Chemical Security: DHS Could Use Available Data to Better Plan Outreach to Facilities Excluded from Anti-Terrorism Standards

What GAO Found

Certain facilities excluded from the Department of Homeland Security's (DHS) Chemical Facility Anti-Terrorism Standards (CFATS) program are regulated by other programs containing requirements or guidance that generally align with at least half of the CFATS 18 standards. For example,

• the U.S. Coast Guard regulates about 3,000 excluded facilities under the Maritime Transportation Security Act of 2002 (MTSA). The MTSA program—designed to deter a maritime transportation security incident—contains requirements or guidelines that generally align with CFATS' standards (e.g., perimeter security), according to GAO's analysis; and
• there are about 150,000 public water systems and more than 25,000 wastewater treatment works regulated by the U.S. Environmental Protection Agency (EPA) that are excluded from the CFATS program. EPA's Risk Management Program regulates certain facilities for accidental chemical releases. Also, the America's Water Infrastructure Act of 2018 program requires certain public water systems to develop risk assessments and emergency response plans. GAO found that these programs include requirements or guidance that generally align with over half of CFATS' standards (see figure) but do not align on elements such as employee background checks.

Number of Department of Homeland Security Chemical Facility Anti-Terrorism Standards That Generally Align with Select Programs' Requirements or Guidance

DHS has conducted outreach to hundreds of excluded water and wastewater facilities but has not assessed available EPA data that may help better inform outreach planning decisions. Through the Protective Security Advisor Program, DHS conducted voluntary outreach security assessments with 389 water and wastewater facilities from March 2017 to April 2020. GAO found that there are at least 1,600 water and wastewater facilities with threshold quantities of hazardous chemicals and that at least 65 of the 389 outreach security assessments involved such facilities. DHS receives data monthly from EPA that identify facilities with threshold quantities of hazardous chemicals but has not assessed the data to inform Protective Security Advisors Program outreach planning. By assessing EPA data when planning outreach to public water system and wastewater treatment works facilities, DHS could help better ensure that it is allocating resources to provide the greatest possible risk reduction.

Why GAO Did This Study

Facilities that produce, use, or store hazardous chemicals could be targeted or used by terrorists to inflict mass casualties and damage. DHS established the CFATS program to assess the risk posed by facilities with threshold quantities of hazardous chemicals of interest and inspect them to ensure compliance with DHS standards. However, certain types of facilities subject to other regulatory programs are excluded from the CFATS program by statute. Excluded facilities include facilities regulated under the MTSA program, public water systems, and wastewater treatment works.

GAO was asked to review issues related to excluded facilities. This report addresses, among other things, the extent to which (1) selected federal programs that regulate excluded facilities contain requirements or guidance that align with CFATS standards, and (2) DHS conducts outreach to excluded facilities. GAO analyzed the most recent available data on excluded facilities from DHS, EPA, and other agencies; reviewed and analyzed statutes, regulations, and program guidance; and interviewed agency officials.