Rebuilding Iraq: Actions Still Needed to Improve the Use of Private Security Providers
Published: 2006-06-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO was asked to address (1) the extent to which coordination between the U.S. military and private security providers has improved since GAO's 2005 report, (2) the ability of private security providers and the Department of Defense (DOD) to conduct comprehensive background screenings of employees, and (3) the extent to which U.S. or international standards exist for establishing private security provider and employee qualifications. For this testimony, GAO drew from its July 2005 report on private security providers, and its preliminary observations from an ongoing engagement examining contractor screening practices.
section_title: What GAO Found
paragraphs: Coordination between the U.S. military and private security providers still needs improvement. First, private security providers continue to enter the battle space without coordinating with the U.S. military, putting both the military and security providers at a greater risk for injury. Second, U.S. military units are not trained, prior to deployment, on the operating procedures of private security providers in Iraq and the role of the Reconstruction Operations Center, which is to coordinate military-provider interactions. While DOD agreed with our prior recommendation to establish a predeployment training program to help address the coordination issue, no action has been taken. Many private security providers and DOD have difficulty completing comprehensive criminal background screenings for U.S. and foreign nationals when data are missing or inaccessible. For example, a DOD policy requires biometric screening of most non-U.S. private security providers accessing U.S. bases in Iraq. Biometric screening (e.g., fingerprints and iris scans) measures a person's unique physical characteristics. Biometric screening is not as effective as it could be because the databases used to screen contractor employees include limited international data. Based on its work to date, GAO believes that incomplete criminal background screening may contribute to an increased risk to military forces and civilians in Iraq, and the military would benefit by reviewing the base security measures to ensure that the risk private security contractors may pose has been minimized. A report on screening will be issued in Fall 2006. No U.S. or international standards exist for establishing private security provider and employee qualifications. Reconstruction contractors told GAO during its review for its July 2005 report that they had difficulty hiring suitable security providers. Contractors replaced their security providers on five of the eight reconstruction contracts awarded in 2003 that were reviewed by GAO. Contractor officials attributed this turnover to various factors, including their lack of knowledge of the security market and of the potential security providers and the absence of useful agency guidance in this area. In our report, we recommended that the State Department, United States Agency for International Development, and DOD explore options that would enable contractors to obtain security services quickly and efficiently. In response to our recommendation, the agencies met in November 2005 and agreed that our recommendation was not practical. They determined that they could best assist contractors by providing access to information related to industry best practices and other security-related material.

section_title: Letter
paragraphs: I am pleased to be here today to discuss issues related to the use of private  security providers by U.S. government agencies and the contractors that  are helping to rebuild Iraq. As you know, because of the continued  hostilities in Iraq, the United States as well as other governments and  nongovernmental agencies are relying heavily on private firms to provide  security for those helping to build a democratic Iraq. This is the first time  that the United States has depended on contractors to provide such  extensive security in a hostile environment, although it has previously  contracted for more limited security services in Afghanistan, Bosnia, and  elsewhere.
Because of growing interest by members of Congress in the use of private  security providers in Iraq, we began a review under the Comptroller  General’s authority and issued a report in July 2005 on the use of private  security providers in Iraq. We reported that    Agencies and reconstruction contractors made extensive use of private  security providers because providing security for these organizations is  not part of the U.S. military’s stated mission. We reported that the  reconstruction contractors’ efforts to obtain security met with mixed  results as they often found that the security providers they selected could  not meet their needs. We recommended that the Secretaries of State and  Defense and the Administrator of United States Agency for International  Development (USAID) explore  options to assist contractors in obtaining  suitable security providers    The relationship between the U.S. military and private security providers  is based on cooperation and not control. It appeared that coordination  between the military and the private security providers improved when the  Reconstruction Operations Center (ROC) opened to coordinate military– provider interactions. However, we noted that additional actions could be  taken to improve coordination and recommended that units deploying to  Iraq receive predeployment training to better understand typical private  security provider operating procedures and the role of the ROC.    Despite the significant role private security providers play in the  reconstruction of Iraq, none of the principal agencies responsible for  reconstruction had complete data on costs associated with using private  security providers. We recommended that the Secretaries of State and  DOD and the Administrator of USAID establish a means to track and  account for security costs to develop more accurate budget estimates.
There has been growth in the private security industry in Iraq. In our 2005  report, we reported that the Department of Defense (DOD) estimated at  least 60 private security providers were working in Iraq with perhaps as  many as 25,000 employees. In March 2006, the Director of the Private  Security Company Association of Iraq estimated that approximately 181  private security companies were working in Iraq with just over 48,000  employees.
Today, my testimony will address some of the issues we raised in our 2005  report as well our preliminary observations from an ongoing engagement  on the processes used to screen private security providers. Specifically,  my testimony today will address  the extent to which coordination between the U.S. military and private  security providers has improved since our 2005 report,  the ability of private security providers and DOD to conduct  comprehensive background screenings of employees, and  the extent to which U.S. or international standards exist for establishing  private security provider and employee qualifications.
My testimony is based on our July 2005 report, a May 2006 visit to Iraq, and  our preliminary observations from an ongoing engagement requested by  this subcommittee on the effectiveness of the processes used to screen  contractor employees in the U.S. Central Command’s area of  responsibility, which includes Iraq. To obtain our preliminary observations  on the effectiveness of the processes used to screen contractor employees  in Iraq, we have reviewed relevant documents such as contracts, as well as  DOD and governmentwide policies; met with DOD officials both in the  United States and Iraq, and interviewed contractors providing services to  deployed forces in Iraq as well as professional background screeners in  the United States and India. This work is being done in accordance with  generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: Prior to the war in Iraq, DOD and the U.S. government agencies  responsible for the reconstruction of Iraq believed that reconstruction  would take place in an environment with little threat from insurgents or  terrorists. By June 2003, the security situation began to worsen, and it  became clear in August 2003 with the bombing of the United Nations  complex that insurgents were targeting nonmilitary targets.
As the Comptroller General testified before this subcommittee in April  2006, the poor security environment continues to be a concern as  insurgents demonstrate the ability to recruit, supply, and attack coalition  and Iraqi security forces, and impede the development of an inclusive Iraqi  government and effective Iraqi security forces. The insurgency intensified  through October 2005 and has remained strong since then. According to a  February 2006 testimony by the Director of National Intelligence,  insurgents are using increasingly lethal improvised explosive devices and  continue to adapt to coalition countermeasures.
Our July 2005 report on private security providers addressed, among other  things, the mission of private security providers in Iraq, the laws and  guidance governing the conduct of private security providers, and the cost  impact of using private security providers.
subsections: section_title: The Mission of Private Security Providers in Iraq
paragraphs: The mission of private security providers is to protect government agency  officials and reconstruction contractors in Iraq’s unstable security  environment. Providers may be U.S. or foreign companies and their staffs  are likely to be drawn from various countries, including the United States,  the United Kingdom, South Africa, Nepal, Sri Lanka, or Fiji, and may  include Kurds and Arabs from Iraq. Generally, private security providers  provide the following services:    Static security – security for housing areas and work sites,    Personal security details – security for high-ranking U.S. officials,    Security escorts – security for government employees, contractor  employees, or others as they move through Iraq,    Convoy security – security for vehicles and their occupants as they make  their way into Iraq or within Iraq, and    Security advice and planning.
section_title: Laws and Guidance Governing Private Security Providers in Iraq
paragraphs: During its existence, the Coalition Provisional Authority (CPA) issued a  number of orders or memoranda to regulate private security providers and  their employees working in Iraq between December 2003 and June 2004.  Among these are CPA order number 3, which authorized possession, use  and registration of weapons used by private security providers; CPA order  number 17, which stated that contractors (including private security  providers) will generally be immune from the Iraqi legal process for acts  performed in accordance with the terms and conditions of their contracts;  and CPA Memorandum number 17, which stated that private security  providers and their employees must be registered and licensed by the  government of Iraq. According to the Director of the Private Security  Companies Association of Iraq, as of June 1, 2006, the CPA memorandum  and orders were still in effect.
In September 2005, U.S. Central Command’s Staff Judge Advocate issued  interim legal guidance regarding DOD’s use of private security providers in  Iraq. The September 2005 guidance permitted the use of properly licensed  private security providers to protect civilians, contractors, nonmilitary  facilities and equipment as well as static military facilities and the military  personnel and equipment within them. In January 2006, the U.S. Central  Command’s Staff Judge Advocate issued additional guidance which gave  commanders in Iraq the authority to use private security providers to  provide security to convoys transporting military supplies and to provide  personal security. Currently, DOD is using private security providers to  guard facilities located within U.S. bases and installations, and may  expand its use of private security providers based on the January 2006  guidance. However, it is not clear to what extent DOD plans to make use  of this expanded authority.
Although private security providers are generally not subject to  prosecution under the Uniform Code of Military Justice in the absence of a  formal declaration of war by Congress, the federal government can impose  sanctions in response to acts of misconduct. For example, private security  providers are subject to prosecution by the Department of Justice under  applicable U.S. federal laws, to include the Military Extraterritorial  Jurisdiction Act, the special maritime and territorial jurisdiction  provisions of title 18 of the U.S. code, and the War Crimes Act.
section_title: The Cost Impact of Private Security Providers in Iraq
paragraphs: Despite the significant role played by private security providers in  enabling reconstruction efforts to proceed, neither the Department of  State, nor DOD, nor the USAID—the principal agencies responsible for  Iraq reconstruction efforts—had complete data on the costs associated  with using private security providers. As of December 2004, the agencies  and contractors we reviewed had obligated more than $766 million for  security services and equipment, and by reviewing invoices that providers  of security services and equipment provided to the contractors, we found  that security costs had accounted for more than 15 percent of the  contract’s costs in 8 of the 15 contracts we reviewed. We cautioned,  however, that our estimates did not reflect security-related costs incurred  by subcontractors or lower tier suppliers, or attempt to quantify the  impact of the security environment on the pace of reconstruction efforts  caused by security-related work stoppages or delays or the costs  associated with repairing the damage caused by the insurgency on work  previously completed. In January 2006, the State Department reported to  Congress that direct and indirect costs of security represented 16 to 22  percent of the overall cost of major infrastructure reconstruction  projects. DOD officials acknowledged, however, that the estimate may  not have accounted for all security costs and that different methodologies  and methods were used to prepare the estimate.
Given the expectation of a relatively benign environment that would  require only a minimal level of security, such costs undoubtedly diverted  resources and contributed to decisions to cancel or reduce the scope of  some projects. In our view, the absence of reliable data in an area critical  to supporting U.S. efforts, limited the agencies’ ability to assess the impact  of and manage security costs on future reconstruction efforts.  Consequently, we recommended in our July 2005 report that agencies  develop a means to track and account for security costs to develop more  accurate budget estimates.
In early June 2006, the State Department issued a procurement  information bulletin in response to our recommendation. The Department  noted that DOD, USAID and the State Department had agreed to include  requirements for reconstruction contractors to report all costs for private  security supplies and services that the contractor or any subcontractor  may have to acquire necessary for the successful performance of the  contract. For example, for all future contracts where performance or  delivery takes place in Iraq, contractors are required to include in their  proposal an estimate of all costs expected to be incurred by the  contractor, or any tier of subcontractor, for private security goods or  services that the contractor or subcontractor obtained as part of contract  performance. The contractors will be required to report similar  information when submitting invoices for payment for goods and services  provided. If fully implemented, such an approach should provide the  Department with a clearer picture on the impact of security costs on  reconstruction contracts.
section_title: Coordination between the U.S. Military and Private Security Providers Continues to Be a Problem
paragraphs: Despite improvements in coordination between private security providers  and the U.S military, military officials we met with in Iraq in May 2006 and  those who recently returned from Iraq said that coordination continues to  be a problem. Coordination between the U.S. military and private security  providers evolved from an informal coordination based on personal  relationships to a more structured, although voluntary, mechanism—the  ROC. U.S. military and contractor officials we spoke with prior to issuing  our July 2005 report had indicated that coordination had improved.
While the ROC has helped improve coordination between the military and  security providers, military officials we spoke to during our May 2006 visit  to Iraq and representatives from the 3rd Infantry Division remain  concerned about coordination. Officials from the 3rd Infantry Division,  who were located in Baghdad from January 2005 to January 2006, told us  that (1) they had a difficult time working and interfacing with private  security providers during their deployment because they had no means to  communicate with the private security providers, (2) they were unfamiliar  with the ROC, and (3) private security providers frequently entered their  battle space without notifying the division. Military officials we spoke with  stated that private security providers should be required to coordinate  with the military. Several U.S. military officers whom we interviewed who  served in Iraq said that they had a responsibility to aid contractors who  need assistance. If private security providers do not coordinate their  movements with military units, it places both the U.S. military and the  private security providers at risk. Also, with better coordination, private  security providers would be informed of areas that were unsafe and either  change their route or delay the movement.
At the time we issued our report in July 2005, incidents of U.S. military  shooting at private security providers were a concern. During the 5-month  period of January through May 2005, the ROC received reports of 20  friendly-fire incidents. It is likely that the number of actual incidents  during that time period was higher since some providers told us they  stopped reporting these types of incidents. For the 12-month period, from  June 1, 2005 to June 1, 2006, 12 incidents were reported to the ROC. We  spoke with the Director of the Private Security Company Association of  Iraq about these incidents, among other things. He said that he believes the  decrease in such incidents is the result of better enforcement of the rules  of engagement by the U.S. military. In addition to better enforcement of  the rules of engagement, which require that U.S. troops determine whether  a person’s intent is hostile before the military uses deadly force, the  director of the ROC believed that our 2005 report led to increased  awareness of the issue.
We recommended in 2005 that the Secretary of Defense develop a training  package for units deploying to Iraq to improve coordination between the  U.S. military and private security providers. The training package would  include information on the ROC, typical private security provider  operating procedures, and any guidance or procedures developed by  Multi-national Force-Iraq (MNF-I) or Multi-national Corps-Iraq (MNC-I)  applicable to private security providers. Although the Department of  Defense agreed with our recommendation and tasked the Joint Staff to  develop the training package, no action had been taken. Early this year, we  contacted officials from the 10th Mountain Division (who deployed to Iraq  in early 2006) to determine if their predeployment training had included  any information on working with private security providers. Division  officials advised us that they had received no information on working with  private security providers. While in Iraq, we met with Army officials at  Camp Anaconda who told us that they received little guidance regarding  private security providers in Iraq prior to deployment and stated that they  needed better guidance regarding the military’s responsibility to private  security providers. Finally, in May 2006 while in Iraq we met with the  director of the ROC who told us that military units should receive some  training regarding private security providers before the units deployed to  Iraq. He stated that such training would help improve U.S. military and  private security provider coordination.
section_title: Missing or Inaccessible Data May Make Criminal Background Screening of Private Security Provider Employees Difficult
paragraphs: Private security providers and DOD have difficulty conducting  comprehensive criminal background screening when data are missing and  inaccessible. When doing such background screenings of those living in  the United States, background screening firms generally use public  information available at the county, state, or federal level or search  commercial databases such as those that collect information on  incarcerations or arrest records. None of these types of searches,  however, guarantees a comprehensive background screening. Private  security firms may find it difficult to complete background screenings of  their Iraqi and third country national employees because of a lack of  reliable information. In addition, DOD’s program to biometrically screen  all Iraqi private security provider employees as well as most third country  nationals who are private security provider employees seeking access to  U.S. installations is not as effective as it could be because of the limited  number of international and foreign databases available for screening.  Because of the numerous difficulties in screening employees, particularly  those who do not live in the United States, it may not be possible to know  the true identities and backgrounds of the thousands of private security  provider employees working in Iraq. This lack of knowledge increases the  security risk to U.S. military forces and civilians in Iraq.
subsections: section_title: Information Is Not Always Available or Accessible When Conducting Criminal Background Screening
paragraphs: Many private security providers that conduct criminal background  investigations use screening firms. The private security provider  requesting the screening determines the parameters of the background  screening. Information is not always available or accessible when  conducting criminal background investigations of U.S. nationals, third  country nationals, and Iraqi nationals. Another factor that can contribute  to difficulties is foreign privacy laws that make some criminal information  inaccessible according to screening firm officials.
U.S. Nationals: When screening firms conduct background investigations  of those living in the United States, they generally use public information  available at the county, state, or federal level, search state maintained  criminal information repositories, and commercial databases such as  those that collect information on incarcerations. However, none of these  actions guarantees a comprehensive background check. For example,  screening companies may not review federal court records if not directed  to by the client. Furthermore, background screening firms generally only  check the records of the court that maintains the preponderance of  criminal data and may miss some records maintained by specialized courts  such as domestic or family law courts. State repositories of information  may not include all criminal data. For example, one official from a  background screening firm explained that only 66 of the 88 counties in  Ohio report crimes to the state repository. Similarly, the State of Illinois  reported that in 2003 only 59 percent of the computerized criminal history  records they audited had complete information. Furthermore, commercial  databases may not provide a complete background investigation because  the databases may not contain the most recent criminal data; certain  criminal offenses may not be reported; and there are no standards on how  data in commercial databases should be collected and validated.
Third Country Nationals: Screening third country nationals presents  additional challenges according to background screeners to whom we  have spoken. Officials from international background screening firms  cited the challenges in verifying criminal background information on third  country nationals because they are relying on the applicant to provide all  prior addresses. Since some countries, such as India, maintain criminal  data at the local level, persons doing the background screenings may miss  crimes that were committed in other locations within the country if the  applicant did not reveal all previous addresses. Those doing screenings  face other challenges as well. For example, some countries lack criminal  records or the records are unreliable because of high levels of corruption  according to representatives of the screening firms we interviewed.  Additionally, some countries only maintain records for 3 to 5 years which  some in the background screening industry consider to be insufficient.  Also, many countries lack national identification numbers, which makes it  difficult to know if the person being screened was the person who  committed the crimes cited in the court or police records.
Iraqi Nationals: Some private security companies have been encouraged  by their clients to hire Iraqi nationals to put money back into the Iraqi  economy and to reduce security costs compared with the salaries of other  employees. However, screening Iraqi nationals is very difficult because of  a lack of criminal information. One firm we spoke with told us that they  have encountered problems screening Iraqi nationals because the Iraqi  police lack criminal records or criminal information. Another company  depends on their Iraqi subcontractors to screen Iraqi applicants and may  not have a clear understanding of how the screening takes place.  According to officials from one of the private security providers we spoke  with, their Iraqi subcontractor claims to have a screening process, and the  provider trusts the company to provide qualified individuals. One company  we spoke with told us that they rely on local tribal leaders to screen their  employees. Finally, the Iraqi Ministry of the Interior also screens Iraqi  private security employees as part of the registration and licensing  process.
Privacy Laws: Privacy laws may also make it difficult to complete accurate  screenings on those who live outside of the United States. According to  officials from background screening firms, some countries do not permit  criminal background searches of their citizens or limit the type of  information that can be released to a third party. In other countries,  criminal information cannot be given to third parties and is only released  to the applicant who can then determine whether to release the  information. According to screening company officials, there are often  issues related to the authenticity of documents provided by applicants.
section_title: The Effectiveness of DOD’s Biometric Screening in Iraq Is Limited Because of Missing Data
paragraphs: DOD conducts biometric screening of most non-U.S. private security  provider employees needing access to installations in Iraq; however, the  value of the screening process is limited because the databases used to  screen the applicants have little international biometric data. In March  2005, shortly after a dining facility bombing at a U.S. installation in Iraq  killed 14 U.S. soldiers and wounded at least 50, the deputy secretary of  Defense issued a policy requiring the biometric screening of most non - U.S. personnel (including private security provider employees) seeking  access to U.S. installations in Iraq. The goal of this policy is to improve  force protection for U.S. and coalition forces in Iraq and to provide  positive identification of local and third country nationals accessing U.S.  facilities. This policy requires that those seeking access to installations in  Iraq be fingerprinted, photographed, have their irises scanned and be  enrolled in one of two systems DOD uses to gather the required biometric  data. The biometric screening is in addition to the in-person interview and  screening of Iraqis (and some third country nationals) wishing to access a  base or installation.
Biometric information from the two installation access systems is sent to  DOD’s Biometric Fusion Center in West Virginia where it is merged with  other biometric data to form the Automated Biometric Identification  System (ABIS). The Biometric Fusion Center screens the applicant’s data  against the ABIS system as well as the FBI’s Integrated Automated  Fingerprint Identification System (IAFIS) database. The IAFIS database  includes the fingerprint records of more than 51 million persons who have  been arrested in the United States as well as information from databases  maintained by other agencies such as the Department of Homeland  Security, the Department of State and the International Criminal Police  Organization (Interpol).
While DOD’s biometric screening process has successfully identified  several persons seeking access to bases in Iraq who have criminal records  in the United States, the lack of international biometric data limits its  usefulness. According to an official from the FBI’s Criminal Justice  Information Services Division, the IAFIS database includes criminal  fingerprint data from only a limited number of foreign countries because  some countries are reluctant to share criminal history information and  others do not have fingerprint repositories or do not collect fingerprints in  a manner compatible with the FBI’s system. In addition, although the  IAFIS database includes about 50,000 fingerprint records from Interpol,  Interpol does not maintain a repository of all criminal offenses committed  in the member countries. Instead, Interpol’s criminal database is  composed of wanted notices submitted by the member countries and the  information is only retained for 5 years. Access to international criminal  biometric information is vital to meeting DOD’s goal of establishing the  positive identification of local and third country nationals accessing U.S  facilities in Iraq. Without access to foreign biometric information, DOD  may find it difficult to determine if third country nationals may pose a  threat to U.S. military and civilians in Iraq.
section_title: There Are No Established Standards to Assist Contractors in Obtaining Suitable Security Providers
paragraphs: At the time we issued our report in July 2005, there were no U.S. or  international standards that would establish security provider  qualifications in such areas as training and experience requirements,  weapons qualifications, and similar skills that are applicable for the type  of security needed in Iraq. Security industry associations and companies  have discussed the need for and desirability of establishing standards, but  as of June 2006, no such standards have been developed or implemented.  As we reported in our 2005 report, reconstruction contractors had  difficulty hiring suitable security providers. Contractors replaced their  security providers on five of the eight reconstruction contracts awarded in  2003 that we reviewed. Contractor officials attributed this turnover to  various factors, including their lack of knowledge of the security market  and of the potential security providers and the absence of useful agency  guidance in this area.
In our report, we recommended that the State Department, USAID, and  DOD explore options that would enable contractors to obtain security  services quickly and efficiently. Such options may include identifying  minimum standards for private security personnel qualifications, training  requirements and other key performance characteristics that private  security personnel should possess; establishing qualified vendor lists;  and/or establishing contracting vehicles which contractors could be  authorized to use. In response to our recommendation, the State  Department noted in November 2005 that it had met with representatives  from DOD and USAID to discuss ways to assist contractors in acquiring  security services. According to the State Department, all agencies agreed  that it was not practical to prequalify vendors or establish contracting  vehicles, in part due to concerns regarding the agency’s liability if  contractors failed to perform. Rather, they determined that they could best  assist contractors by providing access to information related to industry  best practices and other security-related material.
section_title: Concluding Observations
paragraphs: Mr. Chairman, we believe two recommendations we made in our July 2005  report continue to have merit and should be implemented. Specifically, we  believe private security provider operations would be improved by   (1) developing a training package for deploying units to Iraq that would  provide information on the ROC, private security providers operating  procedures, and any MNF-I or MNC-I guidance on private security  providers and (2) further exploring options to assist contractors in  obtaining suitable security providers. Further, U.S. military officials who  have been in Iraq or who we interviewed during our May 2006 visit stated  that coordination between the military and private security providers  should be required. Given the increased risk both parties are subject to  when private security providers do not coordinate their activities with the  military, we believe U.S. government agencies using private security  providers in Iraq may want to consider such a requirement utilizing the  ROC as the focal point for such a requirement. Additionally, based on our  preliminary observations, incomplete criminal background screenings may  contribute to an increased risk to military forces and civilians in Iraq. The  military would benefit by reviewing the installation security measures in  place in Iraq to ensure that the risk private security contractors may pose  has been minimized. Lastly, as noted in our July 2005 report, our  experience in Iraq has made us aware that future operations may include  reconstruction efforts in an unstable or deteriorating security  environment, thus requiring extensive use of private security providers.  Given their important role in Iraq, planning that includes the use of private  security providers will need to be incorporated in future military  operations and reconstruction efforts.
Mr. Chairman and members of the Subcommittee, this concludes my  prepared statement. I will be happy to answer any questions you may have.
section_title: GAO Contacts and Acknowledgments
paragraphs: For questions regarding this testimony, please call William Solis at (202)  512-8365. Other key contributors to this statement were Vincent Balloon,  Carole Coffey, Grace Coleman, Laura Czohara, Gary Delaney, Timothy  DiNapoli, and Wesley A. Johnson.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.