Background

In response to various attacks, State has continually assessed and updated  its security standards and physical security measures at posts around the  world. After the 1998 embassy bombings in Nairobi, Kenya, and Dar es  Salaam, Tanzania, State initiated the Capital Security Construction  program (also referred to as the New Embassy Compound   program), a multiyear effort to replace approximately 200 facilities with  new facilities that meet State’s updated security standards. As of the end  of fiscal year 2007, State had obligated more than $5.9 billion for this  program, awarded contracts for the construction of 78 new embassy and  consulate compounds, and completed more than 50 new facilities. State  currently plans to contract for 80 more new facilities through 2014.
To complement its efforts to move overseas U.S. government employees  into more secure facilities, State initiated efforts to enhance physical  security at existing facilities. After the 1998 embassy bombings, State  initiated a new physical security upgrades program called the World-Wide  Security Upgrade Program, which focused on enhancing perimeter  security measures. In response to the September 11 terrorist attacks, State  focused on ensuring that embassies and consulates had adequate safe  areas for staff in case of an attack on the facilities. Since 2004, State has  taken a more comprehensive approach to physical security upgrades by  reviewing the entire range of physical security needs at posts through  CSUP. State has identified the following four goals for CSUP:  to provide physical security protection to the extent practical for existing  facilities; to provide physical security upgrades to meet current security standards  for those facilities that will not be replaced by a NEC in the near-term; to initiate physical security upgrades at facilities that are not part of the  chancery compound, including annexes, public diplomacy facilities, and  warehouses; and to provide security upgrades to nongovernmental facilities (“soft targets”)  frequented by U.S. citizens.
From fiscal year 1999 through 2007, State had obligated more than $1.2  billion for security upgrades. Since fiscal year 2004 and the initiation of  CSUP, OBO has undertaken approximately 55 major projects costing over  $1 million that enhance physical security at posts that are not going to be  replaced with a new facility in the near future, if at all. OBO’s Long-Range  Overseas Buildings Plan calls for it to undertake an average of 13 major  CSUP projects per year through 2012. CSUP provides several categories of  security upgrades to help posts meet physical security standards, such as  perimeter security measures (including anti-climb walls, fences,  compound access control facilities, bollards, cameras, and security  lighting); forced entry/ballistic resistant doors and windows; safe areas for  U.S. personnel in case of emergency; and stand-alone mail screening  facilities. In addition, OBO has obligated approximately $58 million per  year of CSUP funds for minor post-managed security upgrade projects,  such as minor residential security upgrades, maintenance, repair, and  replacement of existing forced entry/ballistic resistant doors and windows,  and modular mail screening facilities.
The Overseas Security Policy Board, which includes representatives from  more than 20 U.S. intelligence, foreign affairs, and other agencies, is  responsible for considering, developing, and promoting security policies  and standards that affect U.S. government agencies under the authority of  the Chief of Mission at a post. This responsibility includes reviewing and  issuing uniform guidance on physical security standards for embassies,  consulates, and other overseas office space. State incorporates the board’s  physical security standards in its “Foreign Affairs Handbook” and “Foreign  Affairs Manual.” With respect to existing office buildings, the standards  apply to the maximum extent feasible or practicable.
State has identified five key Overseas Security Policy Board standards to  protect overseas diplomatic office facilities against terrorism and other  dangers (see fig. 1).
First, the Secure Embassy Construction and Counterterrorism Act of 1999  requires that office facilities be at least 100 feet from uncontrolled areas,  such as a street where vehicles can pass without being checked by  security officials. This distance is meant to help protect the buildings and  occupants against threats such as bomb blasts. Second, State requires high  perimeter walls or fences that are difficult to climb, thereby deterring  those who might attack the compound on foot. Third, State requires anti- ram barriers to ensure that vehicles cannot breach the facility perimeter to  get close to the building and detonate a bomb. The fourth standard  requires blast-resistant construction techniques and materials. These  materials include reinforced concrete and steel construction and blast- resistant windows. Coupled with a 100-foot setback, blast-resistant  construction provides the best possible protection against vehicle bomb  attack, according to DS officials. State’s fifth security standard is  controlled access of pedestrians and vehicles at the perimeter of a  compound. Compound access control facilities allow guards to screen  personnel and visitors before they enter the compound to verify that they  have legitimate business at the embassy or consulate and that they bring  nothing onto the compound that could be potentially harmful or used to  surreptitiously gather intelligence. Similarly, the facilities allow guards to  search vehicles before they are permitted to enter the compound.

	CSUP Planning Process Balances Security Needs of Posts and Includes Input from Stakeholders

OBO has a threat- and vulnerability-based planning process for its CSUP  projects that includes input from DS’s analysis of security threats and  vulnerabilities and from post officials. The DS analysis currently focuses  on embassy and consulate compounds, though DS is developing a risk- based prioritization process that considers the number of personnel,  threats, and vulnerabilities at each facility, including off-compound  facilities. OBO has improved its process for developing projects by  conducting more comprehensive needs assessments of posts, including  off-compound facilities, early in the design phase.

		OBO Planning Reflects DS Security Analysis and Input from Post

OBO prioritizes which posts will receive upgrades based in part on  assessments from DS of the physical security conditions and threat levels  at each post. Each year, DS ranks all 262 posts based on their threat levels  and vulnerabilities. With input from posts’ security officers and the  intelligence community, DS determines the threat level for terrorism and  political violence. DS also determines the vulnerabilities of each post in  several categories, including protection from chemical and biological  attack, seismic and blast resistance, the strength of the construction and  façade, and the amount of setback. Once these determinations are made,  DS ranks the posts. The resulting list of rankings is used by OBO and  other stakeholders to plan NEC projects.
For CSUP planning, posts that are scheduled for an NEC project within the  next 2 to 3 years are removed from the list, and DS and OBO reevaluate  the list, factoring in the number of people at post, to create a priority list  for CSUP projects. OBO then modifies the list to balance various factors.  First, OBO removes facilities that cannot be further upgraded, such as  many leased facilities. Second, OBO adds facilities that may have been  removed, such as vulnerable off-compound facilities at posts where NEC  projects are planned. Third, OBO has security engineers conduct a  thorough assessment of each post’s needs. Fourth, OBO alters the list to  account for external factors, such as difficulty getting a host government’s  approval on a project, which would move a project down the list. Finally,  OBO develops its 6-year list of CSUP projects based on expected funds  and places these projects in the Long-Range Overseas Buildings Plan. If  OBO experiences budget constraints, it will delay projects—moving future  projects to subsequent fiscal years—rather than reduce their scope,  according to State officials.
Once a project is placed on the Long-Range Overseas Buildings Plan, an  OBO team undertakes an assessment visit to the post to determine what  the project should include. OBO consults with DS and the post and  reviews Office of Inspector General security inspections in order to  determine the scope of the project. One year prior to a project’s start date,  OBO then develops an initial planning survey in which OBO seeks  agreement between its engineers and the post’s Regional Security Officer.  The initial planning survey is then sent in draft form for approval by OBO  and post officials, including the Regional Security Officer, administrative  officer, and facilities manager. Once this process is completed, OBO works  with its contract design firm to develop conceptual design plans. State’s  contracting offices use these plans to advertise for bids to complete the  design and construct the improvements using a design-build contract.  After a firm has been awarded the contract, it will develop and submit  interim and then final plans for OBO’s review. OBO consults with post  officials, including the Regional Security Officer, in reviewing the designs  to help ensure that proposed upgrades meet each post’s security needs  before giving the firm authorization to proceed with construction.

		DS Priority Assessments Focus on Main Compounds, but Efforts Are Being Made to Address All Post Facilities

According to OBO and DS officials, the DS physical security assessment is  currently based on the physical security needs of each post’s main  compound but does not factor in the security of facilities located outside  the main embassy or consulate compound, even though hundreds of such  facilities exist. We noted that, in several cases, these off-compound  facilities lacked required physical security measures. For example, we  found that one post compound, following the conclusion of its CSUP  project, met most security standards, but a nearby off-compound office  facility did not have setback, blast–resistant walls and windows, a  controlled access facility for pedestrians and vehicles, a safe area, and  other security features.
OBO and DS are currently working to better address the needs of all  facilities, including the hundreds of annexes located off compound, and  improve CSUP project prioritization. OBO officials commented that newer  projects take into account the needs of all facilities at a post, whether they  are on compound or not. For example, at one post we visited, we saw a  CSUP project for an off-compound office facility. Moreover, DS is  developing a new risk-based process to prioritize CSUP projects that will  rate the vulnerabilities of each overseas building with office space,  including annexes, and factor in the number of personnel and threat levels  to better set priorities. According to a DS official, the formula needs to be  validated and, if successful, staff needs to be trained on its use before  beginning implementation. State expects to complete these steps by March  2008.

		OBO Has Taken Steps to Conduct More Comprehensive Needs Assessments during Project Design

OBO is taking additional steps to more comprehensively address post  security needs and improve CSUP planning processes. According to OBO,  CSUP initially focused on perimeter security, but as new standards have  been put in place and perimeter projects completed, the program has  broadened its focus to ensure that posts meet all physical security  standards to the extent feasible. For example, in 2004, terrorists rushed on  foot past the barriers blocking a car being inspected at the vehicular gate  of the consulate in Jeddah, Saudi Arabia. In response, State began to  install additional fencing and a secondary gate, called a man trap, at  vehicle entry points at posts to prevent attackers on foot from accessing  the compounds. Moreover, the Overseas Security Policy Board is currently  considering the addition of a new security standard requiring man traps. In  addition, OBO officials noted that they meet monthly to improve processes  for project planning and execution, including those involving CSUP. One  result of these meetings has been a decision to conduct OBO’s initial  planning surveys earlier in the design process to gain a better  understanding of post’s security needs. Another result of these meetings is  that OBO created a more comprehensive survey instrument to better  identify all vulnerabilities at the post for consideration in the CSUP  project.

	CSUP Projects Generally Completed within Contractual Time Frames and Costs, and OBO Has Project Management Procedures to Help Ensure Completion

While most CSUP projects we reviewed have been completed within their  contractual time frames and costs, OBO found it necessary to modify all  but one of the contracts to extend project time frames, adjust costs, or  both. Since the beginning of fiscal year 2004, OBO has contracted for 47  projects valued at $1 million or more that were subsequently completed by  September 30, 2007. In reviewing schedule performance data, we found  that 96 percent of projects were completed within 30 days of their  contractual completion date (see fig. 2). However, we found that OBO  modified the contracts to extend their completion dates for 81 percent of  the projects. On average, OBO extended the contracts by 4 months—an  average increase of 26 percent. Many of these extensions did not result in  increased costs to the government.
For each of the 47 projects, OBO paid the contractor the amount specified  in the fixed-price contracts—an average project cost of $2.6 million. In  reviewing cost data, we found that OBO increased the contract cost for 34  projects, at an average increase of 17 percent, and decreased the contract  cost for 11 projects, at an average decrease of 5 percent (see fig. 2). The  net change in the cost of the 47 projects was an increase of $10 million.  Cost increases were generally due to changes in the scope of the projects,  while cost decreases were generally due to a reduction in expected local  tax costs. Our past assessments of domestic government renovation  projects found that work on existing facilities presented a number of  difficulties and challenges, making renovations especially susceptible to  cost increases stemming from unexpected conditions. We found that, for  such projects, government agencies generally budget 5 to 15 percent of  project cost for unexpected changes.
OBO cited factors outside the contractor’s control as the cause of most of  the delays and cost increases, such as unusually lengthy local permitting  processes, previously unidentified underground utilities that needed to be  moved, design changes that OBO made during construction work, and  project changes requested by the post. For example, OBO extended the  deadline 10 months for completion of perimeter fencing upgrades and a  new CAC facility at a U.S. consulate in Asia because of delays in receiving  approval from local authorities to proceed with the work. In addition, in  response to a request from officials at a U.S. embassy in Europe, OBO  added to the scope of the planned CSUP project, including a new CAC  facility, and modified the contract to pay the contractor an additional  $874,000 for the added work. However, in cases where OBO found that  contractor error was the cause of a delay or cost increase, OBO held the  contractor accountable. For example, at a U.S. mission in Europe, OBO  found instances where the contractor’s work did not conform to contract  specifications and required the contractor to redo the work. OBO did not  compensate the contractor for the additional costs associated with  replacing the substandard work. Similarly, at a U.S. consulate in Europe,  the contractor was more than 6 months late in completing the security  upgrades; OBO, therefore, assessed the contractor a penalty of almost  $60,000.
OBO has project management procedures to help ensure the security  upgrades it contracted for are completed and have enhanced posts’  compliance with physical security standards. For each CSUP project, OBO  assigns a project manager who is responsible for the effective completion  of the project. However, because CSUP projects are generally small and  OBO has limited resources, project managers are not usually able to be on  site full time during the project. Project managers visit posts to ensure the  work contracted for is being done and, in many cases, rely on post  officials, including the Regional Security Officers and facility managers, to  provide additional monitoring of the work. In our visits to 11 posts, we  found that, in most cases, the work called for in the projects had been  done or was under way. However, at one location, we found that one  component of the project—strengthening the room where the post’s  emergency generator is located—was removed from the scope of the  project because, according to post officials, it would have unexpectedly  required creating new office space to relocate people during the work,  adding costs that could not be covered by the CSUP budget. OBO decided  to remove this work from the scope of the project and initiate a new  project in the future to address this physical security need.

	CSUP Has Enhanced Physical Security, but Site Conditions at Many Posts Limit Ability to Adhere to All Security Standards

Completed CSUP projects have achieved their objective of enhancing the  security at posts by bringing posts in better compliance with security  standards. Major CSUP projects have enhanced physical security at 47  embassies and consulates since fiscal year 2004, and OBO currently  expects to complete all major CSUP projects, barring extensive changes to  current security standards or expected funding, by 2018. CSUP security  enhancements have encompassed constructing compound access control  facilities at the perimeter of the compounds at 25 posts (see fig. 3 for an  example); building safe areas for post officials in case of attack at 25  posts; improving compound walls, fencing, and barriers at 22 posts (see  fig. 4 for examples); and strengthening the interior walls and doors that  create a “hard line” that separates American staff from visitors at 8 posts.
At the 11 posts we visited with ongoing or completed CSUP projects, we  found that the projects had enhanced posts’ compliance with State’s  physical security standards as detailed in the “Foreign Affairs Handbook”  and “Foreign Affairs Manual.” The projects we viewed added or enhanced  pedestrian and vehicle access points, replaced perimeter fencing to meet  anti-climb requirements, installed bollards and barriers at key points to  meet anti-ram requirements, built safe areas for post officials in case of  attack, enhanced the hard line separating post employees from visitors,  and installed forced entry/ballistic-resistant windows and doors.
Nevertheless, without building a new facility, many posts are unable to  meet all security standards for a variety of reasons beyond the scope of  CSUP. We found that none of the posts we visited adhered fully with  current security standards because of conditions that were outside the  scope of CSUP projects. For example, most of the posts we visited were  located in dense urban areas that prevented them from achieving a 100- foot setback from the street, one of the key security standards (see fig. 5  for an example). OBO and DS officials acknowledged that, at many  locations, it is not feasible to increase the setback by acquiring land and  closing off nearby streets. In other cases, officials stated the buildings  themselves were not structurally capable of handling heavy forced  entry/ballistic-resistant windows or other upgrades. And in other cases,  officials commented that host nations or cities would not allow certain  upgrades to be implemented, such as removing trees to create a clear zone  around the embassy or changing the facade of historic buildings. Finally,  current plans for the NEC program do not include the replacement of 61 of  262 embassies and consulates. Several of these facilities were built after  physical security standards were strengthened in response to terrorist  attacks against U.S. facilities in Beirut, Lebanon, in the 1980s. State  officials acknowledged that other facilities may not be replaced due to  cost and political concerns. As a result, many buildings and their  occupants may remain vulnerable to attack.

	Agency Comments and Our Evaluation

The Department of State provided written comments on a draft of this  report, which are reproduced in appendix II. State agreed with our  findings, noting that the report accurately describes State’s CSUP efforts.  State also provided us with technical suggestions and clarifications that  we have addressed in this report, as appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to interested  Members of Congress and the Secretary of State. We also will make copies  available to others upon request. In addition, the report will be available at  no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Charles Michael Johnson, Jr., at (202) 512-7331 or johnsoncm@gao.gov.  Contact points for our Office of Congressional Relations and Public Affairs  may be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.

Appendix I: Scope and Methodology

To discuss the factors that the Bureau of Overseas Buildings Operations  (OBO) considers as it plans and prioritizes Compound Security Upgrades  Program (CSUP) projects, we reviewed Department of State (State)  prioritization and planning documents concerning the assignment of post  threat levels, assessments of the security vulnerabilities of posts, and  CSUP. We discussed CSUP prioritization and planning, as well as changes  to those processes in response to recent attacks, with officials from OBO  and State’s Bureau of Diplomatic Security (DS) in Washington, D.C, and  overseas, including post officials, including Deputy Chiefs of Mission,  Regional Security Officers, facilities managers, and General Services  Officers, and with contractors overseas. In addition, we reviewed past  GAO audit work on related issues. (See Related GAO Products at the end  of this report.) To help confirm the accuracy of our analysis, we discussed  our findings with State personnel involved in CSUP.
To assess the extent to which CSUP projects met cost and schedule  projections, we analyzed data that OBO provided specifically for the  purposes of our review. Our scope included all 47 projects contracted  since fiscal year 2004, completed by the end of fiscal year 2007, and valued  at $1 million or more and, therefore, excluded smaller projects such as  those designed to enhance the security of schools and other non-U.S.  government properties frequented by U.S. personnel and their dependents.  For each CSUP project, OBO provided data on the originally contracted  completion date and cost, the modifications to the contracted completion  date and cost, and the actual date of substantial completion and final  contract cost for completed projects. We reviewed contracting documents  to verify that the data were sufficiently reliable for the purposes of this  report. To assess the extent to which CSUP projects included the security  upgrades called for in the contract, we reviewed OBO’s project  management procedures. We interviewed project managers in Washington,  D.C., and facilities managers, administrative officers, and regional security  officers at 11 posts to verify the role and responsibilities of the project  managers. We also inspected the ongoing or completed CSUP work at  these posts to verify that the projects encompassed all of the security  upgrades called for under the contract.
To review the extent to which State’s CSUP efforts have enhanced posts’  ability to comply with State’s physical security standards, we reviewed the  project authorization memoranda, contract modifications, and OBO  summary document on each of the 47 CSUP projects. These documents  allowed us to identify the type of physical security upgrades that were  installed at all 47 facilities. We discussed over 50 completed, ongoing, and  planned projects with OBO officials. To confirm our initial findings, we  traveled to 11 posts in Latin America, Europe, and the Middle East that  had recently completed or ongoing CSUP projects. We selected these  countries to ensure regional coverage, a range of project types, and a mix  of ongoing and completed projects; however, as this was not a  generalizeable sample, our findings do not necessarily apply to all posts.  We are not naming the specific countries we visited for this review due to  security concerns. We developed a physical security needs checklist based  upon State’s “Foreign Affairs Handbook,” “Foreign Affairs Manual,” and  OBO’s own needs assessment documentation. We applied our checklist  consistently at all 11 posts. Our checklist did not, however, attempt to  assess State’s procedures for utilizing physical security upgrades. For  example, the checklist did not assess whether posts use new CACs  properly to screen vehicles or people. At each post, we conducted a  review of the security needs and received briefings on the recently  completed, ongoing, or planned CSUP projects. We met with relevant post  personnel, including Deputy Chiefs of Mission, Regional Security Officers,  facilities managers, and General Services Officers, as well as contractors  to discuss the physical security needs at post, CSUP project management  and implementation, and post-specific limitations to receiving certain  physical security upgrades.
We conducted this performance audit from November 2006 through  January 2008, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings based on our audit  objectives.

Appendix II: Comments from the Department of State

Appendix III: GAO Contact and Staff Acknowledgments

	GAO Contact

	Staff Acknowledgments

In addition the individual named above, David C. Maurer, Assistant  Director; Michael J. Courts, Assistant Director; Valérie L. Nowak; Thomas  M. Costa; Martin H. de Alteriis; Michael W. Armes; Leslie K. Locke; Ramon  J. Rodriguez; Joseph P. Carney; Ian A. Ferguson; Etana Finkler; and Jason  L. Bair made key contributions to this report.

Related GAO Products

Embassy Construction: State Has Made Progress Constructing New  Embassies, but Better Planning Is Needed for Operations and  Maintenance Requirements. GAO-06-641. Washington, D.C.: June 30, 2006.
Overseas Security: State Department Has Not Fully Implemented Key  Measures to Protect U.S. Officials from Terrorist Attacks Outside of  Embassies. GAO-05-688T. Washington, D.C.: May 10, 2005.
Overseas Security: State Department Has Not Fully Implemented Key  Measures to Protect U.S. Officials from Terrorist Attacks Outside of  Embassies. GAO-05-642. Washington, D.C.: May 9, 2005.
Embassy Construction: Achieving Concurrent Construction Would Help  Reduce Costs and Meet Security Goals. GAO-04-952. Washington, D.C.:  September 28, 2004.
Embassy Construction: State Department Has Implemented  Management Reforms, but Challenges Remain. GAO-04-100. Washington,  D.C.: November 4, 2003.
Overseas Presence: Conditions of Overseas Diplomatic Facilities. GAO- 03-557T. Washington, D.C.: March 20, 2003.
Embassy Construction: Better Long-Term Planning Will Enhance  Program Decision-making. GAO-01-11. Washington, D.C.: January 22,  2001.
State Department: Overseas Emergency Security Program Progressing,  but Costs Are Increasing. GAO/NSIAD-00-83. Washington, D.C.: March 8,  2000.

Summary:
Why GAO Did This Study

Following the 1998 embassy bombings, the Department of State (State) determined that more than 85 percent of diplomatic facilities did not meet security standards and were vulnerable to terrorist attacks. State's Bureau of Overseas Buildings Operations (OBO) has undertaken a program to replace or upgrade the security of these facilities. As of 2007, OBO had constructed more than 50 new embassies and moved nearly 15,000 staff to safer facilities. However, most remaining facilities will not be replaced in the near term. To address these facilities, OBO has obligated about $140 million per year for its Compound Security Upgrade Program (CSUP). GAO was asked to (1) describe the process that OBO follows to prioritize and plan CSUP projects, including stakeholder involvement; (2) determine the extent to which CSUP projects met contracted cost and time frames and whether OBO has procedures to ensure security upgrades are installed; and (3) assess whether State's CSUP efforts have enhanced posts' abilities to comply with State's physical security standards. To address these objectives, GAO reviewed pertinent State documents, met with State officials in Washington, D.C., and overseas, and traveled to 11 posts in Latin America, Europe, and the Middle East. State provided written comments on a draft of this report and agreed with our findings.

What GAO Found

OBO has a threat- and vulnerability-based process for prioritizing which posts receive CSUP projects and a planning process that utilizes input from State's Bureau of Diplomatic Security (DS) and post officials. DS assessments are currently based on physical security of each post's main compound, although many posts have facilities located outside the compound. DS is developing a prioritization process that will factor in the number of personnel, threat levels, and vulnerabilities at each facility, including those off compound. OBO has improved its planning processes by conducting a comprehensive survey of posts' physical security needs, including off-compound facilities. GAO found that 96 percent of 47 projects undertaken since fiscal year 2004 were completed within 30 days of their contractual completion date. However, OBO modified 81 percent of the contracts to extend their completion dates. GAO also found that while OBO paid the contractors the amount specified in the contracts, contract modifications resulted in cost adjustments to all but two contracts, which GAO found in prior work is not uncommon in government renovation projects. OBO cited factors outside the contractors' control as the cause of most delays and cost increases, such as lengthy local permitting issues. To help ensure security upgrades contracted for are completed, OBO assigns a project manager who is responsible for the project's completion and relies on regional and post officials to provide additional monitoring. CSUP projects have enhanced posts' compliance with physical security standards by constructing compound access control facilities, safe areas for post personnel, and compound walls and barriers. However, at the 11 posts GAO visited, site conditions prevented them from adhering fully with standards. For example, more than one post's urban location prevented it from achieving a 100-foot setback from the street, a key security standard. As a result, many buildings and their occupants may remain vulnerable to attack.