BSL-4 Laboratories Improved Perimeter Security Despite Limited Action by CDC
GAO-09-1038T: Published: Sep 22, 2009. Publicly Released: Sep 22, 2009.
Biosafety laboratories are primarily regulated by either the Department of Health and Human Services (HHS) or the U.S. Department of Agriculture (USDA), depending on whether the substances they handle pose a threat to the health of humans or plants, animals, and related products, respectively. Currently, all operational biosafety level 4 (BSL-4) labs are overseen by HHS's Centers for Disease Control and Prevention (CDC). BSL-4 labs handle the world's most dangerous agents and toxins that cause incurable and deadly diseases. This testimony summarizes GAO's previously issued reports on perimeter security at the nation's BSL-4 laboratories that were issued in September 2008 (GAO-08-1092) and July 2009 (GAO-09-851). Specifically, this testimony describes (1) the findings and recommendation on key perimeter security controls at five of the nation's operational BSL-4 labs, (2) CDC efforts to address our recommendation, (3) improvements that have been made to the perimeter security controls at the two labs found to be deficient, and (4) other observations about the BSL-4 labs GAO assessed.
Significant perimeter security differences continue to exist among the nation's five BSL-4 laboratories operational at the time of GAO's assessment. In September 2008, GAO reported that three of the five labs had all or nearly all of the 15 key controls GAO evaluated. Two labs, however, demonstrated a significant lack of these controls, such as camera coverage for all exterior lab entrances and vehicle screening. As a result, GAO recommended that CDC work with USDA to require specific perimeter security controls at high-containment facilities. However, as we reported in July 2009, CDC has taken limited action on the GAO recommendation. In July 2009, GAO reported that the two deficient labs made progress on their own despite CDC's limited action. One made a significant number of improvements, thus reducing the likelihood of intrusion. The second made a few changes and formed a committee to consider and prioritize other improvements. Two additional observations about BSL-4 labs concern the significant perimeter security differences among the five labs GAO originally assessed for our September 2008 report. First, labs with stronger perimeter controls had additional security requirements mandated by other federal agencies. For example, one lab is a military facility subject to far stricter Department of Defense physical security requirements. Second, CDC inspection officials stated their training and experience has been focused on safety. CDC officials said they are developing a comprehensive strategy for safety and security of labs and will adjust the training and inspection process to match this strategy.