In addition to the five registered and operational BSL-4 labs, there are  more labs currently under construction or in the planning stages. Results of Security Assessment

CDC regulations do not mandate that specific perimeter security controls  are present at all BSL-4 labs, resulting in a significant difference in  perimeter security between the nation’s five labs. However, there are no specific perimeter security controls that must be in  place at every BSL-4 lab. While three labs had all or nearly all of the key  security controls we assessed, two labs demonstrated a significant lack of  these controls. Although the presence of the security controls we assessed does not  automatically ensure a secure perimeter, having most controls provides  increased assurance that a strong perimeter security system is in place and  reduces the likelihood of unauthorized intrusion. Lab A: The physical security controls of Lab A presented a strong visible  deterrent from the outside, with 14 of the 15 key security controls in place. Lab B: Lab B was the only one of the five BSL-4 labs that had all 15  security controls. Lab D: Although Lab D did not have an armed guard presence outside the  lab or vehicle screening, it presented strong physical security controls in  all other respects, with 13 of the key 15 controls we assessed. DSAT approved the security plans for the two labs lacking most key  security controls, and approved these labs to participate in the Select  Agent Program as BSL-4 labs. Conversely, during our assessment, we  noted that the three BSL-4 labs with all or nearly all of our 15 key controls  were subject to additional federal security requirements outside the  purview of the Select Agent Regulations. The CDC should work with USDA to coordinate its efforts, given  that both agencies have the authority to regulate select agents. We are encouraged that HHS plans to  study this matter further, and suggest that, as part of this study, HHS  reconsider whether the lack of many specific perimeter security controls  at two of the nation’s five BSL-4 labs is acceptable. Appendix I: Perimeter Security Controls

To perform our perimeter security assessment of biosafety level (BSL) 4  labs, we identified 15 key perimeter security controls, based on our  expertise and research of commonly accepted physical security principles,  that contribute to a strong perimeter security system.
Why GAO Did This Study

Biosafety labs under the U.S. Bioterrorism Act are primarily regulated and must be registered with either the Centers for Disease Control and Prevention (CDC) or the U.S. Department of Agriculture (USDA) under the Select Agent Regulations. Currently, all operational biosafety level (BSL) 4 labs are registered with the CDC and thus are regulated by the CDC, not USDA. BSL-4 labs handle the world's most dangerous agents and diseases. In fact, of the four BSL designations, only BSL-4 labs can work with agents for which no cure or treatment exists. GAO was asked to perform a systematic security assessment of key perimeter security controls at the nation's five operational BSL-4 labs. To meet this objective, GAO performed a physical security assessment of the perimeter of each lab using a security survey it developed. GAO focused primarily on 15 physical security controls, based on GAO expertise and research of commonly accepted physical security principles.

What GAO Found

Select Agent Regulations do not mandate specific perimeter security controls that need to be in place at each BSL-4 lab, resulting in significant differences in perimeter security between the nation's five labs. While three labs had all or nearly all of the key security controls GAO assessed--features such as perimeter barriers, roving armed guard patrols, and magnetometers in use at lab entrances--two labs demonstrated a significant lack of these controls. Specifically, one lab had all 15 security controls in place, one had 14, and another had 13 of the key controls. However, the remaining two labs had only 4 and 3 key security controls, respectively. Although the presence of the security controls GAO assessed does not automatically ensure a secure perimeter, having most controls provides increased assurance that a strong perimeter security system is in place and reduces the likelihood of unauthorized intrusion. For example, the two labs with fewer security controls lacked both visible deterrents and a means to respond to intrusion. One lab even had a window that looked directly into the room where BSL-4 agents were handled. In addition to creating the perception of vulnerability, the lack of key security controls at these labs means that security officials have fewer opportunities to stop an intruder or attacker. The two labs with fewer security controls were approved by the CDC to participate in the Select Agent Program despite their weaknesses. During the course of our review, GAO noted that the three labs with all or nearly all of the key security controls GAO assessed were subject to additional federal security requirements imposed on them by agencies that owned or controlled the labs, not because of the Select Agent Regulations.