Report to the Chairman, Special

Oversight Panel on Terrorism,

Committee on Armed Services,

House of Representatives

United States General Accounting Office

GAO

November 2002 COMBATING

TERRORISM

Actions Needed to

Guide Services’

Antiterrorism Efforts

at Installations

GAO-03-14
Page i GAO-03-14 Combating Terrorism

Letter 1

Results in Brief 3

Background 5

Services’ Antiterrorism Efforts Lack a Results-Oriented

Management Framework 7

Services Are Implementing Risk Management but Provide

Inadequate Oversight 10

DOD’s Combating Terrorism Funding Reports Do Not Clearly

Reflect Costs 12

Conclusions 15

Recommendations for Executive Action 17

Agency Comments and Our Evaluation 18

Appendix I Scope and Methodology 20

Appendix II Comments from the Department of Defense 23

Appendix III GAO Contacts and Staff Acknowledgments 26

Related GAO Products 27

Table

Table 1: Results-Oriented Management Framework Principles 7

Figures

Figure 1: DOD’s Combating Terrorism Funding for Fiscal Years

1999 to 2003 14

Figure 2: Estimated Personnel Costs as Part of Combating

Terrorism Funding for Fiscal Years 1999 to 2003 15

Contents
Page ii GAO-03-14 Combating Terrorism

Abbreviations

DOD Department of Defense

GAO General Accounting Office
Page 1 GAO-03-14 Combating Terrorism

November 1, 2002

The Honorable Jim Saxton

Chairman, Special Oversight Panel on Terrorism

Committee on Armed Services

House of Representatives

Dear Mr. Chairman:

After the September 11, 2001, terrorist attacks, domestic military

installations increased their antiterrorism measures1

 to their highest levels.

These measures were reduced in the weeks following the World Trade

Center and Pentagon attacks, but because of the persistent nature of the

threat, the antiterrorism posture at domestic installations remains at a

higher than normal level more than 1 year later. The Department of

Defense’s (DOD) budget request for fiscal year 2003 includes over

$10 billion for combating terrorism activities,2 which includes a substantial

increase in funding for antiterrorism measures to safeguard personnel and

strategic assets.

We previously examined the implementation of DOD’s antiterrorism

initiatives, and focused on the measures taken by domestic military

installations to reduce vulnerabilities last year. We reported that at the

departmental level, the antiterrorism efforts lacked critical management

elements, such as a strategic plan containing long-term goals and a

performance plan to measure results, assess progress, and identify

corrective actions.3

 To strengthen the management of the antiterrorism

 1

 Antiterrorism represents defensive measures used to reduce the vulnerability of

individuals and property to terrorist acts. Examples of defensive measures include

reducing the number of access points onto an installation, verifying the identity of

personnel entering installations, increasing security patrol activity at high-risk targets,

and issuing weapons to all security and law enforcement personnel.

2

 Antiterrorism constitutes only one of four combating terrorism categories. The other

three categories are counterterrorism (offensive measures taken to prevent, deter, and

respond to terrorism), consequence management (preparation for and response to a

terrorist attack), and intelligence support (collection, analysis, and dissemination of

terrorism-related information).

3

 See U.S. General Accounting Office, Combating Terrorism: Actions Needed to Improve

DOD Antiterrorism Program Implementation and Management, GAO-01-909

(Washington, D.C.: Sept. 19, 2001).

United States General Accounting Office

Washington, DC 20548
Page 2 GAO-03-14 Combating Terrorism

program, we recommended that DOD establish a management framework

containing these elements, which could then provide a vehicle to guide

resource allocations and measure the results of DOD’s improvement

efforts. DOD agreed with this recommendation and initiated steps to

develop the framework but temporarily suspended these efforts after the

terrorist attacks on September 11, 2001. The Department has recently

restarted these efforts.

If consistent with our previous recommendation, this forthcoming

Department-wide framework should represent a significant and important

shift in management focus—from measuring program activities and

processes to measuring program results. To supplement and support this

results-oriented approach, a comprehensive risk management process can

be an effective foundation for allocating antiterrorism resources. Risk

management is a systematic, analytical process to determine the likelihood

that a threat will harm individuals or physical assets and to identify actions

to reduce risk and mitigate the consequences of a terrorist attack. (More

detailed information on risk management appears in the background

section of this report.)

Because of the increased emphasis on and funding for DOD’s antiterrorism

efforts, you asked us to examine the management framework each military

Department has established to implement antiterrorism initiatives.

Accordingly, this report specifically focuses on the extent to which the

military services and selected commands (1) use a results-oriented

management framework to guide their antiterrorism efforts at domestic

installations4

 and (2) have established an effective risk management

approach to develop specific antiterrorism requirements. Because you also

asked us to examine how DOD reports combating terrorism funding, we

also reviewed funding trends and determined whether DOD’s annual

budget reports to Congress completely and accurately portray funding for

combating terrorism.

To accomplish this work, we obtained and reviewed documents, examined

the operations of the four services’ headquarters, examined the operations

of eight major service commands and reserve components, and

interviewed cognizant officials. Collectively, these eight commands have

 4 “Domestic” refers to the continental United States and excludes Alaska, Hawaii, and the

U.S. territories.
Page 3 GAO-03-14 Combating Terrorism

antiterrorism responsibilities for approximately 444 installations.5

Although the information we obtained at these commands cannot be

generalized to describe the Department’s overall antiterrorism efforts, it

provides insights into the antiterrorism programs within these commands.

Further information on our scope and methodology appears in appendix I.

For the most part, the service headquarters and commands we reviewed

did not use a comprehensive results-oriented management framework to

guide their antiterrorism efforts. For example, resource decisions

generally were not made with reference to specific, long-term goals, and

short-term measurable performance goals had not been set. However, 3 of

the 12 organizations included in our review—Air Force headquarters,

Army Forces Command, and the Navy’s Atlantic Fleet—did have some, but

not all, elements of a results-oriented management framework in place.

The Army Forces Command’s management framework appeared to be the

most complete, containing elements such as long-term and annual goals,

clear performance measures, quarterly reviews, and the identification of

resource requirements. The Forces Command’s framework also appeared

to have strong support from senior command officials, without which it

might not have been as fully implemented. According to service officials, a

comprehensive results-oriented management framework for antiterrorism

efforts is not consistently used across all services and commands because

DOD does not require it, and service officials indicated that they were

reluctant to develop such an approach before the forthcoming DOD-wide

antiterrorism strategy was issued. Although the Department has recently

restarted its efforts toward developing this strategy, it has not set a

specific time frame for its completion. Without a results-oriented

management framework at both DOD and the service levels to prioritize,

integrate, and evaluate antiterrorism initiatives, the services and

commands may not be efficiently allocating the significant resources

currently applied to antiterrorism efforts or effectively assessing progress

in safeguarding military personnel and assets.

The services and commands we reviewed are generally following

prescribed guidance and regulations to conduct risk management analyses

(i.e., terrorist threat, vulnerability, and asset criticality assessments) to

support their antiterrorism requirements, but significant weaknesses exist

 5

 The number of installations is based on information provided by the respective

commands.

Results in Brief
Page 4 GAO-03-14 Combating Terrorism

with the current approach. Each service has established requirements for

installations to use a risk management approach in developing funding

requirements and generally provided implementing guidance on preparing

the assessments; in addition, each command verified that assessments

have been completed. However, weaknesses exist in the services’

oversight of this process. Specifically, the commands do not always

require documentation of the assessments, and they do not periodically

evaluate the assessment methodology used at each installation to

determine the thoroughness of the analyses or the consistency with

required assessment methodology. If the services and commands do not

evaluate installation assessments and do not require the documentation

of all assessments, then they have no assurance that installations’

antiterrorism requirements are based on a rigorous application of risk

management principles or that these assessments produce comparable

results across a service. Consequently, when the services consolidate their

antiterrorism requirements, the result may not accurately reflect the most

pressing needs.

DOD has reported that $32.1 billion has been allocated or requested for

combating terrorism activities from fiscal year 1999 through fiscal year

2003; however, these reported amounts may not present a clear picture of

total combating terrorism costs. Our analysis indicates that $19.4 billion

(60 percent) of this amount is for military and civilian personnel and

personnel-related operating costs associated with individuals in

designated specialties that have combating terrorism-related missions,

such as military police, civilian police, and security guards. This allocation

may overstate actual combating terrorism costs, however, because the

military services accounting systems do not track the actual time that

these individuals spend on activities related to combating terrorism.

Consequently, the total funding allocated to these personnel specialties

are included in the report, even if the individuals spend only a portion of

their time performing combating terrorism activities.

We are recommending that DOD accelerate its efforts to develop a

Department-wide strategy, set a target date for its completion, and work

with the military services to concurrently initiate steps to adopt a

results-based management framework for their antiterrorism efforts

that is consistent with this Department-wide approach. We also are

recommending that the services take steps to improve their risk

management approaches that underpin antiterrorism requirements.

Additionally, we are recommending that steps be taken to clarify DOD’s

combating terrorism budget report provided to Congress. In written

comments on a draft of this report, DOD agreed with all of our
Page 5 GAO-03-14 Combating Terrorism

recommendations and it identified actions that are under way at the

Department to address these recommendations.

DOD issued a directive6 signed by the Deputy Secretary of Defense that

provides DOD’s antiterrorism policy and assigns responsibilities to DOD

organizations for implementing antiterrorism initiatives. This directive

places responsibility for developing antiterrorism policy and guidance

with the Office of the Assistant Secretary of Defense for Special

Operations and Low-Intensity Conflict.7

 In this capacity, the

Assistant Secretary of Defense issued an instruction that established

31 antiterrorism standards that DOD organizations, including the services,

are required to implement.8, 9

 These standards address antiterrorism

planning, training requirements, physical security measures, and related

issues. The office also issued a handbook containing additional detailed

guidance on antiterrorism policies and practices, including guidance on

assessment methodology.10 The Joint Staff has also issued an installationplanning template to help installations prepare their antiterrorism plans. 11

Additionally, each of the services has issued regulations, orders and

instructions to implement the DOD guidance and establish its own specific

policies and standards. DOD and the services have recently revised some

of these key guidance documents, and others are now under revision.

 6

 DOD Directive 2000.12, DOD Antiterrorism/Force Protection Program, Apr. 13, 1999.

7

 The Assistant Secretary of Defense for Special Operations and Low Intensity Conflict

performs these duties under the Under Secretary of Defense for Policy.

8

 DOD Instruction 2000.16, DOD Antiterrorism Standards, June 14, 2001.

9

 The 31 antiterrorism standards in DOD Instruction 2000.16 also apply to the Office of the

Secretary of Defense, the Chairman of the Joint Chiefs of Staff, the combatant commands,

the Office of the Inspector General of the Department of Defense, defense agencies, and

field activities.

10 DOD Handbook O-2000.12-H, Protection of DOD Personnel and Activities Against Acts of

Terrorism and Political Turbulence, Feb. 19, 1993.

11 Joint Staff Antiterrorism Force Protection Installation Planning Template, July 1, 1998.

Background

DOD’s Antiterrorism

Policy and Guidance
Page 6 GAO-03-14 Combating Terrorism

The services assign responsibility for protecting installations from

terrorist attacks to installation commanders, who identify and prioritize

antiterrorism requirements. Installation commanders are to compose a

prioritized list of antiterrorism requirements from annual assessments of

threat, vulnerability, and the criticality of assets, which they submit to

their respective major commands. The major commands merge the

antiterrorism requirements from all of their installations, prioritize them,

and forward their integrated list to the service’s headquarters. Similarly,

the services merge and prioritize the antiterrorism requirements of their

major commands, and the consolidated list is then used as a basis for

funding decisions.

The required assessments of threat, vulnerability, and criticality of

assets form the foundation of each installation’s antiterrorism plan and

support a risk management approach to resource allocation. These

three assessments are designed to assess (1) the threats to the installation,

(2) the installation’s vulnerabilities, and (3) the installation’s

critical assets.

The threat assessment identifies and evaluates potential threats on the

basis of such factors as the threats’ capabilities, intentions, and past

activities. This assessment represents a systematic approach to identify

potential threats before they materialize. However, this assessment might

not adequately capture some emerging threats, even in cases where the

assessment is frequently updated. The risk management approach

therefore uses vulnerability and asset criticality assessments as additional

inputs to the risk management decision-making process.

A vulnerability assessment identifies weaknesses that may be exploited by

identified threats and suggests options that address those weaknesses.

For example, a vulnerability assessment might reveal weaknesses in an

installation’s access control system, its antiterrorism awareness

training, or how mission-critical assets such as fuel storage sites and

communications centers are protected. Teams of multidisciplinary experts

skilled in such areas as structural engineering, physical security, and

installation preparedness conduct these assessments.

A criticality assessment evaluates and prioritizes assets and functions to

identify which assets and missions are relatively more important to protect

from attack. For example, important communications facilities, utilities, or

major weapons systems might be identified as critical to the execution of

U.S. military war plans, and therefore receive additional protection.

Process for Developing

Services’ Antiterrorism

Requirements

DOD’s Risk Management

Approach
Page 7 GAO-03-14 Combating Terrorism

Criticality assessments provide information in order to prioritize resources

while at the same time, reducing the potential application of resources on

lower-priority assets.

The critical elements of a results-oriented management framework are

not being used by the services to guide their antiterrorism efforts. In

results-based management, program effectiveness is measured in terms of

outcomes or impact rather than outputs (i.e., activities and processes).

Results-oriented principles and elements, which we have derived from the

Government Performance and Results Act,12 are presented in table 1.

Benefits from a results-based management approach depend upon the

combined use of all eight of the critical elements that appear in the table.

These elements, when combined with effective leadership can provide a

management framework to guide major programs and activities.

Table 1: Results-Oriented Management Framework Principles

Principle Critical elements

Long-term goals—typically general in nature

that lay out what the agency wants to

accomplish in the next 5 years.

Strategies to be used—general methods the

agency plans to use to accomplish long-term

goals.

Strategic plan—defines the program’s

overall purpose, mission, and intent.

External factors—factors that may significantly

affect the agency’s ability to accomplish goals.

Performance goals—stated in objective

measurable form.

Resources—a description of the resources

needed to meet the performance goals.

Performance indicators—mechanisms to

measure outcomes of the program.

Evaluation plan—means to compare and report

on program results vs. performance goals.

Performance plan—describes detailed

implementation actions as well as

measurements and indicators of

performance.

Corrective actions—a list of actions needed to

address or revise any unmet goals.

Source: Government Performance and Results Act of 1993.

 12 P.L. 103-62. Congress enacted the Government Performance and Results Act in 1993 to

provide for, among other things, the establishment of strategic planning and performance

measurement in the federal government.

Services’

Antiterrorism Efforts

Lack a ResultsOriented Management

Framework
Page 8 GAO-03-14 Combating Terrorism

The critical elements of a results-oriented management framework were

largely absent in the antiterrorism efforts of three services’ headquarters

and at six of the eight commands we examined. Specifically, the services

have not published and disseminated unambiguous results-based, strategic

and performance goals for their antiterrorism efforts. Some service

antiterrorism officials did articulate broadly stated goals—such as

protecting personnel and material assets against terrorist attack, and

defeating terrorism—but these goals have not been endorsed and

disseminated by service headquarters as servicewide goals nor have the

services described how these goals will be achieved or how they intend to

evaluate results in terms of the goals. The Air Force, however, has taken

some steps toward a results-based management framework. For example,

it has published long-term goals and established service-level working

groups to evaluate the effectiveness of its antiterrorism program and

identify the actions needed to address or revise any unmet goals. Although

the Air Force has taken these positive steps, Air Force officials

acknowledge that the elements may not have been effectively articulated

servicewide so that installations can understand the “big picture” and how

all elements fit together. In fact, officials we contacted from Air Combat

Command and Air National Guard were not aware of the service-level

goals or performance-planning elements.

At the command level, a results-oriented management framework was

largely absent in the antiterrorism efforts of six of the eight major

commands we reviewed. For example, the Air Combat Command did not

have overarching antiterrorism goals for its 15 bases, although command

officials said that they planned to develop them. Also, the Army National

Guard has not issued antiterrorism goals for its 3,900 armories and

211 installations and has no plan to do so.

Two of the commands—the Army’s Forces Command and the Navy’s

Atlantic Fleet—adopted aspects of a results-oriented framework, and

officials said that they did so on their own initiative and without direction

from their parent service. The Army Forces Command management

framework contained most of the critical management elements, such as

quarterly reviews, long-term and annual goals, clear performance

measures, and identification of resource requirements. Army Forces

Command officials said that the results-based management approach

enables its senior officers to monitor the command’s progress toward its

short- and long-term goals and make necessary adjustments to the strategy

and resource allocation to accomplish these goals. Forces Command

officials attributed their management approach’s success, in large part, to

the involvement of senior command officials and their endorsement of
Page 9 GAO-03-14 Combating Terrorism

this management approach. According to Army headquarters

antiterrorism officials, the Forces Command management framework

has been an effective approach and may be useful as a model for other

major commands.

The Navy’s Atlantic Fleet Command also articulated long-term goals

and strategies to accomplish its antiterrorism goals. For example, the

fleet developed a plan of action to address security deficiencies that

were identified through assessments by establishing a database to

track deficiencies and identify trends. The fleet also linked resource

requirements to accomplish these steps and developed metrics to measure

results. According to the Atlantic Fleet officials we spoke with, however,

these strategies are not currently being used by the fleet to shape its

antiterrorism efforts because they are waiting for the Navy to issue

servicewide antiterrorism goals. Atlantic Fleet officials stated they wanted

to avoid having separate and different strategic plans for each command.

The services and their major commands cite two primary reasons for

not employing a results-based management framework to guide and

implement their antiterrorism efforts. First, the services do not want to

adopt goals and strategies that might prove inconsistent with DOD’s

forthcoming, Department-wide antiterrorism strategy. As discussed

earlier, the Department was in the process of developing an antiterrorism

strategy, but suspended its efforts after the attacks on the World Trade

Center and the Pentagon because of the pressing needs of the war on

terrorism. DOD officials have indicated that they have reinitiated their

efforts to develop a strategy but have not set a target date for their

completion. The second reason cited by service officials for not employing

a results-oriented management framework was that strategic planning and

performance planning called for by the Results Act applies to agencies and

not to specific efforts such as antiterrorism. We agree that the services and

major commands are not required by the Results Act to prepare strategic

plans and performance plans specific to their antiterrorism efforts.

Nonetheless, the Results Act offers a model for developing an effective

management framework to improve the likelihood of successfully

implementing initiatives and assessing results.

Without a results-based management approach to prioritize, integrate, and

evaluate their efforts, it will be difficult for the services and their major

commands to systematically plan and implement antiterrorism programs

or assess their progress in reducing the likelihood and impact of terrorist

attacks. It is crucial that the services identify and support those

efforts that are most likely to achieve long-term antiterrorism
Page 10 GAO-03-14 Combating Terrorism

goals because funding is not sufficient to eliminate or mitigate all

identified vulnerabilities.

The services and commands we reviewed are generally following

prescribed guidance and regulations to use the DOD risk management

approach in developing their installation antiterrorism requirements,

but a significant weakness exists with the oversight of this process.

Specifically, the services are not required to evaluate the thoroughness

of all installations’ annual risk management assessments or whether

installations used required methodologies to perform these assessments.

As previously discussed, under DOD’s antiterrorism approach, three

assessments (threat, vulnerability, and criticality) provide the

installation commanders with the information necessary to manage the

risk of a terrorist attack, and develop an antiterrorism program for the

installation.13 It also provides guidance for completing these assessments;14

and it requires the military Departments, through the services, to oversee

the antiterrorism efforts at their installations.15 In their oversight role, the

military Departments, through the services, are required to ensure that

installation antiterrorism efforts adhere to the antiterrorism standards

established by DOD.16

To implement DOD’s required risk management approach, the services

have issued supplements to DOD’s guidance requiring installations to

conduct the three risk management assessments and indicating how these

assessments should be performed. The supplemental guidance of three of

the services—the Army, Air Force, and the Marine Corps—requires

service-specific methodologies to be used for the assessments.17 The

commands, to which the services have delegated some oversight

responsibility for installations’ antiterrorism efforts, generally verified that

installations completed annual threat, vulnerability, and asset criticality

assessments. Command officials indicated that they verify whether

 13 DOD Instruction 2000.16, para. E3.1.1.15 also calls for an assessment of incident

deterrence and response capabilities.

14 See DOD Handbook O-2000.12-H, para. E3.1.1.5, E3.1.1.15, and E3.1.1.15.4.

15 See DOD Directive 2000.12, para. 5.9.

16 See DOD Directive 2000.12, para. 5.9.12.

17 Toward the end of our review, the Marine Corps issued instructions on how installations

are to perform their assessments.

Services Are

Implementing Risk

Management but

Provide Inadequate

Oversight
Page 11 GAO-03-14 Combating Terrorism

installations’ annual risk assessments have been completed in one of

two ways: (1) through the request for and receipt of copies of the written

assessments or (2) through verbal verification from the installation

commanders. The Navy, however, does not require that annual

vulnerability assessments be documented and does not verify that these

assessments are completed.

To provide oversight of the risk management process, DOD’s antiterrorism

standards require a higher headquarters review of subordinate

installations’ antiterrorism programs once every 3 years for installations

that meet specific criteria.18 These reviews are conducted by teams of

specialists skilled in various disciplines (such as engineering, intelligence,

and security) from the Joint Staff, service headquarters, or major

command. The reviews assess, among other things, an installation’s

antiterrorism plans, physical security, vulnerabilities and solutions for

enhanced protection, and incident response measures. These reviews,

however, do not routinely evaluate the methodology used to develop the

annual installation assessments.19 Moreover, there is no requirement to

review the antiterrorism programs of installations that do not meet DOD’s

criteria for higher headquarters assessments.

Because the results of assessments form the foundation of installation

antiterrorism plans, which drive servicewide requirements, it is critical

that assessments be performed consistently across each service to ensure

that assessment results are comparable. According to DOD officials,

installations’ risk assessments were not evaluated for two reasons. First,

DOD does not specifically require the services and their commands to

evaluate installation assessments. Second, several command officials

indicated that evaluating assessment methodologies would provide little

or no added value to the process.

The Air Force and the Navy have initiatives under way that will place a

greater emphasis and importance on the results of the installations’

risk management efforts. Both services are using to varying degrees an

automated risk management program that should improve visibility over

 18 DOD Instruction 2000.16 requires a service-level review of DOD facilities with (1) at least

300 personnel, (2) an emergency response and physical security mission, or (3) contact

with local nonmilitary or foreign agencies at least once every 3 years.

19 In technical comments provided by the Air Force, officials stated that Air Force higher

headquarters reviews also include a review of annual installation assessments.
Page 12 GAO-03-14 Combating Terrorism

installation assessments and the resulting antiterrorism requirements. This

program—the Vulnerability Assessment Management Program—will

enable service and command officials to track assessment results and

prioritize corrective actions servicewide.20 The program will contain

information about installations’ antiterrorism requirements and the threat,

vulnerability, and asset criticality assessments that support these

requirements. It is also designed to allow service officials to conduct trend

analyses, identify common vulnerabilities, and track corrective actions.

Service officials stated that this program will also enable them to evaluate

the risk assessment methodologies used at each installation, but it is

unclear how this will be accomplished.

If installations’ risk assessments are not periodically evaluated to ensure

that assessments are complete and that a consistent or compatible

methodology has been applied, then commands have no assurance that

their installations’ antiterrorism requirements are comparable or based on

the application of risk management principles. Consequently, when the

services and commands consolidate their antiterrorism requirements

(through the process of merging and reprioritizing the requirements of

their multiple installations), the result may not accurately reflect the

services’ most pressing needs. For example, if a standard methodology is

not consistently applied, then vulnerabilities may not be identified and

critical facilities may be overlooked. Or in the case of the Navy, the lack of

assessment documentation further limits the command’s ability to perform

its oversight responsibility.

DOD has reported that $32.1 billion has been allocated or requested for

combating terrorism activities from fiscal year 1999 through fiscal year

2003; however, these reported amounts may not present a clear picture of

total combating terrorism costs. Each year, DOD is required to provide

Congress with a report on the funds allocated to combat terrorism

activities.21 DOD’s reported annual combating terrorism allocations have

risen from $4.5 billion in fiscal year 1999 to $10 billion in the fiscal year

2003 budget request. Significant uncertainty exists, however, regarding the

accuracy of these reported amounts because over half are associated with

 20 Both the Air Force and the Navy are requiring their installations to submit antiterrorism

requirements for fiscal year 2003 in the format prescribed by the Vulnerability Assessment

Management Program.

21 10 U.S.C. sec. 229.

DOD’s Combating

Terrorism Funding

Reports Do Not

Clearly Reflect Costs
Page 13 GAO-03-14 Combating Terrorism

personnel who may or may not be engaged in combating terrorism

activities full-time.

The National Defense Authorization Act for Fiscal Year 2000 requires

DOD to provide Congress with an annual consolidated budget justification

display that includes all of its combating terrorism activities and programs

and the associated funding.22 In response, DOD has submitted a separate

budget report for fiscal years 2001, 2002, and 2003 that portrays its

allocation of funds within the four categories of combating terrorism:

antiterrorism/force protection, counterterrorism, consequence

management, and intelligence support. The most recent budget report,

submitted to Congress in March 2002, includes the following: the

combating terrorism program descriptions and budget request estimates

for fiscal year 2003, the estimated budget for fiscal year 2002, and the

actual obligations for fiscal year 2001. It also reflects the funding

provided by the Defense Emergency Response Fund23 for fiscal years

2001 and 2002.24

If Congress passes the fiscal year 2003 budget request as submitted,

annual funding to combat terrorism will increase 122 percent from fiscal

year 1999 through fiscal year 200325—rising from $4.5 billion (actual

obligations) to $10 billion (budget request), including the Defense

Emergency Response Fund request for fiscal year 2003. (See fig. 1.) In

total, DOD reports that $32.1 billion has been allocated for combating

terrorism activities during this 5-year period. The dollar amounts shown in

figure 1 do not include funding for the current global war on terrorism,

such as military operations in Afghanistan, because these activities are not

intended to be included.

 22 P.L. 106-65, sec. 932, Oct. 5, 1999; 10 U.S.C. sec. 229.

23 The Defense Emergency Response Fund is DOD’s portion of the Emergency

Supplemental Appropriations of September 2001, which was approved immediately

following the attacks on the World Trade Center and the Pentagon.

24 The Defense Emergency Response Fund request for fiscal year 2003 was provided to

Congress in a separate budget justification book.

25 In terms of fiscal year 2002 dollars, which adjusts for inflation, this increase would be

105 percent.

DOD Is Required to Report

Its Funding Requirements

Annually

Funding for Combating

Terrorism Activities More

Than Double Over 5-Year

Period
Page 14 GAO-03-14 Combating Terrorism

Figure 1: DOD’s Combating Terrorism Funding for Fiscal Years 1999 to 2003

Source: GAO’s analysis of DOD’s combating terrorism budget reports.

Although not clearly identified in DOD’s budget reports, our analysis

estimates that $19.4 billion (60 percent) of the $32.1 billion combating

terrorism funding is for military ($14.1 billion) and civilian personnel and

personnel-related operating costs ($5.3 billion); however, this estimate

may be overstated. (See fig. 2.) In accordance with DOD’s Financial

Management Regulation,26 the Department’s combating terrorism costs

include funding for personnel in designated specialties that have

combating terrorism missions, such as military police, civilian police, and

security guards. The military services’ accounting systems do not track the

time that individuals in these specialties spend on activities related to

combating terrorism; therefore, the total personnel costs are reported

even if the individuals spend only a portion of their time performing

combating terrorism activities. The actual proportion of time these

 26 DOD 7000.14-R, Vol. 2B, Ch. 19, June 2000.

Reported Combating

Terrorism Funding May Be

Overstated
Page 15 GAO-03-14 Combating Terrorism

personnel spend between combating terrorism and unrelated activities

(such as counter drug investigations) varies, although all of these

personnel are available to perform combating terrorism duties

when needed.

Figure 2: Estimated Personnel Costs as Part of Combating Terrorism Funding for

Fiscal Years 1999 to 2003

Source: GAO’s analysis of DOD’s combating terrorism budget reports.

The $19.4 billion of estimated combating terrorism personnel costs

shown in figure 2 consists of military personnel costs of $14.1 billion

and estimated operation and maintenance civilian personnel costs of

$5.3 billion. Other components of the total $32 billion shown

include $4.3 billion from the Defense Emergency Response Fund

and $8.4 billion in other appropriations, including procurement,

research and development, and military construction.

Officials in the Office of the Assistant Secretary of Defense for Special

Operations and Low-Intensity Conflict recognize that improvements could

be made in the budget report for next year and plan to consider ways to

restructure its contents to include more summary information.

Funding for antiterrorism requirements has increased since fiscal year

1999, but it is widely recognized that vulnerabilities at military installations

will continue to outpace available funding. It is therefore essential that

Conclusions
Page 16 GAO-03-14 Combating Terrorism

funds be spent efficiently and effectively if the services are to achieve the

highest level of protection possible for military personnel, equipment, and

critical facilities and operations. Our analysis indicates that the military

services generally are not applying a results-oriented management

framework to guide their antiterrorism efforts, in part, because DOD does

not yet have a Department-wide antiterrorism strategy. Without a resultsoriented management framework to implement antiterrorism efforts and

monitor results, the services, military commanders, and Congress will not

be able to determine if past and future resources—which have been

significantly increased—are achieving their desired results in the most

efficient and effective manner.

The services and commands we reviewed are adhering to prescribed

policies and procedures and taking significant steps to improve their

capability to use a risk management approach. We identified a significant

weakness in the services’ current risk management approach, however,

which limits their ability to ensure that these methodologies are

consistently used. As a result, there is limited assurance that assessment

results—which ultimately drive funding allocations—have been achieved

through a consistent assessment process prescribed by DOD guidance.

This creates the potential that limited resources could be misapplied and

important opportunities to improve an installation’s force protection

posture could be overlooked.

The Department’s annual combating terrorism report to Congress

provides a detailed description of DOD funds allocated for combating

terrorism activities, but that report should be viewed with caution because

over half of the reported amounts are estimates that do not reflect actual

activities dedicated to combating terrorism. Consequently, as Congress

considers DOD’s budget requests and oversees DOD’s combating terrorism

activities, it may not have a clear picture of total costs incurred by DOD

for this purpose.
Page 17 GAO-03-14 Combating Terrorism

Because of the magnitude of the funds being allocated for, and the

importance of antiterrorism efforts within, DOD, we recommend that

simultaneous steps be taken within the Department to improve the

management framework guiding these efforts. Accordingly, to establish

a foundation for the services’ antiterrorism efforts, we recommend that

the Secretary of Defense (1) direct the Assistant Secretary of Defense

for Special Operations and Low-Intensity Conflict to accelerate and set a

target date to issue a Department-wide antiterrorism strategy that will

underpin each service’s efforts, and (2) work with each service to ensure

that its management framework is consistent with this Department-wide

strategy.

To improve the effectiveness of the services’ antiterrorism efforts,

we recommend that the Secretary of Defense direct the Secretaries of

the Army, Navy, and Air Force to adopt and effectively communicate a

results-oriented management framework, consistent with DOD’s overall

antiterrorism strategy, to guide each service’s antiterrorism efforts. This

framework should include the following:

A strategy that defines

• long-term antiterrorism goals,

• approaches to achieve the goals, and

• key factors that might significantly affect achieving the goals.

An implementation approach that provides

• performance goals that are objective, quantifiable, and measurable;

• resources to achieve the goals;

• performance indicators to measure outputs;

• an evaluation plan to compare program results with established goals; and

• actions needed to address any unmet goals.

To improve their risk management approach for identifying antiterrorism

requirements, we recommend that the Secretary of Defense direct the

Secretaries of the Army, Navy, and Air Force to require

• installation commanders to document all threat, vulnerability, and asset

criticality assessments and

• periodic higher headquarters evaluations of the methodologies used by

installations to conduct their threat, vulnerability, and asset criticality

assessments. Such an evaluation may be incorporated into the existing

Recommendations for

Executive Action
Page 18 GAO-03-14 Combating Terrorism

service-level review process; however, for those installations that are not

covered by this process, the services should develop an alternative

approach.

To clarify the annual consolidated budget justification display for

combating terrorism reported to Congress, we recommend that the

Secretary of Defense highlight the military and civilian personnel funding

included in the report and clearly indicate that these total personnel funds

are reported even though the individuals may spend only a portion of their

time performing combating terrorism activities.

DOD agreed with all of our recommendations and stated that it is

accelerating the development of an antiterrorism strategy and working

with the military services to ensure that a consistent approach is followed

across the Department. In commenting on this report, DOD said that it

would publish an antiterrorism strategic plan by January 2003 that

articulates strategic goals, objectives, and an approach to achieve them.

Moreover, DOD will require each service to develop its own antiterrorism

strategic plan that complements and supports the Department’s plan. DOD

also agreed to improve its risk management process for establishing

antiterrorism requirements. In its comments, DOD said that it is revising

guidance to validate the methodologies their installations use to

perform threat, vulnerability, and asset criticality assessments and the

thoroughness of these three assessments as part of regularly scheduled

antiterrorism program reviews. DOD agreed with our recommendation to

clarify how personnel costs that appear in the Department’s annual

combating terrorism funding report to Congress were calculated. In its

fiscal year 2004 combating terrorism funding report to Congress, DOD

plans to highlight the personnel costs and the methodology used to

determine them.

DOD officials also provided technical comments that we have

incorporated as appropriate. DOD’s written comments are reprinted in

their entirety in appendix II.

We are sending copies of this report to the Secretaries of Defense, the

Army, the Navy, and the Air Force; the Commandant of the Marine Corps;

and interested congressional committees. We will also make copies

available to others upon request. In addition, the report will be available at

no charge on the GAO Web site at http://www.gao.gov.

Agency Comments

and Our Evaluation
Page 19 GAO-03-14 Combating Terrorism

If you or your staff has any questions about this report, please contact me

at (202) 512-6020. Key contributors to this report are listed in appendix III.

Sincerely yours,

Raymond J. Decker, Director

Defense Capabilities and Management
Appendix I: Scope and Methodology

Page 20 GAO-03-14 Combating Terrorism

The scope of our study was limited to the antiterrorism preparedness of

Department of Defense (DOD) installations in the continental United

States. To perform our review, we contacted the antiterrorism offices for

each of the four military services, as well as two commands within each

service. We selected an active-duty command from each service that was

responsible for a large number of installations and that had a key role in

providing personnel and weapons systems for military operations.

Additionally, we selected a reserve command from each service because

they typically have smaller-sized installations than do active-duty

commands; consequently, a large number of them do not receive servicelevel reviews of their antiterrorism efforts.1

To determine whether the services use a results-oriented management

framework to guide their antiterrorism efforts, we met with Office of the

Secretary of Defense and service headquarters and command

antiterrorism officials, and reviewed their strategic-planning documents

for evidence of the critical elements of a strategic plan and performance

plan—as embodied in the Government Performance and Results Act of

1993. We also reviewed service- and command-specific documents, such

as campaign plans, operating orders, and briefing slides, which describe

and communicate the management structure of the services and

commands antiterrorism programs. We interviewed officials and gathered

relevant documentation for our review primarily from the following DOD

organizations located in the Washington, D.C., area:

• Assistant Secretary of Defense for Special Operations and Low-Intensity

Conflict.

• Headquarters, Department of the Army, Force Protection and Law

Enforcement Division, Antiterrorism Branch.

• Headquarters, Department of the Navy, Interagency Support and

Antiterrorism/ Force Protection Division.

• Headquarters, Department of the Air Force, Force Protection Branch,

Directorate of Security Forces.

• Headquarters, U.S. Marine Corps, Homeland Defense Branch, Security

Division.

 1

 DOD Instruction 2000.16 requires facilities with (1) at least 300 personnel, (2) an

emergency response and physical security mission, or (3) contact with local nonmilitary or

foreign agencies to receive a service-level review at least once every 3 years.

Appendix I: Scope and Methodology
Appendix I: Scope and Methodology

Page 21 GAO-03-14 Combating Terrorism

We also spoke with officials from the following commands, who provided

data on the number of domestic installations within their respective

commands.

• Army Forces Command, Atlanta, Georgia (number of installations = 11).

• Navy Atlantic Fleet, Norfolk, Virginia (number of installations = 18).

• Air Combat Command, Hampton, Virginia (number of installations = 16).

• Marine Forces Atlantic, Norfolk, Virginia (number of installations = 7).

• Army National Guard, Arlington, Virginia (number of installations = 165).

• Naval Reserve Force, New Orleans, Louisiana (number of installations =

116).

• Air National Guard, Arlington, Virginia (number of installations = 69).

• Marine Force Reserve, New Orleans, Louisiana (number of installations =

42).

To determine the extent to which the military services use risk

management analysis to develop antiterrorism requirements, we obtained

relevant documents and interviewed antiterrorism officials from the

organizations and commands previously listed as well as the following

organizations:

• Joint Staff Directorate for Combating Terrorism Programs and

Requirements, Washington, D.C.

• Air Force Security Forces Center, Lackland Air Force Base, San Antonio,

Texas.

We reviewed DOD as well as Joint Staff-, service-, and command-specific

regulations, orders, pamphlets, manuals, and other antiterrorism guidance

to determine whether organizations were required to perform the three

assessments (of threat, vulnerability, and asset criticality) that comprise

risk management to identify and prioritize antiterrorism requirements. We

also reviewed these documents for procedures and directions on how

these assessments are to be performed. We spoke with headquarters and

command officials about their involvement in overseeing how installations

identify antiterrorism requirements and about their process for merging,

reprioritizing, and funding these installation requirements. Additionally,

we spoke with Air Force and Navy headquarters officials as well as

officials from the Air Force Security Forces Center about the utility of the

Vulnerability Assessment Management Program for prioritizing and

tracking installation antiterrorism requirements servicewide.

To identify funding trends and determine if DOD accurately and

completely reports its combating terrorism funding to Congress, we
Appendix I: Scope and Methodology

Page 22 GAO-03-14 Combating Terrorism

obtained and analyzed the three annual combating terrorism activities

budget reports that cover fiscal years 1999 through 2003. We did not

independently verify the information contained in the funding reports,

although we did examine the methodology and assumptions that were

used to develop the information. We discussed how the budget report is

reviewed and consolidated with officials from the DOD Comptroller’s

Office, the Office for Special Operations and Low-Intensity Conflict, and

the Program Analysis and Evaluation Directorate. To determine if the

military services’ funding information is accurate and complete, we

interviewed budget officials responsible for compiling the information for

each service.

To estimate the combating terrorism personnel funding that appears in

figure 2, we analyzed 5 fiscal years of funding from the previously

mentioned combating terrorism budget reports. The $14.1 billion of

military personnel presented in the figure represents appropriations for

military personnel for combating terrorism. We estimated civilian

personnel funding by combining the four antiterrorism activities that

contain most of the operation and maintenance funds for personnel:

physical security management and planning, security forces and

technicians, law enforcement, and security and investigative matters.

DOD’s budget report does not distinguish civilian personnel funds from

the other funds contained in these activities; therefore, our estimate of

civilian personnel funds includes the nonpersonnel funds as well.

However, we believe that the estimate is appropriate on the basis of our

analysis of DOD’s budget report and discussions with DOD officials. We

could not determine the civilian personnel funds embedded in other

operation and maintenance activities and in research and development

activities and, therefore, did not include them in our estimate of personnel

funding.

We conducted our review from February through August 2002 in

accordance with generally accepted government auditing standards.
Appendix II: Comments from the Department

of Defense

Page 23 GAO-03-14 Combating Terrorism

Appendix II: Comments from the Department

of Defense
Appendix II: Comments from the Department

of Defense

Page 24 GAO-03-14 Combating Terrorism
Appendix II: Comments from the Department

of Defense

Page 25 GAO-03-14 Combating Terrorism
Appendix III: GAO Contacts and Staff

Acknowledgments

Page 26 GAO-03-14 Combating Terrorism

Ray Decker, (202) 512-6020

Bob Repasky, (202) 512-9868

In addition to those named above, Alan Byroade, J. Paul Newton,

Marc Schwartz, Corinna Wengryn, R. K. Wild, Susan Woodward, and

Richard Yeh made key contributions to this report.

Appendix III: GAO Contacts and Staff

Acknowledgments

GAO Contacts

Acknowledgments
Related GAO Products

Page 27 GAO-03-14 Combating Terrorism

Combating Terrorism: Department of State Programs to Combat

Terrorism Abroad. GAO-02-1021. Washington, D.C.: September 6, 2002.

Port Security: Nation Faces Formidable Challenges in Making New

Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002.

Combating Terrorism: Preliminary Observations on Weaknesses in

Force Protection for DOD Deployments Through Domestic Seaports.

GAO-02-955TNI. Washington, D.C.: July 23, 2002.

Combating Terrorism: Critical Components of a National Strategy to

Enhance State and Local Preparedness. GAO-02-548T. Washington, D.C.:

March 25, 2002.

Combating Terrorism: Key Aspects of a National Strategy to

Enhance State and Local Preparedness. GAO-02-473T. Washington, D.C.:

March 1, 2002.

Homeland Security: Challenges and Strategies in Addressing Short- and

Long-Term National Needs. GAO-02-160T. Washington, D.C.: November 7,

2001.

Homeland Security: A Risk Management Approach Can Guide

Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.

Combating Terrorism: Considerations for Investing Resources in

Chemical and Biological Preparedness. GAO-01-162T. Washington, D.C.:

October 17, 2001.

Homeland Security: Key Elements of a Risk Management Approach.

GAO-02-150T. Washington, D.C.: October 12, 2001.

Homeland Security: A Framework for Addressing the Nation’s Issues.

GAO-01-1158T. Washington, D.C.: September 21, 2001.

Combating Terrorism: Selected Challenges and Related

Recommendations. GAO-01-822. Washington, D.C.: September 20, 2001.

Combating Terrorism: Actions Needed to Improve DOD’s

Antiterrorism Program Implementation and Management. GAO-01-909.

Washington, D.C.: September 19, 2001.

Related GAO Products
Related GAO Products

Page 28 GAO-03-14 Combating Terrorism

Combating Terrorism: Comments on Counterterrorism Leadership and

National Strategy. GAO-01-556T. Washington, D.C.: March 27, 2001.

Combating Terrorism: Linking Threats to Strategies and

Resources. GAO/T-NSIAD-00-218. Washington, D.C.: July 26, 2000.

Combating Terrorism: Action Taken but Considerable Risks Remain for

Forces Overseas. GAO/NSIAD-00-181. Washington, D.C.: July 19, 2000).

Chemical and Biological Defense: Program Planning and Evaluation

Should Follow Results Act Framework. GAO/T-NSIAD-00-180. Washington,

D.C.: May 24, 2000.

Chemical and Biological Defense: Observations on Actions Taken

to Protect Military Forces. GAO/T-NSIAD-00-49. Washington, D.C.:

October 20, 1999.

Critical Infrastructure Protection: Comprehensive Strategy Can Draw

on Year 2000 Experiences. GAO/AIMD-00-1. Washington, D.C.: October 1,

1999.

Combating Terrorism: Need for Comprehensive Threat and Risk

Assessments of Chemical and Biological Attacks. GAO/NSIAD-99-163.

Washington, D.C.: September 7, 1999.

Combating Terrorism: Opportunities to Improve Domestic

Preparedness Program Focus and Efficiency. GAO/NSIAD-99-3.

Washington, D.C.: November 12, 1998.

Combating Terrorism: Threat and Risk Assessments Can Help

Prioritize and Target Program Investments. GAO/NSIAD-98-74.

Washington, D.C.: April 9, 1998.

Combating Terrorism: Efforts to Protect U.S. Forces in Turkey and the

Middle East. GAO/T-NSIAD-98-44. Washington, D.C.: October 28, 1997.

Combating Terrorism: Status of DOD Efforts to Protect Its Forces

Overseas. GAO/NSIAD-97-207. Washington, D.C.: July 21, 1997.

(350084)
The General Accounting Office, the investigative arm of Congress, exists to

support Congress in meeting its constitutional responsibilities and to help

improve the performance and accountability of the federal government for the

American people. GAO examines the use of public funds; evaluates federal

programs and policies; and provides analyses, recommendations, and other

assistance to help Congress make informed oversight, policy, and funding

decisions. GAO’s commitment to good government is reflected in its core values

of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is

through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and fulltext files of current reports and testimony and an expanding archive of older

products. The Web site features a search engine to help you locate documents

using key words and phrases. You can print these documents in their entirety,

including charts and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and

correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site

daily. The list contains links to the full-text document files. To have GAO e-mail

this list to you every afternoon, go to www.gao.gov and select “Subscribe to daily

E-mail alert for newly released products” under the GAO Reports heading.

The first copy of each printed report is free. Additional copies are $2 each. A

check or money order should be made out to the Superintendent of Documents.

GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a

single address are discounted 25 percent. Orders should be sent to:

U.S. General Accounting Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000

TDD: (202) 512-2537

Fax: (202) 512-6061

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800

U.S. General Accounting Office, 441 G Street NW, Room 7149

Washington, D.C. 20548

GAO’s Mission

Obtaining Copies of

GAO Reports and

Testimony

Order by Mail or Phone

To Report Fraud,

Waste, and Abuse in

Federal Programs

Public Affairs