This is the accessible text file for GAO report number GAO-05-688T entitled 'Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies' which was released on May 10, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Testimony: Before the Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: United States Government Accountability Office: GAO: For Release on Delivery Expected at 2:00 p.m. EDT: Tuesday, May 10, 2005: Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies: Statement of Jess T. Ford, Director, International Affairs and Trade: GAO-05-688T: GAO Highlights: Highlights of GAO-05-688T, a testimony before the Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: Why GAO Did This Study: U.S. government officials working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked—23 fatally—by terrorists outside the embassy. As the State Department continues to improve security at U.S. embassies, terrorist groups are likely to focus on “soft” targets—such as homes, schools, and places of worship. GAO was asked to determine whether State has a strategy for soft target protection; assess State’s efforts to protect U.S. officials and their families while traveling to and from work; assess State’s efforts overseas to improve security at schools attended by the children of U.S. officials; and describe issues related to protection at their residences. What GAO Found: State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. They also indicated that they have recently initiated an effort to develop a soft targets strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. Three State initiated investigations into terrorist attacks against U.S. officials outside of embassies found that the officials lacked the necessary hands-on training to help counter the attack. The investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. After each of these investigations, State reported to Congress that it planned to implement the recommendations, yet we found that State’s hands-on training course is not required, the accountability procedures have not been effectively implemented, and key embassy officials are not trained to implement State’s counterterrorism procedures. State instituted a program in 2003 to improve security at schools, but its scope has not yet been fully determined. In fiscal years 2003 and 2004, Congress earmarked $29.8 million for State to address security vulnerabilities against soft targets, particularly at overseas schools. The multiphase program provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities from terrorist threats. However, during our visits to posts, regional security officers were unclear about which schools could qualify for security assistance under phase three of the program. State’s program to protect U.S. officials and their families at their residences is primarily designed to deter crime, not terrorism. The Residential Security program includes basic security hardware and local guards, which State officials said provide effective deterrence against crime, though only limited deterrence against a terrorist attack. To minimize the risk and consequences of a residential terrorist attack, some posts we visited limited the number of U.S. officials living in specific apartment buildings. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in residential areas. What GAO Recommends: We are recommending that the Secretary of State develop a soft targets strategy; develop counterterrorism training for officials; and fully implement its personal security accountability system for embassy officials. State generally agreed with our recommendations. www.gao.gov/cgi-bin/getrpt?GAO-05-688T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Jess T. Ford at (202) 512- 4128 or fordj@gao.gov. [End of section] Mr. Chairman and Members of the Subcommittee: I am pleased to be here to discuss the report we are releasing today on State Department efforts to protect U.S. officials and their families from terrorist attacks outside of embassies.[Footnote 1] U.S. government officials and their families living and working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked--23 fatally--by terrorists outside the embassy. As the State Department continues to improve security at U.S. embassies, concerns are growing that terrorist groups are likely to focus on "soft" targets--such as homes, schools, and places of worship. Recent terrorist attacks against housing complexes in Saudi Arabia, a school in Russia, and places of worship in Turkey illustrate this growing threat. State-initiated security assessments have further documented this growing concern and recommended that State develop better measures to protect U.S. officials and their families in soft target areas.[Footnote 2] Our report addresses four issues: (1) whether State has a strategy for soft target protection, (2) an assessment of State's efforts to protect U.S. officials and their families against terrorist attacks while traveling to and from work, (3) State's efforts to improve security at schools overseas attended by the children of U.S. officials, and (4) issues related to protection of U.S. officials and their families at residences. I will also discuss our recommendations to State and State's response. For our work on this subject, we reviewed State documents and interviewed State officials in Washington, D.C., and at five posts in four countries. We also attended security trainings and briefings available to State officials. Our work was conducted in accordance with generally accepted government auditing standards. Summary: State has a number of programs and activities to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of legal, management, and resources challenges related to developing and implementing such a strategy, but agreed a strategy was needed. The department is now in the process of developing a soft target strategy. State has not fully implemented one of the most important safeguards against terrorist attacks while traveling to and from work-- counterterrorism training. Three State-initiated investigations into terrorist attacks against U.S. officials outside of embassies found officials lacked the necessary training that could have saved their lives, including surveillance detection and avoidance and defensive and evasive driving techniques. The investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. However, we found that State has not fully implemented these recommendations. For example, State's hands-on counterterrorism training course is still not required, and ambassadors, deputy chiefs of mission, and regional security officers are not trained to implement State's counterterrorism procedures. In addition, the accountability procedures, monitoring, and checklists developed in 2003 designed to promote personal security were not being followed at any of the five posts we visited. In response to congressional directives, State instituted a program in 2003 designed to improve the protection of U.S. officials and their families at schools and some off-compound employee associations from terrorist threats. The multiphase program provides basic security hardware, such as shatter-resistant window film, alarms, and radios, and additional protective measures based on threat levels and vulnerabilities. The first two phases are focused on department- sponsored schools that have previously received grant funding from the State Department. The third and fourth phases, which are similar to the first and second phases, focus on the nondepartment-sponsored schools with American students.[Footnote 3] During our visits to five posts, Regional Security Officers were unclear about which schools qualified for security assistance under phase three of the program. Some Regional Security Officers raised questions about whether to fund schools in which just a few American children were enrolled. State's program to protect U.S. officials and their families at residences is largely designed to deter crime. The Residential Security program includes basic security hardware, such as alarms, shatter- resistant window film, limited access control measures, and local guards. To reduce the terrorist threat, some posts limit the number of U.S. officials living in specific apartment buildings. Moreover, at some of the posts we visited, surveillance detection teams were used to help protect schools and residential areas. Several Regional Security Officers told us that use of surveillance detection teams could provide greater deterrence to potential terrorist attacks. We are recommending that State, as it develops its soft targets strategy, determine the full scope of its responsibilities and the legal and financial ramifications of securing U.S. officials and their families outside the embassy; develop corresponding protection programs and activities; and integrate elements of the soft targets strategy into embassy emergency action plans. We are also recommending that State bolster its training and compliance procedures, including by making counterterrorism training mandatory and delivered on a prioritized basis, and by fully implementing the personal security accountability system that State agreed to implement in response to the 2003 Accountability Review Board for all embassy officials. State said it was in general agreement with most of our recommendations and said that it would examine others. Background: Although State has not yet formally defined what constitutes a soft target, State Department travel warnings and security officers generally consider soft targets to be places where Americans and other westerners live, congregate, shop, or visit, such as hotels, clubs, restaurants, shopping centers, housing compounds, places of worship, schools, or public recreation events. Travel routes of U.S. government employees are also considered soft targets, based on their history of terrorist attacks. The State Department is responsible for protecting more than 60,000 government employees, and their family members, who work in embassies and consulates abroad in 180 countries. Although the host nation is responsible for providing protection to diplomatic personnel and missions under the 1961 Vienna Convention, State has a variety of programs and activities to further protect U.S. officials and family members both inside and outside of the embassy. Following a terrorist attack that involves serious injury or loss of life or significant destruction of a U.S. government mission, State is required to convene an Accountability Review Board (ARB). ARBs investigate the attack and issue a report with recommendations to improve security programs and practices. State is required to report to Congress on actions it has taken in response to ARB recommendations. As of March 2005, there have been 11 ARBs convened since the board's establishment in 1986. Concerned that State was not providing adequate security for U.S. officials and their families outside the embassy, the American Foreign Service Association testified on a number of occasions before the Senate Appropriations Subcommittee on Commerce, Justice, State and the Judiciary on the need for State to expand its security measures. The subcommittee, in its 2002 and subsequent reports, urged State to formulate a strategy for addressing threats to locales abroad that are frequented by U.S. officials and their families. It focused its concern about soft targets on schools, residences, places of worship, and other popular gathering places. In fiscal years 2003, 2004, and 2005, Congress earmarked a total of $15 million for soft target protection each year, particularly to address security vulnerabilities at overseas schools.[Footnote 4] Moreover, in 2005, the Senate appropriations report directed State to develop a comprehensive strategy for addressing the threats posed to soft targets no later than June 1, 2005. State Lacks a Strategy to Cover Soft Target Areas; Key Issues Need to Be Resolved: State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. official and their families. State officials cited several complex issues involved with protecting soft targets. As the terrorist threat grows, State is being asked to provide ever greater levels of protection to more people in more dangerous locations, and they questioned how far State's protection of soft targets should extend. They said that providing U.S. government funds to protect U.S. officials and their families at private sector locations or places of worship was unprecedented and raised a number of legal and financial challenges--including sovereignty and separation of church and state--that have not been resolved by the department. State officials also indicated they have not yet fully defined the universe of soft targets--including taking an inventory of potentially vulnerable facilities and areas where U.S. officials and their families congregate--that would be necessary to complete a strategy. Although State has not developed a comprehensive soft target strategy, some State officials told us that several existing programs could help protect soft targets. However, they agreed that these existing programs are not tied together in an overall strategy. State officials agreed that they should undertake a formal evaluation of how existing programs can be more effectively integrated as part of a soft target strategy, and whether new programs might be needed to fill any potential gaps. A senior official with State's Bureau of Diplomatic Security (DS) told us that in January 2005, DS formed a working group to develop a comprehensive soft targets strategy to address the appropriate level of protection of U.S. officials and their families at schools, residences, and other areas outside the embassy. According to State, the strategy should be completed by June 1, 2005. State Has Not Fully Implemented ARB Training and Accountability Recommendations to Improve Security for Embassy Personnel: To identify vulnerabilities in State's soft target protection, and determine if State had corrected these vulnerabilities, we reviewed the ARB reports conducted after U.S. officials were assassinated outside the embassy. Of the 11 ARBs conducted since 1986, the majority (5) have focused on soft target attacks, compared with attacks against embassies (2) or other U.S. facilities (4). We found that, 17 years after the first soft target ARB, State has still not addressed the vulnerabilities and recommendations identified in that and more recent reports: specifically, the need for hands-on counterterrorism training and accountability mechanisms to promote compliance with personal security procedures. Despite State's assurances to Congress that it would implement recommendations aimed at reducing these vulnerabilities, we found that State's hands-on training course is still not mandatory, and procedures to monitor compliance with security requirements have not been fully implemented. We also found that ambassadors, deputy chiefs of mission, and regional security officers were not trained in how to implement embassy procedures intended to protect U.S. officials outside the embassies. Despite State's Agreement That Counterterrorism Training Is Needed, It Is Still Not Required: Since 1988, State has reported to Congress that it agreed with ARB recommendations to provide counterterrorism training. For example, in 1995, State reported that it "re-established the Diplomatic Security Antiterrorism Course (DSAC) for those going to critical-threat posts to teach surveillance detection and avoidance, and defensive and evasive driving techniques." In 2003, State reported it agreed with the recommendations that employees from all agencies should receive security briefings and indicated that it would review the adequacy of its training and other personal security measures.[Footnote 5] Although State implemented the board's recommendation to require security briefings for all staff, hands-on counterterrorism training is still not mandatory, and few officials or family members have taken DSAC. Senior DS officials said they recognize that security briefings are no longer adequate to protect against current terrorist threats. In June 2004, DS developed a proposal to make DSAC training mandatory. DS officials said that DSAC training should be required for all officials, but that issues such as costs and adequacy of training facilities were constraining factors. As of April 18, 2005, the proposal had not been approved. Although State has agreed on the need to implement an accountability system to promote compliance with personal security procedures since 1988, there is still no such system in place. Beginning in 2003, State has tried to incorporate some limited accountability to promote compliance. However, based on our work at five posts, we found that post officials are following few, if any, of these new procedures. In response to a 2003 ARB, State took a number of steps to improve compliance with State's personal security procedures for officials outside the embassy. In June 2003, State revised its annual assessment criteria to take personal security into account when preparing performance appraisals, and in December 2003, State revised its Foreign Affairs Manual to mandate and improve implementation of personal security practices. In May 2004, State notified posts worldwide on use of a Personal Security Self-Assessment Checklist to improve security outside the embassy. However, none of the posts we visited were even aware of these and other key policy changes. For example, none of the officials we met with, including ambassadors, deputy chiefs of mission, regional security officers, or staff, were aware that the annual ratings process now includes an assessment of whether staff are following the personal security measures or that managers are now responsible for the reasonable oversight of subordinates' personal security activities. Furthermore, none of the supervisors were aware of the checklist, and we found no one was using the checklists to improve their personal security practices. In explaining why posts were not aware of the new personal security regulations, DS officials noted that posts were often overwhelmed by work and may have simply missed the cables and changes in the Foreign Affairs Manual. They also noted that changes like this take time to be implemented globally. Furthermore, State's original plan, to use the checklist as an accountability mechanism, was dropped before it was implemented. In its June 2003 report to Congress on implementation of the 2003 ARB recommendations, State stipulated that staff would be required to use the checklist periodically and that managers would review the checklists to ensure compliance. However, State never implemented this accountability mechanism out of concern it would consume too much staff time. We also found that key officials receive no training on how to promote personal security outside the embassy. According to a number of State officials, improvements in this area must start with the ambassador and the deputy chief of mission. Yet no ambassadors, deputy chiefs of mission, or regional security officers receive any training in how to maximize soft target protection at embassies. DS officials agreed that this critical component should be added to their training curriculum. State Develops Soft Targets Program for Schools, but Scope Is Not Yet Fully Defined: In response to several congressional committee reports, State began developing a "Soft Targets" program in 2003 to help protect overseas schools against terrorism. The program has four proposed phases. The first two phases are focused on department-sponsored schools that have previously received grant funding from the State Department, and the third and fourth phases focus on the nondepartment-sponsored schools with American students. In phase one, department-sponsored schools were offered funding for basic security hardware such as shatter-resistant window film, two-way radios for communication between the school and the embassy, and public address systems. As of November 19, 2004, 189 department-sponsored schools had received $10.5 million in funding for security equipment in phase one of the program. The second phase provided additional security enhancements, such as perimeter fencing, walls, lighting, gates, and guard booths. As of November 2004, State has obligated over $15 million for phase two security upgrades. For phases three and four, State plans to provide similar types of security upgrades to eligible nondepartment- sponsored schools. The program also funds security enhancements for off-compound embassy employee association facilities, such as recreation centers. Security upgrades include funding for perimeter walls and shatter-resistant window film. In fiscal year 2004, almost $1 million was obligated for these enhancements. Full Scope of School Program Not Yet Determined: Regional Security Officers (RSO) said that identifying and funding for security enhancements at department-sponsored schools were straightforward because of the department's pre-existing relationship with these schools. However, they said it has been difficult to identify eligible nondepartment-sponsored schools for phase three because of the vast number of schools that might qualify, the lack of any pre-existing relationship, and limited guidance on eligibility criteria. For example, some RSOs questioned how many American students should attend a school for it to be eligible for security upgrades. Some RSOs were considering funding schools with just a few American students. Moreover, one RSO was considering providing security upgrades to informal educational facilities, such as those attended by children of U.S. missionaries. State is trying to determine the appropriate scope of the program, and sent cables to posts in the summer of 2004 asking RSOs to gather data on nondepartment-sponsored schools attended by American students, particularly U.S. government dependents. State officials acknowledged that the process of gathering data has been difficult since there are hundreds of such schools worldwide. According to an Overseas Buildings Operations (OBO) official, as of December 2004, only about 81 out of the more than 250 posts have provided responses regarding such schools. OBO plans to use the data to develop criteria for which schools might be eligible for funding under phase three and, eventually, phase four of the program. In anticipation of any future phases of the Soft Targets program, RSOs have been asked to identify other facilities and areas that Americans frequent, beyond schools and off-compound employee association facilities, that may be vulnerable to a terrorist attack. State Department officials were concerned about the large number of sites RSOs could identify as potential soft target sites, and the department's ability to protect them. Issues Related to the Protection of U.S. Officials and Their Families at Residences against Terrorist Threats: State has a responsibility for providing a secure housing environment for U.S. officials and their families overseas. However, we found that State's primary program in place to protect U.S. officials and their families at residences, the Residential Security program, is principally designed to deter crime, not terrorism. The program includes basic security hardware and guard service; and as the crime threat increases, the hardware and guard services can be correspondingly increased at the residences. State officials said that while the Residential Security program, augmented by the local guard program, provides effective deterrence against crime, it could provide limited or no deterrence to minimize the risk and consequences of a residential terrorist attack. State officials told us that the best residential scenario for posts is to have a variety of housing options, including apartments and single-family homes, to reduce the potential for a catastrophic attack. To provide greater protection against terrorist attacks, most posts we visited used surveillance detection teams in the residential areas. The program is intended to enhance the embassies' ability to detect preoperational terrorist surveillance and stop the attack. According to State's guidance, surveillance detection units are primarily designed to protect embassies, and their use in residential areas is discouraged.[Footnote 6] However, we found RSOs at some of the posts we visited were routinely utilizing surveillance detection units to cover areas outside the embassies, such as residences, school bus stops and routes, and schools attended by U.S. embassy dependents. RSOs told us that the Surveillance Detection program is instrumental in providing deterrence against potential terrorist attacks, and argued that the current program guidelines are too restrictive.[Footnote 7] Senior State officials agreed that the use of the surveillance detection in soft target areas could be beneficial, but noted that the program is labor intensive and expensive, and any expansion of the program could require significant funding. Mr. Chairman and Members of the Subcommittee, this concludes my prepared statement. I will be happy to answer any questions you may have. Contact and Staff Acknowledgments: For questions regarding this testimony, please call Diana Glod at (202) 512-8945. Individuals making key contributions to this testimony included Edward George and Andrea Miller. FOOTNOTES [1] GAO, Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies, GAO-05-642 (Washington, D.C.: May 9, 2005). [2] These reviews include (1) the 1985 Report of the Secretary of State's Advisory Panel on Overseas Security (The Inman Report); (2) Accountability Review Board reports that followed assassinations of U.S. officials in 1988, 1989, 1995, 2002, and 2003; and (3) the 1999 Report by the Overseas Presence Advisory Panel (The Crowe Commission). [3] Department-sponsored schools receive direct financial grants from State's Office of Overseas Schools. There are over 185 department- sponsored schools worldwide. [4] For fiscal year 2003, Congress earmarked "up to" $15 million in the Overseas Buildings Operations appropriations to address security vulnerabilities of soft targets. State set aside $5 million to undertake a review of the security of all overseas schools attended by children of nonmilitary U.S. government employees. Of the fiscal year 2005 earmark, $10 million is for security at overseas schools attended by dependents of U.S. government employees. [5] The Overseas Security Policy Board is responsible for developing, coordinating, and promoting uniform policies and standards on security programs and projects that affect U.S. government civilian agencies abroad, including diplomatic missions. [6] Department of State, Surveillance Detection Management and Operations Field Guide Version 2.0, FY 2002 and 12 FAH-7 H-530. [7] The guidelines allow posts to use surveillance detection to observe other areas besides the embassy and key residences, but only if there are specific threats present at these locations.