DHS Continues to Implement and Strengthen Its Mission Functions, but Key Operational and Management Challenges Remain

Since DHS began operations in March 2003, it has developed and  implemented key policies, programs, and activities for implementing its  homeland security missions and functions that have created and  strengthened a foundation for achieving its potential as it continues to  mature. However, the department’s efforts have been hindered by  challenges faced in leading and coordinating the homeland security  enterprise; implementing and integrating its management functions for  results; and strategically managing risk and assessing, and adjusting as  necessary, its homeland security efforts. DHS has made progress in  these three areas, but needs to take additional action, moving forward, to  help it achieve its full potential.

		DHS Has Made Progress in Implementing its Mission Functions, but Program Weaknesses and Management Issues Have Hindered Implementation Efforts

DHS has made important progress in implementing and strengthening its  mission functions over the past 8 years, including implementing key  homeland security operations and achieving important goals and  milestones in many areas. The department’s accomplishments include  developing strategic and operational plans across its range of missions;  hiring, deploying and training workforces; establishing new, or expanding  existing, offices and programs; and developing and issuing policies,  procedures, and regulations to govern its homeland security operations.  For example:     DHS issued the QHSR, which provides a strategic framework for  homeland security, and the National Response Framework, which  outlines guiding principles for disaster response.     DHS successfully hired, trained, and deployed workforces, such  as a federal screening workforce which assumed security  screening responsibilities at airports nationwide, and the  department has about 20,000 agents to patrol U.S. land borders.     DHS created new programs and offices, or expanded existing  ones, to implement key homeland security responsibilities, such  as establishing the United States Computer Emergency  Readiness Team to, among other things, coordinate the nation’s  efforts to prepare for, prevent, and respond to cyber threats to  systems and communications networks. DHS also expanded  programs for identifying and removing aliens subject to removal  from the United States and for preventing unauthorized aliens  from entering the country.     DHS issued policies and procedures addressing, among other  things, the screening of passengers at airport checkpoints,  inspecting travelers seeking entry into the United States, and  assessing immigration benefit applications and processes for  detecting possible fraud.
Establishing these elements and others are important accomplishments  and have been critical for the department to position and equip itself for  fulfilling its homeland security missions and functions.
However, more work remains for DHS to address gaps and weaknesses  in its current operational and implementation efforts, and to strengthen  the efficiency and effectiveness of those efforts to achieve its full  potential. For example, we have reported that many DHS programs and  investments have experienced cost overruns, schedule delays, and  performance problems, including, for instance, DHS’s recently cancelled  technology program for securing U.S. borders, known as the Secure  Border Initiative Network, and some technologies for screening  passengers at airport checkpoints. Further, with respect to the cargo  advanced automated radiography system to detect certain nuclear  materials in vehicles and containers at ports DHS pursued the acquisition  and deployment of the system without fully understanding that it would  not fit within existing inspection lanes at ports of entry. DHS subsequently  canceled the program. DHS also has not yet fully implemented its roles  and responsibilities for developing and implementing key homeland  security programs and initiatives. For example, DHS has not yet  developed a set of target capabilities for disaster preparedness or  established metrics for assessing those capabilities to provide a  framework for evaluating preparedness, as required by the Post-Katrina  Emergency Management Reform Act. Our work has shown that DHS  should take additional action to improve the efficiency and effectiveness  of a number of its programs and activities by, for example, improving  program management and oversight, and better assessing homeland  security requirements, needs, costs, and benefits, such as those for key  acquisition and technology programs. Table 1 provides examples of key  progress and work remaining in DHS’s functional mission areas, with an  emphasis on work we completed since 2008.
Impacting the department’s ability to efficiently and effectively satisfy its  missions are: (1) the need to integrate and strengthen its management  functions; (2) the need for increased utilization of performance  assessments; (3) the need for an enhanced use of risk information to  inform planning, programming, and investment decision-making; (4)  limitations in effective sharing and use of terrorism-related information; (5)  partnerships that are not sustained or fully leveraged; and (6) limitations  in developing and deploying technologies to meet mission needs. DHS  made progress in addressing these areas, but more work is needed,  going forward, to further mitigate these challenges and their impact on  DHS’s mission implementation.
For instance, DHS strengthened its performance measures in recent  years and linked its measures to the QHSR’s missions and goals.  However, DHS and its components have not yet developed measures for  assessing the effectiveness of key homeland security programs, such as  programs for securing the border and preparing the nation for emergency  incidents. For example, with regard to checkpoints DHS operates on U.S.  roads to screen vehicles for unauthorized aliens and contraband, DHS  established three performance measures to report the results of  checkpoint operations. However, the measures did not indicate if  checkpoints were operating efficiently and effectively and data reporting  and collection challenges hindered the use of results to inform Congress  and the public on checkpoint performance.  Moreover, DHS has not yet  established performance measures to assess the effectiveness of its  programs for investigating alien smuggling operations and foreign  nationals who overstay their authorized periods of admission to the  United States, making it difficult for these agencies to determine progress  made in these areas and evaluate possible improvements.
Further, DHS and its component agencies developed strategies and tools  for conducting risk assessments. For example, DHS has conducted risk  assessments of various surface transportation modes, such as freight rail,  passenger rail, and pipelines. However, the department needs to  strengthen its use of risk information to inform its planning and investment  decision-making. For example, DHS could better use risk information to  plan and prioritize security measures and investments within and across  its mission areas, as the department cannot secure the nation against  every conceivable threat.
In addition, DHS took action to develop and deploy new technologies to  help meet its homeland security missions. However, in a number of  instances DHS pursued acquisitions without ensuring that the  technologies met defined requirements, conducting and documenting  appropriate testing and evaluation, and performing cost-benefit analyses,  resulting in important technology programs not meeting performance  expectations. For example, in 2006, we recommended that DHS’s  decision to deploy next-generation radiation-detection equipment, or  advanced spectroscopic portals, used to detect smuggled nuclear or  radiological materials, be based on an analysis of both the benefits and  costs and a determination of whether any additional detection capability  provided by the portals was worth their additional cost. DHS subsequently  issued a cost-benefit analysis, but we reported that this analysis did not  provide a sound analytical basis for DHS’s decision to deploy the portals.  In June 2009, we also reported that an updated cost-benefit analysis  might show that DHS’s plan to replace existing equipment with advanced  spectroscopic portals was not justified, particularly given the marginal  improvement in detection of certain nuclear materials required of  advanced spectroscopic portals and the potential to improve the current- generation portal monitors’ sensitivity to nuclear materials, most likely at a  lower cost.  In July 2011, DHS announced that it would end the advanced  spectroscopic portal project as originally conceived given the challenges  the program faced.
As we have previously reported, while it is important that DHS continue to  work to strengthen each of its functional areas, it is equally important that  these areas be addressed from a comprehensive, departmentwide  perspective to help mitigate longstanding issues that have impacted the  department’s progress.

		Key Themes Have Impacted DHS’s Progress in Implementing Its Mission Functions

Our work at DHS has identified several key themes—leading and  coordinating the homeland security enterprise, implementing and  integrating management functions for results, and strategically managing  risks and assessing homeland security efforts—that have impacted the  department’s progress since it began operations. These themes provide  insights that can inform DHS’s efforts, moving forward, as it works to  implement its missions within a dynamic and evolving homeland security  environment. DHS made progress and has had successes in all of these  areas, but our work found that these themes have been at the foundation  of DHS’s implementation challenges, and need to be addressed from a  departmentwide perspective to position DHS for the future and enable it  to satisfy the expectations set for it by the Congress, the administration,  and the country.
Leading and coordinating the homeland security enterprise. While  DHS is one of a number of entities with a role in securing the homeland, it  has significant leadership and coordination responsibilities for managing  efforts across the homeland security enterprise. To satisfy these  responsibilities, it is critically important that DHS develop, maintain and  leverage effective partnerships with its stakeholders, while at the same  time addressing DHS-specific responsibilities in satisfying its missions.  Before DHS began operations, we reported that the quality and continuity  of the new department’s leadership would be critical to building and  sustaining the long-term effectiveness of DHS and achieving homeland  security goals and objectives. We further reported that to secure the  nation, DHS must form effective and sustained partnerships between  components and also with a range of other entities, including federal  agencies, state and local governments, the private and nonprofit sectors,  and international partners.
DHS has made important strides in providing leadership and coordinating  efforts. For example, it has improved coordination and clarified roles with  state and local governments for emergency management. DHS also  strengthened its partnerships and collaboration with foreign governments  to coordinate and standardize security practices for aviation security.  However, DHS needs to take additional action to forge effective  partnerships and strengthen the sharing and utilization of information,  which has affected its ability to effectively satisfy its missions. For  example, we reported that the expectations of private sector stakeholders  have not been met by DHS and its federal partners in areas related to  sharing information about cyber-based threats to critical infrastructure.  Without improvements in meeting private and public sector expectations  for sharing cyber threat information, private-public partnerships will  remain less than optimal, and there is a risk that owners of critical  infrastructure will not have the information and mechanisms needed to  thwart sophisticated cyber attacks that could have catastrophic effects on  our nation’s cyber-reliant critical infrastructure.  Moreover, we reported  that DHS needs to continue to streamline its mechanisms for sharing  information with public transit agencies to reduce the volume of similar  information these agencies receive from DHS, making it easier for them  to discern relevant information and take appropriate actions to enhance  security.
In 2005, we designated information sharing for homeland security as high  risk because the federal government faced serious challenges in  analyzing information and sharing it among partners in a timely, accurate,  and useful way. Gaps in sharing, such as agencies’ failure to link  information about the individual who attempted to conduct the December  25, 2009, airline bombing, prevented the individual from being included  on the federal government’s consolidated terrorist watchlist, a tool used  by DHS to screen for persons who pose a security risk. The federal  government and DHS have made progress, but more work remains for  DHS to streamline its information sharing mechanisms and better meet  partners’ needs. Moving forward, it will be important that DHS continue to  enhance its focus and efforts to strengthen and leverage the broader  homeland security enterprise, and build off the important progress that it  has made thus far. In addressing ever-changing and complex threats, and  with the vast array of partners with which DHS must coordinate,  continued leadership and stewardship will be critical in achieving this end.
Implementing and integrating management functions for results.  Following its establishment, the department focused its efforts primarily  on implementing its various missions to meet pressing homeland security  needs and threats, and less on creating and integrating a fully and  effectively functioning department from 22 disparate agencies. This initial  focus on mission implementation was understandable given the critical  homeland security needs facing the nation after the department’s  establishment, and the enormous challenge posed by creating,  integrating, and transforming a department as large and complex as DHS.  As the department matured, it has put into place management policies  and processes and made a range of other enhancements to its  management functions—acquisition, information technology, financial,  and human capital management. However, DHS has not always  effectively executed or integrated these functions. In 2003, we designated  the transformation and integration of DHS as high risk because DHS had  to transform 22 agencies into one department, and failure to effectively  address DHS’s management and mission risks could have serious  consequences for U.S. national and economic security. Eight years later,  DHS remains on our high-risk list. DHS has demonstrated strong  leadership commitment to addressing its management challenges and  has begun to implement a strategy to do so. Further, DHS developed  various management policies, directives, and governance structures,  such as acquisition and information technology management policies and  controls, to provide enhanced guidance on investment decision making.  DHS also reduced its financial management material weaknesses in  internal control over financial reporting and developed strategies to  strengthen human capital management, such as its Workforce Strategy  for Fiscal Years 2011-2016.
However, DHS needs to continue to demonstrate sustainable progress in  addressing its challenges, as these issues have contributed to schedule  delays, cost increases, and performance problems in major programs  aimed at delivering important mission capabilities. For example, in  September 2010, we reported that the Science and Technology  Directorate’s master plans for conducting operational testing of container  security technologies did not reflect all of the operational scenarios that  U.S. Customs and Border Protection was considering for implementation.  In addition, when it developed the US-VISIT program, DHS did not  sufficiently define what capabilities and benefits would be delivered, by  when, and at what cost, and the department has not yet determined how  to deploy a biometric exit capability under the program. Moreover, DHS  does not yet have enough skilled personnel to carry out activities in  various areas, such as acquisition management; and has not yet  implemented an integrated financial management system, impacting its  ability to have ready access to reliable, useful, and timely information for  informed decision making. Moving forward, addressing these  management challenges will be critical for DHS’s success, as will be the  integration of these functions across the department to achieve  efficiencies and effectiveness.
Strategically managing risks and assessing homeland security  efforts. Forming a new department while working to implement statutorily  mandated and department-initiated programs and responding to evolving  threats, was, and is, a significant challenge facing DHS. Key threats, such  as attempted attacks against the aviation sector, have impacted and  altered DHS’s approaches and investments, such as changes DHS made  to its processes and technology investments for screening passengers  and baggage at airports. It is understandable that these threats had to be  addressed immediately as they arose. However, limited strategic and  program planning by DHS and limited assessment to inform approaches  and investment decisions have contributed to programs not meeting  strategic needs or not doing so in an efficient manner. For example, as  we reported in July 2011, the Coast Guard’s planned acquisitions through  its Deepwater Program, which began before DHS’s creation and includes  efforts to build or modernize ships and aircraft and supporting capabilities  that are critical to meeting the Coast Guard’s core missions in the future,  is unachievable due to cost growth, schedule delays and affordability  issues. In addition, because FEMA has not yet developed a set of target  disaster preparedness capabilities and a systematic means of assessing  those capabilities, as required by the Post-Katrina Emergency  Management Reform Act and Presidential Policy Directive 8, it cannot  effectively evaluate and identify key capability gaps and target limited  resources to fill those gaps.
Further, DHS has made important progress in analyzing risk across  sectors, but it has more work to do in using this information to inform  planning and resource allocation decisions. Risk management has been  widely supported by Congress and DHS as a management approach for  homeland security, enhancing the department’s ability to make informed  decisions and prioritize resource investments. Since DHS does not have  unlimited resources and cannot protect the nation from every conceivable  threat, it must make risk-informed decisions regarding its homeland  security approaches and strategies.
Moreover, we have reported on the need for enhanced performance  assessment, that is, evaluating existing programs and operations to  determine whether they are operating as intended or are in need of  change, across DHS’s missions. Information on the performance of  programs is critical for helping the department, Congress, and other  stakeholders more systematically assess strengths and weaknesses and  inform decision making. In recent years, DHS has placed an increased  emphasis on strengthening its mechanisms for assessing the  performance and effectiveness of its homeland security programs. For  example, DHS established new performance measures, and modified  existing ones, to better assess many of its programs and efforts.
However, our work has found that DHS continues to miss opportunities to  optimize performance across its missions because of a lack of reliable  performance information or assessment of existing information;  evaluation among feasible alternatives; and, as appropriate, adjustment  of programs or operations that are not meeting mission needs. For  example, DHS’s program for research, development, and deployment of  passenger checkpoint screening technologies lacked a risk-based plan  and performance measures to assess the extent to which checkpoint  screening technologies were achieving the program’s security goals, and  thereby reducing or mitigating the risk of terrorist attacks. As a result,  DHS had limited assurance that its strategy targeted the most critical risks  and that it was investing in the most cost-effective new technologies or  other protective measures. As the department further matures and seeks  to optimize its operations, DHS will need to look beyond immediate  requirements; assess programs’ sustainability across the long term,  particularly in light of constrained budgets; and evaluate tradeoffs within  and among programs across the homeland security enterprise. Doing so  should better equip DHS to adapt and respond to new threats in a  sustainable manner as it works to address existing ones.

	Concluding Observations

Given DHS’s role and leadership responsibilities in securing the  homeland, it is critical that the department’s programs and activities are  operating as efficiently and effectively as possible, are sustainable, and  continue to mature, evolve and adapt to address pressing security needs.  DHS has made significant progress throughout its missions since its  creation, but more work is needed to further transform the department  into a more integrated and effective organization. DHS has also made  important progress in strengthening partnerships with stakeholders,  improving its management processes and sharing of information, and  enhancing its risk management and performance measurement efforts.  These accomplishments are especially noteworthy given that the  department has had to work to transform itself into a fully functioning  cabinet department while implementing its missions—a difficult  undertaking for any organization and one that can take years to achieve  even under less daunting circumstances.
Impacting the department’s efforts have been a variety of factors and  events, such as attempted terrorist attacks and natural disasters, as well  as new responsibilities and authorities provided by Congress and the  administration. These events collectively have forced DHS to continually  reassess its priorities and reallocate resources as needed, and have  impacted its continued integration and transformation. Given the nature of  DHS’s mission, the need to remain nimble and adaptable to respond to  evolving threats, as well as to work to anticipate new ones, will not  change and may become even more complex and challenging as  domestic and world events unfold, particularly in light of reduced budgets  and constrained resources. To better position itself to address these  challenges, our work has shown that DHS should place an increased  emphasis and take additional action in supporting and leveraging the  homeland security enterprise, managing its operations to achieve needed  results, and strategically planning for the future while assessing and  adjusting, as needed, what exists today. Addressing these issues will be  critically important for the department to strengthen its homeland security  programs and operations. Eight years after its establishment and 10  years after the September 11, 2001, terrorist attacks, DHS has indeed  made significant strides in protecting the nation, but has yet to reach its  full potential.
Chairman King, Ranking Member Thompson, and Members of the  Committee, this concludes my prepared statement. I would be pleased to  respond to any questions you may have at this time.

	Contacts and Acknowledgments

For further information regarding this testimony, please contact Cathleen  A. Berrick at (202) 512-3404 or berrickc@gao.gov. In addition, contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. Individuals who made key  contributions to this testimony are Rebecca Gambler, Assistant Director;  Melissa Bogar; Susan Czachor; Sarah Kaczmarek; Tracey King; Taylor  Matheson; Jessica Orr; and Meghan Squires.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

The terrorist attacks of September 11, 2001, led to profound changes in government agendas, policies and structures to confront homeland security threats facing the nation. Most notably, the Department of Homeland Security (DHS) began operations in 2003 with key missions that included preventing terrorist attacks from occurring in the United States, reducing the country's vulnerability to terrorism, and minimizing the damages from any attacks that may occur. DHS is now the third-largest federal department, with more than 200,000 employees and an annual budget of more than $50 billion. Since 2003, GAO has issued over 1,000 products on DHS's operations in such areas as transportation security and emergency management, among others. As requested, this testimony addresses DHS's progress and challenges in implementing its homeland security missions since it began operations, and issues affecting implementation efforts. This testimony is based on a report GAO issued in September 2011, which assessed DHS's progress in implementing its homeland security functions and work remaining.

What GAO Found

Since it began operations in 2003, DHS has implemented key homeland security operations and achieved important goals and milestones in many areas to create and strengthen a foundation to reach its potential. As it continues to mature, however, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. DHS's accomplishments include developing strategic and operational plans; deploying workforces; and establishing new, or expanding existing, offices and programs. For example, DHS (1) issued plans to guide its efforts, such as the Quadrennial Homeland Security Review, which provides a framework for homeland security, and the National Response Framework, which outlines disaster response guiding principles; (2) successfully hired, trained, and deployed workforces, such as a federal screening workforce to assume security screening responsibilities at airports nationwide; and (3) created new programs and offices to implement its homeland security responsibilities, such as establishing the U.S. Computer Emergency Readiness Team to help coordinate efforts to address cybersecurity threats. Such accomplishments are noteworthy given that DHS has had to work to transform itself into a fully functioning department while implementing its missions--a difficult undertaking that can take years to achieve. While DHS has made progress, its transformation remains high risk due to its management challenges. Examples of progress made and work remaining include: Border security. DHS implemented the U.S. Visitor and Immigrant Status Indicator Technology program to verify the identities of foreign visitors entering and exiting the country by processing biometric and biographic information. However, DHS has not yet determined how to implement a biometric exit capability and has taken action to address a small portion of the estimated overstay population in the United States (individuals who legally entered the country but then overstayed their authorized periods of admission). Aviation security. DHS developed and implemented Secure Flight, a program for screening airline passengers against terrorist watchlist records. DHS also developed new programs and technologies to screen passengers, checked baggage, and air cargo. However, DHS does not yet have a plan for deploying checked baggage screening technologies to meet recently enhanced explosive detection requirements, a mechanism to verify the accuracy of data to help ensure that air cargo screening is being conducted at reported levels, or approved technology to screen cargo once it is loaded onto a pallet or container. Emergency preparedness and response. DHS issued the National Preparedness Guidelines that describe a national framework for capabilities-based preparedness, and a Target Capabilities List to provide a national-level generic model of capabilities defining all-hazards preparedness. DHS is also finalizing a National Disaster Recovery Framework. However, DHS needs to strengthen its efforts to assess capabilities for all-hazards preparedness, and develop a long-term recovery structure to better align timing and involvement with state and local governments' capacity. Chemical, biological, radiological and nuclear (CBRN) threats. DHS assessed risks posed by CBRN threats and deployed capabilities to detect CBRN threats. However, DHS should work to improve its coordination of CBRN risk assessments, and identify monitoring mechanisms for determining progress made in implementing the global nuclear detection strategy. GAO's work identified three themes at the foundation of DHS's challenges: Leading and coordinating the homeland security enterprise; Implementing and integrating management functions for results; and Strategically managing risks and assessing homeland security efforts. This testimony contains no new recommendations.