Chemical Security: Overlapping Programs Could Better Collaborate to Share Information and Identify Potential Security Gaps
Fast Facts
Thousands of facilities use hazardous chemicals, and hundreds of them are subject to both Department of Homeland Security anti-terrorism standards and other federal chemical safety or security programs.
We reviewed 8 such programs and compared them to DHS's standards. We found some overlap, duplication, and fragmentation. For example, facilities may be developing duplicative information to comply with multiple programs. Even though some facilities may be subject to multiple programs, those not subject to DHS standards—such as water systems—may have gaps in oversight.
We recommended identifying potential security gaps and more.
Chemical Facility Storage Tanks
Highlights
What GAO Found
Eight federal programs addressing chemical safety or security from four departments or agencies that GAO reviewed contain requirements or guidance that generally align with at least half of the Department of Homeland Security's (DHS) 18 Chemical Facility Anti-Terrorism Standards (CFATS) program standards. At least 550 of 3,300 (16 percent) facilities subject to the CFATS program are also subject to other federal programs. Analyses of CFATS and these eight programs indicate that some overlap, duplication, and fragmentation exists, depending on the program or programs to which a facility is subject. For example,
- six federal programs' requirements or guidance indicate some duplication with CFATS. CFATS program officials acknowledge similarities among these programs' requirements or guidance, some of which are duplicative, and said that the CFATS program allows facilities to meet CFATS program standards by providing information they prepared for other programs.
- more than 1,600 public water systems or wastewater treatment facilities are excluded under the CFATS statute, leading to fragmentation. While such facilities are subject to other programs, those programs collectively do not contain requirements or guidance that align with four CFATS standards. According to DHS, public water systems and wastewater treatment facilities are frequently subject to safety regulations that may have some security value, but in most cases, these facilities are not required to implement security measures commensurate to their level of security risk, which may lead to potential security gaps.
The departments and agencies responsible for all nine of these chemical safety and security programs—four of which are managed by DHS, three by the Environmental Protection Agency (EPA), and one each managed by the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and the Department of Transportation (DOT)—have previously worked together to enhance information collection and sharing in response to Executive Order 13650, issued in 2013. This Executive Order directed these programs to take actions related to improving federal agency coordination and information sharing.
However, these programs have not identified which facilities are subject to multiple programs, such that facilities may be unnecessarily developing duplicative information to comply with multiple programs. Although CFATS allows facilities to use information they prepared for other programs, CFATS program guidance does not specify what information facilities can reuse. Finally, DHS and EPA leaders acknowledged that there are differences between CFATS requirements and the security requirements for public water systems and wastewater treatment facilities, but they have not assessed the extent to which potential security gaps may exist. By leveraging collaboration established through the existing Executive Order working group, the CFATS program and chemical safety and security partners would be better positioned to minimize unnecessary duplication between CFATS and other programs and better ensure the security of facilities currently subject to fragmented requirements.
Why GAO Did This Study
Facilities with hazardous chemicals could be targeted by terrorists to inflict mass casualties or damage. Federal regulations applicable to chemical safety and security have evolved over time as authorizing statutes and regulations established programs for different purposes, such as safety versus security, and with different enforcement authorities. GAO has reported that such programs may be able to achieve greater efficiency where overlap exists by reducing duplication and better managing fragmentation.
GAO was asked to review issues related to the effects that overlap, duplication, and fragmentation among the multiple federal programs may have on the security of the chemical sector. This report addresses the extent to which (1) such issues may exist between CFATS and other federal programs, and (2) the CFATS program collaborates with other federal programs. GAO analyzed the most recent available data on facilities subject to nine programs from DHS, EPA, ATF, and DOT; reviewed and analyzed statutes, regulations, and program guidance; and interviewed agency officials.
Recommendations
GAO is making seven recommendations, including that DHS, EPA, ATF, and DOT identify facilities subject to multiple programs; DHS clarify guidance; and DHS and EPA assess security gaps. Agencies generally agreed with six; EPA did not agree with the recommendation on gaps. GAO continues to believe it is valid, as discussed in the report.
Recommendations for Executive Action
| Agency Affected Sort descending | Recommendation | Status |
|---|---|---|
| Bureau of Alcohol, Tobacco, Firearms and Explosives | The Director of ATF should direct its explosive materials programs to collaborate with chemical safety and security program partners and establish an iterative and ongoing process to identify the extent to which the facilities that it regulates are also covered by the CFATS program. (Recommendation 3) |
Closed – Implemented
In January 2022, in response to GAO's recommendation, the Bureau of Alcohol, Tobacco, Firearms and Explosives established a joint procedure with the Department of Homeland Security (DHS), Environmental Protection Agency, and the Department of Transportation for identifying facilities covered by multiple programs through an iterative and ongoing process. According to DHS, as of March 2022, the initial process identified more than 2,000 facilities-out of the 3,300 subject to the CFATS regulations-as regulated by other federal departments and agencies. Further, DHS officials stated that they plan to update the list on a recurring basis through the joint procedure. By identifying the extent of overlap among facilities subject to CFATS and other programs, DHS will have better information to guide coordination across programs, such as inspection and information sharing efforts.
|
| Cybersecurity and Infrastructure Security Agency | The Director of DHS's Cybersecurity and Infrastructure Security Agency should update CFATS program guidance or fact sheets to include a list of commonly accepted actions facilities may have taken and information they may have prepared pursuant to other federal programs, and disseminate this information. (Recommendation 5) |
Closed – Implemented
DHS concurred with this recommendation, and described planned steps it would take to implement it, such as updating its guidance. In April 2021, DHS began reviewing requirements from complementary chemical safety and security programs, and coordinated with partners to better understand those programs' requirements. In October2022, DHS established and disseminated a list of commonly accepted actions taken to comply with other regulations that may meet requirements under the CFATS program. By developing and disseminating its guidance, the CFATS program assisted those facilities subject to overlapping programs with a potentially more efficient approach to complying with CFATS standards.
|
| Cybersecurity and Infrastructure Security Agency | DHS's Cybersecurity and Infrastructure Security Agency should collaborate with the EPA to assess the extent to which potential security gaps exist at water and wastewater facilities and, if gaps exist, develop a legislative proposal for how best to address them and submit it to the Secretary of Homeland Security and Administrator of EPA, and Congress, as appropriate. (Recommendation 6) |
Open – Partially Addressed
DHS concurred with this recommendation, and described planned steps it would take to implement it, including working with EPA to identify and explore possible approaches for assessing potential security gaps that exist at water and wastewater facilities broadly. In response, DHS and EPA officials began discussing options to assess the extent to which potential security gaps exist, identify and evaluate options for addressing such gaps, and determine if any additional action, such as a legislative proposal, is warranted. As of October 2022, subject matter experts from DHS and EPA concluded that security gaps exist at average water and wastewater facilities. According to DHS, these facilities are not only exempt from CFATS, but also often lack both the financial capability and or security expertise to voluntarily implement comprehensive security programs. DHS has prioritized voluntary outreach to such facilities, and DHS and EPA have discussed potential opportunities for legislative action to address the security gaps created by the water and wastewater facility exemption. DHS and EPA plan to work with Congress on legislative opportunities to address these gaps, but have not yet done so. To address this recommendation and the security gaps, the agency will need to, in coordination with EPA, develop a proposal to address such gaps. As of July 28, 2023, Congress has allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards (CFATS) program (6 CFR Part 27) to expire. Therefore, further updates are pending the program being reauthorized.
|
| Department of Homeland Security | The Secretary of DHS should direct its chemical safety and security programs to collaborate with partners and establish an iterative and ongoing process to identify the extent to which CFATS-regulated facilities are also covered by other programs with requirements or guidance that generally align with some CFATS standards. (Recommendation 1) |
Closed – Implemented
In January 2022, in response to GAO's recommendation, DHS established a joint procedure with the Environmental Protection Agency, the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Department of Transportation for identifying facilities covered by multiple programs through an iterative and ongoing process. According to DHS, as of March 2022, the initial process identified more than 2,000 facilities-out of the 3,300 subject to the CFATS regulations -as regulated by other federal departments and agencies. Further, DHS officials stated that they plan to update the list on a recurring basis. By identifying the extent of overlap among facilities subject to CFATS and other programs, DHS will have better information to guide coordination across programs, such as inspection and information sharing efforts.
|
| Department of Transportation | The Secretary of Transportation should direct its hazardous materials transportation program to collaborate with chemical safety and security partners and establish an iterative and ongoing process to identify the extent to which the facilities that it regulates are also covered by the CFATS program. (Recommendation 4) |
Closed – Implemented
In January 2022, in response to GAO's recommendation, the Department of Transportation established a joint procedure with the Environmental Protection Agency, the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Department of Homeland Security (DHS) for identifying facilities covered by multiple programs through an iterative and ongoing process. According to DHS, as of March 2022, the initial process identified more than 2,000 facilities--out of the 3,300 subject to the CFATS regulations--as regulated by other federal departments and agencies. Further, DHS officials stated that they plan to update the list on a recurring basis through the joint procedure. By identifying the extent of overlap among facilities subject to CFATS and other programs, DHS will have better information to guide coordination across programs, such as inspection and information sharing effort.
|
| Environmental Protection Agency | The EPA should collaborate with the DHS's Cybersecurity and Infrastructure Security Agency to assess the extent to which potential security gaps exist at water and wastewater facilities and, if gaps exist, develop a legislative proposal for how best to address them and submit it to the Secretary of Homeland Security and Administrator of EPA, and Congress, as appropriate. (Recommendation 7) |
Open
EPA did not agree with this recommendation in January 2021, but in an August 2021 letter to GAO, EPA changed its response to agree with the recommendation. In the letter, EPA noted that GAO's February 2021 report already provided a rigorous current assessment of overlap. EPA further stated that it would begin to collaborate with the Department of Homeland Security (DHS) to assess whether security gaps exist at water and wastewater facilities, and if gaps are identified, EPA would consider legislative options for how best to address them. As of October 2022, subject matter experts from EPA and DHS concluded that security gaps exist at average water and wastewater facilities. According to EPA and DHS, these facilities are not only exempt from CFATS, but also often lack both the financial capability and or security expertise to voluntarily implement comprehensive security programs. EPA and DHS officials have discussed potential opportunities for legislative action to address the security gaps created by the water and wastewater facility exemption, and in the interim DHS has prioritized voluntary outreach to such facilities. DHS and EPA plan to work with Congress on legislative opportunities to address these gaps, but have not yet done so. To address this recommendation and the security gaps, the agency will need to, in coordination with DHS, develop a proposal to address such gaps. As of July 28, 2023, Congress has allowed the statutory authority for CFATS (6 CFR Part 27) to expire. Therefore, further updates are pending the program being reauthorized.
|
| Environmental Protection Agency | The Administrator of the EPA should direct its chemical safety and security programs to collaborate with partners and establish an iterative and ongoing process to identify the extent to which the facilities that it regulates are also covered by the CFATS program. (Recommendation 2) |
Closed – Implemented
In January 2022, in response to GAO's recommendation, the Environmental Protection Agency established a joint procedure with the Department of Homeland Security (DHS), the Bureau of Alcohol, Tobacco, Firearms and Explosives, and the Department of Transportation for identifying facilities covered by multiple programs through an iterative and ongoing process. According to DHS, as of March 2022, the initial process identified more than 2,000 facilities--out of the 3,300 subject to the CFATS regulations--as regulated by other federal departments and agencies. Further, DHS officials stated that they plan to update the list on a recurring basis. By identifying the extent of overlap among facilities subject to CFATS and other programs, DHS will have better information to guide coordination across programs, such as inspection and information sharing efforts.
|