Capitol Attack: The Capitol Police Need Clearer Emergency Procedures and a Comprehensive Security Risk Assessment Process
As part of our comprehensive look at the events of January 6th, this report examines the U.S. Capitol physical security operations. We found that:
- The Capitol Police and its oversight board didn't have clear, detailed procedures on how to get emergency support from other agencies on January 6th—e.g., when is congressional leadership approval needed?
- The Capitol Police didn't have a comprehensive, documented process for assessing and mitigating physical security risks to the Capitol complex.
The Capitol Police and its board are working on procedures for emergency support, and we recommended finalizing them, addressing security risks, and more.
Crowds gather at the U.S. Capitol during the January 6, 2021 attack.
What GAO Found
The U.S. Capitol Police's (Capitol Police) planning for January 6, 2021, did not reflect the potential for extreme violence aimed at the Capitol and did not include contingencies for support from other agencies. For example, although the Capitol Police had information protesters could be armed and were planning to target Congress, the Capitol Police's plans focused on a manageable, largely non-violent protest at the Capitol. The Capitol Police's Office of Inspector General previously recommended that the Capitol Police improve its operational planning.
Images of the Capitol Attack on January 6, 2021
On January 6, the Capitol Police and the Capitol Police Board, which oversees the Capitol Police, used various different authorities to obtain assistance from about 2,000 personnel from outside agencies. However, the Capitol Police and the Board lacked clear, detailed procedures to guide their decisions about which authority to use or the steps to follow in obtaining assistance. For example, neither the Capitol Police nor the Board had procedures in place describing whether or when approval from congressional leadership was needed for the use of outside assistance during an emergency. The Capitol Police and the Board are currently developing documented procedures, but they are not yet final. Without such procedures, the Capitol Police and the Board may be hampered in their ability to request aid quickly and effectively in future emergencies.
The Capitol Police's process for assessing and mitigating physical security risks to the Capitol complex is not comprehensive or documented. Also, how the Capitol Police Board considers and decides which physical security recommendations made by the Capitol Police should be implemented is unclear. Federal guidance is available to help agencies develop comprehensive processes for assessing physical security risks to facilities. Capitol Police officials stated that they have been informally applying this guidance for the past 5 to 7 years. While the Capitol Police's process incorporates parts of the guidance, its process is not as comprehensive or well documented as the guidance outlines. For example, the Capitol Police conducts regular security assessments of the Capitol complex and buildings, but it does so without a documented procedure to ensure completeness and consistency. In addition, while the Capitol Police makes security recommendations, it does not have the authority to implement them. The Capitol Police Board does not have a process for formally considering or making decisions on the recommendations. Without a comprehensive, documented process to assess and mitigate risks, there is no assurance that the Capitol Police and the Board are not overlooking potential security risks.
Why GAO Did This Study
On January 6, 2021, thousands of demonstrators surrounded the U.S. Capitol Building. Demonstrators attacked and injured law enforcement officers and eventually breached the building. The Capitol Police is responsible for protecting the Congress, its Members, staff, visitors, and facilities. The Capitol Police Board oversees the Capitol Police.
GAO was asked to review the Capitol Police's physical security efforts for January 6. This report addresses the Capitol Police and the Board's: (1) physical security planning for January 6; (2) response to that day's events, including the procedures for obtaining outside assistance; and (3) process for assessing and mitigating physical security risks.
GAO reviewed Capitol Police plans, procedures, hearing statements, timelines, and other documents related to the planning and response on January 6 and how the Capitol Police assesses security risks. GAO also interviewed officials from the Capitol Police Board, the Capitol Police, the Architect of the Capitol, and other federal, state, and local agencies.
Recommendations
GAO is making four recommendations to the Capitol Police Board and the Capitol Police, including finalizing and documenting procedures for obtaining outside assistance in an emergency, addressing security risks, and considering security recommendations. The Capitol Police Board did not take a position on GAO's recommendations. The Capitol Police agreed with GAO's recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Capitol Police Board | The Capitol Police Board should finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. (Recommendation 1) |
As of September 2022, the Capitol Police Board has not taken a position on GAO's recommendation or provided information on any actions it has taken related to implementing this recommendation. We will continue to monitor the Capitol Police Board's efforts to address this recommendation.
|
| Capitol Police Board | The Capitol Police Board should finalize and document its procedures for considering recommended countermeasures from the Capitol Police's security surveys, including documenting the rationale for accepting risk when recommendations are not implemented. (Recommendation 2) |
As of September 2022, the Capitol Police Board has not taken a position on GAO's recommendation or provided information on any actions it has taken related to implementing this recommendation. We will continue to monitor the Capitol Police Board's efforts to address this recommendation.
|
| U.S. Capitol Police | The Chief of the Capitol Police should finalize and document its procedures for obtaining outside assistance in an emergency that, for example, clearly detail roles and responsibilities. (Recommendation 3) |
As of August 2022, the Chief of the Capitol Police informed GAO that the Command and Coordination Bureau is in the process of developing an All-hazards/Emergency Operations Plan. This plan is intended to incorporate an Emergency Action Plan that will define the roles for responding agencies. Once finalized, GAO will review the plan to determine if it is responsive to GAO's recommendation.
|
| U.S. Capitol Police | The Chief of the Capitol Police should finalize the development of a comprehensive, documented risk management process that includes elements called for by the ISC standard, such as clearly assessing the risk of each applicable undesirable event and considering a comprehensive list of countermeasures. (Recommendation 4) |
As of August 2022, Chief of the Capitol Police informed GAO that the department had begun formalizing its Risk Management Process using the ISC standards. Part of these actions include having Interagency Security Committee (ISC) staff provide Risk Management Process training and creating a new Security Coordination Division. The Capitol Police plan to request fiscal year 2024 funding to procure a new Facility Security Assessment tool which will incorporate standards and best practices from the ISC and the Department of Defense. Once the new assessment tool has been implemented, GAO will assess it to determine if it is responsive to GAO's recommendation.
|