Department of Homeland Security: Progress Made and Work Remaining in Implementing Homeland Security Missions 10 Years after 9/11
Published: 2011-09-07T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The events of September 11, 2001, led to profound changes in government policies and structures to confront homeland security threats. Most notably, the Department of Homeland Security (DHS) began operations in 2003 with key missions that included preventing terrorist attacks from occurring in the United States, and minimizing the damages from any attacks that may occur. DHS is now the third-largest federal department, with more than 200,000 employees and an annual budget of more than $50 billion. Since 2003, GAO has issued over 1,000 products on DHS's operations in such areas as border and transportation security and emergency management, among others. As requested, this report addresses DHS's progress in implementing its homeland security missions since it began operations, work remaining, and issues affecting implementation efforts. This report is based on GAO's past and ongoing work, supplemented with DHS Office of Inspector General reports, with an emphasis on reports issued since 2008. GAO also analyzed information provided by DHS in July and August 2011 on recent actions taken in response to prior work.
section_title: What GAO Found
paragraphs: Since it began operations in 2003, DHS has implemented key homeland security operations and achieved important goals and milestones in many areas to create and strengthen a foundation to reach its potential. As it continues to mature, however, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. DHS's accomplishments include developing strategic and operational plans; deploying workforces; and establishing new, or expanding existing, offices and programs. For example, DHS (1) issued plans to guide its efforts, such as the Quadrennial Homeland Security Review, which provides a framework for homeland security, and the National Response Framework, which outlines disaster response guiding principles; (2) successfully hired, trained, and deployed workforces, such as a federal screening workforce to assume security screening responsibilities at airports nationwide; and (3) created new programs and offices to implement its homeland security responsibilities, such as establishing the U.S. Computer Emergency Readiness Team to help coordinate efforts to address cybersecurity threats. Such accomplishments are noteworthy given that DHS has had to work to transform itself into a fully functioning department while implementing its missions--a difficult undertaking that can take years to achieve. While DHS has made progress, its transformation remains high risk due to its management challenges. Examples of progress made and work remaining include: Border security. DHS implemented the U.S. Visitor and Immigrant Status Indicator Technology program to verify the identities of foreign visitors entering and exiting the country by processing biometric and biographic information. However, DHS has not yet determined how to implement a biometric exit capability and has taken action to address a small portion of the estimated overstay population in the United States (individuals who legally entered the country but then overstayed their authorized periods of admission). Aviation security. DHS developed and implemented Secure Flight, a program for screening airline passengers against terrorist watchlist records. DHS also developed new programs and technologies to screen passengers, checked baggage, and air cargo. However, DHS does not yet have a plan for deploying checked baggage screening technologies to meet recently enhanced explosive detection requirements, a mechanism to verify the accuracy of data to help ensure that air cargo screening is being conducted at reported levels, or approved technology to screen cargo once it is loaded onto a pallet or container. Emergency preparedness and response. DHS issued the National Preparedness Guidelines that describe a national framework for capabilities-based preparedness, and a Target Capabilities List to provide a national-level generic model of capabilities defining all-hazards preparedness. DHS is also finalizing a National Disaster Recovery Framework, and awards preparedness grants based on a reasonable risk methodology. However, DHS needs to strengthen its efforts to assess capabilities for all-hazards preparedness, and develop a long-term recovery structure to better align timing and involvement with state and local governments' capacity. Chemical, biological, radiological and nuclear (CBRN) threats. DHS assessed risks posed by CBRN threats and deployed capabilities to detect CBRN threats. However, DHS should work to improve its coordination of CBRN risk assessments, and identify monitoring mechanisms for determining progress made in implementing the global nuclear detection strategy. GAO's work identified three themes at the foundation of DHS's challenges. This report contains no new recommendations.

section_title: Letter
paragraphs: The nation is about to pass the 10-year anniversary of the September 11,  2001, terrorist attacks. The events of that day led to profound changes in  government agendas, policies, and structures to confront homeland  security threats facing the nation. Most notably, in the aftermath of the  attacks, the Department of Homeland Security (DHS) was created with  key missions that include preventing terrorist attacks from occurring within  the United States, reducing U.S. vulnerability to terrorism, minimizing  resulting damages, and helping the nation recover from any attacks that  may occur. The 10-year anniversary of 9/11 provides an opportunity to  reflect on the progress DHS has made since its establishment and  challenges it has faced in implementing its missions, as well as to identify  issues that will be important for the department to address as it moves  forward, based on work we have completed on DHS programs and  operations in key areas.
The creation of DHS was an enormous management challenge,  representing the fusion of 22 agencies, and the size, complexity, and  importance of the effort made the challenge especially daunting and  critical to the nation’s security. DHS is now the third-largest federal  department, with more than 200,000 employees and an annual budget of  more than $50 billion. Since DHS began operations in March 2003, the  department developed and refined the implementation of various policies  and programs to address its homeland security missions as well as its  nonhomeland security functions. In particular, DHS implemented  programs to secure the border and administer the immigration system;  strengthen the security of the transportation sector; and prepare for and  respond to terrorist threats and natural disasters. DHS also took actions  to strengthen and better integrate its management functions and to  transform its component agencies into a unified cabinet-level department.
We have evaluated numerous departmental programs and activities since  DHS began its operations in 2003 and issued over 1,000 reports and  congressional testimony in such areas as border security and  immigration; transportation security; and emergency management,  among others. We have made approximately 1,500 recommendations to  DHS designed to improve its operations, such as to improve performance  measurement efforts; strengthen management processes, including  acquisition processes; enhance coordination and information sharing; and  increase the use of risk information in planning and resource allocation  decisions, as well as to address other key themes that have affected  DHS’s implementation efforts. DHS has implemented about half of these  recommendations, has actions underway to address others, and has  taken additional steps to strengthen its mission activities. However, we  reported that the department has much to do to ensure that it conducts its  missions efficiently and effectively while simultaneously preparing to  address future challenges that face the department and the nation.  Addressing these challenges will likely become increasingly complex as  domestic and world events unfold, and will be particularly challenging in  light of the current fiscal environment and constrained budgets.
In 2003, we designated the implementation and transformation of DHS as  high risk because it represented an enormous undertaking that would  require time to achieve in an effective and efficient manner. Additionally,  the components that merged to form DHS already faced a wide array of  existing challenges, and any DHS failure to effectively carry out its  mission could expose the nation to potentially serious consequences. The  area has remained on our high-risk list since 2003. Our prior work on  mergers and organizational transformations, undertaken before the  creation of DHS, found that successful transformations of large  organizations, even those faced with less strenuous reorganizations than  DHS, can take years to achieve. Most recently, in our 2011 high-risk  update, we reported that DHS took action to implement, transform, and  integrate its management functions, actions that directly affect its ability to  meet its homeland security and other missions. For example, senior  leaders at the department, including the Secretary and Deputy Secretary  of Homeland Security, demonstrated strong commitment and support to  addressing this high-risk area by, among other things, designating the  Under Secretary for Management to be responsible for coordinating  DHS’s efforts to address this high-risk area, as well as other senior  officials to be responsible for implementing corrective actions within each  management function. Moreover, in January 2011 DHS developed a  strategy for addressing existing integration and management issues and  is in the early stages of its implementation. DHS provided an update to  the strategy in June 2011 that detailed plans and status updates designed  to integrate and strengthen its management functions. We plan to provide  the department with feedback on this update later this year. Moving  forward, we reported that DHS will need to continue to implement its high- risk strategy and efforts to identify and acquire resources needed to  address its risks, monitor and validate its corrective actions, and show  measurable, sustainable progress in achieving key outcomes.  Demonstrated, sustainable progress will be critical to helping DHS  strengthen and integrate management functions within and across the  department and its components.
In February 2010, DHS issued its first Quadrennial Homeland Security  Review (QHSR) report, outlining a strategic framework for homeland  security to guide the activities of the department and its homeland  security partners, including federal, state, local, and tribal government  agencies; the private sector; and nongovernmental organizations. The  report identified five homeland security missions—Preventing Terrorism  and Enhancing Security; Securing and Managing Our Borders; Enforcing  and Administering Our Immigration Laws; Safeguarding and Securing  Cyberspace; and Ensuring Resilience to Disasters—and goals and  objectives to be achieved within each mission. In addition to the QHSR  report, in July 2010 DHS issued a report on the results of its Bottom-Up  Review (BUR), a departmentwide assessment to align DHS’s  programmatic activities, such as investigating drug smuggling and  inspecting cargo at ports of entry, and its organizational structure to the  missions and goals identified in the QHSR.
In 2007, we reported on progress made by DHS in implementing its  mission and management functions by assessing actions DHS took to  achieve performance expectations within each function. We reported  that DHS made progress in implementing all of its mission and  management areas since it began operations, but progress among the  areas varied significantly. For example, we reported that DHS made more  progress in implementing its mission functions than its management  functions. Further, among its mission functions, we reported that in  implementing expectations, DHS made substantial progress in maritime  security; moderate progress in aviation and surface transportation  security, critical infrastructure protection, and immigration enforcement;  modest progress in border security and immigration services; and limited  progress in emergency preparedness and response missions. We also  reported on various crosscutting issues related to areas such as risk  management, partnerships and coordination, and performance  measurement, that had impeded DHS’s implementation efforts. We  further noted that DHS generally had not established quantitative goals  and measures for assessing its performance and as a result, we could not  assess where along a spectrum of progress DHS stood in achieving its  missions. Subsequent to the issuance of this report, DHS continued to  take action to strengthen its operations and the management of the  department, including enhancing its performance measurement efforts.  Further, at the request of the Senate Committee on Homeland Security  and Governmental Affairs following the issuance of our report, we  provided DHS with feedback on the department’s performance goals and  measures as DHS worked to better position itself to assess its results.  Our feedback ranged from pointing out components’ limited use of  outcome-oriented performance measures to assess the results or  effectiveness of programs, to raising questions about the steps taken by  DHS or its components to ensure the reliability and verification of  performance data. Based on its internal review efforts and our feedback,  DHS took action to develop and revise its performance goals and  measures in an effort to strengthen its ability to assess its outcomes and  progress in key mission areas. For fiscal year 2011, DHS identified 85  strategic measures for assessing its progress in achieving its QHSR  missions and goals. The department plans to report on its results in  meeting established targets for these new measures at the end of the  fiscal year.
You asked us to review the progress made by DHS in implementing its  homeland security missions since its creation after the September 11,  2001, terrorist attacks. This report addresses the following question: What  progress has DHS made in implementing its mission functions since it  began operations; what work, if any, remains; and what crosscutting and  management issues have affected DHS’s implementation efforts?
This report is based on our work on DHS since it began operations, and  supplemented with work completed by the DHS Office of Inspector  General (IG), with an emphasis on work completed since 2008, and  updated information and documentation provided by the department in  July and August 2011. It is also based on our ongoing work on key DHS  programs for various congressional committees, as noted throughout the  report. For this ongoing work, we examined program documentation and  interviewed agency officials, among other things. Our work and the work  of the DHS IG addressed many of DHS’s programs, operations, and  activities. This report highlights our key work in these areas, but does not  address all products we and the DHS IG issued related to DHS, nor does  it address all of DHS’s homeland security-related activities and efforts.
To determine what progress DHS has made in implementing its mission  functions and what work, if any, remains, we identified 10 DHS functional  areas, which we define as categories or areas of DHS’s homeland  security responsibilities. These functional areas are based on those areas  we identified for DHS in our August 2007 report on DHS’s progress in  implementing its mission and management functions, and our analysis of  DHS’s QHSR and budget documents, such as its congressional budget  justifications. These areas include: (1) aviation security; (2) chemical,  biological, radiological, and nuclear (CBRN) threats; (3) critical  infrastructure protection—physical assets; (4) surface transportation  security; (5) border security; (6) maritime security; (7) immigration  enforcement; (8) immigration services; (9); critical infrastructure  protection—cyber assets; and (10) emergency preparedness and  response. To identify sub-areas within these functional areas, we  identified performance expectations, which we define as composites of  the responsibilities or functions that the department is to achieve or  satisfy based on our analysis of requirements, responsibilities, and goals  set for the department by Congress, the administration, and DHS and its  components. In particular, we used expectations identified in our August  2007 report as a baseline, and updated or added to these expectations by  analyzing requirements and plans set forth in homeland security-related  laws, presidential directives and executive orders, national strategies  related to homeland security, and DHS’s and components’ strategic plans  and documents. We then grouped these expectations within each  functional area into broader sub-areas, as shown in appendix I. For  example, we identified administering grant programs for surface  transportation security as a performance expectation for DHS within the  grants sub-area of the surface transportation functional area. Further, we  then aligned our functional areas to the five QHSR missions based on our  review of the QHSR and BUR reports and DHS’s fiscal year 2012 budget  documents, as shown in appendix II.
To identify key areas of progress and work that remains in each functional  area, as well as crosscutting and management issues that have affected  DHS’s implementation efforts, we examined our and the DHS IG’s past  reports. We selected, in consultation with GAO subject matter experts,  key work we and the DHS IG have completed related to the functional  areas, sub-areas, and crosscutting issues. We examined the  methodologies used by the DHS IG in its reports, including reviewing the  scope, methodological steps, and limitations. We determined that the  DHS IG reports were sufficiently reliable for the purposes of our report to  provide examples, and to supplement our work, of DHS’s progress and  work remaining. We identified crosscutting issues based on analysis of  our work in each functional mission area to determine common issues  that have affected DHS’s implementation efforts across the various  mission areas.
We obtained and incorporated feedback on our assessments from our  subject matter experts. In addition, we provided DHS with drafts of our  assessments of DHS progress and work remaining in each functional  area and crosscutting issue and obtained and analyzed updated  information provided by DHS on these areas. In some cases, DHS  provided us with updated data on its efforts, such as statistics on  technology deployments or program activities. We assessed the reliability  of these data by reviewing available documentation from DHS. We  determined that the data were sufficiently reliable for the purposes of our  report. We included updated information in our assessments, based on  our review of this information and our prior work. In some cases, we could  not make an assessment of the updated information DHS provided  because we did not have prior work upon which to base an assessment.  We noted these instances in our report.
Our assessments of the progress made by DHS in functional areas and  sub-areas, as well as our analyses of crosscutting issues, are based  primarily on our reports, supplemented by reports of the DHS IG. As  such, the assessments of progress do not reflect, nor are they intended to  reflect, the extent to which DHS’s actions have made the nation more  secure in each area. Further, we do not intend to imply that our  discussion of progress and work remaining in the functional areas and  sub-areas, considered separately or together, reflect DHS’s progress in  implementing its missions. Instead, our assessments provide information  on progress made and work that remains in key functional areas on which  we have reported, as indicated by findings from our work, supplemented  by that of the DHS IG. In addition, because we and the DHS IG have  completed varying degrees of work (in terms of the amount and scope of  reviews completed) for each functional area, and because different DHS  components and offices provided us with different amounts and types of  information, our assessments of DHS’s progress in each area reflect the  information available for our review and analysis and are not necessarily  equally comprehensive across all 10 areas. Further, for some sub-areas,  we were unable to make an assessment of DHS’s progress because we  and the DHS IG have not conducted recent work in that area or have  conducted limited work. Additionally, DHS developed other performance  measures against which to gauge its progress in fiscal year 2011, but has  not yet reported on these measures. As such, the department did not  have data available across a consistent baseline against which to assess  its progress from fiscal years 2004 through 2011. Therefore, we were not  able to assess DHS’s progress against a baseline for each functional  area and sub-area, we did not assign a qualitative rating of progress for  each area, and we did not apply a weight to the expectations or sub- areas. More detailed information on those sub-areas for which we did not  make an assessment is included in appendices III through XII.
We conducted this performance audit from April 2011 through September  2011, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. A more detailed  discussion of our scope and methodology is contained in appendix II.
subsections: section_title: Background
paragraphs: In November 2002, the Homeland Security Act was enacted into law,  creating DHS. This act defined the department’s missions to include  preventing terrorist attacks within the United States; reducing U.S.  vulnerability to terrorism; and minimizing the damages, and assisting in  the recovery from, attacks that occur within the United States. The act  also specified major responsibilities for the department, including to  analyze information and coordinate the protection of critical infrastructure;  coordinate efforts to develop countermeasures against chemical,  biological, radiological, nuclear, and other emerging terrorist threats;  secure U.S. borders and transportation systems; and manage the federal  government’s response to terrorist attacks and major disasters. Various  laws have been enacted and presidential directives have been issued  that, among other things, expand, modify, or clarify DHS’s missions and  responsibilities. For example, these laws and directives have reorganized  departmental offices and functions; clarified DHS’s roles and  responsibilities, such as for emergency preparedness and response; and  directed DHS to complete various strategic documents or implement  specific programs within certain time frames. For example, the Aviation  and Transportation Security Act, enacted in November 2001, established  the Transportation Security Administration (TSA) and, among other  things, included requirements for deploying a federal screening workforce  at airports and screening all checked baggage transported on passenger  aircraft using explosive detection systems. The Maritime Transportation  Security Act of 2002 and the Security and Accountability For Every Port  Act of 2006 (SAFE Port Act), among other things, established and  modified a maritime security framework to include U.S. vessel and port  facility security requirements, an international port security assessment  program, and programs for scanning cargo containers. The Intelligence  Reform and Terrorism Prevention Act of 2004 included provisions related  to intelligence, immigration enforcement, border security, and aviation  security, such as those calling for an increase in the number of Border  Patrol agents and full-time investigators for violations of immigration law,  subject to the availability of appropriations, and requiring DHS to develop  a national strategy for transportation security. The Post-Katrina  Emergency Management Reform Act of 2006 required changes to the  Federal Emergency Management Agency’s (FEMA) organizational and  management structure, and addressed other emergency management  areas, such as emergency communications, and national planning and  preparedness. The Implementing Recommendations of the 9/11  Commission Act of 2007 includes provisions related to critical  infrastructure protection, transportation security, and chemical, biological,  radiological, and nuclear threats, among other areas. The law  references the recommendations made by the National Commission on  Terrorist Attacks Upon the United States (known as the 9/11  Commission).
DHS began operations in March 2003, and its establishment represented  a fusion of 22 federal agencies to coordinate and centralize the  leadership of many homeland security activities under a single  department. The department’s total budget authority has increased from  about $39 billion in fiscal year 2004 to about $55 billion in fiscal year  2011. The department’s fiscal year 2012 budget request is about $57  billion in total funding. Table 1 provides information on DHS’s budget  authority for each fiscal year from 2004 though 2011, as reported by  DHS.
A variety of factors have affected DHS’s efforts to implement its mission  functions since its establishment, including several departmental  reorganizations. Most notably, in 2005 DHS announced the outcome of its  Second Stage Review, a systematic evaluation of DHS’s operations,  policies, and structures. As a result of this review, the department  realigned existing directorates. The Post-Katrina Emergency  Management Reform Act provided for the further reorganization of  functions within the department by, in particular, realigning DHS’s  emergency preparedness and response responsibilities. Further, as a  result of the Implementing Recommendations of the 9/11 Commission Act  of 2007, DHS reorganized its intelligence-related operations. In addition  to these reorganizations, domestic and international events have affected  DHS’s implementation efforts. For example, Hurricanes Katrina and Rita,  the 2009 H1N1 pandemic, the attempted airline attack on December 25,  2009, and the 2010 Gulf oil spill required rapid responses from the  department and impacted DHS’s plans and operations for mitigating  vulnerabilities and addressing threats, and its progress in implementing  its missions. Figure 1 provides a timeline of selected events that have  affected DHS’s implementation efforts.
section_title: DHS Continues to Implement and Strengthen Its Mission Functions, but Key Operational and Management Challenges Remain
paragraphs: Since DHS began operations in March 2003, it has developed and  implemented key policies, programs, and activities for implementing its  homeland security missions and functions that have created and  strengthened a foundation to achieve its potential as it continues to  mature. However, the department’s efforts have been hindered by  challenges faced in leading and coordinating the homeland security  enterprise; implementing and integrating its management functions for  results; and strategically managing risk and assessing, and adjusting as  necessary, its homeland security efforts. DHS has made progress in  these three areas, but needs to take additional action, moving forward, to  help it achieve its full potential.
subsections: section_title: DHS Has Made Progress in Implementing Its Mission Functions, but Program Weaknesses and Management Issues Have Hindered Implementation Efforts
paragraphs: DHS has made important progress in implementing and strengthening its  mission functions over the past 8 years. DHS implemented key homeland  security operations and achieved important goals and milestones in many  areas. The department’s accomplishments include developing strategic  and operational plans across its range of missions; hiring, deploying and  training workforces; establishing new, or expanding existing, offices and  programs; and developing and issuing policies, procedures, and  regulations to govern its homeland security operations. Specifically:    DHS issued strategic and operational plans to guide its homeland  security efforts, such as the QHSR, which provided a strategic  framework for homeland security, and the National Response  Framework, which is built upon coordinating structures to align key  roles and responsibilities across the nation, linking all levels of  government, nongovernmental organizations, and the private sector.     DHS successfully hired, trained, and deployed workforces, such as a  federal screening workforce at airports nationwide. DHS also has  about 20,000 agents to patrol the U.S. land borders and about 20,600  officers to conduct screening at air, land, and sea ports of entry.     DHS created new programs and offices, or expanded existing ones, to  implement key homeland security responsibilities, such as  establishing the U.S. Computer Emergency Readiness Team to,  among other things, coordinate the nation’s efforts to prepare for,  prevent, and respond to cyber threats to systems and  communications networks. DHS also expanded programs for  identifying and removing aliens subject to removal from the United  States and for preventing unauthorized aliens from entering the  country.     DHS issued policies and procedures addressing, among other things,  the screening of passengers at airport checkpoints, inspecting  travelers seeking entry into the United States, and assessing  immigration benefit applications and processes for detecting possible  fraud.
Establishing these elements and others are important accomplishments  and have been critical for the department to position and equip itself for  fulfilling its homeland security missions and functions.
However, our work has shown that more work remains for DHS to  address weaknesses in its current operational and implementation efforts  and to strengthen the efficiency and effectiveness of those efforts to  achieve its full potential. For example, we have reported that many DHS  programs and investments have experienced cost overruns, schedule  delays, and performance problems, including, for instance, DHS’s  recently canceled technology program for securing U.S. borders, known  as the Secure Border Initiative Network, and some technologies for  screening passengers at airport checkpoints. DHS also has not yet fully  implemented its roles and responsibilities for developing and  implementing key homeland security programs and initiatives. For  example, FEMA has not yet developed a set of target capabilities for  disaster preparedness or established metrics for assessing those  capabilities to provide a framework for evaluating preparedness, as  required by the Post-Katrina Emergency Management Reform Act of  2006. Further, DHS has not yet fully deployed technologies to meet key  missions for border, aviation, and maritime security. Our work has also  shown that DHS should take additional action to improve the efficiency  and effectiveness of a number of its programs and activities by, for  example, improving program management and oversight, and better  assessing homeland security requirements, needs, costs, and benefits,  such as for key acquisition and technology programs.
Table 2 provides additional information on key progress and work  remaining in each of DHS’s functional mission areas, as identified by our  work and supplemented by that of the DHS IG, with an emphasis on work  completed since 2008. We have made approximately 1,500  recommendations to DHS to help address these issues, and DHS has  addressed about half of them and has actions underway to address  others. Appendixes III through XII provide more detailed information on  our assessment of progress made and work remaining in each functional,  including recommendations we have made and the department’s efforts  to implement them.
Impacting the department’s ability to efficiently and effectively satisfy its  missions are:   the need to integrate and strengthen its management functions;   the need for increased utilization of performance assessments;   the need for an enhanced use of risk information to inform planning,  programming, and investment decision-making;   limitations in effective sharing and use of terrorism-related  information;     partnerships that are not sustained or fully leveraged; and     limitations in developing and deploying technologies to meet mission  needs.
DHS made progress in addressing these areas, but more work is needed,  going forward, to further mitigate these challenges and their impact on  DHS’s mission implementation. As we have previously reported, while it is  important that DHS continue to work to strengthen each of its functional  areas, it is equally important that these areas be addressed from a  comprehensive, departmentwide perspective to help mitigate  longstanding issues that have impacted the department’s progress.
Table 3 provides examples of crosscutting issues that have impacted the  department’s progress, as identified by our work. Appendixes XIII through  XVIII provide more detailed information on our assessment of progress  made and work remaining in each crosscutting area, including  recommendations we have made and DHS’s efforts to implement them.
Our work on the functional mission areas and crosscutting issues  discussed in this report has identified several key themes—leading and  coordinating the homeland security enterprise, implementing and  integrating management functions for results, and strategically managing  risks and assessing homeland security efforts—that have impacted the  department’s progress since it began operations. These themes provide  insights that can inform DHS’s efforts, moving forward, as it works to  implement its missions within a dynamic and evolving homeland security  environment, one in which a broad range of threats face the nation—from  terrorists’ possible use of a chemical or biological agent to carry out an  attack to cyber threats and intrusions to natural disasters and infectious  diseases. DHS made progress and had successes in all of these areas,  but our work found that these themes have been at the foundation of  DHS’s implementation challenges, and need to be addressed from a  departmentwide perspective to position DHS for the future and enable it  to satisfy the expectations set for it by the Congress, the administration,  and the country.
Leading and coordinating the homeland security enterprise. While  DHS is one of a number of entities with a role in securing the homeland, it  has significant leadership and coordination responsibilities for managing  efforts across the homeland security enterprise. To satisfy these  responsibilities, it is critically important that DHS develop, maintain and  leverage effective partnerships with its stakeholders, while at the same  time addressing DHS-specific responsibilities in satisfying its missions.  Before DHS began operations, we reported that the quality and continuity  of the new department’s leadership would be critical to building and  sustaining the long-term effectiveness of DHS and achieving homeland  security goals and objectives. In particular, we reported that top  leadership involvement and clear lines of accountability for making  improvements would be critical to marshalling the needed resources and  building and maintaining organizationwide commitment to new ways of  doing business. We further reported that to secure the nation, DHS must  form effective and sustained partnerships between components and also  with a range of other entities, including federal agencies; state, local, and  tribal governments; the private and nonprofit sectors; and international  partners. Critical aspects of DHS’s success depend on well-functioning  relationships with third parties, and DHS needs to continue to create and  maintain a structure that can leverage partnerships to effectively  implement homeland security efforts. Eight years after its establishment,  DHS has made important strides in providing leadership and coordinating  efforts across the enterprise as it continues to work to implement and  strengthen its effectiveness across its range of missions. For example,  DHS strengthened its partnerships and collaboration with foreign  governments to coordinate and standardize security practices for aviation  security. It has also improved coordination and clarified roles and  responsibilities with state, local, and tribal governments for emergency  management. In addition, DHS operates the Protective Security Advisor  Program, which deploys critical infrastructure protection and security  specialists to local communities to help foster effective information  sharing with the private sector and local communities.
However, our work has found that DHS made limited progress in forging  effective partnerships and sharing information throughout the enterprise  early in its existence and as it matured, and although DHS continues to  make improvements in this area, it faces challenges in building and  leveraging these partnerships and information. These challenges have  impeded the department’s progress, affecting its ability to effectively and  efficiently satisfy its missions. For example, we found that DHS has not  effectively overseen key interagency forums its components have  established with other federal, state, local, tribal, and foreign law  enforcement agencies to secure the border, raising the risk of duplication,  overlap, and an inefficient use of resources.
In 2005 we designated information sharing for homeland security, for  which DHS has key responsibilities, as high risk because the federal  government faced serious challenges in analyzing information and  sharing it among partners in a timely, accurate, and useful way to protect  against terrorist threats. We reported that DHS must effectively share  terrorism-related information with state and local law enforcement  agencies because they depend on it to maintain awareness of emerging  threats and to allocate homeland security resources, among other things.  Further, gaps in sharing, such as agencies' failure to link information  about the individual who attempted to conduct the December 25, 2009,  airline bombing, prevented the individual from being included on the  federal government’s consolidated terrorist watchlist, a tool used by DHS  to screen for persons who pose a security risk.
The federal government and DHS have made progress in this area, but  more work remains to strengthen and streamline existing information  sharing mechanisms and better address partners’ information needs.  These gaps have contributed to, among other things, DHS not realizing  the full potential and contributions that its partners can provide, and not  maximizing its effectiveness in achieving its missions. For example, with  regard to cybersecurity, private sector stakeholders reported that they  expect their federal partners, including DHS, to provide usable, timely,  and actionable cyber threat information and alerts and a secure  mechanism for sharing information, among other things. However,  according to private sector stakeholders, federal partners are not  consistently meeting these expectations. Without improvements in  meeting private and public sector expectations for sharing cyber threat  information, private-public partnerships will remain less than optimal, and  there is a risk that owners of critical infrastructure will not have the  information and mechanisms needed to thwart sophisticated cyber  attacks that could have catastrophic effects on our nation’s cyber-reliant  critical infrastructure. Moreover, we have identified the potential for  overlap between various mechanisms DHS uses for sharing security- related information with public transit agencies. DHS needs to continue to  streamline its mechanisms for sharing information with public transit  agencies to reduce the volume of similar information these agencies  receive from DHS, making it easier for them to discern relevant  information and take appropriate actions to enhance security. Moving  forward, it will be important that DHS continue to enhance its focus and  efforts to strengthen and leverage the broader homeland security  enterprise, and build off the important progress that it has made thus far.  In addressing ever changing and complex threats, and with the vast array  of partners with which DHS must coordinate, continued leadership and  stewardship will be critical in achieving this end.
Implementing and integrating management functions for results.  Following its establishment, the department focused its efforts primarily  on implementing its various missions to meet pressing homeland security  needs and threats, and less on creating and integrating a fully and  effectively functioning department from 22 disparate agencies. This initial  focus on mission implementation was understandable given the critical  homeland security needs facing the nation after the department’s  establishment, and the enormous challenge posed by creating,  integrating, and transforming a department as large and complex as DHS.  As the department matured, it has put into place management policies  and processes and made a range of other enhancements to its  management functions—acquisition, information technology, financial,  and human capital management. However, the department has not  effectively executed these processes in a number of instances, across the  range of its management functions, and has not fully integrated these  functions across components and among departmental missions. These  issues have contributed to performance problems in programs aimed at  delivering important mission capabilities. For example, DHS did not  sufficiently define what capabilities and benefits would be delivered, by  when, and at what cost for US-VISIT—which is to verify the identities of  foreign visitors entering and exiting the United States by storing and  processing biometric and biographic information—and has not yet  reached a decision on deploying an exit capability. Not defining these  capabilities and benefits contributed to development and deployment  delays. In another example, with respect to the cargo advanced  automated radiography system to detect certain nuclear materials in  vehicles and containers at ports, DHS pursued the acquisition and  deployment of the system without fully understanding that it would not fit  within existing inspection lanes at ports of entry. DHS subsequently  canceled this program.
In 2003, GAO designated the transformation and implementation of DHS  as high risk because the department had to transform 22 agencies— several with major management challenges—into one department, and  failure to effectively address DHS’s management and mission risks could  have serious consequences for U.S. national and economic security.  Eight years later, DHS remains on our high-risk list. DHS has made  important strides in working to strengthen its management functions, has  established plans to strengthen and integrate these functions, and in  recent years has demonstrated strong leadership support to address  these long-standing issues. In particular, DHS developed various  management policies, directives, and governance structures, such as  acquisition and information technology management policies and  controls, to provide enhanced guidance on investment decision-making.  DHS also reduced its financial management material weaknesses in  internal control over financial reporting and developed strategies to  strengthen human capital management, such as its Workforce Strategy  for Fiscal Years 2011-2016. However, more work remains to position  these management areas for success. For example, DHS does not yet  have enough skilled personnel to carry out activities in some key  programmatic and management areas, such as for acquisition  management, and was ranked 28 out of 32 agencies in the 2010  Partnership for Public Service’s Best Places to Work in the Federal  Government rankings. DHS also has not yet implemented an integrated  financial management system, impeding its ability to have ready access  to information to inform decision-making, and has been unable to obtain a  clean audit opinion on the audit of its consolidated financial statements  since its establishment. Moving forward, addressing these management  challenges will be critical for DHS’s success, as will the integration of  these functions across the department to achieve efficiencies and  effectiveness.
Strategically managing risks and assessing homeland security  efforts. Forming a new department while working to implement statutorily  mandated and department-initiated programs and initiatives, and  responding to adapting adversaries and evolving threats was and is a  significant challenge facing DHS. Key threats and incidents that have  emerged, both domestically and internationally, such as the anthrax  attacks, Hurricanes Katrina and Rita, and a number of attempted attacks  against the aviation sector, have impacted and altered the department’s  approaches and investments. For example, DHS made key changes to its  processes and technology investments for screening passengers and  baggage at airports in part as a result of threats facing commercial  aviation. DHS also changed its processes and clarified roles and  responsibilities for emergency management in the aftermath of  Hurricanes Katrina and Rita.
It is understandable that these events and threats had to be addressed as  they arose. However, our work has shown, throughout the department,  that limited strategic and program planning, as well as assessment and  evaluation to inform approaches and investment decisions, have  contributed to programs not meeting strategic needs or doing so  effectively and efficiently. For example, as we reported in July 2011, the  Coast Guard’s planned acquisitions through its Deepwater Program,  which began before DHS’s creation and includes efforts to build or  modernize ships and aircraft and supporting capabilities that are critical to  meeting the Coast Guard’s core missions in the future, is unachievable  due to cost growth, schedule delays, and affordability issues. In addition,  because FEMA has not yet developed a set of target disaster  preparedness capabilities and a systematic means of assessing those  capabilities, as required by the Post-Katrina Emergency Management  Reform Act of 2006 and Presidential Policy Directive 8: National  Preparedness, it cannot effectively evaluate and identify key capability  gaps and target limited resources to fill those gaps. We have also  reported that while DHS has made important progress in assessing and  analyzing risk across sectors, it has more work to do in using this  information to inform planning and resource allocation decisions. Risk  management has been widely supported by Congress and DHS as a  management approach for homeland security, enhancing the  department’s ability to make informed decisions and prioritize resource  investments. Since DHS does not have unlimited resources and cannot  protect the nation from every conceivable threat, it must make risk- informed decisions regarding its homeland security approaches and  strategies.
Moreover, we have reported on the need for enhanced performance  assessment, that is, evaluating existing programs and operations to  determine whether they are operating as intended or are in need of  change, across DHS’s missions. Information on the performance of  programs is critical for helping the department, the Congress, and other  stakeholders more systematically assess strengths and weaknesses and  inform decision-making. In recent years, DHS has placed an increased  emphasis on strengthening its mechanisms for assessing the  performance and effectiveness of its homeland security programs. For  example, DHS established new performance measures, and modified  existing ones, to better assess many of its programs and efforts.  Enhanced assessment of programs’ performance and the use of that  information to inform decisions will provide the department with important  insights in determining the extent to which programs and operations are  meeting intended goals and results and at what cost.
However, our work has found that DHS continues to miss opportunities to  optimize performance across its missions because of a lack of reliable  performance information or assessment of existing information;  evaluation of feasible alternatives; and, as appropriate, adjustment of  programs or operations that are not meeting mission needs. For example,  TSA’s program for research, development, and deployment of passenger  checkpoint screening technologies lacked a risk-based plan and  performance measures to assess the extent to which checkpoint  screening technologies were achieving the program’s security goals, and  thereby reducing or mitigating the risk of terrorist attacks. As a result, TSA  had limited assurance that its strategy targeted the most critical risks and  that it was investing in the most cost-effective new technologies or other  protective measures. Further, with regard to border security efforts, CBP  established performance measures for its checkpoints to indicate  checkpoint contributions toward apprehending removable aliens and  seizing illegal drugs, but the lack of information on those passing through  checkpoints undetected continued to challenge CBP’s ability to measure  checkpoint effectiveness and provide public accountability. As the  department further matures and seeks to optimize its operations, DHS will  need to look beyond immediate requirements; assess programs’  sustainability across the long term, particularly in light of constrained  budgets; and evaluate tradeoffs within and among programs across the  homeland security enterprise. Doing so should better equip DHS to adapt  and respond to new threats in a sustainable manner as it works to  address existing ones.
section_title: Concluding Observations
paragraphs: Given DHS’s role and leadership responsibilities in securing the  homeland, it is critical that the department’s programs and activities are  operating as efficiently and effectively as possible, that these programs  are sustainable, and that they continue to mature, evolve, and adapt to  address pressing security needs. DHS has made significant progress  throughout its missions since its creation, but more work is needed to  further transform the department into a more integrated and effective  organization. Specifically, DHS has taken many actions to (1) develop  strategic and operational plans across its range of missions; (2) hire,  deploy and train workforces; (3) establish new, or expand existing, offices  and programs; and (4) develop and issue policies, procedures, and  regulations to govern its homeland security operations. DHS has also  made important progress in strengthening partnerships with stakeholders,  improving its management processes and sharing of information, and  enhancing its risk management and performance measurement efforts.  These accomplishments are especially noteworthy given that the  department has had to work to transform itself into a fully functioning  cabinet department while implementing its missions—a difficult  undertaking for any organization and one that can take years to achieve  even under less daunting circumstances.
Impacting the department’s efforts have been a variety of factors and  events, such as attempted terrorist attacks and natural disasters, as well  as new responsibilities and authorities provided by Congress and the  administration. These events collectively have forced DHS to continually  reassess its priorities and reallocate resources as needed, and have  impacted its continued integration and transformation. Given the nature of  DHS’s mission, the need to remain nimble and adaptable to respond to  evolving threats, as well as to work to anticipate new ones, will not  change and may become even more complex and challenging as  domestic and world events unfold, particularly in light of reduced budgets  and constrained resources. To better position itself to address these  challenges, our work has shown that DHS should place an increased  emphasis and take additional action in supporting and leveraging the  homeland security enterprise, managing its operations to achieve needed  results, and strategically planning for the future while assessing and  adjusting, as needed, what exists today. Addressing these issues will be  critically important for the department to strengthen its homeland security  programs and operations. We have made about 1,500 recommendations  to DHS to address these issues, which the department has or is working  to implement, but more work remains. Eight years after its establishment  and 10 years after the September 11, 2001, terrorist attacks, DHS has  indeed made significant strides in protecting the nation, but has yet to  reach its full potential.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS for its review and comment. We  received written comments on the draft report from DHS, which are  reproduced in full in appendix XIX. DHS also provided technical  comments, which we incorporated as appropriate.
DHS acknowledged our work to assess the progress the department has  made in enhancing the nation’s security and the challenges that still exist.  The department discussed its views of its accomplishments since 2001.  For example, the department noted its creation and management of the  Visa Security Program, which is operational at 19 posts in 15 countries;  the increase in the number of deployed Border Patrol agents since 2001;  the establishment of fusion centers to serve as focal points for the  analysis and sharing of threat and vulnerability-related information;  passenger screening and prescreening efforts; and support to state, local,  tribal and territorial partners’ efforts to enhance emergency  communications capabilities, among other things. DHS further noted its  issuance of the Quadrennial Homeland Security Review in February  2010, which outlined a strategic framework for homeland security. We  recognize the department's progress in these and other areas in the  report, as well as discuss existing challenges that will be important for  DHS to address moving forward.
The department also stated that the report does not address all of DHS’s  homeland security-related activities and efforts, and that assessments in  each area are not comprehensive because we and the DHS IG have  completed varying levels of work in each area. The report notes that the  results are based on our work on DHS since it began operations,  supplemented with work completed by the DHS IG, with an emphasis on  work completed since 2008. We also examined updated information and  documentation provided by the department in July and August 2011. As  identified in the report, we highlighted our work on key DHS programs  and efforts, but neither addressed all products that we and the DHS IG  issued related to DHS, nor addressed all of DHS’s homeland security- related activities and efforts. In addition, each mission area appendix  provides examples of other DHS programs and efforts on which we and  the DHS IG have not reported or have completed limited work. Thus, this  report was not intended to cover all of DHS’s homeland security-related  activities and efforts. Further, as discussed in the report, because we and  the DHS IG have completed varying degrees of work (in terms of the  amount and scope of reviews completed) for each functional area, and  because different DHS components and offices provided us with different  amounts and types of information, our assessments of DHS’s progress in  each area reflect the information available for our review and analysis and  are not necessarily equally comprehensive across all 10 areas.
In addition, DHS provided examples of activities and programs that it  stated are not reflected in our report that demonstrate progress DHS  made in preparing the nation to respond to threats. These programs  include the Western Hemisphere Travel Initiative and increased  coordination across the federal government to analyze travel-related data,  such as through watchlist centers that provide information regarding  potential terrorist travel—the Federal Bureau of Investigation’s Terrorist  Screening Center, the National Counterterrorism Center, the National  Targeting Center, and the Human Smuggling and Trafficking Center. This  report discusses progress made and work remaining related to the  Western Hemisphere Travel Initiative within the border security area. With  regard to the various centers, this report acknowledges the activities of  the National Targeting Center, but we did not include it in our  assessments of progress because we and the DHS IG have completed  limited work on it. The other three centers identified by DHS are not  managed by the department. Because this report is focused on DHS- specific programs and efforts on which we have previously reported,  supplemented by the work of the DHS IG, this report does not discuss  these centers.
This report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-3404, or berrickc@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. Key contributors are listed in appendix XX.
section_title: Appendix I: Department of Homeland Security Functional Mission Areas, Sub- Areas, and Performance Expectations
paragraphs: Table 4 presents the performance expectations and sub-areas we  identified for each Department of Homeland Security (DHS) functional  mission area.
section_title: Appendix II: Scope and Methodology
paragraphs: This report addresses the following question: What progress has the  Department of Homeland Security (DHS) made in implementing its  mission functions since it began operations; what work, if any, remains;  and what crosscutting and management issues have affected DHS’s  implementation efforts?
This report is based primarily on work that we have completed since DHS  began its operations in March 2003, with an emphasis on reports issued  since 2008 to reflect our most recent work, supplemented by DHS Office  of Inspector General (IG) reports and updated information and  documentation provided by the department in July and August 2011. It is  also based on our ongoing work on key DHS programs for various  congressional committees, as noted throughout the report. For this  ongoing work, we examined program documentation and interviewed  agency officials, among other things.
To determine what progress DHS has made in implementing its mission  functions and what work, if any, remains, we identified 10 DHS functional  areas within its missions, which we define as categories or areas of  DHS’s homeland security responsibilities. These functional areas are  based on those areas we identified for DHS in our August 2007 report on  DHS’s progress in implementing its mission and management functions,  and our analysis of DHS’s Quadrennial Homeland Security Review  (QHSR) and budget documents, such as its congressional budget  justifications. We discussed these functional areas with our subject  matter experts and DHS officials and incorporated their feedback as  appropriate. These areas include: (1) aviation security; (2) chemical,  biological, radiological, and nuclear (CBRN) threats; (3) critical  infrastructure protection—physical assets; (4) surface transportation  security; (5) border security; (6) maritime security; (7) immigration  enforcement; (8) immigration services; (9) critical infrastructure  protection—cyber assets; and (10) emergency preparedness and  response. Within these functional areas, we identified performance  expectations, which we define as composites of the responsibilities or  functions that the department is to achieve or satisfy based on  requirements, responsibilities, and goals set for the department by  Congress, the administration, and DHS and its components. In particular,  we used expectations identified in our August 2007 report as a baseline,  and updated, or added to, these expectations by analyzing:    Homeland security-related laws enacted since September 2006 to  identify legislative requirements for each DHS functional area.  Examples of such laws include the Implementing Recommendations  of the 9/11 Commission Act of 2007, the Security and Accountability  For Every Port Act of 2006 (SAFE Port Act), and the Post-Katrina  Emergency Management Reform Act of 2006.     DHS appropriation acts and accompanying conference reports for  fiscal years 2006 through 2011 to identify requirements established  and guidance provided to DHS for each functional area.    Presidential directives and executive orders that have been issued  since September 2006 to identify expectations set for DHS by the  administration for each functional area. Examples of such directives  include Homeland Security Presidential Directive 25: Arctic Region  Policy, and Presidential Policy Directive 8: National Preparedness.     Homeland security-related national strategies that have been issued  since September 2006 to identify expectations set for DHS by the  administration for each functional area. Examples of such strategies  include the 2010 National Security Strategy and 2007 National  Strategy for Homeland Security.    Strategic plans and documents that have been issued since  September 2006 by DHS and its component agencies to identify  goals and measures established by the department for each  functional area. Examples of such strategic plans and documents  include the QHSR and Bottom-Up Review (BUR) reports, as well as  component level strategic plans, such as the U.S. Immigration and  Customs Enforcement (ICE) Strategic Plan (Fiscal Year 2010-2014).
We then grouped the expectations we identified within each functional  area into broader sub-areas. Table 5 provides an example of  performance expectations and sub-areas for the border security  functional area. Appendix I provides the complete list of functional areas,  sub-areas, and performance expectations.
To identify the performance expectations and sub-areas, one analyst  independently reviewed the source documents to identify expectations  and sub-areas for a functional area. A second analyst then independently  reviewed and verified each analysis. We also obtained and incorporated  feedback from our subject matter experts on the expectations and sub- areas. In addition, we obtained feedback from DHS and component  officials on the expectations and sub-areas we identified, and  incorporated their feedback as appropriate.
Further, we then aligned our functional areas to the five Quadrennial  Homeland Security Review (QHSR) missions based on our review of the  QHSR and BUR reports and DHS’s fiscal year 2012 budget documents  (see table 6). Within these documents, DHS identified how its initiatives,  programs, and activities align or support each QHSR mission, with some  supporting more than one mission. For example, U.S. Customs and  Border Protection (CBP) identified that its efforts related to inspections at  ports of entry and facilitation of trade primarily support QHSR Mission 2:  Securing and Managing Our Borders, but also, to a lesser extent, support  QHSR Mission 1: Preventing Terrorism and Enhancing Security and  Mission 3: Enforcing and Administering Our Immigration Laws. On the  basis of DHS’s alignment of its initiatives, programs, and activities to  QHSR missions, we grouped the 10 functional areas under DHS’s QHSR  missions. In doing so, we recognized that our functional areas, as well as  those key sub-areas that comprise the functional areas, may pertain to  more than one QHSR mission area. For example, under our functional  area of immigration enforcement, our work addressing the sub-area  investigations of immigration offenses addresses DHS programs and  activities that relate to more than one QHSR mission—primarily Mission  3: Enforcing and Administering Our Immigration Laws, and also Mission  2: Securing and Managing Our Borders and Mission 1: Preventing  Terrorism and Enhancing Security. In those cases when a functional area  aligned to more than one QHSR mission, we categorized it under the  QHSR mission that it primarily supported on the basis of our review of  DHS’s QHSR and budget-related documents. In cases when sub-areas  within a functional area supported more than one QHSR mission, we kept  the sub-area with its functional area (e.g., aviation security) and noted to  which other QHSR missions it aligned. We provided DHS with our  alignment of the functional areas to the QHSR missions, and incorporated  the department’s feedback, as appropriate.
To identify key areas of progress and work that remains in the DHS  functional areas, we examined our and the DHS IG’s past reports on DHS  missions, programs, and operations, including recommendations we and  the DHS IG have made, and actions DHS has taken or has underway to  address them. We also identified preliminary observations from our  ongoing work in some key areas. In doing so, we identified factors that  have affected DHS progress in the functional areas. Our work and the  work of the DHS IG have covered many of DHS’s key programs,  operations, and activities. In this report, we highlight our key work in these  areas, but do not address all products we or the DHS IG have issued  related to DHS, nor did we address all of the sub-areas or DHS’s  homeland security-related activities and efforts. We selected, in  consultation with our subject matter experts, key work we and the DHS IG  have completed related to the functional areas and sub-areas. We  examined the methodologies used by the DHS IG in its reports, including  reviewing the scope, methodological steps, and limitations. We  determined that the DHS IG reports were sufficiently reliable for the  purposes of our report to provide examples, and to supplement our work,  of DHS’s progress and work remaining. In addition, we obtained data  from DHS on its budget authority for fiscal years 2004 through 2011, and  funding and staffing levels related to the functional areas, and assessed  the reliability of that data by available documentation. We determined that  the data were sufficiently reliable for the purposes of our report.
We obtained and incorporated feedback on our assessments within the  sub-areas and functional areas from our subject matter experts. In  addition, we provided DHS with drafts of our assessments of DHS  progress and work remaining in each functional area and obtained and  analyzed updated information provided by DHS on these areas. In some  cases, DHS provided us with updated data on its efforts, such as  statistics on technology deployments or program activities. We assessed  the reliability of these data by reviewing available documentation from  DHS. We determined that the data were sufficiently reliable for the  purposes of our report. We included updated information in our  assessments of each sub-area and functional area, based on our review  of this information and our prior work. In some cases, we could not make  an assessment of the updated information DHS provided because we did  not have prior work upon which to base an assessment, or DHS’s  reported actions were in the early stages of implementation, and thus it  was too early to assess the results of these efforts. We noted these  instances in our report.
To identify crosscutting and management issues that have affected  DHS’s implementation efforts, we analyzed the assessments of progress  and work that remains in each functional area. We also examined our and  the DHS IG’s past reports on crosscutting issues, related  recommendations, and actions taken by DHS or that are underway to  address the recommendations. We obtained and incorporated feedback  on the crosscutting issues we identified from our subject matter experts.  In addition, we obtained and incorporated feedback from DHS on our  assessment of crosscutting issues that have affected the department’s  mission implementation efforts, including updated information from DHS  pertaining to these crosscutting issues. We incorporated updated  information into our assessments based on our review of this information  and our prior work. In some cases, we could not make an assessment of  the updated information DHS provided because we did not have prior  work upon which to base an assessment. We noted these instances in  our report.
Our assessments of the progress made by DHS in the functional areas  and sub-areas, as well as our analyses of crosscutting issues, are based  primarly on our issued reports, and supplemented by DHS IG reports. As  such, the assessments of progress do not reflect, nor are they intended to  reflect, the extent to which DHS’s actions have made the nation more  secure in each area. Additionally, we do not intend to imply that our  discussion of progress and work remaining in the functional areas and  sub-areas, considered separately or together, reflect DHS’s progress in  implementing all of its missions. We also did not assign a qualitative  rating of progress for each area. DHS developed other performance  measures against which to gauge its progress in fiscal year 2011, but has  not yet reported on these measures. As such, the department did not  have data available across a consistent baseline against which to assess  its progress from fiscal years 2004 through 2011. Therefore, we were not  able to assess DHS’s progress against a baseline for each functional  area and sub-area, and we did not apply a weight to the expectations or  sub-areas. We also did not consider DHS component agencies’ funding  levels or the extent to which funding levels have affected the  department’s ability to carry out its missions as this was not included in  the scope of our prior reviews. Further, we did not consider the extent to  which competing priorities; external and internal events, such as  departmental reorganizations; and resource demands have affected  DHS’s progress in each area relative to other areas, although competing  priorities, events, and resource demands have affected DHS’s progress in  specific areas.
In addition, because we and the DHS IG have completed varying degrees  of work (in terms of the amount and scope of reviews completed) for each  functional area and because different DHS components and offices  provided us with different amounts and types of information, our  assessments of DHS’s progress in each area reflect the information  available for our review and analysis and are not necessarily equally  comprehensive across all 10 areas. Further, for some sub-areas, we were  unable to make an assessment of DHS’s progress because we and the  DHS IG have not conducted recent work in that area or have conducted  limited work. More detailed information on those sub-areas for which we  did not make an assessment is included in appendices III through XII.
We conducted this performance audit from April 2011 through September  2011, in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix III: Aviation Security
subsections: section_title: What This Area Includes
paragraphs: The Transportation Security Administration (TSA), within the Department  of Homeland Security (DHS), is the lead federal agency responsible for  securing all modes of transportation, including aviation. As part of these  responsibilities, TSA performs or oversees the performance of security  operations at the nation’s more than 460 commercial airports.Key  elements that comprise aviation security include:   the aviation security workforce, including hiring, training, and  deploying a screening workforce;     passenger prescreening—comparing passenger information to the  Selectee and No Fly lists;     passenger checkpoint screening, including using staff, policies and  procedures, and technology to address potential vulnerabilities;     checked baggage screening, including deploying explosives detection  systems and other technologies to screen baggage for explosives;     air cargo screening, which involves using staff, policies and  procedures, and technology to screen domestic and high-risk  international inbound air cargo transported on passenger aircraft; and    security of airports, including airport perimeter security and access  controls.
For fiscal year 2011, TSA had about 54,800 personnel and its budget  authority was about $7.7 billion. Aviation security falls primarily within the  Quadrennial Homeland Security Review Mission 1: Preventing Terrorism  and Enhancing Security.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. For example, while DHS's  responsibilities related to aviation security also include aviation security  strategic planning and coordination, we are not reporting on this area.  TSA also relies upon additional programs to deter, detect, and disrupt  persons or threats posing a potential risk to aviation security, such as  travel document checkers, who examine tickets and forms of  identification; random employee screening; intelligence gathering and  analysis; random canine team searches at airports; federal air marshals,  who provide federal law enforcement presence on selected flights; and  reinforced cockpit doors; as well as other measures both visible and  invisible to the public. Further, TSA has additional plans and programs  related to aviation security, such as TSA’s plans to conduct a pilot  program on expedited checkpoint screening for low-risk travelers, and  TSA’s Transportation Systems Integration Facility which supports the  development and deployment of new technologies. We have not  completed work on these areas upon which to make an assessment of  DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that over  the past 10 years, TSA has enhanced aviation security in key areas  related to the aviation security workforce, passenger prescreening,  passenger checkpoint screening, checked baggage screening, air cargo  security, and security of airports. For example, TSA hired, trained, and  deployed a federal screening workforce. Additionally, after initial difficulty  in fielding the program, TSA developed and implemented Secure Flight, a  passenger prescreening program through which the federal government  now screens all passengers on all domestic and international commercial  flights to, from, and within the United States. DHS also developed new  programs and is utilizing new technologies to screen passengers and  checked baggage, and enhanced the security of domestic and in-bound  air cargo. TSA also strengthened security at U.S. airports by assessing  risks to airport perimeters and access controls. However, our work has  shown that more work remains in these areas. For example, a risk-based  strategy and a cost-benefit analysis of airport checkpoint technologies  would improve passenger checkpoint screening. Further, TSA does not  yet have a procurement plan and schedule for checked baggage  screening technologies that would better position TSA to meet recently  enhanced explosive detection requirements. Additionally, TSA does not  yet have a mechanism to verify the accuracy of domestic and inbound air  cargo screening data. Finally, the security of airports would be  strengthened by establishing an evaluation plan for pilot tests to screen  workers. Table 7 provides more detailed information on our assessment  of DHS’s progress and remaining work in key areas on which we have  reported, with an emphasis on work completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Steve Lord at (202)  512-4379 or lords@gao.gov.
section_title: Appendix IV: Chemical, Biological, Radiological, and Nuclear Threats
subsections: section_title: What This Area Includes
paragraphs: The Department of Homeland Security (DHS) leads federal interagency  coordination and planning for emergency response to catastrophic events  such as chemical, biological, radiological, and nuclear (CBRN) incidents  in the United States, and is responsible for assessing the risks posed by  various CBRN agents. These efforts include (1) assessing risks, and (2)  developing and deploying capabilities to detect and mitigate CBRN  threats. Within DHS, the Science and Technology Directorate (S&T) is  responsible for developing, in consultation with other appropriate  executive agencies, a national policy and strategic plan for identifying  priorities, goals, objectives and policies for, and coordinating the federal  government’s civilian efforts to identify and develop countermeasures to  chemical and biological threats. The Domestic Nuclear Detection Office  (DNDO) is responsible for developing, acquiring, and supporting the  deployment of a system to detect and report on attempts to develop,  transport, or use unauthorized nuclear explosive, fissile, or radiological  materials or explosives in the United States. The Office of Health Affairs  provides health and medical expertise in support of the DHS mission to  prepare for, respond to, and recover from all threats, and leads and  coordinates the department’s biological and chemical defense activities.
For fiscal year 2011, S&T had about 450 personnel and budget authority  of about $830 million. For fiscal year 2011, DNDO had about 130  personnel and budget authority of approximately $340 million. For fiscal  year 2011, the Office of Health Affairs had about 95 personnel and  budget authority of approximately $140 million. Chemical, biological,  radiological, and nuclear threats assessment, detection, and mitigation  primarily falls within the Quadrennial Homeland Security Review Mission  1: Preventing Terrorism and Enhancing Security.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. DHS has developed and implemented  other efforts related to CBRN assessments and detection and mitigation  capabilities on which we are not reporting. For example, DHS has  initiated efforts related to incidents involving contaminated debris,  biodefense exercises and notification procedures for biological attacks.  Further, in August 2011 DHS reported to us that it had (1) developed a  strategic plan and issued guidance for biological threat prevention and  response; (2) established a steering committee for anthrax preparedness  and response; and (3) established a program that is developing best  practices guidance and decision support tools for federal, state, and local  stakeholders for preparedness and response to high consequence  chemical incidents. DHS also reported launching a National Nuclear  Forensics Expertise Development Program in fiscal year 2008 to enhance  academic programs and expertise development opportunities in nuclear  forensics. Moreover, DHS reported that it was leading development of a  national strategic plan for improving nuclear forensics capabilities in the  United States. We have not completed work on these areas upon which  to make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work has shown that DHS made progress in assessing risks posed  by CBRN threats, developing CBRN detection capabilities, planning for  nuclear detection, and conducting radiation detection. However, important  efforts related to these areas have not been completed. For example,  DHS conducted risk assessments for CBRN agents, but should better  coordinate with the Department of Health and Human Services by  developing written policies and procedures governing development of the  assessments. DHS also developed the BioWatch program, which  provides early detection of biological threats. However, the next  generation of the system, which is to have additional detection capability,  has not yet been operationally deployed. Further, DHS established the  National Biosurveillance Integration Center, but the center lacks  resources necessary for operations, such as data and personnel from its  partner agencies. In August 2011, DHS reported that, among other  actions, its Office of Health Affairs had begun to develop a new strategy  for the Center. DNDO coordinated the development of a strategic plan for  the global nuclear detection architecture—a multidepartment effort to  protect against terrorist attacks using nuclear and radiological materials  through coordinated activities—and DHS made progress in deploying  radiation detection equipment. However, work remains in implementing  the global nuclear detection strategy, and DHS faced difficulties in  developing new technologies to detect radiological and nuclear materials.  For example, DHS’s strategic plan for the global nuclear detection  architecture addressed some key components of what we previously  recommended be included in a strategic plan, such as identifying the  roles and responsibilities for meeting strategic objectives. However, the  plan did not identify funding needed to achieve the strategic plan’s  objectives, or employed monitoring mechanisms for determining  programmatic progress and identifying needed improvements. Table 8  provides more detailed information on our assessment of DHS’s progress  and remaining work in key areas on which we have reported, with an  emphasis on work completed since 2008.
section_title: GAO Contacts
paragraphs: For additional information about this area, contact William O. Jenkins, Jr.  at (202) 512-8757 or jenkinswo@gao.gov, or Gene Aloise at 202-512- 6870 or aloisee@gao.gov.
section_title: Appendix V: Critical Infrastructure Protection—Physical Assets
subsections: section_title: What This Area Includes
paragraphs: Under the Homeland Security Act of 2002, the Department of Homeland  Security (DHS) has wide-ranging responsibility to lead and coordinate the  nation’s efforts to secure critical infrastructure. DHS’s key responsibilities  and efforts include (1) risk assessment and planning; (2) protection and  resiliency; and (3) partnerships and coordination mechanisms. DHS leads  and coordinates the nation’s efforts to enhance protection and resiliency  for 18 critical infrastructure sectors. Within DHS, three components are  charged with lead responsibility over 11 of the 18 sectors. Specifically,  within DHS’s National Protection and Programs Directorate (NPPD), the  Office of Infrastructure Protection is responsible for the chemical;  commercial facilities; critical manufacturing; dams; emergency services;  and nuclear reactors, materials, and waste sectors. Also within NPPD, the  Office of Cybersecurity and Communications is responsible for the  communications and information technology sectors, and the Federal  Protective Service (FPS) is responsible for the government facilities  sector. The Transportation Security Administration (TSA) is responsible  for the postal and shipping sector and in turn shares responsibility with  the U.S. Coast Guard for the transportation systems sector. As the  primary component responsible for critical infrastructure protection via its  Office of Infrastructure Protection, for fiscal year 2011 NPPD had about  2,800 personnel and its budget authority was about $2.3 billion. Critical  infrastructure protection of physical assets primarily falls within the  Quadrennial Homeland Security Review Mission 1: Preventing Terrorism  and Enhancing Security.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. DHS has developed and implemented  other efforts related to critical infrastructure protection on which we are  not reporting. For example, according to DHS, it is currently developing  measures for critical infrastructure protection and resiliency as part of its  efforts to develop the National Preparedness Goal and National  Preparedness System directed by Presidential Policy Directive 8: National  Preparedness. DHS stated that as part of this effort, it is examining the  extent to which these measures incorporate crosscutting considerations  such as sustainability, durability, and energy efficiency. As these efforts  relate to critical infrastructure protection, we have not completed work on  them upon which to make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the DHS IG’s work, has shown that DHS  expanded its efforts to conduct risk assessments and planning, provide  for protection and resiliency, and implement partnerships and  coordination mechanisms for physical critical assets. DHS updated the  National Infrastructure Protection Plan to include an emphasis on  resiliency (the capacity to resist, absorb, or successfully adapt, respond  to, or recover from disasters), and an enhanced discussion about DHS  risk management. Also, in the National Infrastructure Protection Plan,  DHS expanded the discussion of its program to prioritize assets and  systems for each of the 18 sectors according to their importance,  nationally or regionally. Further, DHS took steps to coordinate with critical  infrastructure protection stakeholders through information sharing  mechanisms such as council meetings. However, our work and that of the  DHS IG has shown that key challenges remain in these areas. For  example, DHS’s state and local partners who are to provide data for the  development of annual lists of critical infrastructure assets and systems  noted that time and resource constraints can adversely affect the  process. Furthermore, DHS has not fully implemented an approach to  measure its effectiveness in working with critical asset owners and  operators in their efforts to adopt measures to mitigate resiliency gaps  identified during various vulnerability assessments. Moreover, the scope  of some risk assessments has been limited and assessment results have  not been consistently incorporated into planning efforts. In addition, DHS  should take additional action to address barriers faced in sharing  information about resiliency strategies with critical infrastructure partners.  Table 9 provides more detailed information on our assessment of DHS’s  progress and remaining work in key areas on which we have reported,  with an emphasis on work completed since 2008.
section_title: GAO Contacts
paragraphs: For additional information about this area, contact Stephen L. Caldwell at  (202) 512-9610 or caldwells@gao.gov for overall critical infrastructure  protection, or Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov  for government facilities.
section_title: Appendix VI: Surface Transportation Security
subsections: section_title: What This Area Includes
paragraphs: The Transportation Security Administration (TSA), within the Department  of Homeland Security (DHS), is the lead federal agency responsible for  overseeing security of all surface transportation modes, which include  passenger and freight rail; mass transit; highways, including commercial  vehicles; and pipelines. Although TSA has primary responsibility for  overseeing surface transportation security, this responsibility is shared  with federal, state, and local governments and the private sector. For  example, public and private operators are responsible for securing their  transportation systems. Key areas within surface transportation security  include: (1) risk assessment and planning; (2) standards, inspections, and  training; (3) grants; and (4) information sharing. As the primary  component responsible for surface transportation security, for fiscal year  2011, TSA had about 54,800 personnel and its budget authority was  about $7.7 billion for fiscal year 2011, most of which is devoted to aviation  security functions. Surface transportation security falls primarily within the  Quadrennial Homeland Security Review Mission 1: Preventing Terrorism  and Enhancing Security.
For the purposes of this report, we are generally focusing on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported, and not on areas in which our two agencies have not reported  or have conducted limited audit work. DHS developed and implemented  additional efforts related to surface transportation security on which we  are not reporting. These include, among other things, the Surface  Transportation Security Priority Assessment—a public-private study  which identified recommendations to enhance surface transportation  security; the National Explosives Detection Canine Program; the Baseline  Assessment for Security Enhancement—a security assessment program  designed to evaluate 17 security and emergency management action  items for mass transit and passenger rail networks; a training program in  Pueblo, Colorado for highway surface transportation inspectors; the  Intermodal Security Training and Exercise Program, which is a training  and exercise program for the transportation industry developed by TSA,  in collaboration with other federal agencies and commercial security  vendors; and standard processes for law enforcement to identify and  report suspicious incidents or activities throughout the Amtrak rail system  and share that information nationally so it can be analyzed to identify  broader trends. We have not completed work in these areas upon which  to make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that  DHS, particularly TSA, expanded its efforts in key areas on which we  have reported, such as risk assessments and strategic planning; surface  transportation inspector workforce; grants administration; and information  sharing. For example, in 2009 we reported that TSA had begun  conducting threat and vulnerability assessments of the commercial  vehicle industry and that TSA and other DHS agencies conducted threat,  vulnerability, and consequence assessments of highway infrastructure,  freight rail, and mass transit. TSA also developed a transportation sector  security risk assessment that assessed risk within and across the various  transportation modes. In addition, since 2008, TSA more than doubled its  surface transportation inspector workforce and reported that, as of July  2011, its surface inspectors conducted over 1,300 site visits to mass  transit and passenger rail stations to complete station profiles, among  other things. Moreover, we reported in June 2009 that DHS used a risk  analysis model to allocate Transit Security Grant Program funding and  award grants to higher-risk transit agencies. Further, TSA expanded its  sharing of surface transportation security information by establishing  information networks.
However, we have identified work remaining in these areas. For example,  TSA has strengthened its risk assessments for surface transportation  modes, but efforts to further improve elements of these assessments are  in the early stages of implementation. Further, TSA has not yet completed  an analysis of its surface inspector workforce to direct current and future  program needs. Moreover, TSA has not issued regulations for security  training programs for mass transit, rail, and bus employees, as required  by the Implementing Recommendations of the 9/11 Commission Act of  2007. Additionally, we found that TSA should strengthen the  management of its program for providing grant funds to transit agencies,  and that its information sharing efforts would benefit from improved  streamlining and coordination. Table 10 provides more detailed  information on our assessment of DHS’s progress and remaining work in  key areas on which we have reported, with an emphasis on work  completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Steve Lord at (202)  512-4379 or lords@gao.gov.
section_title: Appendix VII: Border Security
subsections: section_title: What This Area Includes
paragraphs: Within the Department of Homeland Security (DHS), U.S. Customs and  Border Protection (CBP) is the lead agency responsible for implementing  the department’s border security mission. Key areas include   inspecting travelers at ports of entry;   inspecting cargo and goods at ports of entry while facilitating  commerce; securing the border between ports of entry, for example, to reduce  illegal immigration through the use of fencing and technology; enhancing visa adjudication security and preventing travel document collaborating with other stakeholders on border security efforts.
As the primary component responsible for border security, for fiscal year  2011, CBP had approximately 61,000 personnel and its budget authority  was about $11.3 billion. Border security primarily falls within the  Quadrennial Homeland Security Review Mission 2: Securing and  Managing our Borders.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. For example, while DHS's  responsibilities related to border security also include managing border  security resources, such as facilities, assets and human capital, we are  not reporting on DHS's progress and work remaining in these areas. DHS  also has other border security efforts underway on which we are not  reporting. For example, CBP developed and implemented a number of  border security programs and efforts to, among other things, address  threats posed by the illicit narcotics trade, and acquire or develop new  technologies for the southern and northern borders—such as detection  sensors to detect illicit tunnels at the southern border. CBP also  developed new border security strategies with Canada and Mexico. Other  specific programs implemented by CBP include the Immigration Advisory  Program, in which CBP officers are posted at foreign airports and work  with host countries’ border security agencies and airlines to identify  potentially inadmissible aliens, including those who may have ties to  terrorism, prior to boarding commercial aircraft to the United States; and  the National Targeting Center and the Automated Targeting System for  identifying high-risk travelers and cargo. We have not completed recent  work on these areas upon which to make an assessment of DHS’s  progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that DHS  has expanded its efforts in key border security areas, such as inspection  of travelers, cargo, and goods at ports of entry; security of the border  between ports of entry; visa adjudication and travel document security;  and collaboration with other border security stakeholders. For example,  our work has shown that DHS has undertaken efforts to keep terrorists  and other dangerous people from entering the country, and from October  1, 2010, through June 30, 2011, CBP reported encountering over 164,000  individuals at ports of entry who were found to be inadmissible into the  United States. In addition, checkpoints generally located 25 to 100 miles  from the border have contributed to DHS’s ability to seize illegal drugs,  apprehend removable aliens, and encounter known or suspected  terrorists. According to Border Patrol data, checkpoint operations  accounted for over one-third of the Border Patrol’s total drug seizures.  However, our work and that of the IG have shown that key challenges  remain in these efforts. For example, addressing weaknesses in port of  entry traveler inspection procedures and infrastructure would increase  assurance that dangerous people and illegal goods would be interdicted  at the border. DHS has also not yet decided how to implement a biometric  system for recording foreign nationals’ exit from the United States.  Further, DHS experienced schedule delays and performance problems  with its information technology program for securing the border between  ports of entry—the Secure Border Initiative Network (SBInet)—which  DHS canceled. Because of the program’s decreased scope, uncertain  timing, unclear costs, and limited life cycle management, it was unclear  whether DHS’s pursuit of the program was cost-effective. DHS is  transitioning to a new approach for border technology, which we are  assessing. DHS also should establish performance measures or  management controls for key border security programs. Table 11  provides more detailed information on our assessment of DHS’s progress  and remaining work in key areas on which we have reported, with an  emphasis on work completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Richard M. Stana at  (202) 512-8816 or stanar@gao.gov.
section_title: Appendix VIII: Maritime Security
subsections: section_title: What This Area Includes
paragraphs: Within the Department of Homeland Security (DHS), the U.S. Coast  Guard has primary responsibility for maritime security, while various  component agencies also contribute to maritime security efforts, including  U.S. Customs and Border Protection (CBP), the Transportation Security  Administration (TSA), and the Domestic Nuclear Detection Office  (DNDO). Key areas within maritime security include (1) port facility and  vessel security; (2) maritime domain awareness and information sharing;  and (3) international supply chain security. The Coast Guard is  responsible for ensuring the safety and security of U.S. maritime interests  and leading homeland security efforts in the maritime domain. In this  capacity, among other things, it conducts port facility inspections, leads  the coordination of maritime information sharing efforts, and promotes  domain awareness in the maritime environment. CBP is responsible for  the maritime screening of incoming commercial cargo for the presence of  contraband, such as explosives, while facilitating the flow of legitimate  trade, cargo, and passengers. TSA and the Coast Guard have  responsibility for the implementation and enforcement, respectively, of the  Transportation Worker Identification Credential program to manage the  access of maritime workers to regulated maritime facilities. DNDO is  responsible for acquiring and supporting the deployment of radiation  detection equipment, including portal monitors. As one of the primary  components responsible for maritime security protection, for fiscal year  2011 the Coast Guard had about 50,000 personnel, including civilian and  military, and its budget authority was about $10.2 billion. Maritime  security primarily falls within the Quadrennial Homeland Security Review  Mission 2: Securing and Managing our Borders.
For the purposes of this report, we are generally focusing on key areas on  which we and the DHS Office of Inspector General (IG) have recently  reported, and not on areas in which our two agencies have not reported  or have conducted limited audit work. For example, while DHS's  responsibilities related to maritime security also include maritime security  national planning, we are not discussing DHS's progress and work  remaining in this area. DHS has developed and implemented other efforts  related to maritime security. For example, according to the Coast Guard,  its maritime security programs are part of a layered strategy that begins  far from our ports. Coast Guard officials noted that their security regime  includes close coordination with international and regional organizations  (such as the International Maritime Organization and the European  Union), and individual country's coast guard equivalent agencies; security  inspections of, and technical assistance to, foreign ports; and maintaining  a multi-mission fleet of cutters patrolling our coastal approaches. The  Coast Guard also noted that some of its other missions—those not  directly part of its ports, waterways, and coastal security mission—can  contribute to homeland security.
Further, in July 2011, the Coast Guard reported that it had specific  initiatives underway to enhance maritime security planning at the port  level, on which we have not previously reported. Specifically, Coast  Guard reported that it had updated 43 port-level Area Maritime Security  Plans that covered prevention, protection, security response, and short- term recovery, and that these plans were approved by Coast Guard  district and area commanders. The Coast Guard further reported that it  was working closely with maritime committees and stakeholders to  maintain and annually exercise these port-level plans. We have not  completed work on these areas upon which to make an assessment.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that  DHS’s components, particularly the Coast Guard and CBP, have  expanded their efforts in key areas, such as port facility and vessel  security; maritime domain awareness and information sharing; and  international supply chain security. The Coast Guard strengthened risk  management through the development of a risk assessment model, and  developed a strategy and programs intended to address risks to maritime  facilities and passenger and commodity vessels. In addition, the Coast  Guard increased maritime domain awareness through interagency  operational centers, implementing a vessel tracking system, and  identifying awareness gaps in the Arctic. For example, in July 2011, DHS  reported that it had completed an interagency review of maritime domain  awareness requirements resulting in the publication of a document that  included key strategic capabilities, objectives, resources, and evaluative  methods needed to maintain maritime domain awareness. Further, in July  2011 DHS reported that CBP developed the Small Vessel Reporting  System to allow for better tracking of small boats arriving from foreign  locations, and deployed this system to eight of CBP’s field locations. DHS  also developed a layered security strategy for cargo container security,  including deploying screening technologies and partnering with foreign  governments.
However, our work and that of the DHS IG has shown that more work  remains. For example, DHS components’ efforts to assess the  effectiveness of programs to secure maritime facilities should be  improved. We found that because of a lack of technology capability, DHS  does not electronically verify identity and immigration status of foreign  seafarers as part of its admissibility inspection process, thus limiting the  assurance that fraud could be identified among documents presented by  them. DHS also had not assessed the risks of not having this capability,  which is not expected to be available for several years. Further, DHS and  its partners should enhance efforts to improve maritime domain  awareness by, for example, further strengthening tracking of small  vessels. In addition, although DHS developed the Transportation Worker  Identification Credential program, we found that the program’s controls  were not designed to provide reasonable assurance that only qualified  applicants acquire credentials. For example, during covert tests of the  Transportation Worker Identification Credential at several selected ports,  our investigators were successful in accessing ports using counterfeit  credentials and authentic credentials acquired through fraudulent means.  Table 12 provides more detailed information on our assessment of DHS’s  progress and work remaining in key areas on which we have reported,  with an emphasis on work completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Stephen L. Caldwell at  (202) 512-9610 or caldwells@gao.gov.
section_title: Appendix IX: Immigration Enforcement
subsections: section_title: What This Area Includes
paragraphs: The Department of Homeland Security (DHS) is responsible for enforcing  U.S. immigration and customs laws, and within DHS, U.S. Immigration  and Customs Enforcement (ICE) is primarily responsible for immigration  and customs enforcement efforts. ICE’s key responsibilities and efforts  within immigration enforcement include (1) investigating and taking action  to address individuals who have committed immigration and customs  offenses, such as overstays; addressing immigration law violations at the  workplace; investigating human trafficking and smuggling operations; and  combating illicit smuggling of firearms, narcotics, and illicit proceeds; and  (2) identifying, detaining, and removing aliens subject to removal. As the  primary component responsible for immigration and customs  enforcement, for fiscal year 2011 ICE had about 20,000 personnel, and  its budget authority was about $5.8 billion. Immigration enforcement falls  primarily within the Quadrennial Homeland Security Review Mission 3:  Enforcing and Administering Our Immigration Laws.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported, and not on areas in which our two agencies have not reported  or have conducted limited audit work. For example, while DHS's  responsibilities related to immigration enforcement also include the  management and training of immigration enforcement human capital, we  are not reporting on DHS's progress in this area. Additionally, ICE’s  customs enforcement efforts include investigations of such offenses as  money laundering and other financial crimes. Specifically, ICE reports  efforts to address money laundering, including coordinating with federal,  state, local, and foreign law enforcement to conduct multi-jurisdictional  criminal investigations targeting organizations involved in the movement  and smuggling of illicit proceeds. ICE also reported developing, in  collaboration with Mexico, a study of the processes and methods used by  transnational criminal organizations to move illicit money from the United  States into other countries. We have not completed work on these areas  upon which to make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that  DHS, particularly ICE, expanded its immigration and customs  enforcement programs and activities in key areas on which we have  reported, such as overstay enforcement, compliance with workplace  immigration laws, alien smuggling, and firearms trafficking. For example,  ICE increased its resources for investigating overstays and alien  smuggling operations, and deployed border enforcement task forces to  investigate illicit smuggling of people and goods, including firearms. In  addition, DHS took action to improve the E-Verify program, which  provides employers a voluntary tool for verifying an employee’s  authorization to work in the United States. Specifically, in April 2011 we  reported that DHS increased the E-Verify program’s accuracy by  expanding the number of databases it can query, took actions to  safeguard the privacy of personal information for employees who are  processed through E-Verify, and implemented steps to prepare for  possible mandatory implementation of E-Verify for all employers  nationwide. ICE also expanded its programs for identifying and removing  aliens from the United States to include, for example, entering into  agreements with state and local jurisdictions to assist in identifying aliens  subject to removal. However, our work has shown that work remains in  these areas. For example, ICE took action to address a small portion of  the estimated overstay population in the United States, and lacks  measures for assessing its progress in addressing overstays. Moreover,  ICE should better leverage opportunities to strengthen its alien smuggling  enforcement efforts by assessing the possible use of various investigative  techniques, and CBP should better assess progress made in achieving its  alien smuggling-related program objectives. We have also reported on  weaknesses with the E-Verify program, including challenges in accurately  estimating E-Verify costs that put DHS at an increased risk of not making  informed investment decisions and developing justifiable budget requests  for future E-Verify use and potential mandatory implementation of it.  Table 13 provides more detailed information on our assessment of DHS’s  progress and remaining work in key areas on which we have reported,  with an emphasis on work completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Richard M. Stana at  (202) 512-8816 or stanar@gao.gov.
section_title: Appendix X: Immigration Services
subsections: section_title: What This Area Includes
paragraphs: Within the Department of Homeland Security (DHS), U.S. Citizenship and  Immigration Services (USCIS) is the agency primarily responsible for  providing immigration services in the United States and internationally at  U.S. embassies, consulates and refugee centers. USCIS’s key  responsibilities and efforts within immigration services include:     administering immigration benefits, such as processing millions of  applications and petitions received each year for about 50 types of  immigration benefits for persons seeking to study, work, visit, or live  in the United States, and to become U.S. citizens; and     detecting and resolving suspicious information about and reviewing  evidence provided by benefits applicants and petitioners and referring  them for fraud investigation and possible sanctioning by other DHS  components or external agencies, as appropriate.
As the primary component responsible for immigration services, for fiscal  year 2011 USCIS had about 12,000 personnel, and its budget authority  was about $2.6 billion. Immigration enforcement falls primarily within the  Quadrennial Homeland Security Review Mission 3: Enforcing and  Administering Our Immigration Laws.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. For example, while DHS's  responsibilities related to immigration services also include immigrant  integration, we have not reported on DHS's progress and work remaining  in this area. According to USCIS documentation provided to us in July  2011, the agency has undertaken initiatives to support immigrant  integration, particularly related to citizenship, including, among other  things, outreach, grants for education programs, and improved tools and  resources on the citizenship and naturalization process. We currently  have work underway for the House Committee on Homeland Security  assessing USCIS’s immigrant integration efforts, and plan to report on the  results of our work later this year.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that  DHS, particularly USCIS, improved the quality and efficiency of the  immigration benefit administration process, and strengthened its  immigration fraud detection and deterrence efforts. For example, USCIS  initiated efforts to modernize its immigration benefit administration  infrastructure; improve the efficiency and timeliness of its   application intake process; and ensure quality in its benefit adjudication  processes. In September 2008 we reported that the USCIS Asylum  Division designed training programs and quality reviews to help ensure  the integrity of asylum adjudications. In addition, in 2004 DHS established  the Office of Fraud Detection and National Security, now a directorate, to  lead immigration fraud detection and deterrence efforts, and this  directorate has since developed and implemented strategies for this  purpose. Further, in July 2011, USCIS reported that it completed the  development of a database for analyzing fraud—the Fraud Detection and  National Security Data System—which it uses to collect data on fraud and  national security concerns. In addition, among other things, USCIS  implemented the Administrative Site Visit and Verification Program,  through which it conducts pre-and post-adjudication site visit inspections  to verify information contained in certain visa petitions.
However, our work and that of the DHS IG have shown that work remains  in these areas. For example, USCIS’s program for transforming its  immigration benefit processing infrastructure and business practices from  paper-based to digital systems missed its planned milestones by more  than 2 years, and has been hampered by management challenges, such  as insufficient planning and not preparing key DHS acquisition planning  documents before selecting a contractor to obtain the capabilities needed  to transition to an electronic adjudication process. USCIS should also  take additional action to address vulnerabilities identified in its  assessments intended to determine the extent and nature of fraud in  certain applications. Further, in September 2008 we reported that, despite  mechanisms USCIS had designed to help asylum officers assess the  authenticity of asylum claims, such as identity and security checks and  fraud prevention teams, asylum officers cited challenges in identifying  fraud as a key factor affecting their adjudications. Table 14 provides more  detailed information on our assessment of DHS’s progress and remaining  work in key areas on which we have reported, with an emphasis on work  completed since 2008.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Richard M. Stana at  (202) 512-8816 or stanar@gao.gov.
section_title: Appendix XI: Critical Infrastructure Protection—Cyber Assets
subsections: section_title: What This Area Includes
paragraphs: The Department of Homeland Security (DHS) has overall responsibility  for coordinating critical infrastructure protection efforts for 18 critical  infrastructure sectors—such as energy, water, and communications.  Within DHS, the National Protection and Programs Directorate’s (NPPD)  Office of Cybersecurity and Communications (CS&C) is charged with  enhancing the security, resiliency, and reliability of the nation's cyber and  communications infrastructure. CS&C’s key responsibilities and efforts  related to cybersecurity include (1) risk assessment and planning; (2)  protection and resiliency; and (3) partnerships and coordination  mechanisms. As the primary DHS component responsible for  safeguarding physical and cyber assets, in fiscal year 2011 NPPD, which  includes CS&C, had about 2,800 personnel and its budget authority was  about $2.3 billion. Critical infrastructure protection of cyber assets  primarily falls within the Quadrennial Homeland Security Review Mission  4: Safeguarding and Securing Cyberspace. but in the February 2011 high-risk update we identified several areas of  responsibility that required further attention, such as advancing cyber  analysis and warning capabilities, acquiring sufficient analytical and  technical capabilities, and strengthening the effectiveness of the public- private sector partnerships in securing cyber critical infrastructure. In  January 2011, DHS provided us with a corrective action plan for this high- risk area. We provided DHS with feedback on this plan noting, for  example, that the plan included objectives, milestones, and planned  accomplishments related to DHS’s cybersecurity responsibilities.  However, we identified aspects of the plan that should be strengthened,  such as clarifying whether DHS’s 2010 goals and objectives for its  corrective actions were met, and identifying resources needed and  planned milestones for 2011 activities.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. DHS has other ongoing efforts related  to cyber critical infrastructure protection, such as the assessment of  cybersecurity measures implemented at high-risk chemical facilities as  part of its Chemical Facility Anti-Terrorism Standards program, on which  we have not reported. DHS also established the National Cybersecurity  and Communications Integration Center in October 2009 to serve as a  national cyber and communications operations center to fuse information  from federal civilian agencies, law enforcement, intelligence, state and  local government, and the private sector. Further, DHS signed a  memorandum of agreement with the Department of Defense to improve  cyber coordination. In addition, according to DHS officials, NPPD’s  Office of Infrastructure Protection and the National Cyber Security  Division collaborated to integrate cybersecurity elements into the Office of  Infrastructure Protection’s facility security and vulnerability assessments.  The National Cyber Security Division also conducts cyber assessments in  support of the Office of Infrastructure Protection’s Regional Resiliency  Assessment Program and major national events, according to DHS. We  have not completed work on these areas upon which to make an  assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by the work of the DHS IG, has shown that DHS  expanded its efforts to conduct cybersecurity risk assessments and  planning, provide for the protection and resilience of cyber assets, and  implement cybersecurity partnerships and coordination mechanisms. For  example, DHS updated the National Infrastructure Protection Plan to  include an emphasis on cybersecurity issues by listing progress made  and new initiatives related to cybersecurity. In addition, DHS took steps to  secure external network connections in use by the federal government by  establishing the National Cybersecurity Protection System, operationally  known as Einstein, to analyze computer network traffic information to and  from agencies. Additionally, the agency made progress in enhancing its  cyber analysis and incident warning capabilities through the  establishment of the U.S. Computer Emergency Readiness Team, which,  among other things, coordinates the nation’s efforts to prepare for,  prevent, and respond to cyber threats to systems and communications  networks. DHS is also working to improve cyber-related partnerships with  public and private stakeholders by developing new information-sharing  arrangements and addressing corrective actions based on a  cybersecurity exercise. In September 2008, we reported that since  conducting a major cyber attack exercise, called Cyber Storm, DHS  demonstrated progress in addressing lessons it had learned from these  efforts to strengthen public and private incident response capabilities.
However, our work and that of the DHS IG has also shown that key  challenges remain in these efforts. For example, to expand its protection  and resiliency efforts, DHS needs to lead a concerted effort to consolidate  and better secure Internet connections at federal agencies. DHS also  faces challenges in fully establishing a comprehensive national cyber  analysis and warning capability. For example, in July 2008, we reported  that the U.S. Computer Emergency Readiness Team did not fully address  15 key attributes of cyber analysis and warning capabilities. Moreover,  the DHS IG reported that DHS needs to establish a consolidated, multiple  classification level portal that can be accessed by federal partners with  real-time incident response related information and reports. Additionally,  expectations of private sector stakeholders are not being met by their  federal partners in areas related to sharing information about cyber-based  threats to critical infrastructure. We also reported that public sector  stakeholders believed that improvements could be made by improving  private sector sharing of sensitive information. Table 15 provides more  detailed information on our assessment of DHS’s progress and remaining  work in key areas on which we have reported, with an emphasis on work  completed since 2008.
subsections: section_title: Area
paragraphs: DHS took steps to secure  external network connections in  use by the federal government,  and to coordinate the nation’s  efforts to prepare for, prevent,  and respond to cyber threats to  systems and communications  networks. However, to expand  protection and resiliency efforts,  concerted effort is needed to  consolidate and secure Internet  connections at federal agencies.  DHS also faces challenges in  establishing a comprehensive  national cyber analysis and  warning capability.
Summary of key progress and work remaining  We recommended that DHS (1) assess whether existing sector-specific  planning processes should continue to be the nation’s approach to securing  cyber and other critical infrastructure, and consider whether other options  would provide more effective results; and (2) collaborate with the sectors to  develop plans that fully address cybersecurity requirements. DHS concurred  and reported, for example, that it worked with sector officials to update sector  plans with the goal of fully addressing cyber-related requirements. In 2010, the  sectors issued 18 updated plans to be reviewed by federal agencies, such as  the Office of Management and Budget and DHS. As of August 2011, DHS  officials stated that 17 plans were finalized and 1 was in the process of being  reviewed. DHS officials were not able to provide milestones for when the  remaining plan would be finalized, as it is under federal interagency review.  We have not yet reviewed these plans to determine the extent to which they  address specified security requirements. Having plans with complete updates  that address cybersecurity requirements will be important in providing the  nation with information on where we are in implementing associated protective  measures designed to secure and protect the nation’s cyber and other critical  infrastructure.
section_title: Area
paragraphs: Summary of key progress and work remaining  What remains to be done: Although we found that agencies reported benefits  from the Trusted Internet Connection Initiative, none of the 23 agencies we  reviewed met all of the requirements of the Trusted Internet Connections  Initiative, as of September 2009.
section_title: Area
paragraphs: Summary of key progress and work remaining  In addition, DHS officials stated that the department piloted Einstein 3 (the  Comprehensive National Cybersecurity Initiative 3), which is intended to be an  intrusion prevention system that is to automatically detect and respond  appropriately to cyber threats before harm is done. According to DHS officials,  once fully deployed, Einstein 2 and 3 will provide cyber protection capabilities  to more than 110 federal civilian executive branch departments and agencies.  As of July 2011, DHS reported that Einstein 2 was deployed at 16 of 19  access provider agencies and active at 15 of them, and that it is fully deployed  and active at each of the 4 private telecommunications service providers  through which non-access provider agencies seek Managed Trusted Internet  Protocol Services. Taking steps to expand cyber protection capabilities to  additional federal departments and agencies should help to improve the  nation’s cyber infrastructure if those capabilities are implemented effectively.  However, we have not yet assessed the effectiveness of these efforts as DHS  is in the process of deploying Einstein 2 and 3.  With the establishment of the U.S. Computer Emergency Readiness  Team, DHS took steps to coordinate the nation’s efforts to prepare for,  prevent, and respond to cyber threats to systems and communications  networks. However, DHS faces challenges in establishing a  comprehensive national cyber analysis and warning capability.   Key progress: When incidents such as data loss or theft, computer intrusions,  and privacy breaches occur, agencies are to notify the U.S. Computer  Emergency Readiness Team. Over the past 5 years, the number of incidents  reported by federal agencies to the U.S. Computer Emergency Readiness  Team has increased; from 5,503 incidents in fiscal year 2006 to 41,776  incidents in fiscal year 2010, an increase of over 650 percent. We currently  have work underway assessing the adequacy and effectiveness of agency  information security policies and practices, and agencies' implementation of  the Federal Information Security Management Act of 2002 requirements, and  plan to report on our results later this year.  What remains to be done: In July 2008, we reported that the U.S. Computer  Emergency Readiness Team did not fully address 15 key attributes of cyber  analysis and warning capabilities. These attributes are related to (1)  monitoring network activity to detect anomalies, (2) analyzing information and  investigating anomalies to determine whether they are threats, (3) warning  appropriate officials with timely and actionable threat and mitigation  information, and (4) responding to the threat. For example, the U.S. Computer  Emergency Readiness Team provided warnings by developing and distributing  a wide array of notifications; however, these notifications were not consistently  actionable or timely. We recommended that the department address shortfalls  associated with the 15 attributes in order to fully establish a national cyber  analysis and warning capability. DHS generally concurred and stated that it is  taking steps to implement them, such as opening two 24-hour centers to  increase communication channels and organize cyber response efforts.We  are currently working with DHS officials to more fully determine the status of  their efforts to address these recommendations.
section_title: Area
paragraphs: Federal partners, including DHS,  developed new information- sharing arrangements, and DHS  completed corrective actions  based on a cybersecurity  exercise. However, efforts to  meet the expectations of private  sector stakeholders in areas  related to sharing information  about cyber-based threats to  critical infrastructure should be  improved.
Summary of key progress and work remaining  The DHS IG also identified challenges with the U.S. Computer Emergency  Readiness Team analysis and warning program, which DHS took steps to  address. In June 2010 the DHS IG reported that the U.S. Computer  Emergency Readiness Team made progress in implementing a cybersecurity  program to assist federal agencies in protecting their information technology  systems against cyber threats. However, the IG reported that the team could  further improve its analysis and warning program. For example, the IG  reported that the team could improve its management oversight by developing  a strategic plan and establishing performance measures. Additionally, the IG  reported that the team should improve its information sharing and  communications coordination efforts with the public. Several factors have  hampered DHS’s ability to share information with its partners, including that  threat information from intelligence agencies is classified.   The DHS IG recommended, among other things, that DHS establish a  consolidated, multiple classification level portal that can be accessed by  federal partners that includes real-time incident response related information  and reports. In addition, the DHS IG recommended the establishment of  specific outcome-based performance measures and a strategic plan to ensure  that the team can achieve its mission, objectives, and milestones. DHS  concurred with these recommendations, and took action to implement them.  For example, DHS reported that it established performance measures and a  strategic plan, concept of operations, and standard operating procedures for  the U.S. Computer Emergency Readiness Team. In July 2011 DHS also  reported that it was taking steps to establish a multiple classification level  portal.   DHS developed new information-sharing arrangements and completed  corrective actions based on a cybersecurity exercise. However,  additional action is needed to better ensure that expectations of private  sector stakeholders are met by their federal partners in areas related to  sharing information about cyber-based threats to critical infrastructure.  Key progress: DHS completed corrective actions based on lessons learned  from a cybersecurity exercise. In September 2008, we reported that since  conducting a major cyber attack exercise, called Cyber Storm, DHS  demonstrated progress in addressing 8 lessons it had learned from this  exercise to strengthen public and private incident response capabilities. In the  months following its first exercise, DHS identified 66 activities that address one  or more of the lessons, including hosting meetings with key cyber response  officials from foreign, federal, and state governments and private industry, and  refining their operating procedures. We reported in September 2008 that  DHS’s actions to address the lessons had not been fully implemented, and  consequently recommended that DHS schedule and complete all of the  corrective activities identified to strengthen coordination between public and  private sector participants in response to significant cyber incidents. As of  September 2010, DHS demonstrated that it had completed all 66 of the  corrective actions addressing lessons learned from the exercise.
section_title: Area
paragraphs: Summary of key progress and work remaining  What remains to be done: Federal policy, including DHS’s National  Infrastructure Protection Plan, calls for a partnership model that includes public  and private councils to coordinate policy and information sharing and analysis  centers to gather and disseminate information on threats to physical and  cyber-related infrastructure.In July 2010, we reported that while federal  partners, such as DHS, were developing new information-sharing  arrangements, they were not meeting the key expectations of the private  sector. We also reported that public sector stakeholders believed that  improvements could be made to the partnership, including improving private  sector sharing of sensitive information. We recommended, among other  things, that DHS use our findings to focus its information-sharing efforts on the  most desired services, including access to sensitive or classified information  and a secure mechanism for sharing information. DHS concurred with our  recommendations and stated that it took steps to implement them, such as  initiating pilot programs to enable the mutual sharing of cybersecurity  information at various classification levels. However, as DHS is initiating  these pilot programs, it is too early to assess the extent to which they address  the challenges we identified.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Gregory C. Wilshusen  at (202) 512-6244 or wilshuseng@gao.gov.
section_title: Appendix XII: Emergency Preparedness and Response
subsections: section_title: What This Area Includes
paragraphs: The Federal Emergency Management Agency (FEMA), within the  Department of Homeland Security (DHS), is the federal agency primarily  responsible for emergency preparedness and response efforts. FEMA’s  key responsibilities and efforts include national emergency preparedness  and response planning, such as developing the National Response  Framework and a national preparedness goal; providing emergency  assistance and services, such as temporary housing assistance after a  disaster; and supporting the federal government’s state, local, and tribal  partners’ efforts to enhance their emergency management and homeland  security capabilities, such as emergency communications, through grants  and technical assistance. As the primary component responsible for  emergency preparedness and response, in fiscal year 2011 FEMA had  approximately 7,300 personnel, and its budget authority was about $10.5  billion. Emergency preparedness and response falls within the  Quadrennial Homeland Security Review Mission 5: Ensuring Resilience  to Disasters.
For the purposes of this report, we are focusing generally on key areas on  which we or the DHS Office of Inspector General (IG) have recently  reported and not on areas in which our two agencies have not reported or  have conducted limited audit work. For example, while DHS’s  responsibilities related to emergency preparedness and response also  include areas such as human capital management and training and  exercise programs, we are not reporting on DHS’s progress and work  remaining in these areas. With regard to human capital, FEMA reported  to us in July 2011 that it planned to increase its staffing levels to enhance  FEMA’s investigative operations and fraud awareness training initiatives  by 50 percent in fiscal year 2011, and by another 50 percent in fiscal year  2012. We have not completed recent work on these areas upon which to  make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: Our work, supplemented by that of the DHS IG, has shown that FEMA  expanded its efforts to improve national emergency preparedness and  response planning; improved its emergency assistance services;  supported state, local, and tribal partners’ disaster preparedness and  response capabilities; and enhanced emergency communications. For  example, FEMA developed various plans for disaster preparedness and  response. In particular, FEMA issued the National Response Framework,  which outlines the guiding principles and major roles and responsibilities  of government, nongovernmental organizations, and private sector  entities for disaster response. It is also finalizing a National Disaster  Recovery Framework, intended to provide a model to identify and  address challenges that arise during the disaster recovery process.  Moreover, DHS issued the National Emergency Communications Plan— the first strategic document for improving emergency communications  nationwide. We also reported that FEMA awards certain preparedness  grants based on a reasonable risk methodology. However, more work  remains in FEMA’s efforts to assess capabilities for all-hazards  preparedness, provide long-term disaster recovery assistance, and  strengthen alert systems. For example, FEMA has faced difficulties in  collecting reliable and consistent data and developing measurable target  capabilities for national preparedness. Further, with regard to long-term  disaster recovery assistance, FEMA’s criteria for when to provide the  assistance were vague, and, in some cases, FEMA provided assistance  before state and local governments had the capacity to work effectively  with FEMA. Further, FEMA has faced technical challenges in  implementing the Integrated Public Alert and Warning System related to  systems integration and alerts for individuals with disabilities, among  other things. Additionally, FEMA should improve the efficacy of the grant  application and review process by mitigating duplication or redundancy  within the agency’s various preparedness grant programs. Table 16  provides more detailed information on our assessment of DHS’s progress  and remaining work in key areas on which we have reported, with an  emphasis on work completed since 2008.
subsections: section_title: Area
paragraphs: Summary of key progress and work remaining  What remains to be done: In April 2009 we reported that FEMA had not  yet completed about two-thirds of the plans to operationalize the policies it  had established to define emergency preparedness and response roles  and responsibilities. As a result, the roles and responsibilities of key  officials involved in responding to a catastrophe had not been fully defined  and, thus, could not be tested in exercises. We recommended that FEMA  establish a program management plan to ensure that the plans that were  called for as part of the national preparedness system were developed in a  timely and integrated fashion. FEMA generally concurred and has actions  underway to address it. For example, FEMA told us that since we last  reported, it has revised or completed six concept plans and approximately  28 hazard-specific regional plans. FEMA also reported working to  implement elements of Presidential Policy Directive 8: National  Preparedness. This directive instructs the Secretary of Homeland Security  to develop a national preparedness goal and national preparedness  system to meet that goal through an integrated set of guidance, programs,  and processes. Specifically, FEMA reported in August 2011 that in  response to Presidential Policy Directive 8, FEMA is leading the  development of a Federal Interagency All-Hazards Response Plan, to  include scenario-specific annexes that integrate prior earthquake,  hurricane, and catastrophic planning efforts. To implement Presidential  Policy Directive 8, FEMA will need to review its current and pending  policies to ensure that they are consistent with the goals and requirements  of the Directive, and make any adjustments that may be needed.  Despite ongoing efforts to measure preparedness and assess  capabilities, FEMA faced difficulties in collecting reliable and  consistent data, and developing measurable target capabilities.   Key progress: DHS, particularly FEMA, implemented efforts to measure  preparedness by assessing capabilities and addressing related challenges.  In September 2007, DHS issued the National Preparedness Guidelines  that describe a national framework for capabilities-based preparedness as  a systematic effort that includes sequential steps to first determine  capability requirements and then assess current capability levels. As a  companion to the Guidelines, FEMA issued a Target Capabilities List,  designed to provide a national-level generic model of capabilities defining  all-hazards preparedness. FEMA also made progress in developing a  system for assessing national preparedness capabilities by, among other  things, establishing reporting guidance for state preparedness and issuing  a federal preparedness report.  Presidential Policy Directive 8, issued in March 2011, requires the  development of a national preparedness goal, system, and report. The  implementation plan for the directive calls for the development of the  national preparedness goal by September 25, 2011, and the development  of other documents by September 25, 2012.
section_title: Area
paragraphs: Summary of key progress and work remaining  What remains to be done: The success of FEMA’s efforts to measure  preparedness has been limited due to, among other things, missing  quantifiable metrics to measure capabilities. In April 2009, we reported that  establishing quantifiable metrics for target capabilities was a prerequisite to  developing assessment data that can be compared across all levels of  government. At the time of our review, FEMA was in the process of refining  the target capabilities to make them more measurable and planned to  develop quantifiable metrics for each of the capabilities. We reported in  October 2010 that FEMA had not yet developed national preparedness  capability requirements based on established metrics to provide a  framework for assessing preparedness. FEMA officials told us that  evaluation efforts that they used to collect data on national preparedness  capabilities were useful for their respective purposes, but that the data  collected were limited by data reliability and measurement issues related to  the lack of standardization. Until a framework for assessing preparedness  is in place, we reported that FEMA would not have a basis on which to  operationalize and implement its conceptual approach for assessing local,  state, and federal preparedness capabilities against capability  requirements and identify capability gaps for prioritizing investments in  national preparedness. In our April 2009 report, we recommended that  FEMA improve national preparedness by enhancing its project  management plan for assessing capabilities to include reporting on the  progress of preparedness assessments and developing quantifiable  metrics for capabilities.   DHS concurred, and in July 2011 FEMA reported that it took steps to  establish a preparedness baseline and the accompanying foundation for  assessing preparedness, including determining how effective grants are in  improving preparedness. FEMA also reported that it was working with its  emergency response partners to identify end-states, capabilities, and  performance objectives for each emergency preparedness mission area as  part of its development of the National Preparedness Goal. FEMA further  will provide a summary of the progress being made towards developing  and maintaining performance objectives required to deliver the capabilities  described in the goal. In August 2011, FEMA reported that it had  established a Program Executive Office to ensure that the target dates for  implementation of Presidential Policy Directive 8 are met and stakeholders  are engaged in the process. As these efforts are recent, we have not  conducted work to assess their effectiveness in measuring preparedness.  However, in the past FEMA has had difficulty meeting target dates, thus it  will be important for FEMA to effectively consult with and incorporate the  input of its many stakeholders to support meeting this schedule.
section_title: Area
paragraphs: FEMA improved emergency  assistance services and  oversight of disaster-related  emergency assistance, but  should further strengthen its  management of emergency  response and recovery  assistance programs.
Summary of key progress and work remaining  DHS and FEMA have strengthened nationwide recovery planning  efforts, but efforts are in the early stages.  Key progress: In February 2010, FEMA released a draft National Disaster  Recovery Framework, which is intended to provide a model to collectively  identify and address challenges that arise during the disaster recovery  process. This Framework is designed to help the emergency management  community work better together to support individuals, households, and  communities as they rebuild and restore their ways of life following a  disaster. FEMA later reported that since March 2010, it has received  hundreds of comments and recommendations from federal agencies and  departments on the proposed Framework.   In March 2010, we reported that FEMA assisted local communities with  developing long-term disaster recovery plans as part of its post-disaster  assistance. For example, one way FEMA assisted Iowa City’s recovery  from major floods in 2008 by, among other things, identifying possible  federal funding sources for specific projects in the city’s recovery plan and  advising the city on how to prepare effective project proposals. Local  officials credited this assistance with helping the city to be able to secure  federal funding.   What remains to be done: We have identified areas where FEMA’s  recovery assistance to local communities should be improved. For  example, state and local officials in Texas recovering from Hurricane Ike in  2008 said that FEMA’s process of ranking projects in the City of  Galveston’s recovery plan had the effect of fostering unrealistic  expectations among the public about what projects would be funded. We  recommended that FEMA more clearly communicate the objectives and  processes it uses when assessing the value of specific recovery projects to  help prevent unrealistic expectations about the implementation of such  projects among members of the affected community. DHS agreed and  stated that it would further examine the tools it used to communicate with  impacted communities as part of the implementation of the National  Disaster Recovery Framework. With regard to Framework, in July 2011,  FEMA reported that the revised draft of the Framework was in the final  stages of interagency review and interagency teams had been working to  develop draft annexes for the six core functional areas of the Framework.  Since FEMA has not yet finalized this framework, it is too early to assess  its results.   FEMA improved the provision and oversight of emergency assistance  and services, but work remains in its management and operation of  emergency response and recovery assistance programs.   Key progress: FEMA has provided and coordinated the provision of  assistance to state and local governments, non-profit organizations, and  individuals after disasters—-including helping communities develop long- term recovery plans. In June 2011, the DHS IG reported that it had  identified 128 programs that provide disaster assistance and that DHS  administers 69, or approximately 54 percent, of these programs. For  example, FEMA operates the Public Assistance program, which provides  grants to state, local, and tribal governments and certain non-profit  organizations.
section_title: Area
paragraphs: Summary of key progress and work remaining  FEMA also took steps to improve its disaster assistance program  oversight. In December 2008, we identified challenges in the Public  Assistance program related to project development, information sharing  and tracking the status of projects, project approvals and appeals, and  human capital. For example, disagreements between applicants and  FEMA, as well as changes to project scope decisions, contributed to  slowing down project development. We reported that DHS had addressed  these challenges, including finalizing a public assistance catastrophic  disaster recovery concept plan that recognized the need to more easily  tailor projects to meet post-disaster conditions; developing new  management information systems to better track and manage projects and  increase the transparency of public assistance funding; and creating a  credentialing program for employees. Further, in July 2011, FEMA reported  that it had established two Public Assistance review panels within the  Public Assistance appeals process for the purpose of expediting final  eligibility decisions for disputed projects. With respect to employee  credentialing, FEMA reported in July 2011 that its newly created FEMA  Qualification System is intended to build upon previous efforts to credential  FEMA’s disaster response personnel. According to FEMA, the system is  expected to improve workforce qualification and certification of FEMA  personnel deployed for incident management and support operations. We  are conducting ongoing work related to FEMA’s disaster assistance  workforce and plan to report on our results in 2012.   What remains to be done: In March 2010, we identified two broad  challenges related to FEMA’s long-term disaster recovery assistance  efforts. First, the criteria for when FEMA was to provide long-term recovery  assistance in a specific disaster were vague, which resulted in uncertainty  among other federal agencies and state recovery officials. Second, in  some cases, FEMA assistance began before state and local governments  had the capacity to effectively work with FEMA and ended before critical  long-term recovery coordination and planning needs were fully addressed.  We recommended, among other things, that DHS develop clear and  consistent criteria that identify factors that determine whether and how the  entity responsible for coordinating long-term recovery will become involved  in a specific disaster. We also recommended that DHS establish a long- term recovery structure that more effectively aligns the timing and level of  involvement of the entity responsible for coordinating long-term community  recovery assistance with both the capacity of state and local governments  to work with them and the need for coordination assistance. DHS  concurred and reported in July 2011 that it had developed an assessment  tool to assist a coordinating officer or state when attempting to determine if  activating the long term recovery mission is appropriate. These are positive  steps that should help strengthen FEMA’s efforts to address timing issues  with its disaster recovery, but they are still in the early stages of  implementation.
section_title: Area
paragraphs: DHS and FEMA made strategic  progress in enhancing  emergency and interoperable  communications. However,  specific alert systems, such as  the Integrated Public Alert and  Warning System, have  technical challenges, such as  message delivery limitations.
Summary of key progress and work remaining  Additionally, FEMA reported in July 2011 that it sought to increase its  disaster reservist cadre with professionals in areas of community planning,  city management, and economic recovery to also provide an enhanced  technical resource to local governments early in recovery efforts to assist in  launching recovery planning. These are positive steps that should assist  FEMA in its recovery efforts. However, because of the long-term nature of  disaster recovery, it will take time to determine the impact of these efforts  in enhancing recovery from such recent disasters as the tornados that  devastated areas of Alabama and Missouri.  DHS and FEMA released key emergency communications strategic  documents and made grants available for interoperability, but have  made limited progress to enhance emergency alert systems.   Key progress: Continuity of communications, capacity, and interoperability  are primary areas of vulnerability in emergency communications.  Emergency communications breakdowns undermined response efforts  during terrorist attacks in 2001 and Hurricane Katrina in 2005. In response,  federal agencies, including DHS, increased efforts to enhance emergency  communications. In June 2009, we reported that DHS and other federal  agencies took steps to enhance emergency communications by issuing  key documents such as the National Emergency Communications Plan— the first strategic document for improving emergency communications  nationwide. Further, DHS and other federal agencies made numerous  grants for interoperable communications available and increasingly aligned  them with national and state plans. In addition, we reported that federal  agencies, including DHS, took strategic steps to assist first responders.   In March 2010, we reported that the Emergency Communications  Preparedness Center had been established. At that time, the members  were developing a working definition of the scope of emergency  communications to define the scope of their mission and the types of  information that should be included in an emergency communications  clearinghouse. As of July 2011, DHS reported that the membership of the  Preparedness Center expanded to 14 federal agencies, and the members  had developed strategic objectives and an action plan to implement these  objectives. FEMA also reported that it established and implemented  working groups and a Disaster Emergency Communications Division to  support emergency and interoperable communications.
section_title: Area
paragraphs: Summary of key progress and work remaining  Further, in September 2009, we reported on the Emergency Alert System,  the primary national-level public warning system, and FEMA’s Integrated  Public Alert and Warning System, which is intended to integrate new and  existing alert capabilities, including the Emergency Alert System, into a  “system of systems” to become the country’s comprehensive public alert  system. We reported that FEMA faced coordination issues in developing  and implementing the system. For example, many stakeholders we  contacted during our work knew little about the Integrated Public Alert and  Warning System and expressed the need for better coordination with  FEMA. Among other things, we recommended that FEMA develop  strategic goals and processes for deployment of the Integrated Public Alert  and Warning System and report periodically on program progress to the  Congress and to the Secretary of Homeland Security in order to improve  program transparency and accountability. DHS concurred and published  an Integrated Public Alert and Warning System Strategic Plan in June  2010 that identified the vision, mission, goals and objectives of the  program.  What remains to be done: In September 2009, we reported that FEMA  faced technical challenges in implementing the Integrated Public Alert and  Warning System related to systems integration, standards development,  the development of geo-targeted and multilingual alerts, and alerts for  individuals with disabilities. For example, FEMA’s standard intended to  facilitate integration of alert systems was under development and not  widely used. As a result, we reported that integration with state and local  systems would likely be a significant challenge due to potential  incompatibility, and FEMA did not yet have logistical plans to integrate  these systems. Further, we reported that to demonstrate the integration  and expansion of new alerting technologies, and to work toward the  functionality described in the executive order, FEMA had implemented pilot  projects, but they ended inconclusively, with few documented lessons  learned.   We recommended, among other things, that FEMA establish and  implement a plan to verify the dependability and effectiveness of systems  used to disseminate alerts. FEMA concurred and, in July 2011, reported  that it had engaged with a range of agencies, organizations, and private  sector entities to promote Integrated Public Alert and Warning System  capabilities and opportunities for the integration of alert and warning  technologies for people with access and functional needs. FEMA reported  that it had partnered with organizations to demonstrate products that  incorporate technologies for alerting persons with access and functional  needs. Further, FEMA reported that it was developing an infrastructure of  alert and warning capabilities that expands on the traditional Emergency  Alert System by, for example, allowing individuals with enabled mobile  devices to receive text-like messages alerting them of imminent threats in  their geographic area. FEMA reported that in March 2011 it deployed the  Integrated Public Alert and Warning System-Open Platform for Emergency  Networks, a set of securely hosted Web services that enable the routing of  alerts and warnings between various third-party systems, networks, and  devices. As DHS has recently implemented this system and its pilot  products have not yet been deployed, it is too early to assess the  effectiveness of these efforts.
Overall assessment  FEMA made progress in  allocating homeland security  grants using a reasonable risk  assessment methodology.  However, challenges remain  regarding the coordination of  grant programs.
Summary of key progress and work remaining  FEMA used a reasonable risk assessment methodology to allocate  the Urban Areas Security Initiative and State Homeland Security  grants, but FEMA should coordinate the application and review  process for its preparedness grants.  Key progress: Within FEMA, the Grant Programs Directorate is  responsible for business operations, training, policy, oversight of all FEMA  grants, and the program management of preparedness grants. FEMA’s  grant programs vary from enhancing capabilities that focus on  counterterrorism and catastrophic events, to specific first-responder  disciplines that strengthen capabilities for addressing hazards of all types.  For example, the State Homeland Security Program provides funding in an  effort to address the identified planning, organization, equipment, training,  and exercise needs at the state and local levels to prevent, protect against,  respond to, and recover from acts of terrorism and other catastrophic  events. The Urban Areas Security Initiative program provides funding to  address the unique planning, organization, equipment, training, and  exercise needs of high-threat, high-density urban areas, and assists them  in building an enhanced and sustainable capacity to prevent, protect  against, respond to, and recover from acts of terrorism. In June 2008, we  reported that DHS had constructed a reasonable methodology to assess  risk and allocate the Urban Area Security Initiative and State Homeland  Security grants, but that this methodology did not account for vulnerability  differences among jurisdictions.  In July 2011, DHS reported that it modified its methodology for fiscal year  2011 to address the measurement of vulnerability in its risk-based grant  allocation model. Specifically, FEMA reported creating a separate  vulnerability assessment that accounts for 20 percent of the overall risk  assessment for states, and territories, and the top 100 metropolitan areas  for use in the State Homeland Grant Program and the Urban Areas  Security Initiative grant program. We have ongoing work assessing these  homeland security grant programs, and plan to report on the results later  this year.
section_title: Area
paragraphs: Summary of key progress and work remaining  The IG recommended, among other things, that FEMA identify grant  programs that may overlap or duplicate with other programs. FEMA  concurred and reported it planned to take action to address them. For  example, FEMA reported in July 2011 that it was working with DHS and  other federal departments to consolidate existing preparedness grant  programs and entering into a memorandum of understanding with the  Departments of Health and Human Services and Transportation to clarify  roles among the departments regarding their emergency preparedness- related grants. These are positive steps and should help strengthen  FEMA’s grant management. However, our work and that of the DHS IG  has shown that FEMA should further benefit from examining its grant  programs and coordinating its application process to eliminate or reduce  redundancy among grant recipients and program purposes.
Appendix XII: Emergency Preparedness and  Response  We are conducting this work for the House Committee on Homeland Security; the Senate  Committee on Homeland Security and Governmental Affairs; and the Senate Committee on  Commerce, Science, and Transportation.
section_title: GAO Contacts
paragraphs: For additional information about this area, contact William O. Jenkins, Jr.  at (202) 512-8757 or jenkinswo@gao.gov.
section_title: Appendix XIII: Department of Homeland Security Transformation and Implementation
subsections: section_title: What This Area Includes
paragraphs: In 2003, we designated implementing and transforming the Department of  Homeland Security (DHS) as high risk because DHS had to transform 22  agencies—several with major management challenges—into one  department, and failure to effectively address DHS’s management and  mission risks could have serious consequences for U.S. national and  economic security. This high-risk area includes challenges in  strengthening DHS’s management functions, the impact of those  challenges on DHS’s mission implementation, and challenges in  integrating management functions within and across the department and  its components.
For the purposes of this report, we are highlighting examples of DHS  transformation and implementation efforts in key areas on which we have  recently reported, and not on areas on which we have not reported or  have conducted limited audit work. DHS has other transformation and  implementation efforts underway at the department and component  levels. We have not completed work on these areas upon which to base  an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: workforce goals, objectives, and performance measures for human  capital management. However, DHS continues to face significant  weaknesses in these areas that hinder the department’s transformation  efforts and its ability to meet its missions. For example, because of  acquisition and information technology management weaknesses, major  programs have not met capability, benefit, cost, and schedule  expectations. Further, we reported that financial management internal  control weaknesses have impeded DHS from providing reliable and timely  financial data to support daily operational decision making. Moreover,  human capital challenges have affected departmental and component  efforts to implement their missions. As DHS continues to mature as an  organization, it will be critical that the department continue to work to  strengthen its management functions and their implementation, since the  effectiveness of these functions and their implementation directly affects  its ability to fulfill its homeland security and other missions.
DHS has developed and begun to implement its strategy to address  the high-risk area, but has not yet demonstrated sustainable,  measurable progress in its implementation efforts. In our 2011 high- risk update, we reported that DHS has taken action to implement,  transform, and strengthen its management functions. The Secretary and  Deputy Secretary of Homeland Security, and other senior officials, have  demonstrated commitment and top leadership support to address the  department’s management challenges. In January 2011, DHS provided  us with its Integrated Strategy for High Risk Management, which  summarized the department’s preliminary plans for addressing the high- risk area, and DHS updated this strategy in June 2011. We provided DHS  with feedback on the January 2011 strategy and have worked with the  department to monitor implementation efforts. For example, we noted that  the January 2011 strategy was generally responsive to actions and  outcomes we identified for the department to address the high-risk area.  However, we noted that, in most cases, the strategy did not identify the  specific resources needed to implement planned corrective actions,  making it difficult to assess the extent to which DHS has the capacity to  implement these actions. Additionally, we noted that the strategy did not  provide information on the underlying metrics or factors DHS used to rate  its progress, making it difficult for us to assess DHS’s overall  characterizations of progress. In the June 2011 update, DHS provided  ratings of its progress in implementing corrective actions related to each  management function. We are assessing DHS’s ratings and the June  2011 update, and plan to provide the department with our feedback later  this year.
Going forward, to address the long-standing problems in its management  functions and in the integration of those functions, DHS needs to  implement its Integrated Strategy for High Risk Management; continue its  efforts to identify and acquire resources needed to achieve key actions  and outcomes; implement a program to monitor and validate its corrective  actions; and show measurable, sustainable progress in implementing  corrective actions and achieving key outcomes.
DHS developed processes and policies for managing its  acquisitions, but faces significant challenges in ensuring proper  implementation. DHS has taken steps to strengthen acquisition  oversight processes, but it continues to face obstacles in managing its  acquisitions and ensuring proper implementation and departmentwide  coordination. We previously reported that DHS faced challenges related  to acquisition oversight, cost growth, and schedule delays. In August  2007, DHS established the Acquisition Program Management Division  under the Office of the Chief Procurement Officer to help strengthen  acquisition management within the department. Further, in June 2010, we  reported that DHS continued to develop its acquisition oversight function  and had begun to implement a revised acquisition management directive  that includes more detailed guidance for programs to use when informing  component and departmental decision making. We also reported that the  senior-level Acquisition Review Board had met more frequently and  provided programs decision memorandums with action items to improve  performance. However, while the Acquisition Review Board reviewed 24  major acquisition programs in fiscal years 2008 and 2009, more than 40  major acquisition programs had not been reviewed, and programs had  not consistently implemented action items identified as part of the review  by established deadlines. In July 2011, DHS reported that the Acquisition  Program Management Division in 2009 started conducting annual  portfolio program reviews with components with the goal of ensuring that  major programs receive at least one review on an annual basis, and that  DHS had conducted reviews of additional programs through the  Acquisition Review Board in fiscal years 2010 and 2011.
Our work has also shown that departmental concerns exist about the  accuracy of cost estimates for some of DHS’s major programs. In  addition, over half of the programs we reviewed for our June 2010 report  awarded contracts to initiate acquisition activities without component or  department approval of documents essential to planning acquisitions,  such as mission need statements outlining the specific functional  capabilities required to accomplish DHS’s mission and objectives;  operational requirements; and acquisition program baselines.  Additionally, in November 2010, leveraging our work, the DHS Office of  Inspector General (IG) identified acquisition management as a major  challenge facing the department. We have made a number of  recommendations to DHS to strengthen its acquisition management  functions, such as establishing a departmental joint requirements  oversight board to review and approve acquisition requirements, and  ensuring major investments comply with established component and  departmental review policy standards. DHS generally agreed and is  working to address them by, among other things, establishing an  Investment Review Board to help oversee the status of all acquisition  investments; expanding its Acquisition Corps to provide trained  procurement and program management professionals to manage DHS’s  most critical acquisition programs; developing a tool to track programs’  cost, schedule, and performance indicators; and evaluating the  effectiveness of award fees and performance incentives. These are  positive actions that should better position DHS to meet its acquisition  needs. However, moving forward, DHS will need to continue to  demonstrate sustainable progress in implementing these actions and  delivering programs that meet cost, schedule, and performance  expectations. interrelated management controls and capabilities. For example, DHS  continued to issue annual updates to its enterprise architecture that  added previously missing scope and depth, and further improvements  were planned to incorporate the level of content, referred to as segment  architectures, needed to effectively introduce new systems and modify  existing ones. In addition, in July 2011, DHS reported that the  department had begun tracking implementation of our Enterprise  Architecture Management Maturity Framework and had developed plans  to improve enterprise architecture maturity within each component and  departmentwide. We further reported that DHS redefined its information  technology acquisition and investment management policies, practices,  and structures, including establishing a system life cycle management  methodology, and increased its information technology acquisition  workforce. In addition, in August 2011, DHS reported that it had efforts  underway to establish an information technology program manager  certification track intended to assist in managing information technology  program management challenges.
Nevertheless, challenges remain relative to, for example, fully defining  key system investment and acquisition management policies and  procedures for information technology. Moreover, the extent to which  DHS implemented these investment and acquisition management policies  and practices on major information technology programs has been  inconsistent. For example, our work showed that major information  technology acquisition programs were not subjected to executive-level  acquisition and investment management reviews. As a result, major  programs aimed at delivering important mission capabilities had not lived  up to their capability, benefit, cost, and schedule expectations. those for configuring desktop computers and wireless communication  devices. Additionally, in November 2010, the DHS IG identified  information technology management as a major challenge facing the  department. For example, the DHS IG reported that the department faces  challenges as it attempts to create a unified information technology  infrastructure for effective integration and agencywide management of  information technology assets and programs. We made  recommendations to strengthen DHS information technology  management, such as establishing procedures for implementing project- specific investment management policies, and policies and procedures for  portfolio-based investment management. DHS is working to strengthen  these areas by, for example, developing a process for information  technology acquisition management to help ensure that each investment  begins with a successful plan and road map for its life cycle and by  establishing executive steering committees to monitor the cost and  schedule performance of all high-risk information technology investments.  While these are positive steps that should better position the department  in managing its information technology investments moving forward, DHS  will need to continue to make measurable progress in implementing these  actions and successfully developing and deploying information  technology programs. consolidate its disparate systems. In addition, DHS has not been able to  obtain an unqualified audit opinion on its consolidated financial  statements (i.e., prepare a set of financial statements that are considered  reliable). For fiscal year 2010, the independent auditor issued a  disclaimer on DHS’s consolidated financial statements and identified  deficiencies in DHS’s internal control over financial reporting. Until these  weaknesses are resolved, DHS will not be in position to provide reliable,  timely, and useful financial data to support day-to-day decision making. In  addition, as a result of these weaknesses, in November 2010 the DHS IG  assessed financial management as one of the major management  challenges facing the department. DHS has taken steps to prepare and  implement corrective action plans for its internal control weaknesses  through its Internal Control Playbook, DHS’s annual plan to design and  implement departmentwide internal controls. Further, in fiscal year 2010  DHS committed to the goal of receiving a qualified audit opinion on its  consolidated balance sheet in fiscal year 2011, and the department is  working toward that goal by, for example, focusing on strengthening  budgetary resource processes and payment management, and  remediating financial management issues at the U.S. Coast Guard. These  are positive first steps toward achieving a successful full scope audit of  the department’s consolidated financial statements and, if implemented  effectively, should help DHS strengthen its financial management  functions. objectives, and performance measures for human capital management.  These strategies are promising, but DHS has faced challenges in  implementing its human capital functions, including hiring people with the  needed skills and abilities in areas such as acquisition management, for  example. Further, our prior work suggests that successful organizations  empower and involve their employees to gain insights about operations  from a frontline perspective, increase their understanding and acceptance  of organizational goals and objectives, and improve motivation and  morale. However, DHS’s scores on the Partnership for Public Service’s  2010 rankings of the Best Places to Work in the Federal Government  improved from prior years, but in 2010, it was ranked 28 out of 32  agencies in the Best Places to Work ranking on overall scores for  employee satisfaction and commitment. steering committee to provide oversight of the department’s language  requirements. DHS reported that it is also working to address its human  capital management challenges by, among other things, developing  component operational plans for the Workforce Strategy, tracking those  plans against a common set of performance measures, and implementing  comprehensive workforce planning to link the department’s strategic  goals, mission critical occupations, and workforce capacity and  capabilities. These are positive actions that should better position DHS in  assessing and meeting its human capital needs, but more work remains. on DHS’s updated plan for management integration and will monitor  implementation efforts.
section_title: GAO Contacts
paragraphs: For additional information about this area, contact David Maurer at (202)  512-9627 or maurerd@gao.gov for transformation, human capital  management, and management integration; John Hutton at (202) 512- 4841 or huttonj@gao.gov for acquisition management; David A. Powner  at (202) 512-9286 or pownerd@gao.gov for information technology  management; or Paula Rascona at (202) 512-9816 or rasconap@gao.gov  for financial management.
section_title: Appendix XIV: Performance Measurement
subsections: section_title: What This Area Includes
paragraphs: Performance measurement underpins federal efforts to assess and report  on progress in strengthening programs and operations. We reported on  the importance of the development of outcome-based performance goals  and measures as part of results management efforts across government.  Performance goals and measures are intended to provide Congress and  agency management with information to systematically assess a  program’s strengths, weaknesses, and performance. A performance goal  is the target level of performance expressed as a tangible, measurable  objective against which actual achievement will be compared. A  performance measure can be defined as an indicator, statistic, or metric  used to gauge program performance. Outcome-oriented measures show  results or outcomes related to an initiative or program in terms of its  effectiveness, efficiency, or impact.
For the purposes of this report, we are generally highlighting examples of  Department of Homeland Security (DHS) performance measurement  efforts in key areas on which we have recently reported, and not on areas  on which we have not reported or have conducted limited audit work.  DHS has other performance measurement efforts underway at the  department and component levels. We have not completed work on these  areas upon which to base an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: department’s performance goals and measures to help strengthen DHS’s  efforts in this area. Our feedback was based on our work on and subject  matter knowledge of the programs, activities, and areas being measured,  as well as our work on effective practices for performance measurement.  This feedback ranged from pointing out components’ limited use of  outcome-oriented performance measures to assess the results or  effectiveness of programs, to raising questions about the steps DHS or its  components took to ensure the reliability and verification of performance  data. DHS also implemented internal efforts to strengthen its performance  measures. For example, as part of our ongoing review of the QHSR, we  found that DHS worked to align its performance measures to the QHSR  missions and goals. The department also provided components with  guidance that outlines how to assess QHSR missions and related  training, and formed working groups to discuss implementing specific  performance measure concepts. Further, DHS reported that after the  QHSR was issued, DHS senior leaders held meetings to discuss how to  revise existing performance measures, and components worked to  develop improved performance measures.
In response to its internal efforts and our feedback, DHS developed and  revised its performance goals and measures for some areas to  strengthen its ability to assess its outcomes and progress. For fiscal year  2011, DHS identified 85 strategic measures for assessing its progress in  achieving its QHSR missions and goals. In addition to these strategic  measures, the department has 132 management measures, which DHS  uses for assessing programmatic performance and for resource allocation  and other internal decision making purposes, such as program  evaluation. In addition, in July 2011, DHS reported that the department  has identified 24 areas for focused efforts to develop enhanced  measures, based on guidance from DHS leadership and the Office of  Management and Budget. These areas address gaps in both strategic  and management measures for specific mission areas. DHS also plans to  continue its annual process for reviewing and working to strengthen its  performance measures. of programs lack outcome goals and measures, which may hinder the  department’s ability to effectively assess results or fully assess whether  the department is using resources effectively and efficiently. We have  recognized that DHS faces some inherent difficulties in developing  performance goals and measures to address its unique mission and  programs, such as in developing measures for the effectiveness of its  efforts to prevent and deter terrorist attacks. In such instances, proxy  measures—or indirect indicators—should be designed to assess the  effectiveness of program functions. Outcome measures are helpful to  departmental decision makers and managers, as they describe the  products and services delivered by a program over a period of time.  However, we have reported that many of DHS’s components have not  developed adequate proxy or outcome-based performance measures or  mechanisms to monitor, assess, and evaluate the effectiveness of their  plans and performance. Such measures, along with output and process  measures, would help DHS track progress being made toward specific  goals and provide managers with important information upon which to  base their decisions. improve the measurement and reporting of checkpoint effectiveness. CBP  agreed and reported plans to develop and better use data on checkpoint  effectiveness.
Further, we reported that U.S. Immigration and Customs Enforcement  (ICE) and CBP did not have measures for assessing the performance of  key immigration enforcement programs. For example, in April 2011 we  reported that ICE did not have measures for its overstay enforcement  efforts, and in July 2010 that CBP did not have measures for its alien  smuggling investigative efforts, making it difficult for these agencies to  determine progress made in these areas and evaluate possible  improvements. We recommended that ICE and CBP develop  performance measures for these two areas. They generally agreed and  reported actions underway to develop these measures. In addition, in July  2011, DHS stated that CBP was leading a multiyear effort to develop  measures for border security to position the department to be able to  assess the impact of security measures, such as tactical infrastructure, on  border security. DHS also reported that it has measures for assessing its  border security and immigration enforcement efforts, such as measures  related to detaining and removing criminal aliens while maintaining  compliance with detention standards. However, our work has shown that  within key border security and immigration enforcement programs, DHS  and its components can strengthen its measures for assessing program  results. units and was unable to control the distribution of the Ready Campaign  messages or measure whether the messages were changing the  behavior of individuals. We noted that by examining the feasibility of  approaches to verify data on its community preparedness programs,  FEMA would be better positioned to begin to explore why programs that  no longer exist were disbanded and develop possible strategies for  reconstituting local programs or developing new ones. Among other  things, we recommended that FEMA examine the feasibility of developing  various approaches for ensuring the accuracy of program data.
In July 2011, FEMA reported taking additional action to strengthen its  performance measures by, for example, implementing a priority goal  focusing on ensuring resilience to disasters by strengthening disaster  preparedness and response capabilities, and beginning in fiscal year  2010, requiring its offices to develop and report on activity-level (or  operational level) performance measures to align to each of FEMA’s  budget activity lines. These steps should help FEMA strengthen its  performance measurement efforts. However, FEMA should continue to  work toward implementing a comprehensive set of measures for  assessing national preparedness capabilities.
section_title: GAO Contact
paragraphs: For additional information about this area, contact David Maurer at (202)  512-9627 or maurerd@gao.gov.
section_title: Appendix XV: Risk Management
subsections: section_title: What This Area Includes
paragraphs: Risk management has been widely supported by the President and  Congress as a management approach for homeland security. According  to the Department of Homeland Security (DHS), risk information is usually  one of many factors—and typically not the sole factor—that departmental  decision makers consider when deciding which strategy to pursue. We  have previously reported that defining an acceptable, achievable (within  constrained budgets) level of risk is imperative to address current and  future threats, and on the need to make risk-informed decisions related to  homeland security. Many have pointed out, as did the Gilmore and 9/11  Commissions, that the nation will never be completely safe and total  security is an unachievable goal. Within its sphere of responsibility, DHS  cannot afford to protect everything against all possible threats. As a  result, DHS must make choices about how to allocate its scarce  resources to most effectively manage risk, and a risk management  approach can help inform these decisions.
To provide guidance to agency decision makers, we developed a risk  management framework which is intended to be a starting point for  applying risk-informed principles. Our risk management framework,  shown in figure 2, entails a continuous process of managing risk through  a series of actions, including setting strategic goals and objectives,  assessing risk, evaluating alternatives, selecting initiatives to undertake,  and implementing and monitoring those initiatives.
section_title: Key Progress and Work Remaining
paragraphs: within and across the various aviation and surface transportation  modes, such as freight rail, passenger rail, and pipelines.
In addition, our work shows that DHS and its components conducted risk  assessments across a number of areas, but should strengthen these  assessments. For example, with regard to surface transportation securit in February 2009 we reported that DHS had conducted threat  assessments of the commercial vehicle sector and was in the early  stages of conducting vulnerability assessments for this sector. However,  we reported that TSA’s commercial vehicle threat assessments generally  did not identify the likelihood of specific threats, as directed by the  National Infrastructure Protection Plan, and that TSA had not yet  determined the scope, method, and time frame for completing  vulnerability assessments. We also noted that TSA had not yet conducte consequence assessments, and a approach for securing the commercial vehicle sector addressed the  highest priority security needs. Moreover, in January 2009 we reported  that federal entities, including DHS, had efforts underway to assess  threat, vulnerability, and consequence for highway infrastructure, but  these efforts were not systematically coordinated among key federal  partners and the results were not routinely shared. In August 2010, we s a result, could not be sure that its  further reported that TSA developed a pipeline risk assessment model that combined threat, vulnerability, and consequence to create a risk  score for each system. However, we reported that DHS should improve  the model’s consequence component to take account of additional  impacts from a possible pipeline attack, such as public health and safety,  as called for in the National Infrastructure Protection Plan. of 2007, such as those for the trucking and school bus industries; and developed assessments for highway infrastructure, bus, commercial  truck, and port interfaces that were incorporated into the Transportation  Sector Security Risk Assessment. Moreover, in July 2011 TSA repo rted  that it added data columns for consequence and vulnerability components in its pipeline risk ranking tool to address pipelines in highly populated  and high consequence areas. These are important actions that should  strengthen TSA’s risk assessment efforts across the transportation  modes. We have not yet assessed these efforts, and thus cannot  an assessment of TSA’s efforts.
In addition, with regard to maritime security, the Coast Gua risk assessment model, the Maritime Security Risk Analysis Model, to  assess risk across ports. In April 2010, we reported that the Coast Guard  had assessed the risks to cruise ships and facilities using this model.  However, our work has shown that the Coast Guard has used the model  to assess offshore energy facilities, but faces challenges in doing  assessments because of difficulties in determining the types of attack  scenarios that could cause significant consequences, and in calcula secondary economic effects. In July 2011, the Coast Guard reported that  it is working to improve the accuracy, utility, and standardization of its  model, as the modeling, simulation, and analysis of terror attack  scenarios improves. We are currently conducting work examining the  Maritime Security Risk Analysis Model as well as the extent to which DHS  is allocating port security resources based on risk.We plan to report the results from this work later this year. the department’s risk management capability, to strengthen DHS’s  mission performance, improve departmental management, and increase  accountability. In our ongoing review of DHS’s QHSR, we found that DHS  considered various factors in identifying high priority BUR initiatives for  implementation in fiscal year 2012, but did not include risk information as  one of these factors. Consideration of risk information could help  strengthen DHS’s prioritization of mechanisms for implementing the  QHSR, including determining which BUR initiatives could be implemented  in the short or longer term, and the resources required for  implementation. We plan to report on the final results of this work later  this year.
Also, with regard to transportation security, DHS has not fully utilized risk  information in its strategic planning and prioritization efforts. For example,  in March 2009 we reported that TSA had developed an approach to  prioritization of its security activities based primarily on intelligence  instead of comprehensive risk assessments. We reported that DHS had  not reviewed or validated the methodology for this approach; thus, TSA  lacked assurance that its approach provided the information needed to  guide investment decisions to ensure resources were allocated to the  highest risks. Further, with regard to planning efforts, in October 2009, we  reported that TSA’s strategic plan to guide research, development, and  deployment of passenger checkpoint screening technologies was not risk- based. We noted that lacking such information, DHS could not provide  reasonable assurance that its strategy was effectively addressing security  gaps, prioritizing investments based on risk, and targeting resources  toward security measures that would have the greatest impact. Among  other things, we recommended that DHS conduct a complete risk  assessment related to TSA’s passenger screening program and  incorporate the results into the program’s strategy. DHS generally  concurred and reported actions underway to address them. For example,  in July 2011, TSA reported beginning to use a risk management analysis  process to analyze the effectiveness and efficiency of potential  countermeasures and impact on the commercial aviation system. While  these are positive steps, it is too early to assess the extent to which they  will improve DHS’s use of risk information in strategic planning and  investment decision making.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Cathleen A. Berrick at  (202) 512-3404 or berrickc@gao.gov.
section_title: Appendix XVI: Information Sharing
subsections: section_title: What This Area Includes
paragraphs: Since September 11, 2001, terrorist threats and attempted attacks have  emphasized the importance of developing a national information sharing  capability to efficiently and expeditiously gather, analyze, and disseminate  terrorism-related information, such as law enforcement, homeland  security, and public safety information. The Department of Homeland  Security (DHS) has responsibility for sharing terrorism-related information  as appropriate with its state and local partners. In 2005, we designated  information sharing for homeland security as high risk because the  government faced serious challenges in analyzing information and  sharing it among federal, state, local, and other security partners in a  timely, accurate, and useful way to protect against terrorist threats. We  have further reported that DHS must effectively share terrorism-related  information with state and local law enforcement because they depend on  it to maintain awareness of emerging threats and to allocate homeland  security resources, among other things. Further, gaps in sharing, such as  agencies' failure to link information about the individual who attempted the  December 25, 2009, airline bombing, prevented him from being included  on the federal government’s terrorist watchlist, a tool used by DHS to  screen for persons who pose a security risk.
For the purposes of this report, we are generally highlighting examples of  key DHS areas related to information sharing on which we have recently  reported and not on areas on which we have not reported or conducted  limited audit work. Our work has focused primarily on the sharing of  terrorism-related information to identify threats and help prevent terrorist  incidents. DHS has other ongoing efforts related to information sharing on  which we are not reporting, such as information sharing with the  government of Canada for emergency management purposes. We have  not completed work on these areas upon which to make an assessment  of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: functioning environment, and the Program Manager and agencies have  not yet identified the incremental costs necessary to implement it or  addressed our 2008 recommendation to develop procedures for  determining what work remains. DHS is one of the five federal agencies  with responsibility for implementing the Environment, and has the lead for  sharing information with state, local, tribal, territorial, and private sector  partners. Related to this responsibility, DHS has been implementing its  information sharing policy and governance structure to improve how it  collects, analyzes, and shares homeland security information across the  department and with these state and local partners.
DHS expanded and enhanced its sharing of information, but should  improve its assistance and services to state and local homeland  security partners and streamline some of its information sharing  mechanisms. In January 2011, DHS issued a plan for addressing the  areas for which it has responsibility under the terrorism-related  information sharing high-risk area. DHS identified strategies and  initiatives it had planned or underway to address our high-risk criteria and  outcomes we identified as important to successfully managing risks that  exist due to gaps in information sharing. For example, the plan discussed  steps for developing a governance structure for information sharing and  beginning efforts to develop a set of metrics for measuring information  sharing performance and results. We provided DHS with feedback on this  plan. Among other things, we noted the department needs to move  toward a system where it accounts for information sharing initiatives  against a baseline set of defined capabilities—such as information  sharing mechanisms, personnel, and technology—that are needed, to  help decision makers weigh progress achieved and remaining to inform  investments. Subsequent to our feedback, in July 2011, DHS reported  that it had established performance measures for assessing its  information sharing efforts. These measures include, for example, the  percent of intelligence reports customers rated as “satisfactory” in  enabling customers to anticipate emergency threats. DHS plans to report  on these metrics beginning in fiscal year 2012. While these are positive  steps, our work has shown that developing outcome-based performance  measures that gauge information sharing efforts and results would  strengthen accountability for these efforts.
Specific to its mission to share information with state and local partners,  in December 2010 we reported that DHS’s Office of Intelligence and  Analysis had initiatives underway to identify these partners’ information  needs and obtain feedback on intelligence products. The office  determined information needs—which are owned and controlled by the  states—for 9 of the 50 states and was working with the remaining states  to identify their needs. However, we reported that the Office of  Intelligence and Analysis had not established mutually agreed upon  milestones for completing this effort. We also reported that in addition to  intelligence products, the office provided a number of other services to its  state and local partners—primarily through these partners’ fusion centers  where homeland security, terrorism, and intelligence information is  shared—that had generally been well received by the center officials we  contacted. For example, the Office of Intelligence and Analysis deployed  more than 60 intelligence officers to fusion centers nationwide to assist  state and local partners in areas such as obtaining relevant intelligence  products and leveraging DHS capabilities to support their homeland  security missions. However, the office had not yet defined how it planned  to meet its state and local information-sharing mission by identifying and  documenting the specific programs and activities that are most important  for executing this mission. Moreover, its performance measures did not  allow the office to demonstrate the expected outcomes and effectiveness  of programs and activities that support state and local partners. gaps, and collection requirements. According to DHS, this guidebook will  help fusion centers identify and document a more accurate and  actionable set of information needs and gaps. These actions should help  DHS better assess the performance of its information sharing activities.  However, it is too early to assess possible results, since they have only  recently been, or are in the process of being, implemented.
Moreover, in September 2010 we reported that since 2001, all 50 states  and some major urban areas established fusion centers—totaling 72  centers as of July 2011, according to DHS. These centers have cited  DHS grant funding as critical to achieving baseline capabilities—the  standards the government and fusion centers have defined as necessary  for centers to be considered capable of performing basic functions. To  provide data about the baseline capabilities of fusion centers nationwide,  DHS and other agencies are conducting an ongoing systematic  assessment of fusion centers’ capabilities. According to DHS senior  officials and fusion center representatives, the results of the assessment  are intended to provide centers with the information needed to develop  more accurate and specific investment justifications. However, DHS had  not set standard performance measures for the centers. We  recommended that DHS define the steps it will take to design and  implement such a set of measures and commit to a target timeframe for  completing them. DHS concurred and stated that it has started to develop  a framework to demonstrate the value and impact of the national network  of fusion centers, and is using nationwide assessment data to support the  development of specific performance measures. These efforts should  help DHS strengthen its assessment of fusion centers’ performance, but it  is too soon to assess results as DHS is in the process of implementing  these efforts. As we have reported, if centers are to receive continued  federal financial support, it is important that they are also able to  demonstrate their impact and value added to the nation’s information  sharing goals. sector, there are sites for different transportation modes, such as public  transit. We found in September 2010 that 75 percent of the public transit  agencies we surveyed reported being generally satisfied with the security- related information they received.
However, we have identified several challenges to DHS’s information  sharing efforts for surface transportation security. For example, some  public transit agencies cited the need to streamline the information they  received, and we identified the potential for overlap between the Public  Transportation Information Sharing and Analysis Center, the Public  Transit Portal of DHS’s Homeland Security Information Network, and the  Transportation Security Information Sharing and Analysis Center, which  all communicate similar unclassified and security-related information to  public transit agencies. Also, preliminary observations from interviews  and open-ended responses to a survey as part of our ongoing work  indicate that some freight rail stakeholders would prefer to receive more  analysis or actionable information from TSA, such as trend analysis of  incidents or suggestions for improving security arrangements, that could  help predict how certain events may affect rail systems. In addition, DHS  and TSA have not developed performance goals and outcome-oriented  measures to gauge the effectiveness of their information-sharing  networks. intelligence and security information that had been disseminated by  multiple sources. Further, in July 2011 TSA reported that it and key  industry groups were engaged in an ongoing process to develop,  improve, and refine its information sharing mechanisms. In addition, TSA  reported that it continues to work with its stakeholders to determine how  available intelligence and other security incident data can be leveraged to  provide stakeholders with meaningful information to help guide actions in  the field. We are continuing to assess TSA’s efforts related to sharing  security information with stakeholders in the aviation, rail, and highway  modes and will report the final results later this year.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Eileen Larence at (202)  512-6510 or larencee@gao.gov.
section_title: Appendix XVII: Partnerships and Coordination
subsections: section_title: What This Area Includes
paragraphs: The Department of Homeland Security (DHS) provides federal leadership  for homeland security, but also plays a large role in coordinating the  homeland security activities of other federal, state, local, private sector,  and international stakeholders. We reported that successful partnering  and coordination involves collaborating and consulting with stakeholders  to develop and agree on goals, strategies, and roles to achieve a  common purpose; identify resource needs; establish a means to operate  across agency boundaries, such as compatible procedures, measures,  data, and systems; and agree upon and document mechanisms to  monitor, evaluate, and report to the public on the results of joint efforts. If  these entities do not effectively coordinate their implementation activities,  they may waste resources by creating ineffective and incompatible pieces  of a larger security program. For example, because the private sector  owns or operates a majority of the nation’s critical infrastructure, DHS  must partner with individual companies and sector organizations to  protect vital national infrastructure, such as the nation’s water supply,  transportation systems, and chemical facilities.
For the purposes of this report, we are generally highlighting examples of  key DHS areas related to partnerships and coordination on which we  have recently reported. We are generally not addressing areas on which  we have not reported or have conducted limited audit work. For example,  DHS has ongoing efforts related to coordinating with homeland security  partners within and across its various mission areas and programs, such  as for combating nuclear terrorism and conducting biological research to  support the nation’s biodefense preparedness. We have not completed  work on these areas upon which to make an assessment of DHS’s  progress.
section_title: Key Progress and Work Remaining
paragraphs: coordination of standards and practices, use of enhanced technology,  and assessments of foreign airports. We also reported that DHS and TSA  coordinated with foreign governments to harmonize air cargo security  practices to address the statutory mandate to screen 100 percent of air  cargo transported on U.S.-bound passenger aircraft. In July 2011, TSA  reported that it had requested air carrier feedback on their ability to  accomplish 100 percent of screening on international inbound air cargo  by December 2011, and is evaluating industry comments to finalize its  strategy and establish a feasible timeline for implementing the screening  requirement.
With regard to critical infrastructure protection, in September 2010 we  reported that DHS’s National Protection and Programs Directorate  (NPPD) operates the Protective Security Advisor Program, which deploys  critical infrastructure protection and security specialists, called Protective  Security Advisors, to local communities throughout the country. These  advisors lead NPPD’s efforts in these locations and act as a link between  state, local, tribal, and territorial organizations and DHS infrastructure  mission partners. DHS also reported that these advisors work to maintain  relationships with the private sector and local communities to help foster  effective information sharing and disseminate information to the private  sector during times of increased threat.
July 2011 that it was taking additional action by, for example, establishing  cybersecurity working groups, interagency coordination groups, and a  performance measure for fiscal year 2012 to seek public and private  sector feedback on the extent to which DHS cybersecurity products are  actionable and timely. However, as DHS is in the processing of  implementing these efforts, it is too early to assess their effectiveness.
With regard to border security, in December 2010 we reported that  federal, state, local, tribal, and Canadian law enforcement partners  reported improved DHS coordination to secure the northern border. For  example, interagency forums helped establish a common understanding  of border security threats, while joint operations helped to achieve an  integrated and effective law enforcement response. However, challenges  remained in sharing information and resources useful for operations along  the northern border. For example, partners in all four sectors we visited  cited ongoing challenges in sharing information and resources for daily  border security-related to operations and investigations, and we reported  that oversight by management at the component and local level had not  ensured consistent compliance with provisions of interagency  agreements, such as those related to information sharing. In November  2010, we reported that information sharing and communication among  the Departments of Agriculture, Homeland Security, and Interior for  securing federal and tribal lands along the border had increased, but that  critical gaps remained. For example, these agencies had established  forums and liaisons to exchange information; however, in one sector they  did not coordinate to ensure that federal land law enforcement officials  maintained access to threat information and compatible secure radio  communications for daily operations. Coordination in these areas could  better ensure officer safety and an efficient law enforcement response to  illegal activity. and border management programs or its approaches relative to  addressing outcomes shared by those programs. As a result, we  concluded that the department risked suboptimizing how its programs  collectively supported its immigration and border management goals and  objectives. We have made recommendations to DHS to strengthen its  border security coordination efforts. For example, we recommended that  DHS provide oversight to ensure efficient use of border security  interagency forums and compliance with interagency agreements; take  necessary action to ensure that personnel conduct early and continued  consultations to coordinate on, among other things, threat information for  federal lands that is timely and actionable; and fully define relationships  between the US-VISIT program and other programs.
DHS concurred and reported, for example, that it plans to review the  inventory of interagency forums through its strategic and operational  planning efforts to assess efficiency and identify challenges. Further, in  July 2011, the US-VISIT program office reported taking action to  coordinate with other immigration and border security programs. For  example, it reported that it had established a governance board to  enhance border security solutions to meet congressional mandates, and  supported the expansion of immigration enforcement related programs,  such as Secure Communities through which U.S. Immigration and  Customs Enforcement works with state and local law enforcement  agencies to identify and remove immigration violators. While these are  positive steps, DHS needs to demonstrate that these efforts have helped  the department to fully define relationships between the US-VISIT  program and other programs. and continuity beyond the tenure of any given official or individual office,  and recommended that the departments develop these practices. DHS  concurred with our recommendation.
section_title: GAO Contact
paragraphs: For additional information about this area, contact Cathleen A. Berrick at  (202) 512-3404 or berrickc@gao.gov.
section_title: Appendix XVIII: Developing and Deploying New Technologies for Homeland Security
subsections: section_title: What This Area Includes
paragraphs: Since beginning operations in 2003, the Department of Homeland  Security (DHS) has spent billions of dollars on research and development  of technologies and other countermeasures to address threats and  conduct its missions. DHS programs represent hundreds of billions of  dollars in life-cycle costs and support a wide range of missions and  investments, including border surveillance and screening equipment,  nuclear detection equipment, information systems that help detect and  interdict the planning of terrorist acts, and technologies used to screen  airline passengers and baggage for explosives. Within DHS, the Science  and Technology Directorate (S&T) has the authority to coordinate overall  research and development efforts to improve homeland security. Among  other things, S&T works with DHS components to provide assistance in  researching and developing technologies to meet their specific missions,  while the components themselves are responsible for developing, testing,  and acquiring these technologies. For instance, the Transportation  Security Administration (TSA) works with S&T to research, develop, and  deploy technologies to, for example, screen airline passengers and their  baggage. DHS’s Domestic Nuclear Detection Office (DNDO) is  responsible for developing, acquiring, and supporting the deployment of  programs and systems to detect and report on attempts to develop,  transport, or use unauthorized nuclear explosive, fissile, or radiological  materials or explosives in the United States.
For the purposes of this report, we are generally highlighting examples of  DHS efforts related to developing and deploying new technologies on  which we have recently reported, and are generally not addressing areas  on which we have not reported or have conducted limited audit work.  While this section addresses examples on which we have reported, which  focus on DHS’s efforts related to technologies for border, transportation,  and maritime security, DHS has other efforts related to developing and  deploying new technologies, such as technologies for intelligence. DHS  also reported that it has taken steps intended to formalize requirements  definition and technology development. We have not completed work on  these areas upon which to make an assessment of DHS’s progress.
section_title: Key Progress and Work Remaining
paragraphs: DHS took action to develop and deploy new technologies to help  meet its homeland security missions. However, in some instances  DHS pursued acquisitions without ensuring that the technologies  met defined requirements and faced challenges in conducting and  documenting testing and evaluation and performing cost-benefit  analyses. DHS developed and deployed various technologies within its  functional areas, including maritime and transportation security. For  example, in September 2010, we reported that DHS made progress in  researching and developing container security technologies. Specifically,  we reported that since fiscal year 2004 DHS conducted research and  development for four container security technology projects to monitor  cargo tampering and, according to DHS, provide a global communication  system to securely transmit information to DHS components responsible  for port security. Moreover, in June 2010 we reported that DHS made  significant progress in deploying radiation detection equipment to scan  cargo and conveyances entering the United States through fixed land and  sea ports of entry for nuclear and radiological materials. Specifically, we  reported that DHS deployed more than 1,400 radiation portal monitors to  ports of entry. Further, TSA continues to deploy technologies to screen  checked baggage. As of July 2011, TSA reported that it had about 2,300  explosives detection systems in its fleet, about 1,900 of which were  deployed at airports in the United States. At airports and terminals that  do not use these systems, explosives trace detection machines are used  for primary checked-baggage screening, typically at smaller airports. As  of July 2011, TSA estimated that there were about 5,000 explosives trace  detection machines used for the primary or secondary screening of  checked baggage at U.S. commercial airports. In addition, in June 2010  we reported that DHS, the United States Postal Service, and the  Department of Defense developed and implemented technologies to  sample the air and test for specific biological agents. In particular, DHS’s  BioWatch program had been implemented in more than 30 metropolitan  areas and tests for the presence of multiple biological agents.
However, our work has shown that DHS made acquisition decisions  without ensuring that the systems met program and performance  requirements.
In September 2010, we reported that DNDO was simultaneously  engaged in the research and development phase while planning for  the acquisition phase of its cargo advanced automated radiography  system to detect certain nuclear materials in vehicles and containers  at ports. DNDO pursued the acquisition and deployment of the cargo  advanced automated radiography system without fully understanding  that it would not fit within existing inspection lanes at ports of entry.  This occurred because, during the first year or more of the program,  DNDO and U.S. Customs and Border Protection (CBP) had few  discussions about operating requirements for primary inspection lanes  at ports of entry. DHS announced the termination of the program in  2010.   In July 2011, we reported that TSA revised its explosives detection  system requirements to better address current threats in screening  checked baggage, and plans to implement these requirements in a  phased approach. However, we reported that some number of  systems in TSA’s fleet was configured to detect explosives at the  levels established in the 2005 requirements and that the remaining  systems were configured to detect explosives at 1998 levels. When  TSA established the 2005 requirements, it did not have a plan with  time frames to deploy the explosives detection systems to meet the  new requirements. We recommended that TSA develop a plan to  deploy and operate explosives detection systems to meet the most  recent requirements. TSA concurred and, in July 2011, reported that it  intends to finalize a plan by the fourth quarter of fiscal year 2012. proceed to the next acquisition phase. However, the office did not  consistently document its review and approval of components’ test  agents—a government entity or independent contractor carrying out  independent operational testing for a major acquisition. In addition,  the office did not document its review of other component acquisition  documents, such as those establishing programs’ operational  requirements.   In March 2011, we reported that the independent testing and  evaluation of the Secure Border Initiative Network’s virtual fence Block  1 capability to determine its operational effectiveness and suitability  was not complete at the time DHS reached its decision regarding the  future of the Secure Border Initiative Network, or requested fiscal year  2012 funding to deploy the new Alternative (Southwest) Border  Technology.We reported that because the new Alternative  (Southwest) Border Technology incorporates a mix of technology that  includes an Integrated Fixed Tower surveillance system similar to that  currently used in the Secure Border Initiative Network, such testing  and evaluation could have informed DHS’s decision about moving  forward with the new technology deployment.   In September 2010, we reported that S&T’s master plans for  conducting operational testing of container security technologies did  not reflect all of the operational scenarios that CBP was considering  for implementation. For example, S&T did not include certain  scenarios necessary to test how a cargo container would be  transported throughout the maritime supply chain. Until the container  security technologies are tested and evaluated consistent with all of  the operational scenarios, S&T cannot provide reasonable assurance  that the technologies will function as intended. process. Further, in July 2011, S&T and CBP reported starting a joint pilot  program to implement a new supply chain security technology on  selected rail and truck cargo routes from Mexico and Canada into the  United States to evaluate land cargo security devices intended to monitor  unauthorized door openings or anomalies and to provide encrypted in- transit tracking.
In addition, DHS has not consistently included cost-benefit analyses in its  acquisition decision making. Our prior work shows that cost-benefit  analyses help decision makers assess and prioritize resource  investments and consider potentially more cost-effective alternatives. For  example, in 2006, we recommended that DHS’s decision to deploy next- generation radiation-detection equipment, or advanced spectroscopic  portals, used to detect smuggled nuclear or radiological materials, be  based on an analysis of both the benefits and costs and a determination  of whether any additional detection capability provided by the portals was  worth their additional cost.DHS subsequently issued a cost-benefit  analysis, but we reported that this analysis did not provide a sound  analytical basis for DHS’s decision to deploy the portals. In June 2009,  we also reported that an updated cost-benefit analysis might show that  DNDO’s plan to replace existing equipment with advanced spectroscopic  portals was not justified, particularly given the marginal improvement in  detection of certain nuclear materials required of advanced spectroscopic  portals and the potential to improve the current-generation portal  monitors’ sensitivity to nuclear materials, most likely at a lower cost. At  that time, DNDO officials stated that they planned to update the cost- benefit analysis. In July 2011, DHS announced that DNDO and CBP  would end the advanced spectroscopic portal project as originally  conceived given the challenges the program faced. DHS reported that it  plans to deploy the existing units to field locations to gather operational  data to support future planning efforts. investment life cycle and participate in new councils and boards DHS is  planning to create to help ensure that test and evaluation methods are  appropriately considered as part of DHS’s overall research and  development investment strategies. In addition, DHS reported that the  new councils and boards it is planning to establish would be responsible  for, among other things, making decisions on research and development  initiatives based on factors such as viability and affordability, and  overseeing key acquisition decisions for major programs using baseline  and actual data. According to DHS, S&T will help ensure that new  technologies are properly scoped, developed, and tested before being  implemented. In July 2011, S&T reported that it established a new group  to work with DHS components to, among other things, help ensure that  operational requirements are completely specified and validated and that  comprehensive cost-benefit analyses are performed to identify the best  alternative for meeting identified mission needs. However, as DHS has  recently established this group, it is too soon to assess its effectiveness.  DHS also reports that it is working with components to improve the quality  and accuracy of cost estimates and increased its staff during fiscal year  2011 to develop independent cost estimates, a best practice, to ensure  the accuracy and credibility of program costs. DHS reports that four cost  estimates for level 1 programs have been validated to date. The actions  DHS reported taking or underway to address the management of its  acquisitions and the development of new technologies are positive steps  and, if implemented effectively, could help the department address a  number of these challenges.
section_title: GAO Contact
paragraphs: For additional information about this area, contact David Maurer at (202)  512-9627 or maurerd@gao.gov.
section_title: Appendix XIX: Comments from the Department of Homeland Security
section_title: Appendix XX: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the person named above, Rebecca Gambler, Assistant  Director; Taylor Matheson, Analyst-in-Charge; Melissa Bogar; Susan  Czachor; Lorraine Ettaro; Sarah Kaczmarek; Tracey King; Dawn Locke;  Jan Montgomery; Jessica Orr; and Meghan Squires made key  contributions to this report. Other contributors to this report included Joel  Aldape; David Alexander; Gene Aloise; Rodell Anderson; Aditi Archer;  Sarah Arnett; Neil Asaba; Ben Atwater; Jonathan Bachman; Charles  Bausell; Claudia Becker; Scott Behen; Carolyn Blocker; David Bruno;  Carissa Bryant; Rochelle Burns; Alicia Cackley; Stephen Caldwell; Lisa  Canini; Caitlin Carlberg; Tammy Conquest; Christopher Currie; Ryan  Consaul; Frances Cook; Joseph Cruz; Anthony DeFrank; Davi  D'Agostino; Kay Daly; Deborah Davis; Katherine Davis; Vanessa Dillard;  Michael Dino; Rick Eiserman; Eric Erdman; Jeanette Espinola; Alana  Finley; Edward George; Robin Ghertner; Michael Gilmore; Kathryn  Godfrey; Robert Goldenkoff; Mark Goldstein; Barbara Guffy; Geoffrey  Hamilton; Christopher Hatscher; Brent Helt; David Hinchman; Richard  Hung; John Hutton; William O. Jenkins, Jr.; Amanda Jones; Yvonne  Jones; Valerie Kasindi; Christopher Keisling; Anjalique Lawrence; Michael  Lenington; Eileen Larence; Marya Link; Thomas Lombardi; Stephen Lord;  Robert Lowthian; Jessica Lucas Judy; David Lysy; Gary Malavenda; Kush  Malhotra; David Maurer; Linda Miller; Lara Miklozek; Anthony Moran;  Steve Morris; John Mortin; Gary Mountjoy; Suzanne Murphy; Robin Nye;  Jean Orland; Sabine Paul; David Powner; Paula Rascona; Janay Sam;  Debra Sebastian; Richard M. Stana; Kevin Tarmann; Nathan Tranquilli;  Katherine Trimble; Meg Ullengren; Sarah Veale; Gregory Wilshusen;  Michelle Woods; and Edwin Woodward.
section_title: Related Reports
paragraphs: GAO. Aviation Security: TSA Has Taken Actions to Improve Security, but  Additional Efforts Remain. GAO-11-807T. Washington, D.C.: July 13,  2011.
GAO. Aviation Security: TSA Has Enhanced Its Explosives Detection  Requirements for Checked Baggage, but Additional Screening Actions  Are Needed. GAO-11-740. Washington, D.C.: July 11, 2011.
GAO. Transportation Worker Identification Credential: Internal Control  Weaknesses Need to Be Corrected to Help Achieve Security Objectives.  GAO-11-657. Washington, D.C.: May 10, 2011.
GAO. Aviation Security: Progress Made, but Challenges Persist in  Meeting the Screening Mandate for Air Cargo. GAO-11-413T.  Washington, D.C.: March 9, 2011.
GAO. Aviation Security: TSA’s Revised Cost Comparison Provides a  More Reasonable Basis for Comparing the Costs of Private-Sector and  TSA Screeners. GAO-11-375R. Washington, D.C.: March 4, 2011.
GAO. Opportunities to Reduce Potential Duplication in Government  Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP.  Washington, D.C.: March 1, 2011.
GAO. Aviation Security: TSA Has Made Progress but Faces Challenges  in Meeting the Statutory Mandate for Screening Air Cargo on Passenger  Aircraft. GAO-10-446. Washington, D.C.: June 28, 2010.
GAO. Aviation Security: Efforts to Validate TSA’s Passenger Screening  Behavior Detection Program Underway, but Opportunities Exist to  Strengthen Validation and Address Operational Challenges. GAO-10-763.  Washington, D.C.: May 20, 2010.
GAO. GAO Review of the Department of Homeland Security’s  Certification of the Secure Flight Program—Cost and Schedule  Estimates. GAO-10-535R. Washington, D.C.: April 5, 2010.
GAO. Aviation Security: TSA Is Increasing Procurement and Deployment  of the Advanced Imaging Technology, but Challenges to This Effort and  Other Areas of Aviation Security Remain. GAO-10-484T. Washington,  D.C.: March 17, 2010.
GAO. Transportation Worker Identification Credential: Progress Made in  Enrolling Workers and Activating Credentials but Evaluation Plan Needed  to Help Inform the Implementation of Card Readers. GAO-10-43.  Washington, D.C.: November 18, 2009.
GAO. Aviation Security: DHS and TSA Have Researched, Developed,  and Begun Deploying Passenger Checkpoint Screening Technologies,  but Continue to Face Challenges. GAO-10-128. Washington, D.C.:  October 7, 2009.
GAO. Aviation Security: A National Strategy and Other Actions Would  Strengthen TSA's Efforts to Secure Commercial Airport Perimeters and  Access Controls. GAO-09-399. Washington, D.C.: September 30, 2009.
GAO. Transportation Security: Comprehensive Risk Assessments and  Stronger Internal Controls Needed to Help Inform TSA Resource  Allocation. GAO-09-492. Washington, D.C.: March 27, 2009.
GAO. Aviation Security: Federal Air Marshal Service Has Taken Actions  to Fulfill Its Core Mission and Address Workforce Issues, but Additional  Actions Are Needed to Improve Workforce Survey. GAO-09-273.  Washington, D.C.: January 14, 2009.
GAO. Aviation Security: TSA’s Cost and Performance Study of Private- Sector Airport Screening. GAO-09-27R. Washington, D.C.: January 9,  2009.
GAO. Aviation Security: Transportation Security Administration Has  Strengthened Planning to Guide Investments in Key Aviation Security  Programs, but More Work Remains. GAO-08-1024T. Washington, D.C.:  July 24, 2008.
GAO. Transportation Security: Efforts to Strengthen Aviation and Surface  Transportation Security Continue to Progress, but More Work Remains.  GAO-08-651T. Washington, D.C.: April 15, 2008.
GAO. Aviation Security: Transportation Security Administration Has  Strengthened Planning to Guide Investments in Key Aviation Security  Programs, but More Work Remains. GAO-08-456T. Washington, D.C.:  February 28, 2008.
GAO. Aviation Security: Risk, Experience, and Customer Concerns Drive  Changes to Airline Passenger Screening Procedures, but Evaluation and  Documentation of Proposed Changes Could Be Improved. GAO-07-634.  Washington, D.C.: April 16, 2007.
GAO. Aviation Security: Systematic Planning Needed to Optimize the  Deployment of Checked Baggage Screening Systems. GAO-05-365.  Washington, D.C.: March 15, 2005.
Department of Homeland Security Office of Inspector General.  Transportation Security Administration’s Management of Its Screening  Workforce Training Program Can Be Improved, OIG-11-05. Washington,  D.C.: October 26, 2010.
Department of Homeland Security Office of Inspector General.  Transportation Security Administration’s Controls over SIDA Badges,  Uniforms, and Identification Cards, OIG-08-92. Washington, D.C.:  September 12, 2008.
subsections: section_title: Chemical, Biological, Radiological, and Nuclear Threats
paragraphs: GAO. Combating Nuclear Smuggling: DHS has Developed a Strategic  Plan for its Global Nuclear Detection Architecture, but Gaps Remain.  GAO-11-869T. Washington, D.C.: July 26, 2011.
GAO. National Preparedness: DHS and HHS Can Further Strengthen  Coordination for Chemical, Biological, Radiological, and Nuclear Risk  Assessments. GAO-11-606. Washington, D.C.: June 21, 2011.
GAO. DHS Science and Technology: Additional Steps Needed to Ensure  Test and Evaluation Requirements are Met. GAO-11-596. Washington,  D.C.: June 15, 2011.
GAO. Combating Nuclear Smuggling: DHS Has Made Some Progress but  Not Yet Completed a Strategic Plan for Its Global Nuclear Detection  Efforts or Closed Identified Gaps. GAO-10-883T. Washington, D.C.: June  30, 2010.
GAO. Biosurveillance: Efforts to Develop a National Biosurveillance  Capability Need a National Strategy and a Designated Leader.  GAO-10-645. Washington, D.C.: June 30, 2010.
GAO. Biosurveillance: Developing a Collaboration Strategy Is Essential to  Fostering Interagency Data and Resource Sharing. GAO-10-171.  Washington, D.C.: December 18, 2009.
GAO. Combating Nuclear Smuggling: DHS Improved Testing of  Advanced Radiation Detection Portal Monitors, but Preliminary Results  Show Limits of the New Technology, GAO-09-655. Washington, D.C.:  May 21, 2009.
GAO. Nuclear Detection: Domestic Nuclear Detection Office Should  Improve Planning to Better Address Gaps and Vulnerabilities.  GAO-09-257. Washington, D.C.: January 29, 2009.
GAO. Combating Nuclear Smuggling: Lessons Learned from DHS  Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T.  Washington, D.C.: June 25, 2009.
GAO, Combating Nuclear Smuggling: DHS’s Phase 3 Test Report on  Advanced Portal Monitors Does Not Fully Disclose the Limitations of the  Test Results, GAO-09-979. Washington, D.C.: September 30, 2008.
section_title: Critical Infrastructure Protection—Physical Assets
paragraphs: GAO. Rail Security: TSA Improved Risk Assessment but Could Further  Improve Training and Information Sharing. GAO-11-688T. Washington,  D.C.: June 14, 2011.
GAO. Critical Infrastructure Protection: DHS Efforts to Assess and  Promote Resiliency Are Evolving but Program Management Could Be  Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010.
GAO. Homeland Security: Preliminary Observations on the Federal  Protective Service’s Workforce Analysis and Planning Efforts.  GAO-10-802R. Washington, D.C.: June 14, 2010.
GAO. Critical Infrastructure Protection: Update to National Infrastructure  Protection Plan Includes Increased Emphasis on Risk Management and  Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.
GAO. Emergency Communications: Vulnerabilities Remain and Limited  Collaboration and Monitoring Hamper Federal Efforts. GAO-09-604.  Washington, D.C.: June 26, 2009.
GAO. Freight Rail Security: Actions Have Been Taken to Enhance  Security, but the Federal Strategy Can Be Strengthened and Security  Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009.
GAO. Transportation Security: Comprehensive Risk Assessments and  Stronger Internal Controls Needed to Help Inform TSA Resource  Allocation. GAO-09-492. Washington, D.C.: March 27, 2009.
GAO. Highway Infrastructure: Federal Efforts to Strengthen Security  Should Be Better Coordinated and Targeted on the Nation’s Most Critical  Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009.
Department of Homeland Security Office of Inspector General, Efforts to  Identify Critical Infrastructure Assets and Systems, OIG-09-86.  Washington, D.C.: June 30, 2009.
section_title: Surface Transportation Security
paragraphs: GAO. Rail Security: TSA Improved Risk Assessment but Could Further  Improve Training and Information Sharing. GAO-11-688T. Washington,  D.C.: June 14, 2011.
GAO. Public Transit Security Information Sharing: DHS Could Improve  Information Sharing through Streamlining and Increased Outreach.  GAO-10-895. Washington, D.C.: September 22, 2010.
GAO. Pipeline Security: TSA Has Taken Actions to Help Strengthen  Security, but Could Improve Priority-Setting and Assessment Processes.  GAO-10-867. Washington, D.C.: August 4, 2010.
GAO. Surface Transportation Security: TSA Has Taken Actions to  Manage Risk, Improve Coordination, and Measure Performance, but  Additional Actions Would Enhance Its Efforts. GAO-10-650T.  Washington, D.C.: April 21, 2010.
GAO. Transportation Security: Key Actions Have Been Taken to Enhance  Mass Transit and Passenger Rail Security, but Opportunities Exist to  Strengthen Federal Strategy and Programs. GAO-09-678. Washington,  D.C.: June 24, 2009.
GAO. Transit Security Grant Program: DHS Allocates Grants Based on  Risk, but Its Risk Methodology, Management Controls, and Grant  Oversight Can Be Strengthened. GAO-09-491. Washington, D.C.: June 8,  2009.
GAO. Freight Rail Security: Actions Have Been Taken to Enhance  Security, but the Federal Strategy Can Be Strengthened and Security  Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009.
GAO, Transportation Security: Comprehensive Risk Assessments and  Stronger Internal Controls Needed to Help Inform TSA Resource  Allocation. GAO-09-492. Washington, D.C.: March 2009.
GAO. Commercial Vehicle Security: Risk-Based Approach Needed to  Secure the Commercial Vehicle Sector. GAO-09-85. Washington, D.C.:  February 27, 2009.
GAO. Highway Infrastructure: Federal Efforts to Strengthen Security  Should Be Better Coordinated and Targeted on the Nation’s Most Critical  Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009.
GAO. TSA’s Explosives Detection Canine Program: Status of Increasing  Number of Explosives Detection Canine Teams. GAO-08-933R.  Washington, D.C.: July 31, 2008.
GAO. Department of Homeland Security Progress Report on  Implementation of Mission and Management Functions. GAO-07-454.  Washington, D.C.: August 17, 2007.
Department of Homeland Security Office of Inspector General, DHS  Grants Used for Mitigating Risks to Amtrak Rail Stations. OIG-11-93.  Washington, D.C.: June 27, 2011.
Department of Homeland Security Office of Inspector General, Use of  American Recovery and Reinvestment Act Funds by the Federal  Emergency Management Agency for the Transit Security Grant Program.  OIG-11-18. Washington, D.C.: December 9, 2010.
section_title: Border Security
paragraphs: GAO. Border Security: DHS Progress and Challenges in Securing the  U.S. Southwest and Northern Borders. GAO-11-508T. Washington, D.C.:  March 30, 2011.
GAO. Border Security: Preliminary Observations on the Status of Key  Southwest Border Technology Programs. GAO-11-448T. Washington,  D.C.: March 15, 2011.
GAO. Visa Waiver Program: DHS Has Implemented the Electronic  System for Travel Authorization, but Further Steps Needed to Address  Potential Program Risks. GAO-11-335. Washington, D.C.: May 5, 2011.
GAO. Border Security: DHS's Visa Security Program Needs to Improve  Performance Evaluation and Better Address Visa Risk Worldwide.  GAO-11-315. Washington, D.C.: March 31, 2011.
GAO. Border Security: Enhanced DHS Oversight and Assessment of  Interagency Coordination Is Needed for the Northern Border. GAO-11-97.  Washington, D.C.: December 17, 2010.
GAO. Secure Border Initiative: DHS Needs to Strengthen Management  and Oversight of Its Prime Contractor. GAO-11-6. Washington, D.C.:  October 18, 2010.
GAO. Homeland Security: US-VISIT Pilot Evaluations Offer Limited  Understanding of Air Exit Options. GAO-10-860. Washington, D.C.:  August 10, 2010.
GAO. Border Security: CBP Lacks the Data Needed to Assess the FAST  Program at U.S. Northern Border Ports. GAO-10-694. Washington, D.C.:  July 19, 2010.
GAO. Secure Border Initiative: DHS Needs to Reconsider Its Proposed  Investment in Key Technology Program. GAO-10-340. Washington, D.C.:  May 5, 2010.
GAO. Secure Border Initiative: DHS Has Faced Challenges Deploying  Technology and Fencing Along the Southwest Border. GAO-10-651T.  Washington, D.C.: May 4, 2010.
GAO. Secure Border Initiative: DHS Needs to Address Testing and  Performance Limitations That Place Key Technology Program at Risk.  GAO-10-158. Washington, D.C.: January 29, 2010.
GAO. Homeland Security: Key US-VISIT Components at Varying Stages  of Completion, but Integrated and Reliable Schedule Needed.  GAO-10-13. Washington, D.C.: November 19, 2009.
GAO. Secure Border Initiative: Technology Deployment Delays Persist  and the Impact of Border Fencing Has Not Been Assessed. GAO-09-896.  Washington, D.C.: September 9, 2009.
GAO. Border Patrol: Checkpoints Contribute to Border Patrol’s Mission,  but More Consistent Data Collection and Performance Measurement  Could Improve Effectiveness. GAO-09-824. Washington, D.C.: August 31,  2009.
GAO. Border Security: Despite Progress, Weaknesses in Traveler  Inspections Exist at Our Nation’s Ports of Entry. GAO-08-219.  Washington, D.C.: November 5, 2007.
Department of Homeland Security Office of Inspector General. CBP’s  Efficacy of Controls Over Drug Seizures. OIG-11-57. Washington, D.C.:  March 17, 2011.
Department of Homeland Security Office of Inspector General. Customs  and Border Protection Needs to Improve Its Inspection Procedures for the  Western Hemisphere Travel Initiative. OIG-11-43. Washington, D.C.:  February 11, 2011.
section_title: Maritime Security
paragraphs: GAO. Maritime Security: Progress Made but Further Actions Needed to  Secure the Maritime Energy Supply. GAO-11-883T. Washington, D.C.:  August 24, 2011.
GAO. Transportation Worker Identification Credential: Internal Control  Weaknesses Need to Be Corrected to Help Achieve Security.  GAO-11-657. Washington, D.C.: May 10, 2011.
GAO. Maritime Security: Federal Agencies Have Taken Actions to  Address Risks Posed by Seafarers, but Efforts Can be Strengthened.  GAO-11-195. Washington, D.C.: January 14, 2011.
GAO. Maritime Security: Ferry Security Measures Have Been  Implemented, but Evaluating Existing Studies Could Further Enhance  Security. GAO-11-207. Washington, D.C.: December 3, 2010.
GAO. Combating Nuclear Smuggling: Inadequate Communication and  Oversight Hampered DHS Efforts to Develop an Advanced Radiography  System to Detect Nuclear Materials. GAO-10-1041T. Washington, D.C.:  September 15, 2010  GAO. Maritime Security: DHS Progress and Challenges in Key Areas of  Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010.
GAO. Supply Chain Security: DHS Should Test and Evaluate Container  Security Technologies Consistent with All Identified Operational  Scenarios to Ensure the Technologies Will Function as Intended.  GAO-10-887. Washington, D.C.: September 29, 2010.
GAO. Coast Guard: Efforts to Identify Arctic Requirements Are Ongoing,  but More Communication about Agency Planning Efforts Would Be  Beneficial. GAO-10-870. Washington, D.C.: September 15, 2010.
GAO. Maritime Security: Varied Actions Taken to Enhance Cruise Ship  Security, but Some Concerns Remain. GAO-10-400. Washington, D.C.:  April 9, 2010.
GAO. Combating Nuclear Smuggling: Recent Testing Raises Issues  About the Potential Effectiveness of Advanced Radiation Detection Portal  Monitors. GAO-10-252T. Washington, D.C.: November 17, 2009.
GAO. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would  Assist DHS and Congress in Assessing and Implementing the  Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12.  Washington, D.C.: October 30, 2009.
GAO. Combating Nuclear Smuggling: Lessons Learned from DHS  Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T.  Washington, D.C.: June 25, 2009.
GAO. Combating Nuclear Smuggling: DHS Improved Testing of  Advanced Radiation Detection Portal Monitors, but Preliminary Results  Show Limits of the New Technology. GAO-09-655. Washington, D.C.:  May 21, 2009.
GAO. Maritime Security: Vessel Tracking Systems Provide Key  Information, but the Need for Duplicate Data Should Be Reviewed.  GAO-09-337. Washington, D.C.: March 17, 2009.
GAO. Maritime Security: Coast Guard Inspections Identify and Correct  Facility Deficiencies, but More Analysis Needed of Program's Staffing,  Practices, and Data. GAO-08-12. Washington, D.C.: February 14, 2008.
GAO. Maritime Security: The SAFE Port Act: Status and Implementation  One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2006.
Department of Homeland Security Office of Inspector General. Customs  and Border Protection’s Importer Self-Assessment Program. OIG-10-113.  Washington, D.C.: August 30, 2010.
Department of Homeland Security Office of Inspector General. CBP's  Container Security Initiative Has Proactive Management and Oversight  but Future Direction Is Uncertain. OIG-10-52. Washington, D.C.: February  3, 2010.
Department of Homeland Security Office of Inspector General. Cargo  Targeting and Examinations. OIG-10-34. Washington, D.C.: January 6,  2010.
Department of Homeland Security Office of Inspector General. CBP's  Ability to Detect Biological and Chemical Threats in Maritime Cargo  Containers. OIG-10-01. Washington, D.C.: October 7, 2009.
Immigration Enforcement  GAO. Overstay Enforcement: Additional Mechanisms for Collecting,  Assessing, and Sharing Data Could Strengthen DHS’s Efforts but Would  Have Costs. GAO-11-411. Washington, D.C.: April 15, 2011.
GAO. Employment Verification: Agencies Have Improved E-Verify, but  Significant Challenges Remain. GAO-11-522T. Washington, D.C.: April  14, 2011.
GAO. Employment Verification: Federal Agencies Have Taken Steps to  Improve E-Verify, but Significant Challenges Remain. GAO-11-146.  Washington, D.C.: December 17, 2010.
GAO. Moving Illegal Proceeds: Challenges Exist in the Federal  Government’s Effort to Stem Cross-Border Currency Smuggling,  GAO-11-73, Washington, D.C.: October 25, 2010.
GAO. Alien Smuggling: DHS Needs to Better Leverage Investigative  Resources and Measure Program Performance along the Southwest  Border. GAO-10-328. Washington, D.C.: May 24, 2010.
GAO. Firearms Trafficking: U.S. Efforts to Combat Arms Trafficking to  Mexico Face Planning and Coordination Challenges. GAO-09-709.  Washington, D.C.: June 18, 2009.
GAO. Immigration Enforcement: Better Controls Needed over Program  Authorizing State and Local Enforcement of Federal Immigration Laws.  GAO-09-109. Washington, D.C.: January 30, 2009.
Department of Homeland Security Office of Inspector General. U.S.  Immigration and Customs Enforcement Identification of Criminal Aliens in  Federal and State Custody Eligible for Removal from the United States.  OIG-11-26. Washington, D.C.: January 10, 2011.
Department of Homeland Security Office of Inspector General. The  Performance of the 287(g) Agreements Report Update. OIG-10-124.  Washington, D.C.: September 30, 2010.
Department of Homeland Security Office of Inspector General. The  Performance of 287(g) Agreements. OIG-10-63. Washington, D.C.: March  4, 2010.
section_title: Immigration Services
paragraphs: GAO. Immigration Benefits: Actions Needed to Address Vulnerabilities in  Process for Granting Permanent Residency. GAO-09-55. Washington,  D.C.: December 5, 2008.
GAO. U.S. Asylum System: Agencies Have Taken Actions to Help Ensure  Quality in the Asylum Adjudication Process, but Challenges Remain.  GAO-08-935. Washington, D.C.: September 25, 2008.
GAO. Immigration Benefits: Internal Controls for Adjudicating  Humanitarian Parole Cases Are Generally Effective, but Some Can Be  Strengthened. GAO-08-282. Washington, D.C.: February 6, 2008.
GAO. USCIS Transformation: Improvements to Performance, Human  Capital and Information Technology Management Needed as  Modernization Proceeds. GAO-07-1013R. Washington, D.C.: July 17,  2007.
Department of Homeland Security Office of Inspector General. U.S.  Citizenship and Immigration Services' Progress in Modernizing  Information Technology. OIG-09-90. Washington, D.C.: July 13, 2009.
Department of Homeland Security Office of Inspector General.  Management Oversight of Immigration Benefit Application Intake  Processes, OIG-09-37. Washington, D.C.: March 5, 2009.
Department of Homeland Security Office of Inspector General. Review of  the USCIS Benefit Fraud Referral Process, OIG-08-09. Washington, D.C.:  April 29, 2008.
section_title: Critical Infrastructure Protection—Cyber Assets
paragraphs: GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s  Critical Infrastructure. GAO-11-865T. Washington, D.C.: July, 26, 2011.
GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s  Critical Infrastructure and Federal Information Systems. GAO-11-463T.  Washington, D.C.: March 16, 2011.
GAO. Critical Infrastructure Protection: Key Private and Public Cyber  Expectations Need to Be Consistently Addressed. GAO-10-628.  Washington, D.C.: July 15, 2010.
GAO. Cybersecurity: Continued Attention Is Needed to Protect Federal  Information Systems from Evolving Threats. GAO-10-834T. Washington,  D.C.: June 16, 2010.
GAO. Information Security: Concerted Effort Needed to Consolidate and  Secure Internet Connections at Federal Agencies. GAO-10-237.  Washington, D.C.: March 12, 2010.
GAO. Critical Infrastructure Protection: Update to National Infrastructure  Protection Plan Includes Increased Emphasis on Risk Management and  Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.
GAO. Critical Infrastructure Protection: Current Cyber Sector-Specific  Planning Approach Needs Reassessment. GAO-09-969. Washington,  D.C.: September 24, 2009.
GAO. High-Risk Series: An Update. GAO-09-271. Washington, D.C.:  January 2009.
GAO. Critical Infrastructure Protection: DHS Needs To Fully Address  Lessons Learned from Its First Cyber Storm Exercise. GAO-08-825.  Washington, D.C.: September 9, 2008.
GAO. Cyber Analysis and Warning: DHS Faces Challenges in  Establishing a Comprehensive National Capability. GAO-08-588.  Washington, D.C.: July 31, 2008.
Department of Homeland Security Office of Inspector General. U.S.  Computer Emergency Readiness Team Makes Progress in Securing  Cyberspace, but Challenges Remain. OIG-10-94. Washington, D.C.: June  7, 2010.
section_title: Emergency Preparedness and Response
paragraphs: GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s  Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011  GAO. Measuring Disaster Preparedness: FEMA Has Made Limited  Progress in Assessing National Capabilities. GAO-11-260T. Washington,  D.C.: March 17, 2011.
GAO. Opportunities to Reduce Potential Duplication in Government  Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP.  Washington, D.C.: March 1, 2011.
GAO. FEMA Has Made Limited Progress in Efforts to Develop and  Implement a System to Assess National Preparedness Capabilities.  GAO-11-51R. Washington, D.C.: October 29, 2010.
GAO. Recovery Act: FEMA Could Take Steps to Protect Sensitive Port  Security Grant Details and Improve Recipient Reporting Instructions.  GAO-11-88. Washington, D.C.: October 15, 2010.
GAO. Disaster Recovery: FEMA's Long-term Assistance Was Helpful to  State and Local Governments but Had Some Limitations. GAO-10-404.  Washington, D.C.: March 30, 2010.
GAO. Emergency Communications: Establishment of the Emergency  Communications Preparedness Center and Related Interagency  Coordination Challenges. GAO-10-463R. Washington, D.C.: March 3,  2010.
GAO. Combating Nuclear Terrorism: Actions Needed to Better Prepare to  Recover from Possible Attacks Using Radiological or Nuclear Materials.  GAO-10-204. Washington, D.C.: January 29, 2010  GAO. Combating Nuclear Terrorism: Preliminary Observations on  Preparedness to Recovery from Possible Attacks Using Radiological or  Nuclear Materials. GAO-09-996T. Washington, D.C.: September 14, 2009  GAO. Emergency Preparedness: Improved Planning and Coordination  Necessary for Modernization and Integration of Public Alert and Warning  System. GAO-09-834. Washington, D.C.: September 9, 2009.
GAO. Hurricanes Gustav and Ike Disaster Assistance: FEMA  Strengthened Its Fraud Prevention Controls, but Customer Service Needs  Improvement. GAO-09-671. Washington, D.C.: June 19, 2009.
GAO. Emergency Communications: Vulnerabilities Remain and Limited  Collaboration and Monitoring Hamper Federal Efforts. GAO-09-604.  Washington, D.C.: June 19, 2009.
GAO. National Preparedness: FEMA Has Made Progress, but Needs to  Complete and Integrate Planning, Exercise, and Assessment Efforts.  GAO-09-369. Washington, D.C.: April 30, 2009.
GAO. Disaster Recovery: FEMA's Public Assistance Grant Program  Experienced Challenges with Gulf Coast Rebuilding. GAO-09-129.  Washington, D.C.: December 18, 2008.
GAO. Homeland Security: DHS Risk-Based Grant Methodology Is  Reasonable, But Current Version's Measure of Vulnerability is Limited.  GAO-08-852. Washington, D.C.: June 27, 2008.
GAO. National Flood Insurance Program: Financial Challenges  Underscore Need for Improved Oversight of Mitigation Programs and Key  Contracts. GAO-08-437. Washington, D.C.: June 16, 2008.
GAO. National Response Framework: FEMA Needs Policies and  Procedures to Better Integrate Non-Federal Stakeholders in the Revision  Process. GAO-08-768. Washington, D.C.: June 11, 2008.
Department of Homeland Security Office of Inspector General. Efficacy of  DHS Grants Programs. OIG-10-69. Washington, D.C.: March 22, 2010.
section_title: DHS Transformation and Implementation
paragraphs: GAO. High-Risk Series: An Update. GAO-11-278. Washington, D.C.:  February 2011.
GAO. Information Security: Federal Agencies Have Taken Steps to  Secure Wireless Networks, but Further Actions Can Mitigate Risk.  GAO-11-43. Washington, D.C.: November 30, 2010.
GAO. Department of Homeland Security: Assessments of Selected  Complex Acquisitions. GAO-10-588SP. Washington, D.C.: June 30, 2010.
GAO. Department of Homeland Security: DHS Needs to  Comprehensively Assess Its Foreign Language Needs and Capabilities  and Identify Shortfalls. GAO-10-714. Washington, D.C.: June 22, 2010.
GAO. Information Security: Agencies Need to Implement Federal Desktop  Core Configuration Requirements. GAO-10-202. Washington, D.C.:  March 12, 2010.
GAO. Financial Management Systems: DHS Faces Challenges to  Successfully Consolidating Its Existing Disparate Systems. GAO-10-76.  Washington, D.C.: December 4, 2009.
GAO. Department of Homeland Security: Actions Taken Toward  Management Integration, but a Comprehensive Strategy Is Still Needed.  GAO-10-131. Washington, D.C.: November 20, 2009.
GAO. Homeland Security: Despite Progress, DHS Continues to Be  Challenged in Managing Its Multi-Billion Dollar Annual Investment in  Large-Scale Information Technology Systems. GAO-09-1002T.  Washington, D.C.: September 15, 2009.
GAO. Equal Employment Opportunity: DHS Has Opportunities to Better  Identify and Address Barriers to EEO in Its Workforce. GAO-09-639  Washington, D.C.: August 31, 2009.
GAO. Department of Homeland Security: Billions Invested in Major  Programs Lack Appropriate Oversight. GAO-09-29. Washington, D.C.:  November 18, 2008.
GAO. Department of Homeland Security: Better Planning and  Assessment Needed to Improve Outcomes for Complex Service  Acquisitions. GAO-08-263. Washington, D.C.: April 22, 2008.
GAO. Homeland Security: Departmentwide Integrated Financial  Management Systems Remain a Challenge. GAO-07-536. Washington,  D.C.: June 21, 2007.
GAO. Information Technology Investment Management: A Framework for  Assessing and Improving Process Maturity, version 1.1. GAO-04-394G.  Washington, D.C.: March 2004.
GAO. High-Risk Series: Strategic Human Capital Management.  GAO-03-120. Washington, D.C.: January 2003.
GAO. Determining Performance and Accountability Challenges and High  Risks. GAO-01-159SP. Washington, D.C.: November 2000.
Department of Homeland Security Office of Inspector General. Major  Management Challenges Facing the Department of Homeland Security.  OIG-11-11. Washington, D.C.: November 10, 2010.
Performance Measurement  GAO. Overstay Enforcement: Additional Mechanisms for Collecting,  Assessing, and Sharing Data Could Strengthen DHS’s Efforts but Would  Have Costs. GAO-11-411. Washington, D.C.: April 15, 2011.
GAO. Measuring Disaster Preparedness: FEMA Has Made Limited  Progress in Assessing National Capabilities. GAO-11-260T. Washington,  D.C.: March 17, 2011.
GAO. Department of Homeland Security: Progress Made in  Implementation and Transformation of Management Functions, but More  Work Remains. GAO-10-911T. Washington, D.C.: September 30, 2010.
GAO. Alien Smuggling: DHS Needs to Better Leverage Investigative  Resources to Measure Program Performance along the Southwest  Border. GAO-10-328. Washington, D.C.: May 24, 2010.
GAO. Emergency Preparedness: FEMA Faces Challenges Integrating  Community Preparedness Programs into Its Strategic Approach.  GAO-10-193. Washington, D.C.: January 29, 2010.
GAO. Secure Border Initiative: Technology Deployment Delays Persist  and the Impact of Border Fencing Has Not Been Assessed.  GAO-09-1013T. Washington, D.C.: September 17, 2009.
GAO. Border Patrol: Checkpoints Contribute to Border Patrol’s Mission,  but More Consistent Data Collection and Performance Measurement  Could Improve Effectiveness. GAO-09-824. Washington, D.C.: August 31,  2009.
GAO. Department of Homeland Security: Progress Report on  Implementation of Mission and Management Functions. GAO-07-454.  Washington, D.C.: August 17, 2007.
section_title: Risk Management
paragraphs: GAO. National Preparedness: DHS and HHS Can Further Strengthen  Coordination for Chemical, Biological, Radiological, and Nuclear Risk  Assessments. GAO-11-606. Washington, D.C.: June 21, 2011.
GAO. Pipeline Security: TSA Has Taken Actions to Help Strengthen  Security, but Could Improve Priority-Setting and Assessment Processes.  GAO-10-867. Washington, D.C.: August 4, 2010.
GAO. Aviation Security: DHS and TSA Have Researched, Developed,  and Begun Deploying Passenger Checkpoint Screening Technologies,  but Continue to Face Challenges. GAO-10-128. Washington, D.C.:  October 7, 2009.
GAO. Freight Rail Security: Actions Have Been Taken to Enhance  Security, but the Federal Strategy Can Be Strengthened and Security  Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009.
GAO. Transportation Security: Comprehensive Risk Assessments and  Stronger Internal Controls Needed to Help Inform TSA Resource  Allocation. GAO-09-492. Washington, D.C.: March 27, 2009.
GAO. Commercial Vehicle Security: Risk-Based Approach Needed to  Secure the Commercial Vehicle Sector. GAO-09-85. Washington, D.C.:  February 27, 2009.
GAO. Highway Infrastructure: Federal Efforts to Strengthen Security  Should Be Better Coordinated and Targeted on the Nation’s Most Critical  Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009.
GAO. Homeland Security: DHS Risk-Based Grant Methodology Is  Reasonable, But Current Version’s Measure of Vulnerability Is Limited.  GAO-08-852. Washington, D.C.: June 27, 2008.
GAO. Risk Management: Progress Report on Implementation of Mission  and Management Functions. GAO-07-454. Washington, D.C.: August 17,  2007.
GAO. Department of Homeland Security: Further Refinements Needed to  Assess Risks and Prioritize Protective Measures at Ports and Other  Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15,  2005.
section_title: Information Sharing for Homeland Security
paragraphs: GAO. Information Sharing Environment: Better Road Map Needed to  Guide Implementation and Investments. GAO-11-455. Washington, D.C.:  July 21, 2011.
GAO. Rail Security: TSA Improved Risk Assessment but Could Further  Improve Training and Information Sharing. GAO-11-688T. Washington,  D.C.: June 14, 2011.
GAO. High-Risk Series: An Update. GAO-11-278. Washington, D.C.:  February 2011.
GAO. Information Sharing: DHS Could Better Define How It Plans to Meet  Its State and Local Mission and Improve Performance Accountability.  GAO-11-223. Washington, D.C.: December 16, 2010.
GAO. Information Sharing: Federal Agencies Are Helping Fusion Centers  Build and Sustain Capabilities and Protect Privacy, But Could Better  Measure Results. GAO-10-972. Washington, D.C.: September 29, 2010.
GAO. Public Transit Security Information Sharing: DHS Could Improve  Information Sharing through Streamlining and Increased Outreach.  GAO-10-895. Washington, D.C.: September 22, 2010.
GAO. Surface Transportation Security: TSA Has Taken Actions to  Manage Risk, Improve Coordination, and Measure Performance, but  Additional Actions Would Enhance Its Efforts. GAO-10-650T.  Washington, D.C.: April 21, 2010.
section_title: Partnerships and Coordination
paragraphs: GAO. Border Security: Enhanced DHS Oversight and Assessment of  Interagency Coordination Is Needed for the Northern Border. GAO-11-97.  Washington, D.C.: December 17, 2010.
GAO. Aviation Security: DHS Has Taken Steps to Enhance International  Aviation Security and Facilitate Compliance with International Standards,  but Challenges Remain. GAO-11-238T. Washington, D.C.: December 2,  2010.
GAO. Border Security: Additional Actions Needed to Better Ensure a  Coordinated Federal Response to Illegal Activity on Federal Lands.  GAO-11-177. Washington, D.C.: November 18, 2010.
GAO. Critical Infrastructure Protection: DHS Efforts to Assess and  Promote Resiliency Are Evolving but Program Management Could Be  Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010.
GAO. Critical Infrastructure Protection: Key Private and Public Cyber  Expectations Need to Be Consistently Addressed. GAO-10-628.  Washington, D.C.: July 15, 2010.
GAO. Emergency Preparedness: Improved Planning and Coordination  Necessary for Modernization and Integration of Public Alert and Warning  System. GAO-09-834. Washington, D.C.: September 9, 2009.
GAO, National Response Framework: FEMA Needs Policies and  Procedures to Better Integrate Non-Federal Stakeholders in the Revision  Process. GAO-08-768. Washington, D.C.: June 11, 2008.
GAO. Homeland Security: Strategic Solution for US-VISIT Program  Needs to Be Better Defined, Justified, and Coordinated. GAO-08-361.  Washington, D.C.: February 29, 2008.
GAO. Department of Homeland Security: Progress Report on  Implementation of Mission and Management Functions. GAO-07-454.  Washington, D.C.: August 17, 2007.
section_title: Developing and Deploying New Technologies for Homeland Security
paragraphs: GAO. Homeland Security: DHS Could Strengthen Acquisitions and  Development of New Technologies. GAO-11-829T. Washington, D.C.:  July 15, 2011.
GAO. Aviation Security: TSA Has Enhanced Its Explosives Detection  Requirements for Checked Baggage, but Additional Screening Actions  Are Needed. GAO-11-740. Washington, D.C.: July 11, 2011.
GAO. DHS Science and Technology: Additional Steps Needed to Ensure  Test and Evaluation Requirements Are Met. GAO-11-596. Washington,  D.C.: June 15, 2011.
GAO. Border Security: Preliminary Observations on the Status of Key  Southwest Border Technology Programs. GAO-11-448T. Washington  D.C.: March 15, 2011.
GAO. Supply Chain Security: DHS Should Test and Evaluate Container  Security Technologies Consistent with All Identified Operational  Scenarios to Ensure the Technologies Will Function as Intended.  GAO-10-887. Washington D.C.: September 29, 2010.
GAO. Combating Nuclear Smuggling: Inadequate Communication and  Oversight Hampered DHS Efforts to Develop an Advanced Radiography  System to Detect Nuclear Materials. GAO-10-1041T. Washington D.C.:  September 15, 2010.
GAO. Combating Nuclear Smuggling: DHS Has Made Some Progress but  Not Yet Completed a Strategic Plan for Its Global Nuclear Detection  Efforts or Closed Identified Gaps. GAO-10-883T. Washington, D.C.: June  30, 2010.
GAO. Biosurveillance: Efforts to Develop a National Biosurveillance  Capability Need A National Strategy and a Designated Leader.  GAO-10-645. Washington, D.C.: June 30, 2010.
GAO. Combating Nuclear Smuggling: Recent Testing Raises Issues  About the Potential Effectiveness of Advanced Radiation Detection Portal  Monitors. GAO-10-252T. Washington, D.C.: November 17, 2009.
GAO. Combating Nuclear Smuggling: Lessons Learned from DHS  Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T.  Washington, D.C.: June 25, 2009.
GAO. Combating Nuclear Smuggling: DHS’s Program to Procure and  Deploy Advanced Radiation Detection Portal Monitors Is Likely to Exceed  the Department’s Previous Cost Estimates. GAO-08-1108R. Washington,  D.C.: September 22, 2008.