Homeland Security: Protecting Federal Facilities Remains a Challenge for the Department of Homeland Security's Federal Protective Service
Published: 2011-07-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: As part of the Department of Homeland Security (DHS), the Federal Protective Service (FPS) is responsible for protecting federal employees and visitors in approximately 9,000 federal facilities owned or leased by the General Services Administration (GSA). FPS has a budget of approximately $1 billion and maintains approximately 1,200 full-time employees and about 13,000 contract security guards that help accomplish the agency's facility protection mission. This testimony is based on past reports and testimonies and discusses challenges FPS faces in carrying out its mission with regard to (1) risk management, (2) strategic human capital planning, (3) oversight of its contract guard program, and (4) ensuring that its fee-based funding structure is the appropriate mechanism for funding the agency. GAO also addresses the extent to which FPS has made progress in responding to these challenges. To perform this work, GAO used its key facility protection practices as criteria, visited FPS regions and selected GSA buildings, reviewed training and certification data for FPS's contract guards, and interviewed officials from DHS, GSA, guard contractors, and guards.
section_title: What GAO Found
paragraphs: FPS continues to face challenges in carrying out its mission. Specifically: (1) The absence of a risk management program hampers FPS's ability to protect federal facilities. For many years, GAO has advocated the importance of a risk management approach. GAO reported in August 2010 that FPS does not use a comprehensive risk management approach that links threats and vulnerabilities to resource requirements. Instead, FPS uses a facility-by-facility approach which assumes that facilities with the same security level have the same risk regardless of their location. Without a risk management approach that identifies threats and vulnerabilities and the resources required to achieve FPS's security goals, as GAO has recommended, there is limited assurance that programs will be prioritized and resources will be allocated to address existing and potential security threats in an efficient and effective manner. (2) FPS has not fully addressed several key human capital issues. FPS continues to operate without a strategic human capital plan to guide its current and future workforce planning efforts, as GAO recommended in 2009. Further, FPS is not able to determine what its optimal staffing levels should be because FPS headquarters does not collect data on its workforce's knowledge, skills, and abilities. FPS has yet to fully ensure that its recent move to an inspector-based workforce does not hinder its ability to protect federal facilities. (3) FPS faces longstanding challenges in managing its contract guard workforce. Weaknesses in FPS's contract guard program hamper its ability to protect federal facilities. GAO reported in 2009 and 2010 that FPS cannot ensure that its contract guards have required training and certifications. FPS is in the process of addressing GAO recommendations. For example, FPS revised its x-ray and magnetometer training for its inspectors and guards. (4) FPS has not reviewed its fee design or determined an appropriate funding mechanism. FPS increased its basic security fee four times in 6 years to try to cover costs, but has not reviewed its fees to develop an informed, deliberate design. FPS's current fee structure has consistently resulted in total collection amounts less than agency costs and continues to be a topic of congressional interest and inquiry. FPS has yet to evaluate whether its fee-based structure or an alternative funding mechanism is most appropriate for funding the agency, as GAO recommended in 2008 and 2011. FPS has made some progress in improving its ability to protect federal facilities. For example, in response to GAO recommendations, FPS is developing the Risk Assessment and Management Program (RAMP), which could enhance its ability to comprehensively assess risk at federal facilities and improve oversight of its contract guard program. DHS and FPS have initiatives in process to address 21 of the 28 recommendations GAO has made related to the challenges above, although none are yet fully implemented. According to FPS officials, this is in part because of changes in the agency's leadership, organization, funding, staffing levels, and delays in developing several new management systems, such as RAMP. DHS and FPS have generally concurred with GAO's past recommendations. DHS and FPS have initiatives in process, for example, to address risk management, strategic human capital planning, and oversight of its contract guard program.

section_title: Letter
paragraphs: We are pleased to be here to discuss the challenges the Federal  Protective Service (FPS) faces in carrying out its mission to protect  federal facilities, particularly with regard to (1) risk management, (2)  strategic human capital planning, (3) oversight of its contract guard  program, and (4) ensuring that its fee-based funding structure is the  appropriate mechanism for funding the agency. We will also discuss  FPS’s assessment of its performance and the extent to which FPS has  made progress in responding to these challenges. Recent events have  exposed weaknesses with FPS’s ability to protect federal facilities,  including GAO’s covert testing at federal facilities in 2009, FPS’s ongoing  penetration testing at federal facilities, and FPS’s contract security guards  allowing components of an active bomb to remain in a federal building in  Detroit, Michigan, for three weeks in March 2011 before a bomb squad  was called.
As part of the Department of Homeland Security (DHS), FPS is  responsible for protecting federal employees and visitors in approximately  9,000 federal facilities owned or leased by the General Services  Administration (GSA). FPS has a budget of approximately $1 billion and  maintains approximately 1,200 full-time employees and about 13,000  contract security guards (also known as protective service officers) that  help accomplish the agency’s facility protection mission. FPS’s primary  responsibilities include (1) conducting risk assessments of federal  facilities and recommending countermeasures aimed at preventing  incidents at facilities; and (2) undertaking law enforcement activities,  including responding to incidents at federal facilities.
This testimony is based on our past reports and testimonies. Work  conducted for these reports and testimonies included assessing FPS’s  facility protection efforts using our key security practices as a framework.
We also visited selected FPS regions and selected GSA buildings to  assess FPS activities firsthand. Additionally, we reviewed training and  certification data for 663 randomly selected guards in 6 of FPS’s 11  regions. Because of the sensitivity of some of the information in our prior  work, we cannot specifically identify in this testimony the locations of the  incidents discussed. For all of our work, we reviewed related laws and  directives; interviewed officials and analyzed documents and data from  DHS and GSA; and interviewed tenant agency representatives,  contactors, and guards. These reviews took place between April 2007  and May 2011. Our work was conducted in accordance with generally  accepted government auditing standards. Additional information on scope  and methodology is provided in the previously issued products.
subsections: section_title: The Absence of a Risk Management Program Hampers FPS’s Ability to Protect Federal Facilities
paragraphs: For many years we have advocated the use of a risk management  approach that entails managing risk through actions, including setting  strategic goals and objectives, assessing risk, allocating resources based  on risk, evaluating alternatives, selecting initiatives to undertake, and  implementing and monitoring those initiatives. Risk assessment, an  important element of a risk management approach, helps decision  makers identify and evaluate potential risks so that countermeasures can  be designed and implemented to prevent or mitigate the effects of the  risks.
FPS meets its mission to protect GSA’s federal facilities by assessing the  risks that face those facilities and identifying the appropriate  countermeasures to mitigate those risks. Despite the importance of this  mission, FPS has not implemented an effective risk management  program. In August 2010, we reported that FPS does not use a  comprehensive risk management approach that links threats and  vulnerabilities to resource requirements. Instead, FPS uses a facility-by- facility approach to risk management: we reported in 2010 that FPS  assumes that all facilities with the same security level have the same risk  regardless of their location. For example, a level IV facility in a  metropolitan area is generally treated the same as one in a rural area.  This building-by-building approach prevents FPS from comprehensively  identifying risk across the entire portfolio of GSA’s facilities and allocating  resources based on risk. Both our and DHS’s risk management  frameworks include processes for assessing comprehensive risk across  assets in order to prioritize countermeasures based on the overall needs  of the system.
In response to our recommendations in this area, FPS began developing  a new system, the Risk Assessment and Management Program (RAMP).  According to FPS, RAMP will support all components of the risk  assessment process, including gathering and reviewing building  information; conducting and recording interviews with GSA and tenant  agencies; assessing threats, vulnerabilities, and consequences to  develop a detailed risk profile; recommending appropriate  countermeasures; and producing facility security assessment (FSA)  reports. FPS also plans to use RAMP to track and analyze workforce  data, contract guard program data, and other performance data, such as  the types and definitions of incidents and incident response times. We are  finalizing our ongoing review of FPS’s efforts to develop and implement  RAMP as well as FPS’s transition to DHS’s National Protection and  Programs Directorate (NPPD) and expect to report on these issues soon.
section_title: FPS Has Not Fully Addressed Several Key Human Capital Issues
paragraphs: Over the last 3 years we have reported on the challenges FPS has faced  in the human capital area since moving to DHS from GSA in 2003. As  mandated by Congress, in 2009 FPS increased the size of its workforce  to 1,200 full time employees. However, FPS continues to operate without  a strategic human capital plan. We recommended in 2009 that FPS  develop a human capital plan to guide its current and future workforce  planning efforts. We have identified human capital management as a  high-risk issue throughout the federal government, including within DHS.  A human capital plan is important to both align FPS’s human capital  program with current and emerging mission and programmatic goals, and  develop effective processes for training, retention, and staff development.  In 2009, we reported that the absence of such a plan has contributed to  inconsistent human capital activities among FPS regions and  headquarters, as several regions told us they have implemented their  own processes for performance feedback, training, and mentoring. In  addition, we found that FPS’s workforce planning is limited because FPS  headquarters does not collect data on its workforce’s knowledge, skills,  and abilities. Without such information, FPS is not able to determine what  its optimal staffing levels should be or identify gaps in its workforce needs  and determine how to modify its workforce planning strategies to fill these  gaps. FPS concurred with our recommendation and drafted a workforce  analysis plan in June 2010. According to FPS, the plan must be reviewed  by the Office of Management and Budget (OMB) before it is subject to  approval by the Secretary of Homeland Security.
FPS also has yet to fully ensure that its recent move to an inspector- based workforce does not hinder its ability to protect federal facilities. In  2007, FPS essentially eliminated its police officer position and moved to  an all inspector-based workforce. FPS also decided to place more  emphasis on physical security activities, such as completing FSAs, and  less emphasis on law enforcement activities, such as proactive patrol. We  reported in 2008 that these changes may have contributed to diminished  security and increases in inspectors’ workload. Specifically, we found  that when FPS is not providing proactive patrol at some federal facilities,  there is an increased potential for illegal entry and other criminal activity.  Moreover, under its inspector-based workforce approach, FPS is relying  more on local police departments to handle crime and protection issues at  federal facilities; however, we previously reported that at approximately  400 federal facilities across the United States, local police may not have  the authority to respond to incidents inside those facilities.
We recommended in 2008 that FPS clarify roles and responsibilities of  local law enforcement agencies in responding to incidents at GSA  facilities. While FPS agreed with this recommendation, FPS has decided  not to pursue agreements with local law enforcement officials, in part  because of local law enforcement officials’ reluctance to sign such  agreements. In addition, FPS believes that the agreements are not  necessary because 96 percent of the properties in its inventory are listed  as concurrent jurisdiction facilities where both federal and state  governments have jurisdiction over the property. Nevertheless, we  continue to believe that these agreements would, among other things,  clarify roles and responsibilities of local law enforcement agencies when  responding to crime or other incidents. We are currently reviewing to what  extent FPS is coordinating with state and local police departments to  ensure adequate protection of federal facilities and will issue a report next  year.
section_title: FPS Faces Longstanding Challenges in Managing Its Contract Guard Workforce
paragraphs: FPS’s contract guard program is the most visible component of the  agency’s operations and the agency relies on its guards to be its “eyes  and ears” while performing their duties. Guards are responsible for  controlling access to federal facilities by checking the identification of  government employees and the public who enter federal facilities, and  operating security equipment to screen for prohibited items. Since 2009,  we have identified weaknesses in FPS’s contract guard program which  hamper its ability to protect federal facilities. For example, we reported in  2009 and in 2010 that FPS does not have a reliable system to ensure that  its 13,000 guards have the training and certifications required to stand  post at federal facilities or comply with post orders once they are  deployed.
In 2009, we also identified substantial security vulnerabilities related to  FPS’s guard program. In April and May 2009, GAO investigators  conducted covert tests and were able to successfully pass components of  an improvised explosive device (IED) concealed on their persons through  security checkpoints monitored by FPS guards at 10 Level IV facilities in  4 major metropolitan areas. In addition, FPS’s penetration testing—similar  to our covert testing—shows that guards continue to have problems with  detecting prohibited items. For example, in March 2011, FPS contract  guards allowed components for an active bomb to remain in a Level IV  federal building in Detroit, Michigan for 3 weeks before a bomb squad  was called to remove them.
We also found in 2010 that although some guard contractors did not  comply with the terms of their contracts, FPS did not take any  enforcement action against them. According to FPS guard contracts, a  contractor has not complied with the terms of the contract if, for example,  the contractor has a guard working without valid certifications or  background suitability investigations, or falsifies a guard’s training  records. If FPS determines that a contractor does not comply with these  contract requirements, it can—among other things—assess a financial  deduction for nonperformed work, elect not to exercise a contract option,  or terminate the contract for default or cause.
We reviewed the official contract files for the 7 contractors who, as we  testified in July 2009, had guards performing on contracts with expired  certification and training records to determine what action, if any, FPS  had taken against these contractors for contract noncompliance.  According to the documentation in the contract files, FPS did not take any  enforcement action against the contractors for not complying with the  terms of the contract. Instead, FPS exercised the option to extend the  contracts for these 7 contractors. Additionally, although FPS requires an  annual performance evaluation of each guard contractor and at the  conclusion of contracts exceeding $100,000, FPS did not always evaluate  the performance of its contractors as required, and some evaluations  were incomplete and not consistent with contractors’ performance.
In response to our recommendations, FPS has taken several steps to  improve the oversight of its contract guard program. Since July 2009,  FPS has increased its penetration tests in some regions and the number  of guard inspections it conducts at federal facilities in some metropolitan  areas. Additionally, FPS began the process of providing additional x-ray  and magnetometer training for its workforce. Under the new requirement,  inspectors must receive 30 hours of x-ray and magnetometer training and  guards are required to take 16 hours. Previously, guards were required to  receive 8 hours of training on x-ray and magnetometer machines. Finally,  FPS expects to use RAMP, once it is developed, to determine whether its  13,000 guards have met its training and certification requirements and to  conduct guard inspections. As stated earlier, we are finalizing our review  of FPS’s RAMP.
section_title: FPS Has Not Reviewed Its Fee Design or Determined an Appropriate Funding Mechanism
paragraphs: We reported in May 2011 that FPS increased its basic security fee 4  times in 6 years to try to cover costs (an increase of over 100 percent).  However, FPS has not reviewed its fees to develop an informed,  deliberate fee design. We found that timely, substantive fee reviews are  especially critical for fee-funded agencies to ensure that fee collections  and operating costs remain aligned. FPS has broad authority to design its  security fees, but the current fee structure has consistently resulted in  total collection amounts less than agency costs, is not well understood or  accepted by tenant agencies, and continues to be a topic of  congressional interest and inquiry.
In 2008, we recommended that FPS evaluate whether its use of a fee- based system or an alternative funding mechanism is the most  appropriate manner to fund the agency. Although FPS agreed with this  recommendation it has not begun such an analysis. Based on our  updated work in 2011, we recommended that such an analysis include  the examination of both alternative fee structures and a combination of  fees and appropriations as well as the options and trade-offs discussed in  our 2011 report. FPS agreed with this recommendation.
section_title: FPS Faces Limitations in Assessing Its Performance
paragraphs: We have reported that FPS is limited in its ability to assess the  effectiveness of its efforts to protect federal facilities. To determine how  well it is accomplishing its mission to protect federal facilities, FPS has  identified some output measures. These measures include determining  whether security countermeasures have been deployed and are fully  operational, the amount of time it takes to respond to an incident, and the  percentage of FSAs completed on time. As we reported in 2010, while  output measures are helpful in assessing performance, outcome  measures can provide FPS with broader information on program results,  such as the extent to which its decision to move to an inspector-based  workforce will enhance security at federal facilities. Outcome measures  could also help identify the security gaps that remain at federal facilities  and determine what action may be needed to address them.
In addition, we reported in 2010 that FPS does not have a reliable data  management system that will allow it to accurately track these measures  or other important measures such as the number of crimes and other  incidents occurring at GSA facilities. Without such a system, it is difficult  for FPS to evaluate and improve the effectiveness of its efforts to protect  federal employees and facilities, allocate its limited resources, or make  informed risk management decisions. For example, weaknesses in one of  FPS’s countermeasure tracking systems make it difficult to accurately  track the implementation status of recommended countermeasures such  as security cameras and x-ray machines. Without this ability, FPS has  difficulty determining whether it has mitigated the risk of federal facilities  to crime or a terrorist attack. FPS concurred with our recommendations  and states that its efforts to address them will be completed in 2012 when  its automated information systems are fully implemented.
section_title: FPS Has Begun Some Initiatives, but Most GAO Recommendations Have Not Been Fully Implemented
paragraphs: FPS has begun several initiatives that, once fully implemented, should  enhance its ability to protect the more than 1 million federal employees  and members of the public who visit federal facilities each year. Since  2008, we have made 28 recommendations to help FPS to address its  challenges with risk management, strategic human capital planning,  oversight of its contract guard workforce, and its fee-based funding  structure. DHS and FPS have generally agreed with these  recommendations. As of July 2011, as shown in Table 1, FPS was in the  process of addressing 21 of them, although none were fully implemented.  Of the remaining 7, 5 were recommendations from our May 2011 report,  and we would not necessarily expect them to be fully implemented yet.  According to FPS officials, the agency has faced difficulty in implementing  many of our recommendations because of changes in its leadership,  organization, funding, and staffing levels. In addition, FPS officials stated  that its progress in implementing our recommendations has been affected  by delays in developing several new management systems, such as  RAMP.
Chairmen Lungren and Bilirakis, Ranking Members Clarke and  Richardson, and members of the Subcommittees, this completes my  prepared statement. I would be happy to respond to any questions you or  other members of the Subcommittees may have at this time.
section_title: Contact and Staff Acknowledgments
paragraphs: For further information on this testimony, please contact me at (202) 512- 2834 or by e-mail at goldsteinm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this statement. Individuals making key contributions to this  testimony include Tammy Conquest, Assistant Director; Colin Fallon;  Chelsa Gurkin; Alicia Loucks; Jackie Nowicki, Assistant Director; Justin  Reed; and Susan Michal-Smith.
section_title: Related GAO Products
paragraphs: Budget Issues: Better Fee Design Would Improve Federal Protective  Service’s and Federal Agencies’ Planning and Budgeting for Security.  GAO-11-492. Washington, D.C.: May 20, 2011.
Homeland Security: Preliminary Observations on the Federal Protective  Service’s Workforce Analysis and Planning Efforts. GAO-10-802R.  Washington, D.C.: June 14, 2010.
Homeland Security: Federal Protective Service’s Use of Contract Guards  Requires Reassessment and More Oversight. GAO-10-614T.  Washington, D.C.: April 14, 2010.
Homeland Security: Federal Protective Service’s Contract Guard Program  Requires More Oversight and Reassessment of Use of Contract Guards.  GAO-10-341. Washington, D.C.: April 13, 2010.
Homeland Security: Ongoing Challenges Impact the Federal Protective  Service’s Ability to Protect Federal Facilities. GAO-10-506T.  Washington, D.C.: March 16, 2010.
Homeland Security: Greater Attention to Key Practices Would Improve  the Federal Protective Service’s Approach to Facility Protection.  GAO-10-142. Washington, D.C.: October 23, 2009.
Homeland Security: Federal Protective Service Has Taken Some Initial  Steps to Address Its Challenges, but Vulnerabilities Still Exist.  GAO-09-1047T. Washington, D.C.: September 23, 2009.
Homeland Security: Federal Protective Service Should Improve Human  Capital Planning and Better Communicate with Tenants. GAO-09-749.  Washington, D.C.: July 30, 2009.
Homeland Security: Preliminary Results Show Federal Protective  Service’s Ability to Protect Federal Facilities Is Hampered By  Weaknesses in Its Contract Security Guard Program. GAO-09-859T.  Washington, D.C.: July 8, 2009.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Raise Concerns About Protection of Federal Facilities.  GAO-08-897T. Washington, D.C.: June 19, 2008.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Raise Concerns About Protection of Federal Facilities.  GAO-08-914T. Washington, D.C.: June 18, 2008.
Homeland Security: The Federal Protective Service Faces Several  Challenges That Hamper Its Ability to Protect Federal Facilities.  GAO-08-683. Washington, D.C.: June 11, 2008.
Homeland Security: Preliminary Observations on the Federal Protective  Service’s Efforts to Protect Federal Property. GAO-08-476T.  Washington, D.C.: February 8, 2008.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.