DOD Biometrics and Forensics: Progress Made in Establishing Long-term Deployable Capabilities, but Further Actions Are Needed
Published: 2017-08-07T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since 2008 DOD has used biometric and forensic capabilities to capture or kill 1,700 individuals and deny 92,000 individuals access to military bases. These capabilities were mainly developed through rapid acquisition processes and were resourced with Overseas Contingency Operations funds—funds that are provided outside of DOD's base budget process. As a result, concerns have been raised about DOD's long-term ability to fund these capabilities.
The House Armed Services Committee and House Permanent Select Committee on Intelligence included provisions in committee reports for GAO to review DOD's progress in institutionalizing deployable biometric and forensic capabilities. This report examines, among other issues, the extent to which DOD since 2011 has (1) validated long-term requirements for deployable biometric and forensic capabilities; and (2) taken actions to meet long-term requirements for deployable biometric and forensic capabilities and overcome any related challenges. GAO examined DOD directives, strategies, policies, plans, and requirements and met with cognizant DOD officials.
section_title: What GAO Found
paragraphs: The Department of Defense (DOD) has validated its requirements for long-term deployable biometric capabilities (such as fingerprint collection devices) and forensic capabilities (such as expeditionary laboratories). Biometric capabilities are used to identify individuals based on measurable anatomical, physiological, and behavioral characteristics such as fingerprints, iris scans, and voice recognition. Forensic capabilities support the scientific analysis of evidence—such as deoxyribonucleic acid (DNA) and latent fingerprints—to link persons, places, things, and events. DOD utilizes deployable biometric and forensic capabilities to support a range of military operations, such as targeting, force protection, and humanitarian assistance.
DOD has made significant progress in addressing its long-term requirements for deployable biometric and forensic capabilities, such as issuing new doctrine and establishing long-term funding for several capabilities, including DOD's authoritative biometric database that is used for identifying enemy combatants and terrorists. However, DOD's efforts to institutionalize these capabilities are limited by the following strategic planning gaps and acquisition management challenges:
While DOD has a current and approved forensic strategic plan, it does not have one for its biometric capabilities, because no entity has been assigned responsibility for developing such a plan, according to DOD officials.
The Army did not follow DOD's acquisition protocols in developing a recent key biometric capability, and it may have missed an opportunity to leverage existing, viable, and less costly alternatives.
DOD's authoritative biometric database that is used for identifying enemy combatants and terrorists does not have a geographically dispersed back-up capability to protect against threats such as natural hazards. Having such a back-up could enhance the database's availability.
Addressing these strategic planning and acquisition management challenges could help DOD sustain the progress it has made to establish enduring deployable biometric and forensic capabilities.
The photographs above depict a warfighter obtaining a biometric iris image (left) and a forensic investigator collecting a latent fingerprint (right).
section_title: What GAO Recommends
paragraphs: GAO is making 6 recommendations, including that DOD update its biometric enterprise strategic plan; take steps to more effectively manage the acquisition of a recent biometric capability; and consider developing a geographically dispersed back-up capability for its authoritative biometric database. DOD concurred with all of the recommendations and cited actions it plans to take to address them.

section_title: Letter
paragraphs: During continued military operations in Iraq and Afghanistan, U.S. forces  have faced an adversary that is often indistinguishable from innocent  civilians in the general population. The Department of Defense (DOD) has  relied on biometric and forensic capabilities to identify, target, and disrupt  enemy combatants and terrorists in these countries and worldwide. Since  2008 DOD has used biometric and forensic capabilities to capture or kill  1,700 individuals, deny 92,000 individuals access to military bases, and  identify and place 213,000 individuals on DOD’s biometrically enabled  watchlist.
Biometric capabilities are used to identify individuals based on  measurable anatomical, physiological, and behavioral characteristics  such as fingerprints, iris scans, and voice recognition. Forensic  capabilities support the scientific analysis of evidence—such as  deoxyribonucleic acid (DNA) and latent fingerprints—to link persons,  places, things, and events, such as linking enemy combatants to  explosives and firearms used to attack U.S. and coalition forces. DOD  utilizes deployable biometric and forensic capabilities to support a range  of military operations, such as targeting, force protection, and  humanitarian assistance.
DOD’s deployable biometric and forensic capabilities were mainly  developed through rapid acquisition processes and funded with Overseas  Contingency Operations (OCO) funds—funds that were provided outside  of DOD’s base budget process. While DOD has previously taken steps to  fund some of its deployable biometric and forensic capabilities in the base  budget, these funding levels may not be adequate to ensure their  continued availability. Moreover, through 2012, DOD had not developed  comprehensive long-term requirements (hereinafter referred to as  enduring requirements), such as policy, doctrine, and training, to ensure  the long-term availability of deployable biometric and forensic capabilities.
We reported in 2011 that DOD could better conform to biometric  collection standards and share biometric information with other federal  agencies. In 2012 we identified the need for additional biometric training  for DOD leadership and more timely biometric transmission processes.  Finally, in 2013 we found that additional planning and oversight were  required for managing DOD’s deployable forensic capabilities. Those  three prior reports contained a total of 16 recommendations, and we  discuss the implementation status of these recommendations later in this  report.
House Report 114-537, accompanying a bill for the National Defense  Authorization Act for Fiscal Year 2017, and House Report 114-573,  accompanying a bill for the Intelligence Authorization Act for Fiscal Year  2017, included provisions for us to review DOD’s progress in establishing  enduring deployable biometric and forensic capabilities. This report  evaluates the extent to which DOD since 2011 has:  1.  validated enduring requirements for deployable biometric and forensic  capabilities;  2.  taken actions to meet enduring requirements for deployable biometric  and forensic capabilities and overcome any related challenges; and  3.  taken actions to address our prior recommendations regarding its  biometric and forensic activities.
This report focuses on DOD’s efforts to establish enduring biometric and  forensic capabilities across DOD doctrine, organization, training, materiel,  leadership and education, personnel, and facilities from 2011 to the  present. We did not assess digital; multimedia; cyber; or chemical,  biological, radiological, and nuclear forensic requirements and  capabilities. For objective one, we identified and assessed relevant  strategies, guidance, and plans, and we met with officials from across the  department to determine DOD’s validated enduring deployable biometric  and forensic requirements. For objective two, we identified and evaluated  relevant planning, acquisition, and sustainment documents, and we met  with officials from across the department to discuss biometric and forensic  capabilities and capability gaps. We also compared the content and  process for developing DOD’s biometric and forensic strategic plans  against Standards for Internal Control in the Federal Government for  control activities to determine their enterprise utility. In addition, we  compared federal information systems guidance on contingency planning  against acquisition planning and development documents for DOD’s  follow-on authoritative biometric database. For objective three, we  evaluated actions taken by the Office of the Under Secretary of Defense  for Acquisition, Technology, and Logistics (USD(AT&L)) and the military  services to address our prior biometric and forensic recommendations,  including issuance of new or updated guidance, policies, and plans. More  detailed information on our scope and methodology can be found in  appendix I of this report.
We conducted this performance audit from June 2016 to August 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: DOD Biometric and Forensic Roles and Responsibilities
paragraphs: In April 2011 DOD issued a directive establishing a “defense forensic  enterprise” that, among other things, provided policy and assigned  responsibilities within the department to develop and maintain an  enduring and holistic forensic capability to support the full range of  military operations. In January 2016 DOD reissued a directive  establishing a “defense biometrics enterprise” that, among other things,  provided policies and assigned responsibilities within the department to  provide a critical end-to-end biometric capability to support decision- making across the full range of military operations. These directives  assigned USD(AT&L) responsibility for overseeing and coordinating the  department’s biometric and forensic enterprise activities. USD(AT&L)  utilizes the Defense Biometrics and Forensics Office to carry out its  oversight and coordination responsibilities. The office coordinates and  synchronizes biometric and forensic requirements, as well as facilitates  the development and implementation of enterprise-wide policies.
In 2008 and 2011 the Secretary of Defense designated the Secretary of  the Army as the executive agent for DOD’s biometric and forensic  activities, respectively. In 2013 the Secretary of the Army designated the  Defense Forensics and Biometrics Agency (DFBA) as the executive  manager and tasked the agency with carrying out the Army’s biometric  and forensic executive agent responsibilities, which include, among other  things, leading enterprise coordination, acquiring common capabilities,  ensuring that capabilities are planned and budgeted for, and overseeing  and maintaining DOD’s authoritative biometric database through its  Biometrics Operations Division. DFBA, in carrying out the Army’s  forensics executive agent functions, also coordinates with the Army’s  Criminal Investigations Command, which manages the Defense Forensic  Science Center—the Army entity tasked with planning, programming, and  providing joint or common forensic capabilities.
By directive, the Office of the Secretary of Defense, the Joint Staff, the  military services, and the combatant commands are required to support  various programs and policies within the biometric and forensic  enterprises, such as coordinating and integrating requirements and  capabilities to prevent unnecessary duplication. For example, the  combatant commands are responsible for identifying, validating, and  prioritizing theater-specific, joint biometric and forensic requirements  while the military services and other DOD components plan, program,  and field biometric and forensic capabilities to meet warfighter needs. The  individual military services, the geographic combatant commands, and  Special Operations Command (SOCOM) all have their own offices to  oversee their biometric and forensic activities.
section_title: DOD’s Requirements Validation and Rapid Acquisition Processes
paragraphs: DOD utilizes the Joint Capabilities Integration and Development System  to identify, assess, prioritize, and validate joint military requirements,  including deployable biometric and forensic requirements. The Joint  Capabilities Integration and Development System process is overseen by  the Joint Staff’s Joint Requirements Oversight Council. Joint military  requirement gaps are identified, typically by geographic combatant  commands, and validated often by a military service or by the Joint Staff.  DOD then studies potential non-materiel and materiel solutions to reduce  or eliminate validated capability gaps. Non-materiel solutions include  changes to doctrine, organization, training, or policy. Materiel solutions  are items necessary to equip, operate, maintain, and support military  activities, and they include biometric and forensic collection kits and  communications equipment for transmitting biometric and forensic data to  and from the warfighter. Potential materiel solutions are evaluated  through an analysis-of-alternatives process whereby the performance,  effectiveness, suitability, and estimated costs of potential materiel  solutions are determined.
DOD has a rapid acquisition process to support urgent and emergent  combatant commander needs during ongoing and anticipated  contingency operations. Urgent and emergent operational needs are  generated when other means—such as the department’s traditional  requirements and acquisition processes—cannot be tailored to address  operational requirements in a timely fashion. A goal of the rapid  acquisition process is to typically field a capability solution to an urgent or  emergent operational need within 2 years. The rapid acquisition process  is generally overseen by the Joint Staff and the Joint Rapid Acquisition  Cell within the Office of the Secretary of Defense. Once a joint urgent or  emergent operational need is validated by the Joint Staff, DOD may  designate a sponsor—usually a military service—with responsibility for  evaluating potential non-materiel and materiel solutions, and assigning a  milestone decision authority to approve a solution and oversee its  implementation.
section_title: Deployable Biometric and Forensic Capabilities
paragraphs: Based on validated requirements to support a range of military  operations, DOD has fielded a number of deployable capabilities to  collect, analyze, match, transmit, store, and share biometric and forensic  information.
Biometric collection capabilities include the following:
Secure Electronic Enrollment Kit: Army, Navy, Marine Corps, and  SOCOM hand-held device used to collect fingerprint, iris, facial  images, and biographical information.
Biometrics Automated Toolset: Army hand-held device and  computer equipment used to collect (and transmit) fingerprint, iris, and  facial images.
Identity Dominance System: Navy and Marine Corps hand-held  device and computer equipment used to collect (and transmit)  fingerprint, iris, and facial images in both shore and maritime  environments. The Navy and Marine Corps capabilities are separately  managed, acquired, and funded through the individual services.
BioSled: SOCOM hand-held device attached to a cellular phone used  to collect fingerprint, iris, facial images, and biographical information.
For examples of biometric collection devices, see figure 1.
Forensic analysis capabilities include the following:
Exploitation Analysis Center: SOCOM exploitation kit used to  collect and process latent fingerprints and DNA samples, among other  forensic material.
Expeditionary Forensic Exploitation Capability: Marine Corps  exploitation kit modeled after SOCOM’s exploitation analysis center  and used to collect and process latent fingerprints and DNA samples,  among other forensic material.
Forensic Exploitation Analysis Tool: Managed by the Navy, this  tool is a laboratory-information management and database sharing  software system for documenting, tracking, reporting, and sharing  forensic data.
Forensic Exploitation Laboratories: Owned and operated by the  Army’s Defense Forensics Science Center, these laboratories provide  a modularized, scalable capability to forensically analyze latent  fingerprints, DNA, explosives, drugs, and firearm and tool marks. The  Army has also established a “reachback” operations center at the  Gillem Enclave, Georgia, to oversee the deployment and  management of the forensic exploitation laboratories, and to provide  expertise and analytical capabilities to process forensic material (see  figure 2).
Biometric and forensic transmission, storage, and sharing capabilities  include the following:
DOD Automated Biometric Information System (DOD ABIS): DOD  ABIS is the department’s authoritative biometric repository for non- U.S. persons. It supports the storing, matching, and sharing of  biometric data collected as part of military operations, including  fingerprint, iris, palm, facial images, and biographical information, as  well as forensically collected latent fingerprint information. Biometric  submissions and match requests are prioritized for processing based  on agreements between DFBA and the submitting organization.  Figure 3 shows a person of interest whom DOD identified through  biometric data that were collected, analyzed, and stored in DOD  ABIS.
Special Operations Forces Exploitation: SOCOM communications  architecture utilizing global satellite networks to transmit biometric and  forensic information through an online portal to and from DOD ABIS  with match/no-match responses.
Department of the Navy Identification and Screening Information  System: Navy and Marine Corps communications architecture to  transmit biometric information through an online portal to and from  DOD ABIS with match/no-match responses. The system is modeled  after SOCOM’s Special Operations Forces Exploitation capability.
Near Real Time Identity Operations: Army-provided regional  forward server, communications platform, and collection devices that  are fielded in U.S. Central Command’s (CENTCOM) area of  responsibility in response to a 2014 CENTCOM joint emergent  operational need. In September 2014 CENTCOM submitted a joint  emergent operational need to meet 21 command-specific  requirements. In November 2014 the Joint Requirements Oversight  Council validated CENTCOM’s operational need and directed the  executive agent to establish it as an enduring capability. In January  2015 the Joint Rapid Acquisition Cell assigned the Army as the office  of primary responsibility for fulfilling the need.
section_title: DOD Has Validated Enduring Requirements for Deployable Biometric and Forensic Capabilities
paragraphs: DOD has validated enduring non-materiel and materiel requirements for  deployable biometric and forensic capabilities. DOD officials emphasized  the importance of this step, given DOD’s increasing operational demand  for biometric and forensic capabilities, as shown in figure 4—an  interactive graphic—and in appendix II.
subsections: section_title: DOD Has Validated Non- materiel Enduring Requirements for Deployable Biometric and Forensic Capabilities
paragraphs: To better support current and anticipated warfighter demand, DOD  validated 30 non-materiel enduring requirements for deployable biometric  and forensic capabilities, as shown in table 1.
These requirements are designed to transition DOD’s biometric and  forensic capabilities, over a multi-year period, from rapidly acquired and  OCO-funded capabilities to enduring capabilities that are resourced  through base funding. According to DOD officials, the 30 non-materiel  requirements remain current and comprehensive, as of May 2017. We  found that each biometric and forensic non-materiel requirement was  submitted by the Army, as DOD’s executive agent for biometrics and  forensics; coordinated across the department; and approved and  documented by the Joint Requirements Oversight Council in August 2013  and November 2014, respectively.
section_title: DOD Has Validated Materiel Enduring Requirements for Deployable Biometric and Forensic Capabilities
paragraphs: DOD has validated several materiel enduring requirements for deployable  biometric and forensic capabilities that facilitate the recognition,  collection, preservation, analysis, transmission, matching, storage, and  sharing of biometric and forensic data. While DOD does not have a  consolidated list of its validated biometric and forensic materiel  requirements at this time, it is in the process of developing such a list.  DOD’s materiel requirements are currently described in department,  military service, and SOCOM strategies and acquisition documents, and  in geographic combatant command operational plans. For example, the  2012 Marine Corps Identity Strategy identified a requirement for biometric  and forensic collection, transmission, and storage capabilities to support  operations globally. Additionally, the Army identified enduring  requirements for DOD’s authoritative biometric database in documents  such as its draft 2016 capability production document and its 2015  analysis of alternatives.
section_title: DOD Has Taken Actions to Meet Enduring Biometric and Forensic Requirements but Faces Challenges in Sustaining Progress
paragraphs: DOD has made significant progress in addressing 7 of the 30 validated  non-materiel enduring requirements for deployable biometric and forensic  capabilities. The military services and SOCOM have also taken actions to  ensure the continued availability of several deployable materiel biometric  and forensic capabilities to meet enduring requirements. However, DOD’s  efforts to institutionalize deployable biometric and forensic capabilities are  limited by strategic planning gaps and acquisition management  challenges.
subsections: section_title: DOD Is Addressing Non- materiel Enduring Requirements for Deployable Biometric and Forensic Capabilities
paragraphs: DOD has made significant progress in addressing 7 of the 30 validated  non-materiel requirements for biometric and forensic capabilities that  were identified in 2013 and 2014, as shown in table 2.
According to DFBA documentation, DOD is in the process of addressing  the remaining 23 non-materiel requirements, but as of May 2017 their  status was below 75 percent complete. DFBA is leading DOD’s effort to  address all 30 validated non-materiel requirements, and it has prioritized  and established timeframes for their completion by 2020, as directed by  the Joint Requirements Oversight Council. DFBA officials told us that they  initially focused on doctrine requirements, such as issuing Joint Doctrine  Note 2-16, Identity Activities, and integrating biometric and forensic  activities into existing joint publications, to better address training and  policy requirements. Appendix III includes a description of all 30  validated non-materiel enduring requirements by area, status, and  anticipated completion, as of May 2017.
section_title: DOD Has Developed Materiel Biometric and Forensic Capabilities to Meet Several Enduring Requirements and Has Made Progress in Transitioning These Capabilities to Base Funding
paragraphs: DOD has developed biometric and forensic capabilities to meet several  validated enduring materiel requirements, and it has made progress in  transitioning these capabilities from OCO to base funding. The military  services and SOCOM have initiated acquisition and sustainment  programs, based on validated requirements, to ensure the continued  availability of several materiel biometric and forensic capabilities,  including the following:
Army Next Generation Biometric Collection Device. The Army has  initiated an acquisition program to identify a follow-on capability for its  existing biometric collection device, the Biometrics Automated  Toolset, which is scheduled to reach end-of-life in 2022, according to  Army officials. The Army is conducting an analysis of alternatives to  be completed at the end of fiscal year 2017 to inform its decision,  according to the same officials.
Biometric Enabling Capability (hereinafter referred to as the DOD  ABIS follow-on system). In 2015 the Army completed an analysis of  more than 10 alternatives to inform DOD’s decision regarding a DOD  ABIS replacement. DOD ABIS is scheduled to be replaced in fiscal  year 2022.
Forensic Exploitation Laboratories. Army officials expect to  transition these laboratories to an enduring, base-funded capability in  2019. Officials from the Defense Forensics Science Center noted that  the Army’s draft expeditionary forensic strategy calls for an  expeditionary lab to be aligned with each of the six geographic  combatant commands.
Identity Dominance System. The Navy and Marine Corps are jointly  pursuing a replacement for their existing biometric collection device,  the Secure Electronic Enrollment Kit, which, according to Navy and  Marine Corps officials, is scheduled to reach end-of-life in 2019.
SOCOM Biometric Collection Device. SOCOM has initiated an  acquisition program to replace its existing Secure Electronic  Enrollment Kit and BioSled collection devices, which currently fulfill  validated requirements. SOCOM officials anticipate that the  replacement capability will be available in 2019.
DOD officials stated that the department has made progress in  transitioning enduring biometric and forensic materiel capabilities from  OCO to base budget funding. For example, Army officials stated that  DOD ABIS has transitioned from a combination of OCO and base budget  funding to an enduring capability funded through DOD’s base budget. The  Navy, Marine Corps, and SOCOM have also developed comprehensive  programs of record for their biometric and forensic materiel capabilities  that are expected to be funded through their respective base budgets. In  addition, the Army anticipates transitioning its forensic exploitation  laboratories from OCO to base funding by 2019. Officials from across  DOD noted the importance of continuing to transition biometric and  forensic materiel capabilities from OCO to base funding, to better ensure  their continued availability.
section_title: DOD’s Efforts to Institutionalize Deployable Biometric and Forensic Capabilities Are Limited by Strategic Planning Gaps and Acquisition Management Challenges
paragraphs: DOD’s efforts to institutionalize its enduring deployable biometric and  forensic capabilities are limited by strategic planning gaps and acquisition  management challenges. These limitations include the absence of a  current biometric strategic plan and supporting implementation plan, the  absence of acquisition professionals to oversee CENTCOM’s Near Real  Time Identity Operations solution, the absence of a geographically  dispersed DOD ABIS back-up capability, and difficulties in hiring and  retaining qualified personnel to operate and maintain DOD ABIS.
subsections: section_title: DOD Lacks Current Biometric Strategic Planning Documents
paragraphs: While DOD has a current and approved forensic strategic plan, it does not  have a current and approved biometric strategic plan. According to  Standards for Internal Control in the Federal Government, strategic plans  set the goals and objectives for an entity to achieve more effective and  efficient operations and to minimize waste. Furthermore, the standards  call for set goals and objectives to be reviewed periodically and updated  as necessary.
In 2015 DOD issued a forensic strategic plan to guide its forensic  enterprise through fiscal year 2020. The plan identifies several goals and  objectives, such as enhancing enterprise effectiveness and information- sharing. DOD also issued a supporting forensic implementation plan in  2015 that includes strategic planning elements for each of the objectives,  such as intended outcomes, measures of effectiveness, and assigning  offices of primary responsibility. According to USD(AT&L) officials, the  forensic strategic plan plays a critical role in focusing and prioritizing  DOD’s forensic enterprise activities.
In contrast, DOD’s biometric strategic plan is out of date, and the  department has not developed a supporting implementation plan.  Specifically, DOD issued a biometric strategic plan in 2008, covering the  2008 – 2015 timeframe. The plan identifies several goals and objectives,  such as institutionalizing biometric capabilities and coordinating biometric  efforts across the department more effectively. The plan includes a  requirement to be reviewed annually and updated as necessary. The plan  also directs that a supporting implementation plan be developed.  However, according to DOD officials, the biometric strategic plan has not  been reviewed or updated since 2008, and a supporting implementation  plan has not been issued. USD(AT&L), Army, Navy, Marine Corps, and  DFBA officials agreed that the biometric strategic plan should be updated  and a supporting implementation plan issued to better focus and prioritize  enterprise goals and objectives for matters such as doctrine and policy,  coordination, and acquisition and sustainment efforts. For example, DOD  officials noted that the military services and SOCOM have a number of  ongoing biometric acquisition and sustainment initiatives that are not  articulated and synchronized in a single document, and that including  information about these initiatives in an updated biometric strategic plan  would enhance long-range enterprise planning.
According to DOD officials, the 2008 biometric strategic plan has not  been reviewed and updated, and a supporting implementation plan has  not been issued, because no organization has been assigned  responsibility for completing these tasks. Further, these officials stated  that if an entity were to independently undertake these tasks without  being assigned to do so, there likely would be mixed acceptance across  the enterprise. Without a strategic plan that identifies goals and objectives  and a supporting implementation plan that identifies outcomes, measures  of effectiveness, and responsibilities, among other things, DOD may be  missing an opportunity to reprioritize and better align enterprise efforts in  important areas such as acquisition and sustainment.
section_title: DOD Faces Biometric and Forensic Acquisition Management Challenges
paragraphs: DOD’s acquisition management challenges that are specific to its  biometric and forensic enterprises include the absence of a milestone  decision authority to oversee CENTCOM’s Near Real Time Identity  Operations solution, the absence of a geographically dispersed DOD  ABIS back–up capability, and difficulties in hiring and retaining qualified  personnel to operate and maintain DOD ABIS.
CENTCOM’s Near Real Time Identity Operations solution lacks a  milestone decision authority supported by acquisition  professionals. According to DOD officials, the Army could have more  thoroughly considered existing, viable, and potentially less costly  alternatives to address CENTCOM’s 2014 operational need for a Near  Real Time Identity Operations capability. In 2015 SOCOM offered the  Army its Special Operations Forces Exploitation capability as a  potential solution. According to military service, SOCOM, and DFBA  documentation and officials, SOCOM’s capability was a proven, highly  effective, and cost-efficient communications architecture that met  many of CENTCOM’s 21 operational need requirements, including the  ability to transmit and receive a match/no-match response from DOD  ABIS within 3 minutes. Navy and Marine Corps officials stated that  they modeled their communication architecture (i.e., the Department  of the Navy Identification and Screening Information System) on the  Special Operations Forces Exploitation capability, based on its  demonstrated high performance and reliability. Other Army officials  noted that the Army’s fielded Biometrics Automated Toolset capability  could potentially have been leveraged to satisfy some of CENTCOM’s  operational need requirements.
When CENTCOM’s joint emergent operational need was validated by  the Joint Staff and assigned by the Joint Rapid Acquisition Cell, the  Army office responsible for overseeing the Near Real Time Identity  Operations solution was given 90 days to identify and field a potential  solution; thus, according to DOD officials, they had limited time to  thoroughly assess alternative options. Army officials observed that  while they discussed the feasibility of the Special Operations Forces  Exploitation capability and other potential solutions with DOD, military  service, and SOCOM officials in 2015, they rejected these alternatives  because they did not meet all of CENTCOM’s requirements, including  the ability to share unclassified information with allied partners and the  ability to transmit and receive all match/no-match responses within 3  minutes.
While we did not, in the following assessments, validate the findings  or the Army’s efforts to address the corresponding deficiencies  identified in them, the assessments highlight concerns within DOD  regarding the performance of the Near Real Time Identity Operations  solution. In June 2016 the Center for Naval Analyses issued an  analysis of biometric and forensic data collected through November  2015 which examined several DOD information systems and found  that the Near Real Time Identity Operations solution produced  inconsistent match/no-match responses due to data synchronization  challenges that could increase risk for existing and future missions  conducted in the CENTCOM area of responsibility. In September  2016 the Army completed its operational assessment of the Near Real  Time Identity Operations solution and found that it provided  inconsistent match/no-match responses that “reduced warfighter  confidence in the system.” Based on their lack of confidence in the  system, SOCOM and the Marine Corps sought and received approval  for their forces in the CENTCOM area of responsibility to use their  existing capabilities instead of the Near Real Time Identity Operations  solution. Marine Corps officials asserted that the Near Real Time  Identity Operations solution continued to provide incomplete  match/no-match data as of May 2017. Army officials acknowledged  that the Near Real Time Identity Operations solution operational  assessment identified major deficiencies; however, they stated that  the Army had addressed the major deficiencies as of May 2017. In  addition, CENTCOM determined that the solution has military utility,  and CENTCOM is interested in pursuing further enhancements to  meet all of its 21 operational need requirements.
According to DOD Instruction 5000.02, a milestone decision authority,  supported by acquisition professionals, will be assigned to oversee a  rapid acquisition program such as the Near Real Time Identity  Operations solution. The milestone decision authority is responsible  for, among other things, overseeing the evaluation of alternative  existing technologies to consider cost, schedule, performance, and  operational risk before selecting a solution. However, according to  DOD officials, the Army did not assign a milestone decision authority  and also did not assign an office with experienced acquisition  professionals to oversee the Near Real Time Identity Operations  solution. DOD acquisition officials noted that if acquisition  professionals had overseen the solution, they might have considered  different performance, cost, or schedule trade-offs, which may have  resulted in a different outcome. In 2015 DOD officials informed the  Army of the need to assign a milestone decision authority, but as of  May 2017 the Army had not assigned such an authority. Some Army  officials told us that the office currently responsible for overseeing the  Near Real Time Identity Operations solution has provided sufficient  oversight.
According to DOD guidance, no later than 1 year after a system  enters operation and sustainment, DOD should complete a disposition  analysis that recommends a course of action, including whether to  retain the system. Given the absence of a milestone decision  authority and the acquisition and performance challenges incurred  with the Near Real Time Identity Operations solution, we believe that  the department could benefit from a disposition analysis that is  completed before the solution reaches operation and sustainment. A  disposition analysis not only would inform DOD’s management of the  Near Real Time Identity Operations solution, but also would inform the  department’s other biometric and forensic acquisition programs, such  as the DOD ABIS follow-on system.
DOD ABIS lacks a geographically dispersed back-up capability.
DOD’s mission-critical authoritative biometrics database (i.e., DOD  ABIS) faces heightened operational risk because it does not have a  geographically dispersed back-up capability. According to officials  from across the biometric enterprise, U.S. forces rely on DOD ABIS to  store and match biometric and latent fingerprint information. Without a  geographically dispersed back-up, there is increased risk that if DOD  ABIS were unavailable for unexpected and extended periods, U.S.  forces would be unable to receive timely match/no-match information  to identify enemy combatants and terrorists.
DOD ABIS has a partial back-up system that is located less than 20  miles away from its primary site in West Virginia, thereby making it  vulnerable to many of the same natural and man-made disasters to  which the primary site is vulnerable. According to the National Institute  of Standards and Technology, mission-critical information systems,  such as DOD ABIS, should have a back-up capability located in a  geographic area that is unlikely to be affected by the same hazards as  the primary site. The Army, which has responsibility for operating  and maintaining DOD ABIS, considered geographic dispersal as part  of the 2015 DOD ABIS follow-on system analysis of alternatives.  However, according to DOD officials, the Army has not included  geographic dispersal as part of the selection criteria for the DOD ABIS  follow-on system.
When the Army fielded DOD ABIS in 2004 it was responding to a  CENTCOM urgent need to support military operations, and therefore it  focused on rapidly fielding an initial capability, according to DOD  officials. At that time the Army did not develop a geographically  dispersed DOD ABIS back-up capability, and it has not subsequently  developed such a capability because of anticipated costs and the  assumption that the existing back-up system suffices, according to  DOD officials. However, DOD officials stated that the Army has an  opportunity to consider the pros and cons of developing a  geographically dispersed capability as part of the DOD ABIS follow-on  system acquisition program. For example, one of the options under  consideration entails transitioning DOD ABIS’s data to a virtual cloud  format. According to DOD officials, doing so could reduce the  operational risk associated with having limited geographic dispersal.
DOD’s contractors face challenges in hiring and retaining  qualified personnel to operate and maintain DOD ABIS. DOD  ABIS’s operational risk is exacerbated by DFBA’s challenges in hiring  and retaining qualified personnel to operate and maintain the system.  DFBA’s Biometrics Operations Division is responsible for managing  DOD ABIS’s day-to-day operations and uses contractors to support  several services, including information technology security, staffing an  around-the-clock watch desk to support warfighter requirements, and  providing latent fingerprint examiners to adjudicate potential  fingerprint matches when automated determinations are not definitive,  according to officials. However, DFBA officials stated that its  contractors have experienced difficulty in hiring and retaining staff for  these functions because the current support contracts were issued  using a lowest-price technically acceptable source selection  process—that is, awarding contracts to the lowest bidder deemed  technically qualified. This contracting approach limits DOD’s ability to  attract bids from companies with less restrictive compensation,  according to DOD officials. In contrast, a tradeoff contracting  approach permits tradeoffs among cost and non-cost factors and  allows a contract to be awarded to a contractor that is not the lowest  bidder. According to DOD officials, a tradeoff approach could enhance  the quality of contract offers and improve contractor hiring and  retention through better compensation. According to DOD acquisition  officials, a lowest-price technically acceptable approach should be  used for basic services, such as sanitation and landscaping, and not  for technical, highly-skilled services, such as information technology  security and latent fingerprint examination.
DFBA pursued a tradeoff approach for its DOD ABIS mission-critical  functions, but a lowest- price technically acceptable approach was  settled upon by Army Contracting Command, according to DFBA and  Army Contracting Command officials. Specifically, DFBA’s inability to  attain a tradeoff approach was caused by difficulty in completing  required documentation, such as detailed job position descriptions, in  a timely manner, despite DFBA’s and Army Contracting Command’s  combined efforts.
The National Defense Authorization Act for 2017 directs DOD to avoid  the use of lowest- price technically acceptable selection criteria to  acquire knowledge-based professional services such as information  technology, cybersecurity, systems engineering, and technical  assistance to the maximum extent practicable. Although the current  DOD ABIS support contracts pre-date the passage of the Act,  USD(AT&L) and DFBA officials stated that daily operation and  maintenance of DOD ABIS are considered knowledge-based  professional services that require highly skilled personnel to perform  and therefore, consistent with the Act, the department should consider  pursuing a tradeoff contracting approach when it is practicable to do  so, such as during future contract solicitations. Standards for Internal  Control in the Federal Government emphasizes the importance of  recruiting, developing, and retaining competent personnel. DFBA’s  ability to provide timely and authoritative match/no-match responses  to U.S. forces engaged in ongoing operations might be negatively  affected if its contractors cannot hire and retain sufficient numbers of  highly skilled personnel to operate and maintain DOD ABIS’s mission- critical functions.
section_title: DOD Has Implemented Almost All of Our Prior Biometric- and Forensic-related Recommendations
paragraphs: In our prior reports on DOD’s biometric and forensic activities issued  since 2011, we made 16 recommendations to enhance the biometric and  forensic enterprises. As of May 2017, DOD had implemented 15 of the 16  recommendations and was making progress toward implementing the  remaining recommendation, as shown in table 3. The 15 closed  recommendations and additional steps DOD has taken since they were  closed are summarized in appendix IV.
In March 2011 we found that a biometric collection device used primarily  by the Army did not meet DOD-adopted standards; and that DOD did not  have a finalized biometric information-sharing agreement with the  Department of Homeland Security; and we identified concerns that DOD  ABIS might be unable to meet the search demands of non-DOD biometric  systems. We made five recommendations addressing DOD’s process  and policies for updating and testing collection devices and improving  information-sharing across federal agencies. DOD has implemented each  of these recommendations. For example, in January 2016 DOD updated  its biometric directive that, among other things, now assigns responsibility  for ensuring that its biometric-related systems conform to federal  standards. In addition, in January 2016 the Assistant Secretary of  Defense for Homeland Defense and Global Security, in coordination with  the Department of Homeland Security, updated guidance to further  improve the sharing of biometric, biographical, and identity-management  data between the two departments for screening and identity-verification  purposes.
In April 2012 we found that biometric training for leaders did not provide  instruction on the effective use of biometrics; several factors during the  data transmission process limited the use of biometrics in Afghanistan;  and requirements did not exist for DOD to disseminate biometric lessons  learned across the department. We made seven recommendations to  address these findings, six of which the department has implemented. For  example, between February 2015 and January 2017 DOD approved 25  new universal joint tasks that relate to biometric and forensic training.  This action is one of the first steps DOD must take in order to  institutionalize biometric-related training and education to support its  operational requirements. With respect to the recommendation that is not  implemented, DOD officials told us that the department is taking actions  to address several data transmission factors that hindered the Army’s and  Marine Corps’ ability to identify (and capture) enemy combatants in  Afghanistan in a timely manner. These factors include mountainous  terrain, competing demands for communications infrastructure, and  delays in updating hand-held biometric collection devices with the most  current biometrically enabled watchlist. During this review, USD(AT&L)  and military service officials told us that these data transmission factors  will be analyzed and potentially addressed through the DOD ABIS follow- on system acquisition program and the CENTCOM Near Real Time  Identity Operations solution. We believe that these actions will address  the intent of our 2012 recommendation. DOD officials also stated that  they have improved the reliability and responsiveness of DOD ABIS.  From fiscal years 2014 through 2016, DOD ABIS was available more than  98 percent of the time, excluding brief scheduled periods of unavailability  for system updates and planned maintenance actions. Additionally, in  fiscal year 2016 DOD ABIS’s average match/no-match response time  was generally between 1 and 11 minutes, depending on the prioritization  level assigned to the biometric submission.
In June 2013 we found that DOD’s draft forensic strategic plan was  missing important elements such as milestones and metrics to gauge  progress; that USD(AT&L) had not reviewed and evaluated military  service and SOCOM budget estimates, as required by DOD’s forensic  directive; and that DOD had not provided guidance to the military services  on how they were to collect and report forensic budget data to  USD(AT&L). We made four recommendations addressing DOD’s  forensic strategic plan and the review and evaluation of forensic budget  estimates. DOD has implemented each of these recommendations. For  example, DOD issued a forensic enterprise strategy in March 2015 and a  supporting implementation plan in September 2015. The strategic plan  and implementation plan, when viewed together, contain several  important elements for effective strategic planning, including goals,  milestones, and metrics.
section_title: Conclusions
paragraphs: DOD relies on its deployable biometric and forensic capabilities to support  a range of military operations, including the identification and targeting of  enemy combatants and terrorists. Since 2011 DOD has made  considerable progress in institutionalizing these capabilities, the majority  of which were developed through rapid acquisition processes and funded  with OCO funds to meet urgent and emergent warfighter needs in Iraq  and Afghanistan. For example, DOD has validated a number of non- materiel and materiel enduring requirements, and several of the resulting  capabilities have transitioned, or are in the process of transitioning, from  OCO to base funding. Furthermore, DOD has implemented almost all of  our prior biometric- and forensic-related recommendations that we believe  are consistent with the department’s efforts to institutionalize its  deployable biometric and forensic capabilities. However, DOD’s  continued success could be diminished by gaps in strategic planning  documents and acquisition management challenges. Specifically, without  a current biometric strategic plan and supporting implementation plan,  DOD is not well positioned to prioritize and focus enterprise-wide  activities. Furthermore, without a milestone decision authority to oversee  DOD’s development of a Near Real Time Identity Operations solution,  and a disposition analysis to recommend a path forward, DOD risks  facing continued cost, schedule, and performance issues. Lastly, the  ability of DOD ABIS to support future warfighter needs could be adversely  impacted by not having a geographically dispersed back-up capability and  challenges in hiring and retaining qualified personnel to operate and  maintain the system. Addressing these strategic planning and acquisition  management challenges will help DOD sustain the progress it has made  toward establishing enduring deployable biometric and forensic  capabilities.
section_title: Recommendations for Executive Action
paragraphs: To enhance enterprise-wide biometric strategic planning, we recommend  that the Under Secretary of Defense for Acquisition, Technology, and  Logistics take the following two actions:  1.  Publish an updated biometric strategic plan to identify enterprise goals  2.  Publish a supporting biometric implementation plan that includes  intended outcomes, measures of effectiveness, and responsibilities,  among other things.
To facilitate more effective and efficient acquisition management of  DOD’s biometric and forensic enterprises, we recommend that the  Secretary of the Army, in coordination with the Under Secretary of  Defense for Acquisition, Technology, and Logistics take the following four  actions:  3.  Assign a milestone decision authority to oversee the Near Real Time  4.  Complete a disposition analysis for the Near Real Time Identity  Operations solution before the solution reaches operation and  sustainment;  5.  Consider including geographic dispersal as part of the selection  criteria for the DOD ABIS follow-on system; and  6.  Use tradeoff selection criteria, rather than lowest-price technically  acceptable criteria, for determining contractor support for DOD ABIS  mission-critical functions when it is practicable to do so.
section_title: Agency Comments and Our Evaluation
paragraphs: DOD reviewed a draft of this report and concurred with all of our  recommendations. DOD also cited actions it plans to take to address  them. We believe that if DOD completes the actions it outlines in its  response, this will address the intent of our recommendations. DOD’s  written comments are reprinted in their entirety in appendix V.
We are sending copies of this report to the appropriate congressional  committees; the Secretary of Defense; the Under Secretary of Defense  for Acquisition, Technology, and Logistics; the Chairman, Joint Chiefs of  Staff; the Secretaries of the Army, the Navy, and the Air Force; and the  Commandant of the Marine Corps. In addition, the report is available at  no charge on the GAO website at http://www.gao.gov  If you or your staff have any questions about this report, please contact  me at (202) 512-9971 or at kirschbaumj@gao.gov. Key contributors to  this report are listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report evaluates the extent to which the Department of Defense  (DOD) has since 2011 (1) validated enduring requirements for deployable  biometric and forensic capabilities; (2) taken actions to meet enduring  requirements for deployable biometric and forensic capabilities and  overcome any related challenges; and (3) taken actions to address prior  GAO recommendations regarding DOD’s biometric and forensic  capabilities. We did not assess digital; multimedia; cyber; or chemical,  biological, radiological, and nuclear forensic requirements and  capabilities.
To evaluate the extent to which DOD has validated enduring  requirements for deployable biometric and forensic capabilities since  2011, we identified and analyzed non-materiel requirements documents  drafted by the Army, as DOD’s executive agent for biometrics and  forensics, and validated by the Joint Requirements Oversight Council;  and compared them to DOD’s requirements validation process. We met  with officials from the Defense Forensics and Biometrics Agency (DFBA)  and the Army’s Training and Doctrine Command to obtain greater  specificity on the objective of each non-materiel requirement. We also  identified biometric and forensic materiel requirements by analyzing  relevant Office of the Secretary of Defense, military service, and  combatant command strategies, plans, acquisition and sustainment  documents, as well as written responses to question sets provided to  each of the geographic combatant commands through the Joint Staff.  This included reviewing and assessing the Army’s 2015 analysis of  alternatives and 2016 draft capability production document for DOD’s  authoritative biometric database to identify key performance requirements  for the department’s follow-on biometric database. We discussed the  materiel biometric and forensic requirements with Joint Staff, military  service, combatant command, and DFBA officials responsible for  requirements planning and oversight to understand the requirements  validation process for materiel solutions. We also met with geographic  combatant command officials and analyzed the commands’ written  responses to a questionnaire to better understand their current and  anticipated demand for biometric and forensic capabilities.
To evaluate the extent to which DOD has taken actions to meet enduring  requirements for deployable biometric and forensic capabilities since  2011, we reviewed and analyzed relevant planning, acquisition, and  sustainment documents, including emergent and urgent operational  needs statements, analyses of alternatives, and capability development  documents, to identify any challenges and gaps in meeting validated joint  requirements. During the course of our analysis, we determined that a  DOD-reported completion status of 75 percent or more was reflective of  the validated non-materiel requirement having made significant progress.  We also compared the content and process for developing DOD’s  biometric and forensic strategic plans with Standards for Internal Controls  in the Federal Government for control activities to determine their  enterprise utility. In addition, we compared federal information systems  guidance on contingency planning with acquisition planning and  development documents for DOD’s follow-on authoritative biometric  database. Furthermore, we reviewed and compared contracting  information for providing service contracts to DFBA’s Biometrics  Operations Division, which manages the authoritative biometric database,  with contracting provisions in the National Defense Authorization Act for  Fiscal Year 2017 discouraging the use of lowest-price technically  acceptable selection criteria in certain types of procurements. Finally, we  met with Office of the Secretary of Defense, Joint Staff, military service,  Special Operations Command (SOCOM), geographic combatant  command, and DFBA officials responsible for biometric and forensic  activities to determine the status of DOD’s deployable non-materiel and  materiel biometric and forensic capabilities, current and anticipated  funding sources for materiel solutions, and estimated timeframes for  completion.
To evaluate the extent to which DOD has taken actions to address our  prior recommendations regarding its biometric and forensic capabilities  since 2011, we reviewed our internal recommendation tracking system for  status updates. We also analyzed DOD directives, guidance, and plans  that had been updated or released since 2011, and written responses to  our question set from each of the geographic combatant commands to  determine whether the department had taken actions that met the intent  of our recommendations. Finally, we met with program management,  planning, and acquisition officials from the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD(AT&L)) and  the military services to gather information and clarification on additional  steps the department had taken or planned to take to address our prior  recommendations.
To address our three reporting objectives, we met with biometric and  forensic acquisition, operations, planning, and programming officials from  the DOD organizations identified in table 4. We also met with officials  from the Center for Naval Analyses to discuss their body of work on DOD  biometrics and forensics.
section_title: Appendix II: Geographic Combatant Commands’ Demand for Biometric and Forensic Capabilities
section_title: Appendix III: Department of Defense (DOD)- Validated, Non-materiel Enduring Biometric and Forensic Requirements
paragraphs: Between 2013 and 2014, DOD validated 30 non-materiel enduring  requirements for its deployable biometric and forensic capabilities. These  requirements are designed to transition DOD’s biometric and forensic  capabilities, over a multi-year period, from rapidly acquired and OCO- funded capabilities to enduring capabilities resourced through base  funding. The status and anticipated completion date of each requirement  is detailed in table 5.
section_title: Appendix IV: Additional Actions Taken by Department of Defense (DOD) on Previously Closed GAO Recommendations
paragraphs: As of May 2017, DOD had implemented 15 of 16 recommendations from  our prior reports. Table 6 summarizes the 15 closed recommendations  and additional steps that DOD has taken since they were closed.
section_title: Appendix V: Comments from the Department of Defense
section_title: Appendix VI: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact above, Marc Schwartz, Assistant Director; David  Adams; Vincent Buquicchio; Pamela Davidson; Richard Hung; Amber  Lopez Roberts; Paul Seely; Sarah Warmbein; and Cheryl Weissman  made key contributions to this report.
section_title: Related GAO Products
paragraphs: Defense Forensics: Additional Planning and Oversight Needed to  Establish an Enduring Expeditionary Forensic Capability. GAO-13-447.  Washington, D.C.: June 27, 2013.
Afghanistan: Key Oversight Issues. GAO-13-218SP. Washington, D.C.:  February 11, 2013.
Defense Biometrics: Additional Training for Leaders and More Timely  Transmission of Data Could Enhance the Use of Biometrics in  Afghanistan. GAO-12-442. Washington, D.C.: April 23, 2012.
Afghan Security: Renewed Sharing of Biometric Data Could Strengthen  U.S. Efforts to Protect U.S. Personnel from Afghan Security Force  Attacks. GAO-12-471SU. Washington, D.C.: April 20, 2012.
Defense Biometrics: DOD Can Better Conform to Standards and Share  Biometric Information with Federal Agencies. GAO-11-276. Washington,  D.C.: March 31, 2011.
Defense Management: DOD Can Establish More Guidance for Biometrics  Collection and Explore Broader Data Sharing. GAO-09-49. Washington,  D.C.: October 15, 2008.
Defense Management: DOD Needs to Establish Clear Goals and  Objectives, Guidance, and a Designated Budget to Manage Its Biometrics  Activities. GAO-08-1065. Washington, D.C.: September 26, 2008.