The CFATS program is intended to ensure the security of the nation’s  chemical infrastructure by identifying, assessing the risk posed by, and  requiring the implementation of measures to protect high-risk chemical  facilities. According to the CFATS Act of 2014, among other things, DHS is to  implement the following six provisions related to a whistleblower  procedure:  1.  not later than 180 days after the date of enactment of the CFATS Act  of 2014, establish and provide information to the public regarding a  procedure under which any employee or contractor of a chemical  facility of interest may submit a report of a CFATS violation,  2.  keep confidential the identity of an employee or contractor at a  chemical facility of interest, who submits a report of a potential CFATS  violation under the established whistleblower procedure,  3.  promptly respond to an employee or contractor at a chemical facility of  interest, who provides contact information, to acknowledge receipt of  the report,  4.  review and consider the information provided in any report submitted,  and take action, as appropriate, to address any substantiated CFATS  violation,  5.  follow certain procedural requirements if the Secretary determines  that a violation has occurred and decides to institute a civil  enforcement or issue an emergency order against a chemical facility,  as appropriate under the law, and  6.  work in partnership with industry associations and labor organizations  to make publicly available, physically and online, the rights that an  individual who provides DHS with whistleblower information about a  covered chemical facility, would have under federal law. DHS Received 105 Reports and Closed 97 Because They Did Not Involve CFATS Regulatory Requirements

From June 16, 2015 (when ISCD implemented its whistleblower process)  to April 19, 2016, ISCD received 105 reports from individuals—90 via the  ISCD telephone tip line, 14 via e-mail, and 1 from ISCD’s CFATS help  desk. DHS has not received a whistleblower retaliation report that it  substantiated since ISCD implemented the interim process for  whistleblower reports on June 16, 2015. The  officials stated that, in the meantime, they would address any future  retaliation reports on a case-by-case basis. Guidance on the ISCD Telephone Tip Line and Website for Whistleblower Reports Is Insufficient for Gathering Adequate Information from Whistleblowers

The ISCD current telephone tip line greeting and ISCD website for  CFATS whistleblower reports provide no guidance and limited guidance,  respectively, to whistleblowers regarding the types of information that  would be most useful to ISCD in vetting and determining next steps for  the reports. Our analysis of 105 reports received by ISCD from June 16, 2015 to April  19, 2016 identified the following challenges that ISCD officials  experienced in vetting reports due to insufficient information. However, DHS  has not developed a documented process and procedures to investigate  whether retaliation has occurred. A documented process and procedures  for addressing and investigating whistleblower retaliation reports would  better ensure that DHS can effectively and efficiently investigate reports  to determine whether whistleblowers were retaliated against. Regarding our recommendation that DHS  develop a documented process and procedures to address and  investigate whistleblower retaliation reports that could include existing  practices, such as OSHA’s recommended practices, DHS stated that due  to the construction of the CFATS-authorizing legislation, developing  formal processes and procedures for investigating whistleblower  retaliation reports will require modifications to the CFATS regulations. Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine (1) the number and types of Chemical  Facility Anti-Terrorism Standards (CFATS) whistleblower reports the  Department of Homeland Security (DHS) received, and any actions DHS  took as a result of the reports, and (2) the extent to which DHS has  implemented and followed a process to address reports from the  whistleblowers, including reports of retaliation against whistleblowers. Although we focused on analyzing reports that DHS received since June  16, 2015, for context, we reviewed the CFATS telephone tip line calls that  ISCD received from February 2009, when the telephone tip line started, to  June 15, 2015—the day prior to ISCD’s implementation of the  whistleblower procedure required under the Protecting and Securing  Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of  2014).
Why GAO Did This Study

The CFATS program is intended to ensure the security of the nation's chemical infrastructure by assessing risks and requiring the implementation of measures to protect high-risk chemical facilities. The CFATS Act of 2014 required DHS to establish a whistleblower process. Employees and contractors at hundreds of thousands of U.S. facilities with hazardous chemicals can play an important role in helping to ensure CFATS compliance by submitting a whistleblower report when they suspect noncompliance. Whistleblowers who disclose wrongdoing at chemical facilities can save lives and help improve public safety and health.
The CFATS Act of 2014 also requires GAO to review the CFATS whistleblower process. This report addresses (1) the number and types of CFATS whistleblower reports DHS received, and any actions DHS took as a result, and (2) the extent to which DHS has implemented and followed a process to address the whistleblower reports, including reports of retaliation against whistleblowers. GAO reviewed laws, regulations, and CFATS program documents; analyzed whistleblower reports DHS received from June 16, 2015 to April 19, 2016; and interviewed officials responsible for vetting the reports and deciding how to address them.

What GAO Found

Of the 105 reports that the Department of Homeland Security (DHS) received under its interim process for whistleblowers from June 16, 2015 (the date DHS was mandated to begin collecting reports by), to April 19, 2016, DHS closed 97 because they did not pertain to Chemical Facility Anti-Terrorism Standards (CFATS) regulations, and referred 70 of the 97 to other federal agencies with legal authority relevant to the reports. DHS determined that 8 of the 105 reports involved potential CFATS violations, and after further review, that 1 report involved an actual CFATS violation. As a result of this report, DHS required the chemical facility to register with DHS as a CFATS-regulated facility.
Total Reports Received by DHS and Disposition for Reports, June 16, 2015 to April 19, 2016
In June 2015, DHS implemented an interim process to respond to whistleblower reports involving CFATS and has followed its process since then; however, DHS does not have a documented process and procedures to investigate whistleblower retaliation reports. The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 (CFATS Act of 2014) prohibits retaliation against whistleblowers. According to DHS, the department has not received a report of whistleblower retaliation that it substantiated since implementing the interim process and any future retaliation reports would be addressed on a case-by-case basis. However, without a documented process and procedures for investigating whistleblower retaliation reports, DHS may not be able to effectively and efficiently investigate any future retaliation reports. In addition, DHS maintains a telephone tip line and a website with an e-mail address to receive CFATS whistleblower reports. However, the tip line greeting provides no guidance and the website provides limited guidance about the type of information that would be most useful to DHS for addressing the reports. GAO's analysis of 105 reports received by DHS from June 16, 2015, to April 19, 2016, identified challenges that DHS experienced in vetting reports due to insufficient information, such as the name or location of the chemical facility. Additional guidance explaining the detailed information that DHS needs to review reports could help reduce the amount of follow-up time to obtain this information.

What GAO Recommends

GAO recommends that DHS develop a documented process and procedures to address whistleblower retaliation reports, and provide additional guidance on the DHS whistleblower website and telephone tip line. DHS agreed with GAO's recommendations.