This is the accessible text file for GAO report number GAO-03-509R 
entitled 'Homeland Security: EPA's Management of Clean Air Act Chemical 
Facility Data' which was released on March 18, 2003.



This text file was formatted by the U.S. General Accounting Office 

(GAO) to be accessible to users with visual impairments, as part of a 

longer term project to improve GAO products’ accessibility. Every 

attempt has been made to maintain the structural and data integrity of 

the original printed product. Accessibility features, such as text 

descriptions of tables, consecutively numbered footnotes placed at the 

end of the file, and the text of agency comment letters, are provided 

but may not exactly duplicate the presentation or format of the printed 

version. The portable document format (PDF) file is an exact electronic 

replica of the printed version. We welcome your feedback. Please E-mail 

your comments regarding the contents or accessibility features of this 

document to Webmaster@gao.gov.



March 14, 2003:



The Honorable W.J. “Billy” Tauzin:



Chairman, Committee on Energy:



and Commerce:



House of Representatives:



The Honorable John Shimkus:



House of Representatives:



Subject: Homeland Security: EPA’s Management of Clean Air Act Chemical 

Facility Data:



The events of September 11, 2001, triggered a national re-examination 

of the security of many of the nation’s critical infrastructures. 

Following these events, government agencies have struggled to find the 

right balance between the public’s “right to know” and the dangers of 

inappropriate public disclosure of sensitive information. Professional 

and trade groups representing critical infrastructure sectors including 

the chemical industry generally oppose the release of information 

regarding the vulnerability of such facilities. These groups argue that 

terrorists could use this information to target the chemical facilities 

that are most vulnerable or located near population centers. Other 

groups support communities’ right to information about hazards to which 

they might be exposed. Federal, state, and local governments have 

weighed these factors in reassessing the information publicly available 

in their publications and on their Web sites. For this reason, the 

Environmental Protection Agency (EPA) is currently reviewing its 

management of the chemical facility information it has obtained under 

Clean Air Act provisions.



Regulations promulgated under Section 112(r) of the Clean Air Act as 

amended in 1990 require chemical facilities that produce, use, or store 

certain hazardous chemicals beyond threshold amounts to develop a risk 

management plan (RMP) to detect and prevent or minimize accidental 

chemical releases. Facilities prepare and submit RMPs to EPA at least 

every 5 years. RMPs contain data about the types and amounts of 

hazardous chemicals in covered processes at a facility; a facility’s 

accident history; accident mitigation and prevention measures that are 

in place; a facility’s prevention and emergency response program; and 

the potential effect an accidental chemical release could have on the 

surrounding population, including whether schools and residences are 

located within the area potentially affected by a chemical release. 

Section 112(r) states that RMPs must be made available to the public, 

as well as to state and local agencies responsible for responding to 

accidental chemical releases.



In a report issued today, we discuss issues surrounding chemical 

industry security, including the threat posed by chemical facilities, 

federal requirements addressing chemical facility security and the safe 

management of chemicals, steps taken by federal agencies to assess and 

address security, and voluntary industry actions taken to address 

security concerns.[Footnote 1] As part of our study of issues 

surrounding chemical industry security, you also asked us to examine 

EPA’s management of Clean Air Act chemical facility data. In this 

report we describe EPA’s actions to modify management of RMP data in 

response to the increased terrorist threat since the events of 

September 11, 2001.



Background:



To implement the requirement in the Clean Air Act Amendments of 1990 

for public access to chemical facilities’ RMPs, EPA planned to make 

RMPs including analysis of the potential impact of a chemical release 

on the surrounding population, referred to as “off-site consequences 

analysis” (OCA), available to the public over the Internet. However, in 

response to concerns by Justice’s Federal Bureau of Investigation and 

other representatives of the law enforcement and intelligence 

communities, EPA decided not to make the sections of facility RMPs 

consisting of OCA available on its Web site. Subsequently, Congress 

enacted legislation that limited access to those sections following 

testimony expressing concerns about the risk to national security 

associated with posting RMP data on the Internet. The Chemical Safety 

Information, Site Security and Fuels Regulatory Relief Act of 

1999[Footnote 2] established specific provisions for public access to 

portions of RMPs that consist of OCA. Specifically, the act made the 

OCA portions of RMPs and any EPA databases created from those portions 

unavailable under the Freedom of Information Act for at least one year 

while the federal government assessed the risks of posting OCA 

information on the Internet and the benefits of providing public access 

to the information. The act directed the President to issue regulations 

at the end of the 1-year period governing distribution of OCA 

information in a manner that minimizes the likelihood of accidental 

releases, the increased risk of terrorist or criminal activity 

associated with posting OCA information on the Internet, and the 

likelihood of harm to public health and welfare. The act requires that 

the regulations allow any member of the public to access paper copies 

of OCA information for a limited number of facilities located anywhere 

in the U.S. and grants other public access as appropriate. The act also 

directs that the regulations provide “covered persons,” such as 

government officials, access to OCA information for official use. The 

act includes specific limitations on the:



dissemination by covered persons of OCA information and any statewide 

or national ranking derived from that information. In addition, the act 

establishes criminal penalties for disclosing OCA information in a 

manner not allowed by the act or regulations. The act did not affect 

access to other non-OCA RMP information, such as accident history and 

prevention and emergency response program information. This information 

remained available through the Internet and the Freedom of Information 

Act.



Final Rule Covers Management of Most RMP Information:



Following enactment of the Chemical Safety Information, Site Security 

and Fuels Regulatory Relief Act, EPA and the Department of Justice 

(Justice) conducted assessments of the risks of posting OCA information 

on the Internet and the benefits of providing public access to the 

information and issued a Final Rule in August 2000 providing methods 

for access to OCA information.[Footnote 3] The Final Rule established 

reading rooms as the primary means for the public to access OCA 

information. In response to the Final Rule, EPA and Justice established 

54 reading rooms located across the nation to provide public access to 

OCA information. EPA operates 17 reading rooms primarily through its 

regional offices, while Justice operates 37 reading rooms in federal 

offices around the country.[Footnote 4] The Final Rule allows members 

of the public to view OCA information for all facilities within the 

jurisdiction of the local emergency response committee (established 

under the Emergency Preparedness and Community Right-to-Know Act) in 

which an individual lives or works and for facilities with potential 

off-site consequences that could affect that jurisdiction, as well as 

OCA information for up to 10 facilities per month from any part of the 

country. Individuals may read facility OCA information, but may not 

mechanically reproduce or remove this information from the reading 

room. EPA issued guidance to regional offices on developing reading 

room procedures in compliance with the Final Rule and reviewed all 

region-specific management procedures.



The Final Rule also allows covered persons, defined by the act and 

regulations as federal, state, and local government officials, 

contractors and agents, members of state and local emergency response 

organizations, and qualified researchers, access to OCA information for 

official purposes. Federal government officials have access to all OCA 

information for official use in electronic form or, by request, in 

paper form. State and local government officials have access to OCA 

information for facilities located in their state and other states upon 

request. The Final Rule states that qualified researchers will have 

access to OCA information under a separate system. However, EPA is not 

currently developing a system. Covered persons are generally prohibited 

from disseminating OCA information to the public or to state and local 

government officials. However, state and local government officials can 

disseminate the information to other state and local government 

officials in their state or in a contiguous state. They can also share 

OCA data elements--pieces of OCA information that are not in the format 

of restricted OCA portions of RMPs or in the format of EPA’s electronic 

database. EPA states that it receives hundreds of written requests from 

covered persons for RMPs including restricted OCA information, and 

disseminates information in response to these requests in accordance 

with the Final Rule.



Further, the Final Rule makes available on the Internet only OCA data 

elements that a Justice risk assessment concluded would pose the least 

security risk if posted on the Internet. The Final Rule specifies that 

only the following OCA data elements will be available through EPA’s 

Web site:



* concentration and physical state of the facility’s chemical;



* duration of the chemical release under the worst-case scenario and 

the endpoint used for flammable chemicals in the worst-case scenario;



* the statistical model used;



* wind speed during the chemical release, atmospheric stability, and 

topography of the surrounding area; and:



* safety mitigation systems the facility considered.



The Final Rule precludes posting other OCA data elements such as the 

name and quantity of facilities’ worst-case scenario chemicals, 

residential population that could be affected by a facility’s worst-

case chemical release, and maps or graphics illustrating the worst-case 

scenario.



OCA information and other RMP data may also be available to the public 

through state and local emergency planning organizations and through 

chemical facilities. The Final Rule encourages local and state 

emergency planning organizations to provide read-only access to 

information about facilities located within an individual’s emergency 

response jurisdiction or with potential off-site consequences that 

could affect the jurisdiction. EPA officials told us that while the 

agency still encourages state and local organizations to share OCA 

information with the public, it also provides guidance to these 

organizations on complying with statutory and regulatory restrictions 

on distributing the information. EPA officials told us that state and 

local organizations continue to share RMP data and, to a lesser extent, 

OCA information with the public, but on a more limited basis since 

September 11, 2001. In addition, the public may receive information 

about facilities’ risks and potential off-site consequences through 

public meetings. Virtually all facilities were required by the Chemical 

Safety Information, Site Security and Fuels Regulatory Relief Act to 

hold one public meeting to describe and discuss the local effects of 

their RMPs, including a summary of OCA portions of their RMPs.



EPA Has Modified Management of Information, but Further Changes Would 

Require Legislative or Regulatory Action:



In response to heightened concern about terrorist attacks after 

September 11, 2001, EPA made changes to its dissemination of RMP data. 

Because of concerns about security, EPA removed the RMP database posted 

on its Web site on September 20, 2001.[Footnote 5] Furthermore, 

officials at some EPA regional offices told us they made minor changes 

to their reading room operations to exercise more caution over OCA 

information after September 11, 2001. For example, EPA regional 

officials told us that two regions began conducting limited background 

checks through the agency’s Criminal Investigation Division units 

before allowing individuals to access the information. In response, EPA 

headquarters officials advised regions against implementing additional 

safeguards inconsistent with the Final Rule.



In general, the public has shown limited interest in accessing OCA 

information, both before and after September 11, 2001. Most EPA reading 

rooms had not hosted a visit before September 11, 2001. EPA officials 

report that EPA’s 17 reading rooms hosted about 180 visits in 2002, and 

a total of more than 200 visits since the reading rooms were 

created.[Footnote 6] These numbers may include repeated visits by the 

same individual. Moreover, EPA officials told us that the agency has 

received 18 requests for RMP data from members of the public by e-mail 

or in writing; 14 requests were received after September 11, 2001. EPA 

responded to all requests for RMP data excluding OCA information. The 

agency provided two additional requesters with the entire RMP database, 

excluding OCA information and RMP executive summaries. With the consent 

of these requesters, the agency excluded executive summaries because of 

increased concern over descriptions of OCA contained in this portion of 

some facilities’ RMPs.



EPA officials reported that changes to the management of RMP data were 

made in response to the increased threat of terrorist activity, not in 

response to any breaches in the security of OCA information or the RMP 

database generally. EPA officials told us that to their knowledge, no 

unauthorized access to OCA information has occurred. OCA information 

has been distributed in other formats to members of the public. For 

example, in several instances, journalists have accessed OCA 

information in reading rooms and then published lists identifying the 

most dangerous chemical facilities in a geographic area. These reports 

included facility names, the toxic chemicals housed at each facility, 

and the number of people that a chemical release at each facility could 

potentially affect. Chemical industry groups have voiced concern over 

this dissemination of facility information, arguing that terrorists 

could use the information to target facilities that are most vulnerable 

or located near large population centers. EPA officials also stated 

that some environmental and public interest groups copied the RMP 

database, which did not include OCA data elements other than those 

elements found less sensitive by Justice, from EPA’s Web site prior to 

September 2001 and made this data available on the Internet. However, 

officials stated that this information will become outdated as time 

passes because EPA has not made available the updated facility RMPs it 

receives.



EPA is currently reviewing its management of RMP data. EPA officials 

are working with Justice to determine whether to put RMPs, excluding 

restricted OCA information, back on the Internet and whether to 

restrict public access to other portions of RMPs such as executive 

summaries, which contain descriptions of OCA information. Even before 

the events of September 11, 2001, Justice expressed significant concern 

over general, public access to sensitive information included in 

chemical facility RMPs, which Justice concluded is particularly 

attractive targeting information for terrorists. Justice supports draft 

legislation that would better protect OCA information and prohibit 

general, public access to OCA information in facility RMPs. Because the 

existing statutory and regulatory framework governs access to RMPs and 

OCA information, EPA officials stated that additional changes to the 

management and distribution of this data would require legislative or 

regulatory action.



Agency Comments and Our Evaluation:



We provided a draft of this letter to EPA for its review and comment. 

EPA agreed with the letter’s facts and provided technical comments and 

clarifications, which we incorporated as appropriate.



Scope and Methodology:



To determine EPA’s management of Clean Air Act data under the Section 

112(r) Risk Management Plan provisions, we interviewed officials from 

EPA headquarters and officials from EPA’s 10 regional offices. We also 

reviewed statutes and regulations to determine the relevant statutory 

framework. In addition, we spoke with Justice about the agency’s 

procedures for operating reading rooms.



We conducted our work from April 2002 through March 2003 in accordance 

with generally accepted government auditing standards.



As agreed with your office, unless you publicly announce the contents 

of this report earlier, we plan no further distribution of it until 30 

days after the date of this letter. At that time, we will send copies 

to other interested parties and make copies available to others who 

request them. In addition, the report will be available on GAO’s Web 

site at http://www.gao.gov.



If you or your staff have any questions about this letter, please 

contact me or Peg Reese at (202) 512-3841. Major contributors to this 

report were Paige Gilbreath, Joanna McFarland, Amy Webbink, and Leigh 

White.



John B. Stephenson

Director, Natural Resources and Environment:



(360311):



FOOTNOTES



[1] U.S. General Accounting Office, Homeland Security: Voluntary 

Initiatives Are Under Way at Chemical Facilities, but the Extent of 

Security Preparedness Is Unknown (GAO-03-439, Mar. 14, 2003).



[2] P.L. 106-40, 113 Stat. 207 (1999).



[3] 65 Fed. Reg. 48108 (Aug. 4, 2000).



[4] Justice generally administers its reading rooms similarly to EPA 

reading rooms.



[5] Non-OCA RMP information remained available through the Freedom of 

Information Act.



[6] Justice reports that its 37 reading rooms have hosted fewer than 50 

visits.