Homeland Security: Preliminary Results Show Federal Protective Service's Ability to Protect Federal Facilities Is Hampered By Weaknesses in Its Contract Security Guard Program
Published: 2009-07-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,200 full time employees, and about 13,000 contract security guards. This testimony discusses GAO's preliminary findings on (1) the extent to which FPS ensures that its guards have the required training and certifications before being deployed to a federal facility, (2) the extent to which FPS ensures that its guards comply with their assigned responsibilities (post orders) once they are deployed at federal facilities, and (3) security vulnerabilities GAO recently identified related to FPS's guard program. To address these objectives, GAO conducted site visits at 6 of FPS's 11 regions, interviewed numerous FPS officials, guards, contractors, and analyzed FPS's policies and data. GAO also conducted covert testing at 10 judgmentally selected level IV facilities in four cities. A level IV facility has over 450 employees and a high volume of public contact.
section_title: What GAO Found
paragraphs: FPS does not fully ensure that its contract security guards have the training and certifications required to be deployed to a federal facility. FPS requires that all prospective guards complete about 128 hours of training including 8 hours of x-ray and magnetometer training. However, in one region, FPS has not provided the x-ray or magnetometer training to its 1,500 guards since 2004. Nonetheless, these guards are assigned to posts at federal facilities. X-ray training is critical because guards control access points at facilities. Insufficient x-ray and magnetometer training may have contributed to several incidents where guards were negligent in carrying out their responsibilities. For example, at a level IV facility, an infant in a carrier was sent through an x-ray machine due to a guard's negligence. Moreover, GAO found that FPS does not have a fully reliable system for monitoring and verifying guard training and certification requirements. GAO reviewed 663 randomly selected guard records and found that 62 percent of the guards had at least one expired certification including a declaration that guards have not been convicted of domestic violence, which make them ineligible to carry firearms. FPS has limited assurance that its guards are complying with post orders. FPS does not have specific national guidance on when and how guard inspections should be performed. FPS's inspections of guard posts at federal facilities are inconsistent and the quality varied in the six regions GAO visited. GAO also found that guard inspections are typically completed by FPS during regular business hours and in locations where FPS has a field office; and seldom on nights and on weekends. However, on an occasion when FPS did conduct a post inspection at night it found a guard asleep at his post after taking the pain killer prescription drug Percocet. FPS also found other incidents at level IV facilities where guards neglected or inadequately performed their assigned responsibilities. For example, a guard failed to recognize or did not properly x-ray a box containing handguns at the loading dock at a facility. FPS became aware of the situation because the handguns were delivered to FPS. GAO identified substantial security vulnerabilities related to FPS's guard program. GAO investigators carrying the components for an improvised explosive device successfully passed undetected through security checkpoints monitored by FPS's guards at each of the 10 level IV federal facilities where GAO conducted covert testing. Of the 10 level IV facilities GAO penetrated, 8 were government owned, 2 were leased, and included offices of a U.S. Senator and U.S. Representative, as well as agencies such as the Departments of Homeland Security, State, and Justice. Once GAO investigators passed the control access points, they assembled the explosive device and walked freely around several of floors of these level IV facilities with the device in a briefcase. In response to GAO's briefing on these findings, FPS has recently taken some actions including increasing the frequency of intrusion testing and guard inspections. However, implementing these changes may be challenging, according to FPS.

section_title: Letter
paragraphs: We are pleased to be here to discuss the preliminary results of our review  of the Federal Protective Service’s (FPS) contract security guard (guard)  program. There has not been a large-scale attack on a domestic federal  facility since the terrorist attacks of September 11, 2001 and the 1995  bombing of the Alfred P. Murrah Federal Building in Oklahoma City,  Oklahoma. Nevertheless, the recent shooting death of a guard at the U.S.  Holocaust Memorial Museum—though not a federal facility–demonstrates  the continued vulnerability of public buildings to domestic terrorist attack.  Thus, one of FPS’s most critical responsibilities is to effectively manage its  guard program so that the over one million government employees, as well  as members of the public who work in and visit the 9,000 federal facilities  each year are protected.
To accomplish its mission of protecting federal facilities, FPS currently  has a budget of about $1 billion, about 1,200 full time employees, and  about 13,000 guards deployed at approximately 2,300 of the 9,000 federal  facilities across the country. While FPS does not use guards at the  remaining 6,700 facilities under its protection, it frequently uses other  security countermeasures such as cameras and perimeter lighting to help  protect these facilities. In our June 2008 report, we found that FPS faced  significant challenges in ensuring the quality and timeliness of its building  security assessments and in maintaining complete crime statistics. We also  reported that its risk assessment process was partially flawed. FPS used  these tools to help determine how to protect federal facilities.
As of June 2009, FPS’s guard program has cost about $613 million and  represents the single largest item in its budget. It is the most visible  component of FPS’s operations as well as the first public contact when  entering a federal facility. FPS relies heavily on its guards and considers  them to be the agency’s “eyes and ears” while performing their duties.  Guards are primarily responsible for controlling access to federal facilities  by (1) checking the identification of government employees as well as  members of the public who work in and visit federal facilities, and (2)  operating security equipment, such as x-ray machines and magnetometers  to screen for prohibited materials, such as firearms, knives, explosives, or  items intended to be used to fabricate an explosive or incendiary device.  Guards do not have arrest authority but can detain individuals who are  being disruptive or pose a danger to public safety.
In June 2008, we reported that FPS faced several funding and operational  challenges, including oversight of its guard program, that hamper its  ability to accomplish its mission of protecting federal facilities and  ensuring the safety of the occupants. We recommended, among other  things, that the Secretary of the Department of Homeland Security (DHS)  direct the Director of FPS to develop and implement a strategic approach  to better manage its staffing resources, evaluate current and alternative  funding mechanisms, and develop appropriate measures to assess  performance. While DHS concurred with our recommendations, FPS has  not fully implemented these recommendations. This testimony is based on  preliminary findings of ongoing work and addresses (1) the extent to  which FPS ensures that its guards have the required training and  certifications before being deployed to a federal facility, (2) the extent to  which FPS ensures that its guards comply with post orders once they are  deployed at federal facilities, and (3) security vulnerabilities we identified  related to FPS’s guard program and recent related FPS actions taken in  response.
To determine the extent to which FPS ensures that its guards have the  required training and certifications prior to being deployed to a federal  facility and are complying with post orders once deployed to a federal  facility, we conducted site visits at 6 of FPS’s 11 regions. These regions  have responsibilities for almost 63 percent of FPS’s 13,000 guards and 52  percent of the 2,360 facilities that have guards. To select the regions, we  considered the number of federal facilities in each region, geographic  dispersion across the United States, and the number of FPS employees in  each region. At these locations, we interviewed FPS’s Contract Guard  Program Managers and their support staff; law enforcement security  officers (also referred to as inspectors) who are responsible for  conducting guard inspections, regional managers, as well as guards and  the contractors about FPS’s efforts to manage its guard program. We also  interviewed officials at FPS and GSA headquarters as well as GSA’s  regional security officials. We reviewed and analyzed FPS’s guard training  and certification requirements, Security Guard Information Manual, and  guard contracts. To determine how FPS tracks the status of whether its  guards have met the training and certifications requirements, in the 6  regions we visited we randomly selected 663 guard files that were  maintained in FPS’s Contract Guard Employment Requirements Tracking  System (CERTS). Because CERTS was not fully reliable we also used  information maintained in some of FPS’s regional databases or at the  contractor’s office. The 663 guard files we reviewed in the six regions we  visited are not generalizable. To determine how FPS ensures that its  guards are complying with post orders, we reviewed FPS’s guard  inspection process and observed numerous guard inspections at federal  facilities in each of the 6 regions we visited. To identify potential security  vulnerabilities in FPS’s guard program, we conducted covert testing at 10  judgmentally selected level IV facilities. The facilities were selected from  FPS’s most current listing of federal facilities by security level. The  results of our covert testing at the 10 level IV facilities are not  generalizable. Because of the sensitivity of some of the information in our  report, we cannot provide information about the specific locations of  incidents discussed. We conducted this performance audit from July 200 to July 2009 in accordance with generally accepted government au diting  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: To accomplish its mission of protecting federal facilities, FPS has become  increasingly reliant on its guard force. As of June 2009, FPS’s guard  program has cost $613 million and represents the single largest item in its  fiscal year 2009 budget. While the contractor has the primary  responsibility for training and ensuring that the guards have met  certification requirements, FPS is responsible for oversight of the guards  and relies on about 930 law enforcement personnel located in its   11 regions to inspect guard posts and verify that training, certifications,  and timecards are accurate. Figure 1 shows the location of FPS’s   11 regions and the number of guards and federal facilities with guards in  each of these regions.
Some of the key responsibilities of FPS’s guards include controlling  access; enforcing property rules and regulations; detecting and reporting  criminal acts; and responding to emergency situations involving the safety  and security of the facility. Guards may only detain, not arrest, an  individual, and their authority typically does not extend beyond the  facility. Before being assigned to a post or an area of responsibility at a  federal facility, FPS requires that all guards undergo background  suitability checks and complete approximately 128 hours of training  provided by the contractor or FPS, including 8 hours of x-ray and  magnetometer training. Guards must also pass an FPS-administered  written examination and possess the necessary certificates, licenses, and  permits as required by the contract. Table 1 shows the training and  certifications that FPS requires its guards to (1) obtain before standing  post and (2) maintain during the course of their employment. FPS also  requires its guards to complete 40 hours of refresher training every 2 to 3  years depending on the terms of the contract. In addition to FPS’s  requirements, some states require that guards obtain additional training  and certifications.
FPS currently has contracts with 67 private companies for guard services.  These contractors are responsible for providing and maintaining all guard  services as described in the contract statement of work, including  management, supervision, training, equipment, supplies and licensing. FPS  is also required to actively monitor and verify the contractors’  performance and ensure that the terms of the contract are met.
section_title: Many FPS Guards Do Not Appear to Have the Training and Certifications Required to Stand Post at Federal Facilities in Some Regions
subsections: section_title: FPS Is Not Providing Guards With All of the Required Training in Some Regions
paragraphs: FPS does not fully ensure that its guards have the training and  certifications required to be deployed to a federal facility. While FPS  requires that all prospective guards complete approximately 128 hours of  training, including 8 hours of x-ray and magnetometer training, it was not  providing some of its guards with all of the required training in the six  regions we visited. For example, in one region, FPS has not provided the  required 8 hours of x-ray or magnetometer training to its 1,500 guards  since 2004. X-ray and magnetometer training is important because the  majority of the guards are primarily responsible for using this equipment  to monitor and control access points at federal facilities. Controlling  access and egress to a facility helps ensure that only authorized personnel,  vehicles, and materials are allowed to enter, move within, and leave the  facility. According to FPS officials, the 1,500 guards were not provided the  required x-ray or magnetometer training because the region does not have  the employees that are qualified or who have the time to conduct the  training. Nonetheless, these guards continue to control access points at  federal facilities in this region. In absence of the x-ray and magnetometer  training, one contractor in the region said that they are relying on veteran  guards who have experience operating these machines to provide some  “on-the-job” training to new guards. Moreover, in the other five regions we  visited where FPS is providing the x-ray and magnetometer training, some  guards told us that they believe the training, which is computer based, is  insufficient because it is not conducted on the actual equipment located at  the federal facility.
Lapses and weaknesses in FPS’s x-ray and magnetometer training have  contributed to several incidents at federal facilities in which the guards  were negligent in carrying out their responsibilities. For example, at a level  IV federal facility in a major metropolitan area, an infant in a carrier was  sent through the x-ray machine. Specifically, according to an FPS official  in that region, a woman with her infant in a carrier attempted to enter the  facility, which has child care services. While retrieving her identification,  the woman placed the carrier on the x-ray machine. Because the guard  was not paying attention and the machine’s safety features had been  disabled, the infant in the carrier was sent through the x-ray machine.  FPS investigated the incident and dismissed the guard. However, the guard  subsequently sued FPS for not providing the required x-ray training. The  guard won the suit because FPS could not produce any documentation to  show that the guard had received the training, according to an FPS official.  In addition, FPS officials from that region could not tell us whether the x- ray machine’s safety features had been repaired.
We also found that some guards were not provided building-specific  training, such as what actions to take during a building evacuation or a  building emergency. This lack of training may have contributed to several  incidents where guards neglected their assigned responsibilities. For  example,    at a level IV facility, the guards did not follow evacuation procedures and  left two access points unattended, thereby leaving the facility vulnerable;   at a different level IV facility, the guard allowed employees to enter the  building while an incident involving suspicious packages was being  investigated; and,   at a level III facility, the guard allowed employees to access the area  affected by a suspicious package, which was required to be evacuated.
In addition to insufficient building-specific training, some guards said they  did not receive scenario-based training and thus were not sure what they  should do in certain situations. During our site visits at 6 FPS regions, we  interviewed over 50 guards and presented them with an incident that  occurred at a federal facility in 2008. Specifically, we asked the guards  whether they would assist an FPS inspector chasing an individual escaping  a federal facility in handcuffs. The guards’ responses varied. Some guards  stated that they would assist the FPS inspector and apprehend the  individual, while others stated that they would likely do nothing and stay  at their post because they feared being fired for leaving their post. Some  guards also told us that they would not intervene because of the threat of a  liability suit for use of force and did not want to risk losing their job. The  guard’s different responses suggest that more scenario-based training may  be needed.
section_title: FPS Lacks Assurance That Its Guards Have Required Certifications
paragraphs: FPS’s primary system—CERTS—for monitoring and verifying whether  guards have the training and certifications required to stand post at federal  facilities is not fully reliable. We reviewed training and certification data  for 663 randomly selected guards in 6 of FPS’s 11 regions maintained  either in CERTS, which is the agency’s primary system for tracking guard  training and certifications, databases maintained by some of FPS’s regions,  or contractor information. We found that 62 percent, or 411 of the 663  guards who were deployed to a federal facility had at least one expired  certification, including for example, firearms qualification, background  investigation, domestic violence declaration, or CPR/First Aid training  certification. More specifically, according to the most recent information  from a contractor, we found that over 75 percent of the 354 guards at one  level IV facility had expired certifications, or the contractor had no record  of the training. Based on the contractor information for another contract,  we also found that almost 40 percent of the 191 guards at another level IV  facility had expired domestic violence declarations. Without domestic  violence declarations certificates, guards are not permitted to carry a  firearm. FPS requires its guards to carry weapons in most cases.   Moreover, five of the six regions we visited did not have current  information on guard training and certifications. According to FPS  officials in these five regions, updating CERTS is time consuming and they  do not have the resources needed to keep up with the thousands of paper  files. Consequently, these five regions were not generally relying on  CERTS and instead were relying on the contractor to self-report training  and certification information about its guards.
In addition, not having a fully reliable system to better track whether  training has occurred may have contributed to a situation in which a  contractor allegedly falsified training records. In 2007, FPS was not aware  that a contractor who was responsible for providing guard service at  several level IV facilities in a major metropolitan area had allegedly  falsified training records until it was notified by an employee of the  company. According to FPS’s affidavit, the contractor allegedly repeatedly  self-certified to FPS that its guards had satisfied CPR and First Aid  training, as well as the contractually required bi-annual recertification  training, although the contractor knew that the guards had not completed  the required training and was not qualified to stand post at federal  facilities. According to FPS’s affidavit, in exchange for a $100 bribe,  contractor officials provided a security guard with certificates of  completion for CPR and First Aid. The case is currently being litigated in  U.S. District Court.
section_title: FPS Has Limited Assurance that Guards Comply with Post Orders
subsections: section_title: FPS Is Not Consistently Inspecting Guards Posts
paragraphs: FPS has limited assurance that its 13,000 guards are complying with post  orders. FPS does not have specific national guidance on when and how  guard inspections should be performed. FPS’s inspections of guard posts  at federal facilities are inconsistent and the quality and rigor of its  inspections varies across regions. At each guard post, FPS maintains a  book, referred to as post orders, that describes the duties that guards are  to perform while on duty. However, we found that in one region some of  the post orders were not current and dated back to 2002 when FPS was  part of GSA. In addition, the frequency with which FPS inspects these  posts varied. For example, one region we visited required its inspectors to  complete 5 guard inspections each month, while another region we visited  did not have any inspection requirements. According to the regional staff,  there is no requirement that every guard post be inspected each month;  rather inspectors are required to complete 5 inspections per month which  leads to some guard posts being inspected multiple times per month and  some guard posts not being inspected at all. For example, while we were  observing guard inspections in this region, one guard told us she had been  inspected twice that week. In contrast, according to FPS officials, guards  assigned to posts at federal facilities in remote locations or during the  night shift are rarely inspected.
During our site visits we also found that the quality of FPS’s guard  inspections varied. According to FPS’s procedures for conducting guard  inspections, FPS should inspect the guard’s uniform and equipment,  knowledge of post orders, and ID and certification cards. For example, an  inspector in one region performed a more thorough inspection than other  inspectors. The inspector included an inspection of guard certifications,  knowledge of post orders, uniform and equipment check, inspection of the  post station, and timecards. The inspector also asked the guard a number  of scenario-based questions and asked the guard if he had any questions or  concerns. The results of the inspection were documented immediately  following the inspection. Conversely, in a different FPS region we visited,  the FPS inspector asked the guard if all his certifications and training were  current; but never physically inspected the guard’s certifications or asked  any scenario-based questions. During another inspection we observed, an  inspector in another region performed a uniform and equipment check but  did not ask for any certifications.
We also found that in the 6 regions we visited that guard inspections are  typically completed by FPS during regular business hours and in cities  where FPS has a field office. In most FPS regions, FPS is only on duty  during regular business hours and according to FPS, inspectors are not  authorized overtime to perform guard inspections during night shifts or on  weekends. However, on the few occasions when inspectors complete  guard inspections at night or on their own time, FPS has found instances  of guards not complying with post orders. For example, as shown in figure  2, at a level IV facility, an armed guard was found asleep at his post after  taking the pain killer prescription drug Percocet during the night shift.  FPS’s guard manual states that guards are not permitted to sleep or use  any drugs (prescription or non-prescription) which may impair the guard’s  ability to perform duties.
FPS’s post orders also describe a number of items that guards are  prohibited from doing while on post. For example, guards are prohibited  from sleeping, using government property such as computers, and test  firing a weapon unless at a range course. However, FPS has found  incidents at level IV facilities where guards were not in compliance with  post orders. Some examples follow.
A guard was caught using government computers, while he was supposed  to be standing post, to further his private for-profit adult website.
A guard attached a motion sensor to a pole at the entrance to a federal  facility garage to alert him whenever a person was approaching his post.  Another law enforcement agency discovered the device and reported it to  FPS.
A guard, during regular business hours, accidentally fired his firearm in a  restroom while practicing drawing his weapon.
A guard failed to recognize or did not properly x-ray a box containing  semi-automatic handguns at the loading dock at one federal facility we  visited. FPS only became aware of the situation because the handguns  were delivered to FPS.
While the guards were fired or disciplined in each of these incidents, they  illustrate that FPS is able to identify some instances where guards are not  complying with post orders and the importance of why it should improve  the oversight of its guard program.
section_title: Covert Testing of FPS’s Guard Program Reveals Weaknesses
paragraphs: We identified substantial security vulnerabilities related to FPS’s guard  program. Each time they tried, in April and May 2009, our investigators  successfully passed undetected through security checkpoints monitored  by FPS’s guards, with the components for an IED concealed on their  persons at 10 level IV facilities in four cities in major metropolitan areas.  The specific components for this device, items used to conceal the device  components, and the methods of concealment that we used during our  covert testing are classified, and thus are not discussed in this testimony.  Of the 10 level IV facilities we penetrated, 8 were government owned and 2  were leased facilities. The facilities included field offices of a U.S Senator  and U.S. Representative as well as agencies of the Departments of  Homeland Security, Transportation, Health and Human Services, Justice,  State and others. The two leased facilities did not have any guards at the  access control point at the time of our testing.
Using publicly available information, our investigators identified a type of  device that a terrorist could use to cause damage to a federal facility and  threaten the safety of federal workers and the general public. The device  was an IED made up of two parts—a liquid explosive and a low-yield  detonator—and included a variety of materials not typically brought into a  federal facility by employees or the public. Although the detonator itself  could function as an IED, investigators determined that it could also be  used to set off a liquid explosive and cause significantly more damage. To  ensure safety during this testing, we took precautions so that the IED  would not explode. For example, we lowered the concentration level of  the material.
To gain entry into each of the 10 level IV facilities, our investigators  showed photo identification (state driver’s license) and walked through  the magnetometer machines without incident. The investigators also  placed their briefcases with the IED material on the conveyor belt of the x- ray machine, but the guards detected nothing. Furthermore, our  investigators did not receive any secondary searches from the guards  which might have revealed the IED material that we brought into the  facilities. At security checkpoints at 3 of the 10 facilities, our investigators  noticed that the guard was not looking at the x-ray screen as some of the  IED components passed through the machine. A guard questioned an item  in the briefcase at one of the 10 facilities but the materials were  subsequently allowed through the x-ray machines. At each facility, once  past the guard screening checkpoint, our investigators proceeded to a  restroom and assembled the IED. At some of the facilities, the restrooms  were locked. Our investigators gained access by asking employees to let  them in. With the IED completely assembled in a briefcase, our  investigators walked freely around several floors of the facilities and into  various executive and legislative branch offices, as described above.
subsections: section_title: FPS’s Recent Actions to Improve Its Oversight of Guards May Be Challenging to Implement
paragraphs: Because of the sensitivity of our review, we have already briefed FPS and  GSA on the results of our covert testing at 10 level IV facilities and other  preliminary findings regarding the guard program. FPS subsequently  identified and began taking several actions in response to our findings.  According to FPS officials, it recently authorized the use of overtime to  monitor guards during non-routine business hours and is requiring  penetration tests to identify weaknesses at access control guard posts.  FPS has conducted limited intrusion testing in the past and experienced  difficulty in executing such tests. For example, in 2008, one FPS region  conducted an intrusion test at a level IV facility and successfully brought a  “fake bomb” into the building through a loading area. During the test, FPS  agents misplaced the box containing the “fake bomb” and it was picked up  by a guard who took it to the mail room for processing. It was opened by  the guard who panicked. After this incident, the intrusion testing program  in that region was cancelled, according to FPS officials in that region.
FPS has also accelerated the implementation of a new directive designed  to clarify organizational responsibilities for conducting and reporting the  results of inspections and evaluations. For example, under the March 2009  directive, at a level IV facility, FPS is planning to inspect 2 guard posts a  week. Prior to the new directive, FPS did not have a national requirement  for when to conduct inspections at federal facilities and each region we  visited had requirements that ranged from no inspection requirements to  each inspector having to conduct 5 inspections per month. Meeting these  new requirements may be challenging, according to FPS management and  regional staff we contacted. FPS management in several regions we visited  told us that the new directive appears to be based primarily on what works  well from a headquarters or National Capital Region perspective, not a  regional perspective that reflects local conditions and limitations in  staffing resources. A FPS official in one region also said the region is not  adequately staffed to complete all the current mission-essential tasks that  are required, and another FPS official in that region does not believe the  region will be able to conduct the additional inspections as required in the  new policy. Finally, according to the Director of FPS, while having more  resources would help address the weaknesses in the guard program, the  additional resources would have to be trained and thus could not be  deployed immediately.
section_title: Agency Comments
paragraphs: We provided FPS a detailed briefing on June 5, 2009 on our preliminary  findings. We also provided FPS with a draft of this testimony. FPS  provided no comments on this testimony.
We plan to provide this Committee with our complete evaluation and a  final report on FPS’s oversight of its guard program in September 2009.  This concludes our testimony. We are pleased to answer any questions you  might have.
section_title: Contact Information
paragraphs: For further information on this testimony, please contact Mark Goldstein  at 202-512-2834 or by email at goldsteinm@gao.gov. Individuals making key  contributions to this testimony include Jonathan Carver, Tammy  Conquest, John Cooney, Colin Fallon, Daniel Hoy, George Ogilvie, Susan  Michal-Smith, and Ramon Rodriguez.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.