Homeland Security
Federal Action Needed to Address Security Challenges at Chemical Facilities Gao ID: GAO-04-482T February 23, 2004The events of September 11, 2001, triggered a national re-examination of the security of thousands of industrial facilities that use or store hazardous chemicals in quantities that could potentially put large numbers of Americans at risk of serious injury or death in the event of a terrorist-caused chemical release. GAO was asked to examine (1) available information on the threats and risks from terrorism faced by U.S. chemical facilities; (2) federal requirements for security preparedness and safety at facilities; (3) actions taken by federal agencies to assess the vulnerability of the industry; and (4) voluntary actions the chemical industry has taken to address security preparedness, and the challenges it faces in protecting its assets and operations. GAO issued a report on this work in March 2003 (GAO-03-439).
Chemical facilities may be attractive targets for terrorists intent on causing economic harm and loss of life. Many facilities exist in populated areas where a chemical release could threaten thousands. The Environmental Protection Agency (EPA) reports that 123 chemical plants located throughout the nation could each potentially expose more than a million people if a chemical release occurred. To date, no one has comprehensively assessed the security of chemical facilities. No federal laws explicitly require that chemical facilities assess vulnerabilities or take security actions to safeguard their facilities from attack. However, a number of federal laws impose safety requirements on facilities that may help mitigate the effects of a terrorist-caused chemical release. Although EPA believes that the Clean Air Act could be interpreted to require security at certain chemical facilities, the agency has decided not to attempt to require these actions in light of the litigation risk and importance of an effective response to chemical security. Ultimately, no federal oversight or third-party verification ensures that voluntary industry assessments of vulnerability are adequate and that security vulnerabilities are addressed. Currently, the federal government has not comprehensively assessed the chemical industry's vulnerabilities to terrorist attacks. EPA, the Department of Homeland Security (DHS), and the Department of Justice have taken preliminary steps to assist the industry in its preparedness efforts, but no agency monitors or documents the extent to which chemical facilities have implemented security measures. Consequently, federal, state, and local entities lack comprehensive information on the vulnerabilities facing the industry. To its credit, the chemical manufacturing industry, led by its industry associations, has undertaken a number of voluntary initiatives to address security at facilities. For example, the American Chemistry Council, whose members own or operate approximately 1,000, or 7 percent, of the facilities subject to Clean Air Act risk management plan provisions, requires its members to conduct vulnerability assessments and implement security improvements. The industry faces a number of challenges in preparing facilities against attacks, including ensuring that all chemical facilities address security concerns. Despite the industry's voluntary efforts, the extent of security preparedness at U.S. chemical facilities is unknown. In October 2002 both the Secretary of Homeland Security and the Administrator of EPA stated that voluntary efforts alone are not sufficient to assure the public of the industry's preparedness. Legislation is now pending that would mandate chemical facilities to take security steps to protect against the risk of a terrorist attack.
GAO-04-482T, Homeland Security: Federal Action Needed to Address Security Challenges at Chemical Facilities
This is the accessible text file for GAO report number GAO-04-482T
entitled 'Homeland Security: Federal Action Needed to Address Security
Challenges at Chemical Facilities' which was released on February 23,
2004.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Subcommittee on National Security, Emerging Threats, and
International Relations, Committee on Government Reform, House of
Representatives:
United States General Accounting Office:
GAO:
For Release on Delivery Expected at 9:30 a.m. EST:
Monday, February 23, 2004:
Homeland Security:
Federal Action Needed to Address Security Challenges at Chemical
Facilities:
Statement of John B. Stephenson, Director Natural Resources and
Environment:
GAO-04-482T:
GAO Highlights:
Highlights of GAO-04-482T, a testimony before the Committee on
Government Reform, Subcommittee on National Security, Emerging
Threats, and International Relations, House of Representatives
Why GAO Did This Study:
The events of September 11, 2001, triggered a national re-examination
of the security of thousands of industrial facilities that use or
store hazardous chemicals in quantities that could potentially put
large numbers of Americans at risk of serious injury or death in the
event of a terrorist-caused chemical release. GAO was asked to examine
(1) available information on the threats and risks from terrorism
faced by U.S. chemical facilities; (2) federal requirements for
security preparedness and safety at facilities; (3) actions taken by
federal agencies to assess the vulnerability of the industry; and (4)
voluntary actions the chemical industry has taken to address security
preparedness, and the challenges it faces in protecting its assets and
operations. GAO issued a report on this work in March 2003 (GAO-03-
439).
What GAO Found:
Chemical facilities may be attractive targets for terrorists intent on
causing economic harm and loss of life. Many facilities exist in
populated areas where a chemical release could threaten thousands. The
Environmental Protection Agency (EPA) reports that 123 chemical plants
located throughout the nation could each potentially expose more than
a million people if a chemical release occurred. To date, no one has
comprehensively assessed the security of chemical facilities.
No federal laws explicitly require that chemical facilities assess
vulnerabilities or take security actions to safeguard their facilities
from attack. However, a number of federal laws impose safety
requirements on facilities that may help mitigate the effects of a
terrorist-caused chemical release. Although EPA believes that the
Clean Air Act could be interpreted to require security at certain
chemical facilities, the agency has decided not to attempt to require
these actions in light of the litigation risk and importance of an
effective response to chemical security. Ultimately, no federal
oversight or third-party verification ensures that voluntary industry
assessments of vulnerability are adequate and that security
vulnerabilities are addressed.
Currently, the federal government has not comprehensively assessed the
chemical industry‘s vulnerabilities to terrorist attacks. EPA, the
Department of Homeland Security (DHS), and the Department of Justice
have taken preliminary steps to assist the industry in its
preparedness efforts, but no agency monitors or documents the extent
to which chemical facilities have implemented security measures.
Consequently, federal, state, and local entities lack comprehensive
information on the vulnerabilities facing the industry.
To its credit, the chemical manufacturing industry, led by its
industry associations, has undertaken a number of voluntary
initiatives to address security at facilities. For example, the
American Chemistry Council, whose members own or operate approximately
1,000, or 7 percent, of the facilities subject to Clean Air Act risk
management plan provisions, requires its members to conduct
vulnerability assessments and implement security improvements. The
industry faces a number of challenges in preparing facilities against
attacks, including ensuring that all chemical facilities address
security concerns. Despite the industry‘s voluntary efforts, the
extent of security preparedness at U.S. chemical facilities is
unknown. In October 2002 both the Secretary of Homeland Security and
the Administrator of EPA stated that voluntary efforts alone are not
sufficient to assure the public of the industry‘s preparedness.
Legislation is now pending that would mandate chemical facilities to
take security steps to protect against the risk of a terrorist
attack.
What GAO Recommends:
GAO‘s March 2003 report recommended that the Secretary of Homeland
Security and the Administrator of EPA jointly develop a comprehensive
national chemical security strategy that is both practical and cost
effective, which includes assessing vulnerabilities to terrorist
attacks and enhancing security preparedness.
Legislation is now before Congress that, if enacted, would direct DHS,
or DHS and EPA, to adopt most of GAO‘s March 2003 recommendations.
www.gao.gov/cgi-bin/getrpt?GAO-03-439.
To view the full report, including the scope and methodology, click on
the link above. For more information, contact John B. Stephenson at
(202) 512-3841 or stephensonj@gao.gov.
[End of section]
Mr. Chairman and Members of the Subcommittee:
Thank you for the opportunity to discuss our work on the security of
the nation's chemical facilities and the recommendations that we made
to address this issue in our March 2003 report.[Footnote 1]
As the events of September 11, 2001, showed, terrorists can cause
enormous damage to our country by attacking infrastructure essential to
our economy and jeopardizing public health and safety. Following these
events, the President, in the National Strategy for Homeland Security,
identified the chemical industry as one of 13 sectors critical to the
nation's infrastructure. Across the nation, thousands of industrial
facilities manufacture, use, or store hazardous chemicals in quantities
that could potentially put large numbers of Americans at risk of injury
or death in the event of a chemical release.
Even before September 11, 2001, protecting chemical facilities was the
shared responsibility of federal, state, and local governments in
partnership with the private sector. However, attention was focused
largely on the risks of accidental, rather than intentional, chemical
releases. Under the Clean Air Act, the Environmental Protection Agency
(EPA) identified 140 toxic and flammable chemicals that pose the
greatest risk to human health and the environment when present in
certain quantities above threshold levels. According to EPA,
approximately 15,000 facilities in a variety of industries produce,
use, or store one or more of these chemicals beyond threshold amounts.
Under the act, these facilities must take steps to prevent and prepare
for an accidental chemical release, including developing risk
management plans (RMP). These facilities are referred to as RMP
facilities. The events of September 11, 2001, brought heightened
attention to security at chemical facilities and the possibility of a
chemical release caused by a terrorist attack.
The federal government's role in protecting chemical facilities from
terrorist attacks has been much debated since September 11, 2001.
Initially, EPA had the lead responsibility for chemical security;
currently the Department of Homeland Security (DHS) is the lead federal
agency. For both agencies, public debate has centered on whether the
federal government should impose security requirements on chemical
facilities or whether voluntary industry actions are sufficient.
Several legislative proposals have been introduced that address
security measures at chemical facilities, including provisions giving
DHS, or EPA and DHS, authority to mandate security measures at chemical
facilities.
My remarks today will focus on security preparedness at the nation's
chemical facilities. In particular I will (1) summarize available
information on the threats and risks from terrorism that U.S. chemical
facilities face; (2) describe federal requirements for security
preparedness and the safe management of chemicals at these facilities;
(3) describe actions federal agencies have taken to assess the
vulnerability of the chemical industry or to address security
preparedness; and (4) describe voluntary actions the chemical industry
has taken to address security preparedness, and the challenges it faces
in protecting its assets and operations. Our 2003 report was based on
our review of available reports, statutes and regulations, and industry
association documents; interviews with officials from the Department of
Defense, the Department of Justice, EPA, industry associations
including the American Chemistry Council (ACC) and the Synthetic
Organic Chemical Manufacturers Association (SOCMA), and other chemical
industry officials; and selected chemical facility site visits. We
limited our review to stationary chemical facilities and did not
address security concerns surrounding transportation of hazardous
chemicals.[Footnote 2] Appendix I provides additional information on
the processes covered under the Clean Air Act's for RMP facilities, by
industry sector, and the residential population surrounding RMP
facilities that could be threatended by a "worst-case" accidental
chemical release.
Summary:
In summary, experts agree that the nation's chemical facilities may be
attractive targets for terrorists intent on causing massive damage, but
the extent of security preparedness since the events of September 11,
2001, is unknown. The risk of an attack varies among facilities
depending upon several factors, including their location and the types
of chemicals they use, store, or manufacture. No specific data exist on
the actual effects of successful terrorist attacks on chemical
facilities. However, according to EPA data on accidental toxic release
"worst-case" scenarios, 123 chemical facilities located throughout the
nation could each potentially expose more than one million people in
the surrounding area if a toxic release occurred. Approximately 700
facilities could each potentially threaten at least 100,000 people in
the surrounding area, and about 3,000 facilities could each potentially
threaten at least 10,000 people. To date, no one has comprehensively
assessed the security of chemical facilities; however, numerous studies
and media accounts of reporters and environmental activists gaining
access to facilities indicate that vulnerabilities exist.
Unlike water treatment facilities and nuclear power facilities,
chemical facilities are not subject to any federal requirements to
assess and address security vulnerabilities against terrorist attacks.
However, a number of federal laws impose safety requirements that may
help mitigate the effects of a chemical release resulting from a
terrorist attack. A case in point is the Clean Air Act's requirements
that RMP facilities take safety precautions to detect and minimize the
effects of accidental releases, as well as provide prompt emergency
response to a release. Although EPA believes the Clean Air Act could be
interpreted to require security actions at RMP facilities, the agency
has decided not to attempt to require these actions in light of the
litigation risk and importance of an effective response to chemical
security. In addition, under the regulations for the Maritime
Transportation Security Act of 2002, vessels and port facilities--some
of which are chemical facilities--must develop security plans. However,
no federal oversight or third-party verification ensures that voluntary
industry assessments of vulnerability are adequate and that security
vulnerabilities are addressed.
Currently, the federal government has not comprehensively assessed the
chemical industry's vulnerability to terrorist attacks. As a result,
federal, state, and local entities lack comprehensive information on
the vulnerabilities the industry faces. However, federal agencies have
taken some preliminary steps to assist the industry in its preparedness
efforts. For example, EPA has issued warning alerts to the industry and
informally visited about 30 high-risk facilities to learn about and
encourage security efforts. According to EPA officials, EPA has
provided information to DHS about the 15,000 facilities and DHS is
currently identifying high-risk facilities and conducting site visits.
In May 2002, Justice submitted an interim report to Congress that
described observations on security at 11 chemical manufacturing
facilities. As we reported in October 2002, however, Justice has not
prepared a more comprehensive final report to Congress on the
industry's vulnerabilities, which it was required by law to deliver in
August 2002. In a February 2003 conference report on Justice's
appropriations, Congress directed that funding be transferred to DHS
for completing vulnerability assessments at chemical facilities.
Finally, although the chemical industry has undertaken a number of
initiatives to address security concerns, the extent of security
preparedness across the chemical industry is unknown. The American
Chemistry Council--whose 145 member companies own or operate
approximately 1,000 (7 percent) of the 15,000 RMP facilities--now
requires, as a condition of membership, that facilities conduct
security vulnerability assessments and implement security
improvements. EPA officials estimate that voluntary initiatives led by
industry associations only reach a portion of the 15,000 RMP
facilities. Moreover, the industry faces a number of challenges in
preparing facilities against terrorist attacks, including ensuring that
facilities obtain adequate information on threats and determining the
appropriate security measures given the level of risk. In October 2002,
both the Secretary of Homeland Security and the then-Administrator of
EPA stated that voluntary efforts alone are not sufficient to assure
the public of the industry's preparedness. They also stated that they
would support bipartisan legislation to require the 15,000 chemical
facilities nationwide that contain large quantities of hazardous
chemicals to comprehensively assess their vulnerabilities and then act
to reduce them.
In light of the challenges facing the industry and the gravity of the
potential threat, we recommended in March 2003 that the Secretary of
Homeland Security and the Administrator of EPA jointly develop a
comprehensive national strategy for chemical security that is both
practical and cost effective. This national strategy should:
* identify high-risk facilities based on several factors, including the
level of threat, and collect information on industry security
preparedness;
* specify the roles and responsibilities of each federal agency
partnering with the chemical industry;
* develop appropriate information-sharing mechanisms; and:
* develop a legislative proposal, in consultation with industry and
other appropriate groups, to require these chemical facilities to
expeditiously assess their vulnerability to terrorist attacks and,
where necessary, require these facilities to take corrective action.
Legislation is now before Congress that, if enacted, would direct DHS,
or DHS and EPA, to adopt most of these recommendations.
Background:
Chemical facilities manufacture a host of products--including basic
organic chemicals, plastic materials and resins, petrochemicals, and
industrial gases, to name a few. Other facilities, such as fertilizer
and pesticide facilities, pulp and paper manufacturers, water
facilities, and refineries, also house large quantities of chemicals.
EPA has a role in preventing and mitigating accidental releases at
chemical facilities through, among other things, the RMP provisions of
the Clear Air Act. Under these provisions, EPA identified 140 toxic and
flammable chemicals that, when present above certain threshold amounts,
would pose the greatest risk to human health and the environment if
released. According to EPA, approximately 15,000 facilities in a
variety of industries produce, use, or store one or more of these
chemicals beyond threshold amounts.
The 2003 President's National Strategy for the Physical Protection of
Critical Infrastructures and Key Assets sets forth actions that EPA and
DHS will take to secure the chemical infrastructure. The strategy
directs EPA and DHS to promote enhanced site security at chemical
facilities and review current practices and statutory requirements on
the distribution and sale of certain pesticides and industrial
chemicals to help identify whether additional measures are necessary.
DHS is also charged with continuing to develop the Chemical Sector
Information Sharing and Analysis Center, a partnership with industry to
facilitate the collection and sharing of threat information, by
promoting the Center and recruiting chemical industry constituents to
participate. A presidential directive issued in December 2003
designates DHS as the lead federal agency for chemical security, a
change from national strategies issued in July 2002 and February 2003,
which named EPA as the lead.
A number of other critical infrastructures have federal security
requirements. All commercial nuclear power facilities licensed by the
Nuclear Regulatory Commission are subject to a number of security
requirements. The Aviation and Transportation Security Act of 2001
directed the Transportation Security Administration to take over
responsibility for airport screening. The Public Health Security and
Bioterrorism Preparedness and Response Act of 2002 requires community
water systems serving more than 3,300 people to conduct a vulnerability
assessment, prepare an emergency response plan, certify to EPA that the
vulnerability assessment and emergency response plan have been
completed, and provide a copy of the assessment to EPA. To improve
security in our nation's ports, the regulations implementing the
Maritime Transportation Security Act of 2002 direct vessels and
facilities--some of which are chemical facilities--to develop security
plans.[Footnote 3]
Congress is considering several legislative proposals that would grant
DHS, or DHS and EPA, the authority to require chemical facilities to
take security steps. S. 994 requires the Secretary of Homeland Security
to promulgate regulations specifying which facilities should be
required to conduct vulnerability assessments and to prepare and
implement site security plans, a timetable for completing the
vulnerability assessments and security plans, the contents of plans,
and limits on the disclosure of sensitive information. S. 157 would
direct EPA to designate high-priority chemical facilities based on the
threat posed by an unauthorized release and require these facilities to
conduct vulnerability assessments, identify hazards that would result
from a release, and prepare a prevention, preparedness, and response
plan. S. 157 would also require facilities to send these assessments
and plans to EPA. EPA and DHS would jointly review the assessments and
plans to determine compliance. S. 157 would also require that
facilities consider inherently safer practices (referred to as
inherently safer technologies), such as substituting less toxic
chemicals.
An Attack Against Chemical Facilities Could Cause Economic Harm and
Loss of Life:
Experts agree that chemical facilities present an attractive target for
terrorists intent on causing massive damage because many facilities
house toxic chemicals that could become airborne and drift to
surrounding areas if released. Chemical facilities could also be
attractive targets for the theft of chemicals that could be used to
create a weapon capable of causing harm. Justice has concluded that the
risk of an attempt in the foreseeable future to cause an industrial
chemical release is both real and credible. In fact, according to
Justice, domestic terrorists plotted to use a destructive device
against a U.S. facility that housed millions of gallons of propane in
the late 1990s. In testimony on February 6, 2002, the Director of the
Central Intelligence Agency warned of the potential for an attack by al
Qaeda on chemical facilities.
Some chemical facilities may be at higher risk of a terrorist attack
than others because they contain large amounts of toxic chemicals and
are located near population centers. Attacks on such facilities could
harm a large number of people, with health effects ranging from mild
irritation to death, cause large-scale evacuations, and disrupt the
local or regional economy. No specific data are available on what the
actual effects of successful terrorist attacks on chemical facilities
would be. However, RMP facilities must submit to EPA estimates,
including the residential population located within the range of a
toxic gas cloud produced by a "worst-case" chemical release, called the
"vulnerable zone." According to EPA, 123 chemical facilities located
throughout the nation have toxic "worst-case" scenarios where more than
one million people could be at risk of exposure to a cloud of toxic
gas.[Footnote 4] About 600 facilities could each potentially threaten
between 100,000 and a million people, and about 2,300 facilities could
each potentially threaten between 10,000 and 100,000 people within
these facilities' "vulnerable zones.":
According to EPA, "worst-case" scenarios do not consider the potential
causes of a release or how different causes or other circumstances,
such as safety features, could lessen the consequences of a release.
Hence, the "worst-case" scenario calculations would likely be
overstating the potential consequences. However, under the Clean Air
Act, RMP facilities must estimate the effects of a toxic chemical
release involving the greatest amount of the toxic chemical held in a
single vessel or pipe--not the entire quantity on site. Therefore, for
some facilities it is conceivable that an attack where multiple
chemical vessels were breached simultaneously could result in an even
larger release, potentially affecting a larger population than
estimated in the RMP "worst-case" scenarios. Other factors besides
location and the quantity of chemicals onsite could also make a
facility a more attractive target. For example, a facility that is
widely recognizable, located near a historic or iconic symbol, or
critical to supporting other infrastructures could be at higher risk. A
2002 Brookings Institution report ranks an attack on toxic chemical
facilities behind only biological and atomic attacks in terms of
possible fatalities.[Footnote 5]
Currently, no one has comprehensively assessed security across the
nation at facilities that house chemicals. According to a 1999 study by
the Department of Health and Human Services' Agency for Toxic
Substances and Disease Registry (ATSDR), security at chemical
facilities in two communities was fair to very poor. ATSDR observed
security vulnerabilities such as freely accessible chemical barge
terminals and chemical rail cars parked near residential areas in
communities where facilities are located. Following visits to 11
chemical facilities, Justice concluded that some facilities may need to
implement more effective security systems and develop alternative means
to reduce the potential consequences of a successful attack. The ease
with which reporters and environmental activists gained access to
chemical tanks and computer centers that control manufacturing
processes at chemical facilities in recent years also raises doubts
about security effectiveness at some facilities.
No Federal Requirements Specifically Require Chemical Facilities to
Address the Threat of Terrorism:
No federal laws explicitly require all chemical facilities to take
security actions to safeguard their facilities against a terrorist
attack. Although the federal government requires certain chemical
facilities to take security precautions directed to prevent trespassing
or theft, these requirements do not cover a wide range of chemical
facilities and may do little to actually prevent a terrorist attack.
For example, under EPA's regulations implementing the Resource
Conservation and Recovery Act of 1976, facilities that house hazardous
waste generally must take certain security actions, such as posting
warning signs and using a 24-hour surveillance system or surrounding
the active portion of the facility with a barrier and controlled entry
gates.[Footnote 6] However, according to EPA, these requirements would
be applicable to only approximately 21 percent of the 15,000 RMP
facilities. Regulations implementing the Maritime Transportation
Security Act of 2002 also require vessels and port facilities--some of
which are chemical facilities--to develop security plans.
A number of federal laws also impose safety requirements on chemical
facilities, but these requirements do not specifically and directly
address security preparedness against terrorism. Several statutes,
including the Occupational Safety and Health Act, the Clean Air Act,
and the Emergency Planning and Community Right-to-Know Act, impose
safety and emergency response requirements on chemical facilities that
may incidentally reduce the likelihood and mitigate the consequences of
terrorist attacks.[Footnote 7] All of these requirements could
potentially mitigate a terrorist attack in a number of ways. First,
because some of these requirements only apply to facilities with more
than threshold quantities of certain chemicals, facility owners have an
incentive to reduce or eliminate these chemicals, which may make the
facility a less attractive target or minimize the impact of an attack.
Second, both the Clean Air Act risk management plan provisions and the
hazard analyses under the Occupational Safety and Health Act require
facility operators to identify the areas of their facilities that are
vulnerable to a chemical release. When facilities implement measures to
improve the safety of these areas, such as installing sensors and
sprinklers, the impact of a terrorist-caused release may be lessened.
Third, the emergency response plans increase preparedness for a
chemical release--whether intentional or unintentional. While these
safety requirements could mitigate the effects of a terrorist attack,
they do not impose any security requirements, such as conducting
vulnerability assessments and addressing identified problems.
While no law explicitly requires facilities to address the threat of
terrorism, EPA believes that the Clean Air Act could be interpreted to
provide it with authority to address site security from terrorist
attacks at chemical facilities. Section 112(r) of the Clean Air Act--
added by the Clean Air Act Amendments of 1990--imposes certain
requirements on chemical facilities with regard to "accidental
releases." The act defines an accidental release as an unanticipated
emission of a regulated substance or other extremely hazardous
substance into the air. Arguably, any chemical release caused by a
terrorist attack would be unanticipated and thus could be covered under
the Clean Air Act. An interpretation of an unanticipated emission as
including an emission due to a terrorist attack would provide EPA with
authority to require security measures or vulnerability assessments
with regard to terrorism. However, EPA has not attempted to use these
Clean Air Act provisions. EPA is concerned that such an interpretation
would pose significant litigation risk. As we reported in March 2003,
there are a number of practical and legal arguments against this
interpretation. We find that EPA could reasonably interpret its Clean
Air Act authority to cover chemical security, but also agree with the
agency that this interpretation could be open to challenges. At the
time of our 2003 review, EPA supported passage of legislation to
specifically address chemical security.
Federal Agencies Have Not Comprehensively Assessed the Vulnerability of
the Chemical Industry to Terrorism, but Have Taken Some Preliminary
Steps:
Despite a congressional mandate to do so, the federal government has
not conducted the assessments necessary to develop comprehensive
information on the chemical industry's vulnerabilities to terrorist
attacks.[Footnote 8] The Chemical Safety Information, Site Security and
Fuels Regulatory Relief Act of 1999 required Justice to review and
report on the vulnerability of chemical facilities to terrorist or
criminal attack. In May 2002, nearly 2 years after it was due, Justice
prepared and submitted an interim report to Congress that described
observations on security at 11 chemical manufacturing facilities
Justice visited to develop a methodology for assessing vulnerability,
but its observations cannot be generalized to the industry as a whole.
In its fiscal year 2003 budget, Justice asked for $3 million to conduct
chemical plant vulnerability assessments. In the February 2003
conference report on Justice's appropriation act for fiscal year
2003,[Footnote 9] Congress directed that $3 million of the funding
being transferred to DHS to be used for the chemical plant
vulnerability assessments. Justice believes that chemical plant
vulnerability assessments are now part of DHS' mission.
Federal agencies have taken preliminary steps to assist the industry in
its preparedness efforts. While Justice has not assessed the
vulnerability of the chemical industry, it has provided the industry
with a tool for individual facilities to use in assessing their
vulnerabilities. Justice, together with the Department of Energy's
Sandia National Laboratories, developed a vulnerability assessment
methodology for evaluating the vulnerability to terrorist attack of
facilities handling chemicals. The methodology helps facilities
identify and assess threats, risks, and vulnerabilities and develop
recommendations to reduce risk, where appropriate. As the lead federal
agency for the operational response to terrorism, Justice's FBI is
responsible for weapons of mass destruction threat assessment and
communicating warnings. Finally, agents in the FBI's local field
offices provide information and technical assistance to state and local
jurisdictions and to some chemical facilities to bolster their
preparedness to respond to terrorist incidents.
EPA has also taken some actions. Officials have analyzed the agency's
database of RMP facilities to identify high-risk sites for DHS and
Justice's Federal Bureau of Investigation (FBI). But these facilities
are only a portion of the universe of all industrial facilities that
house toxic or hazardous chemicals. At the time of our review, EPA had
not analyzed non-RMP facilities to determine whether any of those
facilities should be considered at high risk for a terrorist attack.
EPA has also issued warning alerts to the industry, hosted training
classes on vulnerability assessment methodologies, and informally
visited about 30 high-risk facilities to learn about and encourage
security efforts. Finally, DHS' Information Analysis and Infrastructure
Protection directorate collects information from the U.S. intelligence
community, other federal agencies, and the private sector. Working with
ACC, an industry association representing chemical manufacturers, DHS
also supports the Chemical Sector Information Sharing and Analysis
Center to collect and share threat information for the chemical
industry. In addition, according to EPA officials, DHS has begun
identifying high-risk facilities and conducting site visits at
facilities. However, neither EPA nor DHS is currently monitoring the
extent to which the industry has implemented security measures.
Chemical Industry Has Taken Voluntary Actions to Address Security
Concerns but Faces Significant Challenges in Preparing Against
Terrorist Attacks:
The chemical manufacturing industry has undertaken a number of
voluntary initiatives to address security concerns at chemical
facilities, including developing security guidelines and tools to
assess vulnerabilities, but major challenges remain. All of the
industry groups with whom we met have taken actions such as forming
security task forces, holding meetings and conferences to share
security information with members, and participating in security
briefings with federal agencies. In response to the terrorist attacks
on September 11, 2001, ACC--whose members own or operate approximately
1,000 RMP facilities ---now requires its members, as a condition of
membership, to rank facilities using a screening tool to evaluate its
facilities' risk level. It also requires facilities to identify,
assess, and address vulnerabilities at facilities using one of several
available vulnerability assessment methodologies. In doing so, ACC
member facilities generally follow a multistep process that includes:
* evaluating on-site chemical hazards, existing safety and security
features, and the attractiveness of the facility as a terrorist target;
* using hypothetical threat scenarios to identify how a facility is
vulnerable to attack; and:
* identifying security measures that create layers of protection around
a facility's most vulnerable areas to detect, delay, or mitigate the
consequences of an attack.
ACC established time frames for completing the vulnerability assessment
and implementing security measures, based on the facility's risk
ranking. ACC reports that the 120 facilities ranked as the highest risk
and 372 facilities ranked as the next highest have completed
vulnerability assessments. Most of ACC's lower-risk facilities are
progressing on schedule. ACC generally requires third-party
verification that the facility has made the improvements identified in
its vulnerability assessment.[Footnote 10]
While these are commendable actions, they do not provide a high level
of assurance that chemical facilities have better protected their
facilities from terrorist attack. First, ACC does not require third
parties to verify that the facility has conducted the vulnerability
assessment appropriately or that its actions adequately address
security risks. Even though compliance with ACC's safety and security
requirements is a condition of membership, we do not believe that its
requirements for facilities to periodically report on compliance with
these requirements is an effective enforcement measurement because ACC
does not verify implementation or evaluate the adequacy of facility
measures. Second, its member facilities comprise only 7 percent of the
facilities required to submit risk management plans to EPA, leaving
about 14,000 other RMP facilities that may not participate in voluntary
security efforts. These facilities include agricultural suppliers, such
as fertilizer facilities; petroleum and natural gas facilities; food
storage facilities; water treatment facilities; and wastewater
treatment facilities, among others. Third, other facilities house
chemicals that EPA has identified as hazardous, but in quantities that
are below the threshold level required to be categorized as RMP
facilities.
Other industry groups are also developing security initiatives, but the
extent of these efforts varies from issuing security guidance to
requiring vulnerability assessments. For example, the American
Petroleum Institute, which represents petroleum and natural gas
facilities, published security guidelines developed in collaboration
with the Department of Energy that are tailored to the differing
security needs of industry sectors. Despite industry associations'
efforts to encourage security actions at facilities, the extent of
participation in voluntary initiatives is unclear. EPA officials
estimate that voluntary initiatives led by industry associations only
reach a portion of the 15,000 RMP facilities. Furthermore, EPA
officials stated that these voluntary initiatives raise an issue of
accountability, since the extent to which industry group members are
implementing voluntary initiatives is unknown.
The chemical industry faces a number of challenges in preparing
facilities against terrorist attacks, including ensuring that
facilities obtain adequate information on threats and determining the
appropriate security measures given the level of risk. Trade
association and industry officials identified a number of concerns
about preparing against terrorist attacks. First, industry officials
noted that they need better threat information from law enforcement
agencies, as well as better coordination among agencies providing
threat information. Second, industry officials report that chemical
companies face a challenge in achieving cost-effective security
solutions, noting that companies must weigh the cost of implementing
countermeasures against the perceived reduction in risk. Industry
groups with whom we spoke indicated that their member companies face
the challenge of effectively allocating limited security resources.
Third, facilities face pressure from public interest groups to
implement inherently safer practices (referred to in the industry as
inherently safer technologies), such as lowering toxic chemical
inventories and redesigning sites to reduce risks. Justice has also
recognized that reducing the quantity of hazardous material may make
facilities less attractive to terrorist attack and reduce the severity
of an attack. While industry recognizes the contribution that
inherently safer technologies can make to reducing the risk of a
terrorist attack, industry officials noted that decisions about
inherently safer technologies require thorough analysis and may shift,
rather than reduce, risks. Finally, industry officials stated that the
industry faces a challenge in engaging all chemical facilities in
voluntary security efforts. ACC has made efforts to enlist facilities
beyond its membership in voluntary security initiatives. The Synthetic
Organic Chemical Manufacturers' Association (SOCMA) adopted ACC's
security code for its member facilities as a condition of membership.
However, the extent to which all partnering companies and associations
implement the requirements is unclear.
Mr. Chairman, this concludes my prepared statement. I would be happy to
respond to any questions that you or Members of the Subcommittee may
have.
Contacts and Acknowledgements:
For further information about this testimony, please contact me at
(202) 512-3841. Joanna Owusu, Vince Price, Carol Herrnstadt Shulman,
and Amy Webbink made key contributions to this statement.
[End of section]
Appendix I: Appendix I RMP-Covered Industrial Processes and Off-Site
Consequences of Worst-Case Chemical Releases:
This appendix presents information on the processes covered under the
Clean Air Act's requirements for risk management plan (RMP) facilities
by industry sector and the residential population surrounding RMP
facilities that could be threatened by a "worst-case" accidental
chemical release.
Table 1: Number and Percent of RMP-Covered Processes by Industry
Sector:
Industry sector: Agriculture & farming, farm supply, fertilizer
production, pesticides;
Number of processes: 6,317;
Percent of processes: 31.
Industry sector: Water supply and wastewater treatment;
Number of processes: 3,753;
Percent of processes: 18.
Industry sector: Chemical manufacturing;
Number of processes: 3,803;
Percent of processes: 18.
Industry sector: Energy production, transmission, transport, and
sale;
Number of processes: 3,038;
Percent of processes: 15.
Industry sector: Food and beverage manufacturing & storage (including
refrigerated warehousing);
Number of processes: 2,366;
Percent of processes: 11.
Industry sector: Chemical warehousing (not including refrigerated
warehousing);
Number of processes: 318;
Percent of processes: 2.
Industry sector: Other[A];
Number of processes: 1,075;
Percent of processes: 5.
Industry sector: Total[B];
Number of processes: 20,670;
Percent of processes: 100.
Source: EPA.
[A] Other represents a large variety of industry sectors including pulp
mills, iron and steel mills, cement manufacturing, and computer
manufacturing.
[B] The total number of covered processes is not equal to the 15,000
RMP facilities because some RMP facilities have more than one covered
process (i.e., a process containing more than a threshold amount of a
covered hazardous chemical).
[End of table]
Figure 1: Number of Facilities with Worst-Case Accidental Release
Scenarios by Residential Population Potentially Threatened:
[See PDF for image]
Notes: EPA, Chemical Accident Risks in U.S. Industry - A Preliminary
Analysis of Accident Risk Data from U.S. Hazardous Chemical Facilities,
Washington, D.C.: September 25, 2000.
This figure includes only those facilities with toxic chemicals that
could lead to a "worst-case" scenario. Facilities that only have
flammable chemical "worst-case" scenarios are not included. Flammable
chemicals affect fewer people because the distance the flammable
substance travels tends to be significantly shorter.
[End of figure]
FOOTNOTES
[1] U.S. General Accounting Office, Homeland Security: Voluntary
Initiatives Are Under Way at Chemical Facilities, but the Extent of
Security Preparedness Is Unknown, GAO-03-439 (Washington, D.C.: Mar.
14, 2003).
[2] For information on the transportation of hazardous material, see
U.S. General Accounting Office, Rail Safety and Security: Some Actions
Already Taken to Enhance Rail Security, but Risk-based Plan Needed,
GAO-03-435 (Washington, D.C.: April 2003) and U.S. General Accounting
Office, Transportation Security: Federal Action Needed to Help Address
Security Challenges, GAO-03-843 (Washington, D.C.: June 2003).
[3] In responding to our draft, EPA noted that approximately 2,000 RMP
facilities may be covered under the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002.
[4] "Vulnerable zones" are determined by drawing a circle around a
facility with the radius of the circle equal to the distance a toxic
gas cloud would travel before dissipating to relatively harmless
levels. Because, in an actual event, the toxic cloud would only cover a
fraction of that circle, it is unlikely that the event would actually
result in exposure of the entire population estimated in the "worst-
case" scenario, according to EPA. The number of persons within a
"vulnerable zone" is larger than the number of persons that would be
affected by a "worst-case" scenario. In addition, EPA's requirements
for "worst-case" release analysis tend to result in consequence
estimates that are significantly higher than what is likely to actually
occur. For example, "worst-case" release analysis does not take into
account active mitigation measures facilities often employ to reduce
the consequences of releases.
[5] The Brookings Institution, Protecting the American Homeland: A
Preliminary Analysis, (Washington, D.C.: 2002).
[6] 40 C.F.R. § 264.14.
[7] We focus our discussion in this testimony on those requirements
dealing with assessments of hazards and emergency response. However,
the Toxic Substances Control Act also may mitigate the consequences of
a terrorist attack by limiting or eliminating certain toxic chemicals
that a facility manufactures or uses.
[8] For a discussion on Justice's actions to assess the chemical
industry's vulnerability to terrorist attack, see U.S. General
Accounting Office, Homeland Security: Department of Justice's Response
to Its Congressional Mandate to Assess and Report on Chemical Industry
Vulnerabilities, GAO-03-24R (Washington, D.C.: Oct. 10, 2002).
[9] H.R. Conf. Rept. No. 108-10, at 600 (2003).
[10] The lowest-risk facilities may use a less rigorous methodology to
identify and make security enhancements and are not required to obtain
third-party verification that improvements have been made. In addition,
by December 2005, member companies will have to had their compliance
with safety and security requirements certified by independent third-
party auditors.
