Homeland Security: Communication Protocols and Risk Communication Principles Can Assist in Refining the Advisory System
Published: 2004-06-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Established in March 2002, the Homeland Security Advisory System was designed to disseminate information on the risk of terrorist acts to federal agencies, states, localities, and the public. However, these entities have raised questions about the threat information they receive from the Department of Homeland Security (DHS) and the costs they incurred as a result of responding to heightened alerts. This report examines (1) the decision making process for changing the advisory system national threat level; (2) information sharing with federal agencies, states, and localities, including the applicability of risk communication principles; (3) protective measures federal agencies, states, and localities implemented during high (codeorange) alert periods; (4) costs federal agencies reported for those periods; and (5) state and local cost information collected by DHS.
section_title: What GAO Found
paragraphs: DHS assigns threat levels for the entire nation and assesses threat conditions for geographic regions and industrial sectors based on analyses of threat information and vulnerability of potential terrorist targets. DHS has not yet officially documented its protocols for communicating threat level changes and related threat information to federal agencies and states. Such protocols could assist DHS to better manage these entities' expectations about the methods, timing, and content of information received from DHS. To ensure early, open, and comprehensive information dissemination and allow for informed decisionmaking, risk communication experts suggest that warnings should include (1) multiple communication methods, (2) timely notification, and (3) specific threat information and guidance on actions to take. Federal agencies and states responding to GAO's questionnaires sent to 28 federal agencies and 56 states and territories generally indicated that they did not receive specific threat information and guidance, which they believe hindered their ability to determine and implement protective measures. The majority of federal agencies reported operating at heightened security levels regardless of the threat level, and thus, did not need to implement a substantial number of additional measures to respond to code-orange alerts. States reported that they varied in their actions during code-orange alerts. The costs reported by federal agencies, states, and selected localities are imprecise and may be incomplete, but provide a general indication of costs that may have been incurred. Additional costs reported by federal agencies responding to GAO's questionnaire were generally less than 1 percent of the agencies' fiscal year 2003 homeland security funding. DHS collected information on costs incurred by states and localities for critical infrastructure protection during periods of code-orange alert. However, this information does not represent all additional costs incurred by these entities during the code-orange alert periods.

section_title: Letter
paragraphs: The Homeland Security Advisory System was established in March 2002 to  disseminate information regarding the risk of terrorist acts to federal  agencies, states and localities, and the public utilizing five color-coded  threat levels. Implementation of this system generated questions among  government agencies regarding whether they were receiving the  information necessary to respond appropriately when the national threat  level was raised and about the costs resulting from additional protective  measures implemented during periods of heightened alert.
You asked us to review several aspects about how the Department of  Homeland Security (DHS) was operating the Homeland Security Advisory  System including federal, state, and local responses to heightened alerts.  This report discusses (1) the decision-making process for changing the  national threat level; (2) guidance and other information provided to  federal agencies, states, and localities, including the applicability of risk  communication principles to information sharing; (3) protective measures  federal agencies, states, and localities implemented during high—code- orange—alert periods; (4) additional costs federal agencies reported for  implementing such measures; and (5) information DHS collected on costs  states and localities reported for periods of code-orange alert. In addition,  this report provides information on other threat advisory systems used by  federal agencies, states, localities, and other countries. (See app. I.)
To respond to your request, we met with and obtained information from  DHS officials on the decision-making process for changing the national  threat level; guidance and threat information the department provides to  federal agencies, states, and localities; and information on protective  measures and costs that the department collected from states and  localities. We also examined literature on risk communication principles to  identify the applicability of such principles to the Homeland Security  Advisory System. In addition, we sent questionnaires to 28 federal agencies  and the homeland security or emergency management offices in 50 states,  the District of Columbia, American Samoa, Guam, the Northern Mariana  Islands, Puerto Rico, and the U.S. Virgin Islands, regarding the notification  and information these entities received, the protective measures they took,  and the costs they reported for the three code-orange alert periods from  March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to  January 9, 2004. Although some federal agencies and states did not respond  to every question in our questionnaires, we received responses from 26  federal agencies, which account for about 99 percent of total fiscal year  2003 nondefense homeland security funding as reported to the Office of  Management and Budget (OMB), and 43 states, for a 77 percent response  rate. We selected the 28 federal agencies because they reported receiving  homeland security funding for fiscal year 2003 to OMB and are Chief  Financial Officers Act agencies. For this review, we analyzed information  from the District of Columbia, American Samoa, Guam, the Northern  Mariana Islands, Puerto Rico, and the U.S. Virgin Islands along with  information from states, and we refer to all of these throughout the report  as states.
To obtain information on localities’ experiences during code-orange alerts,  we conducted site visits with officials from 12 localities (8 cities and 4  counties). We selected the 12 localities to visit based on the following  criteria: (1) their receipt of grants from DHS; (2) their geographic location  and topography (e.g., inland, border, or seaport); and (3) the type of locality  (e.g., metropolitan and nonmetropolitan areas). We also sent a  questionnaire to 8 additional localities, selecting them based on population  and geographic location. We received questionnaire responses from 4 of  these localities. We used information obtained from the 16 localities we  visited or from which we received questionnaire responses only as  anecdotal examples, as information from these localities cannot be  generalized across all localities in the United States.
DHS has not documented the policies and procedures it has used for  assessing intelligence information, determining whether to raise or lower  the threat level, and notifying federal agencies, states, and localities about  changes in threat levels. Thus, the information provided about the  operations of the Homeland Security Advisory System is principally based  on interviews with DHS officials and questionnaire responses. We  conducted our work from July 2003 to May 2004 in accordance with  generally accepted government auditing standards. For more detailed  information on our scope and methodology, see appendix II.
subsections: section_title: Background
paragraphs: Homeland Security Presidential Directive 3 (HSPD-3) established the  Homeland Security Advisory System in March 2002. Through the creation  of the Homeland Security Advisory System, HSPD-3 sought to produce a  common vocabulary, context, and structure for an ongoing discussion  about the nature of threats that confront the nation and the appropriate  measures that should be taken in response to those threats. Additionally,  HSPD-3 established the Homeland Security Advisory System as a  mechanism to inform and facilitate decisions related to securing the  homeland among various levels of government, the private sector, and  American citizens.
The Homeland Security Advisory System is comprised of five color-coded  threat conditions as described below, which represent levels of risk related  to potential terror attack.
Code-red or severe alert—severe risk of terrorist attacks.
Code-orange or high alert—high risk of terrorist attacks.
Code-yellow or elevated alert—significant risk of terrorist attacks.
Code-blue or guarded alert—general risk of terrorist attacks.
Code-green or low alert—low risk of terrorist attacks.
As defined in HSPD-3, risk includes both the probability of an attack  occurring and its potential gravity.
Since its establishment in March 2002, the Homeland Security Advisory  System national threat level has remained at elevated alert—code-yellow— except for five periods during which the administration raised it to high  alert—code-orange. The periods of code-orange alert follow:  September 10 to 24, 2002;  February 7 to 27, 2003;  March 17 to April 16, 2003;  May 20 to 30, 2003; and  December 21, 2003, to January 9, 2004.
The Homeland Security Advisory System is binding on the executive  branch. HSPD-3 directs all federal departments, agencies, and offices, other  than military facilities, to conform their existing threat advisory systems  to the Homeland Security Advisory System. These agencies are responsible  for ensuring their systems are consistently implemented in accordance  with national threat levels as defined by the Homeland Security Advisory  System. Additionally, federal departments and agency heads are  responsible for developing protective measures and other antiterrorism or  self-protection and continuity plans in response to the various threat levels  and operating and maintaining these plans. While HSPD-3 encourages other  levels of government and the private sector to conform to the system, their  compliance is voluntary.
When HSPD-3 first established the Homeland Security Advisory System, it  provided the Attorney General with responsibility for administering the  Homeland Security Advisory System, including assigning threat conditions  in consultation with members of the Homeland Security Council, except in  exigent circumstances. As such, the Attorney General could assign threat  levels for the entire nation, for particular geographic areas, or for specific  industrial sectors. Upon its issuance, HSPD-3 also assigned responsibility  to the Attorney General for establishing a process and a system for  conveying relevant threat information expeditiously to federal, state, and  local government officials, law enforcement authorities, and the private  sector.
In November 2002, Congress passed the Homeland Security Act of 2002,  P.L. 107-296, which established the Department of Homeland Security.  Under the Homeland Security Act of 2002, the DHS Under Secretary for  Information Analysis and Infrastructure Protection (IAIP) is responsible  for administering the Homeland Security Advisory System. As such, the  Under Secretary for IAIP is primarily responsible for issuing public threat  advisories and providing specific warning information to state and local  governments and to the private sector. The act also charges the Under  Secretary for IAIP with providing advice about appropriate protective  actions and countermeasures.
In February 2003, in accordance with the Homeland Security Act, the  administration issued Homeland Security Presidential Directive 5 (HSPD- 5), which amended HSPD-3 by transferring authority for assigning threat  conditions and conveying relevant information from the Attorney General  to the Secretary of Homeland Security. HSPD-5 directs the Secretary of  Homeland Security to consult with the Attorney General and other federal  agency heads the Secretary deems appropriate, including other members of  the Homeland Security Council, when determining the threat level, except  in exigent circumstances.
section_title: Threat Information and Vulnerability of Potential Targets Inform National and Sector- or Location- Specific Threat Level Decisions
paragraphs: In implementing the Homeland Security Advisory System, DHS assigns  national threat levels and assesses the threat condition of specific  geographic locations and industrial sectors. While the national threat level  has been raised and lowered for five periods, DHS officials told us that the  department has not yet assigned a threat level for an industrial sector or  geographic location. However, DHS officials said that the department has  encouraged specific sectors and regions to operate at heightened levels of  security. According to DHS officials, decisions to change the national threat  level and to encourage specific sectors and regions to operate at  heightened levels of security involve both analysis and sharing of threat  information, as well as an assessment of the vulnerability of national  critical infrastructure assets that are potential targets of terrorist threats.
DHS officials told us they use the criteria in HSPD-3 in determining  whether to raise the national threat level or whether to suggest that certain  regions or sectors operate at heightened security levels. These criteria  include:  the credibility of threat information;  whether threat information is corroborated;  the degree to which the threat is specific and/or imminent; and  the gravity of the potential consequences of the threat.
In determining whether these criteria are met and whether to raise the  national threat level, DHS considers intelligence information and the  vulnerability of potential targets, among other things. DHS officials told us  that they use a flexible, “all relevant factors” approach to decide whether to  raise or lower the national threat level or whether to suggest that certain  regions or sectors operate at heightened security levels. They said that  analysis of available threat information and determination of national  threat levels and regional and sector threat conditions are specific for each  time period and situation. According to these officials, given the nature of  the data available for analysis, the process and analyses used to determine  whether to raise or lower the national threat level or suggest that specific  regions or sectors heighten their protective measures are inherently  judgmental and subjective.
DHS officials said that the intelligence community continuously gathers  and analyzes information regarding potential terrorist activity. This  includes information from such agencies as DHS, the Central Intelligence  Agency, the Federal Bureau of Investigation (FBI), and the Terrorist Threat  Integration Center, as well as from state and local law enforcement  officials. DHS officials also noted that analyses from these and other  agencies are shared with DHS’s IAIP, which is engaged in constant  communication with intelligence agencies to assess potential homeland  security threats.
DHS also considers the vulnerability of potential targets when determining  the national threat level. For example, DHS officials explained that they  hold discussions with state and local officials to determine whether  potential targets specified by threat information require additional security  to prevent a terrorist attack or minimize the potential gravity of an attack.  According to these officials, if the target is determined to be vulnerable,  then DHS will consider raising the threat level. Last, DHS determines  whether there is a nationwide threat of terrorist attack or if the threat is  limited to a specific geographic location or a specific industrial sector. DHS  officials said that, in general, upon assessment of the above criteria, if there  appears to be a threat of terrorist attack nationwide, then IAIP  recommends to the Secretary of Homeland Security that the national threat  level should be raised. The Secretary of Homeland Security then consults  with the other members of the Homeland Security Council on whether the  national threat level should be changed. DHS officials told us that if the  Homeland Security Council members could not agree on whether to  change the national threat level, the President would make the decision.  DHS officials also told us that when deciding whether to lower the national  threat level, they consider whether the time period in which the potential  threat was to occur has passed and whether protective measures in place  for the code-orange alerts have been effective in mitigating the threats.
DHS officials told us that if a credible threat against specific industrial  sectors or geographic locations exists, DHS may suggest that these sectors  or locations operate at a heightened level of security, rather than raising the  national threat level. For example, for the third code-orange alert period in  our review from December 31, 2003, to January 9, 2004, threat information  raised concerns of potential terrorist activity for specific industrial sectors  and geographic locations. In response, DHS officials said that they  encouraged those responsible for securing chemical and nuclear power  plants, transit systems, and aircraft, as well as certain cities, to maintain a  heightened level of security, even after the national threat level was  lowered to code-yellow. However, DHS officials noted that they did not  assign a threat level to these sectors and regions at that time. DHS officials  further indicated that these sectors and locations were not operating at  code-orange alert levels. Rather, they operated at heightened levels of  security. According to DHS officials, when encouraging specific sectors or  regions to continue to operate at heightened levels of security, DHS may  suggest that these sectors or regions (1) implement security measures that  are in addition to those implemented during a code-orange alert period, (2)  continue the measures implemented during the code-orange alert period,  or (3) continue selected measures implemented during a code-orange alert  period.
DHS officials told us that not all threats to specific regions or sectors are  communicated to the public or to officials in all regions or sectors. Rather,  if intelligence information suggests a targeted threat to specific regions or  industrial sectors, DHS officials said that they inform officials in the  specific regions or sectors that are responsible for implementing protective  measures to mitigate the terrorist threat. To inform these officials, DHS  issues threat advisories or information bulletins. The threat advisories we  reviewed contained actionable information about threats targeting critical  national networks, infrastructures, or key assets such as transit systems.  These products may suggest a change in readiness posture, protective  actions, or response that should be implemented in a timely manner. If the  threat is less urgent, DHS may issue information bulletins, which  communicate risk and vulnerabilities of potential targets. In a February  2004 testimony, the Deputy Secretary of Homeland Security said that  because threat advisories and information bulletins are derived from  intelligence, they are generally communicated on a need-to-know basis to a  targeted audience. The threat advisories and bulletins we reviewed also  included advice on protective measures to be implemented by law  enforcement agencies or the owners and operators of national critical  infrastructure assets in response to the specific threat.
section_title: Risk Communication Principles Can Be Useful in Communicating Threat Information and Guidance to Federal Agencies and States
paragraphs: DHS officials told us that they have not yet officially documented protocols  for communicating information about changes in the national threat level  to federal agencies and states. To ensure early and comprehensive  information sharing and allow for informed decision making, risk  communication experts suggest that threat warnings should include the  following principles: (1) communication through multiple methods, (2)  timely notification, and (3) specific information on the nature, location, and  timing of threats as well as guidance on actions to take in response to  threats. These principles can be applied to threat information shared with  federal agencies and states through the Homeland Security Advisory  System. DHS used multiple methods to notify federal agencies and states of  changes in the national threat level. However, many federal agencies and  states responding to our questionnaires indicated that they heard about  threat level changes from media sources before being notified by DHS.  Federal agencies and states also reported that they did not receive specific  threat information and guidance for the three code-orange alert periods  from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003,  to January 9, 2004.
subsections: section_title: DHS Has Not Documented Communication Protocols Regarding Threat Level Changes Including the Methods, Timing, and Content of Guidance and Threat Information to Be Shared
paragraphs: Documentation of communication protocols can assist DHS in better  managing the expectations of federal agencies and states regarding the  methods, timing, and content of guidance and threat information they  receive when the national threat level is raised to code-orange. DHS  officials told us that they have not yet officially documented protocols for  notifying federal agencies and states of changes in the national threat level,  but are working to do so. They noted that it is has been difficult to develop  protocols that provide sufficient flexibility for sharing information in a  variety of situations. Thus, while attempts have been made to officially  document protocols for notifying federal agencies and states of national  threat level changes, DHS officials said that they have not made much  progress in doing so and could not provide a specific target date for  completing this effort. Without documented communication protocols,  recipients of threat level notifications are uncertain as to how, when, and  from what entity, such as which DHS agency, they will be notified of threat  level changes and the content and extent of guidance and threat  information they may receive. Communication protocols would, among  other things, help foster clear understanding and transparency regarding  DHS’s priorities and operations. Moreover, protocols could help ensure  that DHS interacts with federal, state, local, and other entities using clearly  defined and consistently applied policies and procedures.
section_title: Risk Communication Experts Suggest Warnings Should Be Communicated via Multiple Methods, Be Timely, and Include Specific Threat Information and Guidance on Protective Measures
paragraphs: Risk communication is the exchange of information among individuals and  groups regarding the nature of risk, reactions to risk messages, and legal  and institutional approaches to risk management. Risk communication  experts have identified the following as important principles for  communicating risks to individuals and groups:  Threat information should be consistent, accurate, clear, and provided  repeatedly through multiple methods.
Threat information should be provided in a timely fashion.
To the greatest extent possible, threat information should be specific  about the potential threat, including:  the nature of the threat,  when and where it is likely to occur, and  guidance on protective measures to take to prevent or respond to the  threat.
These risk communication principles have been used in a variety of  warning contexts, from alerting the public about severe weather or  providing traffic advisories, to less commonplace warnings of infectious  disease outbreaks or potential dangers from hazardous materials or toxic  contamination. However, warnings about terrorist threats differ from  these relatively more familiar warnings. For example, specific terrorist  threat warnings to the public may allow terrorists to alter tactics or targets  in response to the issuance of warnings. Warnings of terrorist threats may  also increase general anxiety for populations clearly not at risk. Moreover,  government agencies may not always have specific information on terrorist  threats, or may not be able to publicly share specific information in threat  warnings. Yet, despite these differences, the purpose of warnings,  regardless of the threat, is to provide information to citizens and groups  that allows them to make informed decisions about actions to take to  prevent and respond to threats. Thus, risk communication principles  should be applicable to communicating terrorist threat information to  federal agencies, states, and localities through the Homeland Security  Advisory System.
section_title: DHS Used Multiple Methods to Notify Federal Agencies and States of Threat Level Changes
paragraphs: According to risk communication principles, threat information should be  provided through multiple methods to ensure that dissemination of the  information is comprehensive and that people receive the information  regardless of their level of access to information. In addition, HSPD-3 states  that the Homeland Security Advisory System should provide a  comprehensive and effective means to disseminate information regarding  the risk of terrorist acts to federal, state, and local authorities. One means  of disseminating threat information is through notifications to federal  agencies and states of changes in the national threat level. DHS officials  told us that with each increase in the national threat level, they apply  lessons learned from previous alerts to improve their notification and  information sharing processes regarding threat level changes. Based on  federal agencies’ and states’ responses to our questionnaires, it appears  that DHS is making progress in expanding the scope of its notification  process, which is consistent with HSPD-3. As shown in table 1, more  federal agencies reported receiving direct notification from DHS for the  third code-orange alert period than for the other two code-orange alert  periods in our review. Similarly, more federal agencies reported receiving  notification from DHS via multiple methods for the third code-orange alert  period than for the other two code-orange alert periods.
DHS used the following methods, among others, to notify entities of  changes in the national threat level, according to federal agencies’ and  states’ responses to our questionnaires and discussions with DHS and local  government officials:  Conference calls between the Secretary of Homeland Security and state  governors and/or state homeland security officials.
Telephone calls from Federal Protective Service (FPS) officials to  federal agencies.
E-mail, telephone, or electronic communications from Homeland  Security Operations Center (HSOC) representatives to the federal, state,  or local agencies they represent.
FBI electronic systems, such as the National Law Enforcement  Telecommunications System.
E-mail and/or telephone communications with federal agencies’ chief of  staff and public affairs offices.
E-mail and/or telephone communications to local government  associations such as the National Governors Association and the U.S.  Conference of Mayors.
section_title: Federal Agencies and States Reported Hearing about Threat Level Changes from Media Sources before Receiving Notification from DHS
paragraphs: Risk communication experts suggest that threat information should be  provided in a timely fashion to prevent unofficial sources, such as the  media, from reporting information before official sources, including  government agencies, do so. These principles suggest that lack of early and  open information sharing from official entities can undermine these  entities’ credibility. HSPD-3, as amended by HSPD-5, states that the  Secretary of Homeland Security should establish a process and a system  for conveying relevant information regarding terrorist threats  expeditiously. In addition, for an entity to control its operations, it must  have relevant, reliable, and timely communications relating to internal and  external events.
Many federal agencies and some states responding to our questionnaires  expressed concerns that they learned about national threat level changes  from media sources before being notified by DHS. Specifically, 16 of 24  federal agencies indicated that they learned about threat level changes via  media sources prior to being notified by DHS for at least one of the three  code-orange alert periods. Likewise, 15 of 40 states reported learning  about national threat level changes via media sources prior to being  notified by DHS for at least one of the three code-orange alert periods. This  raises questions about whether DHS is always conveying information  regarding threat level changes to government entities expeditiously, as  required by HSPD-3.
Moreover, some states reported that their ability to provide credible  information to state and local agencies and the public was hindered  because they did not receive notification from DHS before the media  reported on the threat level changes. For example, 6 states noted that when  media sources reported national threat level changes before state and local  emergency response officials were directly notified by DHS, these officials  did not have sufficient time to prepare their response to the threat level  change, including how they would respond to requests from the public for  additional information on the threat level change. One other state reported  that it would prefer to first learn about changes in the national threat level  from DHS so that it has sufficient time to notify state agencies and  localities of the change and so that these entities can prepare their  responses before the public is notified of the change. Additionally, 8  localities from which we obtained information indicated that they first  learned of threat level changes from media sources, and 4 of these  localities would prefer to be notified of threat level changes prior to the  public. Officials from some of these localities told us that after media  sources reported the change, their agencies received requests for detailed  information on the change from the public and other entities. They noted  that their agencies appeared ineffective to the public and other entities  because, without notification of the national threat level change before it  was reported by media sources, they did not have time to prepare informed  responses.
DHS officials told us that they attempt to notify federal agencies and states  of threat level changes before the media report on the changes. However,  they noted that DHS has not established target time periods in which to  notify these entities of the threat level changes. Furthermore, DHS officials  indicated they were aware that the media sometimes reported threat level  changes before DHS notified federal and state officials, and in the case of  the second code-orange alert period in our review, before the decision to  raise the threat level was even made. DHS officials told us that they send  notifications/advisories to the media to inform them of impending press  conferences and that the media may speculate about announcements of  threat level changes that may be made at the press conferences. DHS  officials indicated that the department is trying to determine the best  approach for managing expectations created by this situation.
section_title: Federal Agencies and States Reported that They Generally Did Not Receive Specific Guidance and Threat Information for Code-Orange Alert Periods, Hindering Their Response to the Alerts
paragraphs: Risk communication experts said that without specific information on the  nature, location, and timing of threats and guidance on actions to take,  citizens may not be able to determine whether they are at risk and make  informed decisions about actions to take in response to threats, and thus  may take inappropriate actions. According to HSPD-3, the Homeland  Security Advisory System was established to inform and facilitate decisions  appropriate to different levels of government regarding terrorist threats  and measures to take in response to threats. However, federal agencies and  states responding to our questionnaires generally indicated that they did  not receive guidance and specific information on threats on the three  occasions included in our review when the national threat level was raised  to code-orange. These entities reported that insufficient information on the  nature, location, and timing of threats and insufficient guidance on  recommended measures hindered their ability to determine whether they  were at risk as well as their ability to determine and implement protective  measures.
As shown in table 2, federal agencies and states responding to our  questionnaires indicated that they generally did not receive specific  information on threats with notification of increases in the national threat  level for the three code-orange alert periods included in our review. Yet, as  table 2 suggests, a greater number of federal agencies and states reported  receiving more specific threat information for the third code-orange alert  period than for the other two code-orange alert periods.
As shown in tables 3 and 4, federal agencies and states responding to our  questionnaires indicated that guidance and specific information on threats,  if available, would have assisted them in determining their levels of risk  and measures to take for the December 21, 2003, to January 9, 2004, code- orange alert period. Results for the other two code-orange alert periods are  consistent with those reported in tables 3 and 4 for the third code-orange  alert period.
Furthermore, 13 localities reported to us that information on site-, area-, or  event-specific threats would have been beneficial to them in responding to  the code-orange alert periods. Six of the localities from which we obtained  information reported that information on region- or sector-specific threats  would have assisted them in determining their level of risk and measures to  take in response to the three code-orange alerts in our review.
When federal agencies and states perceive that they have not received  sufficient guidance and threat information, these entities may not be able  to determine whether they are at risk from possible threats or what  measures to take in response to the threats. For example, 1 federal agency  reported that DHS never notified the agency as to whether Washington,  D.C., would remain at heightened security levels after the national threat  level was lowered to code-yellow on January 9, 2004, which resulted in the  agency maintaining code-orange alert measures for an additional week and  incurring additional costs for doing so. Another federal agency reported  that to respond to the code-orange alerts, it implemented measures at all  facilities regardless of the specific location or risk involved, which spread  resources across all facilities rather than focusing the measures on  mitigating specific threats. Officials from 1 state and 1 locality noted that  without specific threat information, these entities did not understand the  true nature of the threat and what impact the threat may have on them.
Federal agencies and states responding to our questionnaire also indicated  that without guidance and specific threat information, they may not be able  to effectively and efficiently target or enhance protective measures to  respond to the code-orange alerts. Eighteen of the 25 federal agencies and  32 of the 41 states providing responses to the questions on operational  challenges in our questionnaires reported that lack of sufficient threat  information was a challenge they faced during the three code-orange alert  periods. Moreover, in responding to our questionnaires, 16 federal agencies  and 12 states noted that insufficient information on threats makes it  difficult for these entities to focus resources on specific measures to  respond to threats.
At a February 2004 hearing, the Deputy Secretary of Homeland Security  said that the department’s communications of national threat level changes  are intended to provide specific information regarding the intelligence  supporting the change in the threat level, and that protective measures are  developed and communicated, along with the threat information, prior to a  public announcement of the decision. DHS officials told us that they  provide specific threat information, when available, to federal agencies,  states, and localities at risk and with the authority to respond to threats.  For example, the Deputy Secretary said that threat information that was  shared by DHS regarding changes in the national threat level was primarily  intended for security professionals at all levels of government and the  private sector. Moreover, to provide more specific threat information and  respond to sector- and location-specific security needs, DHS officials told  us they have adjusted the system based on feedback from federal, state,  local and private sector officials; tests of the system; and experience with  previous periods of code-orange alert. For example, for the most recent  code-orange alert from December 21, 2003, to January 9, 2004, the Deputy  Secretary noted in his February 2004 testimony that DHS provided specific  recommendations for protective measures to industrial sectors and for  geographic areas in response to specific threat information.
section_title: Federal Agencies Reported Implementing Few New Protective Measures for Code- Orange Alerts because They Always Operate at High Security Levels, While States Varied Their Responses
paragraphs: The majority of federal agencies responding to our questionnaire indicated  that they maintain high security levels regardless of the national threat  level and, as a result, they did not need to implement a substantial number  of new or additional protective measures to respond to the three periods of  code-orange alert from March 17 to April 16, 2003; May 20 to 30, 2003; and  December 21, 2003, to January 9, 2004. For the most part, these federal  agencies reported enhancing existing protective measures to respond to  the three code-orange alerts. To a lesser extent, federal agencies continued  the use of existing measures, without enhancement, during the code- orange alert periods. On the other hand, states differed in the extent to  which they enhanced or maintained existing measures or implemented  additional protective measures solely in response to the code-orange alerts.  Federal agencies and states reported benefits, such as a heightened sense  of security among employees, from enhancing or implementing protective  measures for the code-orange alert periods. However, federal agencies and  states also indicated that taking such measures negatively affected their  operations, for example, by redirecting resources from normal operations  to code-orange alert duties.
subsections: section_title: Federal Agencies Reported that High Security Postures Reduced the Need to Implement Additional Measures Solely in Response to Code-Orange Alerts
paragraphs: More than half of the federal agencies responding to our questionnaire  indicated that they operate at high security levels, regardless of the  national threat level. Thus, they did not need to implement a significant  number of new or additional protective measures to respond to code- orange alerts. For example, in response to the third code-orange alert  period in our review—December 21, 2003 to January 9, 2004—10 of 24  federal agencies indicated that they most commonly enhanced existing  protective measures, such as increasing facility security patrols. During the  same code-orange alert period, 8 federal agencies reported most often  continuing protective measures at their pre-code-orange alert levels, for  example, relying on continuing activation of monitoring systems and  intrusion detection devices. For the remaining 6 federal agencies, there  were slight differences among the number of protective measures they  enhanced during the third code-orange alert period, those they maintained  at pre-code orange alert levels, and those they implemented solely in  response to the code-orange alert. For one of these agencies,  three of the protective measures in place for the third code-orange alert  period were maintained at their pre-code-orange alert levels,  three of the protective measures were enhanced beyond their pre-code- orange alert levels, and  four protective measures were implemented solely for the code-orange  alert period.
Results for the other two code-orange alert periods in our review are  similar to those reported for the third code-orange alert period. For more  information on protective measures federal agencies most commonly  reported having in place for the three code-orange alert periods and their  testing of such measures, see appendix IV.
section_title: States Differed in the Extent to Which They Implemented Additional Protective Measures for Code-Orange Alerts
paragraphs: Overall, states differed in the extent to which they implemented additional  protective measures for the three code-orange alert periods in our review.  Based on our analysis of questionnaire responses from the 40 states that  provided information on protective measures for the third code-orange  alert period in our review,  16 states most often enhanced protective measures that were already in  place prior to the code-orange alert period;  6 states most often implemented new protective measures for the code-  5 states most often maintained protective measures that were already in  place at their pre-code-orange alert levels; and  13 states employed a varied response, enhancing measures, continuing  existing measures, and/or implementing new measures in roughly equal  proportion.
Results for the other two code-orange alert periods in our review are  similar to those reported for the third code-orange alert period.
Various reasons influenced the extent to which states responding to our  questionnaire enhanced, maintained, or implemented new protective  measures. For example, some states reported that they already operated at  heightened security levels and, therefore, did not need to implement  additional protective measures in response to the code-orange alerts in our  review; rather they enhanced measures already in place. Other states  indicated that the extent to which they implemented protective measures  for the code-orange alert periods in our review depended on specific threat  information. For example, 1 state indicated that it did not enhance existing  protective measures or implement new protective measures for the code- orange alert periods in our review because there were no specific threats to  the state that required it to do so. Other states indicated that the extent to  which they implemented protective measures for code-orange alert periods  depended on the required level of security for their critical infrastructure  sites. For example, 1 state reported that it implemented new protective  measures for its nuclear power plants during code-orange alert periods, but  for some other critical infrastructure assets, it enhanced security measures  already in place. Some states also indicated that resource constraints  determined the extent to which they enhanced or implemented new  protective measures for code-orange alert periods. For example, 2 states  indicated that they had to implement a substantial number of new  protective measures for the three code-orange alert periods in our review  because they could not afford to always operate at a high level of security.  For more detailed information on protective measures that states most  commonly reported having in place for code-orange alert periods and  testing of these measures, see appendix IV.
Additionally, 4 localities from which we obtained information reported that  they did not enhance or implement a substantial number of protective  measures to respond to the code-orange alerts because they did not receive  specific threat information indicating that the localities were at risk. For  example, 1 locality reported that because it did not receive specific threat  information on possible targets, the locality did not take any measures to  respond to the code-orange alerts. Additionally, another locality noted that  its emergency response staff was not able to implement additional  measures in response to the code-orange alerts because the staff was too  busy with regular duties such as responding to 911 calls.
section_title: Federal Agencies and States Reported that Protective Measures for Code-Orange Alerts Were Beneficial, but also Presented Operational Challenges and Affected Normal Operations
paragraphs: Federal agencies and states responding to our questionnaires indicated that  they benefited in various ways from the protective measures they enhanced  or implemented during the code-orange alert periods, but also noted that  they faced operational challenges in responding to the three code-orange  alert periods in our review. For example, federal agencies and states  reported that protective measures increased employees’ sense of security,  promoted staff awareness, and provided visible deterrents to possible  threats. However, federal agencies and states responding to our  questionnaires also reported that their operations were negatively affected  during code-orange alerts as a result of protective measures they enhanced  or implemented. For example, 10 federal agencies and 13 states reported  that they had to redirect resources from normal operations to enhance or  implement protective measures for code-orange alerts. One locality also  reported that its operations were negatively affected by the redirection of  personnel, which resulted in delays of maintenance activities and  preventative exercises as well as postponement of training. Additionally, 15  federal agencies noted delays for visitors and employees. Some of these  federal agencies and states reported that maintaining a code-orange alert  level of security for more than a few days at a time significantly drained  their security resources—an effect federal agencies and states have  identified as “code-orange alert fatigue.”
Federal agencies and states also indicated that the lack of federal  governmentwide coordination hindered their ability to respond to threats.  Without coordination of information and intelligence sharing during code- orange alert periods, federal agencies and states responding to our  questionnaires noted that they may not receive threat information needed  to help them determine and implement their responses to code-orange  alerts. For example, 1 federal agency reported that it received different  requests from several federal agencies to deploy personnel to different  locations. This federal agency noted that improved federal  governmentwide coordination might result in more efficient assignment of  resources. Similarly, 1 locality noted that because different government  agencies notified different local agencies of changes in the national threat  level, first responders and local officials could not effectively and  efficiently coordinate and implement protective resources. On the other  hand, 1 state official raised concerns about whether federal agencies were  fully informed of the information DHS provided to states and had the  information needed to implement appropriate local security measures. This  official noted that persons from the Transportation Security  Administration, the Coast Guard, and the U.S. Army Corps of Engineers  called his state’s homeland security office for advisories and bulletins DHS  had provided to the state. Because of these information requests, this  official noted that the state was concerned that officials from these federal  agencies did not receive information needed to implement security  measures, especially at airports. In commenting on a draft of this report,  DHS officials stated that the department is working to address this  problem.
Six states also indicated that insufficient information from DHS on national  critical infrastructure assets made it difficult to effectively protect these  assets during the code-orange alert periods. Three of these states indicated  that DHS asked them to protect specific national critical infrastructure  sites, some of which were no longer operational or others that were closed,  such as shopping malls. Officials in one state indicated that DHS did not  coordinate with the state when it initially developed this list of national  critical infrastructure assets. DHS officials told us that the department  developed a list of national critical infrastructure assets to assist states in  determining protective measures to implement at their national critical  infrastructure sites. According to the Deputy Director of the Protective  Security Division of IAIP, DHS initially developed a list of 145 national  critical infrastructure assets, including nuclear power plants, chemical  facilities, and transportation systems, to ensure their security during  Operation Liberty Shield. This official told us that DHS identified national  critical infrastructure assets for the list based on intelligence information  indicating possible assets at risk, the vulnerabilities of these assets, and  possible consequences of an attack on assets, including health, safety, and  economic impacts. DHS did not coordinate with states and localities in  developing the national critical infrastructure assets list for Operation  Liberty Shield because planning and timing of military operations for the  war in Iraq and for Operation Liberty Shield were given the highest  classification levels and discussed only at the federal level. The Deputy  Director said that since Operation Liberty Shield, DHS has continually  expanded and revised its national critical infrastructure assets list based on  ongoing analysis of threat information and input from states. In reviewing a  draft of this report, DHS officials told us that its Protective Security  Division has given all states and territories opportunities to suggest assets  to be included in the National Asset Database as well as to verify and  validate information DHS maintains on such assets. To enhance standard  security levels at national critical infrastructure sites, this DHS official said  that the department is working with states to develop plans for protecting  the immediate areas surrounding national critical infrastructure assets and  reducing vulnerabilities in those areas. In particular, the Deputy Director  told us that DHS provided guidance and information to states and local law  enforcement agencies to develop protection plans for areas around  national critical infrastructure assets.
section_title: DHS Efforts to Gather Information on Protective Measures Taken by States and Localities
paragraphs: The majority of states responding to our questionnaire indicated that, for  all three code-orange alert periods in our review, DHS requested some  information on protective measures taken by states in response to the  heightened threat levels. However, as shown in table 5, most states  reported that DHS did not request information on the effectiveness of these  security measures.
An Office of State and Local Government Coordination official said that  DHS maintains close contact with states and localities during code-orange  alert periods and fosters information sharing about actions taken to  increase security. For example, this official noted that DHS co-sponsored a  February 2003 workshop with the FBI to encourage state-level  implementation of the Homeland Security Advisory System and provide a  forum for information exchange among state and local homeland security  representatives. More recently, on April 19, 2004, DHS launched a new Web  site (www.llis.gov) to provide a nationwide network of lessons learned and  best practices for homeland security officials and emergency responders.  For the most recent code-orange alert from December 21, 2003 to January  9, 2004, DHS officials noted that they contacted states to inquire about  protective measures that were put in place. According to DHS officials,  they made such inquiries to (1) monitor the extent to which states  implemented protective measures that DHS recommended, (2) apprise the  White House of actions taken in response to code-orange alerts, and (3)  enhance DHS officials’ understanding of protective measures for which  states may seek reimbursement.
section_title: Costs Reported by Federal Agencies, though Limited, Suggest a Decline in Additional Costs
paragraphs: Sixteen of 26 federal agencies responding to our questionnaire reported  additional costs for at least one of the code-orange alert periods in our  review. We examined the cost information provided by these agencies for  obvious errors and inconsistencies and examined agencies’ responses to  the questionnaire regarding the development of the cost information. In  doing so, we found that these federal agencies’ cost data were generated  from various sources, such as financial accounting systems, credit card  logs, and security contracts. Additionally, this cost information is not  precise, nor do the costs likely represent all additional costs incurred  during code-orange alert periods. In some cases, we have concerns about  the reliability of the data sources used to develop the costs reported to us.  For example, 6 of the 16 federal agencies reported that they extracted some  of the code-orange alert cost data from their agencies’ financial accounting  systems. However, as reported in the fiscal year 2005 President’s Budget, 5  of these agencies’ financial management performance had serious flaws as  of December 31, 2003. Despite these limitations, we believe the cost data to  be sufficiently reliable as indicators of general ranges of cost and overall  trends. However, the data should not be used to determine the cumulative  costs incurred across all federal agencies.
Based on the information provided by federal agencies, total additional  costs reported by federal agencies responding to our questionnaire for the  March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert  periods were less than 1 percent of these agencies’ fiscal year 2003  homeland security funding, as reported to OMB. On the basis of this cost  information, we determined additional average daily costs ranged from  about $190 to about $3.7 million across all three code-orange alert periods  in our review. Based on information reported by these agencies, the  additional average daily costs incurred across code-orange alert periods  have declined over time.
Some of these federal agencies attribute this decline to continued  enhancement of standard levels of security. Some federal agencies reported  that they did not have any additional costs during code-orange alert  periods, as they either did not implement any additional protective  measures or they redirected already existing resources to implement  additional code-orange alert measures rather than employ additional  resources. Although federal agencies may not have reported additional  costs directly as a result of implementing protective measures for code- orange alerts, actions taken such as redirecting resources from normal  operations would have resulted in indirect costs.
subsections: section_title: Additional Costs Reported by Federal Agencies for the First and Second Alert Periods in Our Review Were Less than 1 Percent of Agencies’ 2003 Homeland Security Funding
paragraphs: Sixteen of 26 federal agencies responding to our questionnaire reported  additional costs for the first code-orange alert period in our review—March  17 to April 16, 2003. Fifteen of these agencies also reported additional costs  for the second code-orange alert period in our review—May 20 to 30, 2003.  For 13 of the 15 federal agencies that reported additional costs for both the  first and second code-orange alert periods in our review, we calculated that  the additional costs reported by these agencies were less than 1 percent of  these agencies’ fiscal year 2003 homeland security funding. This calculation  is based on OMB’s 2003 Report to Congress on Combating Terrorism,  which presented information federal agencies reported to OMB on the  amount of homeland security funding authorized to federal agencies in  fiscal year 2003.
For the 16 federal agencies responding to our questionnaire that reported  additional costs during the first code-orange alert period in our review, we  calculated average daily additional costs, which ranged from about $190 to  about $848,000. A cabinet level agency with security responsibilities  limited to protecting its facilities and employees reported the least  additional costs for this code-orange alert period, while another cabinet  level agency that, in addition to securing its facilities, is responsible for the  protection of national critical infrastructure assets reported the most  additional costs. For the 15 federal agencies that reported additional costs  for the second and third—December 21, 2003, to January 9, 2004—code- orange alert periods in our review, we calculated additional average daily  costs that ranged from about $240 to about $3.7 million and from about  $190 to about $1 million, respectively. The agency that reported the least  additional costs for the second and third code-orange alert periods in our  review was an independent agency, while the agencies that reported the  most additional costs for these code-orange alert periods were generally  cabinet agencies that are responsible for the protection of national critical  infrastructure assets. Most of the additional costs federal agencies reported  were personnel costs, such as overtime wages or costs for additional  security personnel. Appendix V provides additional information regarding  cost information submitted by federal agencies.
section_title: Federal Agencies’ Additional Average Daily Costs for Code-Orange Alerts Declined
paragraphs: Based on the cost information provided by federal agencies, we determined  that there was a decline in the additional average daily costs incurred by  these federal agencies over the three code-orange alert periods in our  review. Of the 15 federal agencies that reported additional costs for the first  and third code-orange alert periods, 11 federal agencies experienced an  overall decline in the additional average daily costs across the code-orange  alert periods. Five of these 11 federal agencies indicated that their  additional costs declined across the three code-orange alert periods in our  review because they were consistently enhancing their baseline levels of  security, which, in turn, required fewer additional protective measures  during subsequent code-orange alert periods. Three agencies indicated that  the decline in additional average daily costs was due to a reduction in the  number of protective measures they had in place. One of these agencies  explained that rather than implementing general protective measures with  the receipt of specific threat information for the third code-orange alert in  our review, it was able to determine the most appropriate protective  measures to put in place.
section_title: Some Federal Agencies Reported No Additional Costs Due to Redirection of Existing Resources and Lack of Additional Measures
paragraphs: Six federal agencies reported that they did not have additional costs for at  least two of the code-orange alert periods in our review. Four of these  agencies indicated that they did not have additional costs because they  redirected already existing resources to implement additional protective  measures for the code-orange alert periods rather than employ additional  resources. For example, 2 agencies said that they were able to increase the  frequency of their facility patrols without hiring additional guards or  requiring guards to work overtime by closing one of the facility’s entrances  during code-orange alert. Therefore, the guards who would normally  secure that entrance were assigned to conduct additional roaming facility  patrols. Furthermore, 2 of the 4 agencies indicated that they planned their  protective measures with the specific intent that the agency would not  incur any additional security-related costs during code-orange alert  periods. The remaining 2 agencies reported that they did not have any  additional costs because they did not implement additional protective  measures for the code-orange alert periods. One agency explained that it  did not implement any protective measures during code-yellow or code- orange alert periods because it is located in a privately owned building and  is not responsible for the security of its facility, nor does this agency have  field offices for which it is responsible.
Although these federal agencies reported that they did not directly incur  additional costs to implement protective measures for code-orange alert  periods, the consequences of implementing such protective measures may  have resulted in indirect costs for these agencies. Some federal agencies  responding to our questionnaire indicated they could not quantify these  indirect costs. However, federal agencies provided examples of redirection  of resources that may have caused them to incur such costs. For example,  13 federal agencies noted that in order to implement code-orange alert  measures, they had to redirect existing resources from normal operations.  Furthermore, one agency indicated that redirecting resources in response  to code-orange alerts prevented the agency from performing mission- related activities, such as deterrence of criminal activity other than  terrorism. Additionally, 16 federal agencies said that as a result of  implementing measures for code-orange alerts, there were delays for  employees and visitors entering facilities, which may have resulted in loss  of productivity among employees and a delay in provision of services.  Seven federal agencies indicated that as part of their response to code- orange alerts, they postponed or cancelled agency-sponsored activities  such as training for staff development.
section_title: Cost Data Collected by DHS and Data Reported by Others Cannot be Generalized
paragraphs: DHS has collected limited information on costs incurred by states and  localities during code-orange alert periods through its State Homeland  Security Grant Program – Part II and the Urban Areas Security Initiative –  Part II. States must submit information to DHS to be reimbursed for costs  incurred as a result of actions taken to increase critical infrastructure  protection during code-orange alerts. However, this cost information does  not represent all costs incurred by states and their localities during code- orange alert periods. Therefore, it cannot be used to assess the financial  impact of code-orange alerts on states and localities. The U.S. Conference  of Mayors also collected information and reported estimates of costs  localities incurred in response to code-orange alerts. Moreover, a Director  with the Center for Strategic and International Studies estimated and  reported costs incurred by federal agencies during code-orange alerts.  However, because of limitations in the scope and methodologies used in  these estimates, the cost information they reported may not be adequate  for making generalizations regarding additional costs states and localities  incurred in response to code-orange alerts.
subsections: section_title: DHS Collected Limited Information on Costs Incurred by States and Localities during Code- Orange Alert Periods through Its Grant Programs
paragraphs: DHS issued an information bulletin to states on March 21, 2003, advising  them to capture additional costs incurred by the state and its localities  during the March 17 to April 16, 2003, code-orange alert period for the  protection of critical infrastructure, in the event that funds became  available to reimburse states and localities for these additional costs.  Through the fiscal year 2003 State Homeland Security Grant Program – Part  II (SHSGP II), DHS made a total of $200 million available to states and local  communities to mitigate costs of critical infrastructure protection during  the period of hostilities with Iraq and future periods of heightened threat.  According to SHSGP II guidelines, SHSGP II funds can be used for  public safety agency overtime costs,  contract security personnel costs, and  state-ordered National Guard deployments required to augment security  at critical infrastructure.
Additionally, at least 50 percent of a state’s award must be allocated to local  communities.
Through the fiscal year 2003 Urban Areas Security Initiative – Part II (UASI  II), DHS made approximately $125 million available to reimburse select  urban areas for costs incurred during the February 7 to February 27, 2003;  March 17, 2003, to April 16, 2003; and May 20 to 30, 2003, code-orange alert  periods. Specifically, UASI guidelines allowed for the reimbursement of  costs associated with overtime and critical infrastructure protection. On  January 23, 2004, DHS issued a memorandum to state officials indicating  that SHSGP II and UASI II funding could also be used to reimburse states  and localities for additional costs incurred for protection of critical  infrastructure for the December 21, 2003, to January 9, 2004, code-orange  alert period.
For the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange  alert periods, DHS required states to submit budget detail worksheets,  including the name of the state agency or local jurisdiction that incurred  the additional critical infrastructure protection costs and the amount the  agency or locality requested for reimbursement. For the December 21,  2003, to January 9, 2004, code-orange alert period, DHS provided a more  detailed template for the budget detail worksheet, which asked states to  identify the critical infrastructure site protected and the amount of costs  incurred and personnel deployed for each of the following categories:  contract security personnel, and  emergency operations center overtime.
Additionally, for all three code-orange alert periods in our review, DHS  asked states to distinguish between state-level and local-level costs.  Through SHSGP II and UASI II, states were awarded a specified amount  from which they could draw down over a period of 2 years to reimburse  them for additional costs incurred during code-orange alert periods.  According to the grant guidelines, DHS must approve the budget detail  worksheet before states and localities can obligate, expend, or draw down  these grant funds. DHS, in monitoring these grant programs, takes steps to  validate critical infrastructure protection costs. Additionally, amounts that  states and localities expend in excess of $300,000 are subject to an external  audit which, when completed, provides assurance regarding the reliability  of the cost data.
Based on the following, it is unlikely that the cost information submitted by  states to DHS represents all additional costs incurred by states and  localities during code-orange alert periods:  States have up to 2 years from the time when the grant is awarded to  submit requests for reimbursement of additional code-orange alert  costs.
Some states are still in the process of validating proposed costs incurred  by the state and its localities. For example, one state estimated that its  state agencies and localities incurred an additional $3.7 million for the  March 17 to April 16, 2003, code-orange alert period. However, the state  could only validate additional code-orange alert costs of about $1.3  million, and thus could only report this amount as eligible for DHS  reimbursement.
The cost information submitted by states does not include additional  costs for training or the purchase of equipment and materials during  code-orange alert periods.
Additionally, DHS officials told us that not all states and localities that  incurred additional costs have requested reimbursement; therefore, not all  states and localities have submitted information to DHS on additional code- orange alert costs. Since the cost information does not include all costs  incurred by states and localities for code-orange alerts, it should not be  used to reach conclusions about the financial impact of these alerts on  states and localities.
According to the cost information collected by DHS, as of April 14, 2004, 40  states provided cost information to DHS in order to draw down funds to  reimburse additional costs incurred during the March 17 to April 16, 2003,  and May 20 to 30, 2003, code-orange alert periods. Based on this cost  information, the reported state share of additional code-orange alert costs  ranged from about $7,900 to about $8 million for both the first and second  code-orange alert periods, which lasted a total of 40 days. The locality  share of additional costs incurred during these two code-orange alert  periods ranged from about $2,800 to about $28 million.
As of April 14, 2004, 33 states provided information on additional costs  incurred during the December 21, 2003, to January 9, 2004, code-orange  alert period to DHS. Based on this information, additional costs incurred by  state agencies for this code-orange alert period, which lasted 19 days,  ranged from about $2,000 to about $7 million. Additional costs incurred by  localities during this code-orange alert period ranged from about $3,000 to  about $4 million. In general, the states that have numerous critical  infrastructure sites, as identified by DHS, were the ones that reported the  most additional code-orange alert costs collectively for the state and its  localities. Additionally, DHS officials noted that overtime costs for law  enforcement or security personnel appear to be the primary expense  incurred by states and localities.
You also requested that we determine the extent to which DHS analyzes  available cost data related to code-orange alerts and the role that OMB  plays in providing guidance to DHS on capturing such costs. Though not  required to do so, DHS has not analyzed the cost data collected to identify  trends or assess the financial impact code-orange alerts have on states and  localities. DHS has not tallied individual or overall state and local costs for  any of the increased threat alert periods. However, as cost information  submitted by states for reimbursement through SHSGP II and UASI II does  not include all costs incurred by states and localities during code-orange  alert periods, such analysis may not be appropriate using these data.  According to an OMB representative, OMB has not provided specific  guidance to DHS in capturing and totaling additional costs that states and  localities incurred during periods of heightened national threat levels, nor  is it required to do so. However, the representative noted that OMB is  concerned about the funds that the federal government expends on these  programs and activities.
section_title: Publicly Reported Cost Information May be Insufficient for Assessing Financial Impact of Code- Orange Alerts
paragraphs: Prior to this report, the U.S. Conference of Mayors and a Director with the  Center for Strategic and International Studies have been the only  organization or official to attempt to report estimates of costs incurred by  various governmental entities in response to code-orange alerts. However,  despite their efforts, the information reported by the U.S. Conference of  Mayors and a Director at the Center for Strategic and International Studies  Homeland Security Initiatives, may not be adequate to draw conclusions  regarding the extent to which responding to code-orange alerts imposes a  financial burden on governmental entities.
On March 27, 2003, the Conference of Mayors published a report that  estimated localities within the United States were spending $69.5 million  per week in response to the March 17 to April 16, 2003, code-orange alert  period. However, the U.S. Conference of Mayors’ estimate may not provide  an adequate basis for drawing conclusions regarding the financial impact of  code-orange alerts on localities due to several factors such as:  lack of guidance to localities for developing their estimates,  the absence of independent verification or confirmation of amounts  reported to the Conference of Mayors.
For example, the Conference of Mayors surveyed its membership asking  them to report, “What are you spending extra per week?” However,  according to a Conference of Mayors’ official, members were not provided  guidance on how to develop their costs. Thus, localities could have used  different methodologies potentially resulting in the inclusion of certain  costs in one locality’s estimate that may not be included in another  locality’s estimate. Additionally, only 145 cities out of the U.S. Conference  of Mayors total membership of 1,185 responded to the survey, representing  a 12 percent response rate. The scope for this study was also somewhat  limited in that the U.S. Conference of Mayors issued its report and  estimates prior to the conclusion of the March 17 to April 16, 2003, code- orange alert period. Thus, the estimate may not represent all costs incurred  during that time period. Finally, the U.S. Conference of Mayors’ staff did  not take any additional steps to verify the validity of the estimates provided  in response to its survey nor did they request that localities provide  information to assist them in corroborating the localities’ responses.
Similarly, a December 21, 2003, news release from the Center for Strategic  and International Studies cited remarks by one of its directors who  independently estimated that it costs the nation $1 billion a week to  implement protective measures in response to a code-orange alert.  According to the official that generated this estimate, it was an informal  calculation based primarily on the funds appropriated by Congress to  federal agencies for Operation Liberty Shield. The director divided the total  amount of federal appropriations related to Operation Liberty Shield by the  number of weeks that Operation Liberty Shield lasted. However,  appropriated funds are not accurate representations of expenditures or  costs incurred by federal agencies. Additionally, Operational Liberty Shield  was a comprehensive national plan to increase protection for America’s  citizens and the nation’s infrastructure during the war with Iraq. Thus,  federal agencies may have taken additional protective measures in relation  to the war that are not normally associated with code-orange alerts. As a  result, this estimate may not be an accurate reflection of costs incurred by  federal agencies in relation to other code-orange alerts.
section_title: Conclusions
paragraphs: DHS’s implementation of the Homeland Security Advisory System is  evolving, and the responses to our questionnaires from federal agencies  and states suggest that DHS has made progress in providing more specific  information to federal agencies and states and localities regarding the  specific threats and risks they may face. However, DHS has not yet  officially documented its protocols for communicating changes in the  national threat level, as well as guidance and threat information, to federal  agencies and states. The responses we received to our questionnaires  indicated continuing confusion on the part of federal agencies and states  and localities regarding the process and methods that DHS uses to  communicate changes in the national threat level or recommendations for  heightened security measures in specific regions or sectors. Without clearly  defined and consistently applied communication policies and procedures,  DHS may have difficulty managing the communication expectations of  federal agencies and states and effectively communicating the methods,  timing, and content of guidance and information—including information on  protective measures and potential threats—the department provides to  federal agencies and states. We believe that risk communication principles  are applicable to the Homeland Security Advisory System and should be  applied in DHS communications with federal agencies, states, and  localities. Risk communication experts suggest that warnings should  include the following principles to provide for early, open, and  comprehensive information dissemination and for informed decision  making: (1) communication through multiple methods, (2) timely  notification, and (3) specific information about the nature, location, and  timing of the threat and guidance on actions to take. To the extent that DHS  does not communicate specific threat information and guidance on actions  to take, federal agencies, states, and localities may not be able to  effectively determine their levels of risk, the appropriate protective  measures to implement in response to threats, and how to effectively and  efficiently focus their limited resources on implementing those appropriate  protective measures. Finally, it is important to note that although periods of  code-orange alert do result in some additional costs for many federal  agencies, states, and localities, the available cost data have many  limitations, are not precise or complete, and thus, any conclusions based  on these data must reflect those limitations.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Secretary of Homeland Security direct the Under  Secretary for Information Analysis and Infrastructure Protection to take  the following two actions: (1) document communication protocols for  notifying federal agencies and states of changes in the national threat level  and for providing guidance and threat information to these entities,  including methods and time periods for sharing information, to better  manage these entities’ expectations regarding the methods, timing, and  content of information shared; and (2) incorporate risk communication  principles into the Homeland Security Advisory System to assist in  determining and documenting information to provide to federal agencies  and states, including, to the extent possible, information on the nature,  location, and time periods of threats and guidance on protective measures  to take in response to those threats.
section_title: Agency Comments
paragraphs: We provided a draft copy of this report to DHS for comment. DHS generally  concurred with the findings and recommendations in the report and  provided formal written comments, which are presented in appendix IX.  In  commenting on the draft report, DHS expressed concern that we generalize  examples cited in the report across all states and localities, rather than  characterizing the examples as isolated experiences.  As previously  discussed, we surveyed 56 states and territories to obtain information on  their experiences related to national threat level changes.  We discuss the  results of this questionnaire throughout the report, including information  on the number of states that provided similar responses.  After citing the  number of states that provide a similar response related to a code-orange  alert issue, we frequently use examples to illustrate those perspectives.  We  did not cite all examples we received, but rather those that most effectively  illustrate our message.  Thus, we believe the report accurately portrays  state perspectives on code-orange alerts.  In regard to DHS’s comments on  the examples we discuss related to localities, we believe that we  appropriately cautioned the reader in the report’s introduction and scope  and methodology sections that information from the 16 localities we visited  or from which we received questionnaire responses were used only as  anecdotal examples and cannot be generalized across all localities in the  United States.  DHS also provided technical comments, which we have  incorporated as appropriate.
We plan no further distribution of this report until 14 days after the date of  this report. At that time, we will send copies of this report to the  Subcommittee on Terrorism, Technology, and Homeland Security, Senate  Committee on the Judiciary; the Subcommittee on National Security,  Emerging Threats, and International Relations, House Committee on  Government Reform; the Secretary of Homeland Security; the Director,  Office of Management and Budget; and other interested parties. Copies will  be made available to others on request. In addition, this report will be  available at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  me at (202) 512-8777 or by e-mail at jenkinswo@gao.gov. Other GAO  contacts and key contributors are listed in appendix X.
William O. Jenkins, Jr.
section_title: Federal Agencies’, States’, Localities’, and Foreign Countries’ Threat Advisory Systems
paragraphs: Some federal agencies, states, localities, and foreign countries had threat  advisory systems in place prior to the implementation of the Homeland  Security Advisory System in March 2002, while others have since  developed such systems. Some of these advisory systems were generally  similar to the Homeland Security Advisory System, identifying different  threat levels and requiring or suggesting certain protective actions be taken  at each threat level. However, other systems differed in terms of structural  and operational characteristics—such as the number of threat levels, the  issuance of local or regional alerts, and the dissemination of threat  advisories to the public.
subsections: section_title: Federal Agencies’ Threat Advisory Systems
paragraphs: Seven of the 25 federal agencies responding to our questionnaire reported  that they operated their own threat advisory systems prior to the  establishment of the Homeland Security Advisory System in March 2002.  One agency, for example, indicated that it developed its own five-level alert  system 8 years ago to ensure protection of critical national security assets.  These seven agencies currently follow the Homeland Security Advisory  System as well as their own agency advisory system that conforms to the  Homeland Security Advisory System. Three of these agencies also reported  they could independently raise agency threat levels in response to threats  or events that specifically affect their operations, regardless of whether the  national threat level is raised at the same time. However, they generally  cannot lower a facility threat level below that specified by the agency head  or other designated agency authority. Further, although these agencies can  operate at a threat level that is higher than the Homeland Security Advisory  System national threat level (e.g., at code-orange when the national threat  level is code-yellow), they generally cannot operate at a lower threat level.
Unlike federal civilian agencies, Department of Defense (DOD) military  installations are exempt from following the Homeland Security Advisory  System. Accordingly, DOD operates under its own terrorist threat advisory  system—known as the Force Protection Condition system. According to  DOD officials, this system has five threat conditions—normal, alpha, bravo,  charlie, delta—indicating increasing threats of a terrorist attack, and the  system prescribes mandatory minimum protective measures for all units  and installations for each condition level. Each of the nine DOD Unified  Combatant Commands—for example, Central Command (Middle East and  Asia)—establishes a force protection condition for the entire Command,  based on a variety of information including threat and vulnerability  assessments from such sources as the Department of Homeland Security  (DHS), the Federal Bureau of Investigation (FBI), and the Defense  Intelligence Agency. Beyond this level of protection, installation and unit  commanders may then require additional protective measures, also based  on intelligence assessments. This system, therefore, provides flexibility to  base commanders to set protective measures based on local threat  conditions. In contrast to civilian federal agencies, changes in the  Homeland Security Advisory System do not necessarily result in changes in  DOD’s force protection condition. When the national threat level is raised  to code-orange, DOD reviews and analyzes the same intelligence used by  DHS to decide to raise the national threat level. Based on this analysis,  DOD military commanders then decide whether any change is warranted in  their own force protection condition.
section_title: States’ and Localities’ Threat Advisory Systems
paragraphs: As discussed earlier in the report, the Homeland Security Advisory System  is not binding on states or localities and they are not required to conform  their advisory systems to the Homeland Security Advisory System.  However, 42 of the 43 states responding to our questionnaire indicated  they currently followed the Homeland Security Advisory System, an  equivalent state system, or both.
Eight of the states responding to our questionnaire and 1 locality we visited  indicated that they had implemented their threat advisory systems prior to  the Homeland Security Advisory System. For example, 1 state told us that it  amended its state emergency response plan and implemented a state  advisory system in 1998, in response to the bombing of the federal building  in Oklahoma City.
Twenty-two states responding to our questionnaire and 5 localities we  visited indicated that they currently operate their own advisory systems.  Most of these states reported that their systems provided information  about the type or location of the threat, notified other governmental  entities, and identified protective measures to be taken—while most  localities indicated their systems conformed to the Homeland Security  Advisory System. Some state and local advisory systems are similar to the  Homeland Security Advisory System, but contain a different number of  threat levels than the Homeland Security Advisory System. For example:  One state uses a numbered, 4-level threat advisory system, which is  similar to the Homeland Security Advisory System but combines the  levels of Blue and Yellow into a single threat level.
One locality uses a 4-level advisory system, which does not include the  Homeland Security Advisory System Blue threat level.
State and local advisory systems typically identified actions or protective  measures that were to be taken at each threat level. For example, one state  advisory system identified state, county, and local government actions, as  well as specific security recommendations; while another identified actions  for law enforcement agencies, non-law enforcement agencies, businesses,  and citizens. One locality advisory system identified general security  recommendations, as well as specific agency action checklists identifying a  minimum level of response by agencies and departments within the  locality. Some states and localities can raise their systems’ threat levels  based on specific threats or events independent of changes in the national  threat level. One state, for example, raised its state threat level in early  February 2003 (prior to the February 2003 code-orange alert) in response to  the crash of the space shuttle Columbia. One locality could change its  threat level locally based on information and coordination with the local  FBI office, the state’s department of public safety, and the locality’s police  department.
section_title: Foreign Countries’ Systems
paragraphs: The United Kingdom has a developed threat advisory system and processes  for communicating threat information that are similar to the Homeland  Security Advisory System but, unlike the U.S. system, it does not require  that terrorism threat alerts be issued to the public. According to United  Kingdom officials, under the United Kingdom’s threat advisory system, (1)  threat levels are assigned nationwide, as well as to specific regions and  economic sectors; and (2) these levels and related changes are  communicated to government and law enforcement agencies and private  sector entities with responsibility for critical infrastructure protection, but  not to the public. The United Kingdom does not publicly announce these  threat warnings because it wants to protect its intelligence sources and  avoid alerting terrorists that the government is aware of the threat. If  terrorists know that the government is aware of their planned attack, the  terrorists may change their plans and modes of operation, allowing them to  carry out attacks that are even more lethal. Additionally, the United  Kingdom is concerned about causing public anxiety regarding possible  threats, when, in most cases, the public cannot do anything to mitigate the  threat.
However, United Kingdom officials noted that if warnings are necessary to  protect public safety from specific and credible threats, the United  Kingdom will issue public warnings. Additionally, the United Kingdom  instituted a public campaign to encourage public vigilance regarding  potential terrorist activity. The campaign included posters warning the  public to alert the police to unattended baggage, as shown in figure 1.
Unlike the United Kingdom system, the Australian threat advisory system  places a greater emphasis on publicizing changes in national threat levels.  Australia implemented its current four-level, national counter-terrorist  threat alert system in June 2003. As in the United States, a threat level  condition is publicly announced and defined. Under the Australian system,  each level of alert is defined as follows:  Low—no information to suggest a terrorist attack in Australia.
Medium—medium risk of a terrorist attack in Australia.
High—high risk of a terrorist attack in Australia.
Extreme—terrorist attack is imminent or has occurred.
According to the Australian Attorney-General’s Department, the system  was not introduced as a reaction to any particular threat, but rather as an  arrangement to help inform national preparation and planning and provide  greater flexibility for responding to threats. Accordingly, should any  intelligence information come to light which causes the government to  change the assessed level of threat, the public is to be advised immediately.
Conversely, Norway does not have a nationwide threat advisory system.  According to Norwegian officials, the Norwegian Police Security Service  conducts threat assessments—which are graded into levels of low,  medium, and high—and these are issued to government agencies with  responsibilities for preventing and responding to threats within their  jurisdictions. Unlike the Homeland Security Advisory System, there are no  routines in place for communicating these threat assessments directly to  local governments, private sector entities or the general public, but a  decision to do so can be made depending on the situation. National  government agencies and county governors can be instructed to take  action to address various types of emergencies. However, municipalities,  private sector entities, and the general public cannot be instructed to take  specific action, except in situations where such instructions are warranted  by law.
Like Norway, Germany does not have a uniform nationwide system of  threat levels or requirements that specific actions be taken by  governmental entities in response to different types of emergencies,  including terror attacks. However, Germany does have a single, central 24- hour communication center. For natural disasters and other threats, this  center collects, screens, and processes the incoming information for  subsequent forwarding to other government agencies regarding actions to  take. According to German officials, the central communication center is  concerned primarily with information management, rather than with  controlling and warning functions. After receiving the threat assessments  from the central communication center, governmental entities at the  German federal and state level are each responsible for deciding which  measures are to be taken, based on the threat.
According to German officials, threat information is communicated to  affected persons, individual institutions, the business community, and the  general public by law enforcement agencies, the state governments or the  German federal government, according to the nature of the threat or  danger concerned and the underlying situation. For example, the federal  Criminal Police Office informs the business community on a regular basis  as to the current assessment of the situation regarding Islamic terrorism.
Additionally, Germany has a satellite-based warning system that enables  official warnings to be broadcast to the public. Government agencies and  emergency situation centers are linked via satellite and are able to relay  warnings and information on prevailing dangers to the connected media in  a matter of seconds.
section_title: Scope and Methodology
paragraphs: To determine the process that the Department of Homeland Security (DHS)  used to make decisions about changes in the national threat level, we met  with and obtained information from DHS officials. We examined this  information to identify DHS’s processes for determining whether to raise or  lower the national threat level and for issuing threat products to federal  agencies, states, localities, and private sector entities. We also analyzed  DHS threat products to determine the type of threat information and  guidance on protective measures that DHS included in the products.
To determine guidance and information provided to federal agencies,  states, and localities; protective measures these entities implemented in  response to the three code-orange alerts from March 17 to April 16, 2003;  May 20 to 30, 2003; and December 21, 2003, to January 9, 2004; and  additional costs these entities reported for the code-orange alert periods,  we sent questionnaires to (1) 28 federal agencies; and (2) the homeland  security or emergency management offices in the 50 states, the District of  Columbia, American Samoa, Guam, the Northern Islands, Puerto Rico, and  the U.S. Virgin Islands. We selected the 28 federal agencies because they  reported receiving homeland security funding for fiscal year 2003 to the  Office of Management and Budget (OMB) and are Chief Financial Officers  Act agencies. We sent the questionnaire to the 25 federal agencies that  reported homeland security funding for fiscal year 2003 to OMB and to 3  other federal agencies that are Chief Financial Officers Act agencies but did  not report homeland security funding for fiscal year 2003.
To develop the questionnaires, we met with and obtained information from  8 federal agencies, 4 states, the District of Columbia, and 9 localities.  Overall, the questionnaires sent to federal agencies and states were very  similar. We obtained comments on draft versions of the federal  questionnaire from the 8 federal agencies. We adapted the final version of  the federal questionnaire to create the state questionnaire. We pretested  the questionnaires with 4 federal agencies and 3 states and made relevant  changes to the questions based on these pretests. See appendixes VII and  VIII for the federal and state questionnaires.
As of April 20, 2004, we received questionnaire responses from 26 federal  agencies, which account for about 99 percent of total fiscal year 2003  nondefense homeland security funding as reported to OMB, and 43 states,  for a 77 percent response rate. We made extensive efforts to encourage  federal agencies and states to complete and return the questionnaires, such  as contacting all nonrespondents on multiple occasions and sending  additional copies of questionnaires when requested. We performed this  work from October 2003 through May 2004.
Because our surveys were not statistical sample surveys, but rather a  survey of a nonprobability selection of federal agencies and a census of all  states, there are no sampling errors. However, the practical difficulties of  conducting any survey may introduce errors, commonly referred to as  nonsampling errors. For example, measurement errors are introduced if  difficulties exist in how a particular question is interpreted or in the  sources of information available to respondents in answering a question. In  addition, coding errors may occur if mistakes are entered into a database.  We took extensive steps in the development of the questionnaires, the  collection of data, and the editing and analysis of data to minimize total  survey error. As noted above, to reduce measurement error and ensure  questions and response categories were interpreted in a consistent manner,  we pretested the questionnaires with several federal agencies and states.
We edited all completed surveys for consistency, such as ensuring that  responses were provided for all appropriate questions, and, if necessary,  contacted respondents to clarify responses. All questionnaire responses  were double key-entered into our database (i.e., the entries were 100  percent verified), and random samples of the questionnaires were further  verified for completeness and accuracy of data entry. Furthermore, all  computer syntax was peer reviewed and verified by separate staff to ensure  that the syntax was written and executed correctly.
In addition to sending questionnaires to 28 federal agencies and 56 states,  we conducted site visits at 12 localities (eight cities and four counties) and  sent a questionnaire to another 8 localities. The 12 localities were Atlanta  and Fulton County, Georgia; Denver, Colorado Springs, and Douglas  County, Colorado; Norfolk, Virginia; Portland and Wasco County, Oregon;  Chicago and Cook County, Illinois; and Boston and Fitchburg,  Massachusetts. We selected these localities based on the following criteria:  the locality’s receipt of urban area grants from DHS, geographic location,  topography (e.g., inland, border, or seaport), and type of locality (e.g.,  metropolitan or nonmetropolitan area). We selected four cities and one  county that received grants from DHS and four cities and three counties  that did not. We also selected cities and counties from different geographic  regions and with different topographic characteristics, as well as some  cities and counties located in metropolitan areas and some cities and  counties located in nonmetropolitan areas. We used a structured data  collection instrument to interview emergency management officials and  first responders in these localities. We selected the 8 localities that we  surveyed based on their populations and geographic locations. We received  responses from 4 of these localities; 3 with populations of less than 40,000  – Helena, Montana; Mankato, Minnesota; and Rock Springs, Wyoming – and  1 with a population of greater than 40,000 – San Jose, California.
To determine the extent to which risk communication principles could be  incorporated into the Homeland Security Advisory System, we spoke with  and obtained information from individuals and organizations with  expertise in homeland security issues and risk communication. We  analyzed reports and documents from the ANSER Institute for Homeland  Security, Carnegie Mellon University, the Center for Strategic and  International Studies, the Department of Health and Human Services, the  Harvard Center for Risk Analysis, the Oak Ridge National Laboratory, and  the Partnership for Public Warning.
To assess the reliability of cost data provided by federal agencies on our  questionnaire, we examined the cost information for obvious errors and  inconsistencies and examined responses to the questionnaire items  requesting information regarding the development of the cost data. If  necessary, we contacted respondents to clarify responses and, when  provided, reviewed documentation about the cost data. Federal agencies  generated their cost data from various sources such as their financial  accounting systems, credit card logs, and security services contracts. This  cost information is not precise, nor do the costs likely represent all  additional costs for the code-orange alert periods. In some cases, we have  concerns about the reliability of the cost data source within particular  agencies. For example, 6 of the 16 federal agencies reported that they  extracted some of the code-orange alert cost data from their agencies’  financial accounting systems. As reported in the fiscal year 2005 President’s  Budget, 5 of these agencies’ financial management performance had  serious flaws as of December 31, 2003. Despite these limitations, we  believe the cost data to be sufficiently reliable as indicators of general  ranges of cost and overall trends. However, the data should not be used to  determine the cumulative costs for all federal agencies for code-orange  alert periods. See appendix V for additional information on cost  information reported by federal agencies.
To determine the extent to which DHS has collected information on costs  reported by states and localities during periods of code-orange alert, we  met with and obtained information from DHS officials on costs that states  and their localities submitted to DHS for reimbursement for increased  critical infrastructure asset protection during the three code-orange alert  periods. We examined this information to identify the methods used by  DHS to collect cost information from states and localities. We also met with  and obtained information from representatives of OMB regarding the  extent to which the office provided guidance to DHS for collecting cost  information from states and localities.
We reported these cost data that DHS collected from states and localities  for the three code-orange alert periods only to illustrate the range of costs  that states reported to DHS for reimbursement. Cost information submitted  by states to DHS does not include all costs for states and localities during  the code-orange alert periods. In particular, not all states submitted costs to  DHS for reimbursement, and not all state agencies and localities in states  that submitted cost information to DHS may have reported costs to their  states for submission to DHS. In addition, the cost information submitted  by states does not include additional costs for training or equipment and  material purchases during code-orange alert periods because these costs  are not reimbursable through the critical infrastructure protection grant  programs. Moreover, some states have not finished validating costs they  plan to submit for reimbursement. Despite these limitations, we believe the  cost data to be sufficiently reliable as indicators of general ranges of costs  that states submitted for reimbursement to DHS and overall trends.  However, because this cost information from states and localities is not  complete, it should not be used to reach conclusions about the financial  impact of code-orange alerts on states and localities.
To determine the methodologies used by other organizations to develop  estimates of costs reported by federal agencies, states, and localities during  code-orange alert periods, we spoke with and obtained information from  officials at the U.S. Conference of Mayors and the Director of the Center for  Strategic and International Studies Homeland Security Initiatives regarding  how this organization and this individual developed their estimates. We  evaluated methodologies used by the U.S. Conference of Mayors and the  Director of the Center for Strategic and International Studies Homeland  Security Initiatives based on their scopes, data collection methods, and  analyses to assess the reliability of the cost estimates. Moreover, we  examined costs estimates reported by other organizations, including the  Council on Foreign Relations, the National League of Cities, the National  Association of Counties, and the International Association of Emergency  Managers. We did not include these organizations’ reports in our review  because they did not specifically address costs associated with responses  to increases in the national threat level.
To obtain information on federal agencies’, states’, and localities’ threat  advisory systems, we analyzed questionnaire responses and other  documents to determine the number of federal agencies, states, and  localities that had their own threat advisory systems in place prior to the  establishment of the Homeland Security Advisory System as well as the  number of federal agencies, states, and localities that follow their own  threat advisory systems and the Homeland Security Advisory System. We  reviewed documentation of the threat advisory systems that these federal  agencies, states, and localities provided with their questionnaire responses  to identify the characteristics of the systems, including systems’ threat  levels and protective measures and conformance to the Homeland Security  Advisory System. We also met with and received documents from the  Department of Defense on its Force Protection Condition System.  Furthermore, we spoke with and obtained information from officials of  four foreign countries—Australia, Germany, Norway, and the United  Kingdom—on these countries’ threat advisory systems and information  sharing processes. We compared the characteristics of these systems with  characteristics of the Homeland Security Advisory System to identify  similarities and differences between the systems. We selected the four  countries because they are democracies similar to the United States that  have generally faced terrorist threats.
section_title: Guidance and Information Federal Agencies and States Reported Using to Determine Protective Measures
paragraphs: Federal agencies and states responding to our questionnaire indicated that  they used guidance from various sources, such as the Federal Emergency  Management Agency (FEMA), the Federal Protective Service (FPS), the  Department of Justice, and the White House, among other sources, to  develop plans for responding to each Homeland Security Advisory System  threat level. For example, 12 federal agencies reported using the  Department of Justice’s Vulnerability Assessment of Federal Facilities  that established security levels for various types of federal facilities and  minimum-security standards for each security level. In addition, to develop  their response plans, 8 federal agencies indicated that they used Homeland  Security Presidential Directive 3, which established the Homeland Security  Advisory System and suggested general protective measures for each  advisory system threat level. Six states reported using terrorism alerts and  guidelines from FEMA to develop their plans for protective measures for  national threat levels.
In addition to their response plans for national threat levels, federal  agencies and states responding to our questionnaires reported using  guidance and information from various sources to determine protective  measures to implement or enhance in response to the three code-orange  alert periods from March 17 to April 16, 2003; May 20 to 30, 2003; and  December 21, 2003, to January 9, 2004. As shown in tables 6 and 7, these  federal agencies reported using guidance and information and intelligence  from such sources as the Department of Homeland Security (DHS), the  Federal Bureau of Investigation (FBI), and the White House to determine  measures to take in response to the third code-orange alert period in our  review. These federal agencies generally reported that this guidance and  information and intelligence was useful and timely. Results for the other  two code-orange alert periods – March 17 to April 16, 2003; and May 20 to  30, 2003 – were consistent with those reported in tables 6 and 7 for the third  code-orange alert period.
As shown in tables 8 and 9, states responding to our questionnaire also  indicated that they used guidance and information from sources such as  DHS, other federal entities, and state, territory, and local law enforcement  agencies to determine actions to take in response to the third code-orange  alert period. These states generally reported that this guidance and  information and intelligence was useful and timely. Results for the other  two code-orange alert periods in our review were similar to those reported  in tables 8 and 9.
section_title: Most Commonly Implemented Protective Measures, Measures Tested, and Methods of Confirmation
paragraphs: Federal agencies and states responding to our questionnaires reported  having a variety of protective measures in place for responding to the three  code-orange alert periods from March 17 to April 16, 2003; May 20 to 30,  2003; and December 21, 2003, to January 9, 2004, regardless of whether the  measures were most commonly enhanced, maintained at pre-code-orange  alert levels, or implemented solely in response to the code-orange alerts.  Table 10 provides examples of the protective measures that federal  agencies most commonly reported having in place for the third code- orange alert period in our review. Results from the other two code-orange  alert periods are consistent with those reported in the following table for  the third code-orange alert period.
Table 11 provides examples of the protective measures that states most  commonly reported having in place during the third code-orange alert  period in our review. Results for the other two code-orange alert periods in  our review are similar to those reported in table 11.
To ensure that protective measures operate as intended and are  implemented as planned, most of the federal agencies and states  responding to our questionnaires indicated that they had conducted tests  or exercises on the functionality and reliability of protective measures  within the past year. Table 12 provides examples of protective measures on  which federal agencies and states reported conducting tests and exercises.
In addition, most of the federal agencies and states responding to our  questionnaires reported receiving confirmation from component entities,  offices, or personnel that protective measures were actually enhanced or  implemented during the three code-orange alert periods. Table 13 provides  examples of the methods by which federal agencies and states reported  receiving confirmation from their component entities, offices, and  personnel, for the code-orange alert period from December 21, 2003, to  January 9, 2004. Results for the other two code-orange alert periods from  March 17 to April 16, 2003, and May 20 to 30, 2003, are consistent with those  reported in table 13.
section_title: Cost Information Provided by Federal Agencies, States, and Localities
subsections: section_title: Cost Information Provided by States
paragraphs: In our questionnaire, we asked states to provide information on additional  costs incurred by the state during the three code-orange alert periods in our  review. However, of the 42 states that responded to our questionnaire and  follow the Homeland Security Advisory System, only 6 reported additional  costs incurred by state agencies during at least one of the three code- orange alerts in our review. Therefore, we did not collect sufficient cost  information from our questionnaire to provide ranges or assess general  trends in costs incurred by states during code-orange alert periods.
Twenty-two of the 42 states that responded to our questionnaire and follow  the Homeland Security Advisory System provided us with cost information  they submitted to DHS in order to be reimbursed for state and local critical  infrastructure protection costs through the State Homeland Security Grant  Program – Part II and the Urban Areas Security Initiative – Part II. As  discussed previously in this report, through these two grant programs, DHS  offered financial assistance to reimburse costs incurred by state agencies  and localities as a result of increased security measures at critical  infrastructure sites during the period of hostilities with Iraq and for other  periods of heightened alert. We obtained this critical infrastructure  protection cost information from DHS for 40 states and their localities for  the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert  periods and for 33 states and their localities for the December 21, 2003, to  January 9, 2004, code-orange alert period. However, this cost information  does not represent all additional costs incurred by states and localities  during code-orange alert periods.
section_title: Cost Information Provided by Localities
paragraphs: We also received information on additional code-orange alert costs from 14  select metropolitan and rural localities. However, information on localities’  costs is most appropriately used anecdotally, as these cities and counties  represent a small, nonprobability sample of localities within the United  States.
The rural localities from which we obtained information indicated that they  did not incur additional costs for any of the code-orange alert periods  because they did not take significant action in response to the alert. These  localities explained that they had insufficient resources to do so or did not  perceive their localities to be at risk.
section_title: Acknowledgment of Agency and Government Contributors
paragraphs: We would like to acknowledge the time and effort made by agencies and  governments that provided information by responding to questionnaires  and talked with us during site visits.
subsections: section_title: Federal Agencies
section_title: States and Territories
section_title: Localities
paragraphs: Atlanta, Ga.  Fulton County, Ga.  Denver, Colo.  Douglas County, Colo.  Colorado Springs, Colo.
Portland, Ore.  Wasco County, Ore.  Boston, Mass.  Fitchburg, Mass.  Norfolk, Va.  Chicago, Ill.  Cook County, Ill.  Mankato, Minn.  Helena, Mont.  San Jose, Calif.
Rock Springs, Wyo.
section_title: Federal Agency Questionnaire
paragraphs: The U.S. General Accounting Office (GAO) has been requested by Congress to review federal agencies’ security-related  protective measures, guidance, and costs for periods when the national threat level was raised from yellow (elevated) to  orange (high).  As part of this request, GAO is surveying 28 federal agencies that received homeland security funding in  fiscal year 2003, as reported to the Office of Management and Budget, and/or are Chief Financial Officers Act agencies.
Results from this survey will help GAO to inform Congress of (1) protective measures taken by federal agencies during  periods of orange alert, specifically for the periods March 17 to April 16, 2003, May 20 to May 30, 2003, and December  21, 2003 to January 9, 2004; (2) guidance and other information used by federal agencies in implementing those  measures; and (3) costs incurred by federal agencies as a result of protective measures implemented during those three  orange alert periods.
This questionnaire should be completed by the person(s) most knowledgeable about your agency’s security-related  measures, guidance, and costs for the orange alerts from March 17 to April 16, 2003, May 20 to May 30, 2003, and  December 21, 2003 to January 9, 2004, including your agency’s protective measures for threat levels; guidance and other  information used by your agency in developing and implementing protective measures during those periods; your  agency’s methods for tracking or collecting cost data and ensuring data reliability; your agency’s national threat level  notification processes; and financial and operational challenges your agency faced during the three orange alert periods.
If your agency, or certain of its facilities, remains on orange alert even though the national threat level has been  lowered, please answer the questions about the most recent orange alert period considering your agency’s actions  and costs through January 9, 2004.  Most of the questions can be answered by marking boxes or filling in blanks.
Space has been provided at the end of the survey for any additional comments, and we encourage you to provide whatever  additional comments you think appropriate.  In our report, the responses from your agency will be presented only after  they have been aggregated with responses from other responding agencies.  GAO will not release individual agency  responses to any entity unless requested by Congress or compelled by law.  In addition, GAO will take appropriate  measures to safeguard any sensitive information provided by your agency, and, upon request, can provide security  clearance information for staff reviewing survey responses.
Please complete this questionnaire within 2 weeks of receipt.  Your agency’s participation is important!  A member of our  staff will pick up your completed questionnaire.  If you have any questions or when you are ready for your questionnaire  and any accompanying materials to be picked up, please contact Dr. Jonathan Tumin on (202) 512-3595, Rebecca  Gambler on (202) 512-6912, or Kristy Brown on (202) 512-8697.
Please provide the name, title, agency, and telephone number of the primary person completing this questionnaire so that  we may contact that person if we need to clarify any responses.
Telephone number: (_____)___________________________________ We modified the format of this questionnaire slightly for inclusion in this report, but we did not  change the content of the questionnaire.
Definition of term "agency": Any entity within the executive branch, including federal departments, independent  establishments, and government corporations.  If the questionnaire is to be completed by a federal agency's components,  then "agency" refers to the component entity rather than the department.
Agency Protective Measures for National Threat Levels  1.  According to Homeland Security Presidential Directive 3, issued in March 2002, federal agencies are responsible for  developing their own protective measures and other antiterrorism or self-protection and continuity plans for national  threat levels.  (See highlighted passage on page 2 of the attachment.)
Please provide a copy of the measures along with your completed        questionnaire.
Please provide a copy of the measures along with your completed        questionnaire.
If you answer #4, please skip to question 5;  otherwise, please continue.
GAO Survey on Threat Alerts  2.  Did your agency use guidance and/or information from any of the following sources in developing your protective  measures for national threat levels?  (Please check one answer in each row.) a. Federal Emergency Management Agency (FEMA)  b. Federal Protective Service (FPS)  g. Vulnerability assessments for your agency  h. Other sources (Please specify.)
If you answered “yes” for any source in question 2, please answer: Please list the source and titles or topics of any written guidance used by your agency in developing your protective  measures for national threat levels.
GAO Survey on Threat Alerts  5.  Homeland Security Presidential Directive 3 requires federal agencies to develop and submit to the President, through  the Assistant to the President for Homeland Security, an annual written report on steps taken to develop and  implement protective measures for national threat levels.  (See highlighted passage on page 2 of the attachment.)
Please provide a copy of the report along with your completed        questionnaire.
subsections: section_title: Homeland Security Advisory System
paragraphs: Please provide the name of your agency’s threat-advisory         system and a copy of system documentation, if available,          along with your completed questionnaire.
Please provide the name of your agency’s threat-advisory     threat–advisory system that does not        system and a copy of system documentation, if available,         along with your completed questionnaire.
Please provide the name of your agency’s threat-advisory    uses its own threat–advisory system                 system and a copy of system documentation, if available,         along with your completed questionnaire.
If you answered #4, please stop and return this questionnaire according to the instructions on page 1.           5.  Agency does not follow the HSAS and does        Please provide the name of the other threat-advisory    not use its own  threat–advisory system, but       system used by your agency. uses another threat-level system (e.g., the    Department of Defense’s Force Protection     Condition system)
If you answered #5, please stop and return this questionnaire according to the instructions on page 1.  6.  Agency does not follow any threat-advisory system  If you answered #6, please stop and return this questionnaire according to the instructions on page 1.
section_title: Types of Protective Measures Used During HSAS Code-Yellow Alerts and Specifically in Response to Code-
paragraphs: Orange alerts, that is, measures implemented in addition to the measures used in the  “Yes”, “No”, or “Not applicable-N/A” for  preceding Code-Yellow alert period. (Please check “Implemented, Code-Orange only”,  each  measure.)
Increased use of   N/A or no change in  s. Other measures in this category  (Please specify.)
Increased use of   N/A or no change in  j. Other measures in this category     (Please specify.)
Dec. 21, 2003–Jan. 9, 2004 3. Information collection,  analysis, and dissemination   If your agency did not  implement any types of measures  in category “3”, please check this  box and skip to category “4”.
Increased use of   N/A or no change in  i. Other measures in this category  (Please specify.)
Increased use of   N/A or no change in  i. Other measures in this category  (Please specify.)
Increased use of   N/A or no change in  5. Other types of measures  (Please specify.)
Increased use of   N/A or no change in  measure  GAO Survey on Threat Alerts  9.  We would like to know about the guidance and/or information/intelligence your agency received and used to determine the  protective measures implemented specifically in response to the Code-Orange alert from March 17 to April 16, 2003.  9a.  In addition to your agency’s planned protective measures for national  9c. For each item you answer “yes” in  threat levels, did your agency receive guidance and/or  question 9b, please answer questions 9c and  information/intelligence from any of the following sources to determine the  9d: How useful was the guidance and/or  measures implemented specifically in response to the HSAS Code-Orange  information/ intelligence from the source? alert from March 17 to April 16, 2003? (Please check one answer in each  row under question 9a.)
9d. Was the guidance and/or information/  intelligence from the source timely?
9b. For each item you answer “yes” in question 9a, please answer: Did  your agency use the guidance and/or information/intelligence received from  the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from March 17 to April 16, 2003?
Received?
Used?
Useful?
Timely? “yes” “yes”
1. Guidance (e.g.,  a.  DHS (including FPS  and FEMA)  b.  Federal Bureau of  Investigation (FBI)  e.  Other sources (Please  specify.)  2. Information/Intelligence  (e.g., region, sector or site- “yes” “yes”
GAO Survey on Threat Alerts  10.  We would like to know about the guidance and/or information/intelligence your agency received and used to determine the          protective measures implemented specifically in response to the Code-Orange alert from May 20 to May 30, 2003. 10a.  In addition to your agency’s planned protective measures for national  10c. For each item you answer “yes” in  threat levels, did your agency receive guidance and/or information/intelligence  question 10b, please answer questions 10c and  from any of the following sources to determine the measures implemented  10d: How useful was the guidance and/or  specifically in response to the HSAS Code-Orange alert from May 20 to May  information/intelligence from the source?
30, 2003?   (Please check one answer in each row under question 10a.)
10d. Was the guidance and/or information/  10b. For each item you answer “yes” in question 10a, please answer: Did  intelligence from the source timely? your agency use the guidance and/or information/intelligence received from  the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from May 20 to May 30, 2003?
Received?
Used?
Useful?
Timely? “yes” “yes”
1. Guidance (e.g.,  a.  DHS (including FPS  and FEMA)  e.  Other sources (Please  specify.) (e.g., region, sector or site-  “yes” “yes”
GAO Survey on Threat Alerts  11. We would like to know about the guidance and/or information/intelligence your agency received and used to determine the protective        measures implemented specifically in response to the Code-Orange alert from December 21, 2003 to January 9, 2004. 11a.  In addition to your agency’s planned protective measures for national  11c. For each item you answer “yes” in  threat levels, did your agency receive guidance and/or information/intelligence  from any of the following sources to determine the measures implemented  question 11b, please answer questions 11c and  11d: How useful was the guidance and/or  specifically in response to the HSAS Code-Orange alert from December 21,  information/intelligence from the source?
2003 to January 9, 2004?   (Please check one answer in each row under  question 11a.)
11d. Was the guidance and/or information/  intelligence from the source timely?
11b. For each item you answer “yes” in question 11a, please answer: Did  your agency use the guidance and/or information/intelligence received from  the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from December 21, 2003 to January 9, 2004?
Received?
Used?
Useful?
Timely? “yes” “yes”
1. Guidance (e.g.,  a.  DHS (including FPS and  FEMA)  e.  Other sources (Please        specify.)   2. Information/Intelligence  (e.g., region, sector or site- “yes” “yes”
GAO Survey on Threat Alerts  12.  In addition to guidance and information indicated above, what other types of information, if any, would have been  helpful to your agency in deciding what protective measures to implement specifically in response to the HSAS Code- Orange alert from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable  column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No   DK   Yes  No   DK  f. Other types of information (Please specify.)
Yes  No  DK   Yes  No   DK   Yes  No   DK  13.  Please describe examples of ways in which protective measures implemented during the Code-Orange alerts (March  17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004) benefited your agency.    14.  Please describe examples of ways in which your agency’s operations were affected during the Code-Orange alerts  (March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004), such as longer  lines for visitors or shifting of resources from normal operations.  ____________________________________________________________________________________________  GAO Survey on Threat Alerts  15.  Did your agency receive confirmation from component entities, offices, and/or personnel that the additional protective  measures indicated in questions 8b, 8c, and 8d (on pages 6 through 10) were actually implemented during the HSAS  Code-Orange alert from:   (Please check one answer in each row.) a. March 17 to April 16, 2003?  b. May 20 to May 30, 2003?  c. December 21, 2003 to January 9, 2004?
If you answered “yes” for any of the three Code-Orange alert periods in question 15 (a, b, or c), please answer  question 16; otherwise, skip to question 17:  16.  How did your agency receive confirmation that the additional protective measures indicated in questions 8b, 8c, and  8d were actually implemented during the HSAS Code-Orange alert from:  (Please check one answer (“Yes”, “No”,  or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No  DK  d. Other methods (Please specify.)
section_title: Costs Incurred During the HSAS Code-Orange Alerts
paragraphs: 17.  Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS  Code-Orange alert period from March 17 to April 16, 2003? (Please check only one answer.) 1.  Yes  (Continue with question 18.) 2.  No  (Skip to question 23.)
To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from  March 17 to April 16, 2003, please answer: 18.  What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from February 28 to  March 16, 2003, that immediately preceded the HSAS Code-Orange alert period from March 17 to April 16, 2003?  19.  What additional security-related costs, if any, did your agency incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from March 17 to April 16, 2003? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”  costs for the category.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, March 17 to April 16, 2003  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
section_title: If you provided data for actual security-related costs in questions 18 and/or 19, please answer questions 20 and 21;
paragraphs: otherwise, skip to question 22: 20.  Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from March 17  to April 16, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet).    21.  Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g.,  internal auditing procedures).  ______________________________________________________________________________________________  GAO Survey on Threat Alerts  If you provided data for estimated security-related costs in questions 18 and/or 19, please answer question 22;  otherwise, skip to question 23: 22.  Please briefly describe how your agency developed the estimates for total and/or additional security-related costs for  the HSAS Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period  from March 17 to April 16, 2003. 23.  Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS  Code-Orange alert period from May 20 to May 30, 2003? (Please check only one answer.) 1.  Yes  (Continue with question 24.) 2.  No  (Skip to question 29.)
To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from May  20 to May 30, 2003, please answer: 24.  What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from April 17 to May  19, 2003, that preceded the HSAS Code-Orange alert period from May 20 to May 30, 2003?  25.  What additional security-related costs, if any, did your agency incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from May 20 to May 30, 2003? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”  costs for the category.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, May 20 to May 30, 2003  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
GAO Survey on Threat Alerts  If you provided data for actual security-related costs in questions 24 and/or 25, please answer questions 26 and 27;  otherwise, skip to question 28: 26.  Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to May  30, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet).    27.  Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g.,  internal auditing procedures).
If you provided data for estimated security-related costs in questions 24 and/or 25, please answer question 28;  otherwise, skip to question 29: 28.  Please briefly describe how your agency developed the estimates for total and/or additional security-related costs for  the HSAS Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from  May 20 to May 30, 2003. ______________________________________________________________________________________________  GAO Survey on Threat Alerts  29.  Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS  Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please check only one answer.) 1.  Yes  (Continue with question 30.) 2.  No  (Skip to question 35.)
To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004, please answer: 30.  What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from May 31 to  December 20, 2003, that preceded the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004?  31.  What additional security-related costs, if any, did your agency incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”  costs for the category.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, Dec. 21, 2003 to Jan. 9, 2004  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
Actual costs   Estimated costs   Don’t know costs   Actual costs   Estimated costs   Don’t know costs   Actual costs   Estimated costs   Don’t know costs   Actual costs   Estimated costs   Don’t know costs  $_______________ GAO Survey on Threat Alerts  If you provided data for actual security-related costs in questions 30 and/or 31, please answer questions 32 and 33;  otherwise, skip to question 34: 32.  Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange alert period from December  21, 2003 to January 9, 2004 (e.g., financial accounting system, Microsoft Excel spreadsheet).    33.  Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g.,  internal auditing procedures).
section_title: Agency Notification Process
paragraphs: 35.  How did your agency learn about the HSAS Code-Orange alert from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Dec. 21, 2003 -      a. Direct notification from DHS (not via       media sources)
Yes  No  DK   Yes  No  DK   Yes  No  DK       (not via media sources)
Yes  No  DK   Yes  No  DK   Yes  No   DK   d. Other methods (Please specify.)
Yes  No  DK   Yes  No  DK   Yes  No  DK  If you answered “yes” that your agency received direct notification from DHS for any period in question 35 (Part  A, Part B, or Part C) above, please answer questions 36 and 37; otherwise, skip to question 38:   36.  How did DHS notify your agency about the HSAS Code-Orange alert from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Warning Alert System (WAWAS)    e. Other methods (Please specify.)
GAO Survey on Threat Alerts  37.  What type(s) of information was included in DHS’s official notification for the HSAS Code-Orange alert from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes     No  DK   Yes  No  DK   Yes  No  DK   h.  Other methods (Please specify.)
GAO Survey on Threat Alerts  39.  For each of the methods listed below, please indicate whether or not your agency would like to be notified of future  changes in the national threat-level through this method.  (Please check one answer in each row.) a. Through your agency representatives at the Homeland Security Operations Center b. Through a single official announcement to all federal agencies via telephone, E-mail, or fax c. Through an individual agency message via telephone, E-mail, or fax  d. Through an electronic communications system such as the Washington Area Warning Alert       System (WAWAS)    e. Other methods (Please specify.)  _________________________________________________  Financial and Operational Challenges in Implementing HSAS Code-Orange Alert Measures  40.  What financial challenges, if any, did your agency face in responding to the HSAS Code-Orange alert from:  (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No   DK   d. Other methods (Please specify.)
Yes  No  DK   Yes  No  DK   Yes  No  DK  If you answered “yes” to any financial challenge in rows a through d in question 40 (Part A, Part B, or Part C)  above, please answer question 41; otherwise, skip to question 42: 41.  Briefly describe one or more examples of financial challenges faced during the alerts.  ______________________________________________________________________________________________  GAO Survey on Threat Alerts  42.  What operational challenges, if any, did your agency face in responding to the HSAS Code-Orange alert from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No  DK   i. Other (Please specify.)
Yes  No  DK   Yes  No  DK   Yes  No  DK  If you answered “yes” to any operational challenge in rows a through i in question 42 (Part A, Part B, or Part C)  above, please answer question 43; otherwise, skip to question 44: 43.  Briefly describe one or more examples of operational challenges faced during the alerts.  ______________________________________________________________________________________________  GAO Survey on Threat Alerts  44.  If you have any comments regarding any of the issues covered in this questionnaire or have any other comments about  protective measures, guidance, and costs for HSAS Code-Orange alerts, please use the space provided.
Thank you for your assistance.  Please return the questionnaire and, dependent on your answers to  questions 1, 5, 6, or 7, any accompanying documentation according to the instructions on page 1.
section_title: State and Territory Questionnaire
paragraphs: The U.S. General Accounting Office (GAO), an investigative arm of Congress, has been requested by the Congress to  review states’ and U.S. territories’ security-related protective measures, guidance, and costs for periods when the national  threat level was raised from yellow (elevated) to orange (high).  As part of this request, GAO is surveying the 50 states,  U.S. territories, and Washington, D.C. to determine (1) what, if any, protective measures were taken during periods of  orange alert, specifically for periods March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to  January 9, 2004; (2) guidance and other information used by states and territories in implementing those measures; and (3)  costs incurred by states and territories as a result of protective measures implemented during these three orange alert  periods.  To better inform the Congress on the Homeland Security Advisory System (HSAS) and identify potential  improvements, GAO is also collecting data on (1) applicable threat alert systems used by states and territories prior to the  establishment of the HSAS and (2) operational and financial challenges faced by states and territories as a result of  responding to code-orange alerts.
This questionnaire should be completed by the person(s) most knowledgeable about the guidance received and protective  measures taken by your state or territory during the periods identified above, including the protective measures your  jurisdiction developed to respond to national threat levels, any threat-advisory system you have in place, types of  protective measures taken, costs incurred during these periods of orange alert, how your state or territory was notified of  the increase in the national threat level, and financial and operational challenges your state or territory faced during these  periods of orange alert.  If your state or territory, or certain of its facilities, remains on orange alert even though the  national threat level has been lowered, please answer the questions about the most recent orange alert period  considering your state or territory’s actions and costs through January 9, 2004.  Most of the questions can be  answered by marking boxes or filling in blanks.  Space has also been provided for comments and we encourage you to  provide whatever additional comments you think appropriate; please feel free to type out these comments on a separate  attachment (identified by question number) if you prefer.  In our report, the responses from your state or territory will be  presented only after they have been aggregated with responses from other states and territories.  GAO will not release  individual responses to any entity unless requested by Congress or compelled by law.  In addition, GAO will take  appropriate measures to safeguard any sensitive information you provide, and, upon request, can provide security  clearance information for staff reviewing survey responses.
Please complete this questionnaire and return it within 2 weeks of receipt.  Your participation is important!  A pre- addressed Federal Express envelope has been included to return this questionnaire.  If you have any questions or misplace  the return envelope, please contact Nancy Briggs at (202) 512-5703 or Gladys Toro at (202) 512-3047.
Please provide the name, title, and telephone number of the primary person completing this questionnaire and your state  or territory name so that we may contact that person if we need to clarify any responses.
Telephone number:  (______)__________________________________  State or Territory:  ___________________________________________  We modified the format of this questionnaire slightly for inclusion in this report, but we did not  change the content of the questionnaire.
GAO State Survey on Terrorist Alerts  Sections I and II of this questionnaire ask you to report on your state’s or territory’s protective measures and advisory  systems for all levels of national alert; the remaining sections ask you specifically about Code-Orange alerts.  When  completing this questionnaire, please consider only actions taken and costs incurred at the state or territory level; do not  include local level actions and costs.
I. State and Territory Protective Measures for Responding to National Threat Levels 1.  According to Homeland Security Presidential Directive 3, issued in March 2002, states and territories are encouraged  to develop protective measures and other antiterrorism or self-protection and continuity plans for responding to  national threat levels (see bolded passage on page 2 of the attachment).
If you answered “yes” for any source in question 2, answer question 3; otherwise, skip to question 4.  3.  Please list the source and titles or topics of any written guidance used by your state or territory in developing  protective measures for responding to national threat levels?
subsections: section_title: II. Threat Advisory Systems
paragraphs: If you answered #4, #5, or #6 to question 9, please stop and return this questionnaire according to the instructions on page 1.
section_title: III. Types of Protective Measures Used During HSAS Code-Yellow Alerts and Specifically in Response to Code-
paragraphs: Orange Alerts from March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9,  10.  We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the  protective measures to implement specifically in response to the Code-Orange alert from March 17 to April 16, 2003. 10a. Please indicate the protective measures your state or territory (or at least  10b, 10c, and 10d. Please indicate the protective measures  one state or territory department) has in place for Code-Yellow alerts. your state or territory (or at least one state or territory  (Please check “Yes”, “No”, “Not applicable-N/A”, or “Don’t Know-DK” department) implemented or increased the use of specifically for each measure). in response to the Code-Orange alerts, that is, measures  implemented in addition to the measures used in the  preceding Code-Yellow alert period.  (Please check  “Implemented, Code-Orange only”, “Increased use of”,  “N/A or no change,” or “Don’t Know-DK” for each  measure in each column)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK   Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK   Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK s. Other measures in this      category (Please specify.)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK   Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK   Implemented, Code-Orange       only    Increased use of   N/A or no change       DK j. Other measures in this     category (Please specify.)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  i. Other measures in this      category (Please specify.)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK   Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  Implemented, Code-Orange       only    Increased use of   N/A or no change       DK  i. Other measures in this      category (Please specify.)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK 5. Other types of measures  (Please specify.)
Implemented, Code-Orange       only    Increased use of   N/A or no change       DK GAO State Survey on Terrorist Alerts 11.  We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the  protective measures to implement specifically in response to the Code-Orange alert from March 17 to April 16, 2003. 11a. In addition to planned protective measures for national threat levels, did your  11c. For each item you answer “yes” in  state or territory receive guidance and/or information/intelligence from any of the  question 11b, please answer questions 11c  following sources to determine the measures implemented specifically in response  and 11d: How useful was the guidance and/or  to the HSAS Code-Orange alert from March 17 to April 16, 2003? (Please check  information/intelligence from the source? one answer in each row under question 11a.)
11d. Was the guidance and/or  11b. For each item you answer “yes” in question 11a, please answer: Did your  state or territory use the guidance and/or information/intelligence received from  the source to determine the measures implemented specifically in response to the  HSAS Code-Orange alert from March 17 to April 16, 2003?
Received?
Used?
Useful?
Timely?
1. Guidance (e.g.,  “yes” “yes” a. DHS (including FEMA)     b. Other federal agency, such         as the FBI and its Joint         (JTTF) (Please specify.     c. Other state, territorial, or         (Please specify.)    e. Regional, state or local law     g. Other sources (Please         specify.) (e.g., region, sector or site- “yes” “yes”
GAO State Survey on Terrorist Alerts 12.  We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the  protective measures to implement specifically in response to the Code-Orange alert from May 20 to May 30, 2003. 12a. In addition to planned protective measures for national threat levels, did your  12c. For each item you answer “yes” in  state or territory  receive guidance and/or information/intelligence from any of the  question 12b, please answer questions 12c  following sources to determine the measures implemented specifically in response  and 12d: How useful was the guidance and/or  to the HSAS Code-Orange alert from May 20 to May 30, 2003?   (Please check  information/intelligence from the source? one answer in each row under question 12a.)
12d. Was the guidance and/or  12b. For each item you answer “yes” in question 12a, please answer: Did your  state or territory use the guidance and/or information/intelligence received from  timely? the source to determine the measures  implemented specifically in response to the  HSAS Code-Orange alert from May 20 to May 30, 2003?
Received?
Used?
Useful?
Timely?
1. Guidance (e.g.,  “yes” “yes” a. DHS (including FEMA)    b. Other federal agency, such as         the FBI and its JTTF   (Please specify.)    c. Other state, territorial, or  (Please specify.)   e. Regional, state, or local law    g. Other sources (Please        specify.) (e.g., region, sector or site- “yes” “yes”
GAO State Survey on Terrorist Alerts 13.  We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the  protective measures to implement specifically in response to the Code-Orange alert from December 21, 2003 to January 9, 2004. 13a. In addition to planned protective measures for national threat levels, did your  13c. For each item you answer “yes” in  state or territory receive guidance and/or information/intelligence from any of the  question 13b, please answer questions 13c and  following sources to determine the measures implemented specifically in response  13d: How useful was the guidance and/or  to the HSAS Code-Orange alert from December 21, 2003 to January 9, 2004? information/intelligence from the source? (Please check one answer in each row under question 13a.)
13d. Was the guidance and/or information/  13b. For each item you answer “yes” in question 13a, please answer: Did your  intelligence from the source timely? state or territory use the guidance and/or information/intelligence received from  the source to determine the measures  implemented specifically in response to the  HSAS Code-Orange alert from Dec. 21, 2003 to Jan. 9, 2004?
Received?
Used?
Useful?
Timely?
1. Guidance (e.g.,  “yes” “yes” a. DHS (including FEMA)    b. Other federal agency, such as        the FBI and its JTTF   (Please specify.)    c. Other state, territorial, or  (Please specify.)   e. Regional, state or local law    g. Other sources (Please        specify.) (e.g., region, sector or site- “yes” “yes”
GAO State Survey on Terrorist Alerts 14.  In addition to guidance and information indicated above, what other types of information, if any, would have been  helpful in deciding what protective measures to implement specifically in response to the HSAS Code-Orange alert  from:  (Please check one answer (“Yes”, “No”, “Don’t Know-DK”, or “Already Received”) in each row in each  applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Already received  Yes  No  DK   Already received  Yes  No  DK   Already received  Yes  No  DK   Already received  Yes  No  DK   Already received f. Other methods (Please specify.)
Yes  No  DK   Already received 15.  Please describe examples of ways in which protective measures implemented during the Code-Orange alerts benefited your state or territory.    16.  Please describe examples of ways in which your state or territory’s operations were affected during the Code-Orange  alerts, such as, but not limited to, shifting resources from normal operations or reduced tourism.  ____________________________________________________________________________________________  GAO State Survey on Terrorist Alerts 17.  Did your state or territory receive confirmation from agencies, offices, and/or personnel within your jurisdiction that  the additional protective measures indicated in questions 10b, 10c, and 10d (on pages 6 through 10) were actually  implemented during the HSAS Code-Orange alert from:   (Please check one answer in each row.) a. March 17 to April 16, 2003?  b. May 20 to May 30, 2003?  c. December 21, 2003 to January 9, 2004?
If you answered “yes” or “some” for any of the three Code-Orange alert periods in question 17 (a, b, or c), please  answer question 18; otherwise, skip to question 19:  18.  How did your state or territory receive confirmation that the additional protective measures indicated in questions  10b, 10c, and 10d were actually implemented during the HSAS Code-Orange alert from:  (Please check one answer  (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No  DK  d. Other methods (Please specify.)
GAO State Survey on Terrorist Alerts 19.  Has DHS requested any of the following types of information on protective measures taken in response to increased  national threat levels?  (Please check one answer in each row in each applicable column.)
Yes  No  DK   Yes  No  DK   Yes  No  DK  d. Other information (Please specify.)
section_title: IV. Costs Incurred During the HSAS Code-Orange Alerts
paragraphs: 20.  Does your state or territory have any data on actual or estimated additional security-related costs incurred during the  HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please check only one answer.) 1.  Yes  (Continue with question 21.) 2.  No  (Skip to question 26.)
GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from  March 17 to April 16, 2003, we are assuming that the total security costs incurred during the HSAS Code-Yellow  alert period from February 28 to March 16, 2003 will serve as your baseline.  21.  What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from  February 28 to March 16, 2003, that immediately preceded the HSAS Code-Orange alert period from March 17 to  April 16, 2003?  (Please provide your answer in the table below.) 22.  What additional security-related costs, if any, did your state or territory incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please provide  your answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, March 17 to April 16, 2003  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
section_title: If you provided data for actual security-related costs in questions 21 and/or 22, please answer questions 23 and 24;
paragraphs: otherwise, skip to question 25: 23.  Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS  Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from  March 17 to April 16, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet).    24.  Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial  data (e.g., internal auditing procedures).  ______________________________________________________________________________________________  GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 21 and/or 22, please answer question 25;  otherwise, skip to question 26: 25.  Please briefly describe how your state or territory developed the estimates for total and/or additional security-related  costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange  alert period from March 17 to April 16, 2003. 26.  If you have any other data on costs incurred during the HSAS Code-Orange alert period from March 17 to April 16,  that are not reported above, please briefly describe.  27.  Does your state or territory have any data on actual or estimated additional security-related costs incurred during the  HSAS Code-Orange alert period from May 20 to May 30, 2003? (Please check only one answer.) 1.  Yes  (Continue with question 28.) 2.  No  (Skip to question 33.)
GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from May  20 to May 30, 2003, we are assuming that the total security costs incurred during the HSAS Code-Yellow alert  period from April 17 to May 19, 2003 will serve as your baseline.  28.  What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from April 17  to May 19, 2003, that preceded the HSAS Code-Orange alert period from May 20 to May 30, 2003?  (Please provide your answer in the table below.) 29.  What additional security-related costs, if any, did your state or territory incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from May 20 to May 30, 2003?  (Please provide your  answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, May 20 to May 30, 2003  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
section_title: If you provided data for actual security-related costs in questions 28 and/or 29, please answer questions 30 and 31;
paragraphs: otherwise, skip to question 32: 30.  Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS  Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to  May 30, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet).    31.  Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial  data (e.g., internal auditing procedures).  ______________________________________________________________________________________________  GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 28 and/or 29, please answer question 32;  otherwise, skip to question 33: 32.  Please briefly describe how your state or territory developed the estimates for total and/or additional security-related  costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert  period from May 20 to May 30, 2003. 33.  If you have any other data on costs incurred during the HSAS Code-Orange alert period from May 20 to May 30,  that are not reported above, please briefly describe.  34.  Does your state or territory have any data on actual or estimated additional security-related costs incurred during the  HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please check only one answer.) 1.  Yes  (Continue with question 35.) 2.  No  (Skip to question 40.)
GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from  December 21, 2003 to January 9, 2004, we are assuming that the total security costs incurred during the HSAS  Code-Yellow alert period from May 31 to December 20, 2003 will serve as your baseline.  35.  What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from May 31  to December 20, 2003, that preceded the HSAS Code-Orange alert period from December 21, 2003 to January 9,  2004? (Please provide your answer in the table below.) 36.  What additional security-related costs, if any, did your state or territory incur for protective measures implemented  specifically in response to the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please provide your answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”.
For categories where no costs were incurred, please list costs as $0.  If costs by category cannot be provided, give  “Grand total costs”.)
Orange alert, Dec. 21, 2003 to Jan. 9, 2004  a. Personnel (e.g., security personnel,      overtime) b. Equipment/materials (e.g., screening      materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from       above)
section_title: If you provided data for actual security-related costs in questions 35 and/or 36, please answer questions 37 and 38;
paragraphs: otherwise, skip to question 39: 37.  Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS  Code-Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange alert period from  December 21, 2003 to January 9, 2004 (e.g., financial accounting system, Microsoft Excel spreadsheet).    38.  Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial  data (e.g., internal auditing procedures).  ______________________________________________________________________________________________  GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 35 and/or 36, please answer question 39;  otherwise, skip to question 40: 39.  Please briefly describe how your state or territory developed the estimates for total and/or additional security-related  costs for the HSAS Code-Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange  alert period from December 21, 2003 to January 9, 2004. 40.  If you have any other data on costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to  January 9, 2004 that are not reported above, please briefly describe.  41.  What guidance, if any, did your state or territory use to track costs incurred in response to the Code-Orange alerts of  March 17 to April 16, 2003, May 20 to May 30, 2003, and/or December 21, 2003 to January 9, 2004?  (Please  provide the source and the title or topic of the guidance.)
If you answer “yes” to question 42, please answer question 43; otherwise skip to question 44.  43.  How useful were the following types of guidance from DHS on how or whether to track costs, if provided?  (Please  check one answer in each row.) a. Tracking total costs incurred in response to elevated threat   b. Tracking costs incurred that are eligible for federal   c. Other methods (Please specify.) 44.  Has DHS requested any data on additional costs incurred in response to the Code-Orange alert periods March 17 to  April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004 from your state or territory?   (Please check one answer in each row.)   a. March 17 to April 16, 2003?  b. May 20 to May 30, 2003?  c. December 21, 2003 to January 9, 2004?  45.  Have you submitted any security-related costs for reimbursement to DHS for any of the following Code-Orange alert  periods?  (Please check one answer in each row.) a. March 17 to April 16, 2003?  b. May 20 to May 30, 2003?  c. December 21, 2003 to January 9, 2004?  46.  Have you used any grant funds to reimburse your Code-Orange alert costs?  (Please check only one answer.)
Please provide the name of the grant(s) and amount(s).
section_title: V. Homeland Security Advisory System (HSAS) Notification Process
paragraphs: 47.  In which of the following ways did your state or territory learn about the HSAS Code-Orange alerts for:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a.  March 17 to April 16, 2003? b.  May 20 to May 30, 2003? c.    December 21, 2003 to January 9, 2004?
Yes  No  DK  Yes  No  DK   Yes  No  DK      as the FBI (not via media sources)
Yes  No  DK  Yes  No  DK   Yes  No  DK e. Other methods (Please specify.)
Yes  No  DK  Yes  No  DK   Yes  No  DK If you answered “yes” that your state or territory received direct notification from DHS for any period in question  47 (Part A, Part B, or Part C) above, please answer questions 48 and 49; otherwise, skip to question 50:   48.  How did DHS notify your state or territory about the HSAS Code-Orange alerts from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Telecommunications System (NLETS)    e. Other methods (Please specify.)
GAO State Survey on Terrorist Alerts 49.  What type(s) of information was included in DHS’s official notification for the HSAS Code-Orange alerts from:  (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes     No  DK   Yes  No  DK   Yes  No  DK   h. Other methods (Please specify.)
GAO State Survey on Terrorist Alerts 51.  For each of the methods listed below, please indicate whether or not your state or territory would like to be notified of  future changes in the national threat-level through this method.  (Please check one answer in each row.) a. Through your representatives at the Department of Homeland Security Operations  b. Through a single official announcement to all state and territories via telephone,   c. Through an individual message via telephone, E-mail, or fax  d. Through an electronic communications system, such as the National Law       Enforcement Telecommunications System (NLETS) e. Other methods (Please specify.)
VI.  Financial and Operational Challenges in Implementing HSAS Code-Orange Alert Measures 52.  What financial challenges, if any, did your state or territory face in responding to the HSAS Code-Orange alerts from:    (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.)  a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No   DK   d. Other challenges (Please specify.)
GAO State Survey on Terrorist Alerts 53.  Briefly describe examples of financial challenges and the consequences of these faced during the alerts.  54.  What operational challenges, if any, did your state or territory face in responding to the HSAS Code-Orange alerts  from: (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.)  a.   March 17 to April 16, 2003? b.   May 20 to May 30, 2003? c.   December 21, 2003 to January 9, 2004?
Yes  No  DK   Yes  No  DK   Yes  No  DK    j. Other challenges (Please specify.)
GAO State Survey on Terrorist Alerts 55.  Briefly describe examples of operational challenges and the consequences of these faced during the alerts.  56.  During the HSAS Code-Orange alerts, was your state prevented from taking any specific protective measure because  of a legal prohibition(s)?  1.  Yes, state or territory was prevented from taking specific protective measures because of a legal prohibition(s)  2.  No, state or territory was not prevented from taking specific protective measures because of a legal           prohibition(s)
If you answered “yes” to question 56, please continue with question 57; otherwise, skip to question 58. 57.  Please identify the specific HSAS Code-Orange alert(s), the protective measure involved, and the prohibition(s) that  prevented its implementation, along with any relevant legal citation(s).  ______________________________________________________________________________________________  GAO State Survey on Terrorist Alerts 58.  If you have any comments regarding any of the issues covered in this questionnaire or have any other comments about  protective measures, guidance, and costs for HSAS Code-Orange alerts, please use the space provided.
Thank you for your assistance.
Please return the questionnaire according to the instructions on page 1.
section_title: Agency Comments
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, David P. Alexander, Fredrick D.  Berry, Nancy A. Briggs, Kristy N. Brown, Philip D. Caramia, Christine F.  Davis, Michele Fejfar, Rebecca Gambler, Catherine M. Hurley, Gladys Toro,  Jonathan R. Tumin, Tamika S. Weerasingha, and Kathryn G. Young made  key contributions to this report.
section_title: Bibliography
paragraphs: Dory, Amanda. “American Civil Security: The U.S. Public and Homeland  Security.” The Washington Quarterly, vol. 27, no. 1 (2003-2004) 37-52.
Fischoff, Baruch. “Assessing and Communicating the Risks of Terrorism.”  Science and Technology in a Vulnerable World. eds. Albert H. Teich,  Stephen D. Nelson, and Stephen J. Lita. Washington, D.C.: American  Association for the Advancement of Science, 2003: 51-64.
Fischoff, Baruch, Roxana M. Gonzalez, Deborah A. Small, and Jennifer S.  Lerner. “Evaluating the Success of Terror Risk Communications.”  Biosecurity and Bioterrorism: Biodenfense Strategy, Practice, and  Science, vol. 1, no. 4 (2003) 255-258.
Gray, George M., and David P. Ropeik. “Dealing with the Dangers of Fear:  The Role of Risk Communication.” Health Affairs, vol. 21, no. 6 (2002) 106- 116.
Mileti, Dennis S., and John H. Sorensen. Communication of Emergency  Public Warnings: A Social Science Perspective and State-of-the-Art  Assessment, a report prepared for the Federal Emergency Management  Agency, August 1990.
Mitchell, Charles, and Chris Decker. “Apply Risk-Based Decision-Making  Methods and Tools to U.S. Navy Antiterrorism Capabilities.” Journal of  Homeland Security. February 2004.
National Research Council. Improving Risk Communication. Washington,  D.C.: National Academy Press, 1989.
Partnership for Public Warning. A National Strategy for Integrated Public  Warning Policy and Capability. McLean, VA: May 16, 2003.
Partnership for Public Warning. Developing a Unified All-Hazard Public  Warning System. Emmitsburg, MD: Nov. 25, 2002.
Ropeik, David, and Paul Slovic. “Risk Communication: A Neglected Tool in  Protecting Public Health.” Risk in Perspective, vol. 11, no. 2 (2003) 1-4.
subsections: section_title: GAO’s Mission
paragraphs: The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional responsibilities  and to help improve the performance and accountability of the federal government  for the American people. GAO examines the use of public funds; evaluates federal  programs and policies; and provides analyses, recommendations, and other  assistance to help Congress make informed oversight, policy, and funding  decisions. GAO’s commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail this  list to you every afternoon, go to www.gao.gov and select “Subscribe to   e-mail alerts” under the “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs