Homeland Security
Federal and Industry Efforts Are Addressing Security Issues at Chemical Facilities, but Additional Action Is Needed
Gao ID: GAO-05-631T April 27, 2005
Terrorist attacks on chemical facilities could severely damage the U.S. economy and public health. About 15,000 facilities produce, use, or store large amounts of chemicals that pose the greatest risk to human health and the environment. While the Environmental Protection Agency (EPA) formerly had the lead role in federal efforts to ensure chemical facility security, the Department of Homeland Security (DHS) is now the lead federal agency responsible for coordinating government and private efforts to protect these facilities from terrorist attacks. This testimony is based on GAO's past work on chemical facility security and focuses on (1) the attractiveness of chemical facilities as terrorist targets, (2) their diversity and risks, (3) federal security requirements for these facilities, and (4) federal and industry efforts to improve facility security.
Experts agree that the nation's chemical facilities are attractive targets for terrorists. The theft or release of certain chemicals could disrupt the local economy, impact other critical infrastructures that rely on chemicals, or impact the health and safety of millions of Americans. For example, a 2002 Brookings Institution report ranks an attack on toxic chemical plants behind only biological and atomic attacks in terms of possible fatalities. While several efforts are underway, no one has yet comprehensively assessed security at the nation's chemical facilities. The chemical sector includes a variety of facilities and risks. The 15,000 facilities with large amounts of the most dangerous chemicals include chemical manufacturers, water supply facilities, and fertilizer facilities, among others. Some facilities may be at higher risk of a terrorist attack than others because of the specific chemicals on site and their proximity to population centers. According to 2003 EPA data, 123 U.S. chemical facilities had "worst-case" scenarios where more than one million people could be at risk of exposure to a cloud of toxic gas. While EPA and DHS believe that these scenarios overstate the potential consequences of a chemical release, there are situations where an attack could have potentially more severe consequences. Only about one-sixth of the 15,000 facilities with large amounts of dangerous chemicals are covered by federal security requirements. About 2,000 community water systems and 238 facilities that are located on waterways and handle "bulk liquid chemicals" must conduct vulnerability assessments, among other things, under the Public Health Security and Bioterrorism Response Act of 2002 and the Maritime Transportation Security Act of 2002, respectively. However, the federal government places requirements on chemical facilities to address accidental releases, which may also reduce the likelihood and mitigate the consequences of terrorist attacks. A number of federal and industry efforts are underway to enhance chemical facility security. DHS is developing a strategy to protect the chemical sector, identify high-risk facilities, and integrate chemical sector protection efforts into a national program. With no authority to require facilities to improve security, DHS has provided the industry with financial assistance, information, and training, assessed facility vulnerability, and recommended security improvements. About 1,100 facilities participate in a voluntary industry effort in which they assess vulnerabilities, develop security plans, and undergo a third party verification that the facilities implemented the identified physical security enhancements. The extent to which the remaining facilities are addressing security is unclear and the extent of chemical facilities' security preparedness is unknown. In this context, a comprehensive national strategy to identify high-risk facilities and require facilities to assess their vulnerabilities, among other actions, would help to ensure that security vulnerabilities at chemical facilities are addressed.
GAO-05-631T, Homeland Security: Federal and Industry Efforts Are Addressing Security Issues at Chemical Facilities, but Additional Action Is Needed
This is the accessible text file for GAO report number GAO-05-631T
entitled 'Homeland Security: Federal and Industry Efforts Are
Addressing Security Issues at Chemical Facilities, but Additional
Action Is Needed' which was released on April 27, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Committee on Homeland Security and Governmental Affairs,
U.S. Senate:
United States Government Accountability Office:
GAO:
For Release on Delivery Expected at 10:00 a.m. EDT:
Wednesday, April 27, 2005:
Homeland Security:
Federal and Industry Efforts Are Addressing Security Issues at Chemical
Facilities, but Additional Action Is Needed:
Statement of John B. Stephenson, Director, Natural Resources and
Environment:
GAO-05-631T:
GAO Highlights:
Highlights of GAO-05-631T, testimony before the Committee on Homeland
Security and Governmental Affairs, U. S. Senate.
Why GAO Did This Study:
Terrorist attacks on chemical facilities could severely damage the U.S.
economy and public health. About 15,000 facilities produce, use, or
store large amounts of chemicals that pose the greatest risk to human
health and the environment. While the Environmental Protection Agency
(EPA) formerly had the lead role in federal efforts to ensure chemical
facility security, the Department of Homeland Security (DHS) is now the
lead federal agency responsible for coordinating government and private
efforts to protect these facilities from terrorist attacks.
This testimony is based on GAO‘s past work on chemical facility
security and focuses on (1) the attractiveness of chemical facilities
as terrorist targets, (2) their diversity and risks, (3) federal
security requirements for these facilities, and (4) federal and
industry efforts to improve facility security.
What GAO Found:
Experts agree that the nation‘s chemical facilities are attractive
targets for terrorists. The theft or release of certain chemicals could
disrupt the local economy, impact other critical infrastructures that
rely on chemicals, or impact the health and safety of millions of
Americans. For example, a 2002 Brookings Institution report ranks an
attack on toxic chemical plants behind only biological and atomic
attacks in terms of possible fatalities. While several efforts are
underway, no one has yet comprehensively assessed security at the
nation‘s chemical facilities.
The chemical sector includes a variety of facilities and risks. The
15,000 facilities with large amounts of the most dangerous chemicals
include chemical manufacturers, water supply facilities, and fertilizer
facilities, among others. Some facilities may be at higher risk of a
terrorist attack than others because of the specific chemicals on site
and their proximity to population centers. According to 2003 EPA data,
123 U.S. chemical facilities had ’worst-case“ scenarios where more than
one million people could be at risk of exposure to a cloud of toxic
gas. While EPA and DHS believe that these scenarios overstate the
potential consequences of a chemical release, there are situations
where an attack could have potentially more severe consequences.
Only about one-sixth of the 15,000 facilities with large amounts of
dangerous chemicals are covered by federal security requirements. About
2,000 community water systems and 238 facilities that are located on
waterways and handle ’bulk liquid chemicals“ must conduct vulnerability
assessments, among other things, under the Public Health Security and
Bioterrorism Response Act of 2002 and the Maritime Transportation
Security Act of 2002, respectively. However, the federal government
places requirements on chemical facilities to address accidental
releases, which may also reduce the likelihood and mitigate the
consequences of terrorist attacks.
A number of federal and industry efforts are underway to enhance
chemical facility security. DHS is developing a strategy to protect the
chemical sector, identify high-risk facilities, and integrate chemical
sector protection efforts into a national program. With no authority to
require facilities to improve security, DHS has provided the industry
with financial assistance, information, and training, assessed facility
vulnerability, and recommended security improvements. About 1,100
facilities participate in a voluntary industry effort in which they
assess vulnerabilities, develop security plans, and undergo a third
party verification that the facilities implemented the identified
physical security enhancements. The extent to which the remaining
facilities are addressing security is unclear and the extent of
chemical facilities‘ security preparedness is unknown. In this context,
a comprehensive national strategy to identify high-risk facilities and
require facilities to assess their vulnerabilities, among other
actions, would help to ensure that security vulnerabilities at chemical
facilities are addressed.
What GAO Recommends:
In March 2003, GAO recommended that DHS and EPA develop (1) a
comprehensive chemical security strategy and (2) a legislative proposal
to require facilities to assess their vulnerability to attacks and
require corrective action. At that time, DHS and EPA generally agreed
with these recommendations and, while EPA no longer has a key role in
ensuring chemical facility security, DHS is taking steps to implement
them.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-631T].
To view the full product, including the scope and methodology, click on
the link above.
For more information, contact John Stephenson at (202) 512-3841 or
[Hyperlink, stephensonj@gao.gov].
[End of Section]
Madame Chairman and Members of the Committee:
Thank you for this opportunity to discuss our work on chemical facility
security.[Footnote 1] As the events of September 11, 2001, showed, a
terrorist attack on infrastructure that is critical to our nation's
economy can cause enormous damage to our country and jeopardize public
health and safety. The USA PATRIOT Act defined critical infrastructure
as those "systems and assets—so vital to the United States that the
incapacity or destruction of such systems and assets would have a
debilitating impact on security, national economic security, national
public health or safety, or any combination of those matters."[Footnote
2] We often take these systems for granted because they are so basic in
our daily lives that we generally only notice them when their service
is interrupted. The President's February 2003 National Strategy for the
Physical Protection of Critical Infrastructures and Key Assets sets
forth the federal government's goals, objectives, and responsibilities
in protecting the nation's critical infrastructure. The strategy, as
well as a presidential directive issued in December 2003, identified
the chemical industry among the sectors that are critical to the
nation's infrastructure.[Footnote 3] The chemical sector produces,
uses, stores, and distributes the chemicals needed to manufacture
thousands of products, such as those used in agriculture,
pharmaceuticals, and automobiles.
The national strategy states that the private sector bears primary
responsibility for protecting their facilities from deliberate acts of
terrorism. While federal, state, and local governments work in
partnership with the private sector to protect chemical facilities,
before September 11, 2001, attention was largely focused on the risks
of accidental, rather than intentional, chemical releases. In this
regard, the Environmental Protection Agency (EPA) regulates about
15,000 facilities under the Clean Air Act because they produce, use, or
store more than certain threshold amounts of specific chemicals that
would pose the greatest risk to human health and the environment if
accidentally released into the air. These facilities must take a number
of steps, including preparing a risk management plan (RMP), to prevent
and prepare for an accidental release and, therefore, are referred to
as "RMP" facilities. While EPA initially had the lead responsibility
for protecting the chemical infrastructure sector, the Department of
Homeland Security (DHS) is now the lead federal agency. DHS is
responsible for coordinating the efforts of government and private
institutions to protect critical infrastructure, including the chemical
sector, from terrorist attacks.
My remarks today are based on our March 2003 and March 2005 reports,
and will focus on (1) experts' views on the attractiveness of chemical
facilities as terrorist targets, (2) the diversity of these facilities
and their risks, (3) federal requirements that address security at
these facilities, and (4) an overview of steps the federal government
and industry have taken to improve facility security. For this work, we
interviewed officials from EPA, DHS, and the Department of Justice;
reviewed pertinent federal legislation, EPA data, and available
reports; and interviewed industry representatives from the American
Chemistry Council, other industry associations, and a number of
chemical companies. We conducted our work according to generally
accepted government auditing standards. We are currently reviewing
ongoing federal and industry efforts to improve chemical facility
security, including the need for further regulation. We plan to issue a
report on our findings later this year.
Summary:
In summary, we found the following:
* Experts agree that the nation's chemical facilities present an
attractive target for terrorists intent on causing massive damage. For
example, the Department of Justice has concluded that the risk of an
attempt in the foreseeable future to cause an industrial chemical
release is both real and credible. Terrorist attacks involving the
theft or release of certain chemicals could significantly impact the
health and safety of millions of Americans, disrupt the local or
regional economy, or impact other critical infrastructures that rely on
chemicals, such as drinking water and wastewater treatment systems.
Despite efforts by DHS to assess facility vulnerabilities and suggest
security improvements, no one has comprehensively assessed security at
facilities that house chemicals nationwide.
* DHS has not yet determined the number and type of facilities that
should be considered as part of the chemical infrastructure sector. The
universe of facilities with chemicals is diverse, and they present a
variety of risks. About 15,000 RMP facilities produce, use, or store
more than threshold amounts of chemicals that EPA has estimated pose
the greatest risk to human health and the environment if they were
accidentally released into the air. RMP facilities include chemical
manufacturers, water supply and wastewater treatment facilities,
agricultural suppliers such as fertilizer facilities, food storage
facilities, pulp and paper manufacturers, and iron and steel mills,
among others. Some facilities may be at higher risk of a terrorist
attack than others because of the chemicals they house and their
proximity to population centers. According to 2003 EPA data, the toxic
"worst-case" scenarios for 123 chemical facilities stated that more
than one million people could be at risk of exposure to a cloud of
toxic gas. About 600 facilities could each potentially threaten between
100,000 and a million people and about 2,300 facilities could each
potentially threaten anywhere from 10,000 to 100,000 people. According
to EPA and DHS, the method for calculating these scenarios overstates
the potential consequences of a chemical release. However, because the
scenarios estimate the effects of an accidental toxic chemical release
involving the greatest amount of the toxic chemical held in a single
vessel or pipe, not the entire quantity on site, an attack that
breached multiple chemical vessels simultaneously could result in a
larger release with potentially more severe consequences than those
outlined in "worst-case" scenarios.
* Currently, no federal requirements comprehensively address security
at all U.S. chemical facilities. Only about one-sixth of the 15,000 RMP
facilities must comply with federal security requirements related to
terrorism. Approximately 2,000 RMP facilities are community water
systems subject to the Public Health Security and Bioterrorism Response
Act of 2002 and therefore must conduct vulnerability analyses of their
facilities, among other things. According to the Coast Guard, 238
chemical facilities that are located on waterways and handle "bulk
liquid chemicals" must assess the vulnerabilities of certain facilities
and develop and implement security plans under the Maritime
Transportation Security Act of 2002 and its implementing regulations.
The remaining chemical facilities are not subject to such security
requirements. Although the federal government does not require all
chemical facilities to adopt security measures against acts of
terrorism, it does impose safety and emergency response requirements on
chemical facilities to address accidental releases. These requirements
may incidentally reduce the likelihood and mitigate the consequences of
terrorist attacks.
* The federal government and the chemical industry have taken a number
of steps to enhance security at chemical facilities but further action
is needed. DHS' Information Analysis and Infrastructure Protection
Directorate is developing a strategy for protecting the chemical
sector, identifying high-risk facilities, and integrating chemical
sector protection efforts into a national program. Without specific
authority to require chemical facilities to improve security, DHS has
worked with the chemical industry by providing financial assistance,
sharing information about critical infrastructure protection, assessing
facility vulnerabilities, recommending security improvements, and
providing training. In addition, the chemical industry, led by its
industry associations, is conducting voluntary initiatives at member
facilities. The primary industry security initiative, the American
Chemistry Council's Responsible Care Management SystemŽ, directs
participating facilities to assess vulnerabilities, develop security
plans, and undergo a third party verification that the facilities
implemented the identified physical security enhancements. These third
parties are not required, however, to verify that the vulnerability
assessment is appropriately conducted and that the actions taken by the
facility adequately address security risks. Nevertheless, ACC's self-
initiated requirements incorporate elements of a risk management
framework and were designed to strengthen security at its members'
facilities. Approximately 1,100 (or 7 percent) of the 15,000 RMP
facilities are members of ACC and the Synthetic Organic Chemical
Manufacturers Association--which represents manufacturers who produce
specialty-chemicals at small-to medium-sized facilities--and, thus, are
to comply with the Responsible CareŽ security requirements. However,
the extent to which the remaining 14,000 RMP facilities, or other
chemical facilities that are not RMP facilities, may be voluntarily
addressing their security is unclear. Consequently, despite government
and industry efforts, the extent of security preparedness at chemical
facilities is unknown.
To ensure that chemical facilities take action to review and address
security vulnerabilities, we recommended in March 2003, that the
Secretary of Homeland Security and the Administrator of EPA jointly
develop a comprehensive national strategy for chemical security that is
both practical and cost effective. The strategy should, among other
things, identify high-risk facilities and collect information on
industry security preparedness. We also recommended that DHS and EPA
develop a legislative proposal, in consultation with industry and other
appropriate groups, to require these chemical facilities to
expeditiously assess their vulnerability to terrorist attacks and,
where necessary, require these facilities to take corrective action. At
that time, DHS and EPA generally agreed with these recommendations.
While EPA no longer has a key role in ensuring chemical facility
security, DHS has taken steps to implement our recommendations. In
February 2005, DHS released its Interim National Infrastructure
Protection Plan. While we have not fully evaluated this plan, it
outlines a risk management framework to guide future efforts to
identify and protect critical infrastructure and defines the roles of
federal, state, local, and tribal agencies and the private sector using
elements of this framework. In addition, DHS is developing a strategic
plan specifically for securing the chemical sector and has a number of
efforts underway to help identify and mitigate chemical facilities'
vulnerabilities. We are evaluating DHS' efforts and plans for improving
chemical sector security in our ongoing review.
In comments responding to our March 2003 report, DHS stated that
voluntary efforts alone will not be sufficient to assure an appropriate
level of security across the industry, and that, in the department's
view, every one of the approximately 15,000 RMP facilities nationwide
should be required to perform comprehensive vulnerability assessments
and take actions to reduce vulnerabilities. As part of our ongoing
review for this Committee, we plan to obtain DHS' current views on
whether legislation is still necessary and, if so, the types of
provisions the agency feels would best assist the nation's chemical
facilities in addressing their vulnerability to attack.
Background:
The Homeland Security Act of 2002 established DHS and set forth its
mission to, among other things, prevent terrorist attacks within the
United States, reduce the vulnerability of the United States to
terrorism, and minimize the damage and assist in the recovery from
terrorist attacks that do occur within the United States. Following
passage of the act, a December 2003 presidential directive states that
DHS is responsible for coordinating the overall national effort to
enhance the protection of the critical infrastructure and key resources
of the United States. The Secretary of Homeland Security serves as the
principal federal official to lead, integrate, and coordinate the
implementation of efforts among federal departments and agencies, state
and local governments, and the private sector to protect critical
infrastructure and key resources. The directive identified the chemical
sector as a critical infrastructure sector along with other sectors,
including agriculture, banking and finance, defense industrial base,
emergency services, energy, food, government, information and
telecommunications, postal and shipping, public health, transportation,
and water. Under this presidential directive, DHS is now the lead
agency for the chemical infrastructure sector, a change from national
strategies issued in July 2002 and February 2003, which named EPA as
the lead federal agency.
The presidential directive emphasized those critical infrastructure and
key resources that could be exploited to cause catastrophic health
effects or mass casualties. Because many chemicals are inherently
hazardous, the release of chemicals or the risk of contamination at
chemical facilities poses a potential threat to public health and the
economy. Under the Clean Air Act's Risk Management Program provisions,
EPA identified 140 toxic and flammable chemicals that, when present
above certain threshold amounts, would pose the greatest risk to human
health and the environment if released accidentally into the air.
According to EPA, approximately 15,000 facilities in a variety of
industries produce, use, or store one or more of these chemicals beyond
threshold amounts in one or more processes (e.g., single or
interconnected vessels or tanks).
Before these functions were transferred to DHS by the Homeland Security
Act of 2002, Justice was responsible for collecting information from
the U.S. intelligence community, the FBI's criminal investigations,
other federal agencies, and the private sector about threats, including
those involving chemicals. The Chemical Safety Information, Site
Security and Fuels Regulatory Relief Act required Justice to review the
vulnerability of chemical facilities to terrorist or criminal attack
and report this information to the Congress.[Footnote 4] Justice
prepared and submitted an interim report to Congress in May 2002 based
on observations made at 11 chemical manufacturing facilities.
Experts Agree that Chemical Facilities Are an Attractive Target for
Terrorists:
Experts agree that the nation's chemical facilities present an
attractive target for terrorists intent on causing massive damage. Many
facilities house toxic chemicals that could become airborne and drift
to surrounding communities if released or could be stolen and used to
create a weapon capable of causing harm. Justice has been warning of
the terrorist threat to chemical facilities for a number of years and
has concluded that the risk of an attempt in the foreseeable future to
cause an industrial chemical release is both real and credible. Based
on analysis of trends in international and domestic terrorism and the
burgeoning interest in weapons of mass destruction among criminals and
terrorists, Justice warned of potential targeting by terrorists of
chemical facilities before the events of September 11, 2001. In fact,
according to Justice, domestic terrorists plotted to use a destructive
device against a U.S. facility that housed millions of gallons of
propane in the late 1990s. In testimony on February 6, 2002, the
Director of the Central Intelligence Agency also warned of the
potential for an attack by al Qaeda on chemical facilities.
Terrorist attacks involving the theft or release of certain chemicals
could have a significant impact on the health and safety of millions of
Americans. The disaster at Bhopal, India in 1984, when methyl
isocyanate gas--a highly toxic chemical--leaked from a tank, reportedly
killing about 3,800 people and injuring anywhere from 150,000 to
600,000 others, illustrates the potential threat to public health from
a chemical release. While U.S. chemical facilities are subject to a
number of safety requirements, the Army has estimated high potential
damage to the U.S. population from an intentional toxic chemical
release. During a 2001 informal meeting with a number of agencies, the
Army Office of the Surgeon General proposed, based on generic
estimates, that it was conceivable that as many as 2.4 million people
could request medical treatment if a terrorist caused the release of a
toxic chemical.[Footnote 5] According to officials from that office,
these estimates include anyone who seeks medical attention as a result
of the release--including people with minor irritations or concerns.
Similarly, a 2002 Brookings Institution report ranks an attack on toxic
chemical plants behind only biological and atomic attacks in terms of
possible fatalities.[Footnote 6] In January 2005 testimony before the
Senate Committee on Homeland Security and Governmental Affairs on
challenges facing DHS, a Brookings Institution Visiting Fellow
identified chemical facility security as a priority for DHS, noting
that toxic industrial chemicals present the potential for mass
casualties from a terrorist attack that is rivaled only by improvised
nuclear devices, certain acts of bioterrorism, and the collapse of
large, occupied buildings.[Footnote 7]
In addition to the potential loss of life, a terrorist attack on a
chemical facility could also disrupt the local or regional economy or
impact other critical infrastructures. The chemical manufacturing
industry produces the chemicals used in agriculture, pharmaceuticals,
drinking water and wastewater treatment systems, and food processing.
DHS' February 2005 Interim National Infrastructure Protection Plan
notes that many critical infrastructure assets are dependent on
multiple elements and systems to remain functional. In some cases, a
failure in one sector will have a significant impact on the ability of
another sector to perform necessary functions. For example, rail
transportation of many hazardous materials including chlorine was
disrupted in some states following the events of September 11, 2001,
because of concern about the potential for an intentional chemical
release. This disruption to rail service impacted drinking water
facilities that relied on chlorine delivered by rail to purify water.
Currently, no one has comprehensively assessed security across the
nation at facilities that house chemicals. Both EPA and DHS officials
have visited some chemical facilities to discuss security since
September 11, 2001, but the results of these visits are not publicly
available. EPA visited 30 high-risk chemical facilities to discuss
security, and DHS has visited a number of chemical facilities to assist
owner/operators in assessing vulnerabilities at their facilities.
During a limited review of chemical industry vulnerabilities conducted
at 11 facilities primarily before September 11, 2001, Justice found
that some chemical facilities may need to implement more effective
security systems and develop alternative means to reduce the potential
consequences of a successful attack. The effectiveness of security at
some facilities may also be in doubt as evidenced by several media
accounts of reporters and environmental activists gaining access to
chemical tanks and computer centers that control manufacturing
processes at facilities in 2001, 2002, and 2003.
Chemical Infrastructure Sector Includes Many Types of Facilities with
Different Risks:
DHS has not yet determined the number and type of facilities that
should be considered as part of the chemical infrastructure sector. The
universe of chemical facilities is diverse in that they produce, use or
store a host of products, including (1) basic chemicals used to
manufacture other products such as fertilizers, plastics, and synthetic
fibers; (2) specialty chemicals used for a specific purpose such as a
functional ingredient or a processing aid in the manufacture of a range
of products such as adhesives and solvents, coatings, industrial gases
and cleaners, and water management chemicals; (3) life science
chemicals consisting of pharmaceuticals and pesticides; and (4)
consumer products such as hair and skin products and cosmetics. In
total, about 15,000 RMP facilities produce, use, or store more than
threshold amounts of one or more of the 140 toxic and flammable
chemicals that EPA has estimated pose the greatest risk to human health
and the environment if accidentally released into the air.
Approximately 4,000 facilities manufacture these chemicals, and
numerous other types of facilities--agricultural suppliers such as
fertilizer facilities, food storage facilities, pulp and paper
manufacturers, iron and steel mills, and computer manufacturing
facilities--also house large quantities of chemicals. While the
universe of chemical facilities is diverse, some of these facilities
are part of other critical infrastructure sectors. For example, about
2,000 of these facilities are community water systems that are part of
the water infrastructure sector.
Some facilities may be at higher risk of a terrorist attack than others
because of the chemicals they house and their proximity to population
centers. Toxic chemicals such as chlorine and ammonia could form a
toxic cloud and drift over neighboring populations if released, while
flammable chemicals such as butane and hydrogen could be used in
destructive devices. Assuming that the objective of an attack is a
catastrophic release of a toxic chemical, attacks on such facilities
could harm a large number of people with health effects ranging from
mild irritation to death. No specific data are available on what the
actual effects of successful terrorist attacks on chemical facilities
would be. However, RMP facilities submit to EPA estimates of the
potential consequences to surrounding communities of hypothetical
"worst-case" accidental chemical releases from their facilities. These
estimates include the residential population located within the range
of a toxic gas cloud produced by a "worst-case" chemical release,
called the "vulnerable zone." According to 2003 EPA data, 123 chemical
facilities located throughout the nation had toxic "worst-case"
scenarios where more than one million people would be in the
"vulnerable zone" and could be at risk of exposure to a cloud of toxic
gas.[Footnote 8] About 600 facilities could each potentially threaten
between 100,000 and a million people, and about 2,300 facilities could
each potentially threaten between 10,000 and 100,000 people within
these facilities' "vulnerable zones."
According to EPA and DHS, the method for calculating "worst-case"
scenario calculations for RMP facilities overstates the potential
consequences of a chemical release. The scenarios do not consider the
potential causes of a release or how different causes or other
circumstances, such as safety features, could lessen the consequences
of a release. Furthermore, the scenarios' "vulnerable zones" include
the population in the entire area surrounding the facility, while the
wind would typically carry the toxic cloud in one direction affecting
only a portion of the area. While officials believe these scenarios are
overstated, there are situations where an attack could result in larger
consequences. EPA regulations require RMP facilities to estimate the
effects of a toxic chemical release involving the greatest amount of
the toxic chemical held in a single vessel or pipe, rather than the
entire quantity on site. Therefore, for some facilities, an attack
could breach multiple chemical vessels simultaneously and could result
in a larger release with potentially more severe consequences than
estimated in the "worst-case" scenario.
Few Federal Requirements Address Security at the Nation's Chemical
Facilities:
Currently, few federal requirements address security at U.S. chemical
facilities. While some chemical facilities must comply with the Public
Health Security and Bioterrorism Response Act of 2002 (Bioterrorism
Act) and the Maritime Transportation Security Act of 2002 (MTSA), many
are not subject to any federal security requirements. The Bioterrorism
Act requires community water systems serving more than 3,300 people to
perform vulnerability analyses of their facilities, among other things.
Many of these facilities may store hazardous chemicals for water
treatment and are not required to implement any risk reduction actions
based on their vulnerability assessments or report to EPA on measures
that have been implemented. EPA estimated in 2003, that approximately
2,000 RMP facilities may be community water systems covered under the
Bioterrorism Act. MTSA and its implementing regulations require
maritime facility owners and operators to conduct assessments of
certain at-risk facilities to identify vulnerabilities, develop
security plans to mitigate these vulnerabilities, and implement the
measures discussed in the security plans. According to the Coast Guard,
238 chemical facilities are located on waterways and handle "bulk
liquid chemicals" are subject to MTSA requirements.
The remaining chemical facilities, including the approximately 13,000
RMP facilities, are subject to no federal requirements specifically
related to improving security against terrorist attacks. Although these
facilities pose different levels of risk depending on the chemicals
they use or store, thousands house quantities of toxic chemicals that
could impact neighboring populations if released. The security
requirements for the chemical sector stand in contrast to a number of
other critical infrastructure sectors that are subject to federal
security requirements. In addition to community water systems, all
commercial nuclear power plants licensed by the Nuclear Regulatory
Commission are subject to a number of security requirements, including
placing physical barriers outside the operating reactor area, limiting
access to vital areas, maintaining a trained security force, and
conducting simulated terrorist attack exercises.
While the federal government does not require all chemical facilities
to take security measures to protect against a terrorist attack, it
does impose safety and emergency response requirements on chemical
facilities, which may incidentally reduce the likelihood and mitigate
the consequences of terrorist attacks. For example, the Emergency
Planning and Community Right to Know Act requires owners and operators
of facilities that maintain specified quantities of certain extremely
hazardous chemicals to annually submit information on their chemical
inventory to state and local emergency response officials. This
information is used to help prepare community response plans in the
event of a chemical incident. Under Section 112(r) of the Clean Air
Act, EPA's Risk Management Program requires owners and operators of
facilities that handle listed extremely hazardous substances over a
threshold amount to prepare and implement a risk management plan to
detect and prevent or minimize accidental releases. In addition to
evaluating "worst-case" accidental release scenarios, facility owners
and operators must implement a program to prevent accidental releases
that includes safety precautions and maintenance, monitoring, training
measures, and must have an emergency response plan. The Department of
Labor's Occupational Safety and Health Administration's process safety
management standard also requires facilities to assess and address the
hazards of their chemical process. These requirements could potentially
mitigate a terrorist attack by (1) providing an incentive to facilities
to reduce or eliminate chemicals below regulated threshold levels, (2)
requiring facilities to implement measures to improve the safety of
areas that are vulnerable to a chemical release, and (3) facilitating
emergency response planning that increases preparedness for a chemical
release--whether intentional or unintentional.
Federal Government and Industry Have Taken Steps to Improve Facility
Security, but Further Action Is Needed:
The federal government and the chemical industry have taken a number of
steps to enhance security at chemical facilities. DHS' Information
Analysis and Infrastructure Protection Directorate has a number of
initiatives underway to develop a strategy for protecting the chemical
sector, identify high-risk facilities, and integrate chemical sector
protection efforts into a national program. In February 2005, DHS
released an Interim National Infrastructure Protection Plan. While we
have not yet fully evaluated this plan, it outlines a risk management
framework to guide future efforts to identify and protect critical
infrastructure and defines the roles of federal, state, local, and
tribal agencies and the private sector. DHS is also developing a
vulnerability and risk assessment methodology designed to assist
facilities with analyzing security, help DHS rank these facilities by
risk, and allow DHS to compare assets across sectors.[Footnote 9]
Without specific authority to require that chemical facilities make
security improvements, DHS has worked voluntarily with the chemical
industry to provide financial assistance, share information about
critical infrastructure protection, provide training and exercises, and
assess facility vulnerabilities and recommend security improvements.
DHS has provided training programs to first responders and facility
security officers and held drills at chemical facilities. DHS has also
provided advice and guidance to state and local partners to reduce
vulnerabilities in buffer zones (the area extending from the facility
to the surrounding community) and conducted site assistance visits.
The chemical sector, led by its industry associations, also has
voluntary initiatives underway at member facilities. Industry
associations have issued security guidance, identified security best
practices, and developed vulnerability assessment methodologies
specific to their members. In addition, industry is assisting DHS in
developing a methodology for assessing risk in the chemical sector. To
provide a mechanism for coordinating with DHS, in June 2004, the
chemical industry established the Chemical Sector Council to identify,
prioritize, and coordinate the protection of the industry's critical
infrastructure and key resources, and to facilitate the sharing of
information about physical and cyber threats, vulnerabilities,
incidents, potential protective measures, and best practices. The
Council is composed of 16 sector associations representing a range of
chemical facilities.[Footnote 10]
The primary security initiative undertaken by the industry directs
participating chemical facilities to assess vulnerabilities and develop
security plans to address them. In this regard, the American Chemistry
Council (ACC)--whose members own or operate approximately 1,000 (or
about 7 percent) of the 15,000 RMP facilities--requires its members to
perform vulnerability assessments, develop plans to mitigate
vulnerabilities, and take actions to implement the plans.[Footnote 11]
Companies are then required to have third parties such as local
emergency responders or local law enforcement officials verify that
physical security enhancements identified in facility plans were
implemented. These third parties are not required, however, to verify
that the vulnerability assessment is appropriately conducted and that
the actions taken by the facility adequately address security risks.
ACC also has a new requirement that independent auditors certify that
member companies have management systems in place. These audits will
confirm that companies have security programs and processes. According
to ACC, all of its members have conducted vulnerability assessments,
and most have completed security enhancements and had them verified.
The Synthetic Organic Chemical Manufacturers Association (SOCMA), which
represents manufacturers who produce specialty chemicals at small-to
medium-sized facilities, also adopted these security requirements for
all of their member facilities, which include 77 of the 15,000 RMP
facilities.[Footnote 12] ACC and SOCMA's self-initiated membership
requirements incorporate elements of a risk management framework, which
can aid in assessing risk by determining which vulnerabilities should
be addressed in what ways within available resources, and were designed
to strengthen security at facilities that comply with its requirements.
The actions required by Responsible CareŽ may exceed efforts taken by
non-participating facilities.
Despite these efforts, the overall extent of security preparedness at
chemical facilities is unknown. While DHS has a number of programs
underway to identify high-risk facilities and assess their
vulnerabilities, these programs are in their infancy. As a result,
neither DHS nor any other federal entity has yet assessed the overall
extent of security preparedness at the nation's chemical facilities.
While chemical industry associations have worked closely with member
companies to evaluate and improve security at facilities, the extent of
participation in voluntary initiatives is unclear. EPA officials
estimated in 2003, that voluntary initiatives led by industry
associations only reach a portion of the 15,000 RMP facilities.
Further, EPA and DHS have stated publicly that voluntary efforts alone
are not sufficient to assure the public of the industry's preparedness.
In this context, a comprehensive national chemical security strategy
that would, among other actions, identify high-risk facilities and
require facilities to assess their vulnerabilities and take any needed
corrective actions would help to ensure that security vulnerabilities
at chemical facilities are addressed.
Conclusions:
Across the nation, thousands of industrial facilities manufacture, use,
or store hazardous chemicals in quantities that could potentially put
large numbers of Americans at risk of injury or death in the event of a
chemical release. Experts agree that chemical facilities are an
attractive target to terrorists because of the potential to harm large
numbers of people and disrupt the economy or other critical
infrastructures. Yet, despite efforts since September 11, 2001, to
protect the nation from terrorism, the extent of security preparedness
at U.S. chemical facilities is unknown. While some other critical
infrastructures are required to assess their vulnerabilities, no
federal requirements are in place to require all chemical facilities to
assess their vulnerabilities and take steps to reduce them. Both the
federal government and the chemical industry have taken steps to
improve security at chemical facilities. However, these efforts have
not involved all facilities with significant quantities of hazardous
chemicals on site. Further action is needed to ensure that the nation's
chemical facilities--which produce, use, and store chemicals vital to
the manufacture of a range of everyday products--are assessing security
vulnerabilities and taking actions to address them.
Madame Chairman, this concludes our prepared statement. We would be
happy to respond to any questions that you or Members of the Committee
may have.
Contacts and Acknowledgements:
For further information about this testimony, please contact me at
(202) 512-3841. Jill Edelson, Joanna Owusu, Debra B. Sebastian, Amy
Webbink, Leigh White, and Vincent P. Price made key contributions to
this statement.
FOOTNOTES
[1] GAO, Homeland Security: Voluntary Initiatives Are Under Way at
Chemical Facilities, but the Extent of Security Preparedness is
Unknown, GAO-03-439 (Washington, D.C.: March 2003) and Protection of
Chemical and Water Infrastructure: Federal Requirements, Actions of
Selected Facilities, and Remaining Challenges, GAO-05-327 (Washington,
D.C.: March 2005).
[2] Pub. L. No. 107-56, § 1016(e) (2001) (codified at 42 U.S.C. §
5195c(e)).
[3] Homeland Security Presidential Directive Number 7 (Washington,
D.C.: December 17, 2003).
[4] Pub. L. No. 106-40, 113 Stat. 207 (1999).
[5] U.S. Army, Draft Medical NBC Hazard Analysis of Chemical-
Biological-Radiological-Nuclear-High Explosive Threat, Possible
Scenarios & Planning Requirements, Army Office of the Surgeon General
(October 2001).
[6] The Brookings Institution, Protecting the American Homeland: A
Preliminary Analysis, (Washington, D.C.: 2002).
[7] Statement of Richard A. Falkenrath, Visiting Fellow, The Brookings
Institution, before the United States Senate Committee on Homeland
Security and Governmental Affairs (January 26, 2005).
[8] "Vulnerable zones" are determined by drawing a circle around a
facility with the radius of the circle equal to the distance a toxic
gas cloud would travel before dissipating to relatively harmless
levels. Because, in an actual event, the toxic cloud would only cover a
fraction of that circle, it is unlikely that the event would actually
result in exposure of the entire population estimated in the "worst-
case" scenario, according to EPA. The number of persons within a
"vulnerable zone" is larger than the number of persons that would be
affected by a "worst-case" scenario. In addition, EPA's requirements
for "worst-case" release analysis tend to result in consequence
estimates that are significantly higher than what is likely to actually
occur. For example, "worst-case" release analysis does not take into
account active mitigation measures facilities often employ to reduce
the consequences of releases.
[9]DHS is developing this methodology--called the Risk Analysis and
Management for Critical Asset Protection (RAMCAP)--in conjunction with
the American Society of Mechanical Engineers.
[10] As of April 2005, Chemical Sector Council members included the
American Chemistry Council, the American Forest and Paper Association,
the Chemical Producers and Distributors Association, the Chlorine
Chemistry Council, the Compressed Gas Association, CropLife America,
the Institute of Makers of Explosives, the International Institute of
Ammonia Refrigeration, the National Association of Chemical
Distributors, the National Paint and Coatings Association, the National
Petrochemical and Refiners Association, the Synthetic Organic Chemical
Manufacturers Association, the Adhesive and Sealant Council, the
Chlorine Institute, the Fertilizer Institute, and the Society of the
Plastics Industry, Inc.
[11] ACC adopted a security code to accompany its Responsible Care
Management SystemŽ, a voluntary program to achieve improvements in
environmental, health, and safety performance through management
practices addressing a range of business activities. Member companies
must comply with Responsible CareŽ requirements as a condition of
membership.
[12] SOCMA has 160 member companies. Thirty-six of these companies are
also members of ACC and follow the Responsible CareŽ requirements. The
remaining 124 SOCMA member companies operate 273 facilities--of which
77 are RMP facilities.