oversight

Combating Bioterrorism: Actions Needed to Improve Security at Plum Island Animal Disease Center

Published by the Government Accountability Office on 2003-09-19.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Ranking Democratic Member, Committee
                 on Agriculture, Nutrition and Forestry,
                 U.S. Senate


September 2003
                 COMBATING
                 BIOTERRORISM
                 Actions Needed to
                 Improve Security at
                 Plum Island Animal
                 Disease Center




GAO-03-847

                 a

                                                September 2003


                                                COMBATING BIOTERRORISM

                                                Actions Needed to Improve Security at
Highlights of GAO-03-847, a report to the       Plum Island Animal Disease Center
Ranking Democratic Member, Committee
on Agriculture, Nutrition and Forestry, U.S.
Senate




Scientists at the Plum Island                   Security at the Plum Island Animal Disease Center has improved, but
Animal Disease Center are                       fundamental concerns leave the facility vulnerable to security breaches.
responsible for protecting the                  First, Plum Island’s physical security arrangements are incomplete and
nation against animal diseases that             limited. Second, Plum Island officials have been assuming unnecessary risks
could be accidentally or                        by not adequately controlling access to areas where pathogens are located.
deliberately introduced into the
country. Questions about the
                                                Controlling access is particularly important because pathogens are
security of Plum Island arose after             inherently difficult to secure at any facility. Although this risk may always
the 2001 terrorist attacks and when             exist, DHS could consult with other laboratories working with pathogens to
employees of the contractor hired               learn different approaches to mitigate this risk. Third, Plum Island’s security
to operate and maintain the Plum                response has limitations. For example, the guard force has been armed but
Island facilities went on strike in             has not had the authority from USDA to carry firearms or make arrests.
August 2002. GAO reviewed (1) the               Moreover, Plum Island’s incident response plan does not consider the
adequacy of security at Plum Island             possibility of a terrorist attack. Fourth, the risk that an adversary may try to
and (2) how well the contractor                 steal pathogens is, in our opinion, higher at the Plum Island Animal Disease
performed during the strike. The                Center than USDA originally determined because of hostilities surrounding
Department of Homeland Security                 the strike. Also, when USDA developed its security plan for Plum Island, it
(DHS) assumed the administration
of Plum Island from the
                                                did not review their defined threats with the intelligence community and
Department of Agriculture (USDA)                local law enforcement officials to learn of possible threats—and their
on June 1, 2003. While DHS is now               associated risks—relevant to the Plum Island vicinity. Although these
responsible for Plum Island, USDA               reviews did not occur, USDA subsequently arranged to receive current
is continuing its research and                  intelligence information.
diagnostic programs.
                                                Despite a decline in performance from the previous rating period, USDA
                                                rated the contractor’s performance as superior for the rating period during
                                                which the strike occurred.
GAO recommends that DHS
consult with USDA to correct
physical security deficiencies;                 Plum Island Animal Disease Center
further limit access to pathogens;
consult with other laboratories to
identify ways to mitigate the
inherent difficulty of securing
pathogens; enhance response
capabilities; reconsider risks and
threats; and revise security and
incident response plans as needed.

DHS agreed with the report and has
started to implement our
recommendations. USDA stated
that the report was very useful.
                                                Source: DHS.




www.gao.gov/cgi-bin/getrpt?GAO-03-847

To view the full product, including the scope
and methodology, click on the link above. For
more information, contact Larry Dyckman at
(202) 512-3841 or dyckmanl@gao.gov.
Contents




Letter
                                                                                                       1
                             Results in Brief 
                                                               3
                             Background                                                                       6

                             USDA Has Taken Strides To Improve Security at Plum Island, but 

                               Fundamental Concerns Remain                                                   11
                             USDA Concluded Its Contractor’s Performance Declined during the
                               Strike but Operations Continued and Overall Performance Was
                               Superior                                                                       22
                             Conclusions                                                                     
22
                             Recommendations for Executive Action 
                                           23
                             Agency Comments
                                                                 24


Appendixes
              Appendix I:    Scope and Methodology                                                           28
             Appendix II:    Additional Observations on Plum Island’s Security System by
                             GAO’s Office of Special Investigations                                          30
             Appendix III:   LB&B Associates’ Performance, Employee Qualifications,
                             and Costs                                                                       31
                             Performance
                                                                    31
                             Employee Qualifications 
                                                       34
                             Costs Attributable to the Strike 
                                              35
             Appendix IV:    Comments from the Department of Homeland Security                               39
              Appendix V:    Comments from the U.S. Department of Agriculture                                43
             Appendix VI:    GAO Contact and Staff Acknowledgments                                           46
                             GAO Contact                                                                     46
                             Acknowledgments                                                                 46


Table                        Table 1: Summary of the Award Fee Determination Board’s Rating
                                      of LB&B Associates’ Performance from April 2002 to
                                      January 2003.                                                          34


Figures                      Figure 1: Plum Island, New York                                                  7
                             Figure 2: USDA Award Fee Determination Board’s Composite
                                       Scores for LB&B Associates’ Performance from October
                                       1999 through January 2003                                             33
                             Figure 3: Monthly Costs Billed to USDA, October 2001 through May
                                       2003                                                                  36



                             Page i           GAO-03-847 Improving Security at Plum Island Animal Disease Center
Contents




Abbreviations

APHIS       Animal and Plant Health Inspection Service

ARS         Agricultural Research Service

DHS         Department of Homeland Security

FBI         Federal Bureau of Investigation

GAO         General Accounting Office

USDA        U.S. Department of Agriculture


 This is a work of the U.S. government and is not subject to copyright protection in the
 United States. It may be reproduced and distributed in its entirety without further
 permission from GAO. However, because this work may contain copyrighted images or
 other material, permission from the copyright holder may be necessary if you wish to
 reproduce this material separately.




Page ii              GAO-03-847 Improving Security at Plum Island Animal Disease Center
A

United States General Accounting Office
Washington, D.C. 20548



                                    September 19, 2003


                                    The Honorable Tom Harkin

                                    Ranking Democratic Member

                                    Committee on Agriculture, Nutrition and Forestry

                                    United States Senate


                                    Dear Senator Harkin: 


                                    The Plum Island Animal Disease Center—located in Long Island Sound off 

                                    the coast of New York—researches contagious animal diseases that have

                                    been identified in other countries. The mission of the facility is to develop 

                                    strategies for protecting the nation’s animal industries and exports from 

                                    these foreign animal diseases, which could be accidentally or deliberately 

                                    introduced into the United States. Scientists at Plum Island—often with 

                                    the assistance of scientists from other countries—identify the pathogens 

                                    and toxins (hereafter called pathogens) that cause these foreign animal 

                                    diseases and then work to develop vaccines against them. Some of the 

                                    pathogens maintained at the Plum Island Animal Disease Center, such as 

                                    foot-and-mouth disease, are highly contagious to livestock and could cause 

                                    catastrophic economic losses in the agricultural sector if they were 

                                    released outside the facility. A few can also cause illness and death in

                                    humans. For this reason, research on these pathogens is conducted within

                                    a sealed biocontainment area that has special safety features designed to 

                                    contain the pathogens. 


                                    Until recently, the Department of Agriculture (USDA) administered Plum

                                    Island, but in June 2003, it became the responsibility of the Department of 

                                    Homeland Security (DHS).1 DHS officials told us that during a transition

                                    period that will last until September 31, 2003, they will review USDA’s

                                    policies and procedures for Plum Island and determine how best to

                                    administer the facility. USDA will continue to have access to the facility to 

                                    perform its research and diagnostic programs.





                                    1
                                     The Homeland Security Act of 2002 (P.L. 107-296, § 310) authorized the transfer of Plum
                                    Island to DHS.




                                    Page 1                GAO-03-847 Improving Security at Plum Island Animal Disease Center
Concerns about security at the Plum Island Animal Disease Center were
heightened after the terrorist attacks of September 11, 2001, because of
fears that someone might try to steal certain pathogens from the facility to
conduct bioterrorist activities. As a result, USDA contracted with Sandia
National Laboratories—experts involved in a range of national security
areas, including ensuring the safety of nuclear weapons—to evaluate the
effectiveness of, and make recommendations to improve, Plum Island’s
security program. USDA worked with Sandia to develop a risk
management approach to improve security on the island. Some other
agencies employ this method for their security planning, including the
Department of Energy; we have also endorsed a risk management
approach for addressing security risks.2

Risk management is a deliberate process for determining risk: that is, how
likely it is that a threat will harm an asset and how severe the consequences
would be if the asset were harmed, and then deciding on and implementing
actions to create a certain level of protection or preparedness. Risk
management acknowledges that while risk generally cannot be eliminated,
enhancing protection from known or potential threats can reduce it. A
facility adopting this approach should document in a security plan the
assets the facility is protecting as well as the likely adversaries and their
capabilities (the threat), the probability that an adversary will attempt to
threaten those assets and the consequences of the adversary succeeding
(the risk), and the weaknesses that might allow an adversary to be
successful (the vulnerability). The identified threats, risks, and
vulnerabilities are used to design the physical security system. Because
security systems cannot protect against all threats, the facility should also
develop an incident response plan that clearly lays out the actions to be
taken if an event occurs that exceeds the capability of the security system.
The risk management process is ongoing; as new information develops or
events occur, security is reevaluated and corrective actions are taken.

In August 2002, congressional concerns about the security of pathogens at
the Plum Island Animal Disease Center arose when 71 employees of the
contractor USDA had hired to operate and maintain the facility, LB&B
Associates Inc., went on strike. You asked us to determine (1) the
adequacy of security at Plum Island and (2) how well LB&B Associates
performed from August 2002, the month that its workers went on strike,


2
U.S. General Accounting Office, Homeland Security: A Risk Management Approach Can
Guide Preparedness Efforts, GAO-02-208T (Washington, D.C.: Oct. 31, 2001).




Page 2              GAO-03-847 Improving Security at Plum Island Animal Disease Center
                    through January 2003. To address the first question, we visited Plum Island
                    several times to gain an understanding of the work performed there, the
                    operation of the facilities, and to examine the security measures and plans.
                    We also spoke with officials from DHS, USDA, Sandia National
                    Laboratories, the National Institutes of Health, the U.S. Army Medical
                    Research Institute of Infectious Diseases, the Central Intelligence Agency,
                    the Defense Intelligence Agency, the Federal Bureau of Investigation (FBI),
                    USDA’s Office of Inspector General, and government officials of localities
                    near Plum Island. To address the second question we, among other things,
                    reviewed LB&B Associates’ contract; interviewed pertinent officials; and
                    reviewed USDA’s ratings of LB&B Associates’ performance, the
                    qualifications of its employees to perform certain tasks, and costs that
                    LB&B Associates incurred, but we did not independently rate the
                    contractor’s performance. Before the administration of Plum Island
                    transferred to DHS, we briefed USDA and DHS officials on our preliminary
                    findings and made suggestions for improvement so that they could take
                    immediate corrective measures. Additional details about our scope and
                    methodology are contained in appendix I.



Results in Brief	   Security at the Plum Island Animal Disease Center has improved, but
                    fundamental concerns remain. Before the September 2001 terrorist
                    attacks, officials at the Plum Island Animal Disease Center were less
                    conscious of security and focused primarily on the safety of research
                    activities and operations. Immediately after the attacks, USDA began a
                    concerted effort to assess security at many of its laboratories, including
                    Plum Island. Using a risk management approach that Sandia had
                    suggested, USDA identified certain pathogens as the primary asset
                    requiring protection, the potential threats to this asset, and the associated
                    risk. USDA also began steps to upgrade security, some of which DHS has
                    continued. For example, USDA hired armed guards to patrol the island and
                    installed fingerprint recognition locks on freezers containing pathogens.
                    Despite such improvements, we identified shortcomings in Plum Island’s
                    security arrangements.

                    First, Plum Island’s physical security is incomplete and limited. For
                    example, the alarms and door sensors that Sandia recommended for the
                    biocontainment area are not fully operational. Our Office of Special
                    Investigations also identified shortcomings such as inadequate lighting to
                    support the security cameras outside the research complex. Moreover,
                    USDA did not provide sufficient physical security for certain assets,
                    including the foot-and-mouth disease vaccine bank, and assets critical to



                    Page 3            GAO-03-847 Improving Security at Plum Island Animal Disease Center
the continued operation of the facility. DHS officials agree that alarms and
door sensors for the biocontainment area are important and anticipate that
they will be in place by December 2003. DHS officials also told us they are
in the process of evaluating other physical security decisions made by
USDA. We are recommending actions to correct Plum Island’s physical
security deficiencies.

Second, Plum Island officials have not adequately controlled access to the
pathogens. For example, in an effort to continue its mission, USDA
permitted eight scientists from other countries access to the
biocontainment area without being escorted, despite incomplete
background checks. In addition, background checks are not conducted on
students who regularly attend classes within the biocontainment area.
According to the FBI, allowing anyone involved with pathogen-related
activities—and, in particular, scientists from other countries—access to the
biocontainment area without a completed background investigation
represents a significant security risk. Furthermore, not all individuals
entering the biocontainment area for the purpose of performing
nonlaboratory functions, such as cleaning, have been escorted as required
by regulations. DHS officials expressed concerns about this issue and said
they are reviewing USDA policies and practices. Finally, controlling access
to the pathogens is particularly important because no security device is
currently capable of detecting a microgram of pathogenic material.
Therefore, a scientist at Plum Island, or any other laboratory, could remove
a tiny quantity of pathogen without being detected and potentially develop
it into a weapon. This condition is common to all facilities performing
biological research. Although this risk may always exist, DHS could
consult with other laboratories working with pathogens to learn about their
different approaches for mitigating this risk. For example, at the U.S. Army
Medical Research Institute of Infectious Diseases, background checks are
required to be updated regularly to evaluate the continued suitability and
reliability of employees working with pathogens. DHS officials agree that
additional measures could help safeguard the pathogens at Plum Island and
stated that they have taken responsibility for performing background
checks on all scientists prior to being admitted to the biocontainment area
and added escorts. We are recommending actions to further limit access to
pathogens and to identify ways to mitigate the inherent difficulty of
securing pathogens.

Third, Plum Island’s incident response capability has limitations. For
example, the guard force on Plum Island has been operating without
authority from USDA to carry firearms or to make arrests. Until this



Page 4            GAO-03-847 Improving Security at Plum Island Animal Disease Center
authority is provided, local law enforcement officials said they are
reluctant to help address criminal situations on the island. In addition,
Plum Island officials have never specified how long they believe it should
take for local law enforcement to respond to incidents. Moreover, Plum
Island’s incident response plan does not address what to do in the event of
an incident that exceeds the capability of the security system, such as a
terrorist attack. Finally, Plum Island officials have not tested the facility’s
response capability to ensure its effectiveness. DHS officials said they
have started to take actions to fully address these incident response issues
and are obtaining assistance from the Federal Protective Service. We are
recommending that DHS officials enhance Plum Island’s incident response
capability.

Fourth, the risk that an adversary might try to steal pathogens is, in our
opinion, higher than USDA believed it to be in 2001, when it defined the
same risks for all of its laboratories, including Plum Island. USDA
considered the risk that an adversary would try to steal pathogens from any
of its laboratories to be relatively low compared to materials found at other
laboratories, such as nuclear material or pathogens of a higher
consequence to the human population. Since that time, however, the level
of risk at Plum Island has increased because of the strike that occurred in
August 2002 and the hostility surrounding it. For example, one striker has
been convicted of tampering with the island’s water distribution and
treatment system as he walked off the job the day the strike began. USDA
officials suspect that this individual did not act alone. The intelligence
community considers disgruntled employees to be threats who pose a
security risk. Although USDA did consider the possibility of a disgruntled
worker when planning security for all of its laboratories, it did not
reevaluate the level of risk, the assets requiring protection, or its incident
response plans for Plum Island in light of specific events related to the
strike. Furthermore, Sandia had originally recommended that USDA
review the defined threats with the intelligence community and local law
enforcement officials to ensure that threats particular to Plum Island and
its vicinity were taken into consideration, but this was never done. FBI and
Suffolk County officials told us that they consider this step to be very
important because if there are such threats, federal and local officials may
know of their existence and the risks they pose to the Plum Island Animal
Disease Center. DHS officials told us they recognize the importance of
working with local law enforcement and the intelligence community in
order to better identify the threats relevant for planning security for Plum
Island. We are recommending that DHS reconsider the risks and threats to
Plum Island and revise the security and incident response plans as needed.



Page 5             GAO-03-847 Improving Security at Plum Island Animal Disease Center
              Regarding the contractor’s performance, despite a decline from the
              previous rating period, USDA rated LB&B Associates’ performance as
              superior for the rating period during which the strike occurred. Also, as a
              result of the strike, LB&B Associates exceeded its estimated budget by
              about $511,000, or approximately 5 percent, for fiscal year 2002 and the
              first quarter of fiscal year 2003. USDA was aware of and approved the cost
              increases.

              We provided DHS and USDA with a draft of this report for their review and
              comment. Both agencies provided written and clarifying oral comments.
              The agencies also provided technical comments, which we incorporated
              into the report as appropriate. DHS agreed with the report and stated that
              it has started to implement our recommendations. USDA stated that the
              report was very useful, but raised several concerns. For example, USDA
              stated that it appropriately used armed guards on Plum Island. Our
              concern is that USDA employed armed guards without ensuring that they
              had appropriate authority from USDA to carry firearms or make arrests.
              Furthermore, USDA had not developed a policy for instructing its guards
              on Plum Island about when and how they could use force, including the
              firearms they were carrying. DHS stated that it is working to resolve these
              issues.



Background	   Plum Island is a federally owned 840-acre island off the northeastern tip of
              Long Island, New York. It is about 1.5 miles from Orient Point, New York
              (see fig. 1), and about 12 miles from New London, Connecticut. Access to
              Plum Island is by a ferry service operated by a contractor that transports
              employees from Orient Point and Old Saybrook, Connecticut.




              Page 6            GAO-03-847 Improving Security at Plum Island Animal Disease Center
Figure 1: Plum Island, New York




The U.S. Army used Plum Island during World War II as a coastal defense
artillery installation until it was declared surplus property in 1948. In 1952,
the U.S. Army Chemical Corps constructed a biological research
laboratory, but it was never used. Then, in response to a foot-and-mouth
disease outbreak in Canada, the Congress transferred all of Plum Island to
USDA in 1954 for the purpose of researching and diagnosing animal
diseases from other countries, including foot-and-mouth disease, which has
not been seen in the United States since 1929.




Page 7             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Foot-and-mouth disease is the most feared foreign animal disease because
it is highly contagious and can have serious effects on the economy.
Slaughtering susceptible animals and quarantining both animals and
humans in affected areas helps limit the spread of the disease, but it can,
nevertheless, have devastating economic consequences, as demonstrated
during the 2001 outbreak in the United Kingdom. By the time the disease
was eradicated, about 8 months later, the United Kingdom had slaughtered
over 4 million animals and sustained losses of over $5 billion in the food
and agricultural industries, as well as comparable losses in tourism.3

Many other types of animal diseases are also studied at the Plum Island
Animal Disease Center, such as classical swine fever; rinderpest; and a
variety of pox viruses, including goat, camel, and deer pox. Some of the
diseases are caused by pathogens that are zoonotic—that is, they can
infect, and possibly cause death, in both animals and humans. Zoonotic
pathogens maintained at Plum Island Animal Disease Center include West
Nile virus, Venezuelan equine encephalitis, Rift Valley fever, and vesicular
stomatitis. Because of the importance of the livestock industry to the U.S.
agricultural sector and economy, protecting livestock from these diseases
is an important responsibility.

To prevent pathogens from escaping the Plum Island Animal Disease
Center and infecting livestock, wildlife, or humans, all research is
conducted within a specially designed and sealed biocontainment area
within the research facility that adheres to specific safety measures.4 For
example, the biocontainment area has air seals on its doors and operates
with negative air pressure so that air passes through a special filter system


3
 An outbreak directly impacts the trade sector because countries constrain trade with those
markets whose products may be tainted with foot-and-mouth disease. Other sectors, such
as tourism are affected because tourist activities are restricted, especially in quarantined
areas. Production from infected or quarantined herds is zero because production is stopped
when animals are slaughtered and products from infected animals are not permitted into the
food chain.
4
 Laboratories adhere to specific biosafety guidelines according to their designated biosafety
level, which can range from 1 to 4. Biosafety level 1 is acceptable for low-risk organisms
that may be found, for example, in high school laboratories. Biosafety level 4 is reserved for
a number of exotic and highly lethal pathogens, such as ebola. There are only five facilities
in the United States with biosafety level 4 laboratories, including the Department of the
Defense’s U.S. Army Medical Research Institute of Infectious Diseases and the Department
of Health and Human Services’ National Institutes of Health. Plum Island operates a
biosafety level 3 agriculture laboratory with some additional special agricultural safety
features to prevent the release of animal disease pathogens into the environment.




Page 8                 GAO-03-847 Improving Security at Plum Island Animal Disease Center
before leaving the facility. In addition, employees and visitors must change
into protective clothing before entering the biocontainment area and
shower when going between rooms containing different animal diseases
and before leaving the biocontainment area. USDA’s procedures require all
people and material leaving the biocontainment area to be decontaminated.

The Plum Island Animal Disease Center’s biocontainment area totals
approximately 190,000 square feet, and it is unusual because it houses a
laboratory facility with 40 rooms for large animals. The three-level
laboratory also contains the machinery, such as the air filtration system,
necessary for the biocontainment area to function, and the pathogen
repository. Individuals entering the biocontainment area have access to all
three floors. In contrast, biocontainment areas of other laboratories
usually consist of a series of smaller rooms, housing smaller laboratory
animals, making it easier to control access to the pathogens.

As a result of the September 11, 2001, terrorist attacks, Plum Island Animal
Disease Center is now required to abide by new laws and regulations that
were generated to help reduce the possibility of bioterrorism. These laws
and regulations limit access to pathogens to only approved individuals—
those whom USDA has identified as having a legitimate need to handle
agents or toxins and whose names and identifying information have been
submitted to and approved by the U.S. Attorney General. Specifically, the
USA Patriot Act of 20015 prohibits restricted people—such as criminals or
those individuals from countries that the Department of State has declared
to be state sponsors of terrorism—from shipping, receiving, transporting,
or possessing certain dangerous pathogens. In addition, the Agricultural
Bioterrorism Protection Act of 20026 requires that USDA develop an
inventory of potentially dangerous pathogens. Furthermore, individuals
who possess or use pathogens must have background checks and must be
registered with the U.S. Attorney General. Implementing this law are
regulations that became effective on February 11, 2003,7 which state that




5
Pub. L. No. 107-56, § 817.
6
Pub. L. No. 107-188, §§ 211-213.
7
7 CFR part 331.




Page 9                GAO-03-847 Improving Security at Plum Island Animal Disease Center
laboratories must be in compliance with the regulations by November 12,
2003. USDA also requires employees to have favorably adjudicated
background investigations before working unescorted in the
biocontainment area.8

When USDA contracted with Sandia in October 2001, Sandia evaluated the
effectiveness of security at the Plum Island Animal Disease Center and four
other USDA laboratories. Using a risk management approach, USDA first
identified generic lists of assets, risks, and threats for all five laboratories.
Sandia then used USDA’s generic threat definitions to assess the security
and vulnerabilities at each laboratory. Sandia officials found that Plum
Island’s existing security system was inadequate for protecting against the
generic threats that USDA had selected and that it required significant
improvement. Sandia officials also found that the biocontainment building
was not designed to be a highly secure facility. USDA and Sandia agreed,
however, that modifying the facility to withstand an assault would be cost-
prohibitive and that, because pathogens occur naturally and are available
at other laboratories throughout the world, the risk that a terrorist would
try to steal them from Plum Island was not perceived as significant (and
their perception has not changed). Consequently, Sandia recommended a
limited physical security system designed to deter and detect a security
breach and, with assistance from local law enforcement, respond to
incidents exceeding the capability of the guard force on the island.

DHS assumed formal administration of Plum Island from USDA on June 1,
2003, as provided by the Homeland Security Act of 2002. During a
transition period that will last until October 1, 2003, DHS will review
USDA’s policies and procedures and determine how best to administer the
functions of Plum Island. Until the transition is complete, DHS will
administer the facility under the same policies and regulations established
by USDA. Ultimately, the two agencies will work together to address
national biodefense issues and carry out the mission of the Plum Island
Animal Disease Center. While DHS is now formally responsible for
security, scientists and support staff of two USDA agencies, the
Agricultural Research Service (ARS) and the Animal and Plant Health
Inspection Service (APHIS), will continue to implement the Plum Island
Animal Disease Center’s research and diagnostic mission. ARS scientists at
Plum Island are responsible for research on foreign livestock diseases,


8
 USDA Security Policies and Procedures for Biosafety Level-3 Facilities, Agricultural
Research Service, DM 9610-1.




Page 10               GAO-03-847 Improving Security at Plum Island Animal Disease Center
                       while APHIS scientists are responsible for diagnosing livestock diseases.
                       APHIS conducts diagnostic training sessions several times a year to give
                       veterinary health professionals the opportunity to study the clinical signs of
                       animal diseases found in other countries, such as foot-and-mouth disease.
                       According to USDA, scientists from other countries are an integral part of
                       the Plum Island Animal Disease Center’s workforce because they are well
                       qualified and well situated to study the diseases researched there, many of
                       which are endemic to their own countries. These scientists are sponsored
                       by USDA and obtain visas that permit them to work for the department.

                       DHS currently uses USDA’s independent contractor to carry out operations
                       and maintenance functions for Plum Island. The services under the
                       contract include, among other activities, operating the ferries, providing
                       security and emergency fire and medical services, providing buildings and
                       grounds services, meeting utility requirements, and performing custodial
                       functions. On August 13, 2002, 71 of these employees went on strike. The
                       contractor at that time, LB&B Associates, was responsible for handling the
                       strike. On January 6, 2003, LB&B Associates’ contract expired. USDA had
                       initially awarded that contract under a small business program when LB&B
                       Associates still qualified as one. Since that initial award, LB&B Associates
                       had grown so that it no longer was eligible to compete for contracts set
                       aside for small businesses. As a result, USDA awarded the new contract to
                       North Fork Services, a joint venture between LB&B Associates and
                       Olgoonik Logistics LLC, a small minority company of Anchorage, Alaska.
                       Under this arrangement, the more experienced LB&B Associates serves as
                       a mentor to North Fork Services, and most of the employees who worked
                       for LB&B Associates continue to work for North Fork Services. DHS
                       officials told us that they would not renew the contract with North Fork
                       Services. DHS stated that the current terms and scope of the contract are
                       insufficient to operate the facility in accordance with its view of the
                       standards and mission of the Plum Island Animal Disease Center.



USDA Has Taken         Before the September 2001 terrorist attacks, the Plum Island Animal
                       Disease Center, like many other federal laboratories, was less conscious of
Strides To Improve     security and focused primarily on the safety of its programs and
Security at Plum       operations. Since then, USDA intensified its focus on security and has
                       taken strides in developing and installing a security system. However,
Island, but            Plum Island remains vulnerable to security breaches because its security
Fundamental Concerns   arrangements are incomplete and limited.
Remain


                       Page 11            GAO-03-847 Improving Security at Plum Island Animal Disease Center
USDA Has Taken Strides To   Security at Plum Island has improved since the fall of 2001. USDA hired a
Improve Security at Plum    physical security specialist to oversee its efforts to improve security,
                            including the implementation of Sandia’s recommendations, and to provide
Island                      direction for the security measures being taken for Plum Island. 9 As of July
                            2003, completed security upgrades include the following:

                            •	 taking measures to prevent unauthorized access to Plum Island by
                               allowing only sponsored visitors on the ferry and island; identifying
                               those sponsored individuals, and allocating passes, when they board the
                               ferry; and staffing Orient Point, New York, with a security guard as well
                               as installing an access gate that can be opened only with an
                               identification card assigned to Plum Island federal personnel;

                            •	 hiring armed guards to patrol the island and observe personnel and
                               visitors entering and leaving the facility. When the nation is on high
                               terrorist alert (code orange) armed guards are added to monitor access
                               to the biocontainment area and to better secure the island’s perimeter.
                               This also allows armed guards to remain in the building while the other
                               armed guards go to the harbor to inspect vehicles unloaded from the
                               ferry and ensure that individuals departing the ferry onto Plum Island
                               have permission to be there;

                            •	 conducting a background check for government staff and contractors
                               working on the island and performing more rigorous checks for
                               individuals with access to the pathogens;

                            •	 installing some video cameras to (1) increase the probability of timely
                               detection of an intruder and (2) monitor the activities of those inside the
                               biocontainment area when they remove pathogens from the storage
                               area—or the repository;

                            •	 installing intrusion detection alarms in the administrative building and
                               the biocontainment area;



                            9
                             Also, USDA had engaged the U.S. Army Corps of Engineers in August 2000 to make some
                            physical security improvements at Plum Island, but this work was not based on an
                            assessment of threats and risks. Few of the measures suggested by the Corps were
                            implemented. In addition, Sandia officials told us that they did not agree with the approach
                            taken by the Corps and that their physical security recommendations differed significantly.
                            USDA has relied on Sandia’s security recommendations.




                            Page 12               GAO-03-847 Improving Security at Plum Island Animal Disease Center
                                  •	 limiting access to pathogens by installing certain access control devices;
                                     and

                                  •	 improving pathogen control and accountability by completing and
                                     maintaining an inventory of pathogens at the facility, submitting names
                                     of those with access to pathogens to the U.S. Attorney General, and
                                     creating security and incident response plans, as required by law.



Despite Improvements,             Although security at the Plum Island Animal Disease Center has improved
Security Arrangements at          over the past few years, fundamental concerns remain.
Plum Island Are Incomplete
and Have Serious
Limitations

Plum Island’s Physical Security   Plum Island’s physical security system is not yet fully operational. For
Is Incomplete and Limited         example, the facility does not yet have in place all the equipment necessary
                                  to detect intruders in various places. DHS officials agree that these
                                  physical security measures are important and anticipate they will be in
                                  place by December 2003.

                                  In addition, our Office of Special Investigations identified physical security
                                  limitations. For example, we found that lighting is inadequate to support
                                  the cameras outside of the research complex and vehicles are not properly
                                  screened. (See app. II for other limitations identified by our Office of
                                  Special Investigations and observations on how they could be addressed.)

                                  Moreover, the physical security measures that USDA chose to implement
                                  on Plum Island are largely limited to the biocontainment area, where
                                  pathogens are located. Consequently, other important assets remain
                                  vulnerable. For example, the continued operation of the Plum Island
                                  Animal Disease Center is dependent on its infrastructure, which has limited
                                  protection. Protecting the infrastructure is particularly important because
                                  the Plum Island Animal Disease Center is the only facility in the United
                                  States capable of responding to an outbreak and researching foot-and-
                                  mouth disease. Therefore, if the infrastructure was damaged, no other
                                  facility could step in and continue this foot-and-mouth disease work. 10

                                  10
                                     Foot-and-mouth disease cannot be studied on the mainland of the United States unless the
                                  Secretary of Agriculture determines that it is necessary to do so (see 21 U.S.C. § 113a).




                                  Page 13               GAO-03-847 Improving Security at Plum Island Animal Disease Center
                             Furthermore, Plum Island is the only facility in North America that has a
                             foot-and-mouth disease vaccine bank. This bank represents years of
                             cooperative research performed by Canada, Mexico, and the United States,
                             yet the room containing it has a window opening covered with only
                             plywood. USDA officials said they intend to improve the physical security
                             of the vaccine bank but have not yet decided on the approach to take. In
                             addition, DHS officials agree that the Plum Island Animal Disease Center is
                             vital to combating bioterrorism, and they are evaluating the physical
                             security on Plum Island.

Access to Pathogens Is Not   Access to pathogens at the Plum Island Animal Disease Center is not
Adequately Controlled	       adequately controlled. For example, as of July 2003, eight scientists from
                             other countries were working in the biocontainment area without
                             completed background investigations.11 According to FBI officials,
                             allowing anyone who does not have a completed background investigation
                             access to the biocontainment area—in particular, a scientist from another
                             country—represents a significant security risk. USDA officials told us
                             these scientists were allowed into the biocontainment area to enable
                             research to continue. Furthermore, they stated that background
                             investigations had been initiated for these individuals, and it was assumed
                             that these scientists were being escorted, which USDA policy permits for
                             those with pending background investigations. However, Plum Island
                             officials told us that due to resource constraints, it has not been possible to
                             continually escort and monitor scientists while they are in the
                             biocontainment area. When we brought this concern to the attention of
                             DHS officials, they told us they are developing a more restrictive policy for
                             allowing scientists from other countries to have access to pathogens.




                             11
                                USDA officials told us that they considered these scientists to be “grandfathered”—that is,
                             USDA did not require background checks to gain unescorted access because these
                             scientists were employed before enactment of the Bioterrorism Preparedness Act in June
                             2002. In addition, we found that three of these scientists arrived after this date—December
                             2002 and February and May 2003.




                             Page 14                GAO-03-847 Improving Security at Plum Island Animal Disease Center
In addition, USDA policy does not require background checks on students
who attend the foot-and-mouth disease classes that are regularly held in the
biocontainment area. In 2002, USDA held six classes with an average of 32
students per class and anticipates continuing these classes in the future.
According to USDA’s policy, individuals may enter the biocontainment area
without background checks if an approved individual escorts them.12 We
believe this policy warrants reconsideration for several reasons.

•	 Allowing students who do not have background checks into
   biocontainment for purposes of attending foot-and-mouth disease
   classes, with or without an approved escort, may not be consistent with
   the regulations13 implementing the Agricultural Bioterrorism
   Preparedness Act.

•	 These same regulations do not provide an exception for unapproved
   students or other visitors who may be handling or have access to
   pathogens.

•	 USDA officials told us that maintaining constant visual contact with
   even one escorted individual is very difficult because of the size and
   floor plan of the biocontainment area.

USDA officials told us that they believe escorting students is sufficient to
meet the intent of the regulations. However, DHS officials said that all
students should have completed background checks before entering the
biocontainment area and told us they will develop a policy that will ensure
that this occurs once the transition period is complete.

Although USDA’s regulations specifically allow unapproved individuals into
the biocontainment area with an approved escort, we found unescorted
maintenance workers in the biocontainment area. The regulations provide
for unapproved individuals to conduct routine cleaning, maintenance,
repair, and other nonlaboratory functions in the biocontainment area if
they are escorted and continually monitored by an approved individual.14
However, early in our investigation we found that as many as five such


12
   USDA Security Policies and Procedures for Biosafety Level 3-Facilities, Agricultural
Research Service, DM 9610-1.
13
     7 CFR §§ 331.10 and 331.11.
14
     7 CFR § 331.10(a)(2)(iv)(B).




Page 15                  GAO-03-847 Improving Security at Plum Island Animal Disease Center
individuals were working in the biocontainment area without escorts.
When we brought this to the attention of USDA officials, they provided an
escort for these individuals. DHS officials added that the operating
contractor would soon provide security escorts.

Controlling access to pathogens is important because no security device
can currently ensure that an insider, such as a scientist, will not steal
pathogens from the Plum Island Animal Disease Center or other
laboratories. According to the director of the Plum Island Animal Disease
Center—while under USDA’s administration—and officials from Sandia,
the National Institutes of Health, and the U.S. Army Medical Research
Institute of Infectious Diseases, pathogens are more difficult to secure than
other materials that could be used as weapons, such as nuclear material.
This is because there is no existing mechanism capable of detecting the
theft of a microgram of pathogenic material and a tiny quantity can be
multiplied. Thus, a scientist could covertly generate or divert a pathogen
during the normal course of work, remove it from the laboratory
undetected, and potentially develop it into a weapon for spreading disease.
This inherent problem leaves all facilities with pathogens vulnerable to
serious security breaches. Also, the existence of the foot-and-mouth
disease pathogen at the Plum Island Animal Disease Center is a particular
concern because an undetected theft, followed by the spread of the
disease, would have serious economic consequences for the nation. In
addition, the presence of zoonotic diseases at the Plum Island Animal
Disease Center is worrisome because of the potential for adverse health
affects on humans, and two such pathogens are of particular concern.
First, U.S. government research has shown that Venezuelan equine
encephalitis virus can be developed into a human biowarfare agent.
Second, USDA believes that because of the genetic similarities of two pox
strains, it may be possible to manipulate camel pox into an agent as
threatening as smallpox.15 Although USDA created an inventory list of the
pathogens at the Plum Island Animal Disease Center, as required by law,
such a list cannot provide an accurate count of pathogens because
quantities of pathogens change as they replicate.

Thus far, Plum Island officials have secured pathogens by restricting access
to the island itself and to the biocontainment area where the pathogens are


15
   Out of concern that Iraqi scientists were trying to manipulate camel pox for possible
warfare use, USDA conducted work for the Department of Defense to determine if camel
pox could be manipulated into an agent similar to smallpox.




Page 16               GAO-03-847 Improving Security at Plum Island Animal Disease Center
                                  located and by locking the freezers containing the pathogens. But DHS
                                  officials have not yet had the opportunity to fully consider actions other
                                  laboratories are taking to mitigate the likelihood that pathogens could be
                                  stolen. Officials at the U.S. Army Medical Research Institute of Infectious
                                  Diseases at Fort Detrick, Maryland, told us they are taking several steps, in
                                  addition to physical security measures and inventory control, to better
                                  safeguard pathogens against theft. For example, they plan to use trained
                                  personnel as roving monitors to ensure that unauthorized laboratory work
                                  is not being performed, and they will randomly inspect all personnel exiting
                                  laboratories. Moreover, they are interviewing scientists periodically and
                                  requiring that background checks be updated every 5 years in order to
                                  evaluate the continued suitability and reliability of those employees
                                  working with pathogens. Although USDA told us background checks were
                                  updated every 5 years, according to Plum Island records as of July 2003,
                                  12 current Plum Island employees, some of whom have access to
                                  pathogens, had not had their background checks updated in more than
                                  10 years. According to Sandia, other potentially helpful safeguards include
                                  creating, implementing, and enforcing strict policies, including those that
                                  prohibit researchers from continuing work in the biocontainment area if
                                  they do not follow security procedures. DHS officials stated that they have
                                  started to work with other laboratories and that measures such as these,
                                  while not necessarily a panacea, could help improve the security of
                                  pathogens at Plum Island.

Incident Response Capability Is   Plum Island’s incident response capability is limited in four ways. First, the
Limited	                          security guards on each shift carry firearms, although Plum Island does not
                                  have statutory authority for an armed guard force.16 USDA operated the
                                  guard force on Plum Island without authority for the guards to carry
                                  firearms or make arrests. Furthermore, Plum Island officials have not
                                  approved a policy that addresses the use of weapons, and, as a result, the
                                  guards do not know specifically how they are expected to deal with
                                  intruders on the island and when or if they should use their weapons.17




                                  16
                                     USDA’s Office of General Counsel was aware of this issue for over 1 year but had not
                                  resolved it as of June 2003 when DHS became responsible for Plum Island.
                                  17
                                   A draft policy on the use of force was written for the guard force on Plum Island but never
                                  put into use.




                                  Page 17               GAO-03-847 Improving Security at Plum Island Animal Disease Center
When we informed DHS officials of these problems, they agreed to resolve
them as soon as possible and raised the possibility that the Federal
Protective Service18 could be assigned to guard Plum Island. The Federal
Protective Service, now under DHS, has the authority to carry weapons and
make arrests.19 Since DHS has taken responsibility for the island, the
Federal Protective Service has visited Plum Island to assess its security
requirements.

Second, according to the observations of our Office of Special
Investigations, Plum Island has too few guards to ensure safety and
effectiveness.20 DHS officials agree with this observation and said that they
have requested funds to hire additional guards.

Third, arrangements for local law enforcement support are also limited.
According to Sandia’s recommended security plan, in the event an incident
exceeds the response capability of the Plum Island guards, they would first
contact Southold town police, the closest and primary responding law
enforcement agency.21 If still more resources were needed, Southold town
police would contact Suffolk County police, the secondary responder.
Because of liability issues, however, arrangements with local law
enforcement have not been finalized even though there have been
continuing discussions with local law enforcement. The result is that Plum
Island officials cannot predict the extent to which the Southold town police
will provide backup during an incident. On the other hand, officials of
Suffolk County, which includes both Plum Island and Southold, told us that
although it takes longer for them to respond than Southold police, they
could respond with an adequate number of officers, if necessary.22 In
addition, they have requested a map of the island and a tour of the
biocontainment area to become more knowledgeable about the facility and


18
   The Federal Protective Service’s goal is to provide a safe environment in which federal
agencies can conduct their business by reducing threats posed against federal facilities,
which range from terrorism to workplace violence to larcenies.
19
   Under the Homeland Security Act of 2002, DHS has authority for its officers to carry
firearms and make arrests.
20
     Additional observations of our Office of Special Investigations are included in appendix II.
21
  Southold town police are located on Long Island in Suffolk County, approximately 5 miles
from Plum Island.
22
   In a life-and-death situation, the Suffolk County Police Department could respond with a
helicopter, significantly reducing response time.




Page 18                   GAO-03-847 Improving Security at Plum Island Animal Disease Center
its surrounding terrain. Suffolk County officials pointed out, however, that,
for geographical reasons, Southold remains the primary responder. In this
vein, Plum Island officials have never defined an adequate response time,
nor have they conducted exercises with local law enforcement officials to
determine how effectively Plum Island and local officials can address an
incident on the island. DHS officials agree that the arrangements for local
law enforcement support are limited, and they are trying to overcome this
problem as quickly as possible by first resolving the issue surrounding the
authority to make arrests and carry weapons. In addition, these officials
concur that it is important to develop a better understanding of the
response times and capabilities of local law enforcement assistance and to
conduct exercises to test the adequacy of arrangements once they are
completed.

Fourth, according to Sandia officials, the incident response plan for Plum
Island is not sufficiently comprehensive. Plum Island’s incident response
plan contains certain elements required under law, such as how to respond
to an inventory violation or a bomb threat. 23 However, because USDA
selected a risk management approach to security, Plum Island officials
need an incident response plan that clearly lays out the actions to be taken
if events occur that exceed the capability of the facility’s security system.
For example, Plum Island officials do not have a road map for actions to be
taken in the event of a terrorist attack—who gets notified, in what order,
and the responsibilities of staff for responding. This is a critical
shortcoming because, according to DHS, the nation faces a significant risk
of a terrorist attack. Sandia officials also said that the incident response
plan for Plum Island requires significant additional development to
properly prepare for the complete range of threats. Moreover, the incident
response plan does not identify the security steps that should be taken in
the event of an outbreak of foot-and-mouth disease or take into
consideration any increased risks to the facility, which could severely
impede the nation’s capability to contain an outbreak.




23
     See 7 CFR, § 331.11 (a) (3).




Page 19                   GAO-03-847 Improving Security at Plum Island Animal Disease Center
                                   Finally, according to the FBI and local law enforcement officials, the
                                   island’s incident response plan may need to be coordinated with the
                                   incident response plans of such nearby facilities as the Millstone nuclear
                                   power plant, the Brookhaven National Laboratory, and the laboratories at
                                   the State University of New York at Stony Brook because a terrorist attack
                                   on any of these facilities could also involve Plum Island.24 This type of
                                   coordination has not yet taken place. DHS officials agree that the incident
                                   response plan needs to be more comprehensive and coordinated with
                                   national and local law enforcement agencies.

Plum Island’s Security Plan Does   The risk that an adversary might try to steal pathogens is, in our opinion,
Not Address All Risks and          higher than USDA believed it to be in 2001, when it defined the same risks
Threats                            for all of its laboratories, including Plum Island. USDA considered the risk
                                   that an adversary would try to steal pathogens from any of its laboratories
                                   to be relatively low compared to materials found at other laboratories, such
                                   as nuclear material or pathogens of a higher consequence to the human
                                   population. Since its evaluation in 2001, however, the level of risk at Plum
                                   Island has increased because of the strike that occurred in August 2002 and
                                   the hostility surrounding it. For example, one striker has been convicted of
                                   tampering with the island’s water distribution and treatment system as he
                                   walked off the job the day the strike began.25 USDA officials suspect that
                                   this individual did not act alone. In addition to this incident, USDA asked
                                   the FBI and USDA’s Office of Inspector General to investigate the
                                   possibility that a boat engine had been tampered with. USDA also asked
                                   the FBI to investigate why backup generators failed to come on when Plum
                                   Island lost power for more than 3 hours in December 2002.




                                   24
                                    Officials of the FBI’s New York office and of the Suffolk County’s Police Department and
                                   Department of Fire, Rescue and Emergency Service told us that they would welcome the
                                   opportunity to review Plum Island’s security assessment and response plans and would
                                   assist with this coordination.
                                   25
                                    Water pressure is a vital component of the process used to decontaminate materials in the
                                   biocontainment area in order to prevent the spread of animal diseases. Convicted of
                                   malicious mischief for tampering with the water system, the employee was sentenced to 5
                                   years’ probation and ordered to pay restitution.




                                   Page 20               GAO-03-847 Improving Security at Plum Island Animal Disease Center
After the backup generators failed to provide power, New York’s ABC news
station broadcast an interview with a disguised worker, at that time
employed at Plum Island, who discussed his unhappiness with USDA and
the contractor and blamed replacement workers for the power outage.26 In
addition, several of the striking workers returned to work for LB&B
Associates and are still employed on the island under the new contractor,
North Fork Services. In response to the strike, USDA prevented striking
workers from accessing Plum Island and it added guards at Orient Point to
assure the security of employees as they were arriving and departing near
the union picket line. However, USDA did not reevaluate the level of risk,
the assets requiring protection, or its incident response plans in light of the
strike and accompanying sabotage. USDA believed that this was not
necessary because its security plan anticipated a disgruntled worker at any
of its laboratories. We disagree because there is a difference between
addressing security problems caused by one employee and addressing the
hostilities resulting from the strike, which could include several employees
working together. We believe that the implications of a disgruntled work
force should be taken into account when reevaluating the extent of risks,
threats, and assets requiring increased security.

Furthermore, Sandia had originally recommended that USDA review the
defined threats with the intelligence community and local law enforcement
officials to ensure that threats particular to Plum Island and its vicinity
were taken into consideration, but this was never done.27 FBI and Suffolk
County officials told us that they consider this step to be very important
because if there were such threats, federal and local officials may be aware
of them and the risks they pose to the Plum Island Animal Disease Center.
In addition, if local law enforcement entities were involved in planning
Plum Island’s security, they would be in a better position to respond to
incidents on the island.

DHS officials agree that rehiring workers who walked off the job could be
problematic but told us they are under pressure from the local chapter of
the union and the community to rehire those who lost their jobs as a result
of the strike. DHS officials also said they recognize the importance of


26
   USDA officials said that although it was never proven that replacement workers were to
blame for the outage, this illustrates the discontent on the island. Information on the
qualifications of replacement workers can be found in appendix III.
27
 While intelligence officials did not contribute to the assessment of threats to Plum Island,
USDA has established links that provide current information about terrorist threats.




Page 21               GAO-03-847 Improving Security at Plum Island Animal Disease Center
                        working with local law enforcement and the intelligence community to
                        better define the threats and associated risks for Plum Island.



USDA Concluded Its      Regarding the contractor’s performance, despite a decline from the
                        previous rating period, USDA rated LB&B Associates’ performance as
Contractor’s            superior for the rating period during which the strike occurred. When the
Performance Declined    strike occurred, LB&B Associates, with the assistance of USDA employees,
                        maintained operations at Plum Island. For example, LB&B Associates
during the Strike but   implemented a strike contingency plan, brought in qualified individuals
Operations Continued    from its other work sites, and hired subcontractors with the required
and Overall             licenses and certifications to operate certain Plum Island facilities and its
                        boats. Also, as a result of the strike, LB&B Associates exceeded its
Performance Was         estimated budget by about $511,000, or approximately 5 percent, for fiscal
Superior                year 2002 and the first quarter of fiscal year 2003. USDA was aware of and
                        approved the cost increases. Further information about LB&B Associates’
                        performance, employee qualifications, and costs is contained in appendix
                        III.



Conclusions	            Despite improvements, security arrangements at Plum Island are not yet
                        sufficient. Further actions are needed to provide reasonable assurance
                        that pathogens cannot be removed from the facility and exploited for use in
                        bioterrorism. Until DHS fully implements the physical security measures
                        and addresses those vulnerabilities identified by our Office of Special
                        Investigations, Plum Island’s security system will not provide physical
                        security commensurate with the importance of the facility. Additionally,
                        the Plum Island Animal Disease Center will remain more vulnerable than it
                        needs to be if the physical infrastructure that supports it is not afforded
                        better protection. Similarly, it is important to better secure the foot-and-
                        mouth disease vaccine bank to ensure its availability for combating an
                        outbreak. Also, the lack of comprehensive policies and procedures for
                        limiting access to pathogens unnecessarily elevates the risk of pathogen
                        theft. Moreover, because physical security measures alone are not
                        adequate to secure pathogens, all laboratories containing these materials
                        face the challenge of developing other approaches to mitigate the risk of
                        theft. By consulting with other laboratories to discover methods they are
                        using to mitigate the risk to pathogens, Plum Island officials can learn more
                        about safeguards being employed elsewhere. Furthermore, Plum Island
                        officials cannot effectively respond to security breaches until DHS resolves
                        issues that impede Plum Island’s response capability, such as the authority



                        Page 22           GAO-03-847 Improving Security at Plum Island Animal Disease Center
                      of the guard force to make arrests, which makes it difficult for the guards
                      and local law enforcement agencies to address criminal situations on the
                      island. Finally, because we believe the level of risk at Plum Island is higher
                      than USDA originally determined, and because USDA did not validate
                      threats with intelligence agencies or local law enforcement officials, DHS
                      cannot be assured that Plum Island’s security, including its physical
                      security system and response plans, is sufficient to address the full range of
                      events that could occur on the island.



Recommendations for   To complete and enhance Plum Island’s security arrangements, we
                      recommend that the Secretary of Homeland Security, in consultation with
Executive Action      the Secretary of Agriculture, do the following:

                      •	 Correct physical security deficiencies by (1) fully implementing the
                         physical security measures, (2) addressing the specific security
                         shortcomings identified by our Office of Special Investigations, (3)
                         better securing certain features of the physical infrastructure that
                         supports the continued operation of the Plum Island Animal Disease
                         Center, and (4) better securing the foot-and-mouth disease vaccine
                         bank.

                      •	 Limit access to pathogens by further developing and enforcing specific
                         procedures, including internal control checks, to ensure (1) that all
                         individuals involved in laboratory activities in the biocontainment
                         area—including students and regardless of citizenship—have been
                         approved, in accordance with the law; (2) that background checks of
                         these individuals are updated regularly; and (3) that cleaning,
                         maintenance, and repair staff entering the biocontainment area are
                         escorted at all times by individuals with completed background checks.

                      •	 Consult with other laboratories to identify ways to mitigate the inherent
                         difficulty of securing pathogens.

                      •	 Enhance incident response capability by (1) resolving the issue of the
                         guards’ authority to carry firearms and make arrests; (2) developing and
                         implementing a policy on how guards should deal with intruders and use
                         weapons; (3) increasing the size of the guard force; (4) completing an
                         agreement with local law enforcement agencies to ensure backup
                         assistance when needed; (5) defining an adequate response time for law
                         enforcement to respond to incidents; (6) developing an incident
                         response plan that includes precise detail about what to do in the event



                      Page 23            GAO-03-847 Improving Security at Plum Island Animal Disease Center
                      an incident occurs that exceeds the capability of the security system,
                      such as a terrorist attack; and (7) conducting exercises with local law
                      enforcement to test the efficiency and effectiveness of Plum Island’s
                      response capability.

                   •	 Reconsider the security risks at Plum Island, taking into account recent
                      acts of disgruntled employees.

                   •	 Consult with appropriate state and local law enforcement and
                      intelligence agencies to revisit the threats specific to the Plum Island
                      Animal Disease Center.

                   •	 Revise, as necessary, security and incident response plans to reflect any
                      redefined, risks, threats, and assets.



Agency Comments	   We provided DHS and USDA with a draft of this report for their review and
                   comment. Both agencies provided written and clarifying oral comments.
                   The agencies also provided technical comments, which we incorporated
                   into the report as appropriate. Overall, DHS agreed with the report and
                   stated that it has started to implement our recommendations, and USDA
                   stated that the report was very useful but also raised several concerns.

                   In its written comments (see app. IV), DHS agreed that fundamental
                   concerns leave the facility vulnerable to security breaches and stated that
                   the report is factually accurate. DHS also commented that it accepts and
                   supports our recommendations. In addition, DHS stated that since it
                   assumed administrative responsibility for Plum Island on June 1, 2003, it
                   has taken the following actions, among others, to address the
                   recommendations in this report:

                   •	 DHS is working with USDA to develop corrective actions to address the
                      physical security deficiencies identified in our report.

                   •	 DHS is working with USDA to develop an access control policy for all
                      personnel who are required to enter the biocontainment area.

                   •	 DHS is working with other federal agencies to develop security policies
                      and procedures to limit access to pathogens.

                   •	 DHS is working with the Federal Protective Service to enhance security
                      at the facility and bring arrest and detention authority to the island. In



                   Page 24            GAO-03-847 Improving Security at Plum Island Animal Disease Center
   addition, DHS stated that funds have been requested to increase the
   guard force.

•	 DHS is working with local law enforcement agencies to coordinate
   incident response plans, mutual aid agreement requirements, and joint
   exercises to test security response capabilities.

•	 DHS is reviewing the island’s entire security plan and will revise the
   threat assessment as necessary. DHS stated that it expects to complete
   this assessment in early 2004.

In its written comments (see app. V), USDA addressed several aspects of
our report. These specific comments and our responses follow.

•	 USDA suggested that the report should make judgments about the need
   for enhanced security against a risk assessment-based approach that
   considers both the probability and the consequences of specific types of
   attacks. However, as we report, DHS is now responsible for performing
   such an assessment, and DHS stated that it has undertaken a review of
   USDA’s threat statement, which it will complete early in 2004. Our
   objective was to evaluate the status of security on Plum Island. That
   evaluation included, among other steps, a review of USDA’s risk-based
   security plan for Plum Island and its implementation. Our report details
   substantive flaws in both the planning and the execution of that plan.

•	 USDA also commented that the report did not recognize that USDA had
   a contract to improve security at Plum Island prior to September 11,
   2001. We added to the report that USDA contracted with the U.S. Army
   Corps of Engineers in 2000 to improve security at Plum Island, but noted
   that few of the Corps’ recommendations had been implemented. Also,
   USDA officials told us that in light of September 11, 2001, and the
   subsequent dissemination of anthrax through the postal system, they
   made a concerted effort to improve security at USDA’s laboratories. The
   officials added that Sandia was hired to provide USDA with a consistent
   approach to evaluating security at the department’s major laboratories.
   Sandia officials told us that they did not agree with the approach taken
   by the Corps, and they concluded that Plum Island’s existing security
   system was substantially inadequate for protecting against the threats
   that USDA defined as relevant.

•	 USDA indicated that it took various actions to safeguard pathogens in
   response to the strike. USDA stated that it increased and armed the



Page 25           GAO-03-847 Improving Security at Plum Island Animal Disease Center
   guards on Plum Island; added guards at Orient Point, Long Island, where
   the strikers were picketing; and excluded the strikers from Plum Island
   facilities. We agree that USDA responded with immediate measures and
   have revised the report to reflect these steps. However, we believe that
   USDA’s responses to the strike were insufficient. Although USDA
   increased the number of guards at Orient Point, this was a temporary
   measure primarily put in place to ensure the safety of the employees as
   they passed the union picket line. Also, Plum Island officials told us that
   the number of guards on Plum Island itself did not change as a result of
   the strike and that these guards had been armed since 2001. More
   importantly, USDA’s comments do not recognize that there is a
   difference between addressing security problems caused by one
   employee and addressing the security problems resulting from the
   strike, which could include several employees collaborating to cause
   problems. We believe that the implications of having a disgruntled work
   force should be taken into account when reevaluating the extent of
   risks, threats and assets requiring increased security.

•	 USDA stated that it appropriately used armed guards on Plum Island
   and were in communication with local law enforcement. While we
   agree that armed guards are necessary for security on Plum Island, our
   concern is that the guard force did not have authority from USDA to
   carry firearms and make arrests. Furthermore, USDA never developed a
   policy instructing its guards when and how they could use force,
   including the firearms they were carrying. Plum Island officials said
   they were unable to resolve these important matters with USDA
   headquarters officials, including the Office of General Counsel. Finally,
   we noted in the report that while Plum Island officials have
   communicated with local law enforcement, no agreement was reached
   to assist Plum Island guards in the event a criminal act occurred on the
   island. DHS stated that it is working to resolve these issues.

•	 USDA stated that it is an accepted practice for a person with an
   appropriate background investigation to escort those who do not yet
   have a clearance. USDA also acknowledged that it had problems
   implementing its escort procedures at Plum Island but now believes its
   escort procedures are reliable. We agree that the practice of escorting is
   used in other laboratories that contain pathogens. However, Plum
   Island officials and scientists repeatedly told us that this procedure is
   not practical at Plum Island because of staffing considerations. For
   example, they explained that the escorts were Plum Island employees
   who had other duties, which compelled them to leave those they were



Page 26            GAO-03-847 Improving Security at Plum Island Animal Disease Center
   escorting for periods of time. Furthermore, we believe that internal
   control checks should be established to ensure implementation of
   escort procedures, and we have added this to our recommendations.
   DHS commented that more will be done to address this issue—it is
   planning to develop, in concert with USDA, a limited use policy to
   identify access control requirements for all personnel who are required
   to enter the biocontainment area.

•	 USDA said that several of the employees we identified had not had their
   background checks updated in the last 5 years, but that some of those
   we identified had. We reported based on the actual records of
   background checks maintained at the Plum Island Animal Disease
   Center. We also recognize that there may be differences between the
   records maintained on the island and other USDA records, and that the
   background checks of several of these individuals may have been
   updated since the time of our review.


As we agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution of it until 30 days from
the date of this report. We will then send copies of this report to the
Secretaries of Homeland Security and Agriculture, appropriate
congressional committees, and other interested parties. We will also make
copies available at no charge on the GAO Web site at http://www.gao.gov.

If you have any questions about this report, please call me or Charles M.
Adams at (202) 512-3841. Key contributors to this report are listed in
appendix VI.

Sincerely yours,




Lawrence J. Dyckman
Director, Natural Resources
 and Environment




Page 27            GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix I

Scope and Methodology



              To determine the extent to which USDA has addressed security for Plum
              Island, we visited the facility several times to examine current physical
              security measures and to review plans for further security actions. In
              addition, two security experts from our Office of Special Investigations
              toured the facility to identify possible vulnerabilities and actions that could
              be taken to reduce them. We also reviewed numerous security documents,
              such as Sandia’s assessment of Plum Island security; Plum Island’s draft
              security and response plans; draft memorandums of understanding with
              local entities; physical security implementation plans; and policies and
              procedures for guards, employees, visitors, students, and others with
              access to pathogens. In addition, we worked closely with Sandia officials
              to understand how they applied a risk management security approach to
              Plum Island. We also interviewed numerous officials from Plum Island,
              including the physical security specialist, scientists, the center director,
              and others responsible for security changes under both the Agricultural
              Research Service and the Animal Plant and Health Inspection Service;
              officials of USDA’s Offices of Homeland Security, Procurement and
              Property Management, and General Counsel; and officials of the
              Department of Homeland Security, which assumed the administration of
              Plum Island. To gain a better understanding of possible threats to Plum
              Island, we spoke with officials from the Federal Bureau of Investigation,
              Defense Intelligence Agency, Central Intelligence Agency, Suffolk County
              police and fire departments, and USDA’s Office of Inspector General. To
              understand the cooperation between local governments and Plum Island
              that might be needed if an incident were to occur on the island, we
              interviewed government and law enforcement officials from Suffolk
              County, the town of Southold, and the village of Greenport. Finally, we
              toured the laboratories at and interviewed officials from the National
              Institutes of Health and the U.S. Army Medical Research Institute of
              Infectious Diseases to understand how they are handling security
              challenges since the terrorist attacks of 2001. To determine Plum Island’s
              compliance with new laws and regulations, we reviewed the USA Patriot
              Act1 of 2001, the Agricultural Bioterrorism Protection Act of 20022 and its
              regulations that went into effect as a final interim rule on February 11,
              2003,3 as well as USDA’s policies and procedures for security at biosafety
              level 3 facilities. We also considered the Office of Management and

              1
              Pub. L. No. 107-56.

              2
              Pub. L. No. 107-188 § § 211-213.

              3
              7 CFR § 331.





              Page 28                GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix I

Scope and Methodology





Budget’s Circular A-123, Management Accountability and Control,4 and
the standards in our Internal Control: Standards for Internal Control in
the Federal Government.5

To determine how well LB&B Associates performed from the time the
strike began on August 13, 2002, to January 5, 2003, we (1) reviewed LB&B
Associates’ contract with USDA and identified LB&B Associates’
performance requirements; (2) interviewed officials of USDA, LB&B
Associates, and the International Union of Operating Engineers to get their
perspective on LB&B Associates’ performance; (3) reviewed USDA’s
ratings of LB&B Associates’ performance since 1999 and, in particular, the
Award Fee Determination Board’s report on LB&B Associates’
performance during the period the strike took place; (4) reviewed the
qualifications of LB&B Associates employees, such as the boat operators
and water distribution and treatment system operators, all of whom are
required to meet certain qualifications for performing their duties; (5)
analyzed 3 years of contract cost data provided by LB&B Associates to
learn which items increased as a result of the strike; and (6) validated the
contract cost data by spot-checking it against the bills LB&B Associates
submitted to USDA. While we took these steps to determine how well
LB&B Associates performed, we did not independently rate LB&B
Associates’ performance. In addition, we interviewed officials involved in
investigating strike-related incidents, including officials of the Federal
Bureau of Investigation and USDA’s Office of Inspector General.

Our work was conducted in accordance with generally accepted
government auditing standards from January through August 2003.




4
 Office of Management and Budget, OMB Circular A-123 Management Accountability and
Control (Washington, D.C.: 1995). This document provides the specific requirements for
assessing and reporting on controls within the executive branch.
5
 U.S. General Accounting Office, Internal Control: Standards for Internal Control in the
Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). The Federal
Managers’ Financial Integrity Act of 1982 (FMFIA) requires us to issue standards for internal
control in government. Among other things, the standards provide the overall framework for
establishing and maintaining internal control.




Page 29               GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix II

Additional Observations on Plum Island’s
Security System by GAO’s Office of Special
Investigations
               •	 The security force reports directly to the Administrative Contract
                  Officer and not to the Security Director—it is important for the security
                  force to report directly to the Security Director of Plum Island to ensure
                  that security-related issues are handled promptly.

               •	 There are no name checks or record checks given to contractors and
                  visitors going into the biocontainment area. Contractors and visitors
                  entering the biocontainment area could be checked for criminal charges
                  (through the National Criminal Information Center) before they are
                  granted access.

               •	 The area outside of the biocontainment and administrative building is
                  surveilled by stationary closed-circuit television cameras, which are
                  insufficient. Installing pan, tilt, and zoom closed-circuit television
                  cameras in certain areas would enhance surveillance capabilities.

               •	 The island is easily accessible to the general public by boat, and there
                  are limited “no trespassing” signs present on the island to advise the
                  public that it is a government facility—more “no trespassing” signs in
                  those areas of the island that are easily accessible to the public by boat
                  would address this condition.

               •	 In the event of a fire, Plum Island is not always able to respond
                  appropriately because the fire brigade has limited hours of operation.
                  The security force could be cross-trained for fire rescues and therefore
                  provide 24-hour coverage.

               •	 The building used for overnight accommodations lacks panic alarms for
                  emergency response. Panic alarms could be installed in the building
                  and, when visitors are present, security guards could drive by on a
                  regular basis.

               •	 Control for keys and master keys of the facility is deficient. The security
                  department could be assigned the responsibility for all keys and master
                  keys. A key log could be created to better track possession of keys.




               Page 30            GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee
Qualifications, and Costs

               USDA concluded, in an evaluation of LB&B Associates’ performance,
               which included the time period involving the strike, that LB&B Associates’
               overall performance was superior, although its performance had declined
               compared to prior rating periods. When the strike occurred, LB&B
               Associates, with the assistance of USDA employees, continued to perform
               and maintained operations at Plum Island. LB&B Associates implemented
               a strike contingency plan, brought in qualified individuals from its other
               work sites, and hired subcontractors with the required licenses and
               certifications to operate certain Plum Island facilities and its boats. Also,
               as a result of the strike, LB&B Associates exceeded its estimated budget by
               about $511,000, or approximately 5 percent, for fiscal year 2002 and the
               first quarter of fiscal year 2003. USDA was aware of and approved the cost
               increases.



Performance	   Although LB&B Associates’ performance declined during the strike relative
               to previous rating periods, overall, LB&B Associates performed at a
               superior level during the evaluation period that included several months
               when workers were on strike, maintaining—and in some cases even
               improving—operations critical to the functioning of the island, according
               to Plum Island officials. Plum Island’s Award Fee Determination Board
               regularly rated LB&B Associates’ performance using a system described in
               its contract to calculate a composite performance score.1 According to the
               board, LB&B Associates’ performance was outstanding—the highest
               level—for more than 2 years, until the rating period in which the strike
               began. The board faulted LB&B Associates in several rating categories
               resulting in a decline in its performance rating. For example, according to
               the board, LB&B Associates’ strike contingency plan, which describes how
               essential operations would be continued in the event of a strike, was
               outdated. As a result, implementation of the plan was slowed because it
               took up to 48 hours before all of its temporary workers arrived on the
               island. Moreover, some subcontracts cost more than anticipated.

               According to the board, LB&B Associates overcame initial problems in
               implementing its contingency plan and, overall, performed at the superior


               1
                The Award Fee Determination Board consisted of six officials who worked on Plum Island:
               center director, assistant center director, administrative contract officer, safety officer,
               APHIS laboratory chief, and ARS foot-and-mouth disease unit scientist. The composite
               score could have placed LB&B at one of five levels: 0–34, unacceptable; 35–49,
               unsatisfactory; 50–70, satisfactory; 71–84, superior; and 85–100, outstanding.




               Page 31               GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee 

Qualifications, and Costs





level. For example, temporary workers and subcontractors hired by LB&B
Associates quickly repaired the water system that had been sabotaged on
the first day of the strike. Furthermore, according to the board, some
activities improved after the onset of the strike, including the maintenance
of steam pipes, an important component of the process used to
decontaminate laboratory waste contaminated with pathogens. Also, boat
maintenance and cafeteria services—both of which, according to the
Board, had been problematic before the strike—improved after
replacement workers were hired. Figure 2 shows the composite scores the
board gave LB&B Associates from fiscal year 2000 through the first quarter
of fiscal year 2003, which includes the time during which the strike
occurred.




Page 32             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee 

Qualifications, and Costs





Figure 2: USDA Award Fee Determination Board’s Composite Scores for LB&B
Associates’ Performance from October 1999 through January 2003




Note: GAO presentation of USDA data.
a
 USDA rated LB&B Associates quarterly through fiscal year 2000; USDA changed to a 6-month rating
schedule beginning with fiscal year 2001.
b
 The strike began in August of this rating period, April 1, 2002, through January 5, 2003, which would
have ended on September 30, 2002; however, because the contract was extended through January
2003, the rating period was extended also.


More details about how the board evaluated LB&B Associates’
performance are contained in table 1.




Page 33                  GAO-03-847 Improving Security at Plum Island Animal Disease Center
                  Appendix III

                  LB&B Associates’ Performance, Employee 

                  Qualifications, and Costs





                  Table 1: Summary of the Award Fee Determination Board’s Rating of LB&B
                  Associates’ Performance from April 2002 to January 2003.


                  Performance                                                  Score and level of
                  categories           Types of activities                     performance
                  Utilities            •   Heating, A/C, and ventilation       77
                                       •   Refrigeration                       Superior
                                       •   Plumbing and pipefitting
                                       •   Power plant operations
                                       •   Wastewater operations
                                       •   Electronics
                  Safety, health and   •   Security                            70
                  environmental        •   Emergency health services           Satisfactory
                  compliance           •   Environmental compliance
                                       •   Biological safety
                                       •   Fire alarm support
                  Program and cost     •   Contract and cost management         80
                  management           •   Special task management              Superior
                                       •   Resource utilization
                                       •   Quality control
                                       •   Subcontract management
                                       •   Scheduling and coordination
                                       •   Communications and reporting
                  Facilities           •   Painting and carpentry                76
                                       •   Equipment maintenance                 Superior
                                       •   Janitorial functions
                                       •   General building and grounds
                                           maintenance
                  Administrative       •   Photography services                  82
                  support              •   Mail                                  Superior
                                       •   Laundry
                                       •   Glassware
                                       •   Food services
                  Transportation       • All marine and vehicle                  71
                                         transportation services                 Superior
                                       • Boat and vehicle maintenance
                  Source: GAO.

                  Note: GAO presentation of USDA data.




Employee 	        To maintain operations at Plum Island after the strike began, LB&B
                  Associates brought in temporary replacements from some of its other
Qualifications	   contract sites, hired subcontractors, and subsequently hired permanent
                  replacement workers, as described in the strike contingency plan. We
                  confirmed that workers in certain positions, including boat operators and
                  operators for the wastewater treatment system, were licensed as



                  Page 34                  GAO-03-847 Improving Security at Plum Island Animal Disease Center
                        Appendix III

                        LB&B Associates’ Performance, Employee 

                        Qualifications, and Costs





                        prescribed by LB&B Associates’ contract with USDA. In addition, many of
                        the replacement workers appear to have significant and relevant work
                        experience for the positions for which they were hired.

                        Although LB&B Associates and USDA staff worked together to maintain
                        vital functions, operations were affected at times by the strike because of
                        the reduced workforce and the loss of some workers with specific skills
                        and/or qualifications. For example, the ferries that take workers to and
                        from the island operated on a reduced schedule until all three boat masters
                        who had walked out were replaced by individuals with the necessary Coast
                        Guard license. Also, some USDA officials stepped in to fulfill duties that
                        were normally performed by qualified contract staff, such as monitoring
                        the air filters in the laboratory, until qualified replacements were hired. By
                        July 2003, most positions left vacant by the strike were filled, most of them
                        by permanent replacement workers and 16 by striking workers who
                        returned to work on the island.



Costs Attributable to   With USDA’s approval, LB&B Associates exceeded its estimated budget by
                        about $511,000, or approximately 5 percent, during the 15-month period
the Strike              covering fiscal year 2002 and the first quarter of fiscal year 2003,2 the period
                        during which the strike began.3 USDA allowed the additional expenditures,
                        which occurred in the last 2 months of fiscal year 2002 and the first 3
                        months of 2003, because it recognized that the strike would result in higher
                        expenses and it found LB&B Associates’ estimate for exceeding the budget
                        to be acceptable, under the circumstances. As required by Federal
                        Acquisition Regulations, LB&B Associates notified USDA that it expected




                        2
                         LB&B Associates exceeded its fiscal year 2002 estimated budget of $8,027,011 by
                        approximately $151,000, or about 1.9 percent. In the first quarter of fiscal year 2003, which
                        covered October 1, 2002, through January 5, 2003, the contractor exceeded the estimated
                        budget of $2,250,524 by about $360,000, or about 16 percent.
                        3
                         Prior to the strike, LB&B Associates billed to USDA over $107,000 in legal fees associated
                        with renewing the collective bargaining agreement through May 31, 2002, after which time
                        LB&B Associates itself paid about $136,000 in legal fees through April 2003.




                        Page 35               GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee 

Qualifications, and Costs





to exceed its budget as a result of the strike.4 Figure 3 shows the total costs
LB&B Associates charged to USDA from October 1, 2001 through January 5
2003; the graph also incorporates costs billed to USDA by North Fork
Services from January 6 through May 31, 2003, illustrating the continued
fluctuation in contract costs.



Figure 3: Monthly Costs Billed to USDA, October 2001 through May 2003




Note: GAO presentation of USDA data.




4
 Under a cost-reimbursable contract, Federal Acquisition Regulations require that the
contractor notify the agency in writing whenever it has reason to believe that its costs will
exceed 75 percent of the estimated budget, or if the total cost will be greater or significantly
less than the estimated budget. Also, as part of the notification process, the contractor is
required to provide the agency with a revised estimate of the total cost of performing its
contract. In this case, if USDA had not accepted the cost increases, USDA officials said that
USDA and LB&B Associates officials would have had to agree on which services to
discontinue in order to stay on budget.




Page 36                GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee 

Qualifications, and Costs





According to LB&B Associates’ data,5 there were fluctuations in Plum
Island’s costs, as shown in figure 3. Also, as a result of the strike, additional
costs were incurred in the following areas from August 1, 2002, through
January 5, 2003,6 unless otherwise noted: labor (salary and benefits),
subcontracts, cafeteria, and travel (including lodging and transportation).

Labor: The cost of labor peaked at $428,161 in August 2002, a 16 percent
increase over the average monthly cost of $370,118 for the previous 10
months. Monthly labor costs then gradually decreased until November,
when the cost of labor was about 1.6 percent more than the average
monthly cost. Labor costs increased because most of the temporary
replacements were management-level employees from other LB&B
Associates contract sites, who earned more than the employees they
replaced. According to its documents, LB&B Associates used
management-level employees because union members from other localities
usually honor a picket line and would not temporarily replace union
strikers. As new permanent employees were hired, the cost of labor
gradually decreased.

Subcontracts: Subcontracts related to the strike, such as for providing
security guards at the picket line, added about $523,000,7 or 77 percent of
the total subcontract costs billed to USDA by LB&B Associates.

Cafeteria: Cafeteria expenses increased by about $12,000, or 51 percent of
the total cafeteria expenses because the cafeteria provided two meals per
day for the temporary replacements, who spent more time on the island to
ensure continued operations than employees had before the strike began.




5
 An independent auditor found that LB&B Associates’ statements of income, changes in
equity, and cash flows fairly represent the financial position of the company for the fiscal
year ending September 30, 2002.
6
 Costs rose sharply in December 2002 because costs related to subcontracts that were
incurred in October and November were not billed to USDA until December, due to the
billing cycles of LB&B Associates and the subcontractors. These subcontract-related costs
were for tasks unrelated to the strike, such as security guards on the island, and related to
the strike, such as security guards at the picket line.
7
 North Fork Services incurred an additional $36,000 in subcontract costs related to the
strike from January 6 through May 31, 2003. These subcontracts were for delivering
supplies and materials to Orient Point and for security at the picket line on Orient Point
while striking workers were picketing.




Page 37                GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix III

LB&B Associates’ Performance, Employee 

Qualifications, and Costs





Travel: Travel expenses attributed to the strike, such as transporting and
housing the temporary replacement workers, totaled more than $125,000,
constituting 98 percent of the total travel costs billed to USDA during that
time period.




Page 38             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix IV

Comments from the Department of Homeland
Security




              Page 39   GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix IV

Comments from the Department of Homeland 

Security





Page 40             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix IV

Comments from the Department of Homeland 

Security





Page 41             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix IV

Comments from the Department of Homeland 

Security





Page 42             GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix V

Comments from the U.S. Department of
Agriculture




              Page 43   GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix V

Comments from the U.S. Department of 

Agriculture





Page 44              GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix V

Comments from the U.S. Department of 

Agriculture





Page 45              GAO-03-847 Improving Security at Plum Island Animal Disease Center
Appendix VI

GAO Contact and Staff Acknowledgments




GAO Contact        Charles M. Adams, (202) 512-8010



Acknowledgments	   In addition to the individual named above, Aldo Benejam, Nancy Crothers,
                   Mary Denigan-Macauley, Jonathan Gill, Thomas Farrell, Wyatt R. Hundrup,
                   and Ramon Rodriguez made key contributions to this report.




(360295)           Page 46          GAO-03-847 Improving Security at Plum Island Animal Disease Center
GAO’s Mission	            The General Accounting Office, the audit, evaluation and investigative arm of
                          Congress, exists to support Congress in meeting its constitutional responsibilities
                          and to help improve the performance and accountability of the federal government
                          for the American people. GAO examines the use of public funds; evaluates federal
                          programs and policies; and provides analyses, recommendations, and other
                          assistance to help Congress make informed oversight, policy, and funding
                          decisions. GAO’s commitment to good government is reflected in its core values of
                          accountability, integrity, and reliability.


Obtaining Copies of       The fastest and easiest way to obtain copies of GAO documents at no cost is
                          through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-
GAO Reports and           text files of current reports and testimony and an expanding archive of older
                          products. The Web site features a search engine to help you locate documents
Testimony                 using key words and phrases. You can print these documents in their entirety,
                          including charts and other graphics.
                          Each day, GAO issues a list of newly released reports, testimony, and
                          correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site
                          daily. The list contains links to the full-text document files. To have GAO e-mail this
                          list to you every afternoon, go to www.gao.gov and select “Subscribe to
                          e-mail alerts” under the “Order GAO Products” heading.


Order by Mail or Phone	   The first copy of each printed report is free. Additional copies are $2 each. A check
                          or money order should be made out to the Superintendent of Documents. GAO
                          also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single
                          address are discounted 25 percent. Orders should be sent to:
                          U.S. General Accounting Office
                          441 G Street NW, Room LM
                          Washington, D.C. 20548
                          To order by Phone: 	   Voice: (202) 512-6000
                                                 TDD: (202) 512-2537
                                                 Fax: (202) 512-6061


To Report Fraud, 	        Contact:
                          Web site: www.gao.gov/fraudnet/fraudnet.htm
Waste, and Abuse in       E-mail: fraudnet@gao.gov
Federal Programs          Automated answering system: (800) 424-5454 or (202) 512-7470



Public Affairs	           Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800
                          U.S. General Accounting Office, 441 G Street NW, Room 7149
                          Washington, D.C. 20548
United States
                  Presorted Standard

General Accounting Office
      Postage & Fees Paid

Washington, D.C. 20548-0001
           GAO

                                  Permit No. GI00

Official Business

Penalty for Private Use $300

Address Service Requested