Homeland Security
EPA's Management of Clean Air Act Chemical Facility Data Gao ID: GAO-03-509R March 14, 2003The events of September 11, 2001, triggered a national re-examination of the security of many of the nation's critical infrastructures. Following these events, government agencies have struggled to find the right balance between the public's "right to know" and the dangers of inappropriate public disclosure of sensitive information. Professional and trade groups representing critical infrastructure sectors including the chemical industry generally oppose the release of information regarding the vulnerability of such facilities. These groups argue that terrorists could use this information to target the chemical facilities that are most vulnerable or located near population centers. Other groups support communities' right to information about hazards to which they might be exposed. Federal, state, and local governments have weighed these factors in reassessing the information publicly available in their publications and on their Web sites. For this reason, the Environmental Protection Agency (EPA) is currently reviewing its management of the chemical facility information it has obtained under Clean Air Act provisions. Regulations promulgated under Section 112(r) of the Clean Air Act as amended in 1990 require chemical facilities that produce, use, or store certain hazardous chemicals beyond threshold amounts to develop a risk management plan (RMP)to detect and prevent or minimize accidental chemical releases. Facilities prepare and submit RMPs to EPA at least every 5 years. RMPs contain data about the types and amounts of hazardous chemicals in covered processes at a facility; a facility's accident history; accident mitigation and prevention measures that are in place; a facility's prevention and emergency response program; and the potential effect an accidental chemical release could have on the surrounding population, including whether schools and residences are located within the area potentially affected by a chemical release. Section 112(r) states that RMPs must be made available to the public, as well as to state and local agencies responsible for responding to accidental chemical releases.
In a report issued today, we discuss issues surrounding chemical industry security, including the threat posed by chemical facilities, federal requirements addressing chemical facility security and the safe management of chemicals, steps taken by federal agencies to assess and address security, and voluntary industry actions taken to address security concerns. As part of our study of issues surrounding chemical industry security, GAO also examined EPA's management of Clean Air Act chemical facility data. In this report we describe EPA's actions to modify management of RMP data in response to the increased terrorist threat since the events of September 11, 2001.
GAO-03-509R, Homeland Security: EPA's Management of Clean Air Act Chemical Facility Data
This is the accessible text file for GAO report number GAO-03-509R
entitled 'Homeland Security: EPA's Management of Clean Air Act Chemical
Facility Data' which was released on March 18, 2003.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products‘ accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
March 14, 2003:
The Honorable W.J. ’Billy“ Tauzin:
Chairman, Committee on Energy:
and Commerce:
House of Representatives:
The Honorable John Shimkus:
House of Representatives:
Subject: Homeland Security: EPA‘s Management of Clean Air Act Chemical
Facility Data:
The events of September 11, 2001, triggered a national re-examination
of the security of many of the nation‘s critical infrastructures.
Following these events, government agencies have struggled to find the
right balance between the public‘s ’right to know“ and the dangers of
inappropriate public disclosure of sensitive information. Professional
and trade groups representing critical infrastructure sectors including
the chemical industry generally oppose the release of information
regarding the vulnerability of such facilities. These groups argue that
terrorists could use this information to target the chemical facilities
that are most vulnerable or located near population centers. Other
groups support communities‘ right to information about hazards to which
they might be exposed. Federal, state, and local governments have
weighed these factors in reassessing the information publicly available
in their publications and on their Web sites. For this reason, the
Environmental Protection Agency (EPA) is currently reviewing its
management of the chemical facility information it has obtained under
Clean Air Act provisions.
Regulations promulgated under Section 112(r) of the Clean Air Act as
amended in 1990 require chemical facilities that produce, use, or store
certain hazardous chemicals beyond threshold amounts to develop a risk
management plan (RMP) to detect and prevent or minimize accidental
chemical releases. Facilities prepare and submit RMPs to EPA at least
every 5 years. RMPs contain data about the types and amounts of
hazardous chemicals in covered processes at a facility; a facility‘s
accident history; accident mitigation and prevention measures that are
in place; a facility‘s prevention and emergency response program; and
the potential effect an accidental chemical release could have on the
surrounding population, including whether schools and residences are
located within the area potentially affected by a chemical release.
Section 112(r) states that RMPs must be made available to the public,
as well as to state and local agencies responsible for responding to
accidental chemical releases.
In a report issued today, we discuss issues surrounding chemical
industry security, including the threat posed by chemical facilities,
federal requirements addressing chemical facility security and the safe
management of chemicals, steps taken by federal agencies to assess and
address security, and voluntary industry actions taken to address
security concerns.[Footnote 1] As part of our study of issues
surrounding chemical industry security, you also asked us to examine
EPA‘s management of Clean Air Act chemical facility data. In this
report we describe EPA‘s actions to modify management of RMP data in
response to the increased terrorist threat since the events of
September 11, 2001.
Background:
To implement the requirement in the Clean Air Act Amendments of 1990
for public access to chemical facilities‘ RMPs, EPA planned to make
RMPs including analysis of the potential impact of a chemical release
on the surrounding population, referred to as ’off-site consequences
analysis“ (OCA), available to the public over the Internet. However, in
response to concerns by Justice‘s Federal Bureau of Investigation and
other representatives of the law enforcement and intelligence
communities, EPA decided not to make the sections of facility RMPs
consisting of OCA available on its Web site. Subsequently, Congress
enacted legislation that limited access to those sections following
testimony expressing concerns about the risk to national security
associated with posting RMP data on the Internet. The Chemical Safety
Information, Site Security and Fuels Regulatory Relief Act of
1999[Footnote 2] established specific provisions for public access to
portions of RMPs that consist of OCA. Specifically, the act made the
OCA portions of RMPs and any EPA databases created from those portions
unavailable under the Freedom of Information Act for at least one year
while the federal government assessed the risks of posting OCA
information on the Internet and the benefits of providing public access
to the information. The act directed the President to issue regulations
at the end of the 1-year period governing distribution of OCA
information in a manner that minimizes the likelihood of accidental
releases, the increased risk of terrorist or criminal activity
associated with posting OCA information on the Internet, and the
likelihood of harm to public health and welfare. The act requires that
the regulations allow any member of the public to access paper copies
of OCA information for a limited number of facilities located anywhere
in the U.S. and grants other public access as appropriate. The act also
directs that the regulations provide ’covered persons,“ such as
government officials, access to OCA information for official use. The
act includes specific limitations on the:
dissemination by covered persons of OCA information and any statewide
or national ranking derived from that information. In addition, the act
establishes criminal penalties for disclosing OCA information in a
manner not allowed by the act or regulations. The act did not affect
access to other non-OCA RMP information, such as accident history and
prevention and emergency response program information. This information
remained available through the Internet and the Freedom of Information
Act.
Final Rule Covers Management of Most RMP Information:
Following enactment of the Chemical Safety Information, Site Security
and Fuels Regulatory Relief Act, EPA and the Department of Justice
(Justice) conducted assessments of the risks of posting OCA information
on the Internet and the benefits of providing public access to the
information and issued a Final Rule in August 2000 providing methods
for access to OCA information.[Footnote 3] The Final Rule established
reading rooms as the primary means for the public to access OCA
information. In response to the Final Rule, EPA and Justice established
54 reading rooms located across the nation to provide public access to
OCA information. EPA operates 17 reading rooms primarily through its
regional offices, while Justice operates 37 reading rooms in federal
offices around the country.[Footnote 4] The Final Rule allows members
of the public to view OCA information for all facilities within the
jurisdiction of the local emergency response committee (established
under the Emergency Preparedness and Community Right-to-Know Act) in
which an individual lives or works and for facilities with potential
off-site consequences that could affect that jurisdiction, as well as
OCA information for up to 10 facilities per month from any part of the
country. Individuals may read facility OCA information, but may not
mechanically reproduce or remove this information from the reading
room. EPA issued guidance to regional offices on developing reading
room procedures in compliance with the Final Rule and reviewed all
region-specific management procedures.
The Final Rule also allows covered persons, defined by the act and
regulations as federal, state, and local government officials,
contractors and agents, members of state and local emergency response
organizations, and qualified researchers, access to OCA information for
official purposes. Federal government officials have access to all OCA
information for official use in electronic form or, by request, in
paper form. State and local government officials have access to OCA
information for facilities located in their state and other states upon
request. The Final Rule states that qualified researchers will have
access to OCA information under a separate system. However, EPA is not
currently developing a system. Covered persons are generally prohibited
from disseminating OCA information to the public or to state and local
government officials. However, state and local government officials can
disseminate the information to other state and local government
officials in their state or in a contiguous state. They can also share
OCA data elements--pieces of OCA information that are not in the format
of restricted OCA portions of RMPs or in the format of EPA‘s electronic
database. EPA states that it receives hundreds of written requests from
covered persons for RMPs including restricted OCA information, and
disseminates information in response to these requests in accordance
with the Final Rule.
Further, the Final Rule makes available on the Internet only OCA data
elements that a Justice risk assessment concluded would pose the least
security risk if posted on the Internet. The Final Rule specifies that
only the following OCA data elements will be available through EPA‘s
Web site:
* concentration and physical state of the facility‘s chemical;
* duration of the chemical release under the worst-case scenario and
the endpoint used for flammable chemicals in the worst-case scenario;
* the statistical model used;
* wind speed during the chemical release, atmospheric stability, and
topography of the surrounding area; and:
* safety mitigation systems the facility considered.
The Final Rule precludes posting other OCA data elements such as the
name and quantity of facilities‘ worst-case scenario chemicals,
residential population that could be affected by a facility‘s worst-
case chemical release, and maps or graphics illustrating the worst-case
scenario.
OCA information and other RMP data may also be available to the public
through state and local emergency planning organizations and through
chemical facilities. The Final Rule encourages local and state
emergency planning organizations to provide read-only access to
information about facilities located within an individual‘s emergency
response jurisdiction or with potential off-site consequences that
could affect the jurisdiction. EPA officials told us that while the
agency still encourages state and local organizations to share OCA
information with the public, it also provides guidance to these
organizations on complying with statutory and regulatory restrictions
on distributing the information. EPA officials told us that state and
local organizations continue to share RMP data and, to a lesser extent,
OCA information with the public, but on a more limited basis since
September 11, 2001. In addition, the public may receive information
about facilities‘ risks and potential off-site consequences through
public meetings. Virtually all facilities were required by the Chemical
Safety Information, Site Security and Fuels Regulatory Relief Act to
hold one public meeting to describe and discuss the local effects of
their RMPs, including a summary of OCA portions of their RMPs.
EPA Has Modified Management of Information, but Further Changes Would
Require Legislative or Regulatory Action:
In response to heightened concern about terrorist attacks after
September 11, 2001, EPA made changes to its dissemination of RMP data.
Because of concerns about security, EPA removed the RMP database posted
on its Web site on September 20, 2001.[Footnote 5] Furthermore,
officials at some EPA regional offices told us they made minor changes
to their reading room operations to exercise more caution over OCA
information after September 11, 2001. For example, EPA regional
officials told us that two regions began conducting limited background
checks through the agency‘s Criminal Investigation Division units
before allowing individuals to access the information. In response, EPA
headquarters officials advised regions against implementing additional
safeguards inconsistent with the Final Rule.
In general, the public has shown limited interest in accessing OCA
information, both before and after September 11, 2001. Most EPA reading
rooms had not hosted a visit before September 11, 2001. EPA officials
report that EPA‘s 17 reading rooms hosted about 180 visits in 2002, and
a total of more than 200 visits since the reading rooms were
created.[Footnote 6] These numbers may include repeated visits by the
same individual. Moreover, EPA officials told us that the agency has
received 18 requests for RMP data from members of the public by e-mail
or in writing; 14 requests were received after September 11, 2001. EPA
responded to all requests for RMP data excluding OCA information. The
agency provided two additional requesters with the entire RMP database,
excluding OCA information and RMP executive summaries. With the consent
of these requesters, the agency excluded executive summaries because of
increased concern over descriptions of OCA contained in this portion of
some facilities‘ RMPs.
EPA officials reported that changes to the management of RMP data were
made in response to the increased threat of terrorist activity, not in
response to any breaches in the security of OCA information or the RMP
database generally. EPA officials told us that to their knowledge, no
unauthorized access to OCA information has occurred. OCA information
has been distributed in other formats to members of the public. For
example, in several instances, journalists have accessed OCA
information in reading rooms and then published lists identifying the
most dangerous chemical facilities in a geographic area. These reports
included facility names, the toxic chemicals housed at each facility,
and the number of people that a chemical release at each facility could
potentially affect. Chemical industry groups have voiced concern over
this dissemination of facility information, arguing that terrorists
could use the information to target facilities that are most vulnerable
or located near large population centers. EPA officials also stated
that some environmental and public interest groups copied the RMP
database, which did not include OCA data elements other than those
elements found less sensitive by Justice, from EPA‘s Web site prior to
September 2001 and made this data available on the Internet. However,
officials stated that this information will become outdated as time
passes because EPA has not made available the updated facility RMPs it
receives.
EPA is currently reviewing its management of RMP data. EPA officials
are working with Justice to determine whether to put RMPs, excluding
restricted OCA information, back on the Internet and whether to
restrict public access to other portions of RMPs such as executive
summaries, which contain descriptions of OCA information. Even before
the events of September 11, 2001, Justice expressed significant concern
over general, public access to sensitive information included in
chemical facility RMPs, which Justice concluded is particularly
attractive targeting information for terrorists. Justice supports draft
legislation that would better protect OCA information and prohibit
general, public access to OCA information in facility RMPs. Because the
existing statutory and regulatory framework governs access to RMPs and
OCA information, EPA officials stated that additional changes to the
management and distribution of this data would require legislative or
regulatory action.
Agency Comments and Our Evaluation:
We provided a draft of this letter to EPA for its review and comment.
EPA agreed with the letter‘s facts and provided technical comments and
clarifications, which we incorporated as appropriate.
Scope and Methodology:
To determine EPA‘s management of Clean Air Act data under the Section
112(r) Risk Management Plan provisions, we interviewed officials from
EPA headquarters and officials from EPA‘s 10 regional offices. We also
reviewed statutes and regulations to determine the relevant statutory
framework. In addition, we spoke with Justice about the agency‘s
procedures for operating reading rooms.
We conducted our work from April 2002 through March 2003 in accordance
with generally accepted government auditing standards.
As agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution of it until 30
days after the date of this letter. At that time, we will send copies
to other interested parties and make copies available to others who
request them. In addition, the report will be available on GAO‘s Web
site at http://www.gao.gov.
If you or your staff have any questions about this letter, please
contact me or Peg Reese at (202) 512-3841. Major contributors to this
report were Paige Gilbreath, Joanna McFarland, Amy Webbink, and Leigh
White.
John B. Stephenson
Director, Natural Resources and Environment:
(360311):
FOOTNOTES
[1] U.S. General Accounting Office, Homeland Security: Voluntary
Initiatives Are Under Way at Chemical Facilities, but the Extent of
Security Preparedness Is Unknown (GAO-03-439, Mar. 14, 2003).
[2] P.L. 106-40, 113 Stat. 207 (1999).
[3] 65 Fed. Reg. 48108 (Aug. 4, 2000).
[4] Justice generally administers its reading rooms similarly to EPA
reading rooms.
[5] Non-OCA RMP information remained available through the Freedom of
Information Act.
[6] Justice reports that its 37 reading rooms have hosted fewer than 50
visits.
