The Broken Chair

Law enforcement officials say when Siddiqui was detained in Afghanistan on July 17 she possessed documents with a list of likely targets that included the Statue of Liberty, Times Square, the subway system and the animal disease center on Plum Island. They say she also had detailed chemical, biological and radiological weapon information.

In addition, Siddiqui had e-mails linking her to possible "sleeper" cells in the United States.

"I don't think we've captured anybody as important, and as well connected as she since 2003," says former CIA officer John Kiriakou.

Siddiqui also was carrying ``chemical substances in gel and liquid form that were sealed in bottles and glass jars,'' a criminal complaint said without elaborating.

What GAO Found

Security at the Plum Island Animal Disease Center has improved, but fundamental concerns leave the facility vulnerable to security breaches. First, Plum Island’s physical security arrangements are incomplete and limited. Second, Plum Island officials have been assuming unnecessary risks by not adequately controlling access to areas where pathogens are located. Controlling access is particularly important because pathogens are inherently difficult to secure at any facility. Although this risk may always exist, DHS could consult with other laboratories working with pathogens to learn different approaches to mitigate this risk. Third, Plum Island’s security response has limitations. For example, the guard force has been armed but has not had the authority from USDA to carry firearms or make arrests. Moreover, Plum Island’s incident response plan does not consider the possibility of a terrorist attack. Fourth, the risk that an adversary may try to steal pathogens is, in our opinion, higher at the Plum Island Animal Disease Center than USDA originally determined because of hostilities surrounding the strike. Also, when USDA developed its security plan for Plum Island, it did not review their defined threats with the intelligence community and local law enforcement officials to learn of possible threats—and their associated risks—relevant to the Plum Island vicinity. Although these reviews did not occur, USDA subsequently arranged to receive current intelligence information.

In summary, DHS has made significant progress and has implemented 18 of the 24 recommendations. However, implementation of the 6 remaining recommendations is still under way. In 2003, physical security at Plum Island was deficient in several ways. For example, alarms and door sensors for detecting intruders were not fully operational; controls to account for the keys to the island's facilities were deficient; and USDA was not providing sufficient physical security for certain assets, including those critical to the continued operation of the facility. These vulnerabilities were particularly troubling because a strike was under way, and sabotage of the island's infrastructure had already occurred. DHS has since taken many actions in response to our recommendations. For example, alarms and door sensors are now in use, and DHS has implemented procedures to better control access to keys to facilities. In addition, the department has better secured certain features of the physical infrastructure that supports the continued operation of the Plum Island Animal Disease Center. DHS has also improved the security of North America's only foot-and-mouth disease vaccine bank. This bank represents years of cooperative research performed by Canada, Mexico, and the United States, and the material it contains is considered a critical asset for controlling a large outbreak.