Chemical Security 20 Years after the Oklahoma City Bombing

In 1995, a domestic terrorist killed 168 people and injured hundreds more when he used a fertilizer bomb to blow up a federal building in Oklahoma City. The Department of Homeland Security has since stated that terrorists could target any of the tens of thousands of facilities throughout the United States that house hazardous chemicals—like the ammonium nitrate fertilizer used in that bombing. If stolen or released, these chemicals could inflict mass casualties.

DHS is responsible for ensuring that these facilities are secure. But we found vulnerabilities when we looked into chemical security.

Danger zone

Certain facilities must report the types and amounts of chemicals they hold so DHS can determine which facilities are high-risk. High-risk facilities must then implement measures to secure the chemicals.

Yet DHS may be miscalculating risks for thousands of facilities. One factor DHS takes into account when determining risk is based on what it calls the distance of concern—how far damage could spread if toxic chemicals were released. Facilities use an online calculator to measure the distance of concern, then report the results to DHS.

By our analyses, more than 2,700 of 6,400 facilities with toxic-release chemicals misreported the distance of concern. For example, a facility with more than 200,000 pounds of anhydrous ammonia—a pungent gas with suffocating fumes—reported a distance of concern less than a mile. Using the same calculator, we determined the correct distance was nearly triple that.

(Excerpted from GAO-15-614)

We recommended that DHS verify distances of concern so it can accurately identify and oversee the facilities that could cause the greatest harm. In response, DHS outlined steps it will take to do so.

A tighter lid on hazardous chemicals

DHS also requires high-risk facilities to have a plan for securing their sites—such as putting up perimeter fencing or controlling who can access the area. It then inspects the facilities to see if the plans are in the place.

But as of early 2015, nearly half of DHS’s 69 inspections found facilities that hadn’t fully complied with security plans.

While DHS can impose fines, officials told us that none of the violations they found rose to that level. They also said that they prefer to work with facilities on a case-by-case basis, and believe collaboration ultimately results in better compliance than fines and other enforcement actions.

Given that DHS has over 1,600 facilities left to inspect, we recommended that it develop a way to track noncompliant facilities and make sure they follow through with their planned security improvements. DHS again agreed to do so.

Comments on GAO’s WatchBlog? Contact blog@gao.gov.