Mail Security: Incidents at DOD Mail Facilities Exposed Problems That Require Further Actions
Published: 2006-09-15T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In March 2005, two well-publicized and nearly simultaneous incidents involving the suspicion of anthrax took place in the Washington, D.C., area. The incidents occurred at Department of Defense (DOD) mail facilities at the Pentagon and at a commercial office complex (Skyline Complex). While these incidents were false alarms, DOD and other federal and local agencies responded. The Postal Service suspended operations at two of its facilities and over a thousand DOD and Postal Service employees were given antibiotics as a precaution against their possible exposure to anthrax. This report describes (1) what occurred at the Pentagon and Skyline Complex mail facilities, (2) the problems we identified in detecting and responding to the incidents, (3) the actions taken by DOD that address the problems that occurred, and (4) the extent to which DOD's actions address the problems.
section_title: What GAO Found
paragraphs: Events leading up to the Pentagon incident began when a laboratory that tested samples from the Pentagon's mail-screening equipment informed DOD's mail-screening contractor that test results indicated the presence of anthrax in the mail. By the time the contractor notified DOD 3 days later, suspect mail had already been released and distributed throughout the Pentagon. DOD evacuated its mail-screening and remote delivery facilities, notified federal and local agencies, and dispensed antibiotics to hundreds of employees. The Skyline Complex incident began the same day when Fairfax County, Virginia, emergency personnel responded to a 911 call placed by a Skyline employee that an alarm had sounded on a biosafety cabinet used to screen mail. Local responders closed the complex and decontaminated potentially exposed employees, and DOD dispensed antibiotics to the employees. Similarly, the Postal Service suspended operations at two facilities and dispensed antibiotics to its employees. Laboratory testing later indicated that the incidents were false alarms. Analysis of these incidents reveals numerous problems related to the detection and response to anthrax in the mail. At the Pentagon, DOD's mail-screening contractor did not follow key requirements, such as immediately notifying DOD after receiving evidence of contamination. At the Skyline Complex, DOD did not ensure that the complex had a mail security plan or that it had been reviewed, as required. The lack of a plan hampered the response. DOD also did not fully follow the federal framework--including the National Response Plan, which was developed to ensure effective, participatory decision making. Instead of coordinating with other agencies that have the lead in bioterrorism incidents, DOD unilaterally dispensed antibiotics to its employees. DOD has taken numerous actions that address problems related to the two incidents. At the Pentagon, DOD's actions included selecting a new mail-screening contractor and defining the roles and responsibilities of senior leadership, including those involved in making medical decisions. Related to Skyline, DOD prohibited its mail facilities in leased space within the Washington, D.C., area from using biosafety cabinets to screen mail unless the equipment is being operated within the context of a comprehensive mail-screening program. While DOD has made significant progress in addressing the problems that occurred, its actions do not fully resolve the issues. One remaining concern is whether DOD will adhere to the interagency coordination protocols specified in the national plan for future bioterrorism incidents involving the Pentagon. This concern arises because, more than 1 year after the incident, DOD reiterated that it has the authority to make medical decisions without collaborating or consulting with other agencies. DOD also has not ensured, among other things, that its mail facilities (1) have the required mail security plans and (2) are appropriately using biosafety cabinets for screening mail.

section_title: Letter
paragraphs: Since the fall of 2001, when five persons, including two U.S. Postal Service  Since the fall of 2001, when five persons, including two U.S. Postal Service  employees, died from exposure to anthrax-contaminated mail delivered  employees, died from exposure to anthrax-contaminated mail delivered  through the U.S. mail system, the nation has been acutely aware of the  through the U.S. mail system, the nation has been acutely aware of the  danger of bioterrorism using anthrax and other potentially fatal bacteria.  danger of bioterrorism using anthrax and other potentially fatal bacteria.  The frequency of incidents involving suspicious packages or powder spills  The frequency of incidents involving suspicious packages or powder spills  has increased dramatically since that time, due in part to hoaxes and  has increased dramatically since that time, due in part to hoaxes and  concerns about leakages from mail that had previously been routinely  concerns about leakages from mail that had previously been routinely  handled. Concerns about anthrax in the mail have led federal agencies to  handled. Concerns about anthrax in the mail have led federal agencies to  establish mail-screening operations, including tests for anthrax, that have  establish mail-screening operations, including tests for anthrax, that have  often resulted in false alarms.  often resulted in false alarms.
In March 2005, two well-publicized and nearly simultaneous incidents took  In March 2005, two well-publicized and nearly simultaneous incidents took  place in the greater Washington, D.C., area. The incidents occurred at a  place in the greater Washington, D.C., area. The incidents occurred at a  Department of Defense (DOD) mail facility at the Pentagon, a building of  Department of Defense (DOD) mail facility at the Pentagon, a building of  national military significance located in Arlington County, Virginia, and  national military significance located in Arlington County, Virginia, and  another DOD mail facility in a commercial office complex (Skyline  another DOD mail facility in a commercial office complex (Skyline  Complex), located about 5 miles away in Fairfax County, Virginia. While  Complex), located about 5 miles away in Fairfax County, Virginia.
A third incident occurred at a DOD mail facility at the Bolling Air Force Base in  Washington, D.C. That incident—also a false alarm—was not connected to the Pentagon  and Skyline Complex incidents and, therefore, is not discussed in this report.
You asked us to examine the response to the two March 2005 incidents.  Specifically, this report addresses the following four questions:    What occurred at the Pentagon and Skyline Complex mail facilities?
What problems occurred in detecting and responding to these incidents,  and why?
What actions have been taken by DOD that address the problems that  occurred?
To what extent do these actions address the problems that occurred?
To address these questions, we analyzed, among other things, pertinent  after-action reports, incident timelines, the contract for mail-screening  services at the Pentagon, mail-screening procedures, federal mail  management and other applicable regulations and guidance, and the  federal framework for responding to biological incidents. We compared  whether the actions taken by DOD, its mail-screening contractor at the  Pentagon, and employees at the Skyline Complex were in accordance  with, among other things, the existing contract provisions, mail-screening  procedures, federal regulations and guidance, DOD’s mail manual, and the  federal framework for responding to biological incidents. We interviewed  a wide range of federal and local officials involved in the response to the  two incidents. We also interviewed personnel from the Pentagon’s mail- screening contractor to obtain their perspective on what occurred at the  Pentagon. We analyzed current procedures at the Pentagon related to  detecting and responding to biological agents. To assist in our analyses,  we reviewed previous GAO work regarding anthrax incidents, pertinent  literature and previous GAO work on internal controls, guidance prepared  by the Centers for Disease Control and Prevention (CDC) for responding  to the detection of anthrax in the workplace, and regulations and guidance  issued by the General Services Administration (GSA) on mail security and  responding to biological threats in the mail. We performed our work from  June 2005 to August 2006 in accordance with generally accepted  government auditing standards. Further details about our scope and  methodology appear in appendix I.
subsections: section_title: Background
subsections: section_title: What Is Anthrax and Why Is It a Concern?
paragraphs: Anthrax is an acute infectious disease caused by the spore-forming  bacterium Bacillus anthracis. The anthrax bacterium is commonly found  in the soil and forms spores (like seeds) that can remain dormant in the  environment for many years. Human anthrax infections are rare in the  United States and are usually the result of occupational exposure to  infected animals or contaminated animal products, such as wool, hides, or  hair. Although infection in humans is rare, a person can die if airborne  anthrax spores are inhaled into the lungs. Once airborne, there is greater  possibility that the spores will be inhaled. Medical experts believe that  symptoms of inhalation anthrax (sore throat, muscle aches, and mild  fever) typically appear within 4 to 6 days of exposure, depending on how  the disease is contracted. While anthrax is potentially fatal, individuals  who are exposed to anthrax spores will not necessarily develop the  disease. Inhalation anthrax can be treated with antibacterial drugs, but  medical treatment does not necessarily ensure recovery. Anthrax is not  contagious.
Anthrax is a potential terrorist weapon because, if refined and introduced  into letters and packages, anthrax spores can be released into the air as  letters are processed or opened. The use of the mail as a vehicle for  transmitting anthrax threatens the nation’s mail stream and places the  American public and federal employees at risk. This is what occurred in  2001, when letters containing anthrax contaminated at least 23 Postal  Service facilities and killed five of 22 individuals diagnosed with anthrax,  including two Postal Service employees. Anthrax spores can be killed,  however, through a process known as irradiation, which renders anthrax  in the mail harmless for humans.
section_title: How Is Anthrax Detected?
paragraphs: Detecting anthrax involves many types of activities, including    developing a sampling strategy for deciding how many samples to collect,  where to collect them, and what collection methods to use;   collecting samples using, for example, dry or premoistened swabs;  transporting samples to laboratories for extraction and analysis;   extracting the sample material using specific procedures and fluids (such  as sterile saline or water); and   analyzing the samples using a variety of methods.
To provide a coordinated clinical diagnostic testing approach for detecting  anthrax and other bioterrorism threats, CDC, the Association of Public  Health Laboratories, the FBI, and others collaboratively developed the  Laboratory Response Network (LRN) in 1999. LRN laboratories   (1) perform standard testing methods specified by CDC to either rule out  or confirm the presence of anthrax and (2) provide public health  organizations and others with rapid test results for use in making public  health decisions. Generating a final test result involves both a presumptive  and confirmatory test. Presumptive tests can be obtained within 2 hours  and are considered “actionable” from a public health perspective.  According to CDC, antibiotic medical treatment is recommended as soon  as possible after the LRN has obtained a presumptive positive test result.  Confirmatory tests take longer—generally 24 to 48 hours.
section_title: What Is the Federal Framework for Responses Involving the Suspicion of Anthrax?
paragraphs: The National Response Plan (NRP), which was developed by the federal  government under the leadership of DHS, provides one part of the  coordinated framework for how the United States will prepare for,  respond to, and recover from domestic incidents. The Secretary of  Defense, as well as the heads of 31 other federal departments and  agencies, signed the Letter of Agreement contained in the NRP, indicating  their agreement to abide by the NRP’s incident management protocols.  The December 2004 plan includes a Biological Incident Annex, which  specifies actions that agencies should take when they become aware of a  possible threat involving a biological agent. The annex also identifies the  roles and responsibilities of various agencies that would respond to such  an event. For example, as specified in the annex, HHS is the primary  federal agency for coordinating a public health response involving an  actual or potential biological terrorism attack. Table 1 identifies selected  agency actions specified in the NRP’s Biological Incident Annex.
The other part of the federal framework is the National Incident  Management System (NIMS), which was released in March 2004. NIMS is  intended to provide a consistent and coordinated nationwide approach for  federal, state, and local governments to work effectively and efficiently  together to prepare for, respond to, and recover from domestic incidents,  including those involving biological incidents, regardless of their cause,  size, and complexity. NIMS applies to all levels of government, and for the  federal government, including DOD, it is prescriptive. A key component of  NIMS is the incident command system, which is designed to integrate the  communications, personnel, and procedures of different agencies and  levels of government within a common organizational structure during an  emergency. Another key component of NIMS is the establishment of a  joint information center—with representatives from all affected parties  and jurisdictions—to provide a unified communication message to the  public during emergencies.
section_title: What Federal Requirements Exist for Agencies to Follow?
paragraphs: GSA and DOD have requirements for agencies to follow in protecting  employees in mail facilities and ensuring effective mail operations. For  example, GSA’s federal mail management regulation requires  every federal agency and agency location with one or more full-time  personnel processing mail to have a written mail security plan including,  among other things, procedures for safe and secure mail room operations,  plans for security training for mail employees, and plans for annual  reviews of the agency’s mail security plan and facility-level mail security  plans; and  large agencies, such as DOD, that spend over $1 million annually on  postage to annually (1) verify that facility-level mail security plans have  been reviewed and (2) report to GSA that all facility-level mail security  plans have been reviewed by a competent authority within the past year.
GSA also issues guidance and recommendations for effectively managing  mail programs, including recommendations on the content of mail security  plans. For example, GSA recommends that agencies    develop a communication plan for responding to threats that includes  names and phone numbers to call during emergencies;   establish and maintain partnerships with personnel who respond to  emergencies (first responders); and   create a program for training employees on how to respond to biological  threats, including refresher training on a regular basis.
DOD’s mail manual, effective December 2001, implements DOD’s mail- related requirements. DOD requires its components to comply with GSA’s  federal mail management regulation, including the requirement that each  mail center develop a written mail security plan and have it reviewed  annually by a competent authority.
Beyond mail-related requirements, GSA also requires the highest-ranking  federal official of the largest agency in GSA-controlled (leased) office  space to develop an occupant emergency plan. GSA guidance related to  this requirement recommends that the occupant emergency plan describe,  among other matters, critical information about the office space and  actions to be taken during emergencies.
The GAO Comptroller General’s Standards for Internal Control in the  Federal Government provides the overall framework for agency  management to establish and maintain effective internal control.  Establishing effective internal controls is a major part of managing an  organization. Such controls include the plans, methods, and procedures to  be used to meet an organization’s mission, goals, and objectives by, among  other things, monitoring performance, training employees, and ensuring  that federal requirements, such as GSA and DOD mail security  requirements, are followed.
section_title: How Did the Pentagon and Skyline Complex Process Mail in March 2005?
paragraphs: The Pentagon receives its mail from the Postal Service as well as from  commercial courier services. The Postal Service irradiates almost all first- class mail delivered to the Pentagon and other federal agencies in the  Washington, D.C., area, from its facilities on V Street, N.E. in Washington,  D.C. (the V Street Operation). In March 2005, Pentagon mail was delivered  from the V Street Operation to a mail-screening facility located within the  Pentagon remote delivery facility—a 250,000-square-foot shipping and  receiving facility adjoining the Pentagon. Technicians dressed in  protective gear then screened the mail over a custom-designed table  equipped with four filters intended to capture any particles that might fall  from the mail. The table used a negative airflow system that was intended  to keep microscopic particles from dispersing back into the mail-screening  facility.
At the time of the March 2005 incident at the Pentagon, employees of  Vistronix Incorporated (Vistronix)—the Pentagon’s mail-screening  contractor—collected and sent daily samples from each of the four filters  to Commonwealth Biotechnologies Incorporated (CBI)—a private  laboratory in Richmond, Virginia. Vistronix subcontracted the daily testing  of the Pentagon’s mail to CBI. The opened mail was then shrink-wrapped  and quarantined in a secure room until CBI notified Vistronix of negative  test results by either fax or e-mail. Upon receipt of negative test results, a  Vistronix employee released the mail from quarantine. Once released from  quarantine, mail employees placed the mail into mailboxes at the Defense  Post Office, where it awaited pickup by Pentagon employees.
The TRICARE Management Activity (TMA) mail room at the Skyline  Complex received and processed mail differently from the Pentagon. It  received a small amount of its mail from the Pentagon, but most of its mail  came from a Postal Service facility in Merrifield, Virginia, according to a  TMA mail room official. The TMA mail room had a biosafety cabinet, an X- ray machine, and two full-time employees. The biosafety cabinet had a  negative airflow system with filters for capturing and holding any particles  that fell from envelopes or packages being opened. While the cabinet was  used for mail screening, it was not capable of detecting anthrax.
section_title: Each of the Incidents Presented a Different Situation and Response and Occurred over Several Days
paragraphs: The two incidents involving the suspicion of anthrax occurred over several  days, but the most significant actions occurred the same day—Monday,  March 14, 2005. The Pentagon incident occurred first and was the result of  positive test results for anthrax in the mail. The Skyline Complex incident  occurred later that day when an alarm sounded on the biosafety cabinet  that employees took as a sign that contaminated mail had been passed  from the Pentagon to the Skyline Complex. Combined, the incidents set  in motion a large-scale response that also affected Postal Service  employees and operations. The response ended a few days later, when  further testing confirmed that anthrax was not present at either DOD  facility or in the mail. Figure 1 shows a chronology of the key actions and  organizations involved in the two incidents. The discussion that follows  explains each incident in turn.
subsections: section_title: The Pentagon Incident Was Triggered from Tests Indicating the Presence of Anthrax
paragraphs: Events leading up to the Pentagon incident began on Thursday afternoon,  March 10, 2005. After screening the mail in a facility at the Pentagon  remote delivery facility, Vistronix employees routinely collected swab  samples from four filters and sent them to CBI for analysis. According to  Vistronix’s account of events associated with the incident, about 4:00 p.m.  on Friday afternoon, March 11, a representative from CBI informed the  Vistronix Director that one of four swab samples collected and tested from  Thursday’s mail was positive for anthrax. The Director requested the  laboratory to conduct additional testing over the weekend but did not  notify Defense Post Office officials of the initial positive test results. On  Monday morning, March 14, at about 6:00 a.m., the Vistronix Director  informed a member of his staff (the site supervisor) that while additional  laboratory results for Thursday’s mail had not yet been received, test  results for Wednesday’s mail were negative, and, therefore, Wednesday’s  mail was cleared for release. The site supervisor misunderstood the  conversation, incorrectly concluding that mail from both days could be  released from quarantine, and, consequently, he called his staff to release  the mail. At about 6:30 a.m., Thursday’s mail was released, and, shortly  thereafter, employees of the Defense Post Office began processing the  mail for distribution. According to Vistronix, at about 9:10 a.m., the  laboratory notified Vistronix that additional testing of Thursday’s swab  sample was also positive. By the time Vistronix notified a Defense Post  Office official of the second test result at about 9:25 a.m., an unspecified  amount of the mail suspected of containing anthrax had already been  picked up and distributed throughout the Pentagon.
These developments initiated a wide-ranging response. At about   10:15 a.m., a Defense Post Office official notified the Pentagon Force  Protection Agency (PFPA)—the law enforcement agency responsible for  protecting people, facilities, and infrastructure on the Pentagon  Reservation. In the 2 hours that followed, PFPA    shut down the Pentagon remote delivery facility,    coordinated with mail officials to identify possible recipients of Thursday’s  mail,    secured the perimeter around the remote delivery facility with the help of    evacuated the majority of the employees from the remote delivery facility  to the Pentagon’s former child development center.
PFPA continued to lead the response in the hours that followed. The  Arlington County Emergency Communications Center sent emergency  personnel to the scene after it was notified through official channels at  about 10:37 a.m. Emergency personnel typically take charge of incidents  when the affected individuals have immediate medical needs. However,  when they arrived, they said none of the employees appeared to have  symptoms of illness. As a result, PFPA and Arlington County agreed that  PFPA would continue to lead the response. According to a DOD timeline  of the incident, DOD also attempted to notify the following federal and  local offices:    12:10 p.m.: First broadcast message sent to local public safety and  emergency management response agencies.   12:15 p.m.: FBI’s Washington Field Office and the Weapons of Mass  Destructions Operations Unit at FBI Headquarters.   12:30 p.m.: Office of the Postmaster General—the executive head of the  Postal Service  .    12:40 p.m.: Department of Homeland Security’s Operations Center.
When FBI staff arrived on the scene at about 1:00 p.m., they began to  assess the incident’s credibility. According to FBI officials, the totality of  the initial evidence suggested a false alarm. First, only one of the four  swab samples collected and tested from the filters on Thursday was  positive for anthrax. If an actual incident had occurred, FBI officials said,  it would have been reasonable to expect that all four samples would have  been contaminated because, based on experience gained during the fall of  2001 anthrax attacks, once airborne, anthrax spores disperse over a wide  area. In addition, tests conducted on Friday’s mail were negative. FBI  officials said that if anthrax had contaminated Thursday’s mail, it would  likely have contaminated the entire mail-screening facility, leaving residual  spores that also would have been detected in the samples taken from  Friday’s mail. While suspicious of a false alarm, the FBI declared the  Pentagon remote delivery facility a crime scene based on the evolving  response of other agencies and the need to further assess the evidence.
During the afternoon hours, two DOD Health Affairs officials responsible  for responding to medical issues on the Pentagon Reservation—the  Commander of the DiLorenzo TRICARE Health Clinic and DOD’s Assistant  Secretary for Health Affairs—began providing medical treatment to   (1) employees working at the remote delivery facility where the mail- screening facility was located, (2) Pentagon mail recipients, and (3) the  mail-screening technicians. DOD health officials estimate that, in total,  they dispensed an initial 3-day course of antibiotics to about 889  potentially affected employees. According to the officials involved, their  decision to immediately dispense antibiotics as a precautionary measure  was based on the laboratory’s positive test results and their experiences  gained in the fall of 2001. DOD’s Assistant Secretary for Health Affairs told  us that at about 1:00 p.m., he conferred with the CDC Director about  DOD’s medical decision, and that she agreed with the decision. According  to the CDC Director, the call was made to inform her about the decision  that DOD had already reached. The Director of CDC said that even if the  purpose of the call had been to seek her advice on medical treatment  options, she could not have offered a medical opinion because of  insufficient information, especially with respect to the reliability of the  laboratory’s test results. She stressed the need for clear, accurate, and  understandable information for making decisions about medical  treatment. Such information, she said, is typically developed  collaboratively with all appropriate parties involved. After the  conversation, she said she contacted the CDC operations center that  handles such incidents to ensure that appropriate CDC personnel were  aware of the incident. While HHS is the primary agency responsible for a  public health response, according to an HHS official, the CDC operations  center—not DOD—subsequently contacted the HHS operations center.
As officials from additional federal agencies became aware of the incident,  several interagency conference calls were held. The first of these calls was  convened by HHS officials at about 5:00 p.m. Officials from HHS said the  purpose of the conference call was to obtain a basic understanding of  what had occurred at the Pentagon (and at the Skyline Complex, where  the second incident had already begun), so that decisions could be made  on how to respond appropriately. According to HHS and DHS officials,  decision makers needed answers to such questions as what analysis had  been done, what procedures had been used by the contract laboratory, and  how the Pentagon samples had been collected. Obtaining such information  was critical to determining whether people had been exposed to anthrax,  whether the two incidents were linked, and what the appropriate response  should be. However, according to DHS and HHS officials, DOD could not  adequately answer these and other questions.
On Monday afternoon, DOD took the samples from CBI for analysis to  Fort Detrick, located in Frederick, Maryland—the site of two key federal  laboratories. The samples arrived at about 5:30 p.m. Over the next few  days, the laboratories at Fort Detrick conducted numerous tests of the  Pentagon’s samples as well as environmental samples taken from the  Pentagon. Late Wednesday evening, results of additional testing indicated  that anthrax was not present in samples collected from the Pentagon’s  mail-screening facility. Agency officials involved in the response believe  that the initial positive test result could have been caused by cross  contamination at CBI. The facility reopened on Friday, March 18.
section_title: The Skyline Complex Incident Resulted from an Alarm on Equipment Used for Mail Screening
paragraphs: The incident at the Skyline Complex began several hours after the  Pentagon incident began. At about 10:00 a.m., a TMA employee picked up  mail from the Pentagon and, by 11:30 a.m., had distributed some of the  mail within the Skyline Complex—a large office complex of privately  owned buildings in Fairfax County, Virginia. According to officials at the  Skyline Complex, an employee received an urgent telephone call around  noon indicating an unspecified problem with the Pentagon’s mail and  directing that any mail from the Pentagon be retrieved. The caller did not  provide any further explanation, according to the official. TMA mail room  employees retrieved the mail they had already delivered, emptied  mailboxes, and placed some of the mail in trash bags. About 1:00 p.m., a  TMA mail room employee was screening other mail from the Pentagon  using the biosafety cabinet when the cabinet’s alarm sounded. According  to mail room employees, they made several unsuccessful attempts to  telephone the manufacturer and the maintenance contractors for help. In  addition, DOD’s manager of the complex told us that she called PFPA for  guidance on how the cabinet operated, but the PFPA official was not  aware of the type of equipment in use at the complex, and consequently,  he was not able to tell her what to do. Finally, at 2:09 p.m., a Skyline  employee called the Fairfax County 911 emergency line.
Fairfax County emergency responders (fire, police, public health, and  hazardous material units) arrived on the scene shortly thereafter. They led  the incident over the next few hours and took several actions, including    closing the Skyline Complex and securing its exits,    shutting off its elevators and air-handling systems,    developing and providing health information to occupants,    collecting contact information from the occupants,    decontaminating some employees who were sheltering in place, and    obtaining and testing environmental samples from the complex and  attempting to remove filters from the biosafety cabinet in order to perform  additional tests.
According to Fairfax County responders, they attempted to hold all  occupants within the Skyline Complex because they anticipated receiving  results of environmental testing Monday afternoon. They explained that  having the complex occupants together would help them provide  information to the occupants and coordinate any further responses that  may be necessitated by the results of the environmental testing. Test  results were delayed, however, and the majority of the Skyline Complex  employees began to be released. Just prior to this, at about 7:30 p.m.,  Fairfax County responders began decontaminating 45 of the complex’s  employees who were believed to be at high risk for exposure to anthrax.  The initial environmental test results—available on Tuesday—were  inconclusive and, as a result, Fairfax County and FBI responders collected  additional environmental samples for analysis at Fort Detrick. On Tuesday  afternoon, DOD dispensed antibiotics to the 45 high-risk employees. This  incident began to de-escalate on Tuesday evening as officials learned that  the alarm that sounded on the biosafety cabinet used for mail screening  indicated only an airflow obstruction, not the presence of anthrax. By  Wednesday evening, laboratory results from environmental samples  indicated that anthrax was not present at TMA’s mail room in the Skyline  Complex. The majority of the Skyline Complex reopened on Thursday,  while TMA’s mail room reopened on Friday morning, March 18.
section_title: The Incidents Also Affected Postal Service Employees and Operations
paragraphs: A DOD official called the Postmaster General to inform him of the  Pentagon incident at about 12:30 p.m. on Monday, March 14, 2005, but  neither the Postmaster General nor other Postal Service executive were  available to receive the call. The DOD official left a voice-mail message,  but according to the Postal Service’s Senior Vice President for  Government Relations, the message did not convey any urgency about the  potential for anthrax in the mail. Furthermore, by the time Postal Service  officials listened to the message, they had already heard about the incident  through the local media. At about 5:00 p.m., when Postal Service officials  learned at the first interagency conference call that DOD had provided  antibiotics to Pentagon employees, Postal Service officials acted quickly to  protect their employees who, days earlier, might have processed the mail.  Thus, by Monday evening, the Postal Service had suspended operations at  its V Street Operation and had immediately begun dispensing antibiotics to  its employees. In total, over 160 Postal Service employees were treated for  their possible exposure to anthrax. On Tuesday, March 15, the CDC’s  National Institute for Occupational Safety and Health provided technical  assistance to the Postal Service in designing an environmental testing  strategy for the V Street Operation. By Wednesday morning, March 16,  results from environmental testing of the V Street Operation were negative  for anthrax. The Postal Service reopened the V Street Operation in the  afternoon.
section_title: Problems Encountered Reflect Both a Failure to Follow Existing Contract Provisions and Procedures and a Lack of Procedures and Plans
paragraphs: DOD encountered numerous problems during the two March 2005  incidents. At the Pentagon, these problems primarily involved not  following required mail-screening contract provisions and procedures. The  failure to follow these requirements resulted in, among other things, the  premature release of the potentially contaminated mail that caused the  incident at the Pentagon. In addition, the Pentagon’s contract for mail  screening lacked a clear provision specifying required testing methods,  which resulted in the use of a laboratory whose testing methods were  unknown and whose results were not actionable—this, in turn,  exacerbated the incident at the Pentagon. At the Skyline Complex mail  facility, problems were even more basic, in that required procedures and  plans for responding to biohazards and other emergencies were  inadequate or absent altogether. Further, at the Pentagon, the federal  framework developed to, among other things, help ensure more effective  decision making through the coordinated response of all affected parties  and decision makers was not fully followed. If the framework had been  fully followed, decisions regarding medical treatment of DOD and Postal  Service employees may have been improved.
subsections: section_title: At the Pentagon, the Mail- Screening Contract Provisions and Procedures Were Not Followed
paragraphs: Vistronix did not follow contract provisions and mail inspection  procedures related to the detection and response to potential biohazard  emergencies involving the Pentagon’s mail. The contractor developed  procedures for implementing the contract’s mail-screening requirements,  which described the process by which mail entering the Pentagon would  be inspected, tested, quarantined, and released. DOD approved the  procedures, but the contractor failed to follow two key requirements.
Mail-screening contractor did not provide timely notification of  potential contamination. Both the contract and the approved mail  inspection procedures provided specific notification requirements for  informing DOD of potential biohazardous situations involving the  Pentagon’s mail. The contract required Vistronix to notify PFPA  “immediately” if there were any evidence of risk or possible contamination  of the mail. Similarly, the mail inspection procedures required PFPA to be  contacted (1) within 1 minute of an actual or potential event involving  contamination and (2) when a positive test result occurred “at any point”  in the testing process. The laboratory informed the Vistronix Director that  a sample from Thursday’s mail had tested positive for anthrax on Friday  afternoon, March 11. Instead of immediately notifying PFPA as required,  however, the Director asked the laboratory to conduct additional tests  over the weekend. The contractor did not inform DOD of the suspected  mail contamination until after it received the second positive test result on  Monday, March 14—about 2-½ days after the notification should have  occurred. According to the Vistronix Director, he believed the procedures  required them to notify DOD only after a second positive test result. The  contractor’s untimely notification created a sense of urgency within DOD  to quickly provide antibiotics to its employees—before consulting, as  specified in the NRP, with other agencies about the proper medical  response.
Mail-screening contractor did not quarantine mail until it received  negative test results from the laboratory. The contract required  Vistronix to quarantine the mail until receipt of negative test results.  Similarly, the mail inspection procedures required Vistronix to hold (i.e.,  “not release for delivery”) the Pentagon’s mail until the laboratory had  reported negative test results to Vistronix. The procedures also noted that  a positive result “at any point” necessitates sequestering all potentially  contaminated mail. Vistronix failed to follow these requirements.  Specifically, while the Vistronix Director was aware of an initial positive  test result on Friday, he did not ensure that the mail remained quarantined  until receipt of negative test results from the laboratory. Instead,  miscommunication among Vistronix staff led to the mail’s release several  hours before the laboratory informed Vistronix that its weekend test  results were also positive for anthrax. The premature release of the  potentially contaminated mail resulted in a broad response at the  Pentagon, the Skyline Complex, and the Postal Service’s V Street  Operation.
section_title: The Pentagon’s Mail- Screening Contract Provision for Testing Samples Was Also Unclear
paragraphs: The testing provision in the mail-screening contract required Vistronix to  test samples from the mail-screening equipment in accordance with  unspecified “CDC guidelines.” However, Defense Post Office officials— including the contracting officer’s representative who had responsibility  for overseeing the contract—told us that they did not identify the specific  guidelines to be used and were unaware that the CDC publishes both  general testing guidelines, which are available in the public domain, and  guidance and protocols for anthrax testing by the LRN, which are available  only to LRN laboratories. The officials explained that even if they had  known which guidelines DOD expected to be followed, they did not have  the technical expertise to determine whether the contract’s testing  provision was being followed. Defense Post Office officials further  explained that the contract was awarded quickly in 2001 after the  nationwide anthrax attacks. Their office was tasked with overseeing the  contract, they said, because at that time the office was the “executive  agent for mail in the Pentagon”—not because it had any expertise or  training on these matters. According to Defense Post Office officials, the  lack of technical expertise regarding anthrax at that time contributed to  the lack of clarity in the contract’s testing provision. Their lack of  expertise also caused them to conclude that CBI met all CDC and federal  guidelines, in part, because Vistronix had informed DOD that CBI was a  certified CDC laboratory that adhered to CDC guidelines. An independent  review of CBI, the subcontract laboratory, sponsored by DOD and  conducted in April 2005 found that CBI analyzed the Pentagon’s samples  using testing methods that differed from CDC’s guidance and protocols.  The review also found that Vistronix’s contract with CBI did not require  the laboratory to verify its testing methods. By March 2005, DOD and  Vistronix had had 3-½ years to specify its testing requirements for the  contract. An unclear contracting provision, combined with the lack of  oversight by both DOD and Vistronix, resulted in the use of a laboratory  whose testing methods were unknown and whose results were not  actionable. The effect of these events was evident when DOD officials  could not adequately explain to other agency officials what (1) tests CBI  had conducted, (2) methods CBI had used, and (3) the results meant.  DOD’s inability to provide adequate answers to these and other crucial  questions exacerbated the incident at the Pentagon and slowed the  response since officials from other agencies were skeptical of the  laboratory’s results.
section_title: At the Skyline Complex, Basic Response Procedures Were Inadequate or Absent Altogether
paragraphs: At the Skyline Complex, basic procedures for responding to a  biohazardous incident were inadequate or absent for the TMA mail facility  in the Skyline Complex. The following three key elements were either  inadequate or absent.
First, TMA did not ensure that mail room procedures addressed  what to do, or whom to notify, when the equipment alarm sounded  or that employees were properly trained on the equipment. TMA is  responsible for ensuring that adequate procedures are in place and  effective training occurs, so that employees can perform their duties  competently. Although some procedures were in place at the Skyline  Complex, they did not address the capabilities of the biosafety cabinet or  what to do if the alarm on the equipment sounded. At the time of the  incident, the mail room’s procedures provided, among other things, (1)  basic instructions for using the biosafety cabinet, including how to turn  the machine on and off and how to open the mail, and (2) information  about whom to notify when a suspicious package was discovered. The  procedures did not address what the biosafety cabinet did, how it worked,  or how to respond to its built-in alarm. The TMA mail manager noted that  training on the biosafety cabinet had occurred when the machine was  purchased in 2001, but no subsequent training had been conducted. In the  meantime, he said, staff turnover and the absence of additional training  had led to a lack of understanding about the equipment’s capabilities. In  addition, while the procedures specified whom to call if suspicious mail is  discovered, the procedures did not address whom to contact when the  equipment’s alarm sounded. If procedures were adequate and periodic  training had occurred, employees would likely have known that, although  the equipment had a negative airflow system with filters for capturing and  holding any particles that fell from envelopes or packages being opened  within the equipment, it did not detect biohazards and its alarm sounded  only to indicate an airflow obstruction. Instead, in conjunction with the  phone call indicating an unspecified problem with the Pentagon’s mail,  mail room employees assumed the alarm was signaling the presence of  biohazards in the mail. Because TMA employees lacked adequate  information and training on the equipment, they unnecessarily contacted  first responders.
Second, neither TMA nor DOD ensured that the required mail  security plan was in place. Both TMA and DOD have responsibilities for  ensuring that an adequate mail security plan exists for the mail room in the  Skyline Complex. GSA’s federal mail management regulation and DOD’s  mail manual both require mail security plans for agency mail rooms.
According to GSA’s regulation, security plans must include (1)  procedures for safe and secure mail room operations, (2) plans for training  mail room personnel, and (3) plans for annually reviewing agency and  facility-level mail security plans. In addition, DOD’s mail manual requires  DOD’s mail room officials to ensure that their mail security plans are  coordinated with local security officials. TMA did not develop the required  security plan. If TMA had developed a plan and coordinated it with local  officials, Fairfax County emergency personnel—the local first  responders—may have learned about the biosafety cabinet’s limitations,  including the meaning of the equipment’s audible alarm. Furthermore,  DOD did not ensure that TMA had developed a plan, or attempt to review  it for adequacy, as required. GSA’s federal mail management regulation  requires that facility level mail security plans be annually reviewed.  Moreover, as specified in the regulation, DOD must annually report to GSA  that its mail security plans have been reviewed by a competent authority  within the past year. GSA officials noted that DOD’s Official Mail Manager  submits a certification form to GSA annually; however, the form does not  indicate that DOD’s (1) plans exist and that (2) the plans have been  reviewed by a competent authority in the past year. Instead, the form  submitted to GSA simply certifies that DOD has the requisite requirements  in place. According to DOD’s Official Mail Manager, he cannot certify that  all DOD mail rooms have mail security plans or that they have been  reviewed by a competent authority because DOD does not have a process  in place to ensure that the required reviews take place. He further  explained that he lacks the time and resources to review the plans. If TMA  and DOD had followed the applicable requirements, the problem that  occurred at the Skyline Complex may have been avoided.
Third, the Defense Information Systems Agency had not developed  an Occupant Emergency Plan. GSA requires agencies of GSA-controlled  buildings to have an occupant emergency plan for protecting life and  property during an emergency. Critical elements of the plan include (1)  evacuation and sheltering-in-place information; (2) contact information  and emergency phone numbers; and (3) specific information about the  building’s construction, including its floor plans. The highest ranking  official of the largest agency in each GSA-controlled building is  responsible for developing and maintaining the occupant emergency  plan. In March 2005, the Defense Information Systems Agency (Defense  Agency) was the largest agency in the Skyline Complex. According to  officials from the Defense Agency, they were aware of the agency’s  responsibility for developing the occupant emergency plan as early as  June 2002. Defense Agency officials had drafted a plan by the time of the  incident, but had neither distributed it to other federal occupants of the  complex nor coordinated it with first responders. Moreover, employees  had not been trained on the plan and affected federal agencies had not  agreed to or signed the plan. Officials of the Defense Agency commented  that developing an occupant emergency plan takes a great deal of  coordination among participating agencies, which prolongs the plan’s  completion. The lack of a required occupancy emergency plan contributed  to the difficulties that employees and first responders experienced during  the incident. For example, first responders had difficulty getting critical  information to employees because contact information was not readily  available for federal employees in the complex. In addition, since  information about the complex was not readily available, some employees  were able to exit the complex because Fairfax County police, who had  attempted to secure the Skyline Complex, were unaware of all the existing  exits.
section_title: DOD Did Not Fully Follow the Federal Framework for Coordinating Responses at the Pentagon
paragraphs: DOD did not fully follow the federal framework for coordinating a  response to the potential anthrax incident at the Pentagon; instead, it  chose to make decisions on its own. The federal framework is set forth in  the NRP and NIMS, which specifies a structured and coordinated  approach for involving federal, state, and local agencies in decision  making. The unifying element of this framework is the ability to harness  the resources of various agencies whose expertise and knowledge help  ensure informed decisions about how to proceed in any given situation.  While DOD initially followed NIMS when it established its incident  command at the Pentagon, as the incident evolved, key aspects of the  federal framework were not followed. Here are three examples:    First, DOD did not fully follow NRP’s notification structure. NRP’s  Biological Incident Annex requires every federal agency to first notify the  FBI if it becomes aware of an overt threat involving biological agents.
While DOD officials did notify the FBI, it was not until almost 3 hours after  they first became aware of the Pentagon’s positive test results. Earlier  notification would have likely helped with the evaluation of test results  and allowed federal agencies to collectively coordinate a proper course of  action, particularly because, as discussed earlier, FBI officials began  questioning the incident’s credibility after arriving on scene. The  Biological Incident Annex also designates HHS as the federal agency  responsible for coordinating a public health response involving  bioterrorism threats. DOD officials never notified HHS but, instead, called  the Director of CDC to disclose their intention to administer antibiotics to  DOD employees. The Director of CDC, not DOD, alerted the CDC  operations center, which, in turn, notified HHS’s operations center at  about 4:00 p.m. on Monday. As specified in the Biological Incident Annex,  once HHS officials were notified of a credible threat, they convened an  interagency conference call approximately 1 hour later to coordinate a  possible medical emergency response. However, by then, DOD had already  begun to administer antibiotics to its employees. As a result, any advice  any guidance on (1) medical treatment options or (2) the validity of the  laboratory’s test results that other agency officials may have offered were  essentially moot.
Second, DOD failed to follow NIMS protocols regarding joint  decision making. Under NIMS, the incident commander is responsible for  the entire response to an incident. To assist with various aspects of a  multijurisdictional response, the incident commander is expected to  assemble federal, state, and local agencies to serve in a unified command.  The unified command includes representatives from all agencies and  organizations that have responsibility for, or can provide support to, an  incident. Collectively, the unified command is expected to consider and  help make decisions on all objectives and strategies related to an incident.  At the Pentagon in March 2005, PFPA included federal and local agencies  in the response; however, the response structure never matured into a  unified command, especially when some decisions—especially those  related to medical treatment—were made outside the command structure.  DOD essentially had two separate incident responses: PFPA acted as the  incident commander for the evacuation and containment of Pentagon  employees, while DOD’s Health Affairs made unilateral decisions  regarding the employees’ medical treatment. According to local public  health officials, DOD did not consult them on the proper course of action  regarding whether, or how, to intervene medically. Had information and  decisions flowed through a unified command structure, local public health  officials could have raised the concerns they had about providing  antibiotics without a confirmed LRN test result. Additionally, if medical  treatment decisions had been made collaboratively, DOD and local public  health officials could have (1) agreed on a strategy for treating potentially  affected individuals, including access to additional medication and follow- up treatment; and (2) discussed the potential ramifications of initially  providing ciprofloxacin to DOD employees. According to local public  health officials, DOD’s initial provision of ciprofloxacin to DOD employees  set a precedent that essentially eliminated other antibiotic treatment  options, given the health officials’ desire to ensure that potentially affected  individuals would be treated consistently. Had medical decisions been  made within the context of a unified command, a different decision may  have been reached and hundreds of DOD employees—with no, or limited,  exposure to potential contamination—may not have received unnecessary  medication.
Third, DOD did not coordinate the initial public response to the  incidents. An important outcome envisioned in the federal framework is  effective management of information available to the public. The NIMS  structure calls for a joint information center to provide a location for  organizations participating in the management of the incident to work  together to ensure that timely, accurate, easy-to-understand, and  consistent information is disseminated to the public. The joint information  center is supposed to have representatives from each organization  involved in the management of an incident. DOD did not establish a joint  information center at the start of the incidents, and it did not have clear  written procedures for doing so. As a result, the public received unclear  and inconsistent messages about, among other matters, the source of the  anthrax. For example, media accounts reported that mail through the  Postal Service caused the incidents when, in fact, the source of possible  contamination was unknown. According to the Postal Service, this  resulted in unnecessary anxiety among Postal Service workers, their  families, and recipients of Postal Service mail.
According to DOD health officials responsible for making medical  decisions at the Pentagon, they based their medical treatment decision on  the experiences they gained from the fall 2001 anthrax incidents. The  officials explained that they were very sensitive to what they perceived to  be untimely medical decisions reached in the fall of 2001. Consequently,  they said they decided to err on the side of caution and quickly distribute  antibiotics to employees at the Pentagon and Skyline Complex.  Additionally, since the incident occurred on the Pentagon Reservation,  DOD officials did not believe that the NRP applied because, in their view,  they had the medical authority, expertise, and resources to handle the  incident internally. However, other federal officials—including those in  DHS and HHS—told us that the NRP was applicable and that DOD should  have followed the framework. In addition, CDC guidance emphasizes the  need to make risk-based decisions, including those involving dispensing of  antibiotics during suspected anthrax incidents. According to the CDC, a  risk-based, participatory approach is necessary, in part to limit the number  of people who may receive antibiotics before confirmation by the LRN.  Since the mail had been quarantined over the weekend, the Pentagon  employees most at risk would have been the technicians who had  screened the mail the previous week. These persons received antibiotics,  but so did hundreds of others who, in our view, would not likely have been  exposed until Monday morning, when the Pentagon’s mail was released  from quarantine.
DOD health officials’ concern about protecting DOD employees from the  risk of exposure is clearly understandable. However, DOD’s actions were  not consistent with the NRP. Once HHS was contacted by CDC, it began  using the notification and response protocols specified in the NRP. In  particular, HHS convened the first interagency conference call in which  federal participants were able to discuss the laboratory’s test results and  raise concerns about the quality of the results. Additionally, CDC was able  to address the Postal Service’s concerns about the possible health effects  on its employees who may have processed contaminated mail to the  Pentagon the previous week. CDC recommended antibiotics for  employees of the V Street Operation because (1) of the confluence of the  two incidents, which, at the time, were viewed as involving the presence of  anthrax; (2) DOD had already started its employees on antibiotics; and   (3) the employees could have been exposed to anthrax several days earlier  because they process mail to the Pentagon.
section_title: DOD Took Numerous Actions That Address Problems Related to the Incidents
paragraphs: DOD took numerous actions that address problems related to the  Pentagon and Skyline Complex incidents. At the Pentagon, some actions  to improve DOD’s mail processing and incident response, such as  modernizing the mail-screening facility and changing the laboratory used  to test daily samples, were already under way. Other actions, including  selecting a new mail-screening contractor and improving procedures for  releasing quarantined mail, were a direct response to what occurred. At  the Skyline Complex, DOD’s actions included prohibiting the use of  equipment for screening mail unless the equipment is being operated  within the context of a comprehensive mail-screening program. DOD also  commissioned the RAND Corporation to conduct an independent review  to examine its response to the incidents. The resulting report, issued in  January 2006, contains numerous recommendations which, according to  DOD, it has taken action upon.
subsections: section_title: At the Pentagon, Some Actions Were Already Under Way, While Others Were Taken in Direct Response to the Incident
paragraphs: Some of the actions DOD took at the Pentagon were under way before the  March 2005 incident. Although the actions were not carried out until later,  they reflected decisions that had been previously set in motion to improve  mail screening and responses to biological incidents. These actions  included the following:    DOD transferred oversight of the mail-screening function to PFPA.
PFPA assumed oversight of mail-screening from the Department of the  Army in August 2005 because, according to DOD officials, PFPA’s strategic  mission of providing security and law enforcement at the Pentagon is  better aligned with the mail-screening function. According to a PFPA  official, planning for the transfer of mail-screening oversight began around  January 2005. A gradual transition had been planned, he said, but the  Pentagon incident significantly accelerated efforts to implement the  transfer of mail-screening oversight responsibilities.
DOD modernized the mail-screening facility, refurbished the mail  quarantine room, and installed new mail-screening equipment.  According to a DOD official, initial planning for these improvements also  began around January 2005. PFPA officials stated that the new mail- screening facility and the refurbished quarantine room have improved  capabilities that are designed to protect employees and prevent the spread  of anthrax. Finally, a DOD official said that the decision to replace the  previous mail-screening table with new equipment was based on a 2003  National Academy of Sciences report, which, among other things, raised  questions about the table’s ability to detect anthrax in small amounts.  PFPA is awaiting the results of a study, which it expects to conclude in  May 2006, to evaluate the effectiveness of the changes.
DOD changed its testing laboratory. Daily testing of samples from the  Pentagon’s mail-screening equipment is now performed by a non-LRN  chemical-biological laboratory located on the premises, instead of a  contract laboratory. The laboratory is part of PFPA and, according to a  PFPA official, was established in January 2005 to help protect the  Pentagon from biological threats. The official stated that the original plan  was to transfer testing from CBI to the Pentagon’s chemical-biological  laboratory in October 2005, after the Vistronix contract expired. However,  the transfer was accelerated, occurring instead in March 2005, a few days  after the incident at the Pentagon.
DOD entered into a memorandum of understanding (MOU) on  biological monitoring with other federal agencies. In April 2005, DOD  signed an MOU for Coordinated Monitoring of Biological Threat Agents,  which was developed prior to the Pentagon incident. DHS, HHS, the  Department of Justice (which includes the FBI), and the Postal Service are  also parties to the MOU. DHS’s Science and Technology Directorate is  responsible for coordinating the implementation of the MOU. The  following provisions in the MOU help address the notification, laboratory  testing, and medical response problems that arose at the Pentagon:   The MOU establishes prompt notification requirements. Specifically,  the MOU requires participants to notify the FBI, HHS, and DHS within   1 to 2 hours of positive test results that indicate, with a high degree of  confidence, the presence of anthrax or other biological agents.  However, according to a DHS Science and Technology Directorate  official, such test results only trigger notification and, until confirmed  by the LRN, are not considered actionable by HHS, DHS, and others.
The MOU requires participating agencies to develop and employ  mutually accepted and validated testing methods to confirm  biological threats. According to a Science and Technology official, test  results produced from these methods will be considered actionable for  public health and other response measures, including the  administration of medical treatment. He stated, however, that this MOU  provision will take time to implement. According to the official, an  independent organization is currently performing the extensive testing  and analysis needed to evaluate and establish equivalency between the  wide array of testing methods employed across agencies. DOD  officials stated that the Pentagon’s chemical-biological laboratory— which is not part of the LRN—plans to adopt the testing methods that  emerge from the MOU. As a result, if the MOU’s equivalency testing  provision is fully implemented, they said, confirmatory positive results  from the Pentagon laboratory will be considered equivalent to LRN  results and deemed actionable by DHS, HHS, and others for decisions  related to the administration of medical treatment.
In addition to carrying out actions already in process, DOD also initiated  numerous actions in direct response to the problems that occurred at the  Pentagon. Several of these actions address the mail-screening contractor’s  failure to follow established requirements. Other actions were carried out  in response to the RAND review and are intended to better align DOD’s  procedures with those in the federal framework for coordinating  responses to potential biological threats. The actions are as follows:    DOD changed mail-screening contractors, strengthened the new  contract, and drafted improved procedures. PFPA selected a new  contractor for screening mail at the Pentagon in September 2005. PFPA  also developed new contract provisions and drafted new mail inspection  procedures to address the previous contractor’s failure to follow  established contractual and procedural requirements. Table 2 highlights  key changes in the Pentagon’s mail-screening contract provisions and draft  procedures.
PFPA strengthened the mail-screening contract by requiring the contractor  to, among other things, periodically train employees on emergency  response procedures and develop an effective quality control program to  ensure adherence to contract provisions. In addition, PFPA’s contracting  officer representative is required to evaluate the contractor’s performance  to ensure that it meets contract requirements. PFPA has also drafted new  mail-screening procedures to help ensure the contractor performs in  accordance with requirements. The draft procedures require PFPA to,  among other things, perform unannounced inspections to ensure that the  contractor is properly executing required procedures. As of April 30, 2006,  it was unclear when the draft procedures would be finalized; however,  according to a PFPA official, the new monitoring measures are already  being performed. Effective monitoring of contractor activities and  performance is key to maintaining effective agency internal controls.
DOD strengthened controls over the release of quarantined mail.
The Pentagon’s draft mail inspection procedures require verification of  negative test results by representatives from three separate  organizations—PFPA, the Defense Post Office, and the contractor—before  the mail is released. Table 3 identifies the key steps for releasing  quarantined mail, as specified in the draft procedures.
Although the mail inspection procedures are still in draft form, these steps  are currently being used for releasing the Pentagon’s quarantined mail.  The segregation of key duties and responsibilities at this critical juncture  in the mail release process reduces the risk of error and, as such, is  designed to strengthen the internal controls that were lacking in March  2005. During the incident, inadequate internal controls allowed a single  point of failure—in this case, a misunderstanding between two contract  employees—to result in the premature release and distribution of  quarantined mail that may have been contaminated. This triggered a broad  response at the Pentagon and elsewhere. The implementation of rigorous  internal controls for releasing the Pentagon’s mail appears likely to  prevent similar incidents in the future.
DOD commissioned the RAND Corporation to conduct an  independent review examining its response to the March 2005  incidents. The review primarily focused on evaluating DOD’s policies and  procedures for responding to such incidents and making  recommendations for improvement. In November 2005, DOD formed a  working group to review and implement recommendations from a draft of  the report. The final report was issued in January 2006.
DOD drafted new notification procedures for positive test results  at the Pentagon. To help address the notification problems that arose  during the Pentagon incident, DOD drafted new procedures for notifying  appropriate parties of positive test results from the Pentagon’s on-site  chemical-biological laboratory. These procedures help implement a  recommendation in the RAND report that calls for ensuring timely  notification of designated agencies in accordance with the NRP and NIMS.  The recommendation was based on findings similar to those identified by  GAO. DOD officials stated that the new procedures, while still in draft, are  currently being used to respond to potential incidents involving biological  contamination at the Pentagon. Figure 2 illustrates DOD’s draft  notification procedures for positive test results from the Pentagon’s on- site chemical-biological laboratory.
The procedures require Pentagon laboratory officials to immediately  notify PFPA of positive test results. Thereafter, PFPA and DOD’s Assistant  Secretary of Homeland Defense are responsible for making the required  notifications to internal and external parties. According to a DOD official,  these notifications should occur immediately in order to meet the 1 to 2  hour time frame specified in the MOU. As prescribed in the NRP, once  notified of positive test results, (1) the FBI is responsible for coordinating  appropriate confirmatory testing by the LRN and (2) DHS’s operations  center is responsible for notifying affected local jurisdictions. DOD’s draft  procedures include notification to all agencies specified in the NRP’s  Biological Incident Annex, as well as those specified in the MOU. Although  not specifically required in either the NRP or MOU, the procedures also  include notification to the Postal Service. An official stated that DOD  actively worked with DHS, the FBI, and HHS to develop the notification  procedures and is continuing to improve them based on agency input,  actual events, and the outcome of training exercises.
DOD is developing a new policy that defines the roles and  responsibilities of senior DOD leadership during incidents at the  Pentagon. According to DOD’s Director of Administration and  Management, the policy—called an instruction—is being developed and  will be based, in part, on NRP’s Biological Incident Annex. He stated that  the instruction will detail the health-care responsibilities of DOD  leadership involved in making medical treatment decisions and will be  consistent with NRP and NIMS protocols. The draft instruction was  expected to be tested during a Pentagon training exercise in May 2006 and  is to be finalized in the fall of 2006. The development of the instruction  directly addresses a recommendation from the RAND review, which  arrived at findings similar to ours regarding DOD’s medical decision  making.
DOD drafted new procedures to help ensure that a joint  information center is established. DOD also drafted procedures for  ensuring that, consistent with the NIMS framework, a joint information  center is established during potential emergency incidents at the  Pentagon. During the March 2005 incident, DOD did not establish a joint  information center to disseminate timely, accurate, and consistent  messages to the public. The RAND report contained a similar finding and  recommended remedial actions. In response, DOD drafted procedures that  require PFPA, Public Affairs, and Washington Headquarters Services to  coordinate in the establishment and operation of a joint information  center to disseminate information to the media during incidents at the  Pentagon. According to a Washington Headquarters Services official, the  draft procedures will be tested during future training exercises at the  Pentagon.
section_title: DOD Took Other Actions That Address Problems at the Skyline Complex
paragraphs: DOD also took a number of other actions that address the specific  problems we described related to the incident at the Skyline Complex.  Many of these problems were also raised in the RAND report. DOD’s  actions, several of which also affect other DOD-leased facilities, included  the following:    DOD developed operating conditions for equipment used to screen  mail in the national capital region. In January 2006, DOD’s Director of  Administration and Management issued a directive prohibiting DOD mail  facilities in leased space within the national capital region—including the  Skyline Complex—from operating equipment used to screen mail,  including biosafety cabinets, unless the facilities meet five specific  operating conditions. These conditions include having trained mail  screeners to sample equipment for biological agents and an approved  laboratory for analyzing the samples. The directive partially addresses a  recommendation in the RAND report calling for DOD to develop, evaluate,  and ensure that appropriate site-specific screening practices are in place  departmentwide. According to the Director, the directive is intended to  relay key lessons learned in March 2005—specifically, that equipment for  screening mail is ineffective and potentially risky to personnel and  facilities when used outside of a comprehensive mail-screening program.  The TMA facility at the Skyline Complex did not meet these conditions.  Although the agency purchased a new biosafety cabinet for the Skyline  Complex, which is similar to the device in place in March 2005, a TMA  official stated that the agency is no longer operating the device and is  taking steps for its disposal in response to the directive.
DOD initiated two efforts to gather information on screening  operations in its mail facilities. First, DOD’s Joint Program Executive  Office for Chemical-Biological Defense, as part of a plan required by the  National Defense Authorization Act for Fiscal Year 2006, gathered some  information on equipment used for mail screening in DOD mail facilities  nationwide. However, according to a joint program office official, the data  is not comprehensive because information was not sought from all  applicable facilities. Second, in response to the RAND review, Washington  Headquarters Services attempted to identify DOD-leased facilities in the  national capital region that screen mail for threats. However, as discussed  later, this data collection effort had numerous limitations.
DOD developed an occupant emergency plan for the Skyline  Complex. In July 2005, the Defense Agency, in conjunction with TMA,  issued an occupant emergency plan for the Skyline Complex. The plan was  reviewed and deemed adequate by a building management specialist in  DOD’s Washington Headquarters Services. The plan includes emergency  contact information and information about the complex, such as floor  plans, that were not readily available during the March 2005 incidents. In  addition, according to a Defense Agency official, the plan has been fully  coordinated with Fairfax County first responders, who (1) met with  Defense Agency officials to discuss the roles and responsibilities of  applicable parties, (2) reviewed the plan, and (3) participated in the  emergency training exercises at the Skyline Complex. He also stated that if  a similar incident were to occur, the plan would facilitate communications  between first responders and Skyline Complex employees. The  development of an occupant emergency plan addresses findings in this  report as well as recommendations from the RAND review.
DOD issued supplemental requirements for developing mail  security plans. DOD’s December 2001 mail manual required agency mail  rooms to develop security plans, but at the time of the incidents, did not  clearly specify what the plans should include or require that they be  reviewed. A supplement to the manual, issued in September 2005, requires  mail room officials to ensure that their plan (1) details the reporting  procedures and responsibilities for handling suspicious mail, (2) has been  coordinated with local emergency responders, (3) is disseminated to all  mail center staff, and (4) is reviewed for potential revisions at least  quarterly. The supplemental requirements refer mail room officials to GSA  guidance on handling suspicious mail to assist in the development of  adequate security plans.
section_title: DOD’s Actions Do Not Fully Resolve Identified Problems
paragraphs: DOD’s actions resolve many of the problems that arose in the March 2005  incidents but not all. One remaining and overarching concern involves  whether, despite its actions, DOD will adhere to the interagency  coordination protocols in the NRP and NIMS or will revert to the isolated  decision-making approach it used at the Pentagon. Other remaining issues  include ensuring that DOD (1) facilities have adequate mail security plans  in place and (2) mail facilities in the national capital region are  appropriately using biosafety cabinets for screening mail.
subsections: section_title: DOD’s Adherence to NRP and NIMS Interagency Coordination Protocols Remains Uncertain for Incidents at the Pentagon
paragraphs: DOD has taken actions to align its procedures with the NRP and NIMS,  including the development of an instruction defining the roles and  responsibilities of senior DOD leadership during incidents at the Pentagon.  The policy instruction is not expected to be finalized until the fall of 2006  and, until then, it is unknown whether it will adequately specify medical  treatment responsibilities in accordance with the coordination protocols  in the NRP and NIMS. In October 2005, senior DOD health officials told us  that they would handle the medical response at the Pentagon in a similar  manner if an incident occurred in the future, in part, because they have the  authority to do so. In April 2006—more than 1 year after the incident— another senior health official reiterated that DOD has the authority to  make final decisions on medical treatment at the Pentagon without  collaboration or consultation with other agencies, including HHS. Such  views conflict with protocols in both the NRP, which requires an HHS-led  coordinated public health response, and NIMS, which prescribes local- level input into decisions affecting their jurisdictions. Until DOD ensures  that its senior health officials make medical treatment decisions in  accordance with the NRP and NIMS during potential biological incidents  at the Pentagon, the problems that occurred in March 2005 remain  unresolved.
section_title: DOD Still Has Not Ensured That Its Mail Facilities Have Reviewed Mail Security Plans, As Required
paragraphs: TMA did not have a mail security plan for the Skyline Complex at the time  of the incidents, and although federal mail management regulation and  DOD’s mail manual require such a plan, it has not subsequently developed  one. Until TMA develops a plan and, among other things, coordinates it  with local first responders, any future response at the facility may also be  hampered. More importantly, it is not known whether other DOD mail  facilities also lack plans, or adequate plans, for guiding future responses  involving potential biological threats in the mail. As discussed earlier,  DOD does not have a process in place to (1) ensure that its mail facilities  have mail security plans and (2) verify that each plan has been annually  reviewed by a competent authority.
section_title: DOD Has Not Ensured That Its Facilities in the National Capital Region Are Appropriately Using Biosafety Cabinets
paragraphs: Gaps remain in the actions DOD has taken to ensure the appropriate use  of biosafety cabinets for mail screening in DOD-leased mail facilities in the  national capital region. First, DOD has not ensured that DOD mail facilities  in the national capital region are not operating biosafety cabinets outside  of a comprehensive mail-screening program. As pointed out in the Director  of Administration and Management’s January 2006 directive, using mail- screening equipment in isolation of such a program is ineffective and  potentially risky. Second, at the conclusion of our review, DOD still had  not identified the number of biosafety cabinets in use in the region. For  example, although DOD’s Washington Headquarters Services collected  information about facilities in the national capital region that screen mail  for threats, its winter 2005 data collection effort was not comprehensive.  For example, the office did not attempt to (1) identify whether other  biosafety cabinets were being used, (2) determine the conditions under  which the equipment is being operated, and (3) collect information on the  type and capabilities of other mail-screening equipment being used.  Moreover, it appears that numerous DOD mail facilities in the national  capital region did not respond to the data request. According to an official  from Washington Headquarters Services in April 2006, a follow-up effort  was being conducted to gather additional data on mail-screening  operations in the region; however, we were unable to obtain specific  information regarding the purpose, scope, and status of the effort.  Eliminating equipment that is not being used in conjunction with a  comprehensive mail-screening program is likely to reduce future false  alarms and unnecessary response activities involving the Skyline Complex  and other DOD mail facilities in leased space within the national capital  region.
section_title: Conclusions
paragraphs: Mail continues to be a potential venue for terrorism, particularly as an  opportunity to strike at the Pentagon—a building of national military  significance. DOD has taken aggressive measures to ensure the safety of  its employees during a potential biological attack, but the challenge ahead  is to ensure that DOD’s components and leadership are sufficiently  prepared in the event of another potential incident involving anthrax or  other biohazards. Preparation involves having the procedures, plans, and  training in place to effectively coordinate the best available knowledge  and expertise across the many agencies that will likely be involved. While  lessons learned from these two false alarms have largely been  implemented, there still is a need to tighten controls in the areas discussed  above.
section_title: Recommendations for Executive Action
paragraphs: To help prepare DOD to effectively respond to future incidents involving  the suspicion of biological substances in the mail, we recommend that the  Secretary of Defense take the following four actions:    Ensure that any future medical decisions reached during potential or  actual acts of bioterrorism at the Pentagon Reservation result from the  participatory decision-making framework specified in the NRP and NIMS.
Ensure that appropriate officials at all of DOD’s mail facilities develop  effective mail security plans in accordance with GSA’s mail management  regulation and guidance and DOD’s mail manual.
Ensure that a competent DOD authority conducts a DOD-wide review of  all of its mail security plans.
Determine (1) whether biosafety cabinets are being used at mail facilities  within DOD-leased space in the national capital region and, if so,   (2) whether the equipment is being operated within the context of a  comprehensive mail-screening program. If the use of biosafety cabinets  does not comply with the criteria specified in the Director of  Administration and Management’s January 2006 directive, ensure that the  equipment will not be operated.
section_title: Agency Comments and Our Evaluation
paragraphs: We requested comments on a draft of this report from DOD, GSA, the  Department of Justice, HHS, DHS, and the Postal Service. Two of these  agencies—DOD and GSA—provided written comments. The agencies’  comments are reprinted in appendixes II and III, respectively.
DOD agreed with three of our four recommendations, indicating that it  either was implementing, or intended to immediately implement, actions  to address these recommendations. Furthermore, while DOD is  developing a new policy to define the roles and responsibilities of senior  DOD leadership―including those involved in making medical treatment  decisions―during incidents at the Pentagon, it only partially agreed with  our remaining recommendation, related to the need for DOD to make  future medical decisions within the participatory decision-making  framework specified in the NRP and NIMS. While commenting that  “coordination in such events is highly desirable,” DOD reiterated that it  has the “medical authority to act in a timely manner to provide the best  possible medical protection for its personnel at potential risk in an  incident of this nature.” DOD further commented that the NRP does not  alter or impede its ability to carry out its medical authorities and  responsibilities.
We agree that the NRP does not repeal DOD’s medical powers, authorities,  or responsibilities. However, in signing the NRP Letter of Agreement, DOD  agreed, among other things, to (1) support NRP concepts, processes, and  structures; (2) modify its existing plans to comply with the NRP; and   (3) ensure that its operations support the NRP. Thus, in our view, DOD’s  medical authorities must be exercised in conjunction with DOD’s  responsibilities under the NRP. Had DOD followed such an approach in  March 2005, concerns such as the validity of the test results could have  been discussed among informed agency officials and the provision of  unnecessary medicine to DOD employees at lower risk for exposure may  have been avoided.
DOD also commented that the NRP was not in effect during these  incidents because none of the criteria for an incident of “national  significance” had been met. We agree that the December 2004 NRP plan  was somewhat ambiguous about when an incident is subject to NRP’s  concepts, processes, and structures. However, revisions made in May 2006  clarified that the NRP is “always in effect” and that the plan applies to  incidents of lesser severity that may, nevertheless, require some federal  involvement. In our view, this revision makes it even more clear that,  going forward, coordination is necessary and appropriate with regard to  potential bioterrorism incidents and decisions about medical treatment. In  addition, despite the plan’s prior ambiguity, it is important to note that  other federal officials—including those in DHS and HHS—told us that the  NRP was applicable because of the nearly simultaneous occurrence of two  incidents involving the Pentagon, a building of national military  significance. Thus, according to these and other involved parties, DOD  should have responded to the incidents within the context of the federal  framework.
GSA’s written comments clarified federal requirements related to the  annual review of mail security plans. DOD, the FBI (on behalf of the  Department of Justice), CDC (on behalf of HHS), and the Postal Service  provided technical comments, which we incorporated, as appropriate.  DHS did not provide comments.
We are sending copies of this report to appropriate congressional  committees and subcommittees, CDC, DHS, DOD, the FBI, GSA, HHS, the  Postal Service, the Arlington and Fairfax County Offices of Emergency  Management, the District of Columbia Health Department, and other  interested parties. We will also make copies available to others upon  request. In addition, the report is available at no charge on the GAO Web  site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at siggerudk@gao.gov or (202) 512-2834. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Staff who made key contributions to this report are listed in  appendix IV.
section_title: Appendix I: Scope and Methodology
paragraphs: To determine what occurred at the Pentagon and Skyline Complex mail  facilities in Virginia, we reviewed all available timelines and after-action  reports, including those prepared by various Department of Defense  (DOD) components, the Postal Service, the RAND Corporation, and other  federal, state, and local entities. The after-action reports and timelines  document what occurred at the two sites in March 2005 as well as the  sequence and timing of what occurred. We also obtained and analyzed  other pertinent documentation. We developed a timeline of what occurred  based on the information we obtained, and corroborated this information  with agency officials, where possible. With respect to this and our other  reporting objectives, we interviewed a wide range of officials from the  following organizations:    Office of the Secretary of Defense, Administration and Management;    Office of the Assistant Secretary of Defense for Health Affairs;    Office of the Assistant Secretary of Defense for Homeland Defense;    DOD’s DiLorenzo TRICARE Health Clinic;    DOD’s TRICARE Management Activity (TMA);    DOD’s Pentagon Force Protection Agency, including personnel in the  Chemical, Biological, Radiological and Nuclear laboratory;   DOD’s Washington Headquarters Services;    DOD’s Defense Post Office;    Department of Health and Human Services;    Centers for Disease Control and Prevention (CDC);    Department of Homeland Security (DHS);    Federal Bureau of Investigation (FBI) Headquarters and its Washington  Field Office;    U.S. Postal Service;    District of Columbia’s Department of Health; and    Arlington and Fairfax County Offices of Emergency Management.
To determine what problems occurred and why they occurred, we  obtained, reviewed, and analyzed, among other documents, (1) all  available timelines and after-action reports prepared by federal, state, and  local agencies that were involved in the response; (2) the Pentagon’s mail- screening contract and procedures; (3) TMA’s mail procedures; (4) federal  mail management and other applicable regulations related to occupant  emergency plans; (5) DOD requirements, including its mail manual; (6)  applicable guidance on the coordination of incidents with appropriate  organizations, including the National Response Plan (NRP) and its  Biological Incident Annex and the National Incident Management System  (NIMS) and; (7) CDC guidance related to the provision of medical services  to potentially affected employees, including its guidance on the timing of  antibiotics to affected individuals. We also reviewed and analyzed GAO’s  internal control standards for applicable criteria and interviewed officials  from the previously cited organizations as well as those from DOD’s  Defense Information Systems Agency, DOD’s Military Postal Service  Agency, and the General Services Administration. We compared DOD’s  actions with applicable criteria, such as the Pentagon’s contract provisions  and procedures, regulations and guidance, and the national coordination  protocols in place at the time of the incidents, to identify any variations  between the actions taken at the two facilities and the actions specified in  the applicable criteria. Where variations existed, we interviewed officials  from the previously mentioned organizations to determine why the  applicable criteria was not followed.
To determine the actions DOD has taken that address the problems that  arose during the March 2005 incidents at the two mail facilities, we  interviewed officials from the previously cited DOD offices as well as the  Office of the Assistant Secretary of Defense for Public Affairs, Military   Postal Service Agency, Joint Program Executive Office for Chemical and  Biological Defense, and General Services Administration. We also  interviewed DHS officials from the Science and Technology Directorate  and DHS’s Mail Management Program. We obtained and analyzed pertinent  information on all identified actions. For example, with respect to actions  taken at the Pentagon, we reviewed the new mail-screening contract,  recent interagency agreements, and the Pentagon’s draft (1) mail- screening operating procedures, (2) laboratory procedures, (3) notification  procedures, and (4) procedures for communicating information to the  public. For actions taken in response to the incident at the Skyline  Complex, we reviewed TMA’s mail-screening procedures, DOD’s directive  prohibiting the use of biosafety cabinets in certain environments, and the  Skyline Complex occupant emergency plan, all of which were issued after  the March 2005 incidents.
To determine the extent to which the actions taken address the problems  that arose at the two mail facilities during the March 2005 incidents, we  reviewed and analyzed, among other things, the Pentagon’s new mail- screening contract and its draft (1) mail-screening operating procedures,  (2) laboratory procedures, (3) notification procedures, and (4) procedures  for communicating information to the public. To assess whether the  actions appeared to resolve the problems that arose during the incidents,  we compared policy and procedural changes to applicable criteria,  including criteria contained in DOD’s mail manual, GSA’s regulations and  guidance, CDC guidance, GAO Internal Controls Standards, the NRP’s   Biological Incident Annex, and NIMS. We determined the status of key  recommendations in the after-action reports and, through our analysis,  identified further actions necessary to remedy the issues that arose. In  addition, to provide broader perspective on issues related to detecting and  responding to suspected anthrax incidents, we reviewed previous studies,  congressional testimony, and other pertinent documents including those  prepared by GAO.
We performed our work from June 2005 to August 2006 in accordance  with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: Comments from the General Services Administration
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Kathleen Turner (Assistant  Director), David Hooper, Daniel Klabunde, Steve Martinez, Josh Ormond,  Stanley Stenersen, and Johanna Wong made key contributions to this  report.