Federal Real Property: GSA Should Inform Tenant Agencies When Leasing High-Security Space from Foreign Owners
Published: 2017-01-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO has previously reported that federal facilities are vulnerable to threats from foreign sources that may target their information systems and affect the physical security of the occupants. GAO was asked to examine GSA's lease of high-security space from foreign owners.
This report addresses (1) what is known about foreign ownership of high-security space leased by GSA, (2) potential risks posed by such foreign ownership, and (3) policies and procedures regarding GSA's leasing of space from foreign-owned entities. GAO reviewed GSA's leasing documents; identified and checked ownership information regarding high-security leased space to the extent possible using data, as of March 2016, from a firm that specializes in analyzing the commercial real estate market; interviewed GSA and federal foreign investment officials, tenant agencies that were occupying space owned by foreign entities, and five real estate companies that lease space to GSA or provide related services; and visited three foreign-owned high-security leased facilities selected to represent a variety of owners and tenants.
section_title: What GAO Found
paragraphs: GAO reviewed available information on the ownership of General Services Administration (GSA) leased space that requires higher levels of security protection based on factors such as mission criticality and facility size (high-security space) as of March 2016 and found that GSA is leasing high-security space from foreign owners in 20 buildings. The 26 tenant agencies occupy about 3.3 million square feet at an annual cost of about $97 million and use the space, in some cases, for classified operations and to store law enforcement evidence and sensitive data. The foreign-owned leased space included six Federal Bureau of Investigation field offices and three Drug Enforcement Administration field offices. GAO determined that the high-security space is owned by companies based in countries such as Canada, China, Israel, Japan, and South Korea. GAO was unable to identify ownership information for about one-third of GSA's 1,406 high-security leases as of March 2016 because ownership information was not readily available for all buildings.
Federal officials who assess foreign investments in the United States and some tenant agencies occupying high-security leased space told GAO that leasing space in foreign-owned buildings could present security risks such as espionage and unauthorized cyber and physical access. However, 9 of the 14 tenant agencies GAO contacted were unaware that the space they occupy is in a building that we identified as foreign owned. The other five agencies that knew about occupying foreign-owned space had taken actions to mitigate the risk or were not concerned. Another risk is possibly entering into leases with hidden beneficial owners—the persons who ultimately own and control a building. According to the Treasury Department's Financial Crimes Enforcement Network, the risks of contracting with hidden beneficial owners include money laundering. GSA is not required to collect beneficial ownership information and therefore does not know the beneficial owners of the buildings it leases.
Federal agencies are required to assess and address the risks to their high-security facilities but GSA does not inform tenants when leasing space from foreign owners. When leasing space, GSA is required, among other things, to determine whether the prospective lessor is a responsible party, but foreign ownership is not one of the factors that it must consider. As a result, tenants may be unaware that they are occupying foreign-owned space and not know whether they need to address any security risks associated with such foreign ownership.
section_title: What GAO Recommends
paragraphs: GAO recommends that GSA determine whether the beneficial owner of high-security leased space is a foreign entity and, if so, share that information with the tenant agencies for any needed security mitigation. GSA agreed with the recommendation.

section_title: Letter
paragraphs: The federal government routinely leases space from private sector  landlords, including high-security space occupied by law enforcement  agencies and members of the intelligence community. We have  previously reported that government facilities—some of which contain  high-security space used for classified operations, data centers, and to  store items such as weapons and sensitive evidence—are vulnerable to  threats from foreign sources that may affect their information systems and  the physical security of the occupants. The General Services  Administration (GSA) leases space for many agencies in the federal  government, including some high-security space. However, the extent to  which GSA is leasing high-security space from foreign owners—entities  based in foreign countries—is unclear. Furthermore, foreign ownership of  GSA-leased space raises questions about potential security risks  involving access to the facilities and the means by which these buildings  were financed.
You asked us to examine GSA’s leasing of high-security space from  foreign owners. We reviewed: (1) what is known about foreign ownership  of high-security space leased by GSA; (2) what potential risks, if any, are  posed by foreign ownership of high-security GSA-leased space  associated with physical and cybersecurity and sources of funding; and  (3) what policies and procedures guide GSA’s leasing of space from  foreign-owned entities and how GSA follows them.
To determine what is known about foreign ownership of high-security  space leased by GSA, we conducted our own assessment of the  ownership of high-security GSA-leased space and compared our findings  with a list of leased high-security space that GSA provided. We defined  foreign-owned buildings as those that are owned by an immediate or  parent company based in a foreign country. Another way of defining  foreign ownership is the nationality of a building’s beneficial owner—the  person who ultimately owns and controls a company. While definitions of  beneficial ownership vary, this is the definition we developed for the  purposes of this report. The foreign owners that we identified may not  necessarily be the beneficial owners. Identifying the beneficial owners  would have required access to information that was not available.
To conduct our assessment, we obtained a list from GSA of its 1,406  high-security leased spaces (facility security levels III, IV, and V) within  the United States as of March 2016. GSA provided us with information  about the steps that it took to ensure the completeness and reliability of  its leasing data. Based on our review of this information, we determined  the data were sufficiently reliable for our purposes. We checked, or  attempted to check, the ownership of all of the buildings in which those  1,406 leases of space are located in a database compiled by Real Capital  Analytics as of March 2016. We discussed with Real Capital Analytics’  representatives the steps that the company took to ensure the  completeness and reliability of its real property ownership data and  determined that the data were sufficiently reliable for our purposes.
We took additional steps to verify the ownership information with the  owners’ representatives or other sources such as leasing documentation  and company websites. Because the database was limited to information  about commercial office buildings based on transactions within the last 15  years, we were unable to identify ownership information regarding 500 of  GSA’s 1,406 leases of high-security space as of March 2016. For this  review, we defined a “foreign owned” company as one that the real  property database indicated is based in a foreign country and is an  immediate or highest level owner of the building. We also checked the  ownership of buildings in which GSA leases space that the agency  indicated were owned by foreign entities. GSA officials said that they  compiled that list based on information contained in the System for Award  Management (SAM)—the federal acquisition and award system that GSA  administers. GSA officials provided information on the types of data that  contractors provide in SAM related to foreign ownership and discussed  the extent to which that information was validated.
To determine potential security risks associated with leasing high-security  space from foreign companies, we reviewed GSA leases of high-security  space with foreign companies based in non-North Atlantic Treaty  Organization (NATO) countries as of March 2016 focusing on owner  access. We focused on foreign-owned companies that are not based in  NATO member countries as a way of identifying leasing arrangements  that could be of higher risk.
We also reviewed case files of the Committee on Foreign Investment in  the United States (CFIUS) involving foreign acquisitions of U.S.  companies that are leasing space to GSA. In addition, we obtained  information from the Department of Homeland Security (DHS) about  cyber attacks on government facilities and reports on money laundering  prepared by the Treasury’s Department’s Financial Crimes Enforcement  Network (FinCEN) and the Financial Action Task Force (FATF). We also  reviewed FinCEN’s rules for financial institutions regarding requirements  for beneficial owners and customer due diligence. Further, we interviewed  officials from the Department of the Treasury, which chairs CFIUS; the  Department of Defense (DOD), Department of Energy (DOE), DHS, and  the Department of Justice (DOJ), which are CFIUS members; and  representatives from five real estate companies. We submitted questions  or interviewed officials from the tenant agencies that we identified as  occupying space leased from companies based in countries that are not  NATO members. The real estate companies were selected because they  lease space to GSA or provide services regarding the leasing of space to  GSA. We visited three foreign-owned high-security facilities that GSA is  leasing to interview tenant agencies about security-related issues. We  selected these facilities because they represented a variety of tenants  and owners in two different geographic areas. Our findings from those  visits are not generalizable to all GSA-leased high-security space.
In addition, we interviewed officials from the Securities and Exchange  Commission (SEC) about public disclosure requirements for real estate  investment trusts. We also interviewed organizations such as the Real  Estate Roundtable, the American Bankers Association, Global Financial  Integrity, Global Witness, and the Financial Accountability and  Corporate Transparency (FACT) Coalition about customer identification  due diligence requirements and challenges to identifying the beneficial  owners.
To assess the policies and procedures that GSA uses when leasing  space from foreign-owned entities and how GSA follows them, we  reviewed the agency’s leasing policies and procedures and interviewed  GSA officials about the process that the agency follows when leasing  from foreign companies. We compared the agency’s policies and  practices to federal internal control standards related to risk assessment  and communication.
We conducted this performance audit from August 2015 to November  2016 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objective. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objective.
This is a public version of GAO-17-21SU that we issued in November  2016. This report excludes information that is deemed to be For Official  Use Only (FOUO) by the audited agencies and that must be protected  from public disclosure. Therefore, this report omits FOUO information and  data related to foreign ownership of certain GSA-leased high-security  space. Although the information provided in this report is more limited in  scope, it addresses the same objectives as the sensitive report and the  methodology used for both reports is the same.
subsections: section_title: Background
subsections: section_title: Foreign Investment in U.S. Commercial Office Buildings
paragraphs: The United States has long been open and receptive toward foreign  investment. In 2011, the President issued Executive Order 13,577,  creating the SelectUSA Initiative, in part, to encourage foreign investment  in the United States. In addition, legislation introduced in the 114th  Congress is aimed, in part, at attracting more foreign investment in real  estate through changes in the tax code. According to some real estate  companies we interviewed, investors are attracted to government-leased  buildings because they provide a safe and reliable rate of return.  Representatives from one real estate company added that the  advantages of leasing to the federal government include the ability of  investors to receive higher rates of return, compared with Treasury  bonds, that the real estate also appreciates in value, and that the projects  help promote underdeveloped areas. A representative from another firm  said that foreign investors are also interested in the government’s long- term lease of space.
Foreign investment in U.S. commercial office buildings has been  increasing in recent years. According to Real Capital Analytics, annual  foreign investment in significant U.S. commercial office buildings  increased from $11.7 billion in 2011 to $26.5 billion in 2015. As shown  in figure 1, of those amounts, investors from Canada, Germany, China,  Norway, and South Korea invested the most during those 5 years. For  example, data from Real Capital Analytics indicated that in 2015, foreign  investors purchased 336 commercial office buildings in the United States,  106 of which were purchased by Chinese investors for a total of $2.8  billion. Chinese investment in U.S. commercial office buildings was part  of overall increased Chinese investment in the United States. According  to the National Committee on U.S.-China Relations and the Rhodium  Group, overall Chinese investment in the United States could reach $30  billion in 2016, up from $15 billion in 2015 and $4.9 billion in 2011.
section_title: Agency Roles and Leasing Trends
paragraphs: GSA is responsible for leasing space for many agencies of the federal  government and has about 8,300 leases of space. GSA develops,  coordinates, issues, and administers real property policies, guidelines,  and standards for property under its custody and control and for agencies  operating under, or subject to, the authorities of the GSA Administrator.  As of March 2016, GSA had about 1,400 leases of high-security space in  about 850 buildings. Since 2008, GSA has leased more space than is  federally-owned and under its custody and control. For example, in fiscal  year 2015, GSA leased 190.8 million square feet of space, compared with  having custody and control of 183.2 million square feet of federally-owned  space. Overreliance on costly leasing is one of the major reasons that  federal real property management remains on GAO’s high-risk list. Our  work over the years has shown that leasing space often costs the  government more than owning buildings, especially for long-term space  needs.
GSA and DHS’s Federal Protective Service (FPS) have joint responsibility  for protecting federal facilities held or leased by GSA. FPS has primary  responsibility for the security and protection of buildings and their  occupants, whereas GSA has primary responsibility for security fixtures,  maintenance, and building access. Some agencies also use their own  police forces to protect their facilities. FPS and the client agencies set the  facility security levels in consultation with GSA. As discussed later, these  levels determine the frequency of required risk assessments of facilities,  among other things.
CFIUS, an interagency committee chaired by the Treasury Department,  reviews transactions that could result in foreign control of a U.S.  business, which could include a company that leases space to the federal  government, in order to determine the effect of such transactions on the  national security of the United States. Under the Foreign Investment and  National Security Act of 2007 (FINSA), CFIUS shall review “any merger,  acquisition, or takeover…by or with any foreign person which could result  in foreign control of any person engaged in interstate commerce in the  United States” to determine the effects of such transaction on the national  security of the United States. To review a foreign acquisition of a U.S.  business, CFIUS must determine that the acquisition is a “covered  transaction.” CFIUS may recommend that the President suspend or  prohibit any covered transaction that presents unresolved national  security concerns. Under FINSA, the President may block a foreign  acquisition that raises national security concerns, but this has rarely  occurred. CFIUS’s reviews are confidential and protected from public  disclosure.
FinCEN is one of the Treasury Department’s primary bureaus to oversee  and implement policies to prevent and detect money laundering. FinCEN  uses anti-money laundering laws such as the Bank Secrecy Act to require  reporting and recordkeeping by banks and other financial institutions. The  regulation and enforcement of the Bank Secrecy Act involves several  different federal agencies, including FinCEN, the federal depository  institution regulators—the Federal Deposit Insurance Corporation,  Federal Reserve, National Credit Union Administration, and the Office of  the Comptroller of the Currency—the Internal Revenue Service (IRS), the  Commodity Futures Trading Commission, DOJ, and SEC.
section_title: Federal Facility Security Risks Related to Foreign Ownership
paragraphs: Because owning property can provide access to the buildings and  building systems, foreign ownership of government-leased space can  pose security risks particularly regarding cybersecurity. In 2014, we  reported that federal facilities are vulnerable to cyber attacks to their  building and access control systems (e.g., heating, ventilation, and air- conditioning; surveillance cameras; and electronic card readers), which  could provide unauthorized access to the facilities, endanger the  occupants, and provide access to information systems. We found that  insider threats—which can include disgruntled employees, contractors, or  other persons abusing their positions of trust—represent a significant  threat to building and access control systems, given insiders’ access to  and knowledge of these systems. These insider threats can also include  the owners and the people they employ to operate the buildings. In  addition, we reported that nations use cyber tools as part of their  information-gathering and espionage activities. In our 2014 report, we  recommended that the Secretary of Homeland Security direct the  Interagency Security Committee (ISC), housed within DHS, to incorporate  the cyber threat to building and access control systems into ISC’s list of  undesirable events in its Design-Basis Threat report, which informs  agencies about the threats they face. DHS implemented our  recommendation in 2016. DHS has identified or received reports of cyber  attacks on government facilities in recent years such as incidents at a  state law enforcement crime lab and a wastewater plant. Furthermore, in  March 2016, the U.S. Attorney for the Southern District of New York  announced the indictment of seven Iranians in a cyber attack on a city- owned dam in Rye, NY.
In this regard, multiple sources cite China as a primary source of cyber  intrusions. In 2011, the Office of the National Counterintelligence  Executive reported that “Chinese actors are the world’s most active and  persistent perpetrators of economic espionage.” Attorneys specializing  in Chinese business practices and a real estate company representative  told us that companies in China are likely to have ties to the Chinese  government. In 2014, the Justice Department charged Chinese military  hackers with cyber espionage against U.S. corporations and a labor  organization for the purpose of gaining a commercial advantage—the first  time that criminal charges have been filed against known state actors for  hacking. Moreover, according to the Director of National Intelligence,  China is the leading suspect in the cyber intrusion into the Office of  Personnel Management’s (OPM) systems affecting background  investigation files for 21.5 million individuals which OPM reported in July  2015.
To acquire a building for federal agencies, GSA may work with the private  sector to design and construct a building that the government then  leases—which would give the construction firm access to the building’s  structure. The security risk of having access to a building structure was  evident in 1987 when the Senate Select Committee on Intelligence  reported that “n 1985, the Committee received its first testimony  indicating that there was strong evidence that the Soviets had succeeded  in incorporating a complex and comprehensive electronic surveillance  system into the structure of the new U.S. Embassy under construction in  Moscow….” We reported in 1987 that the U.S. government contracted  with a Soviet firm to construct the embassy building.
Foreign-owned property located near federal facilities may also pose  security risks. In 2014, we reported about DOD’s concerns over  encroachment by foreign entities conducting business near its test and  training ranges. We reported that foreign encroachment may provide an  opportunity for surveillance of DOD test and training activities.
section_title: Money Laundering in Commercial Real Estate Using Anonymous Companies and Hidden Beneficial Owners
paragraphs: Another potential risk to the government regarding foreign-owned leased  space is the source of funds used to finance the projects. According to  FinCEN, money laundering involves disguising financial assets so they  can be used without detection of the illegal activity that produced them.  Through money laundering, criminals transform the monetary proceeds  derived from criminal activity into funds with an apparently legal source.  According to the Federal Financial Institutions Examination Council’s  Bank Secrecy Act/Anti-Money Laundering Examination Manual, a  compilation of guidance developed by the federal banking agencies and  FinCEN, once illegal funds are in the financial system, additional  transactions are used to create the appearance of legality. These  transactions further shield the criminal from a recorded connection to the  funds by providing a plausible explanation for the source of the funds.
Examples include the purchase and resale of real estate, investment  securities, foreign trusts, or other assets.
A 2015 State Department report on money laundering indicated that of  211 countries and jurisdictions, 67 are listed as being “of primary  concern” regarding money laundering, including the United States, and 69  are listed as being “of concern.” The report indicated that economies in  countries such as the United States that attract funds globally are  vulnerable to money laundering activity because the volume and  complexity of the available financial options may make criminals believe  they may more easily hide their funds.
In May 2016, the President announced steps to strengthen financial  transparency and combat money laundering, corruption, and tax evasion,  including a FinCEN rulemaking intended to strengthen customer due  diligence requirements, in part, by requiring covered financial institutions  to identify and verify the identity of beneficial owners. In the final rule,  FinCEN discussed the importance of identifying beneficial owners in the  context of assisting financial investigations by law enforcement.  Specifically, FinCEN discussed a 2013 case in which New York  prosecutors indicted 34 alleged members of Russian-American organized  crime groups with having moved millions of dollars in unlawful gambling  proceeds through a network of shell companies in Cyprus and the  United States.
section_title: GSA Is Leasing Some High-Security Space from Foreign Companies, but Lack of Information Makes Foreign Ownership Difficult to Identify
paragraphs: In October 2015, GSA provided us with a list of all the space that the  agency believed it was leasing from foreign owners. GSA indicated that  this list, which included 17 leases, was compiled using information that  lessors provided in SAM. Prior to November 1, 2014, GSA was not  required to collect certain information from lessors through SAM, such as  the parent, subsidiary, or successor entities to the lessor. All except one  of these leases was entered into prior to November 1, 2014. We tried to  validate the ownership through Real Capital Analytics’ real property  database which indicated that 6 of the 17 leases were with foreign  companies, 4 of which were of high-security space. We were unable to  validate foreign ownership regarding the other 11 leases because (1) the  database indicated that two of the buildings are not owned by foreign  companies, (2) the database did not contain ownership information on  many of the buildings with GSA-leased space, and (3) two leases on the  list were no longer in effect.
Based on our independent analysis using the real property database,  foreign entities owned high-security space that GSA is leasing in 20  buildings through 25 leases as of March 2016. Our analysis indicated that  this space was owned by 16 different foreign entities, 7 of which are  based in non-NATO countries. However, the real property database did  not include information on all of the buildings in which GSA leases high- security space. Therefore, the results of our analysis are likely  understated and GSA may be leasing more high-security space than what  we identified in the 25 leases. For example, we also found that a  Japanese parent company ultimately owns a building in Washington,  D.C., that was not in the database but which contains high-security space  leased by DOJ that is not listed in table 1.
According to Real Capital Analytics, its database shows information on  the chain of title, which is the succession of title ownership to real  property from the present owner back to the original owner, when  available. We contacted, or attempted to contact, each company to  confirm that the company owned the property and was based in the  country identified in the database. In some cases, we were unable to  reach the companies to confirm ownership, but reviewed other  information that confirmed ownership such as leasing documentation or  found that the buildings were part of the companies’ portfolios posted on  their websites.
In four cases, when we contacted the parties that were identified in the  database as the owners or their representatives, we were told that the  information was outdated—that they sold the buildings and no longer  owned them—or that the database information was incorrect—that the  buildings were not owned by foreign affiliates. We excluded those cases  from our review.
See table 1 for information on 20 of the 25 leases of high-security space  that we identified as foreign-owned. When we found that the lessors  were incorporated in the United States but their parent companies were  based in foreign countries, we included them as foreign owned. In one  case, because of the complexity of the transaction involving the purchase  of a building containing high-security GSA-leased space, we were unable  to determine in which country the immediate owner of the building was  based. That property is noted in the table.
We found that 26 different agencies and departmental components  occupy high-security leased space in buildings that we identified as  foreign owned, 22 of which occupy space that we identified as owned by  companies based in non-NATO countries (China, Israel, South Korea,  and Japan). For example, we identified eight leases of high-security  space from Chinese companies entered into prior to November 1, 2014.  These leases are for space occupied by the Drug Enforcement  Administration (DEA), Secret Service, Social Security Administration, and  GAO. GSA indicated that SAM did not contain information on lessors that  listed physical or mailing addresses in China.
The leases of space that we identified as being in foreign-owned buildings  are occupied by agencies such as   six FBI field offices,   three DEA field offices, and  two Social Security Administration offices.
Because the tenants include intelligence and law enforcement agencies,  this high-security space is used, among other things, for classified  operations and storage of weapons, law enforcement evidence, and  sensitive data.
Examples of high-security leased space are shown in figure 2.
Of the 25 leases, we found that the amount of space leased ranged from  about 5,600 square feet to more than 800,000 square feet and that  annual rent ranged from about $174,000 to about $24 million in 2016. We  also found that 10 are high-value leases—those with a net annual rent  above a threshold for which GSA is required to submit a prospectus, or  proposal, to the House and Senate authorizing committees for their  review and approval. The threshold for submitting a prospectus was  $2.85 million for fiscal year 2014, the most recent threshold established.  The total amount of space leased was about 3.3 million square feet at an  annual cost of about $97 million.
Nine of the 14 tenant agencies that we contacted indicated they were not  aware that the space they were occupying was in buildings that we  identified as being owned by foreign companies. For example, the  Executive Office for United States Attorneys indicated that it has no  records showing that GSA notified the office that a building it was  occupying was foreign owned. The other five agencies that knew about  occupying foreign-owned space had taken actions to mitigate the risk or  were not concerned.
Besides GSA, other agencies use their own statutory authority to lease  space from foreign companies. For example, the State Department is  leasing space for the U.S. ambassador to the United Nations in the  Waldorf-Astoria Hotel in New York City, which was acquired by a Chinese  company in 2014. We also found that the U.S. Mint, using its own  authority, is leasing its headquarters building in Washington, D.C., from a  Japanese parent company that is the ultimate owner.
subsections: section_title: Potential Risks of Leasing Foreign- Owned Space Include Espionage, Cyber Intrusions, and Money Laundering Concerns Selected Federal Officials and Real Estate Company Representatives Cited Physical and Cyber Security Risks Posed by Foreign Ownership
paragraphs: Several federal officials who assess foreign investments in the United  States and selected real estate company representatives we spoke to told  us that leasing space in foreign-owned buildings could present security  risks such as espionage, unauthorized cyber and physical access to the  facilities, and sabotage. For example, a DHS foreign investment official  said that potential threat actors could coerce owners into collecting  intelligence about the personnel and activities of the facilities when  maintaining the property. The official said this situation could occur by  direct observation or surreptitious placement of devices in sensitive  spaces or on the telecommunications infrastructure of the facility. In  addition, a DHS cybersecurity official said that advanced persistent cyber  threats (adversaries possessing sophisticated levels of expertise and  significant resources to pursue their objectives) tend to come from foreign  sources. In addition, a representative from a real estate company said  that foreign ownership could pose a cyber risk in buildings with data  systems and sensitive information.
Based on our analysis, interviews, and other information, we identified  low, moderate, and high security risk levels associated with leasing space  from foreign owners. At the lower level of risk, foreign entities that  invested through real estate investment trusts (REIT) and other passive  investments may be removed from accessing or managing the facilities.  At the next level, foreign entities that have directly purchased the  buildings may have access and operational control in the event that a lease or mitigation measure (discussed later in this report) does not exist  to restrict such access. At the highest level, foreign entities that  constructed the buildings could provide access to their structure and  design, increasing the risk of nefarious action as demonstrated by the  construction of the U.S. Embassy in Moscow and design-construction  leased space, described earlier.
Conversely, representatives from two real estate companies whom we  interviewed said that it is not a security risk for the government to lease  space in foreign-owned buildings or that the risks could be addressed.  For example, one of the representatives said that access at high-security  facilities is strictly controlled, including access by the owners, and that  passive investors in properties do not have access to the buildings. A  representative from a third real estate company said that it is not a  security risk for the government to lease space in foreign-owned buildings  because that company’s properties are managed by U.S. companies with  no involvement from the passive investors. He said that passive investors  have on rare occasions toured the properties, but they were subject to the  agencies’ security clearance procedures. A representative from a fourth  company said that foreign ownership is irrelevant when capital funds  come from many investors that do not control the buildings. A  representative from a fifth company said that people such as property  managers, asset managers and building engineers, have more direct  access to building systems and data than the owners and that they are  subject to background checks and must be escorted in high-security  buildings. He added that there could be cheaper ways to conduct  nefarious action than by buying a building. Regarding the construction of  new buildings, one company representative noted that construction  contractors are vetted. A representative from a real estate association  said that the federal government leasing space in foreign-owned buildings  is not “in and of itself” a security risk. He said that foreign owners of U.S.  real estate—including in some cases foreign governments—often will  have meaningful, but noncontrolling, interests in that property which may  give the foreign owner a sizable financial interest in the property’s leasing  income and appreciation, but no involvement in the actual management  or operation of the property. However, he added that the security risk may  increase if the federal government is leasing from ownership entities  controlled by companies from countries that are not allies of the United  States.
section_title: Some Tenants Occupying Foreign-Owned Space Raised Security Concerns
paragraphs: Some agencies that are occupying buildings that we identified as owned  by companies based in non-NATO countries raised the following  concerns:
The Secret Service indicated that its counterintelligence branch  determined that foreign ownership of a building it occupies could raise  counterintelligence and security concerns. According to the Secret  Service, the protection of its information, technology, personnel and  space could be in jeopardy if the space were compromised through  any unannounced inspections, emergency repairs to the building or  any component within, the use of foreign nationals to provide any type  of service, and any unescorted access throughout the space by the  facility owner or representatives. Furthermore, the Secret Service  indicated that the integrity and protection against potential  compromise of the agency’s protection and intelligence information,  criminal investigations and personal identifiable information would  require implementing additional countermeasures to mitigate any  threats and protect the agency’s operations as a result of occupying  space in a building that we identified as being foreign owned.
DEA indicated that foreign ownership raises security risks that should  be mitigated. DEA’s primary concern is the possible unauthorized  access to its secure areas and information. According to the agency,  two important mitigation methods are ensuring that independent  locksmiths are utilized to secure the office and that the security  vendor is not affiliated with the owner. DEA also indicated that it would  be useful for GSA to inform the agency about changes in ownership  because this information would help its security assessment.
DOJ, which has three agencies occupying a building that we identified  as being foreign owned, indicated that it would conduct additional  reviews before occupying space leased from a landlord under the  ownership, control, or influence of a country that is not an ally of the  United States or with which the United States has no diplomatic  relations.
DHS’s National Protection and Programs Directorate indicated that it  has contacted GSA to identify any steps that it takes to assess the  potential risk posed by a foreign-owned property and that in the future,  DHS will use this information to assess space that GSA proposes that  it occupy.
By contrast, the Administrative Office of the United States Courts, another  tenant in foreign-owned space, indicated that knowing that the building is  foreign owned would have been immaterial in occupying the space  because, to its knowledge, GSA does not consider whether a company is  foreign when reviewing potential offers and awarding a lease. Similarly,  four other tenant agencies occupying space in buildings that we identified  as being owned by companies based in non-NATO countries—FBI, IRS,  Social Security Administration, and the Treasury Department Inspector  General for Tax Administration—indicated that foreign ownership of those  buildings did not raise security concerns. Tenant agencies such as the  Administrative Office of the United States Courts, the Social Security  Administration, and Department of Veterans Affairs also emphasized that  GSA selects the leased space, not the tenants.
section_title: Owner Access Can Be Restricted through Lease Provisions and Mitigation Agreements
paragraphs: GSA leases of foreign-owned space generally restrict the owners from  physically accessing the space except to maintain or inspect the facilities.  According to GSA, every standard lease contains the same general  restrictions on owner access without regard to the owner’s nationality.  Specifically, the restriction states that “the Lessor may at reasonable  times enter the premises with the approval of the authorized Government  representative in charge.” Of the 11 buildings owned by companies based  in non-NATO countries, the tenant agencies or the owners told us that the  owners or their representatives had entered 8 of them, for example, for  inspection purposes.
If CFIUS has national security concerns about a covered transaction and  does not believe those concerns can reasonably be addressed through  the U.S. Government lease or other existing authorities, it may propose  that the acquiring company enter into a mitigation agreement or impose  conditions.
section_title: GSA Does Not Check the Beneficial Owners of the Buildings It Leases
paragraphs: Another potential risk to the government regarding foreign-owned leased  space is the possibility of entering into leases with hidden beneficial  owners of buildings that are using the investment to launder money. A  2006 FinCEN report found that hidden beneficial owners launder money  through commonly reported entities, such as property management, real  estate investment, realty, and real estate development companies.  Furthermore, we have reported that money laundering and terrorist  financing are crimes that can destabilize national economies and threaten  global security. GSA checks whether potential lessors have sufficient  funds to meet their lease obligations, but is not required to collect  beneficial ownership information and therefore does not know the  beneficial owners of the buildings it leases. However, federal internal  control standards indicate that management should identify, analyze, and  respond to risks related to achieving the defined objectives.
When leasing space, GSA checks the Excluded Parties List System,  which is a list of companies and individuals that are excluded from  receiving federal contacts, and Treasury’s Specially Designated  Nationals and Blocked Persons List, which is a list of individuals and  companies whose assets are blocked and U.S. persons are generally  prohibited from dealing with them. In leasing from foreign companies,  GSA does not consider whether the lessors are “politically exposed  persons,” which the Financial Action Task Force (FATF) defines as  individuals who are or have been entrusted with a prominent function.  According to FATF, many politically exposed persons hold positions that  “can be abused for the purpose of laundering illicit funds or other  predicate offenses such as corruption or bribery.” In 2010, the Senate  examined how politically powerful foreign officials, their relatives, and  close associates—politically exposed persons—have used the services of  U.S. professionals and financial institutions to bring large amounts of  suspect funds into the United States to advance their interests.  Furthermore, in July 2016, DOJ announced the filing of civil forfeiture  complaints seeking the forfeiture and recovery of more than $1 billion in  assets, including real estate in New York and Los Angeles, associated  with an international conspiracy to launder funds misappropriated from a  Malaysian sovereign wealth fund. We found that commercially available  screening software can be used to identify heightened risk individuals and  organizations and mitigate risks associated with illicit funds, money  laundering, fraud, organized crime, sanctions program violations, terrorist  financing, among other risks.
GSA’s lease of space for the FBI field office in Seattle may be an  example of GSA leasing high-security space from a beneficial owner who  is a politically exposed person. Our review found that the FBI field office  in Seattle is ultimately owned by the Taib family of Malaysia through a  series of domestic and foreign companies. Advocacy groups such as  Global Witness allege that the Taib family has profited from corrupt  practices in Malaysia. The lease was executed by Wallyson’s, a  Washington state corporation, which is owned by Sakti International  Corporation, a California corporation. According to a Dun & Bradstreet  report in GSA’s leasing file, Sakti International Corporation is 100 percent  financed by the Taib family of Malaysia. Furthermore, according to a 2008  document in the GSA leasing file, Sakto International, located in Canada,  is the parent company of Sakti International Corporation. The lease was  signed by Rahman Taib—the president, secretary, and chief financial  officer of Wallyson’s—who is also the son of the former chief minister of  Sarawak, Malaysia.
We found no evidence that the family has been indicted or convicted of  wrongdoing that would disqualify them from leasing to the government.  However, Global Witness representatives told us that the government  runs financial and non-financial risks as well as a reputational risk if it  leases from individuals who have been accused of wrongdoing,  regardless of whether they have been indicted or convicted.
GSA and FBI officials said that they are not concerned about the  ownership of the FBI field office in Seattle. According to GSA, “as long as  the lessor performs according to the contract, additional concerns about  ownership would not be raised.” FBI officials told us that the FBI does not  have any concerns about either the physical or cyber security of the  building or the sources of funding used to finance the building. The  officials said that the owners may not enter the building. Our review of the  lease for this building indicated that the government will have paid a total  of $56 million in rent over the 20-year term ending in 2019.
GSA officials said that leasing specialists must review the lists of  excluded parties at least twice—after receiving offers and before awards.  We asked GSA to provide evidence that it checked these lists with regard  to the lease of space for the FBI field office in Seattle. Federal internal  control standards indicate that documentation is a necessary part of an  effective internal control system. However, GSA could not produce  evidence that it had conducted these checks at those times. We did not  find Taib family members on the Excluded Parties List or the Specially  Designated Nationals and Blocked Persons List.
GSA indicated that most lessors establish a separate entity—usually a  limited liability corporation (LLC)—for each building. Private LLCs are not  subject to the same public disclosure requirements as publicly traded  companies. Representatives from a real estate LLC that leases many  buildings to GSA told us that its investment capital comes from foreign  sources that use financial institutions in the United States. Because the  real estate LLC is privately-owned, we found no publicly available  information about its investment sources.
In May 2016, FinCEN issued final rules that would, in part, require  covered financial institutions to identify and verify the beneficial owners of  legal entity customers. According to the rulemaking, covered financial  institutions are not presently required to know the identity of beneficial  owners, “enabling criminal, kleptocrats, and others looking to hide ill- gotten proceeds to access the financial system anonymously.” Covered  financial institutions must comply with the new rules by May 11, 2018.
Also in May 2016, Treasury announced that it sent beneficial ownership  legislation to Congress for consideration that, among other things, would  require companies formed within the United States to file beneficial  ownership information with the Treasury Department, and face penalties  for failure to comply. The legislation would also require the Secretary of  the Treasury to define “beneficial owner” for the purposes of  implementing the proposed legislation. Separately, members of the  House and Senate have independently introduced various pieces of  beneficial ownership legislation. According to the sponsors, law  enforcement efforts to investigate corporations and LLCs suspected of  committing crimes such as money laundering have been impeded by the  lack of available beneficial ownership information.
section_title: Treasury Exempts the Commercial Real Estate Industry from Certain Due Diligence Procedures
paragraphs: In 2002, FinCEN temporarily exempted certain financial institutions,  including persons involved in real estate closings and settlements, from  the requirement to establish an anti-money laundering program that  includes verifying customer identities. The exemption is still in place  and, in 2015, advocacy organizations such as Global Financial Integrity,  Global Witness, and the FACT Coalition urged FinCEN to remove the  exemption. The organizations said that investors can mask the true  ownership of property in the United States when the real estate purchase  is made through anonymous companies, allowing millions of dollars to be  invested in real estate transactions without detection. Global Financial  Integrity, Global Witness, and the FACT Coalition representatives also  told us that it is easy in the United States to create untraceable shell  companies—which have no operations and can be used for illicit  purposes such as laundering money. However, GSA officials said that  they rely on due diligence processes conducted by real estate companies  and banks to check the legitimacy of the funds that are used to finance  the buildings that GSA leases.
Representatives from a real estate company that uses foreign  investments to finance buildings that are leased to GSA told us that they  rely on banks and an independent global firm that provides fiduciary  services to ensure that the sources of funds comply with applicable  regulations. However, banking and real estate associations expressed  different views on which parties are primarily responsible for checking the  sources of funds used for commercial real estate. A representative from  the American Bankers Association said that while it might seem  reasonable for real estate companies to rely on banks (and for GSA to  rely on real estate companies) to check the legitimacy of the funds that  are used to finance real estate projects, banks do not always have  sufficient information about the transaction. He said that when these  transactions are put together, the lender may not have direct contact with  the purchaser or the seller and if the purchaser or a seller is a  corporation, the bank knows the corporation but not necessarily the  details about the corporation, its structure or its management. The  representative added that because the real estate company is dealing  directly with the corporation as its client and has access to the individuals  who can provide that information, the real estate company has a direct  relationship and is in the best position to obtain any detailed information  about the purchaser or seller.
However, a representative from the Real Estate Roundtable, an  association of real estate firms and associations, said that the many  participants in the commercial real estate transactional process such as  mortgage bankers, brokers, and title agents, are unlikely to have any  significant and important information bearing on the possibility of money  laundering activities given their function in commercial real estate  transactions. He said that these participants are generally small  businesses unequipped to deal with significant training on regulations,  policing, audit and record keeping responsibilities. The Real Estate  Roundtable representative also said that anonymity and liquidity—two  characteristics important to money launderers—typically do not exist in  real estate transactions because real estate transactions generally  involve illiquid and visible assets. In addition, a representative from the  National Association of Real Estate Investment Trusts told us there is a  low risk of illegal foreign money being used to finance publicly traded  REITs. He noted that because a publicly traded REIT is financed and  operated in effectively the same manner as any other publicly traded  company it is very unlikely it would be used as a mechanism to launder money. Furthermore, the Real Estate Roundtable representative said that  because real estate is not a highly liquid asset and real estate  transactions generally create a detailed “paper trail” of debt and equity  investors, commercial buildings are not ideally suited to be money  laundering vehicles. However, in its 2006 report on money laundering in  the commercial real estate market, FinCEN stated that although real  estate historically has been a relatively illiquid asset, money launderers  may use real estate both as an investment and vehicle to store laundered  funds.
section_title: GSA’s Leasing Policies and Procedures Do Not Include Determining Foreign Ownership
paragraphs: GSA’s leasing policies and procedures do not distinguish between leasing  from domestic or foreign companies. When leasing space, GSA is  required, among other things, to determine whether the prospective  lessor is a responsible party. As discussed earlier, GSA officials said  that this process includes, among other things, checking whether the  entity has the financial means to fulfill the contract and assessing whether  the building will be operated properly. However, under GSA’s Acquisition  Manual, foreign ownership is not one of the factors that GSA must  consider when deciding whether to contract for a lease. Offerors are  required to disclose certain ownership information that may indicate  whether they are foreign owned.
The Homeland Security Act of 2002 authorizes GSA to protect federal  facilities except those functions delegated to the Department of Homeland  Security. Tenant agencies and FPS also have responsibility for  protecting federal facilities. According to the Interagency Security  Committee (ISC) standard on protecting federal facilities, tenant agencies  and FPS are to conduct risk assessments for facilities with security levels  III, IV, and V at least every 3 years. The standard also states that tenant  agencies are responsible for making final facility security level  determinations, must devise a risk management strategy, and, if possible,  fund appropriate security countermeasures to mitigate the identified risk.  As discussed earlier, GSA’s information on foreign ownership of high- security space was not reliable, and, as a result, tenant agencies lack  information on such foreign ownership even though it can pose risks  involving physical and cyber security and foreign financing. As discussed  below, GSA’s existing procedures for obtaining information provide the  agencies with some information on foreign ownership, but this information  is incomplete. GSA officials said that they do not have the ability or  authority to check foreign ownership beyond certain sources currently  available to them. In addition, although GSA checks whether potential  lessors have sufficient funds to meet their lease obligations, it does not  check the lessors’ source of funds.
As discussed below, various steps in the leasing process may disclose  whether an offeror’s company is foreign owned as well as whether the  company is owned by an immediate or highest level owner. However,  these sources provide incomplete information on foreign ownership and  foreign investment in space leased by GSA. In addition, GSA officials said  that they do not validate the information on foreign ownership that  contractors disclose in SAM.
Lessors are required to self-disclose whether they are foreign owned.  One way that GSA can identify a foreign company during the leasing  process is when the lessor completes the representations and  certifications form, which is part of the lease agreement, as required by  the Federal Acquisition Regulation (FAR). When completing this form,  the lessor is required to certify with respect to whether a taxpayer  identification number is needed if it is a (1) “nonresident alien, foreign  corporation, or foreign partnership that does not have income effectively  connected with the conduct of a trade or business in the United States  and does not have an office or place of business or a fiscal paying agent  in the United States” or (2) “an agency or instrumentality of a foreign  government.”
GSA is required to check whether prospective lessors are barred from  conducting business with the government. GSA’s Leasing Desk Guide  requires GSA to ascertain whether the offeror has been disqualified or  excluded from participating in federal contracts. As previously discussed,  GSA indicated that it checks the Excluded Parties List System and  Treasury’s Specially Designated Nationals and Blocked Persons List. We  did not find any of the owners based in foreign countries listed in table 1  on the Excluded Parties List or the Specially Designated Nationals and  Blocked Persons List.
Companies are required to report information about their identities using  various business codes. Under the FAR, an offeror must register with Dun  & Bradstreet’s Data Universal Numbering System (DUNS), which are  unique identifiers for business, and include the DUNS number when  registering in SAM. Companies are assigned a Commercial and  Government Entity (CAGE) code—an identification number assigned by  the Defense Logistics Agency that is used within the federal  government—to participate in SAM. Each entity (business, individual, or  government agency) must register with SAM to conduct business with the  federal government. Starting on November 1, 2014, the Federal  Acquisition Regulation (FAR) began requiring offerors to provide  additional ownership information through SAM, including, among other  things, the “immediate” and “highest” level ownership of the offeror, and  the CAGE or North Atlantic Treaty Organization CAGE (NCAGE) codes  for these entities. “Immediate owner” means an “entity, other than the  offeror, that has direct control of the offeror.” This definition includes  “ownership or interlocking management, identity of interests among family  members, shared facilities and equipment, and the common use of  employees.” A highest level owner means “the entity that owns or  controls an immediate owner of the offeror, or that owns or controls one  or more entities that control an immediate owner of the offer.” Of the 8  lessors based in non-NATO countries that we identified from leases  entered into prior to November 1, 2014, and thus not required to include  immediate and highest level ownership information, 7 did not self-identify  as foreign owners on their certifications and representations form.
Our review of GSA’s lease inventory found that the business entity names  are frequently building names or street addresses that do not reflect  useful ownership information. FBI officials told us that GSA could contact  the FBI if it had concerns about a particular foreign company, but declined  to state what types of information it could provide to GSA.
CFIUS has a limited role in identifying risks of GSA leasing from foreign  companies. CFIUS officials said that, consistent with the scope of FINSA,  CFIUS could not review GSA leasing from a foreign company unless a  foreign person, as defined in CFIUS’s regulations, acquired control of a  U.S. business that owned the building in which GSA was leasing space.  Additionally, CFIUS could not review a foreign company’s construction of  a building in the United States if the company did not acquire control of a  U.S. business. During 2014 (the most recent available information)  CFIUS conducted 147 reviews of covered transactions.
Because GSA is not required to identify beneficial ownership information  for the space it leases and because GSA is not informing tenant agencies  when the space they are occupying is leased from foreign owners,  tenants may not be aware that they are occupying space that is foreign  owned and may not be addressing any security risks associated with  foreign ownership. Because GSA is not identifying the beneficial owners  of the properties it leases, it cannot check whether those owners raise  any issues that may represent security risks to tenant agencies.
section_title: Conclusions
paragraphs: GSA’s incomplete information and lack of policies and procedures  regarding foreign ownership of high-security leased space may  undermine the security of the tenants’ facilities. When GSA does not  know the beneficial owners of the high-security properties that it is  leasing, it lacks information that should be shared with its tenants for their  facility risk assessments. Moreover, when tenant agencies lack  information about the beneficial owners of their high-security facilities,  they may not correctly evaluate the security risks and, consequently, not  take the most appropriate steps to secure their buildings, leaving the  facilities vulnerable, for example, to cyber intrusions.
Our review found that GSA is leasing a small portion of its high-security  leased space from foreign owners. However, because ownership  information was not available regarding about one-third of the buildings  with high-security leased space, GSA is likely leasing from more foreign  companies than is readily identifiable. Because CFIUS’s authority is  limited to reviewing foreign acquisitions that could result in control of a  U.S. business, which rarely involves GSA-leased space, CFIUS has a  limited role in identifying and mitigating risks of GSA leasing from foreign  companies. As a result, GSA cannot rely on CFIUS to identify and  mitigate these risks. As the leasing agent, GSA is in the best position to  identify the beneficial owners of the high-security space that it leases and  communicate the relevant information to its federal tenants so that they  may adequately assess and mitigate any potential security risks  associated with them.
section_title: Recommendation for Executive Agency Action
paragraphs: We recommend that the Administrator of the General Services  Administration determine whether the beneficial owner of high-security  space that GSA leases is a foreign entity and, if so, share that information  with the tenant agencies so they can adequately assess and mitigate any  security risks.
section_title: Agency Comments
paragraphs: We provided a draft of this report for review and comment to GSA, the  departments of Defense (DOD), Energy (DOE), Homeland Security  (DHS), Justice (DOJ), State, the Treasury, and Veterans Affairs (VA); the  Administrative Office of United States Courts; the Federal Deposit  Insurance Corporation (FDIC); the Office of the Director of National  Intelligence (ODNI); the Securities and Exchange Commission (SEC); the  Social Security Administration, and agencies which determined that the  information about the foreign-owned buildings that they occupy is for  official use only and is not included in this report.
GSA provided written comments, reprinted in appendix I, agreeing with  the report’s recommendation. DOD provided a letter, reprinted in  appendix II, indicating that it had no comments on the report. ODNI  provided a letter, reprinted in appendix III, indicating that ODNI and the  Intelligence Community concur with the recommendation. The Social  Security Administration provided a letter, reprinted in appendix IV,  indicating that the report accurately reflects its activities regarding this  review. DHS, DOJ, the Department of the Treasury, and the Social  Security Administration provided technical comments which we  incorporated as appropriate. The Administrative Office of the United  States Courts, DOE, FDIC, SEC, the State Department, and VA had no  comments.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, the Administrator of the General Services  Administration, the Secretaries of Defense, Energy, Homeland Security,  State, Treasury, and Veterans Affairs; the Attorney General; Director of  the Administrative Office of the United States Courts, Director of National  Intelligence, Chairman of the Federal Deposit Insurance Corporation,  Chair of the Securities and Exchange Commission, Commissioner of the  Social Security Administration, and other interested parties. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix V.
section_title: Appendix I: Comments from the General Services Administration
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: Comments from the Office of the Director of National Intelligence
section_title: Appendix IV: Comments from the Social Security Administration
section_title: Appendix II: Comments from the Department Appendix V: GAO Contact and Staff of Defense Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Keith Cunningham, Assistant  Director; Bob Homan, Analyst-in-Charge; Lisa Shibata; Camilo Flores;  Tonita Gillich; and Michelle Weathers made key contributions to this  report.