This is the accessible text file for GAO report number GAO-09-42 
entitled 'Defense Critical Infrastructure: Developing Training 
Standards and an Awareness of Existing Expertise Would Help DOD Assure 
the Availability of Critical Infrastructure' which was released on 
October 30, 2008.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Requesters: 

United States Government Accountability Office: 
GAO: 

October 2008: 

Defense Critical Infrastructure: 

Developing Training Standards and an Awareness of Existing Expertise 
Would Help DOD Assure the Availability of Critical Infrastructure: 

GAO-09-42: 

GAO Highlights: 

Highlights of GAO-09-42, a report to congressional requesters. 

Why GAO Did This Study: 

The Department of Defense (DOD) relies on a global network of DOD and 
non-DOD infrastructure so critical that its unavailability could have a 
debilitating effect on DODís ability to project, support, and sustain 
its forces and operations worldwide. DOD established the Defense 
Critical Infrastructure Program (DCIP) to assure the availability of 
mission-critical infrastructure. GAO was asked to evaluate the extent 
to which DOD has (1) incorporated aspects of DCIP into its exercises in 
the Transportation Defense Sector and (2) developed DCIP training 
standards departmentwide and made installation personnel aware of 
existing DCIP expertise. GAO examined a nonprojectable sample of 46 
critical assets representing the four military services, five combatant 
commands, and selected installations within five defense sectors. GAO 
reviewed relevant DOD DCIP guidance and documents and interviewed 
cognizant officials regarding DCIP exercises, training, and awareness. 

What GAO Found: 

U.S. Transportation Command (TRANSCOM) and the installations GAO 
visited that have critical transportation assets have incorporated 
aspects of critical infrastructure assurance into their exercises. 
DODís DCIP guidance requires the combatant commands and the military 
services to conduct annual DCIP exercises, either separately or in 
conjunction with existing exercises. DCIP guidance also requires 
commanders to ensure submission of lessons learned from these 
exercises. For example, TRANSCOM has included aspects of critical 
infrastructure assurance in its two major biennial exercises. Although 
military personnel at 13 of the 19 installations GAO visited that have 
critical transportation assets generally were not aware of DCIP, GAO 
found that all 19 of these installations conduct routine exercises that 
often involve aspects of critical infrastructure assurance, and they 
incorporate lessons learned from past exercises into future exercises. 
For example, personnel at these installations conduct antiterrorism, 
emergency management, and continuity of operations planning exercises 
that often include critical assets located on the installation. 

While several of the combatant commands and military services included 
in GAOís review of the five defense sectors have independently 
developed DCIP training at the headquarters level, DOD has not yet 
developed DCIP training standards departmentwide, and installation 
personnel remained largely unaware of existing DCIP expertise. DODís 
DCIP instruction requires the Office of the Assistant Secretary of 
Defense for Homeland Defense and Americasí Security Affairs 
(ASD[HD&ASA]) to provide policy and guidance for DCIP and oversee the 
implementation of DCIP education, training, and awareness of goals and 
objectives. ASD(HD&ASA) recognizes the need for DCIP training and 
program awareness, as noted in its March 2008 critical infrastructure 
strategy. However, given the newness of the strategy, ASD(HD&ASA) has 
not yet established departmentwide DCIP training standards for assuring 
the availability of critical infrastructure or a time frame for 
implementing the training standards. In the absence of established DCIP 
training standards, the combatant commands and military services are 
variously developing and implementing their own DCIP training programs. 
For example, the Navy has established an information assurance training 
program that includes a DCIP module. Furthermore, installation 
personnel GAO spoke with, with few exceptions, were not familiar with 
DCIP or aware of DCIP expertise at the combatant command and military 
service headquarters levels. In addition, DOD has not developed an 
effective way to communicate to installation personnel the existence of 
DCIP expertise. Consequently, they rely on other, more established 
programs that in some cases do not emphasize the consideration of the 
full spectrum of threats and hazards. Without DCIP training standards 
departmentwide and a means of communicating them to installation 
personnel, the combatant commands and military services potentially may 
develop mutually redundant or inconsistent training programs, and 
installation personnel will continue to be unaware of existing DCIP 
expertise. 

What GAO Recommends: 

GAO recommends that DOD (1) develop departmentwide DCIP training 
standards and an implementation time frame and (2) develop an effective 
means to communicate to installation personnel the existence and 
availability of DCIP expertise at the combatant command and military 
service levels. DOD concurred with both recommendations. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-09-42]. For more 
information, contact Davi M. D'Agostino at (202) 512-5431 or 
dagostinod@gao.gov. 

Contents: 

Letter: 

Results in Brief: 

Background: 

Aspects of Critical Infrastructure Assurance Are Incorporated into 
TRANSCOM and Installation Exercises: 

DOD Has Not Developed DCIP Training Standards Departmentwide, and 
Installation Personnel Remain Unaware of Existing DCIP Expertise: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of Defense: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

Table: 

Table 1: DCIP Training and Exercise Roles and Responsibilities: 

Abbreviations: 

AFB: air force base: 

ASD(HD&ASA): Office of the Assistant Secretary of Defense for Homeland 
Defense and Americas' Security Affairs: 

CENTCOM: U.S. Central Command: 

DCIP: Defense Critical Infrastructure Program: 

DOD: Department of Defense: 

GIG: Global Information Grid: 

ISR: Intelligence, Surveillance, and Reconnaissance: 

OSD: Office of the Secretary of Defense: 

PACOM: U.S. Pacific Command: 

TRANSCOM: U.S. Transportation Command: 

[End of section] 

United States Government Accountability Office: Washington, DC 20548: 

October 30, 2008: 

The Honorable Solomon P. Ortiz: 
Chairman: 
The Honorable J. Randy Forbes: 
Ranking Member: 
Subcommittee on Readiness: 
Committee on Armed Services: 
House of Representatives: 

The Honorable W. Todd Akin: 
House of Representatives: 

The Department of Defense (DOD) relies on a global network of DOD-and 
non-DOD-owned critical infrastructure to carry out its missions, and 
the incapacitation or destruction of one or more of the assets 
constituting this network could have a debilitating effect on DOD's 
ability to project, support, and sustain its forces and operations 
worldwide. Because of its importance to DOD operations, this critical 
infrastructure represents an attractive target to adversaries and may 
also be vulnerable to a host of natural disasters and accidents. In 
September 2003, the Office of the Assistant Secretary of Defense for 
Homeland Defense and Americas' Security Affairs (ASD[HD&ASA]) was 
assigned responsibility for DOD's critical infrastructure protection 
efforts. ASD(HD&ASA) subsequently issued guidance in August 2005 
establishing the Defense Critical Infrastructure Program (DCIP) to 
assure the availability of mission-critical infrastructure and 
articulating the roles and responsibilities for DOD organizations 
involved in the program.[Footnote 1] Under DCIP, DOD created 10 
functionally based defense sectors and designated a Defense 
Infrastructure Sector Lead Agent (hereinafter referred to as sector 
lead agent) for each sector.[Footnote 2] DOD also created several other 
complementary programs, including the Antiterrorism Program,[Footnote 
3] established to protect DOD assets and personnel from terrorist acts, 
and the Information Assurance Program,[Footnote 4] established to 
protect and defend DOD information and information systems. Both 
programs predate DCIP, yet they contribute indirectly to the protection 
and assurance of critical assets. Although not the focus of this 
report, these complementary programs indirectly support elements of 
DCIP. 

In response to your request, we have thus far issued six reports since 
May 2007. Our first report examined the extent to which DOD has 
developed a comprehensive management plan for DCIP and the actions 
needed to identify, prioritize, and assess defense critical 
infrastructure.[Footnote 5] The second report examined DOD's efforts to 
implement a risk management approach for defense industrial base 
critical assets.[Footnote 6] The third report examined the extent to 
which DOD included highly sensitive assets in its critical 
infrastructure program.[Footnote 7] The fourth report focused on 
threats and vulnerabilities affecting intelligence, surveillance, and 
reconnaissance (ISR) operations at Creech Air Force Base, Nevada. 
[Footnote 8] The fifth report focused on DOD's efforts to assure the 
availability of critical assets in the Transportation Defense Sector. 
[Footnote 9] Finally, the sixth report focused on DOD's efforts to 
assure the availability of critical infrastructure in the Space, ISR, 
and Global Information Grid (GIG) Defense Sectors (referred to as the 
Tri-Sector throughout this report).[Footnote 10] All of our related 
products are listed in the Related GAO Products section at the end of 
this report. 

In 2007, we reported that DCIP implementation at the department, 
military service, and combatant command headquarters levels was 
relatively immature.[Footnote 11] To determine the status of DOD's 
efforts regarding DCIP training and exercises, this report examines the 
extent to which DOD has (1) incorporated aspects of DCIP into its 
exercises in the Transportation Defense Sector and (2) developed DCIP 
training standards departmentwide and made installation personnel aware 
of existing DCIP expertise. Our recent work examining the assurance of 
critical infrastructure focused on 5 of the 10 defense sectors: GIG, 
ISR, Public Works, Space, and Transportation. This report's objective 
examining the extent to which DOD has incorporated aspects of DCIP into 
its exercises in the Transportation Defense Sector focused on DCIP- 
related exercises conducted by U.S. Transportation Command (TRANSCOM) 
and on exercises conducted at individual installations we visited that 
have critical transportation assets. For our second objective, the 
scope of our work on the extent to which DOD has developed DCIP 
training standards departmentwide and made installation personnel aware 
of existing DCIP expertise focused on efforts at the Office of the 
Secretary of Defense (OSD); at the four military services; within five 
combatant commands--U.S. Central Command (CENTCOM), U.S. European 
Command, U.S. Pacific Command (PACOM), U.S. Strategic Command, and 
TRANSCOM; and at selected installations that have critical assets 
representing each of the five defense sectors that we visited. 
Regarding DCIP awareness, the scope of our work focused on installation 
personnel who are responsible for critical transportation assets. 

We drew a nonprobability sample[Footnote 12] of critical assets in the 
United States and abroad, using draft critical asset lists developed by 
the Joint Staff, each of the four military services, TRANSCOM, the 
Defense Intelligence Agency, and the Defense Information Systems 
Agency. We selected assets for our review based on the following 
criteria: (1) overlap among the various critical asset lists; (2) 
geographic dispersion among geographic combatant commands' areas of 
responsibility; (3) representation from each military service; and (4) 
with respect to transportation assets, representation in TRANSCOM's 
three asset categories: air bases, seaports, and commercial airports. 
Using this methodology, we selected 46 total critical assets for 
review--22 transportation assets[Footnote 13] and 24 Tri-Sector assets-
-in the United States and in Europe, the Middle East, and the Pacific 
region.[Footnote 14] 

Further, we reviewed relevant DOD guidance pertaining to DCIP training 
and exercise requirements and interviewed officials from OSD, the Joint 
Staff, defense agencies, the military services, combatant commands, and 
sector lead agents responsible for DCIP. (Throughout this unclassified 
report, we do not identify the 46 specific critical assets, their 
locations or installations, or combatant command or others' missions 
that the assets support because that information is classified.) We 
conducted this performance audit from May 2007 through September 2008 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe that 
the evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. A more thorough description 
of our scope and methodology is provided in appendix I. 

Results in Brief: 

TRANSCOM and the installations we visited that have critical 
transportation assets have incorporated aspects of critical 
infrastructure assurance into their exercises. DOD's guidance requires 
the testing of antiterrorism and continuity of operation plans annually 
through various exercises. DOD's antiterrorism guidance requires that 
commanders maintain antiterrorism exercise documentation for no less 
than 2 years to ensure incorporation of lessons learned. For example, 
TRANSCOM has included aspects of critical infrastructure assurance in 
its two major biennial battle staff exercises. Although military 
personnel with whom we spoke at installations we visited that have 
critical transportation assets generally were not aware of DCIP, we 
found that these installations conduct routine exercises that often 
involve critical infrastructure assurance, and they incorporate lessons 
learned from past exercises into plans for future exercises. For 
example, personnel at these installations conduct antiterrorism, 
emergency management, and continuity of operations planning exercises 
that often include critical assets located on the installation. 

While several of the combatant commands and military services included 
in our review of the five defense sectors have independently developed 
DCIP training at the headquarters level, DOD has not yet developed DCIP 
training standards departmentwide, and installation personnel remained 
largely unaware of existing DCIP expertise. DOD's DCIP instruction, 
issued in 2008, requires ASD(HD&ASA) to provide policy and guidance for 
DCIP and oversee the implementation of DCIP education, training, and 
awareness of goals and objectives. ASD(HD&ASA) recognizes the need for 
DCIP training and program awareness, as noted in its March 2008 
critical infrastructure strategy. However, given the newness of the 
strategy, ASD(HD&ASA) has not yet established departmentwide DCIP 
training standards for assuring the availability of critical 
infrastructure or a time frame for implementing the training standards. 
In the absence of established DCIP training standards, the combatant 
commands and military services are variously developing and 
implementing their own DCIP training programs. For example, PACOM 
officials stated that they have conducted internal PACOM training and 
education on critical infrastructure assurance. The Department of the 
Navy has established an information assurance training program that 
includes a DCIP module. Furthermore, installation personnel we spoke 
with who are responsible for assuring the availability of critical 
transportation assets, with few exceptions, were not familiar with DCIP 
or aware of DOD's critical infrastructure expertise at the combatant 
command and military service headquarters levels for two reasons. 
First, as we previously reported, the military services have not yet 
developed specific guidance for how installations are to implement 
DCIP. Second, DCIP efforts to date have focused primarily on the 
identification and assessment of critical infrastructure. In addition, 
DOD has not developed an effective way to communicate to installation 
personnel the existence of DCIP expertise. Consequently, installation 
personnel responsible for assuring the availability of defense critical 
infrastructure rely on other, more established programs, such as the 
Antiterrorism Program, that in some cases do not emphasize 
consideration of the full spectrum of threats and hazards, such as 
earthquakes and typhoons. Without DCIP training standards 
departmentwide, the combatant commands and military services 
potentially may develop mutually redundant or inconsistent training 
programs. Furthermore, installation personnel will continue to have 
limits to their awareness of DCIP knowledge, which will affect how they 
assure the availability of critical infrastructure. 

We are recommending that Secretary of Defense direct ASD(HD&ASA) to 
develop departmentwide DCIP training standards and an implementation 
time frame and to coordinate with the combatant commands and the 
military services to develop a way to effectively communicate to 
installation personnel the existence of DCIP expertise and 
availability. 

We provided a draft of this report to DOD in September 2008 for its 
review and comment. In written comments on a draft of this report, DOD 
concurred with both of our recommendations. Also, TRANSCOM provided us 
with technical comments, which we incorporated in the report as 
appropriate. DOD's response is reprinted in appendix II. 

Background: 

ASD(HD&ASA), within the Office of the Under Secretary of Defense for 
Policy, serves as the principal civilian advisor and the Chairman of 
the Joint Chiefs of Staff serves as the principal military advisor to 
the Secretary of Defense on critical infrastructure protection. 

ASD(HD&ASA) has issued guidance to help assure the availability of 
critical infrastructure. A component of this guidance outlines the 
roles and responsibilities of the organizations involved in DCIP. Table 
1 summarizes the training and exercise roles and responsibilities of 
each DCIP organization. 

Table 1: DCIP Training and Exercise Roles and Responsibilities: 

DCIP organization: ASD(HD&ASA); 
DCIP guidance: DOD Directive 3020.40: 
* Ensure the implementation of DCIP education, training, and awareness 
activities in coordination with the Chairman of the Joint Chiefs of 
Staff; 
DCIP guidance: DOD Instruction 3020.45[A]: 
* Provide policy and guidance for DCIP and oversee (including but not 
limited to) the implementation of education, training, and awareness 
goals and objectives. 

DCIP organization: Chairman of the Joint Chiefs of Staff; 
DCIP guidance: DOD Directive 3020.40: 
* Integrate DCIP functions and activities into joint planning, 
doctrine, training, and exercises; 
* Assist ASD(HD&ASA) in the development and maintenance of DCIP 
standards and procedures; 
* Review DCIP-related doctrine, standards, procedures, and training of 
combatant commands and military departments. 

DCIP organization: Military departments; 
DCIP guidance: DOD Directive 3020.40: 
* Incorporate DCIP elements into education and training programs, 
including the testing and exercising of mitigation and response plans; 
DCIP guidance: DOD Instruction 3020.45[A]: 
* Implement training and education activities designed to meet DCIP 
education and training goals and objectives; 
* Execute annual exercises, either separately or in conjunction with 
existing exercises, to integrate other federal departments and agencies 
in the risk reduction and in the protection, recovery, and restoration 
of defense critical infrastructure notionally affected by the full 
spectrum of threats and hazards; 
* Direct the incorporation of DCIP plans into joint operations, 
training, and exercises. Commanders shall ensure the submission of DCIP 
lessons learned. 

DCIP organization: Combatant commands; 
DCIP guidance: DOD Directive 3020.40: [Empty]; 
DCIP guidance: DOD Instruction 3020.45[A]: 
* Develop and exercise defense critical infrastructure mitigation plans 
to demonstrate that continuity of operations can be maintained; 
* Execute annual exercises, either separately or in conjunction with 
existing exercises, to integrate other federal departments and agencies 
in the risk reduction and in the protection, recovery, and restoration 
of defense critical infrastructure notionally affected by the full 
spectrum of threats and hazards; 
* Direct the incorporation of DCIP plans into joint operations, 
training, and exercises. Commanders shall ensure the submission of DCIP 
lessons learned. 

Source: GAO analysis of DOD DCIP guidance. 

[A] DOD Instruction 3020.45, Defense Critical Infrastructure Program 
(DCIP) Management (Washington, D.C.: Apr. 21, 2008). 

[End of table] 

Aspects of Critical Infrastructure Assurance Are Incorporated into 
TRANSCOM and Installation Exercises: 

[TRANSCOM Incorporates Critical Infrastructure Protection into Its 
Exercises: In its role as a combatant command, TRANSCOM incorporates 
critical infrastructure protection-related events into its two major 
biennial battle staff exercise programs. Turbo Challenge and Turbo 
Distribution are TRANSCOM-sponsored exercises that test and evaluate 
the capability of the Defense Transportation System to support the 
deployment and sustainment of forces associated with a particular 
combatant command operation plan or the movement of personnel and cargo 
in response to a crisis.TRANSCOM officials told us that the objective 
of including critical infrastructure protection-related events in its 
major exercises is to evaluate the commandís response to threats, loss, 
or degradation of its critical infrastructure. TRANSCOM also evaluates 
the potential to include critical infrastructure-related events in 
other combatant command exercises that it supports.] 

TRANSCOM and the installations we visited that have critical 
transportation assets have incorporated DCIP-like elements into their 
existing exercises. Although installation personnel we met with often 
were unaware of DCIP, we found that many conducted routine 
antiterrorism, emergency management, information assurance, and 
continuity of operations planning exercises that often include critical 
transportation assets located on the installation. 

As part of their regularly scheduled antiterrorism and continuity of 
operations programs, installation officials at all 19 installations we 
visited that have critical transportation assets conducted exercises 
encompassing critical assets located on their installations. However, 
unlike DCIP, some of these programs do not emphasize an all-threats, 
all-hazards approach to assuring critical infrastructure. DOD guidance 
requires the testing of antiterrorism[Footnote 15] and continuity of 
operations[Footnote 16] plans annually through various exercises. DOD's 
antiterrorism guidance requires that commanders maintain antiterrorism 
exercise documentation for no less than 2 years to ensure incorporation 
of lessons learned. These antiterrorism exercises often contain aspects 
of DCIP, such as (1) developing adaptive plans and procedures to 
mitigate risk, (2) restoring capability in the event of a loss or 
degradation of assets, (3) supporting incident management, and (4) 
protecting critical infrastructure-related sensitive information. For 
example, even though installation personnel are often unaware of DCIP, 
we found that exercises testing antiterrorism and continuity of 
operations plans typically include critical installation 
infrastructure, and exercises for emergency management plans sometimes 
include assuring the availability of critical transportation assets in 
the event of natural disasters. Several installations in Japan that we 
visited conducted exercises that assure the availability of critical 
transportation assets located on those installations. Also, several 
installation officials responsible for critical transportation assets 
in PACOM's area of responsibility with whom we met told us that they 
conduct exercises that examine the impact of natural disasters, such as 
earthquakes and typhoons, on critical infrastructure. Installation 
officials responsible for critical transportation assets in CENTCOM's 
area of responsibility told us that they incorporate lessons learned 
into future exercises. For instance, an installation in the Middle East 
used exercises to prepare for its response to and recovery from major 
accidents, natural disasters, attacks, or terrorist use of chemical, 
biological, radiological, nuclear, or high-yield explosives, and has 
incorporated its findings into planning for future exercises. 

DOD Has Not Developed DCIP Training Standards Departmentwide, and 
Installation Personnel Remain Unaware of Existing DCIP Expertise: 

Although several of the combatant commands and military services we 
visited have variously developed headquarters-level DCIP training 
programs, DOD has not developed DCIP training standards departmentwide. 
Further, many of the installation personnel responsible for the 
assurance of critical infrastructure remain unaware of the DCIP program 
and the DCIP expertise available at the combatant command and military 
service levels. 

DCIP Training Standards Have Not Yet Been Developed Departmentwide: 

DOD's DCIP instruction requires ASD(HD&ASA) to provide policy and 
guidance for DCIP and oversee the implementation of DCIP education, 
training, and awareness of goals and objectives. ASD(HD&ASA) recognized 
the need for DCIP training in its March 2008 Strategy for Defense 
Critical Infrastructure.[Footnote 17] Specifically, the strategy states 
that ASD(HD&ASA) will establish baseline critical infrastructure 
education requirements. Given that this strategy is relatively new, 
DCIP training standards have not yet been established departmentwide 
nor has DOD established a time frame for implementing the training 
standards. However, in the absence of DCIP training standards 
departmentwide, we determined through our work examining the five 
defense sectors that several combatant commands and military services 
have independently developed their own training programs or modules. 
For example, PACOM officials stated that they have conducted internal 
PACOM training and education on critical infrastructure assurance. U.S. 
Strategic Command has conducted internal training and continuous 
education for its staff. Further, TRANSCOM and CENTCOM officials told 
us that they have developed critical infrastructure training for their 
headquarters-level personnel. Additionally, CENTCOM officials told us 
that the development of their internal critical infrastructure training 
was still in its initial stages. Conversely, U.S. European Command 
officials told us that they are currently focused almost exclusively on 
identifying critical infrastructure and threats to those assets. 

Moreover, the Department of the Navy has developed a DCIP training 
module that it has incorporated into its information assurance 
training.[Footnote 18] The module provides an overview of critical 
infrastructure protection and the vulnerabilities created by increased 
interdependencies. The U.S. Marine Corps has begun familiarizing its 
installation antiterrorism officers with DCIP through required training 
for its Critical Asset Management System, used by the U.S. Marine Corps 
to track critical infrastructure. Air Force officials told us that they 
have a mission assurance training module that includes critical 
infrastructure protection, and like the U.S. Marine Corps, they conduct 
training for major Air Force commands on their version of the Critical 
Asset Management System. Further, officials we spoke with at the Air 
Mobility Command--an Air Force major command and subcomponent command 
to TRANSCOM--told us that they provide annual DCIP training to their 
air mobility wings. Army officials we met with did not identify Army- 
specific DCIP training but stated that training needs to be 
comprehensive and not defense sector specific. 

However, because there are no DCIP training standards departmentwide 
and combatant command-and military service-level training has not 
reached installation personnel responsible for assuring the 
availability of defense critical infrastructure, installation personnel 
rely on other, more established programs, such as the Antiterrorism 
Program. However, unlike DCIP, some of these programs do not emphasize 
consideration of the full spectrum of threats and hazards that can 
compromise the availability of critical infrastructure.[Footnote 19] 
For example, the Antiterrorism Program focuses on terrorist threats to 
assets and personnel. While some DCIP training exists, the combatant 
commands' and military services' development of disparate training 
programs, without benefit of DCIP training standards departmentwide, 
may result in programs that contain potentially conflicting 
information. As a result, training may be less effective, and resources 
may be used inefficiently. 

With Few Exceptions, Installation Personnel We Met with Responsible for 
Critical Transportation Assets Were Unaware of Existing DCIP Expertise: 

With few exceptions, installation personnel we met with who are 
responsible for assuring the availability of critical transportation 
infrastructure were not familiar with DCIP and were not aware that the 
combatant commands or military services possessed DCIP expertise that 
they could leverage for two reasons. First, as we previously reported, 
[Footnote 20] the military services have not yet developed specific 
guidance for how installations are to implement DCIP. Second, DCIP 
efforts to date have focused primarily on the identification and 
assessment of critical infrastructure. At 13 of the 19 installations we 
visited that have critical transportation assets, installation 
personnel we spoke with stated that prior to our visit, they had not 
heard of DCIP. Furthermore, DOD has not developed an effective way to 
communicate that DCIP expertise is available to installation personnel 
at the combatant command and military service levels. Until DOD 
develops a way to effectively communicate the existence of DCIP 
expertise to installation personnel, such personnel may not be able to 
fully leverage DCIP knowledge, which will affect how they assure the 
availability of critical infrastructure from an all-hazards approach, 
which they currently may not be doing. 

Conclusions: 

Because the network of DOD-and non-DOD-owned critical infrastructure 
represents an attractive target to adversaries and also is potentially 
vulnerable to a variety of natural disasters or accidents, it is 
crucial for DOD to conduct DCIP exercises and develop and implement 
DCIP training. With few exceptions, at the sites we visited, 
installation officials responsible for the assurance of critical assets 
were not aware of DCIP. However, they conducted complementary exercises 
that while in some cases not emphasizing the full spectrum of threats 
and hazards, often involved some aspects of critical infrastructure 
assurance and provided a measure of protection for critical assets 
located on the installation. In the absence of DCIP training standards 
departmentwide, the combatant commands and military services are 
developing and implementing disparate training programs, which may 
result in duplicative programs or programs that potentially may contain 
inconsistent information. As a result, training may be less effective 
and resources may be used inefficiently. Furthermore, lacking a process 
for communicating existing DCIP expertise across the department, 
installation personnel will be unable to take full advantage of 
existing knowledge in assuring the availability of critical 
infrastructure. 

Recommendations for Executive Action: 

We are making two recommendations to help assure the availability of 
critical infrastructure by improving training and awareness. We 
recommend that the Secretary of Defense direct ASD(HD&ASA) to: 

* Develop departmentwide DCIP training standards and an implementation 
time frame to enable the combatant commands and military services to 
develop consistent and cost-effective training programs. 

* Coordinate with the combatant commands and military services to 
develop an effective means to communicate to installation personnel the 
existence and availability of DCIP expertise at the combatant command 
and military service levels. 

Agency Comments: 

In written comments on a draft of this report, DOD concurred with both 
of our recommendations. Also, TRANSCOM provided us with technical 
comments, which we incorporated in the report where appropriate. DOD's 
comments are reprinted in appendix II. 

DOD concurred with our recommendation to develop departmentwide DCIP 
training standards and an implementation time frame to enable the 
combatant commands and military services to develop consistent and cost-
effective training programs. In its comments, DOD stated that 
ASD(HD&ASA) intends to designate U.S. Joint Forces Command as the 
executive agent for the development of critical infrastructure 
protection education and training standards, and upon completion of the 
development of training standards, ASD(HD&ASA) will set a 180-day time 
frame for full implementation by the combatant commands and military 
services to enable consistent and cost-effective training. 

DOD also concurred with our recommendation to coordinate with the 
combatant commands and military services to develop an effective means 
to communicate to installation personnel the existence and availability 
of DCIP expertise at the combatant command and military service levels. 
DOD noted that ASD(HD&ASA) intends to take steps to make critical 
infrastructure protection materials available to installation personnel 
and will continue to work with the Joint Staff, U.S. Joint Forces 
Command, and the Defense Threat Reduction Agency to develop an 
effective means to improve communication regarding the availability of 
critical infrastructure protection expertise. 

We are sending copies of this report to the Chairmen and Ranking 
Members of the Senate and House Committees on Appropriations, Senate 
and House Committees on Armed Services, and other interested 
congressional parties. We also are sending copies of this report to the 
Secretary of Defense; the Chairman of the Joint Chiefs of Staff; the 
Secretaries of the Army, the Navy, and the Air Force; the Commandant of 
the U.S. Marine Corps; the combatant commanders of the functional and 
geographic combatant commands; the Commander, U.S. Army Corps of 
Engineers; the Director, Defense Intelligence Agency; the Director, 
Defense Information Systems Agency; and the Director, Office of 
Management and Budget. We will also make copies available to others 
upon request. This report will also be available at no charge on GAO's 
Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have questions concerning this report, please 
contact me at (202) 512-5431 or dagostinod@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix III. 

Signed by: 

Davi M. D'Agostino: 
Director, Defense Capabilities and Management: 

[End of section] 

Appendix I: Scope and Methodology: 

To determine the extent to which the Department of Defense (DOD) has 
(1) incorporated aspects of the Defense Critical Infrastructure Program 
(DCIP) into its exercises in the Transportation Defense Sector and (2) 
developed DCIP training standards departmentwide and made installation 
personnel aware of existing DCIP expertise, we obtained relevant 
documentation and interviewed officials from the following DOD 
organizations:[Footnote 21] 

* Office of the Secretary of Defense (OSD):
- Office of the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs: 

* Joint Staff, Directorate for Operations, Antiterrorism and Homeland 
Defense: 

* Defense Threat Reduction Agency, Combat Support Assessments Division: 

* Military services:
- Department of the Army, Asymmetric Warfare Office, Critical 
Infrastructure Risk Management Branch:
- Department of the Navy:
Office of the Chief Information Officer:
Mission Assurance Division, Naval Surface Warfare Center, Dahlgren 
Division, Dahlgren, Virginia:
- Department of the Air Force, Air, Space and Information Operations, 
Plans, and Requirements, Homeland Defense Division:
- Headquarters, U.S. Marine Corps, Security Division, Critical 
Infrastructure Protection Office: 

* Combatant commands:
- Headquarters, U.S. Central Command, Critical Infrastructure Program 
Office, MacDill Air Force Base (AFB), Florida:
- Headquarters, U.S. European Command, Critical Infrastructure 
Protection Program Office, Patch Barracks, Vaihingen, Germany:
- Headquarters, U.S. Pacific Command, Antiterrorism and Critical 
Infrastructure Division, Camp H.M. Smith, Hawaii: 
U.S. Forces Japan:
- Headquarters, U.S. Transportation Command (TRANSCOM), Critical 
Infrastructure Program, Scott AFB, Illinois: 
Headquarters, Air Mobility Command, Homeland Defense Branch, Scott AFB, 
Illinois:
- Headquarters, U.S. Strategic Command, Mission Assurance Division, 
Offutt AFB, Nebraska: 

* Defense infrastructure sector lead agents:
- Headquarters, Defense Intelligence Agency, Critical Infrastructure 
Protection Team:
- Headquarters, Defense Information Systems Agency, Office for Critical 
Infrastructure Protection and Homeland Security/Defense:
- Headquarters, TRANSCOM, Critical Infrastructure Program, Scott AFB, 
Illinois:
- Headquarters, U.S. Strategic Command, Mission Assurance Division, 
Offutt AFB, Nebraska:
- Headquarters, U.S. Army Corps of Engineers, Directorate of Military 
Programs: 

* Selected critical assets in the continental United States, Hawaii, 
the U.S. Territory of Guam, Germany, Greece, Kuwait and another country 
in U.S. Central Command's area of responsibility, and Japan: 

We drew a nonprobability sample[Footnote 22] of critical assets in the 
United States and abroad, using draft critical asset lists developed by 
the Joint Staff, each of the four military services, TRANSCOM, the 
Defense Intelligence Agency, and the Defense Information Systems 
Agency. We selected assets for our review based on the following 
criteria: (1) overlap among the various critical asset lists; (2) 
geographic dispersion among geographic combatant commands' areas of 
responsibility; (3) representation from each military service; and (4) 
with respect to transportation assets, representation in TRANSCOM's 
three asset categories: air bases, seaports, and commercial airports. 
Using this methodology, we selected 46 total critical assets for 
review--22 transportation assets[Footnote 23] and 24 Tri-Sector assets-
-in the United States and in Europe, the Middle East, and the Pacific 
region.[Footnote 24] 

Further, we reviewed relevant DOD guidance pertaining to DCIP training 
and exercise requirements and interviewed officials from OSD, the Joint 
Staff, defense agencies, the military services, the combatant commands, 
and the defense infrastructure sector lead agents responsible for DCIP. 
(Throughout this unclassified report, we do not identify the 46 
specific critical assets, their locations or installations, or 
combatant command or others' missions that the assets support because 
that information is classified.) 

This report's first objective, examining the extent to which DOD has 
incorporated aspects of DCIP into its exercises in the Transportation 
Defense Sector, focused on DCIP-related exercises conducted by TRANSCOM 
and on exercises conducted at individual installations we visited that 
have critical transportation assets. To address this objective, we 
reviewed and analyzed policies, assurance plans, strategies, handbooks, 
directives, and instructions. Further, we spoke with installation 
personnel about their efforts to incorporate aspects of DCIP into 
installation exercises and reviewed and analyzed installation emergency 
management plans, information assurance plans, and continuity of 
operations plans to determine how, if at all, critical assets were 
incorporated into exercises. In addition, to determine how critical 
assets are included and how lessons learned are incorporated into 
future exercises, we interviewed combatant command, subcomponent, and 
installation personnel responsible for planning and conducting 
exercises involving critical assets. 

For our second objective, the scope of our work on the extent to which 
DOD has developed DCIP training standards departmentwide and made 
installation personnel aware of existing DCIP expertise focused on 
efforts at OSD; at the four military services; within five combatant 
commands--U.S. Central Command, U.S. European Command, U.S. Pacific 
Command, U.S. Strategic Command, and TRANSCOM; and at installations 
that have critical assets representing each of the five defense sectors 
that we visited. Regarding DCIP awareness, the scope of our work 
focused exclusively on installation personnel who are responsible for 
critical transportation assets. To address this objective, we reviewed 
existing combatant command and military service DCIP training programs 
and interviewed program officials at the OSD, combatant command, and 
military service headquarters levels. Further, we interviewed 
installation personnel responsible for assuring the critical 
infrastructure we selected as part of our nonprobability sample to 
determine their awareness of DCIP and the existence of DCIP expertise 
and their ability to leverage these resources. 

We conducted this performance audit from May 2007 through September 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit 
to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. 
We believe that the evidence obtained provides a reasonable basis for 
our findings and conclusions based on our audit objectives. 

[End of section] 

Appendix II: Comments from the Department of Defense: 

Assistant Secretary Of Defense: 
Homeland Defense & Americas' Security Affairs: 
2600 Defense Pentagon: 
Washington, D.C. 20301-2600: 

Ms. Davi M. D'Agostino: 
Director, Defense Capabilities and Management: 
U.S. Government Accountability Office: 
441 G Street, N.W. 
Washington, DC 20548: 

October 16, 2008: 

Dear Ms. D'Agostino: 

This is the Department of Defense (DoD) response to the GAO draft 
report, GAO-09-42, "Defense Critical Infrastructure: Developing 
Training Standards and an Awareness of Existing Expertise Would Help 
DoD Assure the Availability of Critical Infrastructure," (GAO Code 
351240). DoD concurs with the two recommendations in the report. Our 
response to your recommendations is enclosed. 

Our point of contact for this action is Mr. Antwane Johnson, Office of 
the Assistant Secretary of Defense for Homeland Defense and Americas' 
Security Affairs (DASD (HD&ASA)), (703) 602-5730, Extension 143 or 
Antwane.Johnson@osd.mil. 

Sincerely, 

Signed by: 
Peter F. Verga: 
Principal Deputy: 

for: Paul McHale: 

Enclosure: As stated: 

GAO Draft Report - Dated September 24, 2008: 
GAO Code 351240/GAO-09-42: 

"Defense Critical Infrastructure: Developing Training Standards and an 
Awareness of Existing Expertise Would Help DoD Assure the Availability 
of Critical Infrastructure" 

Department Of Defense Comments To The Recommendations: 

Recommendation 1: The GAO recommends that the Secretary of Defense 
direct the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs to develop Department-wide Defense Critical 
Infrastructure Program training standards and an implementation time 
frame to enable the combatant commands and Military Services to develop 
consistent and cost-effective training programs. 

DOD Response: Concur. As noted in the March 2008 DCIP Strategy, 
OASD(HD&ASA) recognizes the need for DCIP training and program 
awareness. Given the newness of the strategy, and the fact that the 
Critical Asset Identification Process Manual is still in final 
coordination, OASD(HD&ASA) has not yet established Department-wide 
training standards. We recognize that several of the combatant commands 
and Military Services are independently developing and implementing 
their own DCIP training programs. OASD(HD&ASA) intends to designate 
United States Joint Forces Command (USJFCOM) as the executive agent for 
the development of critical infrastructure protection education and 
training standards. USJFCOM will be tasked to provide CIP education 
course curricula, and to develop program training standards to support 
both classroom-based instruction and web-based study. OASD(HD&ASA) will 
work with USJFCOM in developing and establishing minimum CIP education 
course criteria and training standards. Upon completion of the 
development of the materials, DASD (HD&ASA) will set a 180-day time 
frame for full implementation by the combatant commands and Military 
Services to enable consistent and cost-effective CIP training. 

Recommendation 2: The GAO recommends that the Secretary of Defense 
direct the Assistant Secretary of Defense for Homeland Defense and 
Americas' Security Affairs to coordinate with the combatant commands 
and Military Services to develop an effective means to communicate to 
installation personnel the existence and availability of Defense 
Critical Infrastructure Program expertise at the combatant command and 
Military Service levels. 

DOD Response: Concur. As noted in the March 2008 DCIP Strategy, 
OASD(HD&ASA) recognizes the. need for DCIP training and program 
awareness which is re-enforced in DoD Instruction 3020.45. The focus of 
the program to date has been on the combatant commands, the Military 
Services and the defense sectors. DCIP concepts and procedures have not 
yet reached installation personnel that own and operate the assets. As 
DCIP policy and procedures are being promulgated, the Military Services 
are beginning to develop their implementation guidance. The
Army has developed Service-specific guidance (AR 525-26) and HQDA is 
executing that guidance in support of DoD Directive 3020.40 and DoD 
Instruction 3020.45. The Air Force is developing a draft Air Force 
Instruction for CIP which is in the coordination process. The other 
Military Services prefer to await official publication of the Critical 
Asset Identification Process prior to implementing Service-specific 
guidance. OASD(HD&ASA) intends, as a part of the CIP training 
standards, to have appropriate CIP materials (brochures, flyers, web 
link) available for CIP awareness and education. These tools would be 
made available inside installation "welcome aboard packets" during 
indoctrination. In addition, OASD(HD&ASA) has developed in conjunction 
with the Defense Threat Reduction Agency (DTRA), a DCIP Introduction 
briefing to be used during Joint Staff sponsored Mobile Training Team 
seminars at combatant command and Service Antiterrorism and Force 
Protection training sessions. OASD(HD&ASA) will continue to work with 
the Joint Staff, JFCOM, and DTRA in developing an effective means to 
improve communication regarding the availability of CIP expertise. 

[End of section] 

Appendix III: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Davi M. D'Agostino, (202) 512-5431 or dagostinod@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Mark A. Pross, Assistant 
Director; Gina M. Flacco; James P. Krustapentus; Kate S. Lenane; Terry 
L. Richardson; Marc J. Schwartz; John S. Townes; Cheryl A. Weissman; 
and Alex M. Winograd made key contributions to this report. 

[End of section] 

Related GAO Products: 

Defense Critical Infrastructure: DOD's Evolving Assurance Program Has 
Made Progress but Leaves Critical Space, Intelligence, and Global 
Communications Assets at Risk. [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-828NI]. Washington, D.C.: August 22, 2008 (For 
Official Use Only). 

Defense Critical Infrastructure: Adherence to Guidance Would Improve 
DOD's Approach to Identifying and Assuring the Availability of Critical 
Transportation Assets. [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-851]. Washington, D.C.: August 15, 2008. 

Defense Critical Infrastructure: Additional Air Force Actions Needed at 
Creech Air Force Base to Ensure Protection and Continuity of UAS 
Operations. [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-
469RNI]. Washington, D.C.: April 23, 2008 (For Official Use Only). 

Defense Critical Infrastructure: DOD's Risk Analysis of Its Critical 
Infrastructure Omits Highly Sensitive Assets. [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-373R]. Washington, D.C.: April 
2, 2008. 

Defense Infrastructure: Management Actions Needed to Ensure 
Effectiveness of DOD's Risk Management Approach for the Defense 
Industrial Base. [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-
1077]. Washington, D.C.: August 31, 2007. 

Defense Infrastructure: Actions Needed to Guide DOD's Efforts to 
Identify, Prioritize, and Assess Its Critical Infrastructure. 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-461]. Washington, 
D.C.: May 24, 2007. 

[End of section] 

Footnotes: 

[1] DOD Directive 3020.40, Defense Critical Infrastructure Program 
(DCIP) (Washington, D.C.: Apr. 19, 2005). 

[2] The 10 defense sectors are the Defense Industrial Base; Financial 
Services; Global Information Grid; Health Affairs; Intelligence, 
Surveillance, and Reconnaissance; Logistics; Personnel; Public Works; 
Space; and Transportation. 

[3] DOD Directive 2000.12, DOD Antiterrorism (AT) Program (Washington, 
D.C.: Aug. 18, 2003 (certified current as of Dec. 13, 2007)). 

[4] DOD Directive 8500.01E, Information Assurance (IA) (Washington, 
D.C.: Oct. 24, 2002 (certified current as of Apr. 23, 2007)). 

[5] GAO, Defense Infrastructure: Actions Needed to Guide DOD's Efforts 
to Identify, Prioritize, and Assess Its Critical Infrastructure, 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-461] (Washington, 
D.C.: May 24, 2007). 

[6] GAO, Defense Infrastructure: Management Actions Needed to Ensure 
Effectiveness of DOD's Risk Management Approach for the Defense 
Industrial Base, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-
1077] (Washington, D.C.: Aug. 31, 2007). 

[7] GAO, Defense Critical Infrastructure: DOD's Risk Analysis of Its 
Critical Infrastructure Omits Highly Sensitive Assets, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-373R] (Washington, D.C.: Apr. 
2, 2008). 

[8] GAO, Defense Critical Infrastructure: Additional Air Force Actions 
Needed at Creech Air Force Base to Ensure Protection and Continuity of 
UAS Operations, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-
469RNI] (Washington, D.C.: Apr. 23, 2008) (For Official Use Only). 

[9] GAO, Defense Critical Infrastructure: Adherence to Guidance Would 
Improve DOD's Approach to Identifying and Assuring the Availability of 
Critical Transportation Assets, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-851] (Washington, D.C.: Aug. 15, 2008). 

[10] GAO, Defense Critical Infrastructure: DOD's Evolving Assurance 
Program Has Made Progress but Leaves Critical Space, Intelligence, and 
Global Communications Assets at Risk, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-828NI] (Washington, D.C.: Aug. 
22, 2008) (For Official Use Only). 

[11] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-461]. 

[12] Results from nonprobability samples cannot be used to make 
inferences about a population, because in a nonprobability sample some 
elements of the population being studied have no chance or an unknown 
chance of being selected as part of the sample. 

[13] For purposes of this report, we are including only 19 
installations that have critical transportation assets, since the 
remaining three critical transportation assets in our sample are 
commercial airports that have no DOD personnel stationed at them. 

[14] For greater detail on asset selection methodology, see [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-851] and [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-08-828NI] (For Official Use 
Only). 

[15] DOD Instruction 2000.16, DOD Antiterrorism (AT) Standards 
(Washington, D.C.: Oct. 2, 2006). 

[16] DOD Directive 3020.26, Defense Continuity Program (DCP) 
(Washington, D.C.: Sept. 8, 2004). 

[17] Department of Defense, Strategy for Defense Critical 
Infrastructure (Washington, D.C.: March 2008). 

[18] DOD Information Assurance Awareness version 6.0. 

[19] A threat is an adversary having the intent, capability, and 
opportunity to cause loss or damage, while hazards are defined as non- 
hostile incidents, such as accidents, natural forces, and technological 
failures, that cause loss or damage to infrastructure assets. 

[20] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-461]. 

[21] DOD organizations are located in the Washington, D.C., 
metropolitan area unless otherwise indicated. 

[22] Results from nonprobability samples cannot be used to make 
inferences about a population, because in a nonprobability sample some 
elements of the population being studied have no chance or an unknown 
chance of being selected as part of the sample. 

[23] For purposes of this report, we are including only 19 
installations that have critical transportation assets, since the 
remaining three critical transportation assets in our sample are 
commercial airports that have no DOD personnel stationed at them. 

[24] For greater detail on asset selection methodology, see GAO-08-851 
and [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-828NI] (For 
Official Use Only). 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: