U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

80–883 PDF 2001

EXAMINING SECURITY AT FEDERAL FACILITIES:

ARE ATLANTA’S FEDERAL EMPLOYEES AT RISK?

HEARING

BEFORE THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

APRIL 30, 2002

Serial No. 107–82

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

DAN BURTON, Indiana, Chairman

BENJAMIN A. GILMAN, New York

CONSTANCE A. MORELLA, Maryland

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

STEPHEN HORN, California

JOHN L. MICA, Florida

THOMAS M. DAVIS, Virginia

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

BOB BARR, Georgia

DAN MILLER, Florida

DOUG OSE, California

RON LEWIS, Kentucky

JO ANN DAVIS, Virginia

TODD RUSSELL PLATTS, Pennsylvania

DAVE WELDON, Florida

CHRIS CANNON, Utah

ADAM H. PUTNAM, Florida

C.L. ‘‘BUTCH’’ OTTER, Idaho

EDWARD L. SCHROCK, Virginia

JOHN J. DUNCAN, JR., Tennessee

JOHN SULLIVAN, Oklahoma

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

PATSY T. MINK, Hawaii

CAROLYN B. MALONEY, New York

ELEANOR HOLMES NORTON, Washington,

DC

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

ROD R. BLAGOJEVICH, Illinois

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

JIM TURNER, Texas

THOMAS H. ALLEN, Maine

JANICE D. SCHAKOWSKY, Illinois

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

———

BERNARD SANDERS, Vermont

(Independent)

KEVIN BINGER, Staff Director

DANIEL R. MOLL, Deputy Staff Director

JAMES C. WILSON, Chief Counsel

ROBERT A. BRIGGS, Chief Clerk

PHIL SCHILIRO, Minority Staff Director

(III)

C O N T E N T S

Page

Hearing held on April 30, 2002 .............................................................................. 1

Statement of:

Malfi, Ronald, Acting Managing Director, Office of Special Investigation,

General Accounting Office; John Cooney, Special Agent, Office of Special Investigations, General Accounting Office; Patrick F. Sullivan, Assistant Director, Office of Special Investigations, General Accounting

Office; Wendell C. Shingler, Assistant Commissioner, Office of Federal

Protective Service, General Services Administration; and Sabina Sims,

Director, Office of Federal Protective Service, GSA Region 4 ................... 12

Letters, statements, etc., submitted for the record by:

Barr, Hon. Bob, a Representative in Congress from the State of Georgia,

prepared statement of ................................................................................... 5

Malfi, Ronald, Acting Managing Director, Office of Special Investigation,

General Accounting Office, prepared statement of .................................... 17

Shingler, Wendell C., Assistant Commissioner, Office of Federal Protective Service, General Services Administration, prepared statement of .... 23

(1)

EXAMINING SECURITY AT FEDERAL FACILITIES: ARE ATLANTA’S FEDERAL EMPLOYEES

AT RISK?

TUESDAY, APRIL 30, 2002

HOUSE OF REPRESENTATIVES,

COMMITTEE ON GOVERNMENT REFORM,

Atlanta, GA.

The subcommittee met, pursuant to notice, at 10:30 a.m., in the

Summit Building, 401 West Peachtree Street, Atlanta, GA, Hon.

Bob Barr (vice chairman of the committee) presiding.

Present: Representatives Barr and LaTourette.

Staff present: Daniel R. Moll, deputy staff director; Robert A.

Briggs, chief clerk; Susan Mosychuk, counsel; and David Rapallo,

minority counsel.

Mr. BARR. I hereby convene this hearing of the Committee on

Government Reform of the U.S. House of Representatives open.

The focus of the hearing will be to examine security at Federal facilities, are Atlanta’s Federal employees at risk.

The events of September 11, 2001 have focused our attention on

a frightening reality. Even our most sacred institutions are vulnerable to attack. Terrorists do not engage in conventional warfare.

While terrorists may attack or threaten our military, the most

tempting terrorist targets of choice are innocent and unsuspecting

civilians. They use fear as a weapon, and will go to whatever extreme to heighten the shock effect.

Terrorists also seek to exploit environments that are a normal

part of our daily routine. They aim to take out large numbers of

victims to generate high media attention, and engender mass panic

and public anxiety. What better targets than high profile landmarks and government institutions.

Government buildings are among the most visible institutions in

our society by design, and selecting them for attack serves a very

distinct purpose. When they attack these institutions the terrorists

not only kill, maim, and destroy, but also instill fear that our government is unable to protect us. When terrorists attack, they are

always trying to catch their victims in situations where they would

otherwise feel safe. How safe are we in our Federal buildings?

The September 11th terrorist attacks in New York and at the

Pentagon prompted immediate security crackdowns in Washington,

DC, including the closing of streets, bolstering the security presence at Federal buildings, and curtailing visitor access to government compounds and buildings. Securing Federal buildings in the

Nation’s Capitol is clearly of vital importance. However, we must

2

not overlook the quality and effectiveness of security in all buildings and facilities occupied by Federal employees and visitors in

every major city and across the Nation.

Congress and the Federal Government had the opportunity to

lead by example working with the District of Columbia, local business leaders, and concerned citizens to meet security needs without

necessarily impeding the city’s or the government’s ability to go

about its daily business in the Capitol.

Despite the workable security measures deployed at Federal facilities in Washington, DC, many local Federal agencies have not

addressed, or remain unable to address security needs in the aftermath of last year’s terrorist attacks. Many media outlets reported

that security procedures at Federal agencies varied tremendously

in both process and effect throughout the country. Inconsistent and

vague security procedures at our Federal facilities leave thousands

of Federal employees, visitors, and constituents highly vulnerable

and at risk. The extent to which our government buildings are vulnerable to attack should concern not only the Federal employees of

these buildings, but every family member of these employees, any

member of the general public visiting these buildings, and any individual or company that conducts business with an agency housed

in one of these buildings. In other words, this concerns every member of our community.

Building security is not just about securing the physical structure itself; it is about protecting the lives and livelihood of everyone

and everything in these buildings.

Consider for a moment the repercussions of a terrorist attack at

the IRS service center here in Atlanta. The building which you can

see a picture of here houses 3,000 occupants and is the main processing center for the entire Southeast Region of the United States.

The human toll would be staggering, and the financial impact devastating.

Or consider the repercussions of a terrorist attack at the Sam

Nunn Federal Building. Look at the sheer numbers of employees

and the variety and importance of the government agencies that

would be directly affected.

Today representatives from the General Accounting Office, Office

of Special Investigations [OSI], will provide testimony on the results of a recently completed investigation. At the request of this

committee the investigators tested security measures at five Federal office buildings in the Atlanta area, which has one of the largest Federal presences outside of Washington, DC.

Acting in an undercover capacity investigators were able to gain

unauthorized access to every secured government building they attempted to penetrate. Not only were the investigators able to gain

unauthorized access to these buildings, they gained access which

allowed them unfettered admission to any areas of the buildings

day or night.

The ease whereby the investigators were successful is shocking.

A simple pretext was concocted and easily carried out, allowing

agents to obtain building passes. In fact, they were able to obtain

passes which denote the bearer as being authorized to carry firearms. This building pass allowed them to move freely about, and

extensively bypassing magnetometers and x-ray machines. They

3

even obtained an after-hours access code allowing them to enter

the facilities after security personnel had gone home.

By employing a few simple tactics and off-the-shelf technology investigators thwarted the security in such a manner that weapons,

explosives, nuclear, chemical, or biological agents, listening devices,

and other life-threatening or hazardous materials could have easily

been carried into and left throughout these Federal buildings. They

were given in effect the keys to the kingdom. In the words of the

investigators, they owned those buildings.

At a time when Federal facilities are operating under the highest

level of security, these undercover investigators were able to freely

enter the buildings without proper identification or authority carrying packages which had not been scanned or inspected.

The problem is not isolated to the Atlanta area alone. The Department of State in Washington, DC, recently had to overhaul its

security operations following a string of serious breaches compromising classified information.

It had been an open secret that security was lax at State. In fact,

in late 1998 an unidentified man in a brown tweed jacket entered

then Secretary of State Albright’s executive suite and carried out

unchallenged a pile of classified documents. He was never seen

again.

We no longer live in an environment in which we can afford such

a casual attitude toward security and safety. All principal personnel must stress the importance of security, and combat perceived

weaknesses in the security culture, and proper measures must be

demanded and enforced.

Beyond that, there are specific areas in which we can focus with

regard to security personnel, training, and equipment. Following

numerous security reviews, inspections, and reports one major area

for reform at the State Department was tightening controls of the

State Department building passes. At the time there were 33,000

State Department passes with 2,000 per year completely lost. Diplomats kept their passes even when stationed overseas, making

those passes prime targets for theft or misuse.

Given the potential threat, State Department began a process of

redoing all building passes, deactivating those of former employees,

and making the process of obtaining them much tougher.

Implementing security procedures with the aim of thwarting any

and every conceivable infiltration would be impractical. To do that

would make daily operations of our government agencies impossible. However, we can, and should, and must make buildings both

safe and accessible by consistently following guidelines, deploying

appropriate technology, and employing basic common sense.

We must take a rational approach to security to ensure safety

concerns are addressed in a manner that does not make things

worse. We cannot allow terrorism to destroy our sense of community or the ability of the institutions that run our government to

serve us.

Understanding the nature of terrorist attacks and how terrorists

organizations operate helps us prepare and prevent future attacks.

We can regain control and eliminate fear by taking proactive steps

to avoid falling victim.

4

I thank the witnesses that will be appearing here today, and look

forward to working with them and others on a subsequent legislative remedy to provide an oversight remedy to provide security procedures at our Federal installations.

While the results of this current investigation are frightening, we

hope the steps taken in response will be reassuring in both effect

and perception.

[The prepared statement of Hon. Bob Barr follows:]

5

6

7

8

9

10

Mr. BARR. I would like to now turn to my colleague from the

State of Ohio, a senior member of our Government Reform Committee, Steve LaTourette.

Mr. LATOURETTE. Thank you very much, Chairman Barr. And

first of all thank you for inviting me to Atlanta. And second I want

to commend Congressman Barr for the leadership that you and the

chairman of our full committee, Dan Burton of Indiana, have demonstrated in dealing with the security of the Federal buildings, this

particular issue, and you in particular because of your concern for

the men and women that work in the buildings in Atlanta, Ga.

As you correctly point out in your opening remarks the security

of the Federal work force and those who visit the Federal buildings

in the United States is of vital concern to the government. In 1995

one of the shocking revelations that came to our attention after the

bombing of the Murrah Federal Building in Oklahoma City was

that there was one contract guard assigned to three different buildings on that occasion, and clearly security was not where we needed to be in 1995. I think many of us hoped that in the years between 1995 and certainly 2002 improvements have been made.

The report that we are here to talk about today is disturbing. Although the agents that we will hear from are certainly skilled at

what they do, the ability to completely breach the buildings in Atlanta, GA I think is incomprehensible in the wake of September

11th.

Hopefully this hearing and other hearings like it will help assist

not only the agencies in charge of the security, but also the Congress and the administration reach some conclusions that can

make these buildings safer.

One of the other happy tasks that I have in the Congress is

chairing the Public Buildings, Economic Development, and Emergency Management Subcommittee of Transportation and Infrastructure that has concurrent jurisdiction over some of the issues

that we are going to be talking about today, and the good news is

that legislation relative to the Federal Protective Service is in fact

moving through that committee, and one of the alarming notes I

would say is that we appear to be going backward. When we talked

to Steve Perry, the administrator of the General Services Administration, the goal was to beef up the Federal Protective Service work

force from 600 full-time employees to 900, and what we have seen

instead according to Mr. Perry is that they have gone down to 450,

and the reason being—and we must bear some of that responsibility—is that there is about a $10,000 starting salary differential between what someone for FPS can make and what someone can

make working for the Capitol Hill police department. So that is an

example of some of the things that we are going to have to take

a look at in the Congress.

The other thing that the hearings revealed on this particular

issue is that the training received by the contract guard authorities

utilized by GSA do not receive equivalent training to those who are

employed as police officers in my home State of Ohio or here in the

State of Georgia, and training is something that we also have to

emphasize.

And last, I am not a big believer in gotcha anything, but I did

read the report, I read the recommendations following the briefing

11

of the GAO officers, and one of the recommendations was that

there be at least three people stationed by the magnetometers, and

during our break I went outside to engage in one of the few vices

I am allowed, and that is to have a cigarette, and I came back in

through the building and there were only two stationed at the magnetometer that I entered, and I am also today in possession of two

visitors passes permitting me access to this building, and it seems

to me that we can address that during the hearing as well to determine how that could be.

I thank you very much.

Mr. BARR. Is that in case you lose one?

Mr. LATOURETTE. I do not know if it is in case I lose one, or in

case I have another visitor I want to bring with me.

I appreciate very much the opportunity to be here today, and I

thank you again for your leadership.

Mr. BARR. Thank you very much.

For those unfamiliar with hearings conducted by the Government

Reform Committee, basically what we will do now is we will swear

in the five witnesses, and we will hear from each one of them if

in fact each one of them wishes to make an opening statement for

the record. If there is any additional material that any of our witnesses seeks to be made a part of the record either in more extensive opening statement or additional material that might come to

light, or be relevant based on subsequent questions, the record will

remain open for 10 days for the submission of any additional material.

Following the opening statements of witnesses, Mr. LaTourette

and I will ask questions. If counsel has any additional questions,

she will ask questions as well. And then we will conclude the hearing.

At this time if the five witnesses would stand, please, to be

sworn. If you would raise your right hands.

[Witnesses sworn.]

Mr. BARR. Let the record reflect that all witnesses responded in

the affirmative. Thank you, and please be seated.

We have five very distinguished witnesses here today, all of

whom have the same goal in mind that we on this committee do,

and that is to provide the very best security for not just the Federal buildings and Federal employees and their families, but all

who visit, come in contact with, or have an interest in our Federal

Government, and we appreciate each one of them being with us

today to assist us in our oversight responsibilities to ensure this

vital function of our Federal Government is carried out, and to

hear from them not only with regard to what steps they have and

believe ought to be taken, but ways in which we in the Congress

might help. As Mr. LaTourette mentioned, we in the Congress have

a responsibility to make sure that the laws reflect the needs of our

Federal agencies and our Federal officials, and also that the funds

necessary to carry out those functions are made available. So this

is very much a team effort, and we appreciate again the witnesses

being with us today.

The witnesses that we will hear from today—I believe there is

a witness list available in the back of the room—we will hear from

in the following order.

12

Mr. Ronald Malfi, the Acting Managing Director, Office of Special

Investigations, General Accounting Office. He has extensive background which he is certainly free to go into to establish his bona

fides in the Secret Service.

Also then testifying second will be Mr. Patrick Sullivan, the Assistant Director, Office of Special Investigations for the General Accounting Office, also with extensive background in law enforcement

and particularly with the Secret Service; and finally testifying on

behalf of GAO will be Mr. John Cooney, Special Agent, Office of

Special Investigations, General Accounting Office, with a similar

and very extensive and distinguished background in Federal law

enforcement.

We will then hear from Mr. Wendell Shingler, the Assistant

Commissioner of the Office of Federal Protective Service [FPS], of

the General Services Administration. The General Services Administration is generally known as the government’s landlord. It is the

responsibility of GSA to maintain thousands of Federal buildings

all across the country, including many of those here in the Atlanta

area.

And finally testifying will be Ms. Sabina Sims, the Director of

the Office of Federal Protective Service for GSA Region 4 which includes as its center Atlanta, GA.

With that introduction, Mr. Malfi, the floor is yours to make an

opening statement, and if you would basically lay out the parameters of why your agency got involved in this investigation and how

you carried it out.

STATEMENTS OF RONALD MALFI, ACTING MANAGING DIRECTOR, OFFICE OF SPECIAL INVESTIGATION, GENERAL ACCOUNTING OFFICE; JOHN COONEY, SPECIAL AGENT, OFFICE

OF SPECIAL INVESTIGATIONS, GENERAL ACCOUNTING OFFICE; PATRICK F. SULLIVAN, ASSISTANT DIRECTOR, OFFICE

OF SPECIAL INVESTIGATIONS, GENERAL ACCOUNTING OFFICE; WENDELL C. SHINGLER, ASSISTANT COMMISSIONER,

OFFICE OF FEDERAL PROTECTIVE SERVICE, GENERAL

SERVICES ADMINISTRATION; AND SABINA SIMS, DIRECTOR,

OFFICE OF FEDERAL PROTECTIVE SERVICE, GSA REGION 4

Mr. MALFI. Thank you. Mr. Chairman, members of the committee. We are here today to discuss the results of our tests of security

measures at Federal office buildings in the Atlanta, GA area. Specifically you asked that special agents of the Office of Special Investigations acting in an undercover capacity attempt to gain unauthorized access to secure facilities in such a manner that weapons,

explosives, chemical/biological agents, listening devices, or that

hazardous materials could have been brought into these facilities.

During February and March 2002 our agents breached the security at four of the Federal office buildings that we tested in the Atlanta area by entering these buildings without proper authority,

carrying a briefcase or package, and bypassing the magnetometers

and x-ray machines. They were able to move freely and extensively

throughout these facilities during both day and evening hours, and

were not challenged by anyone. Our undercover agents could have

carried in weapons, listening devices, explosives, chemical/biological

agents, or other such items.

13

All buildings required screening of visitors and valises, for example briefcases and baggage, which included the use of

magnetometers and x-ray machines at security checkpoints.

The buildings required the wearing of either a blue pass or a yellow pass for identification of employees working in these buildings,

which allowed them to bypass the magnetometers and x-ray machines.

The blue pass could also have an additional feature added to it

that would denote the bearer as being authorized to carry a firearm. All passes included photo identification, and had holograms

on them, but were worn inside plastic pockets that could partially

obscure the hologram as well as the bearer’s photograph.

Mr. BARR. Excuse me, Mr. Malfi. Do you have a couple of those

badges we could look at while you are testifying?

Mr. MALFI. Yes, I do.

One of the badges that you are going to be getting, sir, is the

genuine, and one is the counterfeit badge. The genuine badge has

the holograms that are easily seen when they are reflected off the

light.

Mr. BARR. This one?

Mr. MALFI. That is correct. The other is a counterfeit badge.

Mr. BARR. And they were put in these plastic pouches?

Mr. MALFI. That is how they were handed out. When the building passes were given out, these plastic pouches came with the

passes. And you will note one side of the plastic is clear, the other

side is opaque, and we put the photograph, the building pass with

the photograph and the hologram in the opaque side to obscure it.

Mr. BARR. Without going into—and I do not want you to disclose

particularly sensitive investigative techniques here—would you describe what a pretext is?

Mr. MALFI. Basically a pretext is a ruse that we concocted in

order to allow ourselves to get into the building and to meet with

GSA people who were issuing the passes.

Mr. BARR. A story?

Mr. MALFI. It is a story, a fabricated story to give the people a

reason as to why we needed these passes.

Mr. BARR. Was there anything particularly complex about that

story? Could anybody have made something up?

Mr. MALFI. That is correct. We used one ruse; we could have

used one of many ruses to get into the building in order to obtain

a building pass.

Mr. BARR. Thank you.

Mr. MALFI. You are welcome.

I am going to go into how we exactly breached the security of

these buildings.

In early March using a pretext for gaining access, an agent who

had no building pass entered one of the buildings carrying a briefcase, bypassing the magnetometer and the x-ray machines. He met

with the General Services Administration employee responsible for

issuing building passes, and obtained a yellow building pass and an

after-hours access code for that building.

The next day the same agent entered another building carrying

a briefcase. He showed his yellow pass and stated that he wanted

to obtain a blue pass for that building, and bypassed the

14

magnetometers and the x-ray machines based on the strength of

the yellow pass.

Mr. BARR. Do you have that yellow pass, please?

Mr. MALFI. Yes.

He then met with the GSA contract employee responsible for

issuing building passes, and based solely on the strength of having

a yellow pass obtained a blue building pass and an after-hours access code to two of the subject buildings.

In addition, this agent was able to obtain a second feature on the

blue building pass that identified him as a law enforcement officer

and permitted him to carry a firearm in those buildings.

Finally, through the use of another pretext the same agent

obtained—— Mr. BARR. Excuse me. There is a specific designation on the

badge that the folks at the building would know authorized the

bearer to carry a firearm in the building?

Mr. MALFI. That is correct. It is a little round insignia that would

notify the marshals basically that the bearer had the right to carry

a firearm.

Finally, through the use of another pretext the same agent obtained the security guard’s after-hours access code for one of the

buildings.

Mr. BARR. This would be a security code that was designated

specifically to that particular person?

Mr. MALFI. That is correct.

Mr. BARR. And he gave it to the undercover agent, yourself, or

one of your colleagues—— Mr. MALFI. That is correct.

Mr. BARR [continuing]. So that they could get into the building

after hours?

Mr. MALFI. Based again on some social engineering we had an

access code that allowed us entry to the building at night.

Mr. BARR. What do you mean social engineering?

Mr. MALFI. Basically conning the security guard into having him

reveal his access code. The importance to that would have been

that if anything would have occurred we could have used that access code to gain entry into the buildings after hours. If something—we could have put explosives in the building, and basically

if they would have went back and checked who entered in they

never would have even been able to check it to our false identification. They would have wound up going back to the guard as one

of the people that gained entry into that building that night.

Then after we received the original passes we counterfeited both

the yellow and blue building passes using commercially available

software, inserting in them the fictitious names used by our undercover agents and their photographs in preparation for an attempt

as a group to breach the security of these facilities.

Mr. BARR. Excuse me. In other words, the software that was

used to create the false badges is available to anybody on the open

market? It was not something that was uniquely available to yourselves as law enforcement officials and investigators?

Mr. MALFI. That is correct. Everything that we did and we used

was available to the public. We did not use any of our inside technology in order to enhance this operation. We wanted to make it

15

that anyone basically without being involved in the law enforcement community could have accomplished what we did.

The counterfeit passes contained printed holograms on them, not

actual holograms. Had anyone made a physical inspection of the

counterfeit passes they should have been able to detect them as

being bogus.

Mr. BARR. In other words, the hologram that is available if you

look at it?

Mr. MALFI. That is correct. On the counterfeit ones we just printed a duplicate of the hologram which did not perform the function

that a hologram does. It does not change shades when it is exposed

to the light or moved; it is flat.

Mr. BARR. And that is obvious to us, and it would have been obvious had one of the guards checked it, just physically looked at it

for a moment?

Mr. MALFI. That is correct.

Mr. BARR. But that did not happen?

Mr. MALFI. That is correct.

Later in March other agents using the counterfeit yellow and

blue building passes entered three of the buildings bypassing the

magnetometers and x-ray machines. One of these agents carried a

briefcase. The same agents also successfully entered these same

buildings in the evening utilizing the access codes that they previously acquired.

An agent using a counterfeit yellow building pass met with the

GSA contract employee responsible for issuing building passes for

the two buildings. Based on the strength of the counterfeit yellow

pass and a fictitious request form the agent was issued a genuine

blue building pass and an access code for the evening entry after

security check points were closed.

Additionally, one agent wore another agent’s legitimate blue pass

into one of the buildings, crossed over into another building

through a tunnel, and was never challenged.

Mr. BARR. Is there a physical similarity between the person who

utilized that badge and the picture on the badge?

Mr. MALFI. Actually I used Agent Cooney’s picture identification

to gain access into the buildings.

Mr. BARR. I will not ask which one of you was insulted, but in

other words you used the badge of somebody that does not look

very much like you at all, and you were not challenged?

Mr. MALFI. That is correct.

Two agents then drove to another Federal facility, and based on

the strength of a legitimate yellow pass and a counterfeit yellow

pass and a pretext gained admittance to that building bypassing

the magnetometer and x-ray machines.

Finally, after we completed our test of the security for these

buildings we met with officials from the U.S. attorney’s office, the

U.S. Marshal Service, GSA, and the Federal Protective Service, and

briefed them on the results of the security tests, identifying the

weaknesses we found.

Mr. BARR. This was immediately following the conclusion of your

investigation?

Mr. MALFI. That is correct. Actually the day that I wore the pass

was the day of the meeting, so we were finished. As soon as we finVerDate 11-MAY-2000 11:29 Sep 09, 2002 Jkt 000000 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 C:\DOCS\80883.TXT HGOVREF1 PsN: HGOVREF1
16

ished the actual last function of the operation we immediately had

a meeting with these individuals and advised them of the weaknesses that we found.

Subsequently, the Federal Protective Service issued a security

bulletin which addressed weaknesses we identified.

In closing, I would like to add that last week GAO’s chief technologist testified at a hearing before the Subcommittee on Technology and Procurement Policy, House Committee on Government

Reform, concerning security technologies to protect Federal facilities. As part of that testimony it was acknowledged that effective

security also entails having a well-trained staff that follows and enforces policies and procedures. It was noted that breaches in security resulting from human error are more likely to occur if personnel do not understand the risks and the policies that are put in

place to mitigate them. Good training is essential to successfully

implementing policies by ensuring that personnel exercise good

judgment following security procedures.

Cited as an example was our previous work where we breached

the security at 19 Federal agencies and two airports. This case further exemplifies this point. Further, the Federal Protective Service

bulletin reinforces this point.

Mr. Chairman, that completes my prepared statement. We would

be happy to respond to any questions you have, or members of the

committee. Thank you.

[The prepared statement of Mr. Malfi follows:]

17

18

19

20

21

Mr. BARR. Thank you, Mr. Malfi.

Mr. Sullivan, do you have an opening statement?

Mr. SULLIVAN. No, sir, I do not have an opening statement.

Mr. BARR. Mr. Cooney?

Mr. COONEY. Also I have none.

Mr. BARR. You are both available to answer any questions?

Mr. COONEY. Yes, sir.

Mr. SULLIVAN. Yes, sir.

Mr. BARR. Mr. Shingler.

Mr. SHINGLER. Good morning, Mr. Chairman, members of the

committee.

I am Wendell Shingler, Assistant Commissioner of the Federal

Protective Service, General Services Administration [GSA]. Although I am relatively new to this position, I have 30 years of security experience in progressively more demanding positions within

the Federal Government, most recently with the U.S. Marshal

Service.

I look forward to the challenges that we face, as well as working

with other Federal agencies in meeting their needs. I am pleased

to appear before you today and provide information on the GSA’s

program to secure Federal buildings that it owns or leases, and the

methodology that we use to assess potential vulnerabilities to these

facilities.

GSA’s Federal Protective Service [FPS] provides law enforcement

and security to over 8,000 owned and leased buildings, and approximately 1 million Federal employees and visitors to these facilities on a daily basis.

We are comprised of police officers, criminal investigators, physical security specialists, and rely on the use of nearly 7,000 contract guards to supplement our needs.

With the terrorist attacks of September 11th there is one clear

message: that there is no security silver bullet. Security is a dynamic and ever-changing discipline. GSA’s Federal Protective Service strives to provide the safest environment for the Federal agencies we house and the American public that visit these Federal

buildings. The threat and our response to it changes daily.

The dedicated men and women of the Federal Protective Service

welcome that challenge, and are constantly striving to improve our

services and reduce potential threats to our buildings. Our primary

goal is to make everyone feel safe when entering GSA-controlled

buildings.

Since there is no one-size-fits all in security to achieve this goal,

each of our facilities receives an individual building security assessment. The building security assessment program is designed to determine the specific security measures needed to eliminate or reduce threats directly associated with each individual building. Tailored security measures, countermeasures are then recommended

based on reducing or eliminating determined vulnerabilities and

threats at buildings.

In addition, we are now working with the FBI, CIA, State and

local law enforcement agencies in sharing of intelligence information that enables us to better assess the credibility of those threats.

In addition to physical countermeasures such as guards, physical

barriers, alarms, cameras, x-ray machines, and magnetometers we

22

also provide law enforcement services. These services include responding to calls, arrests, and when necessary conducting investigations.

On a national level we accomplish this challenging and very important job of protecting GSA-controlled facilities with a small but

dedicated uniformed staff. To augment our Civil Service force, we

rely on 7,000 contract guards nationwide.

Here in GSA’s Southeast Sunbelt Region we have 1,327 buildings

of which 143 are Level 4, our highest security level. To protect

these facilities we supplement our law enforcement personnel with

960 armed contract guards.

The only acceptable minimum security level for all of these facilities nationwide is that which provides a safe and secure environment for GSA co-workers, customers, and visitors. This is the driving force behind our FPS mission, to permit Federal agencies and

members of the public to conduct their business without fear of violence, crime, or disorder.

I know I face many challenges in my new position, and I am certain that the Federal Protective Service and I are ready to take

them on.

This concludes my prepared statement, Mr. Chairman, and we

are prepared to answer any of your questions.

[The prepared statement of Mr. Shingler follows:]

23

24

25

26

Mr. BARR. Thank you, Mr. Shingler.

Ms. Sims, please.

Ms. SIMS. I have nothing further to add, but I would be more

than happy to answer any specific questions that you have for me.

Mr. BARR. OK. Maybe you could briefly for the benefit of the audience and the listening public who are very concerned about this

just very briefly describe the FPS or the Federal Protective Service

and its function, and how it interfaces with GSA.

Ms. SIMS. The Federal Protective Service is the law enforcement

and security arm of the U.S. General Services Administration. I am

1 of 11 FPS regional directors around this country, and I am the

Director of the Southeast Sunbelt Region. I have approximately

1,300 facilities around eight States in this region.

Mr. BARR. OK. Thank you.

I have a couple of preliminary questions, and then I would like

to turn to my colleague Mr. LaTourette, then I may have some

more, and he may as well.

Back in 1993 the World Trade Center was bombed in the garage.

Two years later the Murrah Federal Building in Oklahoma City

was bombed and crumbled with tremendous loss of life, and of

course on September 11th of last year our Nation suffered the most

serious terrorist attacks ever perpetrated against us in our homeland or anywhere.

After each one of those I would presume that our government

took a look at security procedures, not just at Federal buildings,

but particularly at Federal buildings, and took steps to address

those, yet obviously we still have some problems.

I know also, Mr. Malfi, that your office conducted an investigation I think 2 years ago was it. If you could, briefly describe that

investigation.

Mr. MALFI. We were requested to test the security at various

government buildings and airports. We undertook an operation, undercover operation where we used false police credentials in an effort to obtain access into these buildings and bypassing the

magnetometers and x-ray machines, carrying in briefcases to simulate the fact that we could have brought in weapons, explosives

into these buildings.

We attempted 19 entries in the Washington area, and were successful in all 19 entries. We attempted two airports, and obtained

entry into both airports, circumventing the magnetometers and xray machines in all the instances where we went out.

Mr. BARR. Were steps taken subsequent to that investigation to

correct the deficiencies that investigation uncovered?

Mr. MALFI. After we completed the investigation we had again a

debriefing with the agencies that were involved, and they instituted immediate steps to try and correct the measures that made

it allowable for us to circumvent their security. So there was much

concern about it, and the agencies reacted to this and put in certain policy changes to effectively enhance their security measures.

Mr. BARR. I want to make sure that Mr. LaTourette and the public and we understand exactly the scope of what you were able to

do here, but also to indicate as I would like you to whether or not

there were in fact areas of these Federal buildings—and we see pictures of the Federal buildings with many, many agencies housed

27

therein, and many thousands of Federal employees—it is my understanding that you were able to gain access to each one of the

I think actually four buildings that you sought to penetrate; is that

correct?

Mr. MALFI. That is correct.

Mr. BARR. And the identification cards that you were able to secure based on pretexts, that is false stories which apparently were

not checked out; is that correct?

Mr. MALFI. That is correct. No due diligence was done in regards

to the story that we used for the reasons we needed a building

pass. We were able to obtain—Agent Cooney was able to obtain two

legitimate building passes. From those legitimate building passes

we counterfeited building passes for our other agents to gain infiltration into these buildings as a group, and then we went and on

the strength of some counterfeit passes, building passes, we were

able to obtain a legitimate building pass. So in turn through a ruse

we got genuine building passes, counterfeited them, were able to

get entry into the buildings using the counterfeited building passes,

get access to the buildings when they were closed and after hours,

and based on the strength of a counterfeit building pass we were

able to obtain genuine building pass. So we would have eventually

turned all of the counterfeit credentials, counterfeit building passes

we had into legitimate passes.

Mr. BARR. Of course if one of our law enforcement agencies were

conducting a true undercover operation, or an intelligence operation, you are familiar with the concept of backstopping; correct?

In other words, if you are going to send an agent out in an undercover capacity you will backstop so that steps are taken down the

line so that if his story is checked out it appears to be legitimate.

Mr. MALFI. Absolutely.

Mr. BARR. Their undercover operations are backstopped. You did

not do that in this case; is that correct?

Mr. MALFI. Actually there was no need for us to do that in this

investigation because nobody checked, pulled back the first layer.

We had a system set up that in case we needed some verification

for the fictitious stories that we laid out that we would have been

able to provide that. But it was not necessary in this case.

Mr. BARR. In other words, there was not one call or effort made

to check out the veracity of what you told the individuals in order

to secure the passes or the codes?

Mr. MALFI. That is correct.

Mr. BARR. Thank you. Mr. LaTourette.

Mr. LATOURETTE. Thank you very much. Mr. Chairman.

Mr. Malfi, did you or your team actually carry explosives or firearms into these buildings?

Mr. MALFI. No, we did not.

Mr. LATOURETTE. And Mr. Barr asked one of the questions, but

all of you have extensive law enforcement experience, each over 20

years if I heard you correctly earlier. Some missions that you are

assigned to I assume are very, very difficult, some are very, very

easy, and like the three bears some are in the middle I guess. How

would you characterize the difficulty that you had in accomplishing

what you did here in Atlanta?

28

Mr. MALFI. I would say we did not have much difficulty accomplishing this assignment. Even though there were some technical

things that we had to do, we had to counterfeit the passes, but we

used basic computerized software to do this, and it was not really

that difficult.

Mr. LATOURETTE. And again basic computer software, is there

anything extraordinary, any lengths that you had to go to, to recreate the passes that you have shown us here today? Anything— could Mr. Barr and I do this if we knew how to work a computer?

Mr. MALFI. I believe so. I mean the original pass was scanned,

which is a common technology now that is used for computer printing. It was scanned in, it was worked on a little bit to get the colors

as close as possible, and basically it was printed out.

The holograms which is a security feature, which is a good security feature, that appeared on the genuine passes. We did not duplicate—I mean we could have went through a more high scale

type of technology and could have gotten holograms produced. I

mean you can replicate that type of technology, but we did not go

that far. We strictly produced a flat hologram that had the appearance if you just looked at it one way that it looked like there was

something there, but it did not do the effect that an actual

hologram does, which is when it hits the light reflects different colors to it.

Mr. LATOURETTE. In our earlier discussions with Ms. Sims and

Mr. Shingler it came up that each building has a committee I guess

set up to determine what security is maintained, it is a security

committee; is that correct?

Mr. SHINGLER. Yes, sir. One of the recommendations from the

original Department of Justice vulnerability assessment that Congressman Barr referenced was the establishment of building security committees. Those committees are made up of the tenants of

the building, and they are each represented, each member is represented.

Mr. LATOURETTE. Is the adoption of security committees for each

building something again that came out of this DOJ report?

Mr. SHINGLER. Yes, sir.

Mr. LATOURETTE. Is it required?

Mr. SHINGLER. It is required, yes, sir.

Mr. LATOURETTE. Let me ask you this. Could the General Services Administration mandate through rule or regulation what level

of security is in each building?

Mr. SHINGLER. Could we, sir?

Mr. LATOURETTE. Yes.

Mr. SHINGLER. Yes, sir.

Mr. LATOURETTE. Are you aware of any—Ms. Sims, let me ask

you this for the buildings that you are in charge of—are you aware

of any security committee that has adopted a recommendation that

everyone that enters the building go through the magnetometer?

Ms. SIMS. I am not aware of that recommendation.

Mr. LATOURETTE. Let me ask you, Mr. Malfi, I indicated before

where Mr. Barr and I work everybody goes through the machines,

and the reason is that we have former staffers that are no longer

working on the Hill that do not turn in their credentials and can

gain access to the building, and for security purposes we ask everyVerDate 11-MAY-2000 11:29 Sep 09, 2002 Jkt 000000 PO 00000 Frm 00032 Fmt 6633 Sfmt 6633 C:\DOCS\80883.TXT HGOVREF1 PsN: HGOVREF1
29

body to go through the machines, and people understand that I

think.

Is there any reason that—well, let me ask you this: If that had

been the policy at these buildings you obviously could not have carried in briefcases and valises and other things without going

through the magnetometers.

Mr. MALFI. That is correct. The whole purpose of us getting the

building pass was after we did the surveillance on the buildings we

realized that people that had the building passes were not subject

to go through the magnetometers or to have their belongings xrayed. So our purpose was to obtain a means in which we could bypass the magnetometers and x-ray so we could if we wanted to

bring in weapons and explosives into the building.

Mr. LATOURETTE. And you talked about the fact that you had

been here before, before you engaged in the attempt to get passes,

and I guess I would ask you the same question. Did you spend an

unusually long amount of time for a law enforcement operation casing the joint before you reached the conclusions you did necessary

to breach the security of these buildings?

Mr. MALFI. No. We did this fairly quickly. I think it was two visits that it took us here. Manpower-wise it took about 3 days before

we were ready to come back and actually do the operation.

Mr. LATOURETTE. Mr. Shingler, Steve Perry who is the Administrator of GSA has made some observations relative to the Federal

Protective Service which is under your care and direction. One of

the things that he has noted at least to me in another capacity that

I have is that there is a pay differential that is hard the make up

for the Federal Protective Service, and the one example that he

cited was that there is a $10-an-hour difference between what

someone can make working for the Capitol Hill police force as opposed to the starting wage in your salary. Is that an accurate observation?

Mr. SHINGLER. Yes, sir, very accurate.

Mr. LATOURETTE. Does that create a turnover problem for you?

Mr. SHINGLER. Yes, sir, constantly.

Mr. LATOURETTE. And likewise it is my understanding that you

started, if not this year, a little while ago with 600 FTEs, full time

FPS workers, and now you are down to the neighborhood of 450?

Mr. SHINGLER. Yes, sir. Turnover is tremendous.

Mr. LATOURETTE. Has the GSA put together, worked with the

administration in a way to develop legislation to help correct some

of the deficiencies relative to first pay scale, and second training?

Mr. SHINGLER. Yes, sir, we have.

Mr. LATOURETTE. And can we anticipate that in the near future?

Mr. SHINGLER. I would say yes, sir.

Mr. LATOURETTE. And the other deficiency that came up in some

of the hearings, and this was principally brought to our attention

by the officers within the Federal Protective Service is that there

is a variation in the training that some of the contract guards are

subject to in order to be under contract. Is that an accurate observation?

Mr. SHINGLER. Yes, sir. As a matter of fact, we have an active

effort to bring some balance to that training effort, including a

30

drastic increase to that training in what we are going to call our

building security guards, yes, sir.

Mr. LATOURETTE. And, Mr. Malfi, back to you. It is my understanding that the equipment was in place at all of these buildings,

and people were in place in all of these buildings, and the breakdown I guess would be two, and I would like your comment, one

is that when you have a policy that as long as you have one of

these you can bring anything into the building that you want without having it checked, I would consider that to be a deficiency, and

second of all the deficiency appears to be human error, that you

were permitted to get through with credentials that were phony,

and in one instance where you had even switched pictures with the

other fellow.

Mr. MALFI. Exactly. Basically Congressman Barr brought this

out earlier in his opening statements, that common sense and diligence is really the key to security, and as long as you have people

that are watching but not paying attention, or looking and not seeing these type of vulnerabilities will continue to be a problem.

Mr. LATOURETTE. And last Mr. Shingler and Ms. Sims, it is not

appropriate to talk about the recommendations that are attached

in the confidential report that followed the briefing that you received, but I think that the fellow that issued is named Constable

which is a good name I think for someone involved in law enforcement, but have you reviewed each of you all of the recommendations contained in that?

Mr. SHINGLER. Yes, sir, we have.

Ms. SIMS. Yes, sir.

Mr. LATOURETTE. OK. And I would just indicate, and again I do

not think that we should try and surprise people, but I would just

indicate that upon my entrance to this building, re-entrance that

I found that the recommendations contained in Mr. Constable’s report are not being followed, and I am sure that you will take that

to heart and do what is necessary to fix it.

Mr. SHINGLER. By all means, sir.

Mr. LATOURETTE. Thank you very much. Thank you, Mr. Chairman.

Mr. BARR. Thank you, Mr. LaTourette.

It is my understanding that currently FPS, or the Federal Protective Service is under the control of the Public Building Service,

and does not function as a truly independent security advocate for

Federal facilities. Has the GSA ever considered moving the FPS

out from under the Public Building Service to allow it to function

truly as a law enforcement agency?

Mr. SHINGLER. We actually are very close to that as of this moment. The GSA did realign all of the regional offices, much as this

one is, reporting to headquarters. In days past they used to report

to the region itself. Now the Federal Protective Service is controlled

out of the central office headquarters in Washington. Although we

are part of the Public Building Service, we are a fairly integral part

of that effort because a lot of what we do requires funding, and it

is funded out of the Federal building fund. The Federal building

fund is controlled by the Public Building Service. So we are a totally dedicated service as of this moment, and we do rely on the

31

funding mechanisms of the Federal building fund which are controlled by the Public Building Service.

Mr. BARR. The funding is very important, and as both Mr.

LaTourette and I mentioned earlier, the Congress certainly has the

responsibility there to make sure that all of these functions are

funded properly.

I am not so much interested in the funding mechanism as separating FPS out so that it truly can function as a law enforcement

agency.

Mr. SHINGLER. We have complete authority as of this moment,

sir, to do that. I have never had—in the 2-months that I have been

here already we have not had any interference whatsoever to try

to do exactly as you said, to be a full-fledged at-the-table law enforcement agency.

Mr. BARR. Mr. Malfi, in your experience both in law enforcement

and in these type of investigations involving Federal facilities do

you see that it would help at all—and this is something we are

looking at from a legislative standpoint as well I suppose—to separate FPS out and give it more autonomy as a law enforcement

agency, as a separate entity?

Mr. MALFI. Actually I have not thought about or looked into that

aspect of it, and I know GAO has not looked at that, but based on

my experience if you have people that are involved in law enforcement that are involved in security and they are answering to people of the same culture with a law enforcement background things

normally seem to run better for that arena based on the culture

and the experience level that you have.

Mr. BARR. With regard to the meeting that you had immediately

following the conclusion of the undercover phase of your investigation, have steps been taken, Mr. Shingler and Ms. Sims, since that

time, just I guess a little over a month ago—actually when was

that meeting, Mr. Malfi?

Ms. SIMS. March 20th.

Mr. MALFI. March 20th.

Mr. BARR. So just about a month ago. And, by the way, let me

say we appreciate your doing that, even more important than getting your information, or even physically getting back up to Washington you sat down with the agencies here because you perceived

that there was a very serious problem, something of which they

should be made aware of immediately, and I think that is very appropriate and commendable.

In followup to that, Mr. Shingler and Ms. Sims, could you again

without revealing any sensitive law enforcement techniques, tell us

some of the steps that have already been taken to address the deficiencies that GAO discovered.

Ms. SIMS. Let me just say that during that March 20th meeting

one of the first things that Agent Malfi said to us is that there has

never been a facility that he has set his sights on that he has been

unable to penetrate, and that is evidenced by his testimony in

which he said that he has been able to penetrate 19 Federal facilities and two airports.

We at the U.S. General Services Administration take no consolation in being lumped into that group. We do not make an excuse

by being lumped into that group now.

32

But what I will say is that within hours of that March 20th

meeting we took immediate, decisive, and what we believed to be

effective steps, probably a dozen steps to further improve security

postures in the Federal facilities, and we are currently working on

at least a dozen more. And that is in addition to what we have always done prior to September 11th, prior to the penetrations by the

U.S. General Accounting Office.

Some of those that we have been doing would include security

surveys, would include occupant emergency planning, would include building security committee meetings, would include daily

contact with the tenants and visitors, and implementing the feedback that they give us each and every day.

Mr. BARR. Two of the items that Mr. Malfi discussed and that

his colleagues have mentioned also, though, would seem to be of

the sort that would not require a serious problem like this in order

to be directive.

Both prior to and after this investigation will all of those folks

under GSA’s or FPS’s authority actually look at a badge physically

to determine that it is in fact, or that at least it appears to be in

fact a valid identification pass?

Ms. SIMS. Yes, sir. We employ a three-step process by which we

look at the badge, we look at the face of the individual, and we look

again at the badge, and we are confident that those strategies are

currently being employed.

Mr. BARR. That was not the case, though, obviously prior to the

undercover investigation, that three-step process obviously was not

used.

Ms. SIMS. I believe that it was used in most cases. Security is

a very unforgiving discipline, and it requires daily iterative followup, and that includes meeting one-on-one with contract security

guards and the contractor to reiterate what the ongoing policies

and procedures are.

Mr. BARR. With the particular badges that you have described,

if somebody, Mr. Malfi, had simply looked at it even cursorily and

seen that it did not have the proper hologram on it for example,

how many times were collectively you all able to secure access to

Federal buildings based on those badges?

Mr. MALFI. I believe if they would have looked at the badges first

of all they would have definitely caught the fact that I was using

John’s building pass because his photograph appeared on it, not

mine.

If they also looked at the passes, all of the counterfeit building

passes should have been detected and those people should not have

been not allowed entry, and a followup investigation should have

occurred. So in all instances——

Mr. BARR. But about how many times did that occur?

Mr. MALFI. On almost all of the entries that we made.

Mr. BARR. I mean a number of times?

Mr. MALFI. We infiltrated the buildings I think on two occasions.

We went back twice. I mean because once we got through then we

wanted to go through at night time with the crew, you know, with

the group, and we saw no need to continually, you know, for 3

weeks straight go in and out of these buildings. Once we peneVerDate 11-MAY-2000 11:29 Sep 09, 2002 Jkt 000000 PO 00000 Frm 00036 Fmt 6633 Sfmt 6633 C:\DOCS\80883.TXT HGOVREF1 PsN: HGOVREF1
33

trated it, we got inside, you know, that operation was over as far

as we were concerned.

So I believe there was like two penetrations for most of the buildings, and one penetration for another.

Mr. BARR. By each one of you?

Mr. MALFI. That is correct.

Mr. BARR. So that would mean at least six penetrations?

Mr. MALFI. Six, and then we had two other undercover agents

that also went into the buildings.

Mr. BARR. And in not one of those instances was the badge physically inspected?

Mr. MALFI. That is correct.

Mr. BARR. This is the problem that we have, Mr. Shingler. It

may be your belief or your wish that in most instances that simple

step occurs, but apparently in none of these instances—I mean it

is not as if they were stopped most of the time and looked; it was

never looked at. Is that a concern?

Mr. SHINGLER. It is deeply a concern. Policies are one thing, all

the equipment in the world are another just as Mr. Malfi said. And

I was at the hearing the other day that his counterpart was at. All

the technology in the world is not going to do you any good if your

staff is not there and trained to identify it and do something with

it. We feel that is a key for us, and training and getting the proper

staff is definitely going to be one of our major efforts. I have already spoken to Mr. Malfi about—the Federal Protective Service

faces a lot of challenges. This effort has helped us focus and set priorities for addressing those challenges, and that is what we are attempting to do, sir.

Mr. BARR. When an initial approach is made as Mr. Malfi and

his colleagues did in order to secure an initial pass, building pass,

and a story is told that obviously is not true, is there a process now

in place that obviously was not in place before so that in every instance that story is checked out at least one level?

Mr. SHINGLER. Yes, sir, that practice is in place now. I think for

the most part most policies were in place, although we have issued

further policy guidance. It was the actual doing the work, and it

is great to talk the talk, but walking the walk is the thing, and we

just were not totally walking the walk at that point, and I think

we are now, sir.

Mr. BARR. As a result of the briefing on March 20th and this operation generally, have you all been able to identify particular individuals that committed serious breaches of security and allowed

this to happen, allowed these penetrations to occur and these false

badges to be used?

Mr. SHINGLER. I misunderstood the question, sir.

Mr. BARR. Have you been able to identify particular individuals

who fell short of the standard that you all maintain?

Mr. SHINGLER. Employee-wise, or contractor-wise?

Mr. BARR. Yes.

Ms. SIMS. Yes, sir, we have.

Mr. BARR. And has action been taken to correct those situations?

Ms. SIMS. Yes, sir, it has been.

Mr. BARR. Have persons been terminated?

Ms. SIMS. No, sir.

34

Mr. BARR. Have any contract personnel been removed from those

responsibilities?

Ms. SIMS. Yes, sir.

Mr. LATOURETTE. Mr. Barr was talking about the new technology, and let me just ask if you are based upon your experience

aware of any additional security technologies including smart cards

or biometric devices that you think could be used to help eliminate

some of the human error that was discovered in this operation, Ms.

Sims, and then you, Mr. Shingler? Are any of those currently under

discussion or consideration by the GSA relative to building security?

Ms. SIMS. Yes, sir. GSA in several regions across the country is

currently employing pilot projects which utilize smart card technology. Certainly if we had our druthers the Nation would move toward that.

Mr. LATOURETTE. And just for the benefit of those that do not

know what a smart card is, maybe you could just explain what it

is that those pilot projects are doing.

Ms. SIMS. Well, there are variations on it. Up in New York several buildings utilize smart card technology in which the individual’s—I am sorry. Wendell, would you like to—— Mr. SHINGLER. Absolutely.

Basically what it is is it is an identification card with a computer

chip inside, and within that computer chip could be a variety of

pieces of information, the person’s name, Social Security number,

and a physical picture so that when it comes up on a computer

screen and it is accessed through a reader you could doubly verify

that it is the person on that card and in person in front of you. So

there is a wide variety of checks within those pieces of equipment.

Biometrics is another issue that we are looking at. Again as I

said in my opening statement I do not know that there is a silver

bullet, but it is definitely one of those items that we intend to work

with the Interagency Security Committee which is also from the

vulnerability assessment that is a government sharing of information, and that is where we will address a lot of those areas, especially with the Defense Department who has done a lot of research

into those areas.

Mr. LATOURETTE. I do not want to get too far afield from the subject of this hearing in terms of an internal penetration, but both

what happened in Oklahoma City and at the World Trade Center

had to do with things happening externally to buildings. Has GSA

engaged in a study of the properties under its control relative to

external security? Say the building we are sitting in today?

Mr. SHINGLER. Yes, sir. We are actively doing that in two methods. One, the new buildings that the Hill authorizes for new courthouses and the like, we are looking at new technologies and old

technologies. We are putting seismic things, designing them into

the building that probably were not used in years past in other

than the seismic regions such as the West Coast. So we are looking

at those things.

We have done a lot of research in glass. As you may be aware,

in Oklahoma a lot of people were hurt or injured or killed because

of flying glass, so we have done a lot in the scientific look-sees at

glass.

35

We are also using a lot to address the existing buildings. We are

looking at set-backs, how we can increase set-backs using street

closures or lane changes, or even just changes to the surfaces of the

buildings. So we are actively looking at all of those areas.

Mr. LATOURETTE. And actually one of the not-often-enough-told

stories is one of the women who lost a child in the day care center

in the Murrah Building and started a foundation called People

First, and it has specifically dedicated itself to the development and

research of shatterproof glass for not only Federal buildings but for

also other facilities, and she is doing wonderful work.

And last, Mr. Malfi, maybe to impress, and I want to indicate

that I guess what concerns me about the answer to Mr. Barr’s

question, again when I went outside the building not only did I get

a second visitor’s pass, but someone with a yellow pass just blew

right past the guards and the magnetometer, no one touched the

pass, nobody examined the pass, nobody matched up the picture,

and so I know that you are in here and you have contracted with

people to engage in security, but it appears to me that we are still

not quite there, even in the fact that I assume most of the people

in the building know what we are doing here if they watch television, so I would think that they would take it a little more seriously.

And maybe to give the matter some seriousness, Mr. Malfi, what

was the biggest container that you or your agents brought in in

terms of a suitcase that you could put in an overhead bin, or a

briefcase?

Mr. MALFI. We took in a travel bag, a valise-type bag that could

have been used to bring in certain equipment, certain explosives,

anything basically we wanted to bring into the building.

Mr. LATOURETTE. And did any of you during the 20-plus years

that each of you had with the Secret Service, do you have experience with explosives training?

Mr. MALFI. Enough to know to get away from them. That is

about it.

Mr. LATOURETTE. Are you able to estimate or guesstimate based

upon the size of the valise that you brought in what sort of damage

you could have done to this building if it had been packed for instance with C4 explosives?

Mr. MALFI. Well, basically depending on where we would have

placed those, how much we would have brought in. It depends. I

mean once you have access to a building and free reign on the

building then you can sort of accomplish basically anything you

want to.

I do not think anybody would have stopped us if we all walked

in carrying two large duffel bags each. I mean we had the building

passes that allowed us to bypass the magnetometers and the xrays. The main thing is that technology is not a cure-all for security, money is not a cure-all for security. The bottom line is that

due diligence is really the most vital factor in regards to any type

of security that you have set up.

People have to be diligent in what they are hired to do, they have

to adhere to the policies and understand why those policies are in

effect so that it makes sense to them so that they could prevent

things like this from going on.

36

Mr. LATOURETTE. And part of that is not only going over things,

but it is training, and it is also compensating somebody at a rate

that motivates them to do their job I would assume.

Mr. MALFI. That is correct.

Mr. LATOURETTE. Thank you very much.

Mr. BARR. Going back, Mr. Malfi, to the one aspect of the badges,

you say there was the designation on the badges that allowed the

person, or indicated that the person possessing the badge could

carry firearms into the building. What was done in order to secure

that additional authority?

Mr. MALFI. Basically Agent Cooney just did a little social engineering in regards to having that person put that extra feature on

that badge.

Mr. BARR. In other words, he just gave them a story that he

needed to carry a firearm?

Mr. MALFI. In the conversation it came up that he may need this,

and he says, yeah, he says I definitely could use this, and they put

it on. So it was volunteered, right, John?

Mr. COONEY. Correct. I did not have to explain in detail what the

need for a firearm was. I just said I would be coming in with firearms at some time, and they said ‘‘Well, then you need this feature

on it,’’ and I said ‘‘Yes, I would like to have that.’’ They were very

willing.

Mr. BARR. What steps have been taken to correct that particular

deficiency in the wake of this investigation? Ms. Sims.

Ms. SIMS. Would you elaborate on the question, please?

Mr. BARR. Not really on the question, but what steps have been

taken to address that particular deficiency? In other words, the

ease with which the undercover officer was able to get the designation on the badge that allowed them to bring firearms in without

having to explain or provide any sort of documentation at all.

Ms. SIMS. Without getting too detailed on our security protocols,

there are at least a half dozen steps that we have taken specifically

to that element of building entry. One would include tightening up

the policies and procedures associated with the issuance of the

badge. The actual badge issuance procedure has changed in terms

of who issues the badge, the actual application for the badge has

changed, and the validation process by which we issue the badge

has changed and tightened up.

Mr. BARR. We have been talking generally today very specifically

about the facilities here in Atlanta in Region 4. Are the measures

that we have been talking about here today being implemented

across the country in all regions of the country, in all facilities

under the jurisdiction and control and responsibility of GSA and

FPS?

Mr. SHINGLER. The specific ones that are being done here may

not necessarily be, but the intent is each of Sabina’s counterparts,

the regional directors in the balance of the country are specifically

addressing similar types of issues.

Some of the ID card issuance procedures are different from location to location, but the ultimate intent of tightening up our security of getting in and out of buildings is definitely being addressed

nationally, sir.

37

Mr. BARR. I mean it would seem to me that what we are talking

about here is just so basic, namely not just giving somebody a designation to carry a firearm into a Federal building without asking

any questions or checking anything out, but the issue of simply

checking to see whether the person that they say they are coming

to see actually needs to see them, physically looking at a badge,

and these are all so basic I am somewhat at a loss to understand

why we cannot have the assurance today that they are in fact

being implemented in all GSA regions for all Federal buildings.

Mr. SHINGLER. No. Absolutely, sir. I misunderstood what you

were asking. Yes, sir, that is happening. They have tightened up

security nationally. I misunderstood what you were talking about,

the holograms and one thing or another.

Mr. BARR. So as we sit here today can you assure us in the Congress and the American people that at least these specific steps

that we have identified here today as being deficiencies in Federal

building security are being addressed, have been addressed, and

will continue to be addressed properly?

Mr. SHINGLER. Yes, sir.

Mr. BARR. Ms. Sims.

Ms. SIMS. Absolutely.

Mr. BARR. We talked earlier about the different levels of security

for the Federal buildings, and we have pictures of the different

Federal buildings, at least five of them here in the Atlanta area.

What is the level of security for each one of these buildings?

Mr. SHINGLER. They are all Level 4 facilities.

Mr. BARR. And if you could just explain briefly what Level 4

means.

Mr. SHINGLER. The vulnerability assessment, the DOJ vulnerability assessment categorized virtually all Federal buildings in one

of five levels. Primarily the first four, 1 through 4, are the ones

that we deal with. The fifth level are those agencies such as the

Pentagon, or the CIA headquarters where they may employ their

own security requirements. But the 1 through 4 levels are based

on a variety of things, primarily how many people are in them, the

size of the building, the type of mission that goes on within the

building, the threat assessments that could happen, from the shopping center type of recruiting office all the way to a building of this

magnitude here in Atlanta. So that is where they range between

the 1 through 4 levels.

Mr. BARR. The buildings earlier, in your earlier investigation 2

years ago, Mr. Malfi, were they all Level 4 facilities?

Mr. MALFI. I believe a lot of those buildings were Level 5.

Mr. BARR. In other words, even a higher level of security and

vulnerability associated with them?

Mr. MALFI. That is correct.

Mr. LATOURETTE. Mr. Shingler, if I could just have one more sort

of housekeeping question, Mr. Barr was talking about where the

money comes for the Federal Protective Service, and it does come

from the Public Building side of GSA, and it is my understanding

that the tenants, for instance if the Internal Revenue Service is in

a GSA-operated building that they pay you so much per square foot

or whatever to provide security. Am I right about that?

38

Mr. SHINGLER. Yes, sir. For the most part there is an across-theboard charge, and each square foot of rent an X percent goes to security. And then there are building-specific charges that are added

onto that which in some cases there are multiple entrances that

they may want to have guards at, or anything that is above what

the basic security charge covers.

Mr. LATOURETTE. And GSA could by regulation—we have already I think said this—but GSA by regulation could require everybody that comes into this building to go through the magnetometer,

but you have chosen not to do that, you have chosen to leave it up

to the security committees.

Mr. SHINGLER. Yes, sir.

Mr. LATOURETTE. I think I would ask you to chat with Mr. Perry

and see if that could be reevaluated. But likewise are there lease

arrangements because not every building that you operate is a government-owned building, there are also leased buildings that you

lease on behalf of the government. Are there restrictions by landlords, or are there lease restrictions that somehow impede your

ability to protect the men and women of the Federal work force and

the people that visit them?

Mr. SHINGLER. Balancing security with openness is a primary

issue that we are constantly addressing. One of our biggest challenges right now are leased facilities, but we are working closely

with the Interagency Security Committee to come up with a minimal standard to implement security in leased locations.

We are also working with organizations such as BOMA, Building

Owners and Managers Association, to come up with standards that

not only they can live with, but meet our needs of protecting our

government employees. So we are actively addressing those issues,

sir.

Mr. LATOURETTE. Are any of the buildings that we are talking

about today in Atlanta leased, or does the Federal Government own

them all?

Ms. SIMS. We own them all.

Mr. LATOURETTE. You own them all.

Ms. SIMS. Yes, sir.

Mr. LATOURETTE. Thank you very much.

Ms. SIMS. Excuse me, let me correct. The Sam Nunn Atlanta

Federal Center is a complex lease-to-own financial deal. At the end

of a period of time we will own that facility.

Mr. LATOURETTE. But do you currently on behalf of the Federal

agencies that are located there, do you lease it from someone at the

moment?

Ms. SIMS. Yes, sir.

Mr. LATOURETTE. OK. Are there any restrictions—I guess that is

what I want to get to—are there any restrictions in the lease that

prevent you or hinder you from engaging in the security that you

engage in in a wholly owned Federal building?

Ms. SIMS. At that facility no. That facility is operated as if it

were ours from a security stance.

Mr. LATOURETTE. Thank you very much.

Ms. SIMS. Sure.

Mr. BARR. The investigation, the undercover investigation that

took place in early March, and we have identified what I presume

39

we would all agree are serious security problems, the failure to look

at a badge, the ease with which somebody gets the badge based on

a false pretense that was not checked out, the additional volunteering of the designation to be able to carry firearms in, agents giving

an access code to these undercover agents without checking them

out properly, would everybody here agree that those things should

not have occurred?

Ms. SIMS. Yes, sir.

Mr. BARR. What specific steps—and were those problems, were

those errors made by both contract personnel and FPS employees?

Ms. SIMS. Employee singular, and contract employee singular.

Yes, sir.

Mr. BARR. And are there any limitations under which GSA or

FPS now operates that would prevent effective disciplinary action

being taken against either employees or contract personnel for

identified security lapses such as these?

Ms. SIMS. The contract employee referenced in the scenarios no

longer provides the service to the U.S. General Services Administration.

With respect to the GSA employee, that employee has been reprimanded.

Mr. BARR. Is that sufficient in your view? Are there—I guess I

am asking a more general question. Are there any limitations

under which you all have to operate now that would prevent you

in any way from taking what you believe is effective disciplinary

action against an employee that commits a serious error in security? Do you have sufficient authority?

Ms. SIMS. Yes, sir, we do.

Mr. BARR. Does that include termination of an employee?

Ms. SIMS. If it were deemed appropriate, yes, sir, it most definitely would include up to termination.

Mr. BARR. OK. And you do have the ability to terminate the services of a contractor similarly, and you have plenty of authority to

do that?

Ms. SIMS. Unilaterally and very quickly.

Mr. BARR. Thank you.

Do any of you all have anything additional that you would like

to add for the record today that we might not have gone over, or

to supplement anything that we have touched on today?

Mr. SHINGLER. We appreciate the opportunity to be here.

Mr. BARR. Thank you.

As I indicated—do you have anything else, Mr. LaTourette?

Mr. LATOURETTE. I do not. Thank you.

Mr. BARR. Counsel?

As I indicated, the record will be kept open for 10 days so that

if there are any additional materials that you would like to submit.

And let me ask just one final question I forgot. With regard to

followup measures, is this an ongoing process, Mr. Shingler or Ms.

Sims?

Mr. SHINGLER. We will constantly be following up, because weapons and terrorist activities have changed drastically. Hopefully we

will never be able to sit here and say we have done everything we

could do, because we will constantly adjust to that.

40

Mr. BARR. Now, we have purposely not gone into in this public

setting all of the details of the security breaches, which is good

both from the standpoint that we have not indicated a specific road

map or game plan that somebody could use, and I think people

would be shocked even at some of the details that we did not go

into here, the ease with which the security breaches were effectuated, but knowing, Mr. Shingler and Ms. Sims, as you do the full

details of this undercover investigation here, can you assure us

that if that same operation were carried out tomorrow it would

very clearly not succeed?

Mr. SHINGLER. Yes, sir, I can say that.

Mr. BARR. Ms. Sims.

Ms. SIMS. I am confident that we have taken the steps that we

need to take, and that we are continuing to take the daily iterative

steps that we need to protect the people and the properties, and

the daily visitors who frequent our facilities.

Mr. BARR. I mean this is not a trick question at all. I am just

wondering if as you sit here today you feel confident that if this

same type of operation were carried out tomorrow that it would not

succeed. Do you feel confident in that?

Ms. SIMS. As I said, I am confident in the fact that we have done

everything, and we continue to do everything to protect the people

and the properties.

What is a little bit frustrating is that with the state of technology

today is it difficult to discern fake identification.

Mr. BARR. No, it is not. I mean that is the whole point of this

hearing. I mean it is not. This is one that has the proper hologram,

this is one that is not. It is not difficult to tell that one does not

have the proper hologram and that one does.

Yes, there certainly other aspects of falsification of identification

that are much more difficult to discern, you are absolutely correct,

but the undercover operation that was effected here is something

that a high school student—I mean no insult to these gentlemen,

but they especially and consciously dumbed down their operation.

Is that correct, Mr. Malfi, that you sort of dumbed it down, you

used the lowest level of technology to thwart the security measures;

right?

Mr. MALFI. Correct. To duplicate the building passes, like I said,

we did not use anything that was sophisticated. We used something that was accessible to the general public.

I mean we could have—with the technology that is available to

us we could have duplicated these things very, very close to the

originals. That was not our intent. Our intent was to give basically

a fighting chance to show that if somebody paid attention to these

things it would have been detected.

Mr. BARR. And that is sort of my point, Ms. Sims, and I come

back to it again. I am not talking about the more sophisticated

measures that somebody might come up with and that we have to

be continually on guard against, just with regard to these most elementary measures that thwarted security measures at Federal

buildings here in Atlanta, can you give us your assurance that at

least this level of threat has been taken care of and if this type of

operation, not a more sophisticated one, and we hope the answer

would be the same for that, but just for this level of security breach

41

are there measures in place today so that if the same type of operation were attempted tomorrow you feel confident that it would not

succeed?

Ms. SIMS. Yes, sir, I am confident that the scenarios employed

would not meet with the success before, yes, sir.

Mr. BARR. OK. We appreciate very much the time and effort that

our witnesses from GAO put in in traveling down here, and we also

appreciate very much the swift response and continuing effort by

Mr. Shingler, Ms. Sims, and their colleagues and the other Federal

agencies in addressing these problems.

And with that I would like to thank Mr. LaTourette for traveling

here from the great State of Ohio today and being with us. I appreciate counsel and the committee staff for all of the preparatory

work here, and I hereby declare this hearing of the Government

Reform Committee closed.

[Whereupon at 11:55 a.m., the committee was concluded.]

[Additional information submitted for the hearing record follows:]

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

Æ