On the basis of our review of the draft plan and discussions with DHS  officials, the final plan will   present background information on the sector, including a description  of (1) the types of assets that are considered part of the chemical sector;  (2) the regulatory authority of key federal agencies relative to the  chemical industry and the key stakeholders in the sector; (3) the roles  and responsibilities of each stakeholder; and (4) DHS’s coordination  with federal, state, and local agencies, such as law enforcement and  emergency management departments, and with the private sector on  efforts that include sharing intelligence and security information;  describe the process DHS will use to develop a comprehensive  inventory of assets in the chemical sector, including plans for working  with the private sector to develop this inventory, since the critical  infrastructure in the chemical sector is predominantly privately owned  and operated;  describe DHS’s efforts to identify and assess the vulnerabilities of  chemical facilities and how DHS plans to prioritize these efforts on the  basis of the vulnerability assessments;  outline the protective programs that will be created to prevent, deter,  mitigate, and recover from attacks on chemical facilities, and describe  how DHS will work with private sector and government entities to  implement these programs;  explain the performance metrics DHS will use to measure the  effectiveness of DHS and industry security efforts and ensure that DHS  meets its overall critical infrastructure goals, including (1) identifying  and assessing the vulnerability of the nation’s critical infrastructure and  key resources; (2) ensuring the protection of the nation’s critical  infrastructure and key resources from terrorist attack; (3) establishing a  collaborative environment across all levels of government and with the  private sector to better protect the nation’s critical infrastructure and  key resources; and (4) coordinating and integrating, as appropriate, with  other federal emergency management and preparedness activities,  including the National Response Plan; document DHS’s plans to work with stakeholders to review current  federal research and development initiatives for prioritization and to  identify gaps between the chemical sector’s requirements and current  projects in order to identify research and development needs; and  outline challenges the department faces in coordinating the efforts of  the chemical sector, such as collecting information about facilities from  a large number of owners; communicating with chemical facility owners  who do not belong to industry associations; coordinating the roles of  sector stakeholders; and working without federal regulatory authority. DHS is also  distributing threat information to the industry and coordinating sector  activities with the Chemical Sector Coordinating Council, an industry-led  working group that acts as a liaison for the chemical sector. DHS Is Identifying High-Priority Sites

DHS has identified approximately 3,400 chemical facilities that it believes  pose the greatest hazard to human life and health in the event of a terrorist  attack. Some industry associations require  member companies to assess their facilities’ vulnerabilities and make  security enhancements. For example, ACC requires, as a condition of  membership, that companies conduct vulnerability assessments, develop  and implement plans to mitigate vulnerabilities, and have a third party  verify that the security enhancements identified in the plans were  implemented. Other industry associations have encouraged their members  to address security by developing security guidelines, best practices, and  other tools. The Chemical Industry Faces Challenges in Securing Facilities against Terrorism

Chemical industry officials told us they face a number of challenges in  preparing facilities against a terrorist attack. DHS Needs Additional Authority to Ensure That Chemical Facilities Are Addressing Security Issues

Existing laws provide DHS with only limited authority to address security  concerns at U.S. chemical facilities, and additional legislation is needed to  place federal security requirements on these facilities. DHS Has Concluded That It Needs Additional Authority to Address Chemical Facility Security

DHS has concluded that its existing patchwork of authorities does not  permit it to regulate the chemical industry effectively, and that the  Congress should enact federal requirements for chemical facilities. However, the extent of  security preparedness at these facilities remains largely unknown. However, unlike other  federal agencies—such as EPA and the Nuclear Regulatory Commission,  which require drinking water and nuclear facilities, respectively, to take  actions to improve their security—DHS does not currently have the  authority to require the chemical industry to take such actions. Objectives, Scope, and Methodology

Our objectives were to describe (1) the Department of Homeland Security’s  (DHS) actions to develop an overall strategy for protecting the chemical  industry; (2) DHS’s efforts to identify high-risk chemical facilities, assess  their vulnerabilities, ensure that facilities are addressing security, and  coordinate with the Environmental Protection Agency (EPA) in these  efforts; (3) chemical industry security initiatives and challenges; and (4)  DHS’s existing authorities, and whether additional legislative authority is  needed to ensure that chemical facilities take action to address  vulnerabilities.
Why GAO Did This Study

Terrorist attacks on U.S. chemical facilities could damage public health and the economy. While the Environmental Protection Agency (EPA) formerly led federal efforts to ensure chemical facility security, the Department of Homeland Security (DHS) is now the lead federal agency coordinating efforts to protect these facilities from terrorist attacks. GAO reviewed (1) DHS's actions to develop a strategy to protect the chemical industry, (2) DHS's actions to assist in the industry's security efforts and coordinate with EPA, (3) industry security initiatives and challenges, and (4) DHS's authorities and whether additional legislation is needed to ensure chemical plant security. GAO interviewed DHS, EPA, and industry officials, among others.

What GAO Found

As part of a national framework for protecting the chemical sector, DHS is developing a Chemical Sector-Specific Plan. The plan is intended to, among other things, describe DHS's ongoing efforts and future plans to coordinate with federal, state, and local agencies and the private sector; identify chemical facilities to include in the sector, assess their vulnerabilities, and prioritize them; and develop programs to prevent, deter, mitigate, and recover from attacks on chemical facilities. DHS did not estimate when the plan will be completed. To date, DHS has taken a number of actions aimed at protecting the chemical sector from terrorist attacks. DHS has identified 3,400 facilities that, if attacked, could pose the greatest hazard to human life and health and has initiated programs to assist the industry and local communities in protecting chemical facilities. For example, the Buffer Zone Protection Program assists facility owners and local law enforcement with improving the security of areas surrounding plants. DHS also coordinates with the Chemical Sector Coordinating Council, an industry-led group that acts as a liaison for the chemical sector, and with EPA and other federal agencies. The chemical industry is voluntarily addressing plant security, but faces challenges in preparing against terrorism. Some industry associations require member companies to assess plants' vulnerabilities, develop and implement plans to mitigate vulnerabilities, and have a third party verify that security measures were implemented. Other associations have developed security guidelines and other tools to encourage their members to address security. While voluntary efforts are under way, industry officials said that they face challenges in preparing facilities against terrorism, including high costs and limited guidance on how much security is adequate. Because existing laws provide DHS with only limited authority to address security at chemical facilities, it has relied primarily on the industry's voluntary security efforts. However, the extent to which companies are addressing security is unclear. Unlike EPA, for example, which requires drinking water facilities to improve their security, DHS does not have the authority to require chemical facilities to assess their vulnerabilities and implement security measures. Therefore, DHS cannot ensure that facilities are taking these actions. DHS has stated that its existing authorities do not permit it to effectively regulate the chemical industry, and that the Congress should enact federal requirements for chemical facilities. Many stakeholders agreed--as GAO concluded in 2003--that additional legislation placing federal security requirements on chemical facilities is needed. However, stakeholders had mixed views on the contents of any legislation, such as requirements that plants substitute safer chemicals and processes that potentially could reduce the risks present at these facilities.