Homeland Security: Actions Needed to Improve Security Practices at National Icons and Parks
Released: 2009-09-28T00:00:00

Letter

Background

Interior is responsible for the safety and security of more than 67,000 employees, 280,000 volunteers, 1 million daily visitors, and 500 million acres of public lands that include national icons and parks. After September 11, the Secretary of the Interior took steps to address serious organizational and management problems in the law enforcement and security components of the department. Of particular concern, according to the Interior IG, was the lack of coordination among these components and the absence of a meaningful single point of contact that the Secretary and senior managers could depend upon for reliable information and advice. The Secretary approved a Deputy Assistant Secretary for Law Enforcement and Security in July 2002, and established OLES to oversee the department’s law enforcement and security efforts and ensure their consistent application across Interior’s bureaus and offices. Specific to icon protection, in 2003, Homeland Security Presidential Directive 7 (HSPD-7) designated Interior as the sector-specific agency for the National Monuments and Icons critical infrastructure sector, and Interior selected OLES to carry out sector responsibilities. To fulfill its duties, OLES officials developed a national monuments and icons sector-specific plan in which they defined national icons as: (1) monuments, physical structures, or objects; (2) recognized both nationally and internationally as representing the nation’s heritage, traditions, and/or values or are recognized for their national, cultural, religious, historical, or political significance; and (3) serve the primary purpose of memorializing or representing significant aspects of our nation’s heritage, traditions, or values and serve as points of interest for visitors and educational activities. In accordance with its assigned duties, OLES officials also developed a uniform risk assessment and ranking methodology to quantify risk, identify needed security enhancements, and measure risk-reduction benefits at icons. OLES officials used this methodology to assess risks at the icons during 2004 and 2006. OLES has also issued sector annual reports and established a sector government coordinating council.

The Park Service’s mission is the unimpaired preservation of the natural and cultural resources and values of the national park system. The Park Service is responsible for managing the national icons and the national park system. In 2008, the Park Service welcomed almost 275 million visitors to its nearly 400 national park units throughout the United States, American Samoa, Guam, Puerto Rico, and the Virgin Islands. Within the Visitor and Resource Protection division of the Park Service, the Law Enforcement, Security, and Emergency Services branch provides policy formulation, oversight, support services, guidance, and leadership to assist park managers and law enforcement staff in accomplishing the Park Service’s visitor protection goals and objectives. This branch is led by a chief and has one position dedicated to security and intelligence management. Park superintendents and rangers manage and provide security and law enforcement services at icons and parks throughout the United States in conjunction with their other duties. These other duties include the management of public use, dissemination of scientific and historical information, and protection and management of natural and cultural resources. The Park Police, which is a Park Service component, provides law enforcement and security services for national icons and parks in Washington, D.C.; New York City; and San Francisco. The Park Police has also staffed law enforcement specialists in four of seven Park Service regions including the National Capital, Northeast, Intermountain, and Pacific West regions.

We have identified a set of six key protection practices from the collective practices of federal agencies to provide a framework for guiding agencies’ protection efforts and addressing challenges. The following are the key practices we used for this review: Allocation of resources using risk management: Identify threats, assess vulnerabilities, and determine critical assets to protect; use information on these and other elements to develop countermeasures; and prioritize the allocation of resources as conditions change.

Leveraging of technology: Select technologies to enhance asset security through methods like access control, detection, and surveillance systems. This involves not only using technology, but ensuring that there are positive returns on investment in the form of reduced vulnerabilities.

Information sharing and coordination: Establish means of coordinating and sharing security and threat information internally, within large organizations, and externally, with other government entities and the private sector.

Performance measurement and testing: Use metrics, such as implementation timelines, and active testing, such as unannounced on-site assessments, to ensure accountability for achieving program goals and improving security at facilities.

Strategic management of human capital: Manage human capital to maximize government performance and assure accountability in asset protection through, for example, recruitment of skilled staff, training, and retention.

We have used the key practices to evaluate the efforts of the Smithsonian to protect its assets, DHS to protect its facilities, and federal agencies to protect icons and facilities on the National Mall. For example, in 2007, we found that while the Smithsonian follows key practices to protect its assets, it faces challenges related to ensuring that museum and facility directors are aware of information on security and funding constraints. Similarly, in 2005, we found that federal agencies on the National Mall— the Park Service, Smithsonian, National Gallery of Art, Department of Agriculture, and U.S. Botanic Garden—were using five of the six key practices to implement security enhancements. Also, in 2007, we reported that DHS had taken actions intended to improve the security of its facilities, but its efforts fell short in certain key areas, such as DHS components not fully implementing risk management.

Moreover, the ISC—a body that addresses the quality and effectiveness of security requirements for federal facilities through developing and evaluating security standards for federal facilities—is using our key protection practices as key management practices to guide its priorities and work activities. For example, ISC established subcommittees for technology best practices and training, and working groups in the areas of performance measures and strategic human capital management. ISC also issued performance measurement guidance in 2009.

The Park Service Does Not Manage Risk Servicewide or Ensure the Best Return on Security Technology Investments

While the Park Service, with the assistance of OLES, has assessed risks at the icons and southwest border parks, it has not adopted a servicewide approach to risk management, including policies, guidance, and tools to support risk assessments at the remaining parks. Furthermore, although icon and park officials have acquired a variety of technologies to enhance security, they do not have guidance to evaluate the cost-effectiveness of proposed or actual countermeasures.

The Park Service Has Focused Risk Management Efforts on Icons and Border Parks but Vulnerabilities Remain

We have reported that most risk management approaches generally involve identifying the assets that are most critical to protect in terms of mission and significance, identifying potential threats, assessing vulnerabilities, and evaluating mitigation alternatives for their likely effect on risk and their cost. The Park Service and OLES generally employed such an approach in identifying five icons as critical assets to protect, assessing risks, and implementing countermeasures. Specifically, OLES conducted its first round of icon risk assessments during 2004, through which it identified vulnerabilities that the icons shared. Officials at the icons worked on implementing the assessments’ recommendations; therefore OLES’s 2006 icon risk assessments and 2007 compliance reviews noted significant security improvements, including new surveillance and monitoring equipment, some barriers installed to protect against vehicle explosions, and enhanced visitor screening stations and procedures.

In addition to prioritizing icon security, during 2008 the Secretary of the Interior directed the Park Service to focus on border park security through its “Safe Borderlands” initiative, and as a result, the Park Service has also taken steps to balance security and public access at southwest border parks. About 41 percent of the land along the U.S. southwest border is under the control and custody of Interior’s land management bureaus, including five parks that are under the Park Service. These border parks face security challenges related to drug smuggling and other unlawful activities in the area, which have also caused significant environmental damage. The Safe Borderlands initiative aims to strengthen Interior’s— including the Park Service’s—law enforcement capabilities, improve its radio communications, and lessen the environmental impact of illegal activities. The Park Service and other Interior bureaus have assessed risks and increased staffing along the southwest border, and have installed security features, such as vehicle barricades and sensors at certain border locations, in an effort to prevent illegal aliens and drug smugglers from entering. According to Park Service officials from the Intermountain Region, all border parks in their region have ground sensors to detect illegal traffic and some have alarm systems.

Despite the significant improvements made in icon security, we noted some cases in which recommended security countermeasures were not implemented and vulnerabilities remain. Park officials at the Statue of Liberty told us that the icon security plan had not been updated since its creation in 2002; however, later in our review, Park Police officials told us they updated this plan during 2008. Park officials at the Gateway Arch have also made notable security improvements, such as moving the dispatch center away from the arch. However, vulnerabilities still exist at the park, and security breaches have occurred. Officials from both icons told us that, while they identify and prioritize security needs, security projects compete with other operational needs, and these officials must prioritize and balance competing interests as best they can.

The Park Service Lacks a Systematic Approach for Allocating Resources Using Risk Management

Park Service officials at the national, regional, icon, and park levels told us that security awareness has increased throughout the organization, largely because of Interior’s initiative to assess security risks at the icons, and the resources the Park Service has allocated to address these concerns; yet the Park Service has not formally applied risk management principles for the rest of its national parks inventory. We have reported that allocating resources using risk management is a systematic and analytical process to consider the likelihood that a threat will endanger an asset—structure, individual, or function—and identify, evaluate, select, and implement actions that reduce the risk or mitigate the consequences of an event. However, the Park Service does not require that other parks undergo risk assessments and therefore there has been no comprehensive servicewide assessment, prioritization, and mitigation of vulnerabilities. Instead, Park Service officials use their discretion to request risk assessments from the Park Service or another entity, and as a result, risk assessments can vary in their scope and methodology from park to park. Even if Park Service officials obtain risk assessments, they may not use them to guide park operations, or they may find it challenging to interpret and implement recommended actions because they are unfamiliar with the risk assessment process. Of the three parks we reviewed, only the African Burial Ground had received a comprehensive risk assessment because it is in a high-security federal facility that is under the control and custody of the General Services Administration (GSA) and is protected by the Federal Protective Service (FPS). The risk assessments of the other two parks were limited in scope.

The African Burial Ground is adjacent to a high security multitenant federal building in New York City and the visitor center is inside the building. Therefore, the Park Service authorized FPS to provide law enforcement and security services—such as conducting security assessments and recommending countermeasures through a memorandum of understanding. Furthermore, because the Park Service is a tenant in a GSA building, it receives certain protection services from GSA. For example, FPS, GSA, and the Park Service collaborated to identify perimeter fencing for GSA to install around the monument that maintained park aesthetics and provided protection based on FPS and GSA security standards (see fig. 1). Also, according to the Northeast regional chief ranger, the former regional physical security specialist completed a risk assessment of the park in 2006. In accordance with the memorandum, FPS will continue to address security vulnerabilities at the African Burial Ground, such as visitor screening, in collaboration with the park.

In 2008, the Gettysburg Foundation—a private, nonprofit educational organization working with the Park Service at Gettysburg—hired a security consulting firm to complete a risk assessment specifically for the new visitor center and museum that it constructed on its land within the park. The assessment included recommendations for protecting artifacts, infrastructure, visitors, and staff, and the Gettysburg Foundation implemented some of the countermeasures. For example, the Gettysburg Foundation purchased surveillance cameras, and Park Service rangers monitor them. The Park Service is responsible for protecting visitors and providing a safe environment for visitors and staff. Moreover, the risk assessment was only for the visitor center and museum, not the park as a whole. According to the chief ranger, the park faces security challenges from the numerous roads leading into it and its open borders.

In 2006, Park Service officials at the Grand Canyon—with more than 4 million visitors annually—requested a risk assessment through their participation in the Arizona Joint Terrorism Task Force (JTTF). The Arizona Counter Terrorism Information Center fulfilled the request and identified points of vulnerability and potential security improvements at the park. The center’s assessment cited concerns with the location of the dispatch center and wiring system, and Park Service officials are taking steps to mitigate these risks, such as moving the dispatch center to a more secure location and upgrading the wiring. Additionally, Park Service officials enhanced security for the fee collection booths by having surveillance cameras installed. However, even though the assessment contained actionable items, the chief ranger told us it lacked details that would have made it more helpful. The chief ranger considered assigning a Park Service staff person to the center to learn more about the risk assessment methodology, but the time commitment was prohibitive.

In addition to lacking a systematic approach for assessing risk throughout its inventory, the Park Service lacks guidance and tools that officials at icons and parks can use to develop risk management strategies. The Park Service’s 40-chapter law enforcement manual, which was updated in 2008, focuses primarily on law enforcement policies and responsibilities. One chapter on physical security broadly outlines the duties of the physical security coordinator and delineates closed-circuit television policy, but does not include other guidance such as risk assessment procedures and how to use technology to enhance security. Park Service officials we spoke with had mixed views on the manual. Officials from three of the four regions we spoke with said the manual lacks comprehensive physical security information and guidance, while officials from the fourth region considered the manual to be useful. While officials at the Gateway Arch and Gettysburg told us that they used the manual and found it useful for physical security, officials at the Statue of Liberty and the Grand Canyon said they did not use the manual to guide park security operations. The superintendent at the African Burial Ground told us that other Park Service staff advising the park refer to the manual. Park Police officials told us that they do not use the Park Service’s law enforcement manual. Instead, they rely on the Park Police law enforcement manual for security guidance at locations where the Park Police are responsible for physical security, such as the Statue of Liberty.

The Park Service also relies on Interior’s physical security manual which sets forth the policies designed to safeguard Interior personnel and facilities, including buildings, grounds, and other property. OLES developed the manual using the Department of Justice’s facility security level standards and minimum security countermeasure standards. OLES officials told us that they adopted ISC’s updated facility security level standards, and notified bureau security managers of changes. The Park Service’s Acting Chief of the Law Enforcement, Security, and Emergency Services division and the Security and Intelligence Program Manager told us that they are developing a process for updating icons’ and parks’ individual facility security levels based on the revised standards. However, the department-level physical security manual is focused on general facility protection and officials from the regions, icons, and parks told us it would be more useful if it were tailored to park-specific security issues. For example, officials from two of the regions we spoke with found the manual unhelpful, though officials from the other two regions considered the manual the main driver for security policy. Park Service officials at the icons and parks we spoke with had mixed reviews as well. For example, officials at the Gateway Arch and Gettysburg told us that they used the manual and found it useful—much as they did the Park Service’s law enforcement manual—while officials at the Statue of Liberty and the Grand Canyon said they did not use the manual to guide park security operations.

While officials at icons and parks are required to develop and implement physical security plans and conduct physical security surveys, there is no standardized approach, tools, or guidance for carrying out these responsibilities. In the absence of a standardized approach, some Park Service officials from the regions are developing their own risk assessment tools and guidance for parks to use. Although officials from the regions are taking actions that could help parks allocate resources using risk management in accordance with the key practice, these initiatives are being developed independently without a servicewide strategy.

The Intermountain regional office has provided parks with a physical security plan template and workbook with guidance on how to assess risk and identify appropriate countermeasures.

The Midwest regional office is updating a small parks assessment program that it originally created during 2002 by developing a physical security assessment checklist for Park Service rangers to identify deficiencies at parks.

The Northeast regional office plans to create a team made up of rangers and cultural staff that they can send to parks to work with staff to assess security and develop strategies to mitigate vulnerabilities.

At the national level, the Park Service recognizes that parks should have tools available to help them assess risks and that physical security plans and assessments should be standardized. Therefore, the Park Service is developing a physical security handbook to standardize physical assessment processes servicewide. Park Service officials are using a U.S. Geological Survey physical security handbook and Interior’s physical security manual to develop the Park Service’s physical security handbook. The Park Service is also developing a small park assessment program based on the Midwest Region’s program, which it intends to test in one region before implementing it servicewide. However, the Park Service has not considered the other regions’ approaches and is therefore missing an opportunity to leverage best practices and lessons learned, and create buy- in for a new security program. For example, the Acting Chief of the Law Enforcement, Security, and Emergency Services division and the Security and Intelligence Program Manager were unfamiliar with the Intermountain Region’s physical security template and workbook, explaining that officials at each regional office take their own approach to physical security.

Lacking a systematic approach for assessing risk throughout the Park Service’s inventory of icons and parks has negative effects. First and foremost, the Park Service lacks assurance that decisions about security are based on an assessment of potential threats and countermeasures. Although highly visible icons are the most plausible terrorist targets, it is not unreasonable to presume that parks with high visitor volumes or other national parks, monuments, memorials, and facilities that have symbolic value may also be targets. Second, risk management practices provide the foundation for a comprehensive protection program. Hence, efforts in the other key practice areas—leveraging technology, information sharing and coordination, performance measurement and testing, and human capital management—are diminished if they are not part of a risk management approach which can be the vehicle for using these practices. Lastly, as previously discussed, individual efforts by officials at regions, icons, and parks to develop risk management tools and security approaches in the absence of overarching guidance are not conducive to sharing lessons learned and leveraging efficiencies.

The Park Service Does Not Have Guidance or Standards That Would Assist Icons and Parks in Leveraging Technology

Officials at icons and parks use a variety of technologies and other countermeasures—such as video and surveillance monitoring equipment, visitor screening equipment, vehicle barriers, and door locks—to enhance security operations (see table 1). We have reported that by efficiently using technology to supplement and reinforce other security measures, agencies can more effectively address vulnerabilities identified through the risk management process with appropriate countermeasures.

Additionally, officials at icons we reviewed are partnering with other agencies to test and obtain security technologies. By pooling resources and sharing equipment, officials at icons are leveraging expertise and cost- effectively enhancing their security. As we have reported, technology implementation costs can be high, and the type of technology used should be carefully analyzed to ensure its effectiveness and efficiency. For example, at the Statue of Liberty, the U.S. Air Force used the park as a testing ground for emerging technologies, and the arrangement allowed the Park Service to keep the equipment. For example, according to Park Service officials, the U.S. Air Force has tested wireless cameras, weather stations, and chemical, radiological, biological, nuclear, and explosives detection systems on Liberty Island. Park Service and Park Police officials told us that the weather stations are particularly useful to them since the Federal Aviation Administration (FAA) requires weather data for fining aircraft that violate airspace rules near the Statue of Liberty. According to the Park Police, this partnership has been extended into 2010.

Despite icon and park officials’ use of various technologies and other countermeasures to enhance security, the Park Service has not developed guidance on how to evaluate the cost-effectiveness of proposed or actual security investments. We have recognized that having an approach that allows for cost-effectively leveraging technology to supplement and reinforce other measures would represent an advanced security approach in this area. Without such guidance, icon and park officials rely on other methods to identify systems and equipment that best suit their needs. This, however, is an inefficient way to enhance security, particularly in light of icon and park officials’ competing resource demands and regular developments in technology that necessitate upgrades. For example, officials from two Park Service regions told us that parks contact them for assistance in identifying security equipment. Officials at the icons we reviewed cited instances of using a trial and error approach to identify cost-effective and suitable technologies. For example, officials at both the Statue of Liberty and the Gateway Arch use magnetometers and X-ray machines to screen visitors and their belongings. After several years of purchasing security equipment, Park Police officials at the Statue of Liberty have realized that they can acquire new and more effective space- saving visitor screening equipment faster through leasing agreements. Park Police officials told us that they intend to lease equipment in the future to stay current with emerging technologies and ensure equipment is maintained. Moreover, in its 2007 compliance review, OLES recommended that park officials lease equipment because such an approach would allow for quicker and less costly upgrades as new technology is developed. In contrast, Park Service officials at the Gateway Arch plan to continue purchasing this equipment. Officials at both icons have made these decisions based on preference without formal cost-benefit analysis. Officials from the Midwest Regional Office, Statue of Liberty, and Gateway Arch suggested that the Park Service could better assist icon and park officials in making informed decisions about security technologies and other countermeasures.

The Park Service Lacks a Servicewide Approach to Sharing Information Internally and Measuring Performance

The Park Service has information sharing and coordination arrangements with external organizations at the national, regional, icon, and park levels, but lacks comparable arrangements for internal security communications that would allow icon and park officials to share information with one another on common security problems and solutions. In addition, officials at the regions, icons, and parks have discretion to implement security performance measures and testing, but the Park Service lacks a servicewide approach for measuring and testing the results of its security efforts. As a result, little consolidated performance information is available for icon and park officials to use in managing their day-to-day activities or for Park Service management to use in managing security efforts throughout the organization.

The Park Service Shares Information and Coordinates with External Organizations, but Internal Coordination Is Limited

At the national, regional, icon, and park levels, the Park Service has made progress in sharing information and coordinating with other law enforcement, security, and emergency management entities. We have reported that information sharing and coordination among organizations is crucial to producing comprehensive and practical approaches and solutions to addressing terrorist threats directed at federal assets. By having a process in place to obtain and share information on potential threats to federal assets, agencies can better understand the risks they face and more effectively determine what preventive measures should be implemented. At the national level, the Park Service’s Security and Intelligence Program Manager analyzes intelligence from various sources including the Federal Bureau of Investigation (FBI), DHS, and Interior, and disseminates this information to officials at regions, icons, and parks. This manager also attends department-level quarterly meetings of Interior’s Security Advisory Council. According to OLES officials, meeting attendees are encouraged to disseminate information discussed at the meetings to pertinent staff within their respective bureaus and offices.

By collaborating with area law enforcement, security, and emergency management entities, officials at regions, icons, and parks receive threat information and leverage security expertise (see table 2). For example, officials at the Gateway Arch said they are collaborating with area federal agencies such as TSA, the Federal Air Marshal Service, and FBI to form a federal screeners working group to share best practices and learn about new technologies.

While collaboration with partner agencies has expanded, the Park Service has not fully leveraged information sharing and coordination mechanisms that could strengthen the ability of officials at regions, icons, and parks to share threat information and identify common security problems and solutions. We have reported that sharing information on threats and incidents that others have experienced can help an organization identify trends better, understand the risks it faces, and determine what countermeasures it should implement. Specifically, an information sharing practice that we have found to be an important success factor in protecting critical infrastructure is holding regularly scheduled meetings during which participants can share security management practices, discuss emerging technologies, and create committees to perform specific tasks such as policy setting. However, the Park Service’s use of regularly scheduled security meetings is limited, and security discussions typically occur on an as-needed basis. The Park Service’s Law Enforcement, Security, and Emergency Services branch holds a monthly conference call with regional chief rangers, which covers a variety of topics and is not solely focused on security. Regional officials we spoke with said they meet with icon and park officials to discuss security issues on an as-needed basis. Icon and park officials can contact Park Service regional law enforcement or even the Park Service’s Intelligence and Security Program Manager for security assistance as needed.

Icon and park officials could access needed information anytime through a Park Service security Web portal, but this tool does not exist servicewide and is instead under development. We have reported that secure Web portals are another important success factor in protecting critical infrastructure and can ensure effective and timely communication among an organization’s members. Web portals can be used to (1) disseminate all types of information, including alerts, advisories, reports, and other analysis; (2) provide methods for members to ask each other about particular incidents, vulnerabilities, or potential solutions; and (3) share sensitive information. For example, GSA’s security division is developing a Web portal to track incidents, share threat information, post security policies and other related documents, and enable virtual security discussions. The Park Service recognizes a need to improve its use of technology to disseminate security information through mechanisms such as a Web site and Web conferencing, thereby enhancing its application of the information sharing and coordination key practice. However, the Park Service’s security Web portal is still under development without a timetable for completion. According to OLES officials, Interior’s Office of Emergency Management maintains a secure Web site known as SAFETALK, where sensitive information and policies can be exchanged and stored. However, only authorized individuals are allowed to access the portal, and over the course of our review, no Park Service or Park Police officials we spoke to at the national, regional, icon, or park levels cited this Web site as a primary security information source. Without its own Web portal, the Park Service is limited in its ability to disseminate key icon and park-specific security information and guidance to icons and parks efficiently and raise security awareness overall.

In the absence of a servicewide secure Web portal, some Park Service regional offices have developed law enforcement and security Web sites, but the functionality, content, and usage of these sites vary from region to region. For example, while officials from the Intermountain regional office said that they regularly update their Web site with security resources, officials from the Midwest and Pacific West regions said their law enforcement and security Web sites were used infrequently and not to their fullest extent. The Midwest regional chief ranger told us that officials from the region’s icons and parks make limited use of the regional Web site, instead preferring to contact someone in the regional office for assistance or to obtain policy documents. Officials from the Midwest and Pacific West regions acknowledged that more could be done to enhance the content of their Web sites and promote greater usage. For example, the Pacific West regional chief ranger cited the inability of parks to communicate with one another as a limitation on the usefulness of the regional Web site as a tool for protecting visitors and resources. The Web site offers one-way communication from the region to the field, but the region is trying to increase the site’s functionality and usage by adding discussion threads and message boards, and displaying successful park security strategies and plans. Also, the Northeast regional chief ranger told us the office is considering creating a Web site to post security-related lessons learned and security assessment templates.

The Park Service Lacks a Servicewide Approach for Routine Performance Measurement and Testing

The Park Service—at the national level—has no standardized performance measures, evaluation mechanisms, or a testing program for security servicewide. We have reported that successful performance measures should (1) be linked to an agency’s mission and goals; (2) be clearly stated; (3) have quantifiable targets or other measurable values; (4) be reasonably free of significant bias or manipulation that would distort the accurate assessment of performance; (5) provide a reliable way to assess progress; (6) sufficiently cover a program’s core activities; (7) have limited overlap with other measures; (8) have balance, or not emphasize one or two priorities at the expense of others; and (9) address governmentwide priorities. Linking goals to a security program can be used to hold agencies and program offices accountable for achieving those goals. Furthermore, we reported that such alignment increases the usefulness of performance information to decision makers.

Although the Park Service requires icon and park officials to report security incidents, it has no centralized reporting and analysis mechanism, thus these Park Service units have created their own incident-tracking tools. The Park Service began developing an incident reporting and analysis tool in 2003, but Interior decided to transfer the project to OLES and leverage it for the whole department. Interior’s intent is that all bureaus—including the Park Service—will use the Incident Management Analysis and Reporting System for a variety of security performance measurement and management activities, such as reporting incidents, identifying training and resource needs, justifying resource requests and expenditures, measuring program performance, and tracking training. These functions coincide with some of the uses and results of performance measurement that we have recognized, such as assessing the change in the total number of security incidents to evaluate program effectiveness and inform the overall risk management approach, as shown in figure 2. However, Interior expects that this tool will not be available until 2011 or 2012, therefore, until the new system is implemented, the Park Service will continue to be limited in its ability to identify common threats and incidents—information which it could use to evaluate risk management strategies and countermeasures, identify problems, and develop solutions.

Regional officials may perform two to three park law enforcement operational evaluations annually by selecting parks for evaluation or responding to a park’s request for an evaluation. These assessments have a small security component, but are not security evaluations. For example, the Midwest regional chief ranger examines the security of park fee collections and the types of locks on windows and doors of park facilities, according to this official. Officials from some of the icons and parks we reviewed recognized a need for standardized performance measures and testing. For example, Park Police officials at the Statue of Liberty told us they would like a standardized testing and evaluation program for security technologies, instead of solely relying on informal testing efforts such as the Park Police’s collaboration with TSA to test visitor screening equipment. Similarly, Park Service officials from the Gateway Arch expressed an interest in coordinated reviews of the park’s security that would incorporate markers for achievement. Because performance is measured and tested occasionally and inconsistently, officials from icons and parks have limited opportunities for sharing lessons learned or using performance data to manage security from a broader perspective.

We have reported that performance measurement can help achieve broad program goals and improve security at the individual asset level. Without effective performance measurement data, decision makers may have insufficient information to evaluate whether their investments have improved security or reduced vulnerabilities to threats such as terrorism or crime. We have also reported that active testing, using methods such as on-site security assessments, can provide data on the effectiveness of efforts to reduce vulnerabilities. Because the Park Service’s performance management and testing capability is limited, the agency has little information on the status and performance of security activities at the icons and parks it can use to manage day-to-day activities or that Park Service management can use to strategize security efforts throughout the organization. Absent a formal performance measurement system and testing program, officials at icons and parks individually identify security program components to test, such as focusing on equipment and procedural knowledge. We have reported that testing methods include conducting inspections to ensure that adequate levels of protection are employed, testing the effectiveness of security measures such as structural enhancements and physical barriers, and assessing preparedness through training exercises and drills. We found some examples of tests, exercises, and drills that park officials use to assess security performance at icons and parks (see table 3). For example, officials at the Grand Canyon said that they analyze law enforcement and security incidents to shape patrol strategies, and officials at the Statue of Liberty told us they hold emergency exercises with the New York Police Department and FBI.

Human Capital Management Lacks a Security Focus

The Park Service assigns security duties to selected regional staff and requires that icon and park superintendents designate physical security coordinators, but it does not require these staff to have physical security experience or expertise, and it does not provide them with specialized security training. As a result, there is little assurance that staff are equipped to effectively identify and mitigate risks at icons and parks.

Security Roles Are Not Well Defined and Training Is Limited

The Park Service has security staff at the national, regional, icon, and park levels that have a variety of security and other duties. We have reported that the strategic management of human capital is a key practice that can maximize the government’s performance and ensure the accountability of its security-related efforts. At the national level, the Park Service has established a Security and Intelligence Program Manager position within its Law Enforcement, Security, and Emergency Services division. This position was created in 2003, in response to a 2002 Interior IG recommendation that Interior bureaus install full-time security managers. We have also recognized the importance of having a chief security officer position and the security industry maintains that such a position is essential in organizations with large numbers of mission-critical assets. Moreover, a security trade organization—ASIS International—has developed chief security officer guidance for organizations to use in developing a security leadership position that would establish a comprehensive, integrated security risk strategy.

The Acting Chief of the Law Enforcement, Security, and Emergency Services division and the Security and Intelligence Program Manager told us that the Park Service has structured the manager position to disseminate and coordinate information among Park Service units, instead of establishing a managerial position that oversees and directs security activities at regions, icons, and parks. The Security and Intelligence Program Manager performs a variety of duties, such as liaising with DHS to improve security within the southwest border parks, coordinating with OLES to develop semiannual security workshops, conducting risk assessments when parks request them, and gathering, analyzing, and disseminating intelligence information. This official also oversees some of the national initiatives we have previously described, such as the small parks assessment program and the security Web portal. According to the Security and Intelligence Program Manager, as the Park Service has become more aware of this resource, the manager’s activities have increased, especially in the area of physical security.

At the regional level, security responsibilities are assigned to law enforcement staff that also have other duties in the areas of law enforcement and emergency management. Of the four regional offices we reviewed, only the Northeast Regional Office, had a full-time position dedicated to security. From 2002 to 2007, the regional office employed a physical security and intelligence specialist who performed a variety of activities such as conducting risk assessments, establishing technology- sharing relationships with other federal agencies, and analyzing and disseminating intelligence throughout the agency. This position was vacated in 2007, but the regional chief ranger is trying to staff this position again and is revising the position description to focus on physical security. Park Police law enforcement specialists are staffed to the National Capital, Northeast, Intermountain, and Pacific West regional offices and can provide security assistance. Regional Park Service and Park Police staff who have security responsibilities are available to help icons and parks that request their services. These staff may conduct risk assessments or help identify security technologies or other countermeasures, as shown in table 4.

The Park Service requires icon and park superintendents to designate physical security coordinators and expects them to develop and implement park physical security plans and conduct physical security surveys of all structures. Park Service officials told us that, typically, physical security coordinators are park rangers or maintenance managers, who have other duties and responsibilities in addition to security. Moreover, because of the small size of some parks, one person may serve as the physical security coordinator for several parks. For example, the Intermountain Regional Chief Ranger told us that the region has 41 physical security coordinators positioned at about 56 of its 78 parks. We found that physical security coordinators perform a variety of duties, such as overseeing dispatch center operations and reviewing video surveillance images, as shown in table 5. Additionally, Park Service law enforcement rangers and Park Police staff at icons and parks have some security responsibilities in addition to law enforcement duties.

Despite the range of security duties assigned to regional staff, physical security coordinators, law enforcement rangers, and Park Police staff, the Park Service does not provide them with specialized training. Moreover, senior Park Service officials told us that they do not have an inventory of all the physical security coordinators servicewide, and they do not track their duties. We have noted that the effectiveness of a risk management approach depends on the involvement of experienced and professional security personnel and that the chances of omitting major steps in the risk management process increase if personnel are not well trained in applying risk management. Without training for security staff, or evaluations of their security activities, there is little assurance that risks are identified and mitigated and that staff are held accountable for results.

Though the Park Service lacks a physical security training program, it has partnered with OLES to organize security workshops at icons and other critical assets such as the Hoover Dam (see table 6). Park Service and Park Police staff are invited to attend, but attendance is contingent upon time and resource availability. For example, staff from the icons we reviewed and the regions we interviewed had attended some of these workshops, but no staff from the African Burial Ground, Gettysburg, or the Grand Canyon had attended. Officials at regions, icons, and parks may also develop security training internally or in collaboration with external agencies. We have reported that (1) training exercises are useful in assessing preparedness,(2) effective security entails having well-trained staff that follow and enforce policies and procedures, and (3) good training and practice are essential to successfully implementing policies by ensuring that personnel exercise good judgment in following security procedures.

Additionally, Park Service rangers can try to enroll in two physical security courses that are offered at the Federal Law Enforcement Training Center (FLETC)—the physical security training program and the critical infrastructure protection training program. However, according to Park Service officials, space in the courses is limited—the Park Service receives one or two slots per class—the courses are offered on a limited basis, training and travel are subject to resource constraints, and the training is not specific to icons and parks. For example, the physical security specialist at the Gateway Arch tried to enroll in the physical security course for more than 18 months before gaining admission and completing the course in 2008. According to Park Service officials, this specialist may also be able to attend the critical infrastructure training. No park staff from the Statue of Liberty have completed the physical security course since 2001. Moreover, Park Service officials told us that no staff from the African Burial Ground, Gettysburg, or Grand Canyon have completed either of the two FLETC training courses. The Grand Canyon chief ranger tried to enroll the physical security coordinator in the physical security training course, but the application for enrollment was not accepted; as a result, the park lacks staff with experience and formal training in physical security.

While various security training opportunities arise throughout the Park Service, training is inconsistent and lacks cohesion, and there is little assurance that Park Service employees have the knowledge, skills, and awareness needed to contribute to overall park security. With limited security expertise, the Park Service will face challenges in implementing the other key practices. The lack of physical security expertise affects icon and park officials’ ability to develop strategies for identifying their security vulnerabilities and determining how to mitigate them effectively and efficiently with limited resources. Such strategies would ensure that the Park Service has the expertise and resources at the national and regional levels to oversee the implementation of security advancements and practices. Moreover, physical security expertise allows icon and park officials to determine what countermeasures fit their specific needs and how well these countermeasures enhance their security performance. Finally, because all icon and park staff have a role in security, increasing overall security awareness enhances the security of the park.

Human Capital Challenges Are a Particular Concern at Icons

We noted earlier that officials at icons have made improvements in security since 2001; however, the Interior IG and OLES have concerns about icon security that are related to human capital issues, including security expertise and the management of security operations. We have reported that it is widely recognized that there is a need for competent professionals who can effectively manage complex security programs that are designed to reduce threats to people and assets. Clearly defining roles and responsibilities and ensuring that security personnel are adequately trained are central aspects of this key practice. In its 2008 assessment of the Park Police, the IG recommended that the Park Service hire a qualified senior-level certified security professional to oversee Park Service security operations at all icons, including those that are mana by the Park Police, but the Park Service does not believe such action is necessary. Senior Park Service officials told us that the agency works . closely with the Park Police, especially in areas with shared responsibilityHowever, the Park Service relies on its Security and Intelligence Program Manager to oversee icon security for icons that do not have a Park Police nd presence—the Gateway Arch, Independence National Historic Park, a Mount Rushmore National Memorial. The Park Service relies on the Park Police for security program management at the national mall icons and the Statue of Liberty. As a result, the Park Service has no comprehensive program with centralized senior-level oversight of icon security. T inefficient approach, since the five icons—while distinct—have a need to manage similar issues including guard services, surveillance and screening equipment, vehicle and pedestrian barriers, access to intelligence information, staff trained in security awareness, and security performance measurement and testing procedures. his is an Moreover, until recently, the Park Service Security and Intelligence Program Manager lacked specialized physical security expertise. Trained as a law enforcement special agent, this official was not certified in physical security until 2008. According to OLES officials, the Park Service security manager meets the minimum security training requirements for senior-level security managers that OLES established in 2009. The Interior IG also recognized that this manager has been through extensive physical security training. Although the Park Police created an Homeland Security Division in October 2008 and established a security manager position in accordance with the IG’s 2002 recommendation, the IG reported in 2009 that the appointee to this position—a Deputy Chief—had no background in physical security and had only been through a basic 2 week critical infrastructure protection course at FLETC. According to the Park Police, the Deputy Chief is qualified for the position having (1) attended a 2 week DHS program on critical infrastructure and key resource protection in August 2008, (2) worked on icon protection issues for 4 years, (3) designed security upgrades at the Washington Monument, and, (4) over the course of 25 years, worked on security system alarm issues in Washington, D.C. and San Francisco. Furthermore, the Park Police told us that the Deputy Chief received a certification after completing DHS’s Critical Infrastructure and Key Resources Protection course. OLES officials also told us that the Deputy Chief has met the department’s minimum training requirements.

The Interior IG and OLES officials are also concerned about the Park Service’s management of security operations at individual icons. In its 2003 icon protection report, the IG suggested that icons with the most significant threat potential should have trained and certified security managers on-site, and in 2008, recommended that the Park Service install trained and certified security professionals at each icon park to work under the direction of the security manager the IG had recommended for all of the icons. In its 2006 icon risk assessment and 2007 icon compliance reviews, OLES recommended that Independence National Historic Park and the Statue of Liberty hire security managers. While officials at these two icons have identified hiring security managers as a priority, they had yet to fill the positions at the time of our review. While park officials at the Statue of Liberty have identified hiring a security manager as a top priority, they have not determined whether the Park Service or the Park Police will fund the position. In 2007, the Park Pol hired a security manager for the National Capital Region. The Deputy Chief of the Icon Protection Division told us that the Park Police intends to hire a technical assistant for this manager who can, for example, repair security equipment.

Of the five icons, only the Gateway Arch has a full-time physical security specialist—a need the park identified on its own and filled with a qualified professional. Park officials at the Gateway Arch created and staffed this position during 2006 and had to give up one law enforcement position to do so. The park’s assistant chief rangers, who are law enforcement officers, told us they believe the tradeoff was justified and the specialist’s efforts may increase awareness among staff. The physical security specialist has undertaken a number of initiatives, such as conducting a risk assessment of the facility where park officials wanted to locate its dispatch center, testing security alarms in the visitor center, sending park employees security awareness e-mails, and forming partnerships with area federal departments and agencies such as DHS, the Department of Justice, and the U.S. Postal Service to enhance surveillance capabilities, acquire interoperable communications technology, and assess mail handling. Moreover, the Midwest Region has leveraged the specialist’s expertise to help the region develop a risk assessment tool for its small parks security program. OLES officials told us that of the five icons, the Gateway Arch had the highest security policy compliance rating in 2007, and although they did not attribute this rating to the physical security specialist’s work, it is worthwhile to note that the Gateway Arch is the only icon that has a full-time position dedicated solely to physical security.

Conclusions

In addition to its primary mission to preserve the natural and cultural resources and values of the national park system for the enjoyment, education, and inspiration of those who visit them, the Park Service has a critical role related to security at national icons and parks and has taken important steps to improve the security of nearly 400 national icons and parks. However, concerns persist that terrorists may attack the United States by targeting national icons such as the Statue of Liberty and the Gateway Arch, and by harming those who visit places emblematic of our nation’s natural beauty and heritage, such as the Grand Canyon and Gettysburg. More emphasis on the key practices would provide greater assurance that Park Service assets are well protected and that Park Service resources are being used efficiently to improve protection. Critical to advancing the Park Service’s security efforts, a more comprehensive risk management approach and related guidance—which are currently lacking—would provide management with up-to-date information on threats and trends in security gaps and would allow management to target resources to address the greatest threats and vulnerabilities. Standards and guidance for technology investment, if developed, would provide better assurance that the Park Service’s return on investment is maximized. In addition, a strategy for improving internal communication by, for example, expeditiously developing a security Web portal, could lead to more efficient information sharing and coordination. Implementing a more systematic performance measurement and testing program would inform risk management efforts and allow management to better gauge security performance. Finally, paying greater attention to the human capital component of security—by clearly defining security roles and responsibilities using risk management and establishing a security training program—would give Park Service staff the tools and awareness needed to protect the Park Service’s assets and the people who visit them.

Recommendations for Executive Action

In order to better oversee and more efficiently manage the protection of the vast and diverse inventory of national icons and parks, in the restricted version of this report, we recommended that the Secretary of the Interior take six actions. Specifically, the Secretary should instruct the Director of the National Park Service, in consultation with OLES, to develop and implement 1. a more comprehensive, routine risk management approach for security that encompasses the Park Service’s vast inventory of icons and parks, including developing guidance, standards, and procedures for conducting risk assessments at the icon and park level and for using the results to inform resource allocation decisions at the national, regional, icon, and park levels; 2. guidance and standards for leveraging security technology, including how to assess the costs and benefits of countermeasure alternatives while taking into account risk management results; 3. an internal communications strategy for security to address coordination gaps, including a timeline for the development of a servicewide Web portal for security; 4. a servicewide performance management and testing program that includes specific measures and an evaluation component, which can be used to inform broader risk management decision-making and to assess security performance; 5. a strategy for more clearly defining security roles and responsibilities within the Park Service, which should, among other things, ensure that the Park Service is well equipped at the national and regional levels to oversee security improvements; and 6. a servicewide security training program and related curriculum to provide staff with the knowledge, skills, and awareness needed to improve Park Service security practices.

Agency Comments and Our Evaluation

We provided a draft of the restricted version of this report to Interior for official review and comment. Interior agreed with our assessment that actions are needed to improve security practices at national icons and parks and agreed with the report’s recommendations. Regarding the first recommendation to develop a more comprehensive, routine risk management approach for security, Interior cited the recent creation of a Homeland Security Division within the Park Police, stated that parks and regions have been working to develop a more comprehensive approach to security, and agreed to bring all of these efforts together in a more comprehensive, servicewide program. For the second recommendation to develop guidance and standards to leverage security technology, Interior cited some examples of the partnerships it has with other federal agencies and acknowledged that guidance and standards for leveraging technology, coupled with an effective communications strategy, would add to the effectiveness and efficiency of its security program for icons and parks. With respect to the third recommendation, Interior stated that a more formal internal communications strategy would enhance the effectiveness of its security program for icons and parks and noted that such a strategy should acknowledge the critical importance of the communication networks icons and parks establish at the asset level. For the fourth recommendation to develop and implement a servicewide performance management and testing program, Interior stated that while its current approach has been effective in some situations, applying a servicewide approach would benefit all icons and parks in the system. Regarding the fifth recommendation to develop and implement a strategy for more clearly defining security roles and responsibilities within the Park Service, Interior stated that it would continue to look for ways to leverage the expertise and experience of physical security staff and to clearly define their roles and responsibilities.

Finally, for the sixth recommendation to develop and implement a servicewide security training program and related curriculum, Interior stated that a servicewide security training program and increased access to contemporary training on appropriate security subjects would be helpful and noted that it currently sends staff with security responsibilities to a variety of training programs within and outside of Interior, including the physical security training program offered through FLETC. While these other security courses may be helpful, as we reported, not all Park Service personnel that have security responsibilities are able to attend these training classes due to the space limitations of the entities offering these courses and resource constraints on the part of individual icons and parks. Furthermore, as we reported, the Park Service does not have a special training curriculum for its designated physical security coordinators. Therefore, it is important that the Park Service develop its own park- specific training program so that staff that have security responsibilities delegated to them can effectively carry out those duties and better ensure that icons and parks, and the people who visit and work at them, are well- protected. Interior’s official comments are contained in appendix II.

Interior also provided general and technical comments from the Park Police and we incorporated the technical comments where appropriate. In its general comments, the Park Police noted some of the security improvements it has made since September 11 for the icons under its purview in New York City and Washington, D.C. Specifically, the Park Police cited enhancements made to physical barriers, surveillance systems, visitor screening, and contract guard services. The Park Police also stated that in October 2008, it underwent its largest internal reorganization in 40 years and created a Homeland Security Division and added more officers and patrols to enhance icon protection efforts. Finally, with respect to information sharing and coordination, the Park Police stated that it has assigned three intelligence officers to enhance icon protection in Washington, D.C. and detectives to the JTTFs in New York City; Washington, D.C.; and San Francisco. Moreover, the Park Police has assigned a major to the Park Service’s national office to liaise with the Park Service to protect all icons.

As agreed with your office, unless you publicly announce the contents of this report, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of the Interior and appropriate congressional committees. In addition, the report will be available at no charge on GAO’s Web site at http://www.gao.gov.

If you have any questions about this report, please contact me at (202) 512- 2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objective was to determine whether the National Park Service’s (Park Service) approach to security for national icons and parks reflects key protection practices. Through previous work, we identified a set of key protection practices from the collective practices of federal agencies and private sector entities that can provide a framework for guiding agencies’ protection efforts and addressing challenges. The key practices essentially form the foundation of a comprehensive approach to asset protection and can be used to assess the management of security programs. We used our key protection practices as criteria to evaluate the Park Service’s approach to security. Of the six key practices, we used the following as criteria: Allocating resources using risk management.

Leveraging technology.

Information sharing and coordination.

Performance measurement and testing.

Strategic management of human capital.

We did not consider the sixth key practice, aligning assets to mission, which focuses on realigning the federal real property inventory to better reflect agencies’ missions.

Jefferson National Memorial, and the Lincoln National Memorial—becaus the IG examined their security in 2008. We selected: Two icons—the Statue of Liberty National Monument (Statue of Liberty) in New York City and the Jefferson National Expansion Memorial in St. Louis.

Three parks—the African Burial Ground National Monument in New York City, Gettysburg National Military Park in Pennsylvania, and Grand Canyon (Grand Canyon) National Park in Arizona.

Collectively, the sites we selected illustrate a range of park protection practices applied by the Park Service. At each site, we interviewed P Service officials with primary responsibility for security implementation, operation, and management. We also interviewed U.S. Park Police (Park Police) officials from the Statue of Liberty. We toured each site and observed the physical environment and the principal security elemen gain firsthand knowledge of the protection practices used at all the s except the Grand Canyon where we used videoconferencing to interview Park Service officials. We reviewed and analyzed documents, when available, that contained site-specific information on security pla ns, policies, procedures, budgets, and staffing. Because we observed the Park Service’s efforts to protect icons and parks at a limited number of sites, our observations of security issues at individual sites cannot be generalized to all the icons and parks that the Park Service is responsible for securing. To supplement these site visits, we interviewed Park Service regional chief rangers and other security officials from the three regio where we had selected icons and parks—the Northeast, Midwest, and Intermountain regions. We also interviewed the regional chief ranger fro the Pacific West region because the Park Service once identified the Golden Gate Bridge as an icon and we wanted that region’s perspec icon and park protection. At the national level, we interviewed offici als from the IG, Office of Law Enforcement and Security, Park Service, and Park Police. Furthermore, we collected supporting documentation including law enforcement and secur enforcement, security, and icon protection; icon risk assessments and compliance reviews; and security plans, policies, procedures, budgets, an staffing information when available. ity manuals; IG reports on law d We conducted this performance audit from January 2008 to June 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Comments from the Department of the Interior

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, David Sausville, Assistant Director; Denise McCabe, Analyst-in-Charge; Anne Dilger; Elizabeth Eisenstadt; Brandon Haller; Robin Nye; Joshua Ormond; Susan Michal- Smith; and Adam Yu made key contributions to this report.