Capitol Attack: The Capitol Police Need Clearer Emergency Procedures and a Comprehensive Security Risk Assessment Process
Fast Facts
As part of our comprehensive look at the events of January 6th, this report examines the U.S. Capitol physical security operations. We found that:
- The Capitol Police and its oversight board didn't have clear, detailed procedures on how to get emergency support from other agencies on January 6th—e.g., when is congressional leadership approval needed?
- The Capitol Police didn't have a comprehensive, documented process for assessing and mitigating physical security risks to the Capitol complex.
The Capitol Police and its board are working on procedures for emergency support, and we recommended finalizing them, addressing security risks, and more.
Crowds gather at the U.S. Capitol during the January 6, 2021 attack.
Highlights
What GAO Found
The U.S. Capitol Police's (Capitol Police) planning for January 6, 2021, did not reflect the potential for extreme violence aimed at the Capitol and did not include contingencies for support from other agencies. For example, although the Capitol Police had information protesters could be armed and were planning to target Congress, the Capitol Police's plans focused on a manageable, largely non-violent protest at the Capitol. The Capitol Police's Office of Inspector General previously recommended that the Capitol Police improve its operational planning.
Images of the Capitol Attack on January 6, 2021
On January 6, the Capitol Police and the Capitol Police Board, which oversees the Capitol Police, used various different authorities to obtain assistance from about 2,000 personnel from outside agencies. However, the Capitol Police and the Board lacked clear, detailed procedures to guide their decisions about which authority to use or the steps to follow in obtaining assistance. For example, neither the Capitol Police nor the Board had procedures in place describing whether or when approval from congressional leadership was needed for the use of outside assistance during an emergency. The Capitol Police and the Board are currently developing documented procedures, but they are not yet final. Without such procedures, the Capitol Police and the Board may be hampered in their ability to request aid quickly and effectively in future emergencies.
The Capitol Police's process for assessing and mitigating physical security risks to the Capitol complex is not comprehensive or documented. Also, how the Capitol Police Board considers and decides which physical security recommendations made by the Capitol Police should be implemented is unclear. Federal guidance is available to help agencies develop comprehensive processes for assessing physical security risks to facilities. Capitol Police officials stated that they have been informally applying this guidance for the past 5 to 7 years. While the Capitol Police's process incorporates parts of the guidance, its process is not as comprehensive or well documented as the guidance outlines. For example, the Capitol Police conducts regular security assessments of the Capitol complex and buildings, but it does so without a documented procedure to ensure completeness and consistency. In addition, while the Capitol Police makes security recommendations, it does not have the authority to implement them. The Capitol Police Board does not have a process for formally considering or making decisions on the recommendations. Without a comprehensive, documented process to assess and mitigate risks, there is no assurance that the Capitol Police and the Board are not overlooking potential security risks.
Why GAO Did This Study
On January 6, 2021, thousands of demonstrators surrounded the U.S. Capitol Building. Demonstrators attacked and injured law enforcement officers and eventually breached the building. The Capitol Police is responsible for protecting the Congress, its Members, staff, visitors, and facilities. The Capitol Police Board oversees the Capitol Police.
GAO was asked to review the Capitol Police's physical security efforts for January 6. This report addresses the Capitol Police and the Board's: (1) physical security planning for January 6; (2) response to that day's events, including the procedures for obtaining outside assistance; and (3) process for assessing and mitigating physical security risks.
GAO reviewed Capitol Police plans, procedures, hearing statements, timelines, and other documents related to the planning and response on January 6 and how the Capitol Police assesses security risks. GAO also interviewed officials from the Capitol Police Board, the Capitol Police, the Architect of the Capitol, and other federal, state, and local agencies.
Recommendations
GAO is making four recommendations to the Capitol Police Board and the Capitol Police, including finalizing and documenting procedures for obtaining outside assistance in an emergency, addressing security risks, and considering security recommendations. The Capitol Police Board did not take a position on GAO's recommendations. The Capitol Police agreed with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Capitol Police Board | The Capitol Police Board should finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. (Recommendation 1) |
On January 6, 2021, thousands of demonstrators surrounded the U.S. Capitol Building. Demonstrators attacked and injured law enforcement officers and eventually broke into the building, leading to the lockdown of the Capitol complex and evacuation of lawmakers and staff. In 2022, GAO reported that the Capitol Police Board (the Board) faced challenges in quickly and effectively obtaining outside assistance from other agencies. At the time of the attack, the Capitol Police had different authorities available to the agency to request outside assistance, and some of these authorities required Board involvement before the Capitol Police could request outside assistance. While the Board's Manual of Procedures (Manual) included general information about some of the authorities available for obtaining outside assistance during emergencies, the Board did not have documented procedures for its emergency determination process, including how and when it should be determined, the authorities to use, and whether or when approval from congressional leadership must be obtained for the use of outside assistance during an emergency. The Board issued an updated version of its Manual in December 2021 that included additional information about the roles and responsibilities of the Board and others in regard to obtaining outside assistance during emergencies. However, GAO found the updated Manual did not identify clearly detailed procedures for obtaining outside assistance in an emergency. Standards for Internal Control in the Federal Government state that agency management should design control activities (i.e., policies, procedures, techniques, and mechanisms) that enforce management's directives to achieve the entity's objectives and address related risks. Without clear, documented procedures for all steps involved in obtaining outside assistance--such as clearly defining the types of circumstances under which the different authorities should be considered, or the various procedures that the Board must follow in order to obtain outside assistance--the Board may be hampered in its ability to obtain aid quickly and effectively in the event of a future emergency. Thus, GAO recommended that the Capitol Police Board finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. Following the attack, the authorities were amended so that the Capitol Police could request outside assistance without waiting for Board approval. In December 2023, the Board provided GAO a copy of its updated Manual. The Manual includes procedures related to who is responsible for issuing emergency orders related to requesting outside assistance, the relevant authorities, which entities the Board should coordinate with during an emergency, and the situations in which the Board may declare an emergency. For example, the Manual states that in situations in which the Board declares an emergency that requires outside assistance, it should coordinate with the Capitol Police to notify the appropriate outside agencies. Finally, the Manual notes that the Board may declare a period of emergency when, in their judgment, an emergency situation exists involving the safety of human life or the protection of property requiring the prolonged presence of Capitol Police, the Architect of the Capitol, or other emergency response personnel. By taking these steps, the Board improved its ability to quickly and efficiently obtain outside assistance in an emergency.
|
| Capitol Police Board | The Capitol Police Board should finalize and document its procedures for considering recommended countermeasures from the Capitol Police's security surveys, including documenting the rationale for accepting risk when recommendations are not implemented. (Recommendation 2) |
On January 6, 2021, thousands of demonstrators surrounded the U.S. Capitol Building. Demonstrators attacked and injured law enforcement officers and eventually broke into the building, leading to the lockdown of the Capitol complex and evacuation of lawmakers and staff. The U.S. Capitol Police (Capitol Police) is responsible for protecting the Congress, including Members, staff, visitors, and facilities. The Capitol Police Board (the Board) is responsible for overseeing the Capitol Police in the policing, protection, and security of Congress and the Capitol complex. In 2022, GAO identified concerns with the processes for assessing and mitigating physical security risks to the Capitol complex. The Capitol Police conducts regular physical security assessments of the Capitol complex. The results of these assessments are reported in security surveys that identify vulnerabilities and recommended countermeasures to mitigate those vulnerabilities. Capitol Police officials told GAO that they do not have the authority to install physical security countermeasures on their own; in general, officials said the Capitol Police must seek approval from the Board. However, the Board did not have a formal process for reviewing or making decisions about whether to accept or reject the Capitol Police's security recommendations. Therefore, there was no documentation for decisions, including the consideration and rationale for accepting or rejecting recommendations. In 2021, Board officials told GAO that they were revising the process of how the Board considers recommended countermeasures in security surveys. Interagency Security Committee standards--which are intended to enhance the quality and effectiveness of security in and protection of federal facilities--note that after countermeasures are identified, the next step is to decide which countermeasures to implement. For those countermeasures not implemented, agencies are to consider alternative measures or accept unmitigated risk--a regular part of risk management--and document their decisions, including the rationale for accepting risk. GAO found that until explicit procedures were in place for making and documenting decisions regarding recommended countermeasures, including the rationale for rejecting recommended countermeasures, there was no acknowledgment or accountability of the risks being accepted, potentially leaving the Capitol Building less secure. Thus, GAO recommended that the Board finalize and document its procedures for considering recommended countermeasures from the Capitol Police's security surveys, including documenting the rationale for accepting risk when recommendations are not implemented. In December 2023, GAO confirmed that the Board implemented this recommendation. Specifically, the Board updated its Manual of Procedures to note that monthly Board meeting sessions shall include a security briefing from the Capitol Police, and that the Board shall discuss and document decisions related to the Capitol Police's physical security recommendations. The Manual notes that the Board meeting minutes shall reflect decisions made related to recommendations, including when the Board chooses not to implement countermeasures. In addition, when the Board decides not to implement specific countermeasures recommended in Capitol Police security surveys, the manual states that by the next Board meeting, the Board will develop a Memorandum for the Record to document the decision, including the rationale for accepting the risk. By taking these steps, the Board has improved its oversight of the Capitol Police's protection of Congress and the Capitol Building.
|
| U.S. Capitol Police | The Chief of the Capitol Police should finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. (Recommendation 3) |
On January 6, 2021, thousands of demonstrators surrounded the U.S. Capitol Building. Demonstrators also attacked and injured law enforcement officers and eventually broke into the building, leading to the lockdown of the Capitol complex and evacuation of lawmakers and staff. In 2022, GAO reported that the U.S. Capitol Police (Capitol Police) faced challenges in quickly and efficiently obtaining outside assistance from other agencies. GAO also found that the Capitol Police lacked clear procedures for obtaining outside assistance. Specifically, the Capitol Police did not have standard operating procedures for making requests for outside assistance; for ensuring outside officers responding to assist the Capitol Police were sworn in; or for its emergency determination process. In November 2021, the Capitol Police developed a Critical Incident Response Plan that outlined procedures for requesting and receiving outside assistance. However, the procedures were not finalized and did not fully address the approval process for obtaining outside assistance. For example, the plan stated that the decision to activate the plan would be done in consultation with the Capitol Police Board but did not include details on the process for that consultation. Standards for Internal Control in the Federal Government state that agency management should design control activities (i.e., policies, procedures, techniques, and mechanisms) that enforce management's directives to achieve the entity's objectives and address related risks. Without clear, documented procedures for all steps involved in obtaining outside assistance-such as clearly defining the types of circumstances under which the different authorities should be considered, or the various procedures that the Capitol Police must follow in order to obtain outside assistance-the Capitol Police may be hampered in its ability to obtain aid quickly and effectively in the event of a future emergency. Thus, GAO recommended that the Capitol Police finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. In November 2023, GAO confirmed that the Capitol Police finalized its procedures for obtaining outside assistance in an emergency. Specifically, the Capitol Police finalized multiple directives that outline its procedures, authorities, and the roles and responsibilities for: requesting outside assistance from partner agencies; swearing in outside officers; and activating its emergency operations plan. For example, these directives clarify that the Chief of the Capitol Police can declare an emergency and request outside assistance from other agencies. In addition, the directives outline the procedures for requesting outside assistance and swearing in outside officers. By taking these steps, the Capitol Police improved its ability to quickly and efficiently obtain outside assistance in an emergency.
|
| U.S. Capitol Police | The Chief of the Capitol Police should finalize the development of a comprehensive, documented risk management process that includes elements called for by the ISC standard, such as clearly assessing the risk of each applicable undesirable event and considering a comprehensive list of countermeasures. (Recommendation 4) |
In December 2024, GAO confirmed that the Capitol Police finalized its procedures for a comprehensive, documented risk management process that includes elements called for by the ISC Standard. In May 2024, the Capitol Police issued a directive for facility security assessments. The directive states that the process described in the ISC Standard is the preferred methodology for conducting a facility security assessment. In addition, in November 2024, the Capitol Police issued a standard operating procedure to establish uniform processes for Capitol Police staff assigned to conduct facility security assessments which, among other things, are to be performed consistent with the ISC Standard. By taking these steps, the Capitol Police can better ensure that it is properly and comprehensively assessing risks to the Capitol Building and identifying appropriate countermeasures to mitigate those risks.
|