Homeland Security: Addressing Weaknesses with Facility Security Committees Would Enhance Protection of Federal Facilities
Published: 2010-08-05T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,225 full-time employees, and about 15,000 contract security guards. However, protecting federal facilities and their occupants from a potential terrorist attack or other acts of violence remains a daunting challenge for the Department of Homeland Security's (DHS) Federal Protective Service. GAO has issued numerous reports on FPS's efforts to protect the General Services Administration's (GSA) facilities. This report (1) recaps the major challenges we reported that FPS faces in protecting federal facilities and discusses FPS's efforts to address them and (2) identifies an additional challenge that FPS faces related to the facility security committees (FSC), which are responsible for addressing security issues at federal facilities. This report is based primarily on our previous work and recent FPS interviews.
section_title: What GAO Found
paragraphs: Since 2007, we have reported that FPS faces significant challenges with protecting federal facilities, and in response FPS has recently started to take steps to address some of them. In 2008, we reported that FPS does not use a risk management approach that links threats and vulnerabilities to resource requirements. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS's security goals, there is limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. FPS recently began implementing a new system referred to as the Risk Assessment Management Program (RAMP). This system is designed to be a central database for capturing and managing facility security information, including the risks posed to federal facilities and the countermeasures that are in place to mitigate risk. FPS expects that RAMP will enhance its approach to assessing risk, managing human capital, and measuring performance. Our July 2009 report on FPS's contract guard program also identified a number of challenges that the agency faces in managing its contract guard program, including ensuring that the 15,000 guards that are responsible for helping to protect federal facilities have the required training and certification to be deployed at a federal facility. In response to our report, FPS took a number of immediate actions with respect to contract guard management. For example, FPS has increased the number of guard inspections it conducts at federal facilities in some metropolitan areas and revised its guard training. We have not reviewed whether these actions are sufficient to fulfill our recommendations. Another area of continuing concern is that FPS continues to operate without a human capital plan and does not have an accurate estimate of its current and future workforce needs. In our July 2009 report, we recommended that FPS develop a human capital plan to guide its current and future workforce planning efforts. While FPS agreed with this recommendation, it has not yet fully developed or implemented a human capital plan. As we reported in 2009, FPS's ability to protect GSA facilities is further complicated by the FSC structure. Each FSC includes FPS, GSA, and a tenant agency representative and is responsible for addressing security issues at its respective facility and approving the funding and implementation of security countermeasures recommended by FPS. However, there are several weaknesses with the FSC. First, FSCs have operated since 1995 without procedures that outline how they should operate or make decisions, or that establish accountability. Second, the tenant agency representatives to the FSC generally do not have any security knowledge or experience but are expected to make security decisions for their respective agencies. Third, many of the FSC tenant agency representatives also do not have the authority to commit their respective organizations to fund security countermeasures. No actions have been taken on these issues since our 2009 report, and thus these weaknesses continue to result in ad hoc security and increased risk at some federal facilities.
section_title: What GAO Recommends
paragraphs: GAO recommends that the Secretary of DHS direct the Director of FPS to work in consultation with other representatives of the FSC to develop and implement procedures that, among other things, outline the committees' organization structure, operations, and accountability. DHS concurred with GAO's recommendation.

section_title: Letter
paragraphs: Protecting federal facilities and their occupants from a potential terrorist  attack or other acts of violence remains a daunting challenge for the  Department of Homeland Security’s (DHS) Federal Protective Service  (FPS). Since 2008, our work has shown that FPS has experienced  significant operational, management, and funding challenges that have  hampered its ability to protect the 9,000 federal facilities under the control  and custody of the General Services Administration (GSA). We have made  numerous recommendations to help FPS address these challenges, and  while DHS agreed with our recommendations, the majority of them have  not yet been fully implemented. See appendix I for a complete list of our  recommendations and their current status.
To assist Congress in its oversight of FPS, this report (1) recaps the major  challenges we reported that FPS faces in protecting federal facilities and  discusses actions FPS is taking to address them and (2) identifies an  additional challenge FPS faces related to the facility security committees  (FSC). Each FSC consists of representatives from each of the tenant  agencies in the federal facility and is responsible for addressing security  issues at their respective facility and approving the implementation of  security countermeasures recommended by FPS. This report is based  primarily on our previous work and recent interviews with FPS officials to  obtain the current status of planned initiatives. We conducted our work  from January 2010 through July 2010 in accordance with generally  accepted government auditing standards. Those standards require that we  plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings and conclusions based on our audit  objectives.
subsections: section_title: FPS Faces Challenges in Protecting Federal Facilities and Is Taking Some Actions to Address Them
subsections: section_title: FPS Has Begun to Develop a Risk Management Approach to Protecting Federal Facilities
paragraphs: In 2008, we reported that FPS does not use a comprehensive risk  management approach that links threats and vulnerabilities to resource  requirements. Without a risk management approach that identifies threats  and vulnerabilities and the resources required to achieve FPS’s security  goals, there is only limited assurance that programs will be prioritized and  resources will be allocated to address existing and potential security  threats in an efficient and effective manner. FPS uses a facility-by-facility  approach to risk management. Under this approach, FPS assumes that all  facilities with the same security level have the same risk regardless of their  location. For example, a level IV facility in a metropolitan area is generally  treated the same as one in a rural area. We also reported in 2008 that  FPS’s approach does not include a process for examining comprehensive  risk across the entire portfolio of GSA’s facilities. Both our and DHS’s risk  management frameworks include processes for assessing comprehensive  risk across assets in order to prioritize countermeasures based on the  overall needs of the system. FPS’s building-by-building approach, however,  prevents it from comprehensively identifying and prioritizing  vulnerabilities and making countermeasure recommendations at a  strategic level.
Over the years we have advocated the use of a risk management approach  that links threats and vulnerabilities to resource requirements and  allocation. A risk management approach entails a continuous process of  managing risk through a series of actions, including setting strategic goals  and objectives, assessing risk, allocating resources based on risk,  evaluating alternatives, selecting initiatives to undertake, and  implementing and monitoring those initiatives. Risk assessment, an  important element of a risk management approach, helps decision makers  identify and evaluate potential risks so that countermeasures can be  designed and implemented to prevent or mitigate the effects of the risks.
In response to our recommendations in this area, FPS began developing a  new system referred to as the Risk Assessment Management Program  (RAMP). This system is designed to be a central database for capturing  and managing facility security information, including the risks posed to  federal facilities and the countermeasures in place to mitigate risk. FPS  also anticipates that RAMP will allow inspectors to obtain information  from one electronic source, generate reports automatically, enable FPS to  track selected countermeasures throughout their life cycle, address some  concerns about the subjectivity inherent in facility security assessments  (FSA), and reduce the amount of time inspectors and managers spend on  administrative work. FPS designed RAMP so that it will produce risk  assessments that are compliant with Interagency Security Committee  (ISC) standards, which, among other things, require risk assessment  methodologies to be credible, reproducible, and defensible and for FSAs  to be done every 3 to 5 years. According to FPS, RAMP is also compatible  with the risk management framework set forth by the National  Infrastructure Protection Plan (NIPP), and consistent with the business  processes outlined in the memorandum of agreement with GSA.
According to FPS, RAMP will support all components of the FSA process,  including gathering and reviewing building information; conducting and  recording interviews; assessing threats, vulnerabilities, and consequences  to develop a detailed risk profile; recommending appropriate  countermeasures; and producing FSA reports. FPS also plans to use RAMP  to track and analyze certain workforce data, contract guard program data,  and other performance data, such as the types and definitions of incidents  and incident response times. Currently, FPS is in the process of  implementing the first phase of RAMP and plans to have it fully  implemented by the end of 2011. We are reviewing the design and  implementation of RAMP and will provide Congress with a final report  next year.
section_title: FPS Has Taken Some Steps to Improve Oversight of the Contract Guard Program
paragraphs: We reported in July 2009 and April 2010 that FPS faces challenges in  ensuring that many of the 15,000 contract security guards that FPS relies  on to help protect federal facilities have the required training and  certification to be deployed at federal facilities. We also identified  substantial security vulnerabilities related to FPS’s guard program. Each  time they tried, in April and May 2009, our investigators successfully  passed undetected through security checkpoints monitored by FPS’s  guards, with the components for an improvised explosive device  concealed on their persons at 10 level IV facilities in four major  metropolitan areas. FPS also took a number of immediate actions to  address concerns raised about contract guard management in our July  2009 contract guard report. For example, since July 2009, FPS has  increased its penetration tests in some regions and the number of guard  inspections it conducts at federal facilities in some metropolitan areas.  FPS currently requires its inspectors to complete two guard inspections a  week at level IV facilities. Prior to this new requirement, FPS did not have  a national requirement for guard inspections, and each region we visited  had requirements ranging from no inspections to five inspections per  month per FPS inspector. FPS is also in the process of providing  additional X-ray and magnetometer training in response to our July 2009  testimony. FPS anticipates that guards will be fully trained by the end of  2010. Under FPS’s revised training program, inspectors must receive 30  hours of X-ray and magnetometer training and guards must receive 16  hours. Prior to this revision, guards needed 8 hours of training on X-ray  and magnetometer machines. However, despite these changes, we remain  concerned about FPS’s oversight of the contract guard program and made  recommendations for additional improvements in our April 2010 report.  For example, we reported that despite FPS’s recent actions, guards were  continuing to neglect or inadequately perform their assigned  responsibilities. We also remained concerned that FPS had not acted  diligently in ensuring the terms of its guard contract and taken  enforcement action when noncompliance occurred. Thus, we  recommended, among other things, that FPS identify other approaches  that would be cost-beneficial for protecting federal facilities. FPS agreed  with this recommendation but has not yet implemented it.
section_title: DHS Transferred FPS to NPPD
paragraphs: We have reported on several issues related to locating FPS within DHS’s  Immigration and Customs Enforcement (ICE). For example, we reported  in 2008 that some of FPS’s operational and funding challenges stemmed  from it being part of ICE. In October 2009, to enable FPS to better focus on  its primary facility protection mission, the Secretary of Homeland Security  transferred FPS from ICE to the National Protection and Programs  Directorate (NPPD). According to DHS, transferring FPS to NPPD will  enhance oversight and efficiency while maximizing the department’s  overall effectiveness in protecting federal buildings across the country. We  are reviewing the transition of FPS into NPPD and will provide Congress  with a final report in 2011.
section_title: Several Key Workforce Issues Remain Unresolved
paragraphs: FPS has yet to fully ensure that its recent move to an inspector-based  workforce does not hinder its ability to protect federal facilities. In 2007,  FPS essentially eliminated its police officer position and moved to an all-  inspector-based workforce. FPS also decided to place more emphasis on  physical security activities, such as completing FSAs, and less emphasis on  law enforcement activities, such as proactive patrol. We reported in 2008  that these changes may have contributed to diminished security and  increases in inspectors’ workload. Specifically, we found that when FPS is  not providing proactive patrol at some federal facilities, there is an  increased potential for illegal entry and other criminal activity. For  example, in one city we visited, a deceased individual had been found in a  vacant GSA facility that was not regularly patrolled by FPS.
Under its inspector-based workforce approach, FPS will rely more on local  police departments to handle crime and protection issues at federal  facilities. However, at about 400 federal facilities across the United States,  the federal government has exclusive jurisdiction, and it is unclear if local  police have the authority to respond to incidents inside those facilities.  Additionally, FPS has not entered into any memorandums of agreement  for increased law enforcement assistance at federal facilities. In most of  the cities we visited, local law enforcement officials said they would not  enter into any agreements with FPS that involve increased responsibility  for protecting federal facilities because of liability concerns, existing  shortages of staff, and the need to respond to crime in their cities that  would make it difficult to divert resources from their primary mission. For  example, local law enforcement officials from one location we visited said  they are significantly understaffed and overburdened with their current  mission and would not be able to take responsibility for protecting federal  facilities. We believe that it is important that FPS ensure that its decision  to move to an inspector-based workforce does not hamper its ability to  protect federal facilities. We recommended in 2008 that FPS clarify roles  and responsibilities of local law enforcement agencies in responding to  incidents at GSA facilities. While FPS agreed with this recommendation,  FPS has decided not to pursue agreements with local law enforcement  officials, in part because of reluctance on the part of local law  enforcement officials to sign such agreements. In addition, FPS believes  that the agreements are not necessary because 96 percent of the  properties in its inventory are listed as concurrent jurisdiction facilities  where both federal and state governments have jurisdiction over the  property. Nevertheless, we continue to believe that these agreements  would, among other things, clarify roles and responsibilities of local law  enforcement agencies when responding to crime or other incidents.
While FPS has recently increased the size of its workforce as mandated by  Congress, we reported in our 2009 report that FPS has operated without a  human capital plan. We recommended that FPS develop a human capital  plan to guide its current and future workforce planning efforts. We have  identified human capital management as a high-risk issue throughout the  federal government, including within DHS. Without a long-term strategy  for managing its current and future workforce needs, including effective  processes for hiring, training, and staff development, FPS will be  challenged to align its personnel with its programmatic goals. FPS  concurred with this recommendation and has drafted a workforce analysis  plan but has not yet fully developed or implemented a human capital plan.
section_title: Appropriate Funding Mechanism Has Not Been Determined
paragraphs: FPS’s primary means of funding its operations—the basic security fee  charged to some federal agencies—does not account for a building’s level  of risk, the level of service provided, or the cost of providing those  services. We reported in 2008 that this issue raises questions about  whether some federal agencies are being overcharged by FPS. FPS also  does not have a detailed understanding of its operational costs, including  accurate information about the cost of providing its security services at  federal facilities with different risk levels. Without this type of information,  FPS has difficulty justifying the rate of the basic security fee to its  customers. We have found that by having accurate cost information, an  organization can demonstrate its cost-effectiveness and productivity to  stakeholders, link levels of performance with budget expenditures,  provide baseline and trend data for stakeholders to compare performance,  and provide a basis for focusing an organization’s efforts and resources to  improve its performance. In addition, FPS’s fee-based funding system has  not always generated sufficient revenue to cover its operational costs. In  2007 we reported that FPS’s collections fell short of covering its projected  operational costs, and the steps it took to address the projected shortfalls  reduced staff morale, increased attrition rates, and diminished security at  some GSA facilities. FPS has yet to evaluate whether its fee-based system  or an alternative funding mechanism is most appropriate for funding the  agency as we recommended in our 2008 report. FPS agreed with our  recommendation and has taken some action, including the development  and implementation of an Activity Based Cost framework. We are  assessing FPS’s efforts in this area as part of our ongoing review of FPS’s  fee-base structure and will provide Congress with a final report in 2011.
section_title: FPS Faces Limitations in Assessing Its Performance
paragraphs: We have reported that FPS is limited in its ability to assess the  effectiveness of its efforts to protect federal facilities. To determine how  well it is accomplishing its mission to protect federal facilities, FPS has  identified some output measures. These measures include determining  whether security countermeasures have been deployed and are fully  operational, the amount of time it takes to respond to an incident, and the  percentage of FSAs completed on time. While output measures are helpful,  outcome measures are also important because they can provide FPS with  broader information on program results, such as the extent to which its  decision to move to an inspector-based workforce will enhance security at  federal facilities or help identify the security gaps that remain at federal  facilities and determine what action may be needed to address them.
In addition, FPS does not have a reliable data management system that  will allow it to accurately track these measures or other important  measures such as the number of crimes and other incidents occurring at  GSA facilities. Without such a system, it is difficult for FPS to evaluate and  improve the effectiveness of its efforts to protect federal employees and  facilities, allocate its limited resources, or make informed risk  management decisions. For example, weaknesses in one of FPS’s  countermeasure tracking systems make it difficult to accurately track the  implementation status of recommended countermeasures such as security  cameras and X-ray machines. Without this ability, FPS has difficulty  determining whether it has mitigated the risk of federal facilities to crime  or a terrorist attack. FPS concurred with our recommendations and states  that its efforts to address them will be completed in 2012 when its  automated information systems are fully implemented.
section_title: Facility Security Committee Structure Hampers Protection of Federal Facilities
paragraphs: FPS’s ability to protect federal facilities under the control or custody of  GSA is further complicated by the FSC structure. The Department of  Justice’s 1995 Vulnerability Assessment of Federal Facilities guidelines  directed GSA to establish a FSC in each federal facility under its control.  FSCs have experienced several issues that may have increased the risk at  some federal facilities. For example, FSCs have operated since 1995  without guidelines, policies, or procedures that outline how they should  operate, make decisions, or establish accountability. This results in ad hoc  security that undermines effective protection of individual facilities as well  as the entire facilities’ portfolio.
Each FSC consists of a representative from each of the tenant agencies in  the facility and is responsible for addressing security issues at its  respective facility and approving the implementation of security  countermeasures recommended by FPS. After completing its FSAs, FPS  makes recommendations to GSA and tenant agencies for building security  countermeasures. For example, tenant agencies decide whether to fund  countermeasures for security equipment, and FPS is responsible for  acquiring, installing, and maintaining approved security equipment.  However, we reported in November 2009 that the tenant agency  representatives generally do not have any security knowledge or  experience but are expected to make security decisions for their  respective agencies. We also reported that some of the FSC tenant agency  representatives also do not have the authority to commit their respective  organizations to fund security countermeasures. Thus, when funding for  security countermeasures is needed, each federal tenant agency  representative that does not have funding authority must obtain approval  from his or her headquarters office. According to some FSC members, in  some instances funding for security countermeasures is not always  available because the request for funding is generally made after the  budget is formulated. In addition, while FPS, GSA, and tenant agencies are  responsible for some aspects of protecting federal facilities, it is unclear  who is the final arbiter or accountable for final decisions.
We reported in November 2009 that the FSC structure may not contribute  to effective protection of federal facilities for several reasons.
Some FSC members may not have the security expertise needed to make  risk-based decisions.
They may find the associated costs prohibitive.
Tenant agencies may lack complete understanding of why recommended  countermeasures are necessary because they do not receive an adequate  amount of information from FPS.
Moreover, we found some instances in 2008 and 2009 where the FSC  structure contributed to increased risk at some federal facilities. For  example, an FPS official in a major metropolitan area stated that over the  last 4 years inspectors have recommended 24-hour coverage at one high- risk facility located in a high-crime area multiple times; however, the FSC  was not able to obtain approval from all its members. In addition, several  FPS inspectors stated that their regional managers have instructed them  not to recommend security countermeasures in FSAs if FPS would be  responsible for funding the measures because there is not sufficient  funding in regional budgets to purchase and maintain the security  equipment. Moreover, at a different location, members of a FSC told us  that they met as needed, although even when they hold meetings, one of  the main tenant agencies typically does not participate. GSA officials  commented that this tenant adheres to its agency’s building security  protocols and does not necessarily follow GSA’s tenant policies and  procedures, which GSA thinks creates security risks for the entire  building.
ISC recently began to develop guidance for FSC operations, which may  address some of these issues. The committee, however, has yet to  announce an anticipated date for issuance of this guidance.
section_title: Conclusions
paragraphs: In response to our many recommendations, FPS has a number of ongoing  improvements that, once fully implemented, should enhance its ability to  protect the over 1 million federal government employees and members of  the public who visit federal facilities each year. In addition, FSCs have a  significant role in ensuring the effective protection of federal facilities;  however, they face a number of issues in carrying out their security  responsibilities. For example, they have operated without any procedures  since their creation in 1995, and efforts to develop guidance are  incomplete. Without specific guidance or procedures, FSCs have operated  in an ad hoc manner, and there is a lack of assurance that federal facilities  under the control and custody of GSA are effectively protected by FPS.  Moreover, no actions have been taken on these issues since we identified  them in our November 2009 report. As such, these weaknesses continue to  result in ad hoc security and increased risk at some federal facilities.  Therefore, we are making a recommendation for the Secretary of DHS to  address this matter.
section_title: Recommendation for Executive Action
paragraphs: GAO recommends that the Secretary of DHS direct the Under Secretary of  NPPD and the Director of FPS to work in consultation with GSA and ISC  to develop and implement procedures that, among other things, outline the  FSCs’ organizational structure, operations, decision-making authority, and  accountability.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for review and comment. DHS  concurred with the recommendation in this report. Regarding the status of  our recommendations listed in appendix I, FPS commented that it is  actively pursuing initiatives and implementing measures to address the  nine recommendations that we reported as not implemented. We believe  our characterization of FPS’s efforts to address our recommendations  reflects the data provided by FPS. We are also concerned that the steps  FPS described in its documents are not comprehensive enough to address  the recommendations that we reported as not implemented. For example,  regarding our recommendation to identify other approaches and options  that would be most beneficial and financially feasible for protecting  federal facilities, FPS states that it most recently coordinated with DHS’s  Science and Technology Directorate to better define requirements for the  next generation of security technology. However, we continue to believe  that given the challenges FPS faces with managing its contract guard  program, among other things, FPS needs to undertake a comprehensive  review of how it protects federal facilities. FPS has not provided us with  this type of analysis or information. We are also concerned about the  reliability of the preliminary data FPS used to evaluate whether its fee- based system or an alternative funding mechanism is appropriate to fund  the agency. We are currently reviewing the reliability of FPS’s Activity  Based Costing framework and will reassess FPS’s efforts to address this  recommendation at the end of our review. DHS’s comments are presented  in appendix II. DHS also provided technical clarifications, which we  incorporated into the report as appropriate.
We are sending copies of this report to appropriate congressional  committees, the Secretary of Homeland Security, and other interested  parties. In addition, the report will be available at no charge on GAO’s Web  site at http//www.gao.gov. If you have any questions about this report,  please contact me at (202) 512-2834 or or goldsteinm@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.
section_title: Appendix I: Status of GAO Recommendations to the Federal Protective Service
subsections: section_title: Homeland Security: Federal Protective Service’s Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact name above, Tammy Conquest, Assistant  Director; Jennifer Clayborne; Delwen Jones; and Susan Michal-Smith made  key contributions to this report.