Summary: The National Strategy for Homeland Security grouped critical infrastructure into 13 sectors which include assets that if attacked by terrorists could have a debilitating impact on the nation. Two of these 13 sectors are the chemical and water sectors. The total number of chemical sector facilities is not clear. DHS estimates that there are 4,000 chemical manufacturing facilities that produce, use, or store more than threshold amounts of chemicals that EPA has estimated pose the greatest risk to human health and the environment. There are approximately 53,000 community water systems and more than 2,900 maritime facilities that are required to comply with security regulations under the Maritime Transportation Security Act (MTSA). This report provides information about what federal requirements exist for the chemical and water sectors to secure their facilities, what federal efforts were taken by the lead agencies for these sectors to facilitate sectors' actions, what actions selected facilities within these sectors have taken and whether they reflect a risk management approach, what obstacles they say they faced in implementing enhancements, and what are the Coast Guard's results from its inspection of regulated maritime facilities' security enhancements.
Few federal requirements address the security of the chemical and water sectors. However, the Department of Homeland Security (DHS) and the Environmental Protection Agency (EPA) have taken actions to assist the chemical and water sectors to implement security enhancements including providing financial assistance in the form of grants, threat information and guidance, training and exercises, and infrastructure protection initiatives, as well as setting security requirements for some facilities and reviewing actions by maritime facilities to determine compliance with MTSA. Except for facilities covered by MTSA, the chemical sector's security efforts are not regulated. The water sector is regulated by the Bioterrorism Act of 2002, which, among other things, requires community water systems to perform vulnerability analyses of their facilities. Chemical facilities and community water systems reported making security improvements separate from federal requirements. The chemical industry's two principal trade associations require their members to follow a security code that includes elements of a risk management framework such as completing vulnerability assessments and taking actions based on those assessments. Officials at all 10 chemical facilities GAO visited reported making significant progress in implementing the trade associations' security code. However, the proportion of total chemical facilities covered by the code is uncertain. The 8 water systems GAO visited reported completing their required vulnerability assessments, which is one element of a risk management framework. Although community water systems are not required to take any risk reduction measures under the Bioterrorism Act, these 8 water systems reported implementing a number of enhancements, such as increasing access controls. Officials representing 8 of the 10 chemical facilities and 8 community water systems GAO visited reported encountering obstacles in making security enhancements and maintaining a level of security consistent with their needs. Officials at 3 chemical facilities reported experiencing difficulties, such as delays, in obtaining permits or other approvals needed from federal authorities to install fences to better protect the perimeter of their facilities. Officials at 6 of the community water systems GAO visited reported economic constraints, such as balancing the need for rate increases to fund security enhancements with efforts to keep rates low. MTSA's security requirements cover more than 2,900 maritime facilities, including chemical facilities. The Coast Guard found that 97 percent of these facilities complied with MTSA and its implementing regulations. The Coast Guard took 312 enforcement actions against 98 facility owners and operators and imposed operational controls on 29 facilities across the more than 2,900 MTSA-regulated facilities. DHS and EPA generally concurred with the contents of the report.
