DHS assumed formal administration of Plum Island from USDA on June 1,  2003, as provided by the Homeland Security Act of 2002. ARS scientists at  Plum Island are responsible for research on foreign livestock diseases,  while APHIS scientists are responsible for diagnosing livestock diseases. On August 13, 2002, 71 of these employees went on strike. However,  Plum Island remains vulnerable to security breaches because its security  arrangements are incomplete and limited. This also allows armed guards to remain in the building while the other  armed guards go to the harbor to inspect vehicles unloaded from the  ferry and ensure that individuals departing the ferry onto Plum Island  have permission to be there; conducting a background check for government staff and contractors  working on the island and performing more rigorous checks for  individuals with access to the pathogens;  installing some video cameras to (1) increase the probability of timely  detection of an intruder and (2) monitor the activities of those inside the  biocontainment area when they remove pathogens from the storage  area—or the repository;  installing intrusion detection alarms in the administrative building and  the biocontainment area;  limiting access to pathogens by installing certain access control devices;  and  improving pathogen control and accountability by completing and  maintaining an inventory of pathogens at the facility, submitting names  of those with access to pathogens to the U.S. Attorney General, and  creating security and incident response plans, as required by law. Despite Improvements, Security Arrangements at Plum Island Are Incomplete and Have Serious Limitations

Although security at the Plum Island Animal Disease Center has improved  over the past few years, fundamental concerns remain. For example, the continued operation of the Plum Island  Animal Disease Center is dependent on its infrastructure, which has limited  protection. Access to Pathogens Is Not Adequately Controlled

Access to pathogens at the Plum Island Animal Disease Center is not  adequately controlled. This is a critical  shortcoming because, according to DHS, the nation faces a significant risk  of a terrorist attack. Plum Island’s Security Plan Does  The risk that an adversary might try to steal pathogens is, in our opinion,  Not Address All Risks and  Threats  higher than USDA believed it to be in 2001, when it defined the same risks  for all of its laboratories, including Plum Island. USDA Concluded Its Contractor’s Performance Declined during the Strike but Operations Continued and Overall Performance Was Superior

Regarding the contractor’s performance, despite a decline from the  previous rating period, USDA rated LB&B Associates’ performance as  superior for the rating period during which the strike occurred. Finally, because we believe the level of risk at Plum Island is higher  than USDA originally determined, and because USDA did not validate  threats with intelligence agencies or local law enforcement officials, DHS  cannot be assured that Plum Island’s security, including its physical  security system and response plans, is sufficient to address the full range of  events that could occur on the island. Consult with other laboratories to identify ways to mitigate the inherent  difficulty of securing pathogens. While we  agree that armed guards are necessary for security on Plum Island, our  concern is that the guard force did not have authority from USDA to  carry firearms and make arrests.
Why GAO Did This Study

Scientists at the Plum Island Animal Disease Center are responsible for protecting the nation against animal diseases that could be accidentally or deliberately introduced into the country. Questions about the security of Plum Island arose after the 2001 terrorist attacks and when employees of the contractor hired to operate and maintain the Plum Island facilities went on strike in August 2002. GAO reviewed (1) the adequacy of security at Plum Island and (2) how well the contractor performed during the strike. The Department of Homeland Security (DHS) assumed the administration of Plum Island from the Department of Agriculture (USDA) on June 1, 2003. While DHS is now responsible for Plum Island, USDA is continuing its research and diagnostic programs.

What GAO Found

Security at the Plum Island Animal Disease Center has improved, but fundamental concerns leave the facility vulnerable to security breaches. First, Plum Island's physical security arrangements are incomplete and limited. Second, Plum Island officials have been assuming unnecessary risks by not adequately controlling access to areas where pathogens are located. Controlling access is particularly important because pathogens are inherently difficult to secure at any facility. Although this risk may always exist, DHS could consult with other laboratories working with pathogens to learn different approaches to mitigate this risk. Third, Plum Island's security response has limitations. For example, the guard force has been armed but has not had the authority from USDA to carry firearms or make arrests. Moreover, Plum Island's incident response plan does not consider the possibility of a terrorist attack. Fourth, the risk that an adversary may try to steal pathogens is, in our opinion, higher at the Plum Island Animal Disease Center than USDA originally determined because of hostilities surrounding the strike. Also, when USDA developed its security plan for Plum Island, it did not review their defined threats with the intelligence community and local law enforcement officials to learn of possible threats--and their associated risks--relevant to the Plum Island vicinity. Although these reviews did not occur, USDA subsequently arranged to receive current intelligence information. Despite a decline in performance from the previous rating period, USDA rated the contractor's performance as superior for the rating period during which the strike occurred.