Critical Infrastructure Protection:

DHS Action Needed to Verify Some Chemical Facility Information and Manage Compliance Process

GAO-15-614: Published: Jul 22, 2015. Publicly Released: Jul 22, 2015.

Additional Materials:

Contact:

Chris Currie
(404) 679-1875
curriec@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

Since 2007, the Office of Infrastructure Protection's Infrastructure Security Compliance Division (ISCD), within the Department of Homeland Security (DHS), has identified and collected data from approximately 37,000 chemical facilities under its Chemical Facility Anti-Terrorism Standards (CFATS) program and categorized approximately 2,900 as high-risk based on the collected data. However, ISCD used unverified and self-reported data to categorize the risk level for facilities evaluated for a toxic release threat. A toxic release threat exists where chemicals, if released, could harm surrounding populations. One key input for determining a facility's toxic release threat is the Distance of Concern (distance) that facilities report—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure. ISCD requires facilities to calculate the distance using a web-based tool and following DHS guidance. ISCD does not verify facility-reported data for facilities it does not categorize as high-risk for a toxic release threat. However, following DHS guidance and using a generalizable sample of facility-reported data in a DHS database, GAO estimated that more than 2,700 facilities (44 percent) of an estimated 6,400 facilities with a toxic release threat misreported the distance. By verifying that the data ISCD used in its risk assessment are accurate, ISCD could better ensure it has identified the nation's high-risk chemical facilities.

ISCD has made substantial progress approving site security plans but does not have documented processes and procedures for managing facilities that are noncompliant with their approved site security plans. Site security plans outline, among other things, the planned measures that facilities agree to implement to address security vulnerabilities. As of April 2015, GAO estimates that it could take between 9 and 12 months for ISCD to review and approve security plans for approximately 900 remaining facilities—a substantial improvement over the previous estimate of 7 to 9 years GAO reported in April 2013. ISCD officials attributed the increased approval rate to efficiencies in ISCD's security plan review process, updated guidance, and a new case management system. Further, ISCD began conducting compliance inspections in September 2013, but does not have documented processes and procedures for managing the compliance of facilities that have not implemented planned measures outlined in their site security plans. According to the nature of violations thus far, ISCD has addressed noncompliance on a case-by-case basis. Almost half (34 of 69) of facilities ISCD inspected as of February 2015 had not implemented one or more planned measures by deadlines specified in their approved site security plans and therefore were not fully compliant with their plans. GAO found variations in how ISCD addressed these 34 facilities, such as how much additional time the facilities had to come into compliance and whether or not a follow-on inspection was scheduled. Such variations may or may not be appropriate given ISCD's case-by-case approach, but having documented processes and procedures would ensure that ISCD has guidelines by which to manage noncompliant facilities and ensure they close security gaps in a timely manner. Additionally, given that ISCD will need to inspect about 2,900 facilities in the future, having documented processes and procedures could provide ISCD more reasonable assurance that facilities implement planned measures and address security gaps.

Why GAO Did This Study

Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. Within DHS, ISCD oversees this program.

GAO was asked to assess the CFATS program. This report addresses, among other things, the extent to which DHS has (1) categorized facilities as subject to the CFATS regulation, and (2) approved site security plans and conducted compliance inspections. GAO reviewed laws, regulations, and program documents; randomly selected data submitted to ISCD by facilities from 2007 to 2015, tested the data's reliability; and generated estimates for the entire population of facilities, and interviewed officials responsible for overseeing, identifying, categorizing, and inspecting chemical facilities from DHS headquarters and in California, Maryland, Oregon, and Texas (selected based on geographic location and other factors).

What GAO Recommends

GAO recommends, among other things, that DHS (1) verify the Distance of Concern reported by facilities is accurate and (2) document processes and procedures for managing compliance with site security plans. DHS concurred with GAO's recommendations and outlined steps to address them.

For more information, contact Chris Currie at (404) 679-1875 or curriec@gao.gov.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: We found that ISCD used self-reported and unverified data to determine the risk categorization for facilities with a toxic release threat. DHS requires that facilities self-report the Distance of Concern, an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure. Facilities report the Distance of Concern as part of the Top-Screen, which is the initial screening tool whereby chemical facilities report to ISCD information on the chemicals in their possession. Following DHS guidance and using a generalizable sample of facility-reported data in a DHS database, we estimated that more than 2,700 facilities (44 percent) of an estimated 6,400 facilities with a toxic release threat misreported the Distance of Concern. ISCD officials stated that the next iteration of the Top-Screen will not require facilities to calculate and provide a Distance of Concern, but officials did not have a timeline for implementing the new Top-Screen. We recommended that DHS provide milestone dates and a timeline for implementation of a new Top-Screen and ensure that changes to this Top-Screen mitigate errors in the Distance of Concern submitted by facilities. In January 2016, ISCD developed milestone dates for implementing an updated Top-Screen. ISCD stated that the new Top-Screen will no longer require facilities to calculate the Distance of Concern, but rather will collect data from facilities to enable DHS to calculate it to assess risk. These actions are consistent with our recommendation.

    Recommendation: To ensure the accuracy of the data submitted by chemical facilities, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to provide milestone dates and a timeline for implementation of the new Top-Screen and ensure that changes to this Top-Screen mitigate errors in the Distance of Concern submitted by facilities.

    Agency Affected: Department of Homeland Security

  2. Status: Open

    Comments: According to Infrastructure Security Compliance Division (ISCD) officials, ISCD has begun reaching out to facilities with a higher potential for having been miscategorized based on misreported Distance of Concern (DOC) data to ascertain the correct DOC and, if necessary, reassess the facility's level of risk based on corrected DOC information. To identify the facilities to be contacted, ISCD first manually calculated the DOC for all of the release-toxic chemicals of interest (COI) possessed by the approximately 8,500 facilities reporting threshold levels of a release-toxic COI. After removing facilities whose reported DOC was an exact match with the DOC calculated by ISCD, as well as facilities whose previous tier determination was extremely unlikely to change based on a corrected DOC, approximately 1,600 facilities remained whose potentially erroneous DOC information could have caused a miscategorization of the facility's risk level, according to ISCD officials. ISCD then proceeded to calculate a hypothetical tier for each of those approximately 1,600 facilities using the DOC calculated by ISCD. That effort identified approximately 160 facilities whose tier based on ISCD's DOC calculation differs from the tier to which they have currently been assigned. Any of those facilities whose originally reported DOC is confirmed to have been erroneous will be directed to resubmit a new Top-Screen with the correct DOC to allow for a reassessment of their risk level. ISCD anticipates completing this reassessment for all of the subject facilities by the end of the second quarter of fiscal year 2016. We will update the status of this recommendation after additional information is received from DHS. Status as of January 20, 2016.

    Recommendation: To ensure the accuracy of the data submitted by chemical facilities, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD, in the interim, to identify potentially miscategorized facilities with the potential to cause the greatest harm and verify the Distance of Concern these facilities report is accurate.

    Agency Affected: Department of Homeland Security

  3. Status: Open

    Comments: According to Infrastructure Security Compliance Division (ISCD) officials, ISCD is nearing finalization of the updated CFATS Inspection Standard Operating Procedure (SOP) and has made progress on the new CFATS Enforcement SOP. Once completed, these two documents collectively will formally document the processes and procedures currently being used to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans. We will update the status of this recommendation after additional information is received from DHS. Status as of January 20, 2016.

    Recommendation: In addition, to better manage compliance among high-risk chemical facilities and demonstrate program results, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to develop documented processes and procedures to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans.

    Agency Affected: Department of Homeland Security

  4. Status: Closed - Implemented

    Comments: We found that DHS's performance measure for the Chemical Facility Anti-Terrorism Standards (CFATS) program, which was intended to reflect the overall impact of the CFATS regulation on facility security, did not solely capture security measures that were implemented by facilities and verified by ISCD. Instead, the performance measure reflected both existing security measures and planned security measures that facilities intended to implement within the fiscal year. We recommended that the Director of ISCD improve the measurement and reporting of the CFATS program performance by developing a performance measure that includes only planned measures that have been implemented and verified. In December 2015, ISCD finalized its fiscal year 2016 annual operating plan that included verification requirements for the performance measure. Specifically, the new requirement requires that ISCD officials verify that planned measures have been implemented in accordance with the approved site security plan (or alternative security program) by compliance inspection other means before inclusion in the performance measure calculation. ISCD's actions to improve the performance measure verification are consistent with our recommendation.

    Recommendation: In addition, to better manage compliance among high-risk chemical facilities and demonstrate program results, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to improve the measurement and reporting of the CFATS program performance by developing a performance measure that includes only planned measures that have been implemented and verified.

    Agency Affected: Department of Homeland Security

 

Explore the full database of GAO's Open Recommendations »

May 24, 2016

May 17, 2016

Apr 25, 2016

Apr 19, 2016

Apr 15, 2016

Apr 14, 2016

Apr 12, 2016

Mar 31, 2016

Mar 16, 2016

Looking for more? Browse all our products here