Diplomatic Security: State Department Should Better Manage Risks to Residences and Other Soft Targets Overseas
Published: 2015-07-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive “soft targets.” GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015.
section_title: What GAO Found
paragraphs: The Department of State (State) conducts a range of activities to assess risks to residences overseas. For instance, State tracks information on overseas residences in its property database, establishes threat levels at overseas posts, develops security standards for different types of residences and threat levels, and requires posts to periodically conduct residential security surveys. However, 17 of the 68 surveys for residences GAO reviewed were untimely or missing. Without up-to-date security surveys of all its overseas residences, State's ability to identify and address vulnerabilities or make informed decisions about where to allocate resources for security upgrades is limited.
State has taken steps to update its residential security standards; however, these updates have not been timely, and the standards are difficult to use. According to State officials, updating residential security standards should take about 75 days, but all three updates since 2005 took more than 3 years each. State is making efforts to improve the timeliness of such updates in response to a prior GAO recommendation. In addition, while federal internal control standards state that policy standards should be clear and consistent to support good decision making, State's standards and other security-related guidance for residences have gaps and inconsistencies, complicating posts' efforts to determine and apply the appropriate security measures and potentially leaving some residences at risk.
State addresses security vulnerabilities at residences by installing various upgrades intended to help residences meet security standards, but 38 of the 68 residences GAO reviewed did not meet all applicable standards. For example, 8 residences did not meet the standards for perimeter barriers. When residences do not and cannot meet all applicable security standards, posts are required to request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, State had an exception on file for only 1 of the 38 residences that did not meet all applicable standards. As a result, State lacks key information that could provide it with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions.
State manages risks to schools and other soft targets overseas in several ways, but its efforts may be constrained by limited awareness of relevant guidance and tools. In fiscal years 2010 through 2015, State awarded almost 400 grants in total for security upgrades at schools and other soft targets. While federal internal control standards call for timely communication of relevant information to staff responsible for program objectives, officials at most of the posts GAO visited were unaware of some guidance and tools for securing schools and other soft targets. As a result, State may not be fully leveraging existing programs and resources for addressing security needs at these facilities.
section_title: What GAO Recommends
paragraphs: GAO recommends that State, among other things, institute procedures to ensure residential security surveys are completed as required, clarify its standards and security-related guidance for residences, develop procedures to ensure residences either meet standards or have exceptions on file, and take steps to ensure posts are aware of existing guidance and tools regarding the security of schools and other soft targets. State concurred with all of GAO's recommendations.

section_title: Letter
paragraphs: Following the August 1998 bombings of two U.S. embassies in East  Africa, the Department of State (State) embarked on a multiyear,  multibillion dollar effort to replace and secure vulnerable diplomatic  facilities overseas. State has constructed more than 100 new diplomatic  facilities since 1998 and has enhanced security measures at many  others. Increased security at these highly symbolic targets has raised  concerns that residences, schools, and other places where U.S.  diplomatic personnel and their families congregate may be viewed as  more attractive “soft targets.” According to State reporting, there were  approximately 30 attacks against U.S. diplomatic residences and other  soft targets overseas from August 1998 to December 2014. Recent  events have heightened awareness of the threats these kinds of facilities  face. For example, a 2014 posting on a jihadist website called for attacks  on American and other international schools in the Middle East.  Furthermore, terrorists have conducted attacks on Turkish diplomatic  residences in Somalia and numerous schools in Nigeria, Pakistan, and  Kenya.
You asked us to review the security of U.S. diplomatic residences and  other soft targets overseas, particularly in high-threat areas. For this  report, we evaluated (1) how State assesses risks to U.S. diplomatic  residences overseas; (2) the timeliness, clarity, and consistency of State’s  security standards for these residences; (3) how State addresses security  vulnerabilities at residences; and (4) how State manages risks to other  soft targets overseas.
To address these objectives, we reviewed U.S. laws; relevant State  security policies and procedures as found in cables, the Foreign Affairs  Manual (FAM), and the Foreign Affairs Handbooks (FAH)—in particular,  the Residential Security Handbook and Overseas Security Policy Board  (OSPB) standards; Bureau of Diplomatic Security (DS) threat and risk  ratings, periodic assessments of post security programs, and residential  security exceptions; post-specific documents pertaining to security of  residences and other soft targets; Bureau of Overseas Buildings  Operations (OBO) data on overseas residences and grants for security  upgrades at schools attended by children of U.S. government personnel  and off-compound employee association facilities; classified  Accountability Review Board (ARB) reports containing recommendations  related to residences; and past GAO, State Office of Inspector General,  and Congressional Research Service reports. We also interviewed  officials in Washington, D.C., from DS; OBO; State’s Office of  Management Policy, Rightsizing, and Innovation; and the U.S. Agency for  International Development.
We reviewed and compared relevant residential security standards and  other security-related guidance within the FAM and FAH to evaluate their  clarity and consistency. We also evaluated the timeliness of updates to  residential security standards. We traveled to 7 overseas diplomatic posts  and also conducted work focused on 3 other posts. Our judgmental  sample of 10 posts included nine countries in four of State’s six  geographic regions—Africa, the Near East, South and Central Asia, and  the Western Hemisphere. In addition to ensuring geographic coverage,  we selected posts that had relatively high threat and risk ratings as  established by DS. At the 7 posts we visited, we evaluated a judgmental  selection of 68 residences against applicable security standards. To do  so, we created checklists of all the OSPB residential security standards  and then reviewed each residence against the standards applicable to it.  We also reviewed security measures in place at 10 schools attended by  U.S. government dependents and 3 off-compound employee association  facilities and met with State’s regional security officers (RSO) and other  officials involved in efforts to secure residences and other soft targets.  Our findings from our sample of 10 posts are not generalizable to all  posts. (For security reasons, we are not naming the 10 posts in our  judgmental sample.) We assessed DS’s risk management practices  against its own policies and standards (see Background for additional  detail on these documents), best practices for results-oriented  management we identified in a previous report, and federal internal  control standards. See appendix I for a complete description of our  scope and methodology.
We conducted this performance audit from July 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
This report is a public version of a sensitive but unclassified report that  was issued on June 18, 2015, copies of which are available upon request  for official use only by those with the appropriate need-to-know. This  report does not contain certain information that State regarded as  sensitive but unclassified and requested that we remove. We provided  State a draft copy of this report for sensitivity review, and State agreed  that we had appropriately removed all sensitive but unclassified  information.
subsections: section_title: Background
paragraphs: According to State, more than 25,000 U.S. government personnel are  assigned to 275 U.S. diplomatic posts overseas. These officials  represent a number of agencies besides State, such as the Departments  of Agriculture, Defense, Homeland Security, Justice, and the Treasury,  and the U.S. Agency for International Development, among others. As we  reported in 2005, State considers soft targets to be places where  Americans and other westerners live, congregate, shop, or visit. In  addition to residences and schools, soft targets can include hotels, clubs,  restaurants, shopping centers, places of worship, and public recreation  events. Travel routes of U.S. government employees are also considered  soft targets, based on their vulnerability to terrorist attacks. For the  purposes of this report, we focus primarily on U.S. diplomatic residences;  we also focus on schools attended by U.S. government dependents and  off-compound employee association facilities since such schools and  facilities are eligible for State-funded security upgrades.
As of the end of fiscal year 2014, the U.S. government leased or owned  more than 15,000 residences worldwide, according to State. About  13,000 were residences leased by the U.S. government and located off  embassy or consulate compounds, while slightly more than 2,000 were  government-owned, most of which were also located off embassy or  consulate compounds. With respect to schools, State estimates that  there are nearly 250,000 school-age American children overseas, of  which approximately 8,000 are U.S. government dependents. State  provides assistance to almost 200 “American-sponsored” schools  worldwide to help provide quality education for children of U.S.  government employees. U.S. government dependents may also attend  any other schools preferred by their parents. In addition, State has  chartered about 130 employee associations at posts overseas. These  associations maintain a variety of facilities, including, among others, retail  stores, cafeterias, recreational facilities, and quarters for officials on  temporary duty. Some of these facilities are located off embassy or  consulate compounds. The vast majority of the facilities are either owned  or leased by the U.S. government.
According to State, host-country police, security, and intelligence forces  are often the first line of defense in protecting U.S. government personnel  against potential threats. Additionally, as required by the Omnibus  Diplomatic Security and Antiterrorism Act of 1986, the Secretary of State,  in consultation with the heads of other federal agencies, is responsible for  developing and implementing policies and programs to protect U.S.  government personnel on official duty abroad, along with their  accompanying dependents. Responsibility for the security of residences  and other soft targets overseas falls primarily on DS and OBO.
DS is responsible for, among other things, establishing and operating  security and protective procedures at posts, chairing the interagency  process that sets security standards, and developing and  implementing posts’ residential security programs, which includes  providing funding for most residential security upgrades. At posts, DS  agents known as RSOs, including deputy RSOs and assistant RSOs,  are responsible for protecting personnel and property, documenting  threats and residential vulnerabilities, and identifying possible  mitigation efforts to address those vulnerabilities. Posts with high  turnover of residences or a large number of residences may also have  a residential security coordinator on the RSO’s staff to assist with  supervision and management of the posts’ residential security  programs. RSOs are also responsible for offering security advice  and briefings to schools attended by U.S. government dependents  and recommending security upgrades to school and employee  association facilities.
OBO tracks information on State’s real properties, including  residences; provides funding for certain residential security upgrades;  and funds and manages the Soft Target Program, State’s program for  providing security upgrades to schools attended by U.S. government  dependents and off-compound employee association facilities.
State’s policies are outlined in the FAM and corresponding FAH. Sections  of the FAM and FAH relevant to residential security include various  subchapters detailing State’s program for residential security, the OSPB  residential security standards, and security-related guidance found in  the Residential Security Handbook and Physical Security Handbook.  In addition, the FAM includes sections that provide guidance about  schools that enroll U.S. government dependents and off-compound  employee association facilities. See table 1 for further details on  selected FAM and FAH policies that are pertinent to securing residences  and other soft targets.
In addition to these policies, State has produced other guidance  documents, such as a matrix that identifies which residential security  upgrades DS and OBO, respectively, are responsible for funding and an  OBO-drafted cable that outlines the process for requesting security  upgrades at schools and employee association facilities.
section_title: State Conducts a Range of Activities to Assess Risks to Residences Overseas, but Weaknesses Exist in Security Surveys at Posts
paragraphs: State assesses risks to U.S. diplomatic residences overseas using a  range of activities, but many security surveys were not completed for  residences we visited. We found that State (1) records and monitors  information on overseas residences in its property database, (2)  establishes threat levels at overseas posts, (3) develops security  standards for residences, and (4) uses these standards to conduct  security surveys of residences to identify vulnerabilities. However, 17 of  68 surveys for residences we visited were not completed as required,  thereby limiting State’s ability to effectively and efficiently identify and  address vulnerabilities.
subsections: section_title: OBO Tracks Overseas Residences and Has Taken Steps to Improve the Reliability of Its Data
paragraphs: OBO is responsible for maintaining records on all diplomatic residences  overseas in its real property database (hereafter referred to as OBO’s  property database). OBO’s property database contains data on  residences owned and leased by the U.S. government, and includes  details such as residence type and address, whether a given residence is  leased or owned, the agency affiliation of the occupant, and the  acquisition date, among others. DS officials told us that they rely on  OBO’s database as their source for such details on residences.
As we have previously reported, maintaining accurate and reliable  property information has been a long-standing challenge for State. OBO  has taken a number of steps to enhance its property data since we first  reported on this issue, including hiring dedicated analysts to review and  validate data entered at posts and processing budget requests through  the property database so that funding requests from posts are linked to  the accuracy of the posts’ property data. State also concurred with our  June 2014 recommendation that OBO establish a routine process for  validating the accuracy of the data in its property database, and we  continue to follow up on State’s efforts to implement the  recommendation. During this review, we found inaccuracies in the  property data for 2 of the 68 residences we visited: in both cases, the  residence type listed was incorrect. OBO officials told us that they  reached out to the posts where the residences were located and asked  them to input the correct information.
section_title: DS Establishes Threat Levels at Posts Overseas and Leads Development of Security Standards for Residences
paragraphs: DS conducts two key activities to help assess risks to residences. First,  DS evaluates the security situation at each overseas post by assessing  five types of threats—political violence, terrorism, crime, and two  classified categories—and assigning corresponding threat levels for each  threat type. The threat levels are as follows:  critical: grave impact on U.S. diplomats; high: serious impact on U.S. diplomats; medium: moderate impact on U.S. diplomats; and low: minor impact on U.S. diplomats.
Threat levels for each post are assessed and updated annually in the  Security Environment Threat List. According to DS officials, the bureau  develops the list based on questionnaires filled out by post officials, and  the final threat ratings are reviewed and finalized through an iterative  process involving officials at overseas posts and headquarters. These  threat levels are used to determine the security measures required for  residences at each post.
Second, in consultation with the interagency OSPB, DS develops physical  security standards for diplomatic facilities and residences. The  residential security standards apply to all residences of U.S. government  personnel assigned abroad under chief-of-mission authority. The OSPB  standards are published in the FAH and vary by residence type.  Specifically, there are separate OSPB standards for six different  residence types, one of which is on-compound housing. The remaining  five are for off-compound (1) apartments, (2) single family homes, (3)  residential compounds, (4) Marine Security Guard residences, and (5)  residences for principal officers. OSPB standards also vary by date of  construction or acquisition, threat level, and whether they are mandatory.  If residences do not meet all applicable mandatory standards, posts are  required to request exceptions to the OSPB standards.
Within the OSPB standards, we identified six key categories of security  standards to protect residences from the threats of political violence,  terrorism, and crime. These include (1) an anti-climb perimeter barrier,  such as a wall or a fence, and access control; (2) setback from the  perimeter; (3) a secure off-street parking area; (4) a secure building  exterior with substantial doors and grilled windows with shatter-resistant  film; (5) alarms; and (6) a safe space for taking refuge. Figure 1 portrays  these six categories at a notional residence.
In addition to the OSPB standards, State developed the Residential  Security Handbook and Physical Security Handbook, also published in  the FAH, which provide detailed supporting information designed to help  officials understand how to implement and meet the OSPB standards.
section_title: Posts Conduct Residential Security Surveys to Identify Vulnerabilities, but Many Surveys at Posts We Visited Were Not Completed as Required
paragraphs: According to the FAM, before State can purchase or lease an overseas  residence, the RSO must conduct a residential security survey of the  property, document all security deficiencies that must be corrected, and  approve the purchase or lease of the residence. Off-compound  residences must be resurveyed every 5 years, and on-compound  residences must be resurveyed every 3 years. Additionally, according to  DS officials, RSOs at posts that experience a change in threat level must  resurvey all post residences within 1 year of the threat-level change.  While officials at the posts we visited were able to provide us with up-to- date surveys for most of the 68 residences that we evaluated, not all  surveys at five of the seven posts we visited met the requirements  outlined in the FAH and the FAM. Specifically, 17 surveys were not  completed as required: 9 surveys were outdated, 1 survey was completed  after the residence had already been leased, and 7 surveys were missing.  Among the residences with surveys that did not meet requirements were  those of two principal officers. At one post, we found that the consul  general’s residence had not been surveyed since 2006. At another, the  RSO was unable to find a survey for the ambassador’s residence.
Missing or outdated surveys may limit DS and posts’ ability to identify and  address residential security vulnerabilities that could have otherwise been  recognized and corrected through the security survey process. As noted  in the framework we developed to help federal agencies implement the  Government Performance and Results Act of 1993, leading organizations  reinforce results-oriented management by giving their managers  extensive authority to pursue organizational goals in exchange for  accountability for results. According to officials at DS headquarters,  ensuring that residential security surveys are completed as required is the  responsibility of individual posts. These officials added that they recently  started reviewing surveys for on-compound residences. However, aside  from periodic DS headquarters-led inspections that review, in part, the  extent to which posts are conducting residential security surveys as  required, DS has not instituted procedures to hold posts accountable for  complying with the survey requirements for off-compound residences,  which, as noted earlier, greatly outnumber on-compound residences.  Without up-to-date security surveys of all its overseas residences, State  has limited ability to effectively and efficiently identify vulnerabilities or  make informed decisions about where to allocate resources for security  upgrades to address such vulnerabilities.
State Has Taken or Planned Actions to Enhance Residential Security  Following Attacks on U.S. Facilities and Personnel State has taken steps to enhance residential security in response to previous  attacks on U.S. facilities. These have included actions taken or planned to address  recommendations resulting from interagency security assessments and  Accountability Review Board (ARB) reports. In response to the September 2012  attacks against U.S. diplomatic facilities—including facilities in Libya, Sudan,  Tunisia, Yemen, and Egypt, among others—State formed several Interagency  Security Assessment Teams to assess security vulnerabilities at 19 posts that the  Bureau of Diplomatic Security considered to be high-threat and high-risk. Rather  than assess the facilities at the 19 posts against the Overseas Security Policy Board  standards typically used to assess these facilities, the teams assessed all facilities  at the 19 posts for any type of security vulnerability—physical or procedural. This  assessment process resulted in a report that recommended physical security  upgrades at some residences. At one post that we visited, officials noted that in  response to this report they had added a closed-circuit television system at the  ambassador’s residence, but had not yet installed an emergency siren system at a  residential compound, which was also recommended by the report.
State has also taken or planned steps to address recommendations from ARB  reports stemming from previous attacks on U.S. facilities and personnel overseas.  According to State, there have been four ARB reports related to the security of  residences, with 10 residential security recommendations in total. We found that 8 of  the 10 recommendations related to residential security have been implemented. For  instance, State established an interagency working group in response to a  recommendation to conduct a comprehensive review of issues related to residential  security. The 2 open recommendations are both from the 2005 ARB report on the  attacks on the U.S. consulate in Jeddah, Saudi Arabia. Those recommendations,  which called for the construction of a new consulate compound along with  residences that meet the relevant security standards, will be closed as implemented  once staff transition into the new consulate compound in Jeddah. According to State  documentation, the new consulate compound was originally projected for completion  in March 2010. However, in May 2010, State terminated the contract because of the  original contractor’s failure to perform. State awarded a new contract for the project  in September 2012. State officials told us in November 2014 that they expect  substantial construction of the new consulate compound to be completed in  December 2015 and that the planned move-in date is March 2016.
section_title: State’s Updates of Security Standards for Residences Have Not Been Timely, and the Standards Are Difficult to Use
paragraphs: Over the last decade, State has taken steps to develop or revise several  sets of OSPB residential security standards. However, we found that  State has not been timely in updating these standards, nor has it always  communicated changes to posts in a timely manner. Moreover, the OSPB  standards and other security-related guidance for residences are  confusing in nature and contain gaps and inconsistencies, thereby  complicating posts’ efforts to apply the appropriate security measures and  potentially leaving residences at risk.
subsections: section_title: State Has Not Always Been Timely in Updating Security Standards for Residences or Communicating Changes
paragraphs: Federal internal control standards state that agencies must have timely  communication and information sharing to achieve objectives; therefore,  it is vital that agencies update their policies in a timely manner,  particularly when lives and the security of property and information are at  stake. DS manages the interagency process by which OSPB security  standards are updated. According to DS officials, it should take about 75  days to make an update to the OSPB standards. Specifically, it should  take up to 30 days to draft and obtain approval within DS for an update to  the security standards in the FAH and up to another 15 days to obtain  approval for the draft changes by other relevant stakeholders within State,  such as OBO and the Office of the Legal Adviser. Obtaining approval  from OSPB members should occur within an additional 30 days. Once all  of the required approvals are obtained, DS sends the update to the  Bureau of Administration for publishing.
Since 2005, State has taken steps to update three sections of the FAH  with new or revised OSPB residential security standards; however, the  time it took to complete these updates significantly exceeded 75 days.  Specifically, State (1) developed new residential security standards to  address the threat of terrorism, (2) revised the standards for newly  acquired on-compound housing, and (3) developed new standards for  existing on-compound housing. In each of these cases, the update  process took more than 3 years, including one instance that took more  than 9 years (see fig. 2).
In April 2005, the ARB resulting from the attacks on the U.S.  consulate in Jeddah, Saudi Arabia, recommended developing  residential security standards to address terrorism. A working group  completed a final draft of the standards 4 years later in April 2009,  and it took other stakeholders within State nearly 5 more years to  clear the standards. As a result, the standards were not approved by  OSPB and published until May 2014. Moreover, DS did not notify  posts that the new standards had been completed until mid-October  2014—5 months after their publication and 3 months after they went  into effect. DS officials stated that their decision to notify posts was  prompted in part by our asking how posts become aware of new or  revised standards. Of the three posts that we visited prior to DS’s  notification regarding the new standards, one had found them in the  FAH on its own in the same month that the standards went into effect,  one had found the new standards in the FAH on its own but not until  they had already gone into effect, and one was unaware of the new  standards until we mentioned them during our visit. According to DS  officials, these new standards applied immediately to off-compound  residences acquired on or after July 1, 2014; all other off-compound  residences have to meet the standards within 3 years—by July  2017—or receive exceptions. However, because DS did not notify  posts about the new standards until October 2014, post officials  effectively lost several months during which they could have been  preparing to apply the new standards. Additionally, officials at one  post stated that the DS notification arrived 1 day before the deadline  for submitting a budget request for the following fiscal year. In order to  request funding for newly required security features, they had to make  major revisions to the budget request they had already developed but  had very little time to do so. Likewise, officials at another post stated  that they had to make significant revisions to the building plan for a  new residential compound already under construction in order for it to  meet the new standards.  In November 2010, OSPB gave its approval for revising the standards  for newly acquired on-compound housing. These standards were not  finalized until September 2014. DS notified posts of their publication in  October 2014.  In November 2010, OSPB also gave its approval for developing new  standards for existing on-compound housing. The standards did not  receive approval within DS until September 2014. State published the  standards in May 2015.
As we reported in June 2014, two key factors can cause major delays in  DS’s process for updating security standards. First, if a stakeholder  suggests a change to the draft standards at any time during the review  process, the proposed draft must go through the entire review process  again; some stakeholders may then request additional time for reviewing  proposed changes, further prolonging the process. Second, when  changes are being made to an existing FAH subchapter, the FAH  requires officials to review and update the entire subchapter, and  according to DS officials, there is no specific exception for updates to  standards aimed at ensuring security and protecting lives. As a result,  even when DS needs to make urgent changes to the OSPB standards, it  must review and update the entire subchapter containing the update.
In an attempt to mitigate delays in the process for updating OSPB  standards, State has taken some steps to help posts apply draft  standards before they are officially approved, but these steps have not  fully addressed the delays. While the standards for newly acquired on- compound housing were still in the OSPB approval process, State  incorporated them into the Physical Security Handbook—updates to  which, according to DS, require clearance only within State—so that  RSOs could begin to apply them. Similarly, State incorporated the  standards for existing on-compound housing into the Physical Security  Handbook before DS approved them. With respect to timely  communication of updated standards, DS recently began sending  monthly notices to RSOs to announce recently published updates to the  FAH. However, DS had not yet begun these monthly notices when the  new standards addressing terrorism were finalized in May 2014. Thus,  these efforts notwithstanding, delays in updating OSPB security  standards and communicating the updates may leave posts unaware of  the most current security measures required to address identified threats.  Accordingly, we recommended in June 2014 that State take steps to  ensure that updates to security and safety standards be approved  through an expedited review process. State concurred with the  recommendation, explaining that it had shortened the deadline for  department clearance on draft policies from 30 days to 15 days. However,  in two of the three cases outlined above—the revised standards for newly  acquired on-compound housing and the new standards for existing on- compound housing—draft standards were submitted for department  clearance after State’s decision to shorten the associated deadline to 15  days. In both cases, it took more than 4 months to secure department  clearance. We continue to follow up on State’s efforts to implement our  recommendation to use an expedited review process for updating security  and safety standards.
section_title: Relevant Security Standards and Other Security-Related Guidance for Residences Are Confusing in Nature and Contain Gaps and Inconsistencies, Making Them Difficult to Use
paragraphs: According to federal internal control standards, policy standards should  be clear, complete, and consistent in order to facilitate good decision  making in support of agency objectives. The FAH similarly directs  officials who are drafting FAH and FAM directives to write “in plain  language whenever possible” and to convey “a clear sense of what you  want the reader to do or not do.” However, we found that relevant State  residential security standards and related guidance are confusing in  nature and contain gaps and inconsistencies, making it difficult for RSOs  to identify and apply the appropriate security measures.
Several aspects of State’s residential security standards and related  guidance contribute to their confusing nature.
Dispersed across the FAH and FAM. State’s residential security  standards and related guidance are presented throughout various  sections of the FAH and FAM. RSOs at six posts we visited and even  some headquarters officials involved in developing the standards  stated that they find it challenging to keep track of all the sections  where relevant standards and guidance appear. We located relevant  standards and guidance in nine different subchapters of the FAH and  FAM. Further, one of the subchapters refers to a set of standards that  predated the 1998 embassy bombings and no longer exists. DS has  taken steps to mitigate this dispersion by creating tables that  consolidate the relevant standards. Specifically, DS has created  tables for each of the following: (1) the standards for newly acquired  on-compound housing; (2) the standards for existing on-compound  housing; and (3) the standards for off-compound residences, including  the new May 2014 standards to address terrorism. DS officials stated  in April 2015 that they had not yet provided RSOs with the table for  off-compound residences but planned to do so in May 2015. In  addition, DS officials told us that they plan to develop an automated  template for on-compound housing to assist RSOs in identifying the  relevant standards.
Confusing terminology. RSOs at five posts stated that the standards  and guidance are sometimes worded in a confusing manner.  Specifically, while some standards are worded as mandatory  measures that “must” be taken, others are worded in a way that could  be interpreted as mandatory or discretionary. For example, some  measures “should” or will “ideally” be taken, or are “recommended”;  likewise, some standards “must be considered,” while others “should  be considered.” DS officials told us that the intent of using various  terms in the guidance is to give RSOs some flexibility in deciding  which measures are applicable to their posts. However, a number of  RSOs told us that they sometimes had difficulty deciding whether and  how to apply certain standards because of their confusing wording.  These RSOs said that difficulties in distinguishing the nuances  between the various terms used in the standards sometimes resulted  in their uncertainty as to whether the residences at their posts were  fully in compliance with the standards.
Unclear housing categories. While the new standards issued in May  2014 include a section outlining specific security measures for  residential compounds, DS headquarters officials told us that they  have had difficulty defining what differentiates this type of housing  from single family homes located in gated communities, which are  subject to a separate set of security measures. Officials added that in  the absence of clearly defined housing categories, it is difficult for  RSOs to know which standards to apply.
In addition to finding State’s residential security standards and guidance  to be confusing in nature, we identified multiple gaps and inconsistencies,  including the examples described below.
The previous version of the FAM subchapter detailing State’s program  for residential security stated that when a post experiences a change  in its Security Environment Threat List rating, the post must resurvey  residences to determine what security upgrades, if any, are needed.  However, a new version of the FAM subchapter published in August  2014 does not include this requirement. When we asked DS officials  about this, they told us it was an oversight and stated that the  requirement still exists. They also stated that because we brought this  issue to their attention, they plan to revise the standards issued in  May 2014 to include the requirement.
While the new standards released in May 2014 call for pedestrian and  vehicle gates at residences to have locking devices, DS officials noted  that the standards as written do not explicitly require the residences to  have gates. They told us they plan to modify the wording of this  standard to clarify that gates are required.  In addition to announcing the completion of residential security  standards to address terrorism, the notification DS sent to posts in  October 2014 enumerated other sets of security standards for posts to  apply, including standards to address crime and standards for newly  acquired on-compound housing. However, the notification did not  mention the security standards in effect at the time for existing on- compound housing. Additionally, those standards for existing on- compound housing, which dated back to December 1999, were  labeled in the FAH as standards for “new” on-compound housing. This  could potentially have caused confusion since the September 2014  standards for newly acquired on-compound housing are also labeled  as standards for “new” on-compound housing. As noted earlier, State  issued new standards for existing on-compound housing in May 2015.  Because State completed those standards late in our review, we were  unable to fully evaluate them.
We found inconsistent guidance on whether residential safe havens  are required to have an emergency exit. The Residential Security  Handbook states that every residential safe haven must have an  emergency exit. By contrast, a definitional section of the OSPB  security standards states that an emergency exit is required in  residential safe havens that have grilles and are located below the  fourth floor. A third variation appears in the new residential security  standards to address terrorism released in May 2014; it states that  residential safe havens must have an emergency exit “if feasible.” DS  officials told us that they plan to update the May 2014 standards to  help RSOs determine feasibility, but it is unclear whether they plan to  eliminate the inconsistencies we identified.
These gaps and inconsistencies exist in part because DS has not  comprehensively reviewed and harmonized its various standards and  security-related guidance for residences. The FAH requires OSPB to  review all the OSPB standards periodically—at least once every 5  years. In practice, as we previously reported, the process by which  security standards are updated is typically triggered by an event, such as  an attack, rather than by a periodic and systematic evaluation of all the  standards. As noted above, DS officials are planning updates to the  OSPB residential security standards to remedy some of the issues we  found. DS officials also stated that they are in the process of updating the  Residential Security Handbook and, as part of that effort, are adding  further clarifications and details to help guide RSOs. However, as  discussed earlier in this report, updates to the OSPB standards have  frequently taken State several years. Furthermore, the planned updates  that DS officials discussed with us do not constitute a comprehensive  effort to review all standards and security-related guidance for residences  to identify all potential gaps, inconsistencies, and instances where clarity  is lacking. Consequently, the confusing nature of the standards and  guidance and the gaps and inconsistencies they contain may continue to  complicate RSOs’ efforts to identify and apply the appropriate security  measures, potentially leaving some residences at greater risk. At a  minimum, such gaps and inconsistencies in the standards and guidance  can lead to confusion and inefficiency. For example, according to RSO  officials at one post we visited, DS inspectors from headquarters told  them during a review of the post’s security operations that residential safe  havens must have a reliable water source and grilles on all external  windows, including inaccessible windows. We subsequently verified with  DS headquarters that no such requirements exist for residential safe  havens.
section_title: State Uses Upgrades to Address Residential Security Vulnerabilities, but More Than Half of Residences We Reviewed Did Not Meet All Standards and Lacked Exceptions
paragraphs: Over the last 6 fiscal years, State has allocated about $170 million for  security upgrades to help address vulnerabilities identified at diplomatic  residences. However, 38 of the 68 residences that we reviewed did not  meet all of the applicable standards, thereby potentially placing their  occupants at risk. In instances when a residence does not and cannot  meet the applicable security standards, posts are required to either seek  other residences or request exceptions, which identify steps the posts will  take to mitigate vulnerabilities. However, DS had an exception on file for  only 1 of the 38 residences that we found did not meet all of the  applicable standards. Without all necessary exceptions in place, State  lacks information that could provide decision makers with a clearer picture  of security vulnerabilities at residences and enable them to make better  risk management decisions. In addition, new, more rigorous security  standards will likely increase posts’ need for exceptions and lead to  considerable costs for upgrades.
subsections: section_title: State Uses Security Upgrades to Address Residential Security Vulnerabilities
paragraphs: State addresses security vulnerabilities at residences by installing various  kinds of upgrades intended to help residences meet, or in some cases  exceed, the applicable standards. According to State guidance, every  effort should be made to have owners or landlords of leased residences  complete any permanent residential security upgrades at no cost to the  U.S. government. If the owners or landlords are unwilling or unable to  complete the necessary upgrades, RSOs have the option either to  request funding for upgrades or seek alternate residences. Security  upgrades for residences are primarily funded through DS, which funds all  upgrades—such as window grilles, residential safe havens, and shatter- resistant window film—other than perimeter barriers and some access  control measures at certain residences. As shown in table 2, in fiscal  years 2010 through 2015, DS allocated approximately $164 million for  residential security upgrades. Over the same period, OBO allocated more  than $6 million for residential security upgrades to perimeter barriers and  some access control measures at government-owned residences and  certain leased residences.
In some cases, RSOs may determine that the OSPB residential security  standards applicable at their posts are not stringent enough to address  threat conditions. In such instances, the RSO, in consultation with the  post’s Emergency Action Committee, may seek to implement security  measures that go above the standards. If an owner or landlord does not  agree to install a security measure that goes above the standards, the  post may choose to request funding from DS. For example, DS officials  told us that they approved a request for funding to install additional  security measures at a post where single family homes were meeting all  the applicable standards but were still experiencing break-ins.
section_title: More Than Half of the 68 Residences We Visited Did Not Meet All Mandatory Standards; DS Had an Exception on File for 1
paragraphs: Diplomatic residences are required to meet OSPB security standards.  The FAH and the FAM state that when residences do not meet and  cannot be made to meet the applicable standards, and no other  acceptable alternatives are available, posts are required to request  exceptions to the standards from DS headquarters. According to State,  exception requests are required to identify the steps posts will take to  mitigate vulnerabilities, and approved exceptions serve to document  State’s acceptance of any unmitigated risk that remains. DS officials  clarified that posts are required to apply for exceptions for any unmet  standards that are worded in terms of mandatory measures that “must” be  taken. However, more than half of the residences we reviewed at the  seven posts we visited did not meet all applicable mandatory security  standards and lacked required exceptions to those standards. Of the 68  residences we reviewed at the seven posts, 38 did not meet all of the  mandatory standards applicable to them at the time even though,  according to post officials, most of the 38 received security upgrades in  recent years. Moreover, 23 of the 38 residences did not meet two or  more of the mandatory standards.
When we discussed the unmet standards we found with RSOs and other  post officials, they generally agreed with our assessments and stated in  several cases that they would take steps to address the vulnerabilities. In  some cases, though, post officials were unable to provide explanations  for unmet standards. For instance, although 3 of the 4 off-compound  principal officer residences we visited did not have grilles on all  accessible windows as required—thereby creating vulnerabilities at these  potentially high-profile targets—officials could not explain why grilles were  missing other than to suggest that current principal officers and their  predecessors may have wanted to leave certain windows without grilles  for aesthetic purposes. In addition, two factors discussed earlier in this  report may contribute to unmet standards. First, missing or outdated  residential security surveys may hamper posts’ ability to identify and  address residential security vulnerabilities that could have otherwise been  recognized and corrected. Second, the difficult-to-use nature of the OSPB  standards and other security-related guidance for residences can  complicate RSOs’ efforts to identify and apply the appropriate security  measures.
subsections: section_title: Nearly All of the Residences We Visited That Did Not Meet All Mandatory Standards Were Missing Required Exceptions
paragraphs: Of the 38 residences we reviewed that did not meet all of the applicable  mandatory standards, DS had an exception on file for only 1. In some  cases, such as residences with doors lacking deadbolt locks or  peepholes, DS officials told us that relatively little effort or funding would  be needed to bring the residence into compliance with the standards and  thereby eliminate the need for an exception. However, many of the 38  residences that did not meet all of the applicable mandatory standards  had more significant vulnerabilities. For instance, as noted earlier, 3 of the  4 off-compound principal officer residences we visited did not meet the  standard that all accessible windows must have grilles when such  residences are located at posts rated high for political violence or crime;  DS did not have exceptions for any of the 3. Likewise, 5 of the 7 off- compound apartments acquired after July 1, 2014—and therefore subject  to the new May 2014 standards—did not have perimeter barriers  surrounding them as required by the standards; none of the 5 had  exceptions.
We found that required exceptions for residences were missing for three  key reasons. First, posts do not always request exceptions when they are  needed. For example, of the 3 posts where off-compound principal officer  residences lacked some window grilles, none had requested exceptions  to this unmet standard. DS headquarters officials told us that State’s  guidance for posts on how to request residential security exceptions has  historically been limited and vague, which, according to them, may  explain why posts do not always request exceptions when they are  needed. In cases where residences acquired since July 1, 2014, did not  meet all of the standards issued in May 2014, the lack of exceptions is  understandable, given that the posts acquired the residences before  being notified of the new standards in October 2014. In other cases,  though, the residences in question had been acquired several years or  even decades prior, and the standards we found that they were not  meeting had also been in existence for years.
Second, until recently, State guidance on exceptions did not clearly  identify the roles and responsibilities of key offices involved in managing  the exception process, leading to confusion within DS headquarters and  potentially at posts as well. In 2007, State established FAM guidance  identifying an office within DS’s Directorate for International Programs  (DS/IP) as the office responsible for managing the residential security  exception process. DS officials explained that, in practice, a different  office within DS’s Directorate for Countermeasures (DS/C) has handled  residential exception requests since the late 1980s and, because of  limited staffing in DS/IP, continued to do so even after State guidance  named DS/IP as the responsible office in 2007. However, State did not  revise the FAM guidance to identify DS/C as the responsible office.  Subsequently, in August 2014, DS provided us with a written response  stating that, as of that date, it had not received any requests for  residential security exceptions. We subsequently learned the written  response was drafted by DS/IP, which was unaware that DS/C had been  receiving and processing exception requests for residences since the late  1980s. Since that time, the two offices have clarified their roles and  responsibilities with respect to residential security exceptions.  Specifically, officials told us in April 2015 that DS/C is now handling all  exception requests related to setback, while DS/IP is handling all other  exception requests.
Third, weaknesses exist in DS’s tracking of exceptions. The FAM states  that State documentation should be complete to the extent necessary to  facilitate decision making. However, we found weaknesses that raise  questions about the completeness of DS’s documentation on exceptions.  For example, a list DS provided in response to our request for data on all  residential security exceptions only shows exceptions to the setback  standard. As noted earlier, DS had an exception on file for 1 of the 38  residences we reviewed that did not meet all of the applicable mandatory  standards. In reviewing the exception package for that residence, we  noted that the post requestedand received approval forexceptions to  four different standards. The exception package also lists mitigation  actions the post plans to take. DS’s list mentions that an exception was  granted to the setback standard, but it does not mention any of the other  three standards to which DS granted exceptions or the planned mitigation  actions. In addition, while the list DS provided identifies the post that  requested each exception, it does not identify the specific residence for  which the exception was requested. DS officials stated that in order to  identify the specific residence for which a given exception was requested  and approved, they would have to locate the paper copy of the exception  packagea potentially time-consuming task given that, according to DS  officials, the paper copies of residential exception packages are  commingled with thousands of exception packages for office facilities  dating back as far as 1986. Because of these weaknesses, DS’s list has  limited utility in helping DS and posts understand which residences may  have security vulnerabilities stemming from unmet standards.
While DS is taking steps to improve its guidance and tracking for  exceptions, it is unclear if the planned improvements will fully address the  factors that have contributed to missing exceptions. DS officials told us  that as part of their ongoing update to the Residential Security Handbook,  they will be providing additional guidance for RSOs on how to submit  requests for exceptions. Since that initiative is still in development, it is  too early to assess its effectiveness. Additionally, DS/C officials told us  that they have begun converting paper copies of exception packages they  have processed to electronic form—a task they estimate will take about 5  months—and both DS/IP and DS/C have developed databases to record  exception requests. As noted earlier, the FAM calls for State  documentation to be complete to the extent necessary to facilitate  decision making; however, neither office currently plans for its database  to include all of the exceptions processed by the other office.  Consequently, DS may lack a complete picture of all the residential  exceptions it has processedvaluable information that could help it better  understand the types of security vulnerabilities at residences and thus  make better informed risk management decisions.
section_title: New, More Rigorous Security Standards Will Likely Increase Posts’ Need for Exceptions and Lead to Considerable Costs for Upgrades
paragraphs: In addition to reviewing residences against the mandatory security  standards applicable to them at the time of our visit, we also reviewed  them using the new May 2014 standards in order to assess the impact  these standards will have on posts, DS headquarters, and future State  funding requests. As discussed earlier, by July 2017, all off-compound  residences will be required to meet the new standards to address  terrorism. If the residences do not meet the standards and cannot be  upgraded to meet them, posts will be required to apply for exceptions.  DS officials indicated that the new standards are more rigorous than the  previous ones and that many existing residences may be unable to meet  them. Overall, 55 of the 56 off-compound residences we reviewed did not  meet all of the new standards, including 49 residences that did not meet  two or more. As a result of the new standards, DS officials expect the  need for posts to apply for exceptions to increase. For example, officials  at one post told us that they do not believe it will be possible for any of the  approximately 300 apartments occupied by U.S. personnel at that post— or for other apartments available at their post—to meet the new  mandatory standard of a perimeter barrier surrounding the building. In  other cases, it will be possible to upgrade existing residences to meet the  new standards, but the associated costs may be considerable. For  instance, RSO officials at the post with about 300 apartments stated that  they will need to install alarms and residential safe havens to meet the  new standards, at a cost of approximately $3,000 per residence. They  added that it is unlikely that current landlords will agree to pay for these  upgrades. The 2014 Security Environment Threat List indicates that  nearly 45 of the 275 U.S. diplomatic posts worldwide have higher threat  ratings for terrorism than for political violence and crime and thus will  likely have to adopt additional security measures—potentially at  significant cost to the U.S. government—in order to meet the new  standards to address terrorism. Furthermore, additional upgrades—and  thus additional funding—will likely be needed as posts take steps to apply  the new standards for existing on-compound housing, which, according to  DS officials, are also more rigorous than the standards that preceded  them.
DS headquarters officials told us that because of our inquiries about the  implications of the new standards to address terrorismsuch as the  financial cost of meeting themthey had decided to conduct a survey of  posts to assess the extent to which each one currently meets the new  standards. According to these officials, the results of the survey will help  them estimate the cost of upgrades needed to meet the new standards  and will provide them with valuable information on the types of  vulnerabilities that currently exist at residences. They stated that they  anticipate the survey may also help them determine how much time it will  take to review and process posts’ requests for exceptions. DS officials  added that they plan to send the survey to posts in May 2015.
section_title: State Has Taken Steps to Manage Risks to Schools and Other Soft Targets, but Its Efforts May Be Constrained by Limited Awareness of Relevant Guidance and Tools
paragraphs: State’s efforts to protect U.S. personnel and their families at schools and  other soft targets include funding physical security upgrades, providing  threat information and security-related advice, and conducting security  surveys of various soft target facilities. However, RSOs at most of the  accompanied posts we visited were unaware of some guidance and tools  for securing these facilities. As a result, State may not be taking full  advantage of its programs and resources for managing risks at schools  and other soft targets.
subsections: section_title: State Funds Security Upgrades, Shares Threat Information, and Conducts Security Surveys to Manage Risks to Schools and Other Soft Targets
paragraphs: State has taken a variety of actions to manage risks to schools and other  soft targets. These actions fall into three main categories: (1) funding  security upgrades at K-12 schools with enrolled U.S. government  dependents and off-compound employee association facilities, (2) sharing  threat information and providing advice for mitigating threats at schools  and other soft targets, and (3) conducting security surveys to identify and  manage risks to schools and other soft targets.
First, in 2003, State developed a multiphase initiative known as the Soft  Target Program to protect U.S. personnel and their families at schools  and off-compound employee association facilities. With respect to  schools, the Soft Target Program funds physical security upgrades at  existing K-12 schools with enrolled U.S. government dependents.  Program funding was initially limited to “American-sponsored” schools  that receive State assistance. Subsequently, eligibility for program  funding was expanded to non-American-sponsored schools that enroll  U.S. dependents or are expected to enroll such students within the next 6  months. In fiscal years 2010 through 2015, State allocated almost $28  million for security upgrades through the Soft Target Program (see table  3). State has used approximately $23.8 million of these allocations to  award almost 400 grants for specific upgrades. Of these awards,  approximately 97 percent ($23.1 million of $23.8 million) went to schools,  with the remaining 3 percent provided for off-compound employee  association facilities. According to State documentation, since the Soft  Target Program began in 2003, State has provided schools with more  than $100 million for physical security upgrades. American-sponsored  schools received $63 million of this funding; other schools received the  remaining $38 million.
At the posts we visited, RSOs had worked with schools to identify  physical security needs and obtain funding for upgrades such as walls,  guard booths, public address systems, and window grilles. In addition to  school security upgrades, we also saw Soft Target Program-funded  security upgrades at employee association facilities, such as closed- circuit television systems, perimeter walls, and access control systems.  Overall, RSOs and school administrators told us they were pleased with  the upgrades. However, State does not operate or control the schools  eligible for Soft Target Program upgrades; as a result, the extent to which  eligible schools cooperate with posts on security-related issues depends  on the willingness of the schools’ administrators.
Second, State officials help manage risks to schools and other soft  targets by sharing threat information and providing advice on how to  mitigate such threats. RSO outreach to schools at the posts we visited  included sharing information related to specific threats, such as apprising  school administrators about the recent posting on a jihadist website  calling for attacks on western-affiliated teachers and schools in the Middle  East. In addition, at one post architects designing a new American- sponsored school cited security advice provided by the RSO as the  impetus for them to undertake a more security-conscious redesign. RSOs  at all the accompanied posts we visited stated that they also share local  threat information with schools and others outside the U.S. government.  Additionally, RSOs we met with told us that they communicate with  security officials at British, Canadian, and other embassies in the area  they cover to help deter attacks on soft targets by raising overall threat  awareness.
Third, RSOs conduct security surveys to help identify and manage risks  to schools and other soft targets. Although State does not control schools,  hotels, or hospitals overseas, RSOs at all the accompanied posts we  visited had conducted security surveys of such facilities. State is currently  in the process of developing security standards for off-compound  employee association facilities in response to our June 2014  recommendation that State develop physical security standards for  facilities not covered by existing standards.
section_title: Awareness of Some State Guidance and Tools for Securing Schools and Other Soft Targets Is Limited
paragraphs: Federal internal control standards call for agencies to communicate the  information necessary for conducting the agency’s operations to those  within the entity responsible for carrying out these activities in a form and  time frame that allows them to carry out their responsibilities. State has  established guidance for RSOs regarding the security of schools and  other soft targets as well as tools to assist RSOs’ security-related  outreach with schools, but half of the RSOs we met with at the six  accompanied posts stated that the only guidance or tools they were  aware of with respect to schools and soft targets was a cable with  information on the types of items that can be funded through the Soft  Target Program. One post was using an outdated version of this cable.  Additionally, two RSOs described the cable as lacking sufficient detail on  the specific types of upgrades allowed and disallowed. Additional Soft  Target Program guidance does exist in the FAM—including details on  grant eligibility and the roles, responsibilities, procedures, and  requirements related to project development and implementation—but the  relevant FAM subchapter was not mentioned in any of the Soft Target  Program cables we reviewed, and no RSOs cited that FAM subchapter as  a source of guidance with which they were familiar. OBO officials stated  that they believe the Soft Target Program cable provides RSOs with the  necessary level of information but noted that they plan to issue an  updated version of the cable with additional detail. They also stated that  they see value in mentioning the associated FAM subchapter in the  updated cable.
With respect to tools, in 2008, State’s Office of Overseas Schools, DS,  and OBO published a booklet—Security Guide for International Schools— and an accompanying CD to assist international schools in designing and  implementing a security program. These are tools that RSOs can offer to  all schools—including those otherwise ineligible for upgrades funded by  the Soft Target Program. However, RSOs at the majority of the posts we  visited were unaware of this security guide, but after we brought it to their  attention, some stated that they planned to share it with schools at their  posts.
Because of limited awareness of the guidance and tools for securing  schools and other soft targets, State may not be fully leveraging its  existing programs and resources for addressing the security needs of  schools and other soft targets.
section_title: Conclusions
paragraphs: Thousands of U.S. diplomatic personnel and their families live in an  overseas environment that presents myriad security threats and  challenges. While State has taken significant measures to enhance  security at its embassies and consulates since the 1998 East Africa  embassy bombings, these same actions have given rise to concerns that  would-be attackers may shift their focus to what they perceive as more  accessible targets, such as diplomatic residences, schools, and other  places frequented by U.S. personnel and their families. We found that  State has taken various steps to address threats to residences and other  soft targets. For instance, over the last 6 fiscal years, State allocated  nearly $200 million for security upgrades for residences, schools, and off- compound employee association facilities, and it has also made efforts to  modernize the physical security standards that residences must meet.  However, we found vulnerabilities at many of the residences we reviewed  and a number of gaps or weaknesses in State’s implementation of its risk  management activities. For example, posts do not always complete  residential security surveys as required, exceptions are missing for many  residences that require them, and DS’s tracking of exceptions is  fragmented between two offices. As a result, State lacks full awareness of  the vulnerabilities that exist at residences. Similarly, State’s physical  security standards and security-related guidance for residences are  difficult to use, and awareness of its guidance and tools for schools and  other types of soft targets is limited. Each of these issues is problematic  on its own, but taken together, they raise serious questions about State’s  ability to make timely and informed risk management decisions about soft  targets. Until it addresses these issues, State cannot be assured that the  most effective security measures are in place at a time when U.S.  personnel and their families are facing ever-increasing threats to their  safety and security.
section_title: Recommendations for Executive Action
paragraphs: To enhance State’s efforts to manage risks to residences, schools, and  other soft targets overseas, we recommend that the Secretary of State  direct DS to take the following five actions:  1.  Institute procedures to improve posts’ compliance with requirements  for conducting residential security surveys.  2.  Take steps to clarify existing standards and security-related guidance  for residences. For example, DS could conduct a comprehensive  review of its various standards and security-related guidance for  residences and take steps to identify and eliminate gaps and  inconsistencies.  3.  Develop procedures for ensuring that all residences at posts overseas  either meet applicable standards or have required exceptions on file.  4.  Ensure that DS/IP and DS/C share information with each other on the  exceptions they have processed to help DS establish a complete  picture of all residential security exceptions on file.  5.  Take steps in consultation with OBO to ensure that RSOs are aware  of existing guidance and tools regarding the security of schools and  other soft targets. For example, DS and OBO could modify the Soft  Target Program cable to reference the associated FAM subchapter.
section_title: Agency Comments
paragraphs: We provided a draft of this report for review and comment to State and  the U.S. Agency for International Development. We received written  comments from State, which are reprinted in appendix II. State agreed  with all five of our recommendations and highlighted a number of actions  it is taking or plans to take to implement the recommendations. The U.S.  Agency for International Development did not provide written comments  on the report.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of State, and the Administrator for the U.S.  Agency for International Development. In addition, the report is available  at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our report were to evaluate (1) how the Department of  State (State) assesses risks to residences overseas; (2) the timeliness,  clarity, and consistency of State’s security standards for residences; (3)  how State addresses security vulnerabilities at residences; and (4) how  State manages risks to other soft targets overseas.
To address these objectives, we reviewed U.S. laws; relevant State  security policies and procedures as found in cables, the Foreign Affairs  Manual (FAM), and the Foreign Affairs Handbooks (FAH)—in particular,  the Residential Security Handbook, Physical Security Handbook,  Overseas Security Policy Board (OSPB) standards, and information and  guidance related to State’s residential security program and Soft Target  Program; the Bureau of Diplomatic Security’s (DS) threat and risk  ratings, periodic assessments of post security programs, and residential  security exceptions; post-specific documents pertaining to security of  residences and other soft targets; classified Accountability Review Board  reports and Interagency Security Assessment Team recommendations;  and past GAO, State Office of Inspector General, and Congressional  Research Service reports. We assessed DS’s risk management practices  against its own policies and standards, best practices identified by GAO,  and federal internal control standards.
Additionally, we reviewed and compared residential security standards  and other security-related guidance within the FAM and FAH to evaluate  their clarity and consistency. We identified gaps and inconsistencies in  relevant standards and security-related guidance for residences in the  course of (1) conducting an analysis of the OSPB standards, the  Residential Security Handbook, and the Physical Security Handbook to  develop our facility review checklists and (2) discussing the guidance with  knowledgeable State officials. Because it was beyond the scope of this  engagement to systematically review all residential security standards  and related guidance for gaps and consistencies, we cannot generalize  our findings to all standards and security-related guidance for residences.  We also evaluated the timeliness of updates to OSPB residential security  standards. To do so, we asked State to identify all updates to the  residential security standards since 2005 and to provide information about  when the updates started and were completed. We then analyzed how  long each update took and compared that against State officials’  expectation of how long such updates should take.
In addition to reviewing the documents above, we interviewed officials in  Washington, D.C., from DS; the Bureau of Overseas Buildings Operations  (OBO); State’s Office of Management Policy, Rightsizing, and Innovation;  and the U.S. Agency for International Development. We also traveled to 7  posts and conducted work focused on 3 other posts. Our judgmental  sample of 10 posts included nine countries in four of State’s six  geographic regions—Africa, the Near East, South and Central Asia, and  the Western Hemisphere. Each of the 10 posts was rated by DS as  having a high or critical threat level in one or more of the Security  Environment Threat List categories of political violence, terrorism, and  crime. Additionally, all but 1 of the 10 posts we selected were within the  top 75 posts rated by DS as the highest risk worldwide; of the 10, 7 were  within the top 50, and 4 were within the top 25. For security reasons, we  are not naming the 10 posts in our judgmental sample. Our findings from  these posts are not generalizable to all posts. Moreover, our judgmental  sample of high-threat, high-risk posts cannot be generalized to other high- threat, high-risk posts.
For 2 of the 3 posts in our judgmental sample that we did not visit, we  reviewed residential security surveys and spoke with a Regional Security  Officer (RSO) regarding residential security measures in place at the  posts. For the third post we did not visit, we requested RSO input on  recent security upgrades and any remaining vulnerabilities at soft target  facilities at post. At the 7 posts we visited, we met with U.S. government  officials from State and other agencies involved in securing residences  and other soft targets—including RSOs, general services officers,  financial management officers, facility managers, and members of post  Emergency Action Committees and Interagency Housing Boards—to  understand their respective roles related to security of residences and  other soft targets and their perspectives on State’s security policies and  procedures for these facilities. We also requested residential security  surveys for all 68 residences in our judgmental selection. We evaluated  the posts’ records of these surveys using the residential security survey  requirements outlined in the FAM. Additionally, we reviewed security  measures in place at 10 schools attended by U.S. government  dependents and 3 off-compound employee association facilities. Of the  10 schools, 6 were “American-sponsored” schools that receive State  assistance; the other 4 do not receive State assistance but enroll U.S.  government dependents.
At the 7 posts we visited, we also evaluated a judgmental selection of 68  residences against applicable security standards. To do so, we first asked  DS officials to identify all sections of the FAH that contain residential  security standards. Based on DS’s input, we reviewed all of the identified  sections and developed checklists of the residential security standards  applicable to each of the following residence types: on-compound  housing, off-compound apartments, off-compound single family homes,  off-compound residential compounds, off-compound Marine Security  Guard residences, and off-compound residences for principal officers.  The checklist for each residence type included the standards applicable  to it as of our fall 2014 visit, and the checklists for off-compound  residences also included the new May 2014 standards to address  terrorism, which all off-compound residences have to meet by July 2017.  As noted earlier in this report, standards also vary by date of construction  or acquisition and threat level. We included these variations in each  checklist so that for each residence we visited, we could apply the exact  standards applicable to it based on its type, its date of construction or  acquisition, and the post threat level.
Our checklists included mandatory standards worded in terms of  measures that “must” be taken as well as other standards, such as  measures that are “recommended” or that “should” or will “ideally” be  taken, among others. While we used all of these standards to review the  residences we visited, the analysis presented in this report only includes  mandatory standards worded in terms of measures that “must” be taken.  We did not include other standards in our analysis because, as discussed  earlier in this report, some of the terminology used in those standards is  inconsistent, making it difficult to determine if a given residence is in  compliance or not.
With regard to the specific 68 residences reviewed, we evaluated the  principal officer’s residence at 6 of 7 posts and the Marine Security Guard  residence at 5 of 7 posts. The remaining 57 residences in our judgmental  selection represented a mix of different types of residences (such as  apartments and single family homes), on-compound and off-compound  residences, owned and leased residences, older and newer residences,  and residences occupied by State officials and non-State officials. Using  the checklists that we developed, we reviewed each of the 68 residences  against the mandatory standards applicable to it as of our fall 2014 visit;  in addition, we reviewed each of the 56 off-compound residences against  the mandatory standards in the new May 2014 standards to address  terrorism.
After completing all 68 checklists, we categorized the mandatory  standards into six general categories, which we developed on the basis of  our professional judgment as well as our review of the six general  categories of security standards presented in our June 2014 reporting on  the security of diplomatic work facilities overseas. Each category  included one or more mandatory standards. For example, the category of  secure building exteriors included mandatory standards calling for  features such as lighting; substantial or grilled doors with peepholes and  deadbolt locks; and grilles, locks, and shatter-resistant film on accessible  windows. For the purposes of our analysis, if a residence did not meet  one of more of the mandatory standards in a given category, we classified  the residence as not meeting all mandatory standards in that category.  We used this methodology to calculate the number of residences that did  not meet all mandatory security standards applicable to them as of fall  2014 within each security standard category. We used the same  methodology to calculate the number of off-compound residences that did  not meet all mandatory standards within each category of the new May  2014 standards to address terrorism.
To determine the reliability of the data we collected on overseas  residences and funding for security upgrades to residences, schools  attended by children of U.S. government personnel, and off-compound  facilities of employee associations, we compared information from  multiple sources, checked the data for reasonableness, and interviewed  cognizant officials regarding the processes they use to collect and track  the data. We evaluated the reliability of OBO’s data on overseas  residential properties by comparing records for specific residences from  OBO’s system with information we collected during site visits to these  residences and discussions with OBO and post officials. We evaluated  the reliability of the funding data we collected by comparing the data  against prior GAO reporting and by interviewing DS and OBO officials  familiar with State’s financial management system to ask how the data  are tracked and checked for accuracy. On the basis of these checks, we  determined that the data we collected on overseas residences and  funding were sufficiently reliable for the purposes of this engagement.
We conducted this performance audit from July 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of State
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Thomas Costa (Assistant  Director), Joshua Akery, Amanda Bartine, John Bauckman, Tina Cheng,  Aniruddha Dasgupta, David Dayton, Martin De Alteriis, Jonathan  Fremont, Grace Lui, and Candice Wright made key contributions to this  report.