Congress is considering several legislative proposals that would grant  DHS, or DHS and EPA, the authority to require chemical facilities to take  security steps. S. 994 requires the Secretary of Homeland Security to  promulgate regulations specifying which facilities should be required to  conduct vulnerability assessments and to prepare and implement site  security plans, a timetable for completing the vulnerability assessments  and security plans, the contents of plans, and limits on the disclosure of  sensitive information. An Attack Against Chemical Facilities Could Cause Economic Harm and Loss of Life

Experts agree that chemical facilities present an attractive target for  terrorists intent on causing massive damage because many facilities house  toxic chemicals that could become airborne and drift to surrounding areas  if released. Justice has concluded that the risk of an attempt in the foreseeable  future to cause an industrial chemical release is both real and credible. However, RMP  facilities must submit to EPA estimates, including the residential  population located within the range of a toxic gas cloud produced by a  “worst-case” chemical release, called the “vulnerable zone.” According to  EPA, 123 chemical facilities located throughout the nation have toxic  “worst-case” scenarios where more than one million people could be at  risk of exposure to a cloud of toxic gas. Currently, no one has comprehensively assessed security across the nation  at facilities that house chemicals. No Federal Requirements Specifically Require Chemical Facilities to Address the Threat of Terrorism

No federal laws explicitly require all chemical facilities to take security  actions to safeguard their facilities against a terrorist attack. A number of federal laws also impose safety requirements on chemical  facilities, but these requirements do not specifically and directly address  security preparedness against terrorism. Second, both the Clean Air Act risk  management plan provisions and the hazard analyses under the  Occupational Safety and Health Act require facility operators to identify  the areas of their facilities that are vulnerable to a chemical release. As we  reported in March 2003, there are a number of practical and legal  arguments against this interpretation. Federal Agencies Have Not Comprehensively Assessed the Vulnerability of the Chemical Industry to Terrorism, but Have Taken Some Preliminary Steps

Despite a congressional mandate to do so, the federal government has not  conducted the assessments necessary to develop comprehensive  information on the chemical industry’s vulnerabilities to terrorist attacks. Federal agencies have taken preliminary steps to assist the industry in its  preparedness efforts. However, neither EPA nor DHS is currently monitoring the extent to  which the industry has implemented security measures. Chemical Industry Has Taken Voluntary Actions to Address Security Concerns but Faces Significant Challenges in Preparing Against Terrorist Attacks

The chemical manufacturing industry has undertaken a number of  voluntary initiatives to address security concerns at chemical facilities,  including developing security guidelines and tools to assess vulnerabilities,  but major challenges remain. In response to the  terrorist attacks on September 11, 2001, ACC—whose members own or  operate approximately 1,000 RMP facilities —-now requires its members,  as a condition of membership, to rank facilities using a screening tool to  evaluate its facilities’ risk level. ACC generally requires third-party verification that the facility  has made the improvements identified in its vulnerability assessment. Despite  industry associations’ efforts to encourage security actions at facilities, the  extent of participation in voluntary initiatives is unclear. The chemical industry faces a number of challenges in preparing facilities  against terrorist attacks, including ensuring that facilities obtain adequate  information on threats and determining the appropriate security measures  given the level of risk. Finally, industry officials stated  that the industry faces a challenge in engaging all chemical facilities in  voluntary security efforts.
Why GAO Did This Study

The events of September 11, 2001, triggered a national re-examination of the security of thousands of industrial facilities that use or store hazardous chemicals in quantities that could potentially put large numbers of Americans at risk of serious injury or death in the event of a terrorist-caused chemical release. GAO was asked to examine (1) available information on the threats and risks from terrorism faced by U.S. chemical facilities; (2) federal requirements for security preparedness and safety at facilities; (3) actions taken by federal agencies to assess the vulnerability of the industry; and (4) voluntary actions the chemical industry has taken to address security preparedness, and the challenges it faces in protecting its assets and operations. GAO issued a report on this work in March 2003 (GAO-03-439).

What GAO Found

Chemical facilities may be attractive targets for terrorists intent on causing economic harm and loss of life. Many facilities exist in populated areas where a chemical release could threaten thousands. The Environmental Protection Agency (EPA) reports that 123 chemical plants located throughout the nation could each potentially expose more than a million people if a chemical release occurred. To date, no one has comprehensively assessed the security of chemical facilities. No federal laws explicitly require that chemical facilities assess vulnerabilities or take security actions to safeguard their facilities from attack. However, a number of federal laws impose safety requirements on facilities that may help mitigate the effects of a terrorist-caused chemical release. Although EPA believes that the Clean Air Act could be interpreted to require security at certain chemical facilities, the agency has decided not to attempt to require these actions in light of the litigation risk and importance of an effective response to chemical security. Ultimately, no federal oversight or third-party verification ensures that voluntary industry assessments of vulnerability are adequate and that security vulnerabilities are addressed. Currently, the federal government has not comprehensively assessed the chemical industry's vulnerabilities to terrorist attacks. EPA, the Department of Homeland Security (DHS), and the Department of Justice have taken preliminary steps to assist the industry in its preparedness efforts, but no agency monitors or documents the extent to which chemical facilities have implemented security measures. Consequently, federal, state, and local entities lack comprehensive information on the vulnerabilities facing the industry. To its credit, the chemical manufacturing industry, led by its industry associations, has undertaken a number of voluntary initiatives to address security at facilities. For example, the American Chemistry Council, whose members own or operate approximately 1,000, or 7 percent, of the facilities subject to Clean Air Act risk management plan provisions, requires its members to conduct vulnerability assessments and implement security improvements. The industry faces a number of challenges in preparing facilities against attacks, including ensuring that all chemical facilities address security concerns. Despite the industry's voluntary efforts, the extent of security preparedness at U.S. chemical facilities is unknown. In October 2002 both the Secretary of Homeland Security and the Administrator of EPA stated that voluntary efforts alone are not sufficient to assure the public of the industry's preparedness. Legislation is now pending that would mandate chemical facilities to take security steps to protect against the risk of a terrorist attack.