Perimeter Security Assessment of the Nation's Five BSL-4 Laboratories
GAO-08-1092: Published: Sep 17, 2008. Publicly Released: Oct 16, 2008.
Biosafety labs under the U.S. Bioterrorism Act are primarily regulated and must be registered with either the Centers for Disease Control and Prevention (CDC) or the U.S. Department of Agriculture (USDA) under the Select Agent Regulations. Currently, all operational biosafety level (BSL) 4 labs are registered with the CDC and thus are regulated by the CDC, not USDA. BSL-4 labs handle the world's most dangerous agents and diseases. In fact, of the four BSL designations, only BSL-4 labs can work with agents for which no cure or treatment exists. GAO was asked to perform a systematic security assessment of key perimeter security controls at the nation's five operational BSL-4 labs. To meet this objective, GAO performed a physical security assessment of the perimeter of each lab using a security survey it developed. GAO focused primarily on 15 physical security controls, based on GAO expertise and research of commonly accepted physical security principles.
Select Agent Regulations do not mandate specific perimeter security controls that need to be in place at each BSL-4 lab, resulting in significant differences in perimeter security between the nation's five labs. While three labs had all or nearly all of the key security controls GAO assessed--features such as perimeter barriers, roving armed guard patrols, and magnetometers in use at lab entrances--two labs demonstrated a significant lack of these controls. Specifically, one lab had all 15 security controls in place, one had 14, and another had 13 of the key controls. However, the remaining two labs had only 4 and 3 key security controls, respectively. Although the presence of the security controls GAO assessed does not automatically ensure a secure perimeter, having most controls provides increased assurance that a strong perimeter security system is in place and reduces the likelihood of unauthorized intrusion. For example, the two labs with fewer security controls lacked both visible deterrents and a means to respond to intrusion. One lab even had a window that looked directly into the room where BSL-4 agents were handled. In addition to creating the perception of vulnerability, the lack of key security controls at these labs means that security officials have fewer opportunities to stop an intruder or attacker. The two labs with fewer security controls were approved by the CDC to participate in the Select Agent Program despite their weaknesses. During the course of our review, GAO noted that the three labs with all or nearly all of the key security controls GAO assessed were subject to additional federal security requirements imposed on them by agencies that owned or controlled the labs, not because of the Select Agent Regulations.
Recommendation for Executive Action
Status: Closed - Implemented
Comments: In 2008, the United States Government Accountability Office (GAO) reported that regulations issued by the Centers for Disease Control (CDC) did not mandate specific perimeter security controls that need to be in place at each BSL-4 lab. We recommended that the CDC, in coordination with USDA, take action to implement specific perimeter security controls for all BSL-4 labs to provide assurance that each lab has a strong perimeter security system in place. In October 2011, in response to our recommendation, CDC in conjunction with USDA published a proposed rule for a tiered security approach, where the labs with the most dangerous biological substances, which includes BSL-4 labs, have minimum security standards. CDC expects the proposed regulations to be in place in October 2012.
Recommendation: To further enhance physical perimeter security at BSL-4 labs regulated by the Division of Select Agents and Toxins (DSAT), the Director, CDC, should take action to implement specific perimeter security controls for all BSL-4 labs to provide assurance that each lab has a strong perimeter security system in place. The CDC should work with USDA to coordinate its efforts, given that both agencies have the authority to regulate select agents.
Agency Affected: Department of Health and Human Services: Public Health Service: Centers for Disease Control