Diplomatic Security: State Should Enhance Its Management of Transportation-Related Risks to Overseas U.S. Personnel
Published: 2016-10-04T00:00:00

Fast Facts:
Is State Department doing enough to keep U.S. personnel safe?
U.S. personnel overseas can be targets of terrorism, violence, and crime—particularly while in transit. From 1998 to 2015, State Department personnel were attacked more than 100 times while traveling outside of embassy compounds, with many of the worst attacks occurring while victims were in motorcades, official vehicles, or other forms of transportation.
State has taken steps to protect personnel in transit, but we found opportunities to enhance transportation policies, training, and communications, and made multiple recommendations to that end.

Highlights:
section_title: Why GAO Did This Study
paragraphs: U.S. diplomatic personnel posted overseas continue to face threats to their security. According to State, personnel and their families are particularly vulnerable when traveling outside the relative security of diplomatic work facilities or residences. In many serious or fatal attacks on U.S. personnel over the last three decades, victims were targeted while in motorcades, official vehicles, or otherwise in transit.
GAO was asked to review how State manages transportation-related security risks to U.S. diplomatic personnel overseas. For this report, GAO evaluated the extent to which State, with regard to transportation security at overseas posts, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time-sensitive information. GAO reviewed agency documents and met with key officials in Washington, D.C. GAO also reviewed policies from a judgmental sample of 26 posts—primarily higher-threat, higher-risk locations—and conducted fieldwork and met with officials at 9 of these posts. This is the public version of a sensitive but unclassified report issued in September 2016.
section_title: What GAO Found
paragraphs: The Department of State (State) has established policies related to transportation security for overseas U.S. personnel, but gaps exist in guidance and monitoring. GAO reviewed 26 posts and found that all 26 had issued transportation security and travel notification policies. However, policies at 22 of the 26 posts lacked elements required by State, due in part to fragmented implementation guidance on what such policies should include. State also lacks a clear armored vehicle policy for overseas posts and procedures for monitoring if posts are assessing their armored vehicle needs at least annually as required by State. These gaps limit State's ability to ensure that posts develop clear policies that are consistent with State's requirements and that vehicle needs for secure transit are met.
While State provides several types of training related to overseas transportation security, weaknesses exist in post-specific refresher training. Regional security officers (RSO) receive required training related to transportation security in special agent courses, and nonsecurity staff reported receiving relevant training before departing for posts—including on topics such as defensive driving and the importance of taking personal responsibility for one's security—as well as new arrival briefings at posts. At most of the 9 posts GAO visited, however, staff had difficulty remembering key details covered in new arrival briefings or described the one-time briefings as inadequate. State's requirements for providing refresher briefings are unclear, potentially putting staff at greater risk.
State uses various systems at overseas posts to communicate time-sensitive information related to transportation security, but several factors hinder its efforts. RSOs and other post officials are responsible for communicating threat information to post personnel. However, at 4 of the 9 posts it visited, GAO learned of instances in which staff did not receive important threat information in a timely manner for various reasons. In one case, this resulted in an embassy vehicle being attacked with rocks and seriously damaged while traveling through a prohibited area. In addition, while all 9 of the posts GAO visited require that personnel notify the RSO before traveling to certain locations, personnel at more than half of the 9 posts said they were unaware of these requirements or had difficulty accessing required travel notification systems. Timely communication is critical for managing transportation security risks, and failure to communicate important transportation-related information and receive such information promptly could leave overseas personnel facing avoidable security risks.
section_title: What GAO Recommends
paragraphs: GAO is making eight recommendations in this report to help State improve its management of transportation-related security risks by enhancing associated policies, guidance, and monitoring; clarifying its requirements for refresher briefings; and better communicating time-sensitive information. State agreed to take steps for all but one recommendation—the need to clarify its requirements for refresher briefings. GAO continues to believe this is needed as discussed in the report.

section_title: Letter
paragraphs: U.S. personnel at diplomatic and consular posts overseas continue to  face threats to their security, including numerous attacks in high-risk  locations in recent years. Travel routes of U.S. government employees  and their family members are particularly vulnerable to attack. From 1998  to 2015, more than 100 attacks targeted personnel in transit, including  officials en route to work facilities or their residences. Several of these  attacks resulted in fatalities. Similarly, in more than half of the 19 most  damaging attacks that led the Department of State (State) to convene  Accountability Review Boards (ARB) over the last 3 decades, victims  were attacked while in motorcades, official vehicles, or some other form  of transportation. These tragedies underscore the risks U.S. diplomatic  personnel and their families can face when traveling outside the relative  security of embassy and consulate compounds or their residences.
You asked us to review how State manages transportation-related  security risks to U.S. diplomatic personnel overseas, particularly in  higher-threat areas. For this report, we evaluated the extent to which  State, with regard to transportation security at overseas posts, has (1)  established policies, guidance, and monitoring; (2) provided personnel  with training; and (3) communicated time-sensitive information.
To address these objectives, we reviewed U.S. laws; State’s security  policies and procedures as found in the Foreign Affairs Manual (FAM),  Foreign Affairs Handbooks (FAH), and diplomatic cables; Bureau of  Diplomatic Security (DS) threat and risk ratings and periodic assessments  of post security programs; State budgetary documents; classified ARB  reports concerning transportation-related attacks; and past reports by  GAO, State’s Office of Inspector General, and the Congressional  Research Service. We also interviewed officials in Washington, D.C.,  from DS; State’s Bureau of Administration, Office of Inspector General,  and Office of Management Policy, Rightsizing, and Innovation; State  regional bureaus; the U.S. Agency for International Development; and the  Peace Corps. Additionally, we collected funding data and DS training  records for armored vehicle drivers, the reliability of which we assessed  by conducting checks for reasonableness and interviewing  knowledgeable officials to ask how the data are tracked and checked for  accuracy. We determined that the funding data we collected were  sufficiently reliable for the purposes of this engagement, and the  inaccuracies we found in the training records for armored vehicle drivers  are discussed in our findings.
In addition, we selected a judgmental sample of 26 posts for which we  collected post-level transportation security and travel notification policies,  among other documents. For security reasons, we are not naming the  specific posts. Our judgmental sample included three to five embassies or  consulates from each of State’s six geographic regions. In addition to  ensuring geographic coverage, we selected 22 posts that had relatively  high DS-established threat ratings while also choosing 4 posts with lower  threat ratings for comparison purposes. We evaluated the extent to which  these 26 posts’ policies contained key elements required by DS. We also  conducted fieldwork at 9 of the 26 posts. At the 9 posts we visited, we  conducted 13 focus groups with post personnel and also met with  regional security officers (RSO) and other officials involved in efforts to  provide transportation security for U.S. personnel. The findings from our  judgmental sample of 26 posts are not generalizable to all posts. We  assessed DS’s risk management practices against its own policies (see  Background for additional detail on these policies) and federal internal  control standards. See appendix I for a complete description of our  scope and methodology.
We conducted this performance audit from July 2015 to October 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
This report is a public version of a sensitive but unclassified report that  was issued on September 9, 2016, copies of which are available upon  request for official use only by those with the appropriate need to know.  This report does not contain certain information that State regarded as  sensitive but unclassified and requested that we remove. We provided  State a draft copy of this report for sensitivity review, and State agreed  that we had appropriately removed all sensitive but unclassified  information.
subsections: section_title: Background
paragraphs: Since the 1998 embassy bombings in East Africa, State has constructed  more than 100 new diplomatic facilities and enhanced security measures  at many others. Increased security at these facilities has raised concerns  that would-be attackers may shift their focus to more easily accessible  “soft targets”—places frequented by Americans and other Westerners, as  well as their transportation routes. According to State, U.S. government  employees and their families are most at risk on these transportation  routes. Many of the worst attacks on U.S. diplomatic personnel—including  10 of the 19 attacks that prompted State to convene ARBs—occurred  while victims were in transit. Among these was the 2004 murder of a U.S.  diplomat in Iraq, which led the resulting February 2005 ARB to find that  the diplomat’s death was almost certainly caused by his failure to follow  the post’s security policy. The February 2005 Iraq ARB report  consequently recommended several actions intended to increase post  personnel’s compliance with security policy and personal security  practices, which are discussed in more detail later in this report. Figure 1  shows the locations of the 10 transportation-related attacks that resulted  in the formation of ARBs, and figure 2 depicts an August 2008 attack  against the Principal Officer at the U.S. consulate general in Peshawar,  Pakistan, shortly after she left her residence.
According to State, transportation security overseas is a shared  responsibility involving various entities. As established by the 1961  Vienna Convention on Diplomatic Relations, the host nation is  responsible for providing protection to diplomatic personnel and  missions. In addition, as required by the Omnibus Diplomatic Security  and Antiterrorism Act of 1986, the Secretary of State, in consultation with  the heads of other federal agencies, is responsible for developing and  implementing policies and programs to protect U.S. government  personnel on official duty abroad, along with their accompanying  dependents. At posts abroad, chiefs of mission are responsible for the  protection of personnel and accompanying family members at the  mission. Further, as the February 2005 Iraq ARB noted, all mission  personnel bear “personal responsibility” for their own and others’  security.
Lead operational responsibility for transportation security overseas falls  on DS, which is responsible for establishing and operating security and  protective procedures at posts. For example, one division within DS  manages State’s armored vehicle program, while another manages a  contract used to provide transportation security in certain high- and  critical-threat locations. DS also evaluates the security situation at each  overseas post by assessing five types of threats—political violence,  terrorism, crime, and two classified categories—and assigning  corresponding threat levels for each threat type in the annually updated  Security Environment Threat List. The threat levels are as follows:  critical: grave impact on U.S. diplomats; high: serious impact on U.S. diplomats; medium: moderate impact on U.S. diplomats; and low: minor impact on U.S. diplomats.
At posts, DS agents known as RSOs, including deputy RSOs and  assistant RSOs, are responsible for protecting personnel and property.  Among other things, RSOs are responsible for issuing transportation  security and travel notification policies, providing security briefings to  newly arrived personnel, and communicating information about threats to  post personnel. According to State officials, RSOs at certain locations are  also responsible for managing the post’s fleet of armored vehicles, while  at other locations this responsibility is assumed by the general services  office as part of its management of the post’s overall vehicle fleet.
State’s policies are outlined in the FAM and corresponding FAH. Sections  of the FAM and FAH pertinent to transportation security include various  subchapters detailing, among other things elements that all security directives, including transportation-related  policies, are required to include;
State’s armored vehicle program; and personal security practices for employees to follow.
See table 1 for further details on selected FAM and FAH policies that are  relevant to transportation security. In addition to these policies, State has  produced other guidance documents, such as a checklist that outlines  criteria for DS reviewers to use when evaluating posts’ security policies  and programs, including those related to transportation security, and  cables that reiterate the recommendations of the February 2005 Iraq ARB  and the importance of good personal security practices.
State uses a variety of means to provide transportation security for U.S.  personnel posted overseas. These include, but are not limited to, the  following:
Armored vehicles. In fiscal years 2011 through 2016, State obligated  more than $310 million for armored vehicles, such as sport utility  vehicles, vans, and sedans.
Security contractors and bodyguards. Through the Worldwide  Protective Services contract, DS has hired private security contractors  to provide transportation security for diplomatic missions in certain  high- and critical-threat areas. State obligated more than $2.7 billion  for this contract in fiscal years 2011 through 2016. According to DS  officials, DS also uses host nation police, local guard force personnel,  U.S. government protective agents, or a combination of all three as  bodyguards in more than 100 countries worldwide. State obligated  more than $150 million for such bodyguards in fiscal years 2011  through 2016.
section_title: State Has Established Policies Related to Transportation Security, but Gaps Exist in Guidance and Monitoring
paragraphs: State has established policies related to transportation security for  overseas U.S. personnel, but gaps exist in guidance and monitoring. We  reviewed 26 posts and found that each had issued a transportation  security policy and a travel notification policy. However, the policies at 22  of the 26 posts were missing elements required by State, due in part to  fragmented guidance on what such policies should include. State also  lacks a clear armored vehicle policy for overseas posts and effective  procedures for monitoring whether posts are assessing their armored  vehicle needs at least annually, as required by State. These gaps limit  State’s ability to ensure that posts develop policies that are clear and  consistent with State requirements and that vehicle needs for secure  transit are met.
subsections: section_title: Post Transportation Security and Travel Notification Policies We Reviewed Consistently Lacked Key Elements
paragraphs: Federal internal control standards state that in order to enable personnel  to perform key roles in achieving agency objectives and addressing risks,  management should develop policies that outline personnel’s  responsibilities in a complete, accurate, and clear manner. DS  encourages every post to issue a transportation security policy and a  travel notification policy. Because DS requires that these policies be  issued as security directives, they are subject to criteria that apply to all  security directives. Specifically, the February 2005 Iraq ARB  recommended that all security directives include six elements intended to  emphasize the personal security responsibilities of all personnel under  chief-of-mission authority (see table 2). For example, the ARB report  recommended that security directives, among other things, identify the  consequences of violations and oblige all members of the mission to  report any known or suspected violations. After accepting these  recommendations, State promulgated them to all posts through multiple  cables as well as the FAM. DS requires all security directives to include  the six elements recommended by the February 2005 Iraq ARB.
According to DS, transportation security and travel notification policies are  required to include additional standard elements so that U.S. personnel  and their families are aware of the potential transportation-related security  risks they may face while at post. Specifically, transportation security  policies are required by DS to clarify, among other things, if the use of  public transit is permitted and whether any zones are off-limits to U.S.  personnel, while travel notification policies are required to ensure that  both official and personal travel are appropriately approved and  conducted with appropriate vehicles, escort, and notification.
Each of the 26 posts we reviewed had issued a transportation security  policy and a travel notification policy. We found that 4 posts had issued  policies that met all the required criteria while 22 posts had not.  Specifically, 20 of 26 were missing one or more of the six elements  required by DS in all security directives as recommended by the February  2005 Iraq ARB (see table 2), and 4 of 26 did not include all of the  standard transportation-related elements required by DS (see table 3).  Compliance with the standard transportation-related elements required  was significantly higher (85 percent of the posts we reviewed) than  compliance with the six elements required in all security directives as  recommended by the February 2005 Iraq ARB (23 percent of the posts  we reviewed).
Two key factors contribute to these shortcomings in posts' transportation  security and travel notification policies.
First, no single source of guidance for RSOs on transportation  security and travel notification policies lists all of the elements the  policies at the posts are required to contain. Specifically, DS has  produced multiple sources of guidance on what posts are to include in  transportation security and travel notification policies, but each source  covers a different set of requirements. For example, before a post  security evaluation is conducted, RSOs are given a copy of the  checklist used for the evaluation to help guide them in identifying and  complying with security program requirements. While the checklist  includes the standard transportation-related elements required by DS,  such as the use of public transit and restricted zones, it does not list  all of the elements required by DS in all security directives as  recommended by the February 2005 Iraq ARB—a potential reason  why the policies we reviewed were five times more likely to be missing  the ARB elements than the standard transportation-related elements.  By contrast, the FAM chapter on security directives contains the  February 2005 Iraq ARB criteria but does not list any of the standard  transportation-related elements required by DS. RSOs at 3 of the 9  posts we visited noted that it would be helpful if DS provided  examples of model policies to use as guidance. DS is in the process  of developing standard templates for certain security directives,  including transportation security and travel notification policies, but  this effort is not yet complete.
Second, DS’s monitoring of post transportation policies lacks any  additional guidance to ensure that reviewers assess policies  consistently in order to identify any missing policy elements and  suggest corrective action. Specifically, we found that DS reviewers  lack a comprehensive set of criteria for evaluating posts’  transportation security and travel notification policies. DS officials told  us that DS reviewers are expected to look for the February 2005 Iraq  ARB criteria during their evaluations of post security directives, but as  noted earlier the checklist that DS reviewers use does not mention the  February 2005 Iraq ARB or list its criteria. Further, while DS officials  stated that security directives lacking the February 2005 Iraq ARB  criteria should receive lower scores, we found that several of the  posts’ transportation policies that were lacking these required  elements nevertheless received the highest possible score from DS  reviewers. In January 2016, DS updated the checklist reviewers use  to assess transportation security and travel notification policies by  adding a reference to the FAM section that lists the February 2005  Iraq ARB criteria. Although citing the relevant FAM section is helpful,  the checklist does not include all the actual requirements.
Due to these weaknesses in its guidance and monitoring, State has no  assurance that all of its posts are developing transportation-related  policies that are comprehensive and consistent with department policy.
section_title: State’s Armored Vehicle Policy for Overseas Posts Is Unclear, and DS Lacks Effective Monitoring Procedures to Ensure Posts Are Routinely Assessing Their Armored Vehicle Needs
paragraphs: As noted earlier, federal internal control standards state that agencies  should develop policies that outline responsibilities in a complete,  accurate, and clear manner to enable personnel to perform key roles in  achieving agency objectives and addressing risks. The FAH establishes  a minimum requirement for the number of armored vehicles at each post.  The FAH also states that post Emergency Action Committees (EAC) must  meet at least annually to discuss post armored vehicle programs and  requirements. According to the FAM, it is important that EACs provide  information on posts’ armored vehicle requirements to ensure there is  sufficient time to budget for the costs of such vehicles, including the extra  costs associated with armoring them.
We found that DS may not be meeting the first of these FAH  requirements, and EACs are not meeting the second requirement at  every post. With respect to the first requirement, DS officials initially  explained that under the FAH, every embassy and consulate is required  to have a certain number of armored vehicles, but we found that not every  consulate met this requirement as of May 2016. These potential  deficiencies exist in part because DS has not instituted effective  monitoring procedures to ensure that every embassy or consulate is in  compliance with the FAH’s armored vehicle policy.
Regarding the second requirement, DS officials in the armored vehicle  program office told us that they do not receive annual assessments of  post armored vehicle needs from all posts as required. This deficiency  exists because DS lacks a mechanism for monitoring whether EACs meet  at least annually to discuss their posts’ armored vehicle needs.  Furthermore, DS officials in the armored vehicle program office stated  that, unlike some other offices within DS and State’s regional bureaus,  their office cannot compel post officials to hold EACs because overseas  posts do not fall within their office’s chain of command. Without up-to-date  information on posts’ armored vehicle needs, State cannot be certain that  posts have the vehicles necessary to provide U.S. personnel and their  families with secure transportation. DS officials told us that the lack of  regular EAC assessment of the armored vehicle needs at each post also  creates procurement challenges for armored vehicles aside from those  used by chiefs of mission and principal officers, which the program office  proactively replaces as needed. For all other armored vehicles, individual  posts communicate their armored vehicle needs to the program office  throughout the year as these needs arise. As a result, the program office  orders vehicles in smaller numbers or waits until multiple orders come in,  according to DS officials. This leads to avoidable delays because less  urgent needs are not filled until the office receives enough requests to  justify processing an order. Urgent vehicle needs are processed  immediately, but DS officials told us this is inefficient because processing  an order for one or two vehicles requires the same investment of time as  a much larger request.
While DS is taking steps to address the lack of annual EAC assessment  of post armored vehicle needs, it is unclear if the planned steps will fully  address the problem. In May 2016, DS released a cable to all posts to  reiterate the annual requirement, and DS stated that it plans to work  through RSOs at post to ensure that EACs meet at least annually.  However, DS has not developed a mechanism to track whether the EACs  actually do so. According to DS officials, the program office is also  planning to develop a forecasting model to overcome some of the  obstacles related to the lack of regular assessment, but the accuracy of  this forecasting will ultimately depend on the timely submission of quality  information from posts.
section_title: State Provides Several Types of Transportation Security Training, but Weaknesses Exist in Refresher Training and State’s Tracking of Armored Vehicle Driver Training
paragraphs: State provides several types of training related to transportation security,  but weaknesses exist in post-specific refresher training and State’s  tracking of armored vehicle driver training. RSOs receive required training  related to transportation security in special agent courses, and  nonsecurity staff reported receiving relevant training before departing for  posts and new arrival briefings at posts. Staff at most of the posts we  visited either had difficulty remembering certain key details covered in the  new arrival briefings or described the one-time briefings as inadequate.  State lacks a clear requirement to provide periodic refresher briefings and  for post personnel to participate in such briefings, potentially putting them  at increased risk. Additionally, we found gaps or errors in State’s tracking  of armored vehicle driver training; State is taking steps to address these  problems.
subsections: section_title: RSOs and Other Post Personnel Receive Various Types of Transportation Security Training, but Weaknesses Exist in Post-Specific Refresher Training
paragraphs: Federal internal control standards state that appropriate training, aimed at  developing employee knowledge, skills, and abilities, is essential to an  agency’s operational success. It is vital that U.S. diplomatic personnel— including RSOs as well as nonsecurity staff—receive training on the  transportation-related security risks they may face overseas and how best  to manage them in order to facilitate mission-related outcomes while  protecting lives and property.
As table 4 shows, State provides a number of training courses, targeting  different audiences, that cover transportation security. For example,  RSOs receive training in various tactics related to transportation security  in the Basic Special Agent Course, which is required of all DS special  agents, as well as in other training courses, such as the High Threat  Operations Course (see fig. 3).
With respect to non-RSO personnel, one or more participants in most of  the focus groups we conducted mentioned that they had taken Foreign  Affairs Counter Threat training. According to State, by 2019, all personnel  posted overseas under chief-of-mission authority, with certain exceptions,  will be required to take this training regardless of where they are posted.  Foreign Affairs Counter Threat training covers several topics relevant to  transportation security, such as defensive driving, route analysis, and the  importance of taking personal responsibility for one’s security and varying  routes and times to reduce one’s predictability. Figure 4 shows examples  of transportation security-related elements of the Foreign Affairs Counter  Threat training.
Additionally, focus group participants stated that they had received new  arrival briefings from the RSO upon their arrival at post. According to the  FAM, new arrival briefings are to be comprehensive and are to acquaint  newly arrived personnel with the post’s “total security environment,”  including security requirements and procedures that are in effect, such as  travel notification requirements. Furthermore, participants are required  to affirm that they have received the briefing. However, participants in 10  of 13 focus groups either had difficulty recalling certain security policies  and requirements or described the one-time briefings as inadequate. For  example, some participants were unaware or unclear about specific  aspects of their post transportation security policy or travel notification  policy, while others said it can be challenging to remember the content of  the new arrival briefings, in part because staff are simultaneously  managing the process of moving and adjusting to a new post.  Additionally, some participants suggested that the one-time nature of the  briefings is not conducive to keeping staff informed of changes to security  requirements and procedures, particularly in locations with fluid security  environments.
State lacks a clear requirement for RSOs to provide periodic refresher  briefings and for post personnel to participate in such briefings. In part,  this may result from the FAM’s lack of clarity and comprehensiveness on  this matter. Specifically, the FAM states that RSOs must conduct  refresher briefings “periodically” at “certain posts where personnel live  under hostile intelligence or terrorist threats for long periods” but does not  define “periodically” or “long periods.” Furthermore, according to DS  officials, the FAM requirement does not extend to posts that face high  levels of crime or political violence, even though both types of threats can  pose risks to personnel in transit. Moreover, while there is a requirement  for post personnel to affirm that they have received new arrival briefings,  according to DS officials, there is no such requirement for affirming that  they have received refresher briefings. RSOs at some of the posts we  visited noted that they take steps to make updated briefings available to  staff, such as electronically posting updated briefing slides and having  regularly scheduled briefings open to all staff—not just new arrivals.  However, RSOs at those posts stated that it was not mandatory for staff  to view the updated slides or periodically attend the regularly offered  briefings.
DS headquarters officials commented that they believe most violations of  post transportation security and travel notification policies are  inadvertently committed by staff who have forgotten the information  conveyed in new arrival briefings. Without effective reinforcement of the  information that is covered in new arrival briefings, State cannot ensure  that staff and their families have the knowledge they need to protect  themselves from transportation-related security risks.
section_title: State Is Taking Steps to Address Gaps in Its Tracking of Armored Vehicle Driver Training
paragraphs: According to the FAM, RSOs must ensure that locally employed staff  assigned to drive armored vehicles for the chief of mission or principal  officer attend the DS Training Center’s armored vehicle driver training  course. This training covers topics such as emergency driving, attack  recognition, and evasive maneuvers, among others. In addition, RSOs  must ensure that these drivers take refresher training every 5 years  following the initial training. The FAM also requires that State  documentation be complete to the extent necessary to facilitate decision  making, and federal internal control standards similarly state that  managers should use quality information—information that is, among  other things, current, complete, and accurate—to make informed  decisions.
We found two problems in State’s tracking of armored vehicle driver  training, each of which State has either addressed or is taking steps to  address. First, DS officials who manage the course were unaware of the  existence of seven diplomatic and consular posts overseas and  consequently lacked information on whether those posts had drivers in  need of armored vehicle driver training. After we brought these seven  posts to their attention, DS course managers consulted with other  colleagues in DS and told us that they determined none of the seven  posts had untrained drivers. Second, DS officials verified that some of  State’s training records for armored vehicle drivers include inaccurate  information about the posts to which the drivers are assigned. For  example, DS course managers told us that, according to a database they  use to track students of the training course, seven drivers from a  particular post received training in fiscal years 2011 through 2015, but  State’s official training records show no drivers from that post as having  received training in that time period. A cognizant official stated that those  seven drivers instead appear in the records as being assigned to a  different post in the same country. When we asked about the cause of  these inaccuracies, the official explained that they were due to clerical  errors and stated that State will be taking steps to identify and correct  similar errors in the future.
section_title: Posts Use Various Systems to Communicate Time- Sensitive Information Related to Transportation Security, but Several Factors Can Hinder Their Effectiveness
paragraphs: State has a variety of systems for RSOs to communicate threat  information to personnel and for personnel to report travel plans to RSOs.  However, we found that several factors can inhibit the timely two-way  communication of threat information and travel plans between RSOs and  personnel. Timely communication is critical for managing transportation  security risks, and failure to communicate important transportation-related  information and receive such information promptly could leave overseas  personnel facing avoidable security risks.
subsections: section_title: Post Personnel Do Not Always Receive Transportation-Related Threat Information in a Timely Fashion
paragraphs: According to DS officials, RSOs are responsible for communicating  transportation-related threat information to post personnel. In addition, DS  officials stated that various other officials may be involved in the process  of communicating and receiving threat information at post, including  consular officers, information management officers, and senior post  officials, as well as post personnel themselves. For instance, according to  DS officials, post personnel are responsible for making their mobile phone  numbers available to RSOs so that they can receive text-based  messages about potential threats, and they are generally also responsible  for sharing threat information with their family members.
RSOs at the nine posts we visited told us they communicated  transportation-related threat information to post personnel through various  methods, such as post-issued radios, personal and official e-mail, text  messages to work and personal mobile phones, and phone trees.  However, we learned of instances at four of the nine posts in which  personnel did not receive important threat information in a timely manner.
For instance, at one of the posts we visited, the RSO sent a security  notice restricting travel along a specific road and warning that recent  violent protests in the area had resulted in injuries and even death, but  because the notice was sent exclusively to state.gov e-mail addresses,  some non-State personnel at the post did not receive it at the e-mail  address they regularly used and were unaware of the restriction. The  personnel subsequently traveled through the restricted area, resulting in  an embassy vehicle being attacked with rocks while on unauthorized  travel through the area. While no one was hurt, the vehicle’s front  windshield was smashed. The RSO told us that to avoid similar situations  in the future, he would add the personnel’s regularly used e-mail  addresses to his distribution list for security notices. At another post,  focus group participants stated that they did not receive any information  from the RSO or other post officials about the security-related closure of a  U.S. consulate in the same country and instead learned about the closure  from media sources. Participants in focus groups at two other posts  stated that threat information is often either obsolete by the time they  receive it or may not reach staff in time for them to avoid the potential  threats.
Several factors can lead to untimely receipt of transportation-related  threat information.
First, as in the example above, RSOs at three posts told us that they  send security notices exclusively to post personnel’s state.gov e-mail  addresses. However, officials who manage State’s e-mail system told  us that some non-State personnel do not have state.gov e-mail  addresses, and others who do may not check them regularly.
Second, DS has produced limited guidance for RSOs on how to  promote timely communication of threat information. By contrast,  consular officers, who are responsible for sharing threat information  with the nonofficial U.S. community at overseas posts, have detailed  guidance from the Bureau of Consular Affairs on how to do so. Among  other things, the guidance for consular officers encourages them to  use previously cleared language whenever possible and also includes  preapproved templates they can use for security-related messages.  No such detailed guidance exists for RSOs, according to DS officials.
Third, DS officials told us that staff, including RSOs, at some posts  mistakenly believe that in cases where threat information applies to  both official and nonofficial U.S. citizens and nationals, the RSO  cannot share the threat information with the official U.S. community  until consular officials have received approval to share the same  information with the nonofficial U.S. community—a clearance process  that can take as long as 8 hours. In April 2016, State completed an  update to the FAM that, according to DS officials, is intended to clarify  that RSOs’ sharing of threat information with the official U.S.  community should not be delayed by this clearance process.  However, because the update is found in a section of the FAM about  consular affairs—not diplomatic security—it is unclear if RSOs will  come across it in the course of their day-to-day duties. Acknowledging  this potential challenge, DS officials told us that an update to the  diplomatic security section of the FAM, which is currently under  review, will include a reference to the relevant consular affairs section  of the FAM.
Federal internal control standards direct agencies to select appropriate  methods of communication so that information is readily available to  intended recipients when needed; thus, it is critical that post personnel  receive timely information on emerging transportation security threats that  enables them to take appropriate mitigation steps. Likewise, as noted  earlier, RSOs are responsible for protecting personnel and property at  posts—a responsibility that includes communicating transportation-related  threat information to post personnel, according to DS officials. Without  timely communication of transportation-related security risks and timely  receipt of such information, post personnel may be less able to respond  to changing security environments and comply with the latest post  policies and directives, potentially putting them in harm’s way.
section_title: Personnel at Several Posts Reported Difficulty Using Travel Notification Systems or Were Unaware of Travel Notification Requirements
paragraphs: All nine of the posts we visited had post-specific travel policies requiring  personnel to notify the RSO—and in some cases to obtain approval— before traveling to certain locations. In addition to the travel notification  requirements specific to these posts, the FAM contains broader travel  notification requirements that apply to all personnel under chief of mission  authority at overseas posts, and federal internal control standards  emphasize the necessity of communication from personnel to  management in order to achieve agency objectives. Travel notifications  allow RSOs or other post officials to take actions to protect personnel,  such as prohibiting potential travel to dangerous or restricted areas,  providing appropriate security measures such as armored vehicles or  additional security briefings, adjusting residential security activities while  the occupant is away, and accounting for all post personnel in the event  of an emergency.
Personnel at more than half of the nine posts we visited cited difficulty  using travel notification systems or were unaware or unsure of their post’s  travel notification requirements. While three of the nine posts we visited  permit personnel to use e-mail or other means to inform the RSO of their  travel plans, the remaining six posts require personnel to complete an  official travel notification form that is only accessible through a State  information system called OpenNet. However, according to officials  responsible for managing State’s information resources, including  OpenNet, not all post personnel have OpenNet accounts. Specifically, all  State personnel at overseas posts have OpenNet accounts, but some  non-State agencies, such as the U.S. Agency for International  Development, typically only have a limited number of OpenNet account  holders at each post; some smaller agencies, such as the Peace Corps,  usually have none. One focus group participant from a non-State agency  told us that because she does not have an OpenNet account, her ability  to submit travel notifications as required depends on whether or not she is  able to find one of the few individuals at the post from her agency that  does have an OpenNet account. Similarly, the travel notification policy for  another post requires that post personnel use an OpenNet-based travel  notification system even though the policy explicitly acknowledges that  not all post personnel have OpenNet accounts.
Focus group participants at several posts we visited also stated that they  were unaware or unsure of their post’s travel notification requirements.  For example, one post we visited requires notifications for all overnight  travel, whether official or personal; however, at least one focus group  participant at the post believed that such notifications were optional. At  another post, focus group participants expressed confusion about which  destinations within the host country required advance notification to the  RSO. The RSO at that post described an incident in which post personnel  traveling to a permitted location mistakenly violated post travel policy  because their flight made a stop in a restricted area while en route to the  nonrestricted destination. Travel notification requirements are covered in  the security briefings personnel receive when they arrive at posts, but as  discussed earlier participants in many of our focus groups had difficulty  recalling certain key information covered in the new arrival briefings or  found the one-time briefings to be inadequate.
Advance notification of travel plans allows RSOs to act preemptively by  assessing the current security situation at a certain location and  determining whether to deny travel requests when conditions are  particularly dangerous or provide personnel with relevant threat  information or additional security resources—such as armored vehicles  and armed security teams. Without notifications, RSOs may not be aware  of travel plans and therefore may not take appropriate steps to protect  post personnel.
section_title: Conclusions
paragraphs: U.S. diplomatic personnel and their families face threats to their security  in numerous locations around the world. As many serious and even fatal  attacks over the last few decades have shown, personnel and their  dependents are especially vulnerable when traveling outside the relative  security of embassies, consulates, or residences. State has taken a  number of measures to enhance transportation security for personnel  overseas. For example, State provides security officials, post personnel,  and their spouses and dependents with various types of training on how  to avoid and counter transportation-related security risks. State also plans  to expand its Foreign Affairs Counter Threat training to a much broader  population over the next 3 years and has taken steps to emphasize that  personnel should take responsibility for their own security. However, a  variety of weaknesses in State’s implementation of its risk management  activities continue to put U.S. personnel at risk. Fragmented guidance,  insufficient monitoring of post-level transportation policies, and a lack of  clarity in State’s armored vehicle policy for overseas posts make it difficult  for State to ensure that measures necessary for protecting key personnel  are implemented consistently worldwide, and State has limited insight into  armored vehicle needs at some posts. In addition, State lacks an effective  means of reinforcing the training personnel receive upon arrival at post,  and the two-way sharing of threat and transportation-related information  between post security officers and personnel is not always timely. While  each of these shortcomings is of concern, in the aggregate, they raise  questions about the adequacy of security for U.S. personnel and their  families overseas. Until it addresses these issues, State cannot be  assured that the deadly threats U.S. personnel and their families may  face while in transit overseas are being countered as effectively as  possible.
section_title: Recommendations for Executive Action
paragraphs: To enhance State’s efforts to manage transportation-related security risks  overseas, we recommend that the Secretary of State direct DS to take the  following eight actions:  1.  Create consolidated guidance for RSOs that specifies required  elements to include in post travel notification and transportation  security policies. For example, as part of its current effort to develop  standard templates for certain security directives, DS could develop  templates for transportation security and travel notification policies  that specify the elements required in all security directives as  recommended by the February 2005 Iraq ARB as well as the standard  transportation-related elements that DS requires in such policies.  2.  Create more comprehensive guidance for DS reviewers to use when  evaluating posts’ transportation security and travel notification  policies. For example, the checklist DS reviewers currently use could  be modified to stipulate that reviewers should check all security  directives for DS-required elements recommended by the February  2005 Iraq ARB. The checklist could also provide guidance on how to  take the presence or absence of these required elements into account  when assigning a score to a given policy.  3.  Clarify whether or not the FAH’s armored vehicle policy for overseas  posts is that every post must have sufficient armored vehicles, and if  DS determines that the policy does not apply to all posts, articulate  the conditions under which it does not apply.  4.  Develop monitoring procedures to ensure that all posts comply with  the FAH’s armored vehicle policy for overseas posts once the policy is  clarified.  5.  Implement a mechanism, in coordination with other relevant State  offices, to ensure that EACs discuss their posts’ armored vehicle  needs at least once each year.  6.  Clarify existing guidance on refresher training, such as by delineating  how often refresher training should be provided at posts facing  different types and levels of threats, which personnel should receive  refresher training, and how the completion of refresher training should  be documented.  7.  Improve guidance for RSOs, in coordination with other relevant State  offices and non-State agencies as appropriate, on how to promote  timely communication of threat information to post personnel and  timely receipt of such information by post personnel.  8.  Take steps, in coordination with other relevant State offices and non- State agencies as appropriate, to make travel notification systems  easily accessible to post personnel who are required to submit such  notifications, including both State and non-State personnel.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report for review and comment to State, the  U.S. Agency for International Development, and the Peace Corps. We  received written comments from State, which are reprinted in appendix II.  State generally concurred with 7 of our 8 recommendations and  highlighted a number of actions it is taking or plans to take to address the  problems that we identified. State did not concur with our sixth  recommendation to clarify guidance on refresher training. In its response,  State described a number of efforts that RSOs take to keep post  personnel informed, such as sending security messages via e-mails and  text messages, and therefore State did not believe additional formal  training was necessary. We agree that RSOs have made significant  efforts to keep post personnel informed. Nevertheless, participants in 10  of our 13 focus groups either had difficulty recalling certain security  policies and requirements or described their security briefings as  inadequate. Participants noted that this was, in part, because it can be  challenging to remember the content of new arrival security briefings  while they are simultaneously managing the process of moving and  adjusting to a new post and because of the one-time nature of new arrival  briefings. DS headquarters officials stated that most violations of post  travel policies are due to personnel forgetting the information conveyed in  the new arrival briefings. By clarifying existing guidance that requires  refresher briefings, and then providing those briefings, State could  potentially remind and update personnel about post security policies and  requirements in a more effective setting and on a more regular basis. In  addition, RSOs at posts we visited provided security briefings to new  arrivals on a regular basis. Thus, allowing staff already at post to attend  these regular briefings could involve minimal additional cost or effort. The  U.S. Agency for International Development and the Peace Corps did not  provide comments on the report. State also provided technical comments,  which we incorporated as appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of State, the Administrator of the U.S. Agency  for International Development, and the Director of the Peace Corps. In  addition, the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this report were to evaluate the extent to which the  Department of State (State), with regard to transportation security, has (1)  established policies, guidance, and monitoring; (2) provided personnel  with training; and (3) communicated time-sensitive information. For the  purposes of this review, we focused on transportation security for U.S.  personnel at overseas posts, which we defined as security for such  personnel while they are in transit outside of embassy and consulate  compounds or their residences at overseas posts. Our scope did not  include transportation-related safety threats, such as road conditions or  local drivers. We focused primarily on transportation in motor vehicles,  but also included travel on foot, public transit, and to the extent that post  documents and personnel addressed them, boats and local airlines. We  did not focus on transportation-related security issues specific to Iraq and  Afghanistan given the unique operating environments in those countries.  We focused on U.S. direct hire personnel permanently assigned or on  temporary duty under chief-of-mission security responsibility and their  family members but excluded locally employed staff.
To address the objectives of this report, we reviewed U.S. laws; State’s  security policies and procedures as found in the Foreign Affairs Manual,  Foreign Affairs Handbooks, and diplomatic cables; Bureau of Diplomatic  Security (DS) threat and risk ratings and periodic assessments of post  security programs; State budgetary documents and training curricula;  classified Accountability Review Board reports concerning transportation- related attacks; and past reports by GAO, State’s Office of Inspector  General, and the Congressional Research Service. We assessed DS’s  risk management practices against its own policies and federal internal  control standards. In addition, we interviewed officials in Washington,  D.C., from DS; State’s Bureaus of Administration, Consular Affairs, and  Information Resource Management; State’s Offices of Inspector General  and Management Policy, Rightsizing, and Innovation; State regional  bureaus; the U.S. Agency for International Development; and the Peace  Corps. We also attended State’s Foreign Affairs Counter Threat training  course to gather firsthand information on the extent to which it covers  issues related to transportation security.
Additionally, we selected a judgmental sample of 26 posts for which we  collected post-level transportation security and travel notification policies,  among other documents. For security reasons, we are not naming the  specific posts. Our judgmental sample included three to five embassies or  consulates from each of State’s six geographic regions. In addition to  ensuring geographic coverage, we selected 22 posts that had relatively  high DS-established threat ratings, while also choosing 4 posts with lower  threat ratings for comparison purposes. We evaluated the extent to which  these 26 posts’ policies contained key elements required by DS, including  the criteria recommended by the February 2005 Iraq ARB. We then  reviewed various related documents, such as the checklist DS uses in its  periodic assessments of post security programs, and spoke with  cognizant DS officials to identify factors contributing to cases of  noncompliance with the required elements. The findings from our  judgmental sample of 26 posts are not generalizable to all posts. We also  conducted fieldwork at 9 of these 26 posts. Each of the 9 posts was rated  by DS as having a high or critical threat level in one or more of the  Security Environment Threat List categories of political violence,  terrorism, and crime. Additionally, 8 of the 9 posts we selected for  fieldwork were within the top 100 posts rated by DS as the highest risk  worldwide, 5 were in the top 75, and 3 were in the top 50. At the 9 posts,  we met with officials from State and other agencies involved in  transportation security—including regional security officers (RSO),  general services officers, community liaison officers, Emergency Action  Committee members, and other senior post officials—to understand their  roles related to transportation security and their perspectives on State’s  associated policies and procedures.
In addition, to obtain a wide range of firsthand perspectives from  personnel at these 9 posts, we conducted 13 focus group discussions  with randomly selected U.S. direct hire personnel who had been at post  longer than 3 months. We selected focus group participants from multiple  agencies at each post and various sections within State. We excluded  RSOs and senior post officials from our focus groups in order to  encourage participants to provide candid observations on security-related  matters. These meetings involved structured, small-group discussions  designed to gain more in-depth information about specific issues that  cannot easily be obtained from single or serial interviews. Most groups  involved 6 to 10 participants. Discussions were structured and guided by  a moderator who used the following standardized questions to encourage  participants to share their thoughts and experiences.  1.  In your opinion, what are the most significant security threats that staff  face when traveling in-country at this post? As a reminder, we are  interested in security threats posed by other people with intent to  harm, not safety threats such as road conditions or local drivers.  2.  What guidance or training have you received—whether before or after  arriving at this post—on security practices to protect yourself against  potential threats or attacks when traveling in-country? This is different  from the post’s travel or transportation security policy, which we will  ask you about later in the discussion.  a.  Where did you receive that guidance or training? What were the  key takeaways from that guidance or training?  3.  How easy or difficult is it to routinely apply those security practices at  this post?  4.  In your opinion, is post’s travel or transportation security policy  appropriately tailored to the types and levels of security threats that  staff face when traveling in-country at this post?  a.  If yes, in what ways is the travel policy appropriately tailored?  b.  If not, how can the policy be improved?  c.  What factors, if any, create challenges to following the post’s  travel policy?  5.  In your opinion, have you received all the guidance or training you  need to protect yourself against potential threats or attacks when  traveling in-country at this post? If not, what additional guidance or  training do you believe is needed?  6.  What other suggestions do you have, if any, for how staff posted at  diplomatic posts overseas can be better protected against potential  security threats or attacks when traveling in-country?
As the list indicates, we did not ask about specific security threats,  guidance, training, or security practices, but instead asked general  questions on each of these topics. For example, we did not specifically  ask participants whether they had received certain types of training;  rather, we asked a general question about what training they had  received and relied on them to volunteer information on the types of  training they had taken. However, when appropriate, we did ask more  specific follow-up questions during the focus groups. Our overall objective  in using a focus group approach was to obtain the views, insights, and  beliefs of overseas personnel on issues related to transportation security.  While we recorded the audio of each focus group, we assured  participants of the anonymity of their responses, promising that their  names would not be directly linked to their responses. We also conducted  one pretest focus group, after which we asked the participants of the  pretest focus group to provide their opinions on whether the questions we  asked were comprehensive, clear, unbiased, and appropriate. The  participants of the pretest focus group confirmed that our questions were  comprehensive, clear, unbiased, and appropriate. To analyze the focus  group responses, we reviewed transcripts of the focus group audio  recordings and conducted keyword searches to identify key themes  related to our reportable objectives. We quantified the frequency of these  key themes by counting the number of focus groups (out of 13) in which  the themes were raised. As appropriate, we also followed up with RSOs  and other officials at the posts we visited to discuss and clarify the issues  raised, while preserving the anonymity of the focus group participants.
Methodologically, focus groups are not designed to (1) demonstrate the  extent of a problem or to generalize results to a larger population, (2)  develop a consensus to arrive at an agreed-upon plan or make decisions  about what actions to take, or (3) provide statistically representative  samples or reliable quantitative estimates. Instead, they are intended to  generate in-depth information about the reasons for the focus group  participants’ attitudes on specific topics and to offer insights into their  concerns about and support for an issue. The generalizability of the  information produced by our focus groups is limited because participants  were asked questions about their specific experiences related to  transportation security, and other personnel who did not participate in our  focus groups or were located at different posts may have had different  experiences. Because of these limitations, we did not rely entirely on  focus groups but rather used several different methodologies to  corroborate and support our conclusions. For example, as noted earlier in  this appendix, we reviewed a variety of documents and interviewed  cognizant officials from multiple agencies and offices.
To determine the reliability of the data on funding for transportation  security and training records for armored vehicle drivers that we collected,  we compared information from multiple sources, checked the data for  reasonableness, and interviewed knowledgeable officials regarding the  processes they use to collect and track the data. On the basis of these  checks, we found the data we collected on funding for transportation  security to be sufficiently reliable for the purposes of this engagement. As  noted in this report, we found inaccuracies in the training records for  armored vehicle drivers. We interviewed cognizant DS officials to  understand the causes of the inaccuracies as well as State’s plans to  address them. We also collected data on the worldwide distribution of  armored vehicles by post.
This report is a public version of a sensitive but unclassified report that  was issued on September 9, 2016, copies of which are available upon  request for official use only by those with the appropriate need to know.  This report does not contain certain information that State regarded as  sensitive but unclassified and requested that we remove. We provided  State a draft copy of this report for sensitivity review, and State agreed  that we had appropriately removed all sensitive but unclassified  information.
We conducted this performance audit from July 2015 to October 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of State
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Thomas Costa (Assistant  Director), Joshua Akery, Aniruddha Dasgupta, David Dayton, Martin De  Alteriis, Neil Doherty, Justin Fisher, Lina Khan, Jill Lacey, Grace Lui, and  Oziel Trevino made key contributions to this report.
section_title: Related GAO Products
paragraphs: Diplomatic Security: State Should Enhance Management of  Transportation-Related Risks to Overseas U.S. Personnel. GAO-16- 615SU. Washington, D.C.: September 9, 2016.
Diplomatic Security: Options for Locating a Consolidated Training Facility.  GAO-15-808R. Washington, D.C.: September 9, 2015.
Diplomatic Security: State Department Should Better Manage Risks to  Residences and Other Soft Targets Overseas. GAO-15-700. Washington,  D.C.: July 9, 2015.
Diplomatic Security: State Department Should Better Manage Risks to  Residences and Other Soft Targets Overseas. GAO-15-512SU.  Washington, D.C.: June 18, 2015.
Combating Terrorism: Steps Taken to Mitigate Threats to Locally Hired  Staff, but State Department Could Improve Reporting on Terrorist  Threats. GAO-15-458SU. Washington, D.C.: June 17, 2015.
Diplomatic Security: Overseas Facilities May Face Greater Risks Due to  Gaps in Security-Related Activities, Standards, and Policies.  GAO-14-655. Washington, D.C.: June 25, 2014.
Diplomatic Security: Overseas Facilities May Face Greater Risks Due to  Gaps in Security-Related Activities, Standards, and Policies.  GAO-14-380SU. Washington, D.C.: June 5, 2014.
Countering Overseas Threats: Gaps in State Department Management of  Security Training May Increase Risk to U.S. Personnel. GAO-14-360.  Washington, D.C.: March 10, 2014.
State Department: Diplomatic Security Challenges. GAO-13-191T.  Washington, D.C.: November 15, 2012.
Diplomatic Security: Expanded Missions and Inadequate Facilities Pose  Critical Challenges to Training Efforts. GAO-11-460. Washington, D.C.:  June 1, 2011.
Overseas Security: State Department Has Not Fully Implemented Key  Measures to Protect U.S. Officials from Terrorist Attacks Outside of  Embassies. GAO-05-642. Washington, D.C.: May 9, 2005.
Overseas Security: State Department Has Not Fully Implemented Key  Measures to Protect U.S. Officials from Terrorist Attacks Outside of  Embassies. GAO-05-386SU. Washington, D.C.: May 9, 2005.