Contractors operate each  site for DOE. DOE’s Office of Security develops and promulgates orders  and policies, such as the DBT, to guide the department’s safeguards and  security programs. Because of these risks,  DOE has long employed risk-based security practices. The key component of DOE’s well-established, risk-based security  practices is the DBT, a classified document that identifies the  characteristics of the potential threats to DOE assets. Development of the New DBT Took Almost 2 Years Because of Delays in Developing the Postulated Threat and DOE’s Lengthy Review and Comment Process

In the immediate aftermath of September 11, 2001, DOE officials realized  that the then current DBT, issued in April 1999 and based on a 1998  intelligence community assessment, was obsolete. According to DOE and DOD officials, this  delay resulted from other demands placed on the intelligence community  after September 11, 2001, as well as from sharp debates among the  organizations developing the Postulated Threat over the size and  capabilities of future terrorist threats and the resources needed to meet  these threats. As a result,  during the time it took DOE to develop the new DBT, its sites were only  required to defend against the terrorist group defined in the 1999 DBT,  which, in the aftermath of September 11, 2001, DOE officials realized was  obsolete. The May 2003 DBT Identifies a Larger Terrorist Threat, but in Most Cases is Less Than the Terrorist Threat Identified by the Postulated Threat

While the May 2003 DBT identifies a larger terrorist group than did the  previous DBT, the threat identified in the new DBT, in most cases, is less  than the terrorist threat identified in the intelligence community’s  Postulated Threat. Finally, the department’s criteria for determining the severity of  radiological, chemical, and biological sabotage may be insufficient. For chemical sabotage standards, the 2003 DBT requires  sites to protect to industry standards. However, we reported March 2003  year that such standards currently do not exist. DOE Has Been Slow to Resolve a Number of Significant Issues That May Affect the Ability of its Sites to Fully Meet the Threat Contained in the New DBT

While DOE issued the final DBT in May 2003, it has only recently resolved  a number of significant issues that may affect the ability of its sites to fully  meet the threat contained in the new DBT in a timely fashion and is still  addressing other issues. Second, DOE also only recently provided additional DBT implementation  guidance. Some sites may be able  to move more quickly and meet the department’s deadline of the end of  fiscal year 2006. As a result, DOE needs to take a series of actions  to mitigate these risks to an acceptable level as quickly as possible.
Why GAO Did This Study

A successful terrorist attack on Department of Energy (DOE) sites containing nuclear weapons or the material used in nuclear weapons could have devastating consequences for the site and its surrounding communities. Because of these risks, DOE needs an effective safeguards and security program. A key component of an effective program is the design basis threat (DBT), a classified document that identifies, among other things, the potential size and capabilities of terrorist forces. The terrorist attacks of September 11, 2001, rendered the then-current DBT obsolete, resulting in DOE issuing a new version in May 2003. GAO (1) identified why DOE took almost 2 years to develop a new DBT, (2) analyzed the higher threat in the new DBT, and (3) identified remaining issues that need to be resolved in order for DOE to meet the threat contained in the new DBT.

What GAO Found

DOE took a series of actions in response to the terrorist attacks of September 11, 2001. While each of these has been important, in and of themselves, they are not sufficient to ensure that all of DOE's sites are adequately prepared to defend themselves against the higher terrorist threat present in the post September 11, 2001 world. Specifically, GAO found that DOE took almost 2 years to develop a new DBT because of (1) delays in developing an intelligence community assessment--known as the Postulated Threat--of the terrorist threat to nuclear weapon facilities, (2) DOE's lengthy comment and review process for developing policy, and (3) sharp debates within DOE and other government organizations over the size and capabilities of future terrorist threats and the availability of resources to meet these threats. While the May 2003 DBT identifies a larger terrorist threat than did the previous DBT, the threat identified in the new DBT, in most cases, is less than the threat identified in the intelligence community's Postulated Threat, on which the DBT has been traditionally based. The new DBT identifies new possible terrorist acts such as radiological, chemical, or biological sabotage. However, the criteria that DOE has selected for determining when facilities may need to be protected against these forms of sabotage may not be sufficient. For example, for chemical sabotage, the 2003 DBT requires sites to protect to "industry standards;" however, such standards currently do not exist. DOE has been slow to resolve a number of significant issues, such as issuing additional DBT implementation guidance, developing DBT implementation plans, and developing budgets to support these plans, that may affect the ability of its sites to fully meet the threat contained in the new DBT in a timely fashion. Consequently, DOE's deadline to meet the requirements of the new DBT by the end of fiscal year 2006 is probably not realistic for some sites.