Investigative Operations: Use of Covert Testing to Identify Security Vulnerabilities and Fraud, Waste, and Abuse
Released: 2007-11-14T00:00:00

Letter

FSI Covert Testing Processes and Procedures

Because of the sensitive nature of our work, and the fact that our findings can generate information that may compromise national or homeland security, we apply strict processes and procedures when performing covert work. FSI plans and conducts all investigations in accordance with the standards established by the President’s Council on Integrity and Efficiency (PCIE). These standards are relevant to the full range of government investigations, including fraud, corruption, white-collar crime, security inquiries, whistleblower issues, and other special investigations. With regard to covert operations specifically, FSI has developed our own internal procedures detailing the requirements related to the planning, execution, and reporting phases of the operations.

Planning a Covert Test

FSI, in conjunction with senior-level GAO management, decides on a case- by-case basis whether to accept written congressional requests requiring covert operations or whether to incorporate covert testing into existing engagements. In making these decisions, a number of factors are considered, including, but not limited to, whether the proposed operations are within the scope of GAO’s authority; whether the operations may be performed more appropriately by agency Inspectors General; and whether the requested work presents significant risk of personal injury to individuals or other harm to persons, businesses, or public safety. We also identify the specific aspects of the security system or the government program that are particularly vulnerable to terrorist threats or fraudulent activities. Once the use of covert operations is accepted, the first step in FSI’s process involves using the training and experience of our investigators to develop a written investigative plan. Because the average FSI investigator has over 20 years of law enforcement experience, they are uniquely positioned to develop a blueprint for performing the work, while minimizing disruption to the day-to-day operations of the agency being tested and seeking to ensure the safety of all involved.

In general, FSI investigative plans contain the following elements: a statement regarding the investigation’s overall objectives; a description of the legal issues involved; and a summary of the allegations that merit investigation or the processes, systems, and controls that will be tested. When covert operations are involved, the plan must also contain a detailed outline of the steps that would be necessary to effectively conduct the operation. In most cases, this step-by-step process will include the creation of fictitious identities and counterfeit documentation, including items such as birth certificates, driver’s licenses, credit cards, billing records, and social security cards. All counterfeit documents that FSI uses are manufactured by FSI using hardware, software, and materials that are available to the general public—this allows us to demonstrate that any security vulnerabilities we find could be exploited by a criminal or terrorist with moderate means and resources and would not require sophisticated insider knowledge or access to sophisticated equipment. In order to obtain the best possible evidence, the plan may also request that GAO management authorize FSI to obtain photographs or video or audio recordings. The investigative plan must be reviewed and approved by an FSI Assistant Director for Investigations, FSI’s Managing Director, and two members from GAO’s top management team.

Executing a Covert Test

Once the investigative plan has been approved, FSI proceeds with the covert operation. In general, FSI’s investigators are the only staff allowed to participate in actual testing activities, although audit and analyst staff are often involved in planning and operational support. Furthermore, if the covert testing is conducted outside GAO headquarters (e.g., the testing of U.S. border security), FSI policy requires that investigators acting in a covert capacity have a “cover team” of investigators to ensure safety. These agents are usually placed strategically about the test site to monitor the situation and to alert the investigators conducting the tests if anything seems out of place. The responsible Assistant Director for Investigations is also present during all covert operations conducted outside of the GAO headquarters building. Before any testing begins, the Managing Director generally receives an itinerary sheet with all the names of the investigators involved and pertinent contact numbers.

During the execution phase, investigators are required to protect investigative information from unauthorized disclosure, protect the rights of all individuals involved, and avoid any action that may give the appearance of coercion or intimidation. In addition, investigators must safeguard any counterfeit documentation against theft or damage. Investigators must document all evidence obtained in accordance with PCIE standards and applicable FSI and GAO policies.

Investigators routinely make dry runs of covert operations tests to determine whether new or enhanced security procedures have been implemented after the development of our testing plan. Because FSI only uses publicly available information to develop our covert tests and does not consult with agency insiders, the specifics of our operations are not leaked to agency officials. Our belief is that by using only publicly available information, our tests reveal what an actual terrorist or criminal might do during a real security breach or fraud scheme.

Furthermore, our policy is that if an FSI covert operation is uncovered during one of our tests, the backup investigators immediately will identify themselves and alert the proper law enforcement authorities that a test is being conducted and identify all participants as being FSI investigators with the proper authority. Importantly, if investigators discover vulnerabilities that pose a significant and immediate threat to public safety, FSI immediately discontinues its investigation and alert the appropriate government law enforcement agency. Under no circumstances will FSI make publicly available any photograph, videotape, or audiotape that could be used as a road map by criminals or terrorist groups.

Reporting the Results of Covert Testing

Once the operation is complete, investigators immediately brief the congressional requester. Next, FSI conducts a “corrective action briefing” with officials at the tested entity to inform them that they have been the subject of a covert operation, share the results of the testing , and, if necessary, suggest potential remedies for any identified control weaknesses or security vulnerabilities.

After all parties have been briefed, FSI will issue a report or testimony that comports with PCIE and applicable FSI and GAO standards. Because the covert testing is sometimes part of a broader forensic audit, parts of the product may also adhere to U.S. generally accepted government auditing standards. These products contain our findings, the results of the corrective action briefing with the tested entity, and sometimes contain recommendations to agency management. FSI does not usually reveal all details about its covert methodologies in public products. For example, we typically do not reveal the name of any bogus companies that we create or the fictitious identities that we use. Moreover, if our findings relate to issues of national or homeland security, FSI submits a draft product to the agency for a sensitivity review prior to issuance. In some cases, FSI products are issued in conjunction with letters to the tested entity or other law enforcement agencies referring specific instances of wrongdoing, including the criminal activities of agency officials or private citizens.

Examples of FSI Covert Testing

At the request of a number of different congressional committees and subcommittees, FSI has conducted a wide variety of covert testing activities, including evaluations of controls over radioactive materials and security at America’s borders, airport security, sales of sensitive and surplus military equipment, public safety, and other issues including fraud prevention controls over federal programs. As demonstrated by the examples below, covert activities are instrumental in identifying important weaknesses that expose the federal government—and most importantly, the American public—to threats to their security and safety, as well as fraud, waste, and abuse related to taxpayer dollars. Following are summaries of several covert activities we performed in recent engagements and the results we obtained.

Controls over Radioactive Materials and Security at America’s Borders

The covert activities we performed in these areas include: Using the name of a bogus business that existed only on paper, FSI investigators obtained a genuine radioactive materials license from the Nuclear Regulatory Commission (NRC) without leaving the office or actually meeting with or having our nonexistent facility inspected by anybody from the NRC. After altering the maximum quantity of materials listed on the license, FSI investigators faxed these licenses to two suppliers and obtained price quotes and commitments to ship machines containing radioactive materials in quantities that could have been used to produce a dirty bomb. In contrast, a state allowed by the NRC to issue radioactive licenses indicated that it would perform physical verification prior to approving a radioactive materials license for our bogus company. As a result, we informed NRC that we had “financial problems” and withdrew our application.

Using counterfeit documents and posing as employees of a company with an NRC license, FSI investigators successfully crossed the northern and southern borders with the type of radioactive materials that could be used to make a dirty bomb. While the radiation portal monitors at the two border locations properly signaled the presence of the radioactive materials in our vehicles, the inspectors readily accepted our counterfeit documents—including a counterfeit bill of lading and NRC license—which we created using publicly available hardware, software, and materials. As part of this operation, an FSI investigator using the name of a fictitious company ordered by telephone a small amount of radioactive sources to “calibrate personal radiation detection pagers.” These radioactive sources were shipped to the Washington, D.C., area to the fictitious company. This test demonstrated that anyone could purchase small quantities of radioactive sources for stockpiling.

Posing as individuals with simulated contraband including radioactive material, FSI investigators successfully crossed the northern U.S. border at locations that were unmanned and unmonitored. This test showed that the northern border is significantly vulnerable to terrorists or criminals entering the United States undetected.

Airport Security Testing

In 2006, we reported on the results of covert security vulnerability testing of numerous airports across the country. During these covert tests, our investigators passed through airport security checkpoints carrying prohibited explosive components without being caught by Transportation Security Administration (TSA) security officers. The details of this March 2006 report are classified; however, TSA has authorized this limited discussion.

Sale of Sensitive and Surplus Military Equipment

Posing as private citizens, FSI investigators purchased sensitive military equipment—including ceramic body armor inserts, guided missile radar test sets, and microcircuits used in F-14 fighter aircraft— on the Internet from the Department of Defense’s (DOD) liquidation sales contractor. Some of these items required us to obtain an “end use certificate”, which is intended to provide assurance that sensitive property is sold to legitimate buyers. To obtain these parts we applied for this certificate using fictitious individuals and bogus documents. Subsequently, a DOD official called our investigator (the fictitious individual) asking why he had no credit or other history. Our investigator used social engineering and a copy of a bogus utility bill to address the questions and our application was then approved. We used this certificate to buy items, including F-14 parts, which are in demand by Iran, the only country currently operating F-14 fleet in the world.

FSI investigators posing as DOD contractor employees were able to easily penetrate two Department of Defense excess property warehouses. There, they were able to obtain about $1.1 million in sensitive military equipment items, including launcher mounts for shoulder-fired guided missiles, body armor, a digital signal converter used in naval surveillance, and an all-band antenna used to track aircraft. Our cover story was so convincing that DOD and its contractor staff helped our investigators locate targeted items and load them into our rented van.

Public Safety

Using bogus driver’s licenses, FSI investigators successfully gained entry to all 24 Department of Transportation regulated urine collection sites that we tested, which are responsible for providing drug testing of commercial truck drivers in safety sensitive transportation positions. This test shows that individuals required to undergo drug testing can send someone to take a drug test in their place using fake identification. Furthermore, FSI investigators were able to use adulterants at four collection sites and substitute synthetic urine at another four sites without being caught by site collectors. None of the eight synthetic or adulterated urine specimens were detected by the labs.

Other Testing

Activities in this area include obtaining disaster assistance and demonstrating weaknesses in agencies’ fraud prevention controls.

Posing as disaster victims of hurricanes Katrina and Rita, FSI investigators applied for federal assistance using falsified identities, bogus addresses, and fabricated disaster stories to register for assistance under the Individuals and Households Program. Despite the fact that our applications over the Internet were not accepted because of data validation procedures the Federal Emergency Management Agency (FEMA) had implemented, FSI investigators successfully registered over the phone. As a result, FEMA sent a number of checks to FSI for our fictitious individuals based on our bogus applications. After our investigation was complete, we returned the checks we obtained.

Using easily obtained data on the Internet, FSI submitted a fictitious travel order for a fictitious individual to a DOD commercial travel office to obtain an airline ticket from Washington, D.C., to Atlanta, Georgia. DOD issued FSI the airline ticket, established an obligation, and paid for the ticket without detecting the fictitious nature of the request. On the day of the scheduled flight, an FSI investigator went to the airline’s ticket counter at the airport and, under the name of this fictitious individual, picked up a boarding pass.

Using entirely false documents and an erroneous IRS taxpayer identification number, FSI pretended to be a charity and applied to three of the Combined Financial Campaign’s local 2006 campaigns. The fictitious entity was accepted into all three CFC campaigns. Immediately after our applications were accepted, we notified CFC officials and withdrew our charity from the campaigns in order to prevent federal employees from making donations to our fictitious charity.

Conclusions

The results of FSI’s covert testing have been used by Congress and federal agency managers across the government to help strengthen homeland security and minimize fraud, waste, and abuse of taxpayer dollars. We will continue to offer this valuable service to the Congress in a responsible and professional manner and provide the results of our work to agency management, where appropriate, so that they can take concrete steps to improve the federal government’s operations.

Mr. Chairman and Members of the Committee, this concludes my statement. I would be pleased to answer any questions that you or other Members of the Committee may have at this time.

Contacts and Acknowledgments

For further information about this testimony, please contact Gregory D. Kutz at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.