What GAO Found
Since 2007, the Office of Infrastructure Protection's Infrastructure Security Compliance Division (ISCD), within the Department of Homeland Security (DHS), has identified and collected data from approximately 37,000 chemical facilities under its Chemical Facility Anti-Terrorism Standards (CFATS) program and categorized approximately 2,900 as high-risk based on the collected data. However, ISCD used unverified and self-reported data to categorize the risk level for facilities evaluated for a toxic release threat. A toxic release threat exists where chemicals, if released, could harm surrounding populations. One key input for determining a facility's toxic release threat is the Distance of Concern (distance) that facilities report—an area in which exposure to a toxic chemical cloud could cause serious injury or fatalities from short-term exposure. ISCD requires facilities to calculate the distance using a web-based tool and following DHS guidance. ISCD does not verify facility-reported data for facilities it does not categorize as high-risk for a toxic release threat. However, following DHS guidance and using a generalizable sample of facility-reported data in a DHS database, GAO estimated that more than 2,700 facilities (44 percent) of an estimated 6,400 facilities with a toxic release threat misreported the distance. By verifying that the data ISCD used in its risk assessment are accurate, ISCD could better ensure it has identified the nation's high-risk chemical facilities.
ISCD has made substantial progress approving site security plans but does not have documented processes and procedures for managing facilities that are noncompliant with their approved site security plans. Site security plans outline, among other things, the planned measures that facilities agree to implement to address security vulnerabilities. As of April 2015, GAO estimates that it could take between 9 and 12 months for ISCD to review and approve security plans for approximately 900 remaining facilities—a substantial improvement over the previous estimate of 7 to 9 years GAO reported in April 2013. ISCD officials attributed the increased approval rate to efficiencies in ISCD's security plan review process, updated guidance, and a new case management system. Further, ISCD began conducting compliance inspections in September 2013, but does not have documented processes and procedures for managing the compliance of facilities that have not implemented planned measures outlined in their site security plans. According to the nature of violations thus far, ISCD has addressed noncompliance on a case-by-case basis. Almost half (34 of 69) of facilities ISCD inspected as of February 2015 had not implemented one or more planned measures by deadlines specified in their approved site security plans and therefore were not fully compliant with their plans. GAO found variations in how ISCD addressed these 34 facilities, such as how much additional time the facilities had to come into compliance and whether or not a follow-on inspection was scheduled. Such variations may or may not be appropriate given ISCD's case-by-case approach, but having documented processes and procedures would ensure that ISCD has guidelines by which to manage noncompliant facilities and ensure they close security gaps in a timely manner. Additionally, given that ISCD will need to inspect about 2,900 facilities in the future, having documented processes and procedures could provide ISCD more reasonable assurance that facilities implement planned measures and address security gaps.
Why GAO Did This Study
Thousands of facilities have hazardous chemicals that could be targeted or used to inflict mass casualties or harm surrounding populations in the United States. DHS established the CFATS program to, among other things, identify and assess the security risk posed by chemical facilities. Within DHS, ISCD oversees this program.
GAO was asked to assess the CFATS program. This report addresses, among other things, the extent to which DHS has (1) categorized facilities as subject to the CFATS regulation, and (2) approved site security plans and conducted compliance inspections. GAO reviewed laws, regulations, and program documents; randomly selected data submitted to ISCD by facilities from 2007 to 2015, tested the data's reliability; and generated estimates for the entire population of facilities, and interviewed officials responsible for overseeing, identifying, categorizing, and inspecting chemical facilities from DHS headquarters and in California, Maryland, Oregon, and Texas (selected based on geographic location and other factors).
GAO recommends, among other things, that DHS (1) verify the Distance of Concern reported by facilities is accurate and (2) document processes and procedures for managing compliance with site security plans. DHS concurred with GAO's recommendations and outlined steps to address them.
Recommendations for Executive Action
|Department of Homeland Security||1. To ensure the accuracy of the data submitted by chemical facilities, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to provide milestone dates and a timeline for implementation of the new Top-Screen and ensure that changes to this Top-Screen mitigate errors in the Distance of Concern submitted by facilities.|
|Department of Homeland Security||2. To ensure the accuracy of the data submitted by chemical facilities, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD, in the interim, to identify potentially miscategorized facilities with the potential to cause the greatest harm and verify the Distance of Concern these facilities report is accurate.|
|Department of Homeland Security||3. In addition, to better manage compliance among high-risk chemical facilities and demonstrate program results, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to develop documented processes and procedures to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans.|
|Department of Homeland Security||4. In addition, to better manage compliance among high-risk chemical facilities and demonstrate program results, the Secretary of Homeland Security should direct the Under Secretary for NPPD, the Assistant Secretary for the Office of Infrastructure Protection, and the Director of ISCD to improve the measurement and reporting of the CFATS program performance by developing a performance measure that includes only planned measures that have been implemented and verified.|