Insider Threats: DOD Should Improve Information Sharing and Oversight to Protect U.S. Installations
Released: 2015-07-16T00:00:00

Letter

Background

Examples of Insider Threats at U.S. Installations

Insiders have proven to be a threat to DOD facilities and personnel within the United States on multiple occasions. DOD acknowledged in its 2014 Quadrennial Defense Review that the United States is no longer a sanctuary for U.S. forces and the department must anticipate the increased likelihood of an attack on U.S. soil. Table 1 below provides examples of past incidents involving DOD insider threats at U.S. military installations.

Reviews of the 2009 Fort Hood and 2013 Washington Navy Yard Shootings

DOD and the military services completed a series of reviews after the 2009 Fort Hood shooting and the 2013 Washington Navy Yard shooting that led to the recommendations that the Secretary of Defense and Secretary of Navy tasked the department and Navy, respectively, to implement. Specifically, in response to the 2009 Fort Hood shooting, the Secretary of Defense directed the department to conduct an independent review of the incident. The results of this independent review, which were released in January 2010, identified 79 recommendations that the department could take to address findings associated with personnel policies, force protection, emergency and mass casualty response, and support to DOD healthcare providers. In response to the 2013 Washington Navy Yard shooting, the Secretary of Defense directed an independent review and an internal review of the incident to identify and recommend actions to address gaps or deficiencies in DOD programs, policies, or procedures regarding security at DOD installations and the granting and renewing of security clearances for DOD employees and contractor personnel. Both the Washington Navy Yard independent review and internal review were released in November 2013 and identified actions that were intended to improve DOD’s force protection posture from insider threats. In March 2014, the Secretary of Defense directed DOD to implement four key recommendations that were a compilation of a number of recommendations from the Washington Navy Yard independent review and internal review. Similarly, the Department of the Navy conducted two internal service reviews in response to the Washington Navy Yard shootings. As a result, the Navy issued two reports with recommendations to the Navy and Marine Corps. Figure 1 shows a timeline of DOD’s and the military services’ reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings. See appendix II for more information about these reviews.

DOD Efforts to Establish an Insider Threat Program

In light of these insider attacks on U.S. installations and as part of its response to an executive order and national insider threat policy directing federal agencies to develop insider threat programs, DOD is developing its own insider threat program. Specifically, in September 2014, DOD issued a directive establishing a department-wide insider threat program that identifies policy and assigns responsibilities. Among other things, the directive states that appropriate DOD policies shall be evaluated and modified to effectively address insider threats to DOD.

There are a number of DOD officials and organizations that have a role in protecting personnel, facilities, and resources on U.S. installations from insider threats. For example:

The Under Secretary of Defense for Intelligence serves as the principal staff assistant to the Secretary of Defense with responsibility for personnel security and issuing department-wide guidance regarding insider threats. The Secretary of Defense also tasked the Under Secretary to oversee the implementation of the four recommendations and three studies that the Secretary of Defense directed DOD to undertake based on the independent review and internal review of the 2013 Washington Navy Yard shooting.

The Assistant Secretary of Defense for Homeland Defense and Global Security (ASD ), within the Office of the Under Secretary of Defense for Policy, has responsibility for updating DOD antiterrorism policy. The Secretary of Defense also tasked the Assistant Secretary to oversee the implementation of the recommendations that were identified in the independent review of the 2009 Fort Hood shooting and the military service follow-on reviews.

Military services are responsible for executing portions of the recommendations from the independent review of the 2009 Fort Hood shooting, funding certain programs that address insider threats, and executing DOD-wide policy and guidance.

Geographic combatant commands have the primary responsibility for setting force protection postures and guidance in their areas of responsibility.

GAO Insider Threat Framework

We have previously reported that DOD should incorporate 25 key elements into DOD components’ insider threat programs. We identified these key elements based on our analysis of the National Insider Threat Policy and Minimum Standards for Executive Agencies, DOD policy and guidance, executive-branch policy and reports, and independent studies to mitigate insider threats. As shown in figure 2 below, these key elements include training employees, issuing guidance, equipping response personnel, and establishing formal and informal agreements. While we developed the framework during our review of DOD’s efforts to protect classified information and systems from insider threats, the framework is also applicable to DOD’s efforts to protect U.S. installations from insider threats. For example, the following DOD policy and guidance documents and reviews support each of the phases of the framework: DOD Instruction 1438.06, DOD Workplace Violence Prevention and Response Policy; DOD Instruction 2000.12, DOD Antiterrorism (AT) Program; DOD Instruction 2000.16, DOD Antiterrorism (AT) Standards; DOD Instruction 2000.26, Suspicious Activity Reporting; DOD 5200.08-R, Physical Security Program; DOD Instruction 5525.15, Law Enforcement (LE) Standards and Training in the DOD; DOD Instruction 5240.22, Counterintelligence Support to Force Protection; DOD Instruction 6055.17, Installation Emergency Management (IEM) Program; Joint Publication 3-07.2, Antiterrorism; Directive Type Memorandum 09-012, Interim Policy Guidance for DOD Physical Access Control; and the findings and recommendations identified in the independent and internal reviews conducted in response to the 2009 Fort Hood and 2013 Washington Navy Yard shootings. In addition to these documents, our 2015 report, Insider Threats: DOD Should Strengthen Management and Guidance to Protect Classified Information and Systems, identifies documents that support the need to protect personnel and property on U.S. installations in addition to protecting classified information and systems. For example, DOD Directive 5240.06, Counterintelligence Awareness and Reporting, and DOD Instruction 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence (CI)

Insider Threat, identify procedures that would protect classified information, personnel, and real property from insider threats.

Majority of DOD’s Key Force Protection– Related Policy and Guidance Have Been Updated, but Some Guidance Do Not Yet Reflect Insider Threat Considerations

We found that 7 of 10 force protection–related DOD policy and guidance documents incorporated insider threat considerations; however, the 3 other documents do not reflect insider threat considerations. Specifically, we found that these 3 policy and other guidance documents did not cover all DOD employees that could become either an insider threat or a victim of such a threat, did not identify multiple types of insider threat scenarios, or did not incorporate insider threats into their training requirements. In addition, we identified a potential policy gap in providing information on reporting certain types of suspicious activities to base security personnel, which DOD officials acknowledged and were taking steps to address in light of our finding.

Seven DOD Key Force Protection–Related Policy and Guidance Documents Incorporate Insider Threat Considerations

We found that seven DOD policies and other guidance documents related to force protection incorporated insider threat considerations. Specifically, these seven DOD policies and other guidance address antiterrorism, security, and counterintelligence issues that are intended to protect the department’s personnel, facilities, and resources.

Joint Publication 3-07.2, Antiterrorism, sets forth joint doctrine to provide the fundamental tenets for planning, executing, and assessing joint antiterrorism programs. In 2014, DOD updated the joint publication to identify active shooter and other insider threats as common terrorist tactics, techniques, and procedures, among other things. For example, the joint publication states that an insider threat can include active shooters and bombers that use improvised explosive devices to create additional victims or to impede first responders to the scene of the incident.

DOD Instruction 2000.12, DOD Antiterrorism (AT) Program, establishes and prescribes procedures for the DOD antiterrorism program. The instruction was updated in 2013 to clarify the geographic combatant commanders’ authority to set force protection conditions in their areas of responsibility in response to recommendations from the 2009 Fort Hood shooting.

DOD Instruction 2000.26, Suspicious Activity Reporting (SAR), establishes policy and procedures for implementing eGuardian as the DOD law enforcement suspicious activity reporting system. In addition, the instruction, which was updated in 2014, identifies responsibilities, such as the development of component-specific suspicious activity awareness campaigns, that DOD components should implement. The instruction refers to insider threats and also provides categories of suspicious activities. These categories include threats to DOD personnel, efforts to recruit personnel to collect information on DOD functions and procedures, and testing security measures at DOD installations in an effort to discover vulnerabilities.

DOD Directive 5200.43, Management of the Defense Security Enterprise, provides direction for a comprehensive Defense Security Enterprise policy, oversight framework, and governance structure to safeguard personnel and resources against harm, loss, or hostile acts and influences. The directive requires the Defense Security Enterprise Executive Committee—which advises the Under Secretary of Defense for Intelligence—to, among other things, develop a Defense Security Enterprise framework that aligns with and is informed by insider threat initiatives and policy.

DOD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), establishes policy, assigns responsibilities, and provides procedures for counterintelligence awareness and reporting to include listing reportable indicators and behaviors associated with foreign intelligence entities. The directive includes specific references to counterintelligence insider threats and lists examples of reportable DOD employee behavior and activities such as advocating violence on behalf of a known or suspected international terrorist organization, advocating support for a known or suspected international terrorist organization, or any attempt to recruit personnel for terrorist activities. The directive also incorporates insider threat awareness training into requirements for counterintelligence awareness training. For example, the directive states that the annual counterintelligence awareness training for all DOD employees should include instruction on the counterintelligence insider threat, methods of foreign intelligence entities, and reporting requirements on the list of indicators and behaviors.

DOD Instruction 5240.22, Counterintelligence Support to Force Protection, assigns responsibilities and lays out procedures for conducting and managing counterintelligence support to force protection programs of the DOD components and other supported elements within DOD. While the instruction does not explicitly identify insider threats, it identifies the responsibilities and procedures for addressing international terrorist threats, terrorist-enabling individuals, and organizations threatening DOD interests—areas that could include individuals who are insider threats and are associated with foreign terrorist entities.

DOD Instruction 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence (CI) Insider Threat, establishes policy and assigns responsibilities for the counterintelligence insider threat program in support of other DOD insider threat programs. The instruction includes specific references to counterintelligence insider threats and lays out procedures for reporting and processing threats from unidentified individuals affiliated with DOD who are believed to have a relationship with a foreign intelligence entity. The instruction directs the Director, Defense Intelligence Agency, to incorporate counterintelligence insider threat awareness into counterintelligence awareness and reporting training in accordance with DOD Directive 5240.06.

DOD Is Updating Three Documents That Do Not Reflect Insider Threat Considerations and Addressing a Policy Gap for Reporting Someone Carrying a Weapon on an Installation

We found that, as of May 2015, three DOD policies and other guidance documents related to force protection did not incorporate insider threat considerations; additionally, DOD did not have a policy on when DOD military and contractor employees should report individuals observed carrying weapons on an installation. We found the following:

DOD Instruction 1438.06, DOD Workplace Violence Prevention and Response Policy, establishes policy and assigns responsibilities for workplace violence prevention and response regarding DOD civilian personnel. The instruction, which was issued in 2014, does not explicitly identify insider threats but does direct the department to prevent and report incidents involving violence, threats, harassment, intimidation, and other disruptive behavior from civilian employees. These types of activities could be considered insider threat concerns. The instruction also requires all supervisors to immediately report threats of workplace violence to their management and appropriate military or civilian authorities as determined by local threat reporting protocols. However, the policy applies only to DOD civilian employees and does not apply to military and contractor personnel who could also become potential insider threats. DOD officials told us that the department is drafting a memorandum that will expand this instruction to cover all employees.

DOD Instruction 2000.16, DOD Antiterrorism (AT) Standards, identifies minimum antiterrorism standards, such as training standards, that DOD components must apply in the development of their individual antiterrorism programs and plans. We found that the instruction, which has not been updated since either the 2009 Fort Hood or the 2013 Washington Navy Yard shootings, does not identify insider threats as one of the minimum antiterrorism awareness training requirements. DOD is in the process of updating this instruction and has included “insider threat and active shooter attacks” as a minimum training requirement in a draft version of the instruction.

DOD Instruction 6055.17, DOD Installation Emergency Management (IEM) Program, establishes policy and prescribes procedures for developing, implementing, and sustaining installation emergency management programs at DOD installations worldwide for all-hazards threats. While the instruction, which has not been updated since 2010, does not explicitly reference insider threats, it highlights workplace violence and active shooter incidents as threats that have the potential to affect military installations and thus should be included in an installation’s emergency management program. These threats could be considered insider threat concerns. However, the instruction does not identify other insider threat scenarios that have the potential to affect military installations, such as the use of a vehicle-borne improvised explosive device or a personal-borne improvised explosive device. DOD’s joint guidance on antiterrorism recognizes that an insider threat could use improvised explosive devices to create additional victims, to impede first responders, or both. DOD is in the process of updating this instruction and included “improvised explosive device response” as a minimum capability assessment requirement in a draft version of the instruction.

In addition, we found that DOD does not have a policy in place for military personnel and DOD affiliated-contractors to provide guidance on when it would be appropriate to report to base security officials when an individual is observed carrying a weapon on an installation, especially into a work environment. Senior officials within OASD(HD&GS) acknowledged that the issue is not addressed in DOD policy for military personnel and DOD-affiliated contractors and told us that their intent is to incorporate such guidance into DOD Instruction 5200.08 on DOD’s physical security program, which is currently under revision. If DOD addresses the policy gap on carrying weapons and issues updated policies on workplace violence prevention, antiterrorism standards, and installation emergency management to incorporate insider threats, the department will be better positioned to have clear and current policy and accurate procedures to prevent, detect, deter, and take actions in response to insider threats on U.S. installations.

Selected Installations Have Taken Actions to Protect against Insider Threats, but DOD Has Not Consistently Shared This Information

The eight installations we visited have taken actions to protect against insider threats. However, DOD has not consistently shared information about these actions throughout the department because DOD personnel have not consistently used existing mechanisms.

Installations Have Taken Actions to Protect against Insider Threats

During our visits to eight U.S. installations, we identified actions that installation officials had taken to protect against insider threats, as shown in table 2.

The following are some specific examples we found during our eight site visits:

Establish Rules and Policies. Officials at four installations told us they issued guidance documents to protect against active shooters and other potential insider threats. For example, Peterson Air Force Base developed an active shooter response book that officials shared with local law enforcement to facilitate training and response to incidents. Rock Island Arsenal and Washington Navy Yard developed and issued handbooks that guide personnel to protect against active shooters and other insider threats. Specifically, Rock Island Arsenal issued a handbook for supervisory personnel on how to respond to on-base incidents. At Washington Navy Yard, officials told us they issued a handbook that guides law enforcement personnel by providing information about behavioral indicators of potential insider threats and actions when responding to an active shooter or a bomb threat.

Train and Exercise Employees. All eight installations had trained and exercised personnel to report suspicious activities, report potential counterintelligence activities, and respond to active shooters, according to installation officials. To encourage suspicious activity and counterintelligence activity reporting, officials at Marine Corps Base Quantico told us they used media, briefings to new hires, and presentations to on-base school students to remind employees and military dependents about the base’s suspicious activity program. Officials at Rock Island Arsenal told us they provide antiterrorism training that is tailored for each unit. In addition, officials at Fort Hood told us they encourage personnel to use a social media webpage to report suspicious activities. To facilitate response efforts, officials at four installations told us they also use realistic training environments. For example, installation officials at Peterson Air Force Base and Naval Submarine Base New London told us they use buildings that contain cubicles to train installation security personnel on active shooter response. Officials at Naval Submarine Base New London and Marine Corps Base Quantico also told us they use blank and simulated ammunition to make training more realistic.

Train, Exercise, and Equip Response Personnel. Officials at three installations we visited told us that additional equipment was provided to installation security forces personnel in order to respond to and protect against active shooters and insider threats. For example, officials at Fort Hood told us that after the 2009 Fort Hood shooting, they provided installation security personnel with supplemental weapons and body armor to respond to active shooters. Officials at Joint Base San Antonio also told us that they had procured upgrades on locks and doors for certain facilities to protect against active shooters. In addition, officials at Washington Navy Yard told us they upgraded their installation radio system to have interoperable communications for all first responders on the installation and within Naval District Washington.

Establish Formal and Informal Agreements. Seven of the eight installations we visited have established formal agreements, such as memorandums of agreement or mutual aid agreements, with fire and medical emergency responders, and local law enforcement. Officials at three installations also told us they had developed informal relationships with local law enforcement and emergency responders. For example, officials at Fort Hood told us they regularly meet with local law enforcement officials. Also, officials at Rock Island Arsenal told us they participate in a monthly local area emergency management forum. Naval Criminal Investigative Service officials at Naval Submarine Base New London also told us they attend a monthly local and state law enforcement conference focused on both internal and external threats in the area. Officials at the Pentagon Force Protection Agency told us they have relationships with other organizations within the National Capital Region—such as the Naval Criminal Investigative Service—which helps facilitate information sharing on potential threats in the area.

Other Actions Taken. Officials at the eight installations we visited also told us of other actions they had taken to protect against insider threats. Such actions include using random antiterrorism measures, installing installation mass notification systems, and piloting a workplace violence risk assessment program. For example, officials at Joint Base San Antonio told us about a pilot program they developed to assess the potential risk for workplace violence within units. At the time of our visit, officials at Joint Base San Antonio had tested the pilot program on 17 units at the base with the goal to expand the pilot.

DOD Has Not Consistently Shared Actions to Protect against Insider Threats

While the U.S. installations we visited have taken actions to protect against insider threats, military services have not consistently shared this information across the department because DOD officials are not consistently using existing information sharing mechanisms. Such mechanisms include working groups, conferences, lessons-learned information systems, and antiterrorism web portals.

Working groups. DOD officials told us that working groups are one mechanism used to share information across organizations and at installations. However, we found that some of the installations we visited were not consistently using working groups to share information. For example, we found that Air Force officials at Joint Base San Antonio were not aware and had not received a copy of an after-action report that an Army tenant on the installation had completed after an individual with access to the installation shot an employee on the installation. Air Force officials were not aware of this report and its recommendations even though they are responsible for security on the Joint Base because the installation command had not set up a working group with tenant officials where such information could have been shared.

Conferences. DOD officials told us that leading practices and lessons learned formerly were exchanged at DOD antiterrorism conferences. However, DOD and two of the military services cancelled their annual antiterrorism conferences from 2013 to 2014 because of limited funding and increased scrutiny of conferences. The Army reinitiated its antiterrorism conference in 2015 and an Air Force official told us that the service is considering merging antiterrorism and other force protection issues into a mission assurance conference going forward.

Lessons-learned information systems. The Joint Staff and each of the military services have established information systems to exchange information on lessons from training, exercises, and combat operations across the department. However, military service and installation officials told us they do not consistently use joint or military service lessons-learned information systems. Officials told us they do not use these systems because they believed the information within the systems focuses more on military combat operations, there is not a requirement to use the systems to share information on insider threats, and there is limited time or desire to use the systems. When we examined the joint lessons-learned information system, we found examples of information contained in the system that installations could use to enhance their efforts to protect against insider threats. For example, we found two after-action reports that highlight lessons learned on active shooter exercises conducted at two installations within the United States.

Antiterrorism web-based portals. The Joint Staff established an antiterrorism web-based, secure portal in 2003 to provide a collaborative environment for the DOD community to share antiterrorism and force protection information with the military services, combatant commands, and other DOD agencies. The portal contains links to various antiterrorism organizations, communities, and other force protection portals. However, service and installation officials told us they either were not aware of or did not use the Joint Staff’s antiterrorism portal. Marine Corps and Army officials told us that they use their service-specific antiterrorism portals. When we examined the Army’s antiterrorism enterprise portal we found examples of information contained in the system that installations could use to enhance their efforts to protect against insider threats. For example, the Army’s antiterrorism enterprise portal contained documentation on mitigating insider threats and antiterrorism best practices.

DOD guidance and recommendations issued after the 2009 Fort Hood shooting state that DOD should identify and share leading practices to enhance the department’s ability to protect the force. For example, DOD’s joint guidance on antiterrorism states that after-action reports and lessons learned should be shared with other units and defense components. Also, in 2014, the Chairman of the Joint Chiefs of Staff recommended that the department share innovative measures to prevent and respond to attacks similar to those at Fort Hood and the Washington Navy Yard. Further, the independent review of the 2009 Fort Hood shooting encouraged the department to identify best practices to enhance the department’s ability to protect the force. Similarly, in 2015, we reported that DOD components did not have or use a formalized process to develop, disseminate, and incorporate best practices and lessons learned in their insider-threat program. According to federal internal control standards, communication and information sharing should occur in a broad sense with information flowing down, across, and up an organization with management ensuring there are adequate means of communicating with, and obtaining information from, external stakeholders who may have a significant effect on the achievement of goals. Unless the military services share information across the department on insider threats by consistently using existing mechanisms, U.S. installations may miss opportunities to enhance the department’s ability to protect the force against such threats.

DOD Is in the Process of Implementing Recommendations from the 2009 and 2013 Official Reviews, but Inconsistent Reporting and Limited Monitoring Prevent Status Assessment

DOD has taken actions to implement the recommendations from the official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings; however, we were unable to identify the number of Fort Hood recommendations fully implemented because DOD and the military services had inconsistently reported this information and have conducted limited monitoring of recommendation implementation. DOD, as well as the Navy and Marine Corps, have also taken initial actions towards implementing the recommendations that were tasked by the Secretary of Defense and the Secretary of the Navy in response to the official reviews of the 2013 Washington Navy Yard shooting. For example, DOD issued an implementation plan in June 2014 that stated it will take years to implement the recommendations approved by the Secretary of Defense.

DOD Has Taken Actions to Implement Fort Hood Recommendations

We found that DOD has taken a number of actions to implement recommendations from the DOD independent review of the 2009 Fort Hood shooting. For example, in response to recommendations stemming from the 2009 Fort Hood shooting, DOD revised policies in areas such as suspicious activity reporting, counterintelligence, and emergency management. In September 2014, as part of its effort to address a recommendation that DOD integrate its disparate efforts to defend against internal threats, DOD established policy and assigned responsibilities for a DOD insider threat program. Also, in response to a recommendation to examine the feasibility of advancing procurement and deployment of mass warning systems, military service officials informed us that they were provided with additional funding to install mass notification systems and enhanced 911 systems. In response to our questionnaire provided to DOD and the services on the implementation of recommendations, DOD reported the Marine Corps installed mass notification systems at all of its installations, and the Navy and Air Force installed the systems at over 90 percent of their installations. DOD also reported that the Army fielded mass notification systems at locations that provide warning to over 80 percent of Army personnel. Likewise, DOD reported that all the services have installed enhanced 911 capabilities to varying degrees at their installations. For example, the Marine Corps installed enhanced 911 capabilities at all its installations, whereas the Army has completed fielding at 18 installations covering 54 percent of its population, and the Air Force has established enhanced 911 capabilities at 71 installations covering 64 percent of its population. The Navy reported that it has been hampered in fielding enhanced 911 systems at its installations because of aging infrastructure, among other factors, but expects to have enhanced 911 systems on its installations by September 2015.

In December 2014, the ASD(HD&GS) directed the Deputy Assistant Secretary of Defense for Defense Continuity & Mission Assurance to visit a sampling of installations to determine the effectiveness of policies issued since the 2009 Fort Hood shooting. In response to this tasking, the Deputy Assistant Secretary assembled key personnel from the Office of the Secretary of Defense staff, to include the Under Secretaries of Defense for Intelligence, for Personnel and Readiness, and for Acquisition, Technology, and Logistics; the Joint Staff; the military services; and the Defense Threat Reduction Agency to conduct these courtesy visits. According to OASD(HD&GS) officials, the team completed visits to the four selected installations—Joint Base Andrews, Maryland; Marine Corps Base Quantico, Virginia; Fort Bragg, North Carolina; and Naval Station Mayport, Florida—by June 2015. In commenting on a draft of this report, DOD stated that the Mission Assurance Senior Steering Group plans to share best practices and lessons learned gathered from these site visits to strengthen DOD insider threat efforts and help prevent future tragedies such as the Fort Hood shootings.

Inconsistent Reporting of Information and Limited Monitoring Hampers an Assessment of Fort Hood Recommendation Implementation

DOD reported that, as of March 2015, the department had fully implemented 73 of the 79 recommendations identified in the Fort Hood independent review—and approved by the Secretary of Defense—and was taking actions on the other 6 recommendations. However, we were unable to confirm the number of recommendations fully implemented because DOD and the military services were inconsistently reporting information and had conducted limited monitoring of recommendation implementation. Specifically, we found the following: Inconsistent reporting of recommendation implementation. Although DOD officials told us that as many as 73 of the 79 recommendations from the review of the 2009 Fort Hood shooting had been closed as implemented, we were unable to verify these had been implemented because DOD and the military services provided us inconsistent reporting of recommendations implemented. We identified the following two factors as potentially contributing to DOD’s inconsistent reporting of recommendations implemented. First, the military services reported the status of recommendations based on service-level implementation rather than department-level implementation. For example, in response to a recommendation for the department to revise current policies and procedures to address preventing violence toward others in the workplace, DOD closed the recommendation as implemented by issuing a policy on workplace violence prevention and response in January 2014. However, the Army and the Air Force reported that they were still taking action to address this recommendation based on the need to update their service-level implementing policies. Second, DOD reported that it closed recommendations that were partially under way, although the services reported such actions as in progress. DOD reported that it closed 10 recommendations that the military services were tasked to lead or support on behalf of the department even though all the military services reported they had not fully implemented the 10 recommendations. For example, DOD reported that it had closed a recommendation that the services were to review senior medical officers’ requirements to optimize utilization and assignments. While three services reported to us that they had implemented this recommendation, one service reported that it had not completed implementation. Similarly, DOD reported closing a recommendation that the services were to update policies to reflect current DOD-level guidance on the release of protected health information. While two services reported to us that they had implemented this recommendation, the other two services reported that they had not completed implementation. Further, according to DOD officials, DOD reported closing recommendations based on preliminary rather than final actions taken by DOD. For example, in response to a recommendation to improve efforts for sharing access control information, DOD stated it was developing a new guidance document; however, this guidance document is still in draft form and has not gone through the Federal Register process, according to DOD officials. Therefore, this recommendation should not have been considered fully implemented by DOD.

The Army Audit Agency and the DOD Inspector General cited similar concerns in three recent reports about the reliability of the status of Fort Hood recommendation implementation. In December 2012, the Army Audit Agency issued a report that assessed the Army headquarters’ progress in implementing recommendations from DOD’s review of the 2009 Fort Hood shooting. The Army Audit Agency concluded that the intentions of 13 recommendations stemming from the 2009 Fort Hood shooting were not met by the Army, and recommended that the Army reopen the recommendations and continue to monitor implementation. A February 2015 Army Audit Agency report, which examined whether nine selected Army installations had sufficiently implemented 18 selected Fort Hood recommendations, also noted that the Army may have prematurely closed 4 recommendations in addition to the 13 recommendations identified in the 2012 audit. The Army Audit Agency also found only 1 of 18 selected recommendations from the review of the 2009 Fort Hood shooting was fully implemented at the nine Army installations that the agency visited even though 11 of the 18 recommendations had been closed by the Army. In discussions with officials from the DOD Office of Inspector General about their ongoing review of DOD’s workplace violence prevention program, the DOD Inspector General found that DOD has not developed a comprehensive workplace violence prevention program, which resulted in the military services and the Defense Threat Reduction Agency using different approaches to address workplace violence. DOD Office of Inspector General officials told us this occurred, in part, because DOD did not exercise sufficient oversight to ensure the Fort Hood and Defense Science Board recommendations were properly addressed and closed.

Limited monitoring. We also were unable to confirm the number of Fort Hood recommendations implemented because DOD and the military services have conducted limited monitoring of the status of recommendations from the review of the 2009 Fort Hood shooting. DOD has established a mechanism and process for reviewing the status of recommendations at the department level. Specifically, the Deputy Assistant Secretary of Defense for Defense Continuity and Mission Assurance has convened monthly meetings for the Mission Assurance Coordination Boards’ Fort Hood Working Group to monitor implementation of the remaining Fort Hood recommendations. According to OASD(HD&GS) officials, the Fort Hood Working Group provides regular briefings to the Mission Assurance Coordination Boards’ senior leaders and they discuss whether specific recommendations should be closed as implemented or remain open as an effort in continued progress. However, we found that DOD was not monitoring implementation of the Fort Hood recommendations at the military service and installation levels. Specifically, officials from OASD(HD&GS) told us that DOD—through the Mission Assurance Coordination Boards—has not been monitoring implementation of actions from military service follow-on reviews of the 2009 Fort Hood shooting. According to the 2013 DOD Mission Assurance Strategy Implementation Framework, the Mission Assurance Coordination Boards’ initial objectives included ensuring completion of all Fort Hood independent review activities as directed by the Secretary of Defense. In 2010, the Secretary of Defense issued a memorandum that tasked the ASD(HD&GS)—one of two key leaders of the Mission Assurance Coordination Boards—to report on progress made by the military services. Officials from OASD(HD&GS) told us they did not monitor the progress of the military services’ efforts to take action based on their internal reviews of the 2009 Fort Hood shooting and that they believed the services were in the best position to report on their progress on implementing recommendations. However, these officials acknowledged that the Assistant Secretary’s monitoring responsibility was never removed by the Secretary of Defense. Also, while OASD(HD&GS) officials believe that services are in the best position to report on their progress on implementing recommendations, we found that the services were not consistently monitoring the implementation of recommendations at their installation levels. For example, service headquarters officials from three services told us that they generally do not monitor implementation of the recommendations from the reviews of the 2009 Fort Hood shooting at the installation level. As previously stated, a February 2015 Army Audit Agency report found that the Army had prematurely closed recommendations related to the 2009 Fort Hood shooting, based on the Army Audit Agency’s review of implementation of 18 selected Fort Hood recommendations at nine selected installations. Officials from OASD(HD&GS) acknowledged that periodic reports from the military services would provide the Mission Assurance Coordination Boards with a more complete understanding of the extent to which the military services have implemented the recommendations from the 2009 Fort Hood shooting.

According to federal internal control standards, program managers need operational data to determine whether they are meeting their agencies’ goals for accountability and such pertinent information should be identified, captured, and distributed in a form and time frame that permits people to perform their duties efficiently. Internal control standards also state that monitoring of internal control should assess the quality of performance over time and ensure that the findings of reviews are promptly resolved. Until the military services provide the Mission Assurance Coordination Boards consistent reporting of information on the implementation of recommendations, DOD will not be able to ensure the reliability of its reporting on the status of the recommendations from the official review of the 2009 Fort Hood shooting. Further, until the Mission Assurance Coordination Boards and military services consistently monitor Fort Hood recommendation implementation at the service and installation level, DOD will be unable to know whether the deficiencies identified in the independent review of the 2009 Fort Hood shooting have been addressed on U.S. installations. In addition, by improving consistent reporting of information and monitoring—such as through developing criteria for consistent reporting on the progress of recommendations and having the military services provide periodic status reports—DOD will be better positioned to provide complete and accurate information in its report to Congress on Fort Hood recommendation implementation as required by the Carl Levin and Howard P. “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015.

DOD Has Taken Initial Actions to Implement Washington Navy Yard Recommendations

In response to the official reviews from the 2013 Washington Navy Yard shootings, the Secretary of Defense and the Secretary of the Navy issued memorandums directing DOD components to implement the recommendations and provide progress reports on the status of the recommendations. The department has taken initial actions towards implementing the four recommendations that were tasked by the Secretary of Defense. For example, in June 2014, DOD issued an implementation plan that lays out major milestones, timelines, responsibilities, and resource requirements needed to address the findings and four recommendations. According to the implementation plan, implementation of these four recommendations will take years to complete. For example, the plan calls for funding and fielding of an Identity Matching Engine for Security and Analysis system at DOD installations through fiscal year 2019 and beyond. Nonetheless, DOD has begun to undertake actions identified in this plan. The following are examples of DOD’s initial efforts: In response to a recommendation to field the Identity Matching Engine for Security and Analysis system, DOD installed the system at 127 Air Force and Defense Logistics Agency sites as of June 2015 with plans to roll out the system to the rest of the department through fiscal year 2019 and beyond. In response to a recommendation to implement continuous evaluation, the Washington Navy Yard Task Force Implementation Plan stated that the department was going to meet this recommendation by enhancing the throughput capacity of DOD’s existing first-generation Automated Continuing Evaluation System while concurrently developing the system’s next generation. According to the Implementation Plan and DOD officials, the department is piloting the enhanced first-generation system and is developing a second generation of the system. In response to a recommendation to create a DOD Insider Threat Management and Analysis Center, the Under Secretary of Defense for Intelligence has directed the Director of the Defense Security Service to establish the center. We previously reported in June 2015 that DOD had not issued a concept of operations and other planning documents that identify the center’s actual functions, scope, level of involvement expected from DOD components, level of DOD involvement, depth of analysis to be completed at the center, and the relationship between the center and the services’ existing threat- analysis centers. In response to a draft of this report, DOD provided a draft version of the concept of operations that the department plans to publish in the summer of 2015. According to DOD officials, the concept of operations, in combination with a DOD instruction on DOD Insider Threat Management and Analysis Center operations, will facilitate the analysis and response functions critical to identifying and mitigating the threat posed by insiders.

DOD has initiated efforts to address a recommendation to centralize authority and accountability under the Under Secretary of Defense for Intelligence as the principal staff assistant to the Secretary of Defense for insider threat issues. Specifically, in 2014, DOD issued Directive 5205.16 that states that the Under Secretary of Defense for Intelligence serves as the senior official and principal civilian advisor to the Secretary of Defense on the DOD Insider Threat Program.

Similarly, the Navy and Marine Corps have taken actions toward implementing the 2013 Washington Navy Yard recommendations that were tasked by the Secretary of Navy. For example, the Navy has developed specific training material on the principles of its personnel security program and force protection. Also, according to Marine Corps officials, all Marine Corps installations are now conducting active shooter training as part of their annual exercises. While the services have taken these initial actions, as of March 2015, the Navy reported that it had implemented 12 (15 percent) of 79 recommendations from the internal base security report, the Marine Corps reported that it had fully implemented 9 (31 percent) of the 29 recommendations identified in the internal base security report, and we found that the Navy had fully implemented 13 (87 percent) of the 15 recommendations identified in the in-depth assessment of the events leading up to and during the Washington Navy Yard incident.

Conclusions

The insider attacks at Fort Hood in 2009 and the Washington Navy Yard in 2013 claimed the lives of 25 people and wounded 36 others, highlighting the need for DOD to address threats to U.S. installations by those personnel with authorized access. While we found that 3 of the 10 key force protection policy and guidance documents do not address insider threat considerations, DOD is taking steps to update these documents. Addressing gaps we identified in these 3 documents as well as addressing the policy gap we identified would provide DOD components with clearer and more comprehensive procedures for preventing, detecting, deterring, and taking actions in response to insider threats at U.S. installations.

Installations we visited have taken actions to protect against insider threats, such as training personnel on active shooter scenarios. However, until DOD more consistently shares leading practices and lessons learned on actions taken to protect against insider threats through the consistent use of existing information-sharing mechanisms, commanders and DOD leadership might miss opportunities to enhance force protection against insider threats at installations across the United States.

Finally, DOD has taken actions to implement recommendations in the wake of the 2009 Fort Hood and 2013 Washington Navy Yard shootings, such as establishing active shooter training. Because the military services have not provided the Mission Assurance Coordination Boards consistent information on the status of Fort Hood recommendation implementation, DOD is hampered in its ability to assess the extent to which it can deter, prevent, detect, and take action to counter insider threats where it matters most—at the installation level. Until the Mission Assurance Coordination Boards and the military services provide consistent reporting of information and conduct improved monitoring of recommendation implementation, the department will be unable to capitalize on the progress it has made and will be unable to assess whether efforts to mitigate the risk of insider threats to DOD personnel and installations in the United States have been achieved.

Recommendations for Executive Action

To assist U.S. installations in protecting against insider threats, we recommend that the Secretary of Defense direct the military services to share information about actions U.S. installations have taken to address insider threats by consistently using existing mechanisms—such as working groups, lessons-learned information systems, and antiterrorism web portals.

To assist DOD leadership in their oversight and decision-making process, we recommend that the Secretary of Defense direct the DOD leaders on the Mission Assurance Coordination Boards and the military services to take steps to improve the consistency of reporting and monitoring of the implementation of recommendations from the independent review of the 2009 Fort Hood shooting. Such steps could include DOD and the military services developing criteria for consistent reporting on the progress of recommendations and the military services providing periodic reports to the Mission Assurance Coordination Boards on the status of Fort Hood recommendations at the service level and installation level.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD for comment. In its written comments, which are reprinted in appendix III, DOD concurred with the two recommendations and cited actions the department is currently taking to address the recommendations. The Departments of Homeland Security and Justice reviewed a draft of this report but did not provide any comments.

In response to our recommendation that the Secretary of Defense direct the military services to share information about actions U.S. installations have taken to address insider threats by consistently using existing mechanisms, DOD stated that the department has working groups in place within the Office of the Under Secretary of Defense for Intelligence and the Mission Assurance Senior Steering Group that act as venues for sharing best practices and lessons learned related to insider threats. DOD also stated that it conducted a series of site visits to installations and that the Mission Assurance Senior Steering Group will share the best practices and lessons learned from those visits with the DOD components. These are helpful steps toward identifying and sharing information to support the department’s effort to address insider threats. However, the information-sharing actions that DOD identified in its comments are actions that are occurring at senior DOD levels and not at the installation level. In addition, DOD stated that it established a DOD insider threat website within the past year that is a potential source for components seeking the latest insider threat information. However, during our visits to selected installations, officials we spoke with did not mention this website. Therefore, we continue to believe that it is important for DOD to continue the progress it has made by increasing communication about the existence of the department’s resources for sharing information on best practices and lessons learned, such as this website, down to the military services and installations.

In response to our recommendation that the Secretary of Defense direct the DOD leaders on the Mission Assurance Coordination Boards and the military services to take steps to improve the consistency of reporting and monitoring of the implementation of recommendations, DOD stated that the Mission Assurance Senior Steering Group will monitor the status of Fort Hood recommendations at the military service level to ensure full implementation. To the extent that the senior steering group monitors the military services, DOD will be better positioned to have situational awareness of the rate at which the services have implemented the recommendations. However, in its comments to the draft report, DOD did not state whether the military services will take steps to improve their monitoring of recommendation implementation at the installation level. We believe it remains important for the military services to extend efforts to monitor recommendation implementation at the installation level. This will better position the military services and DOD to know whether problems or deficiencies associated with prior insider attacks have been addressed.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Secretary of Homeland Security, the Attorney General of the United States, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please contact me at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report evaluates the extent to which the Department of Defense (DOD) has (1) reflected insider threat considerations in its force protection policies and other guidance, (2) shared actions that U.S. installations have taken to protect against insider threats, and (3) implemented recommendations from the official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings. As discussed with your committee, we focused our review on insider threats to force protection at U.S. installations and did not include DOD’s overseas facilities.

To evaluate the extent to which DOD force protection policies and other guidance reflect insider threat considerations, we obtained and reviewed 10 key DOD policies and other guidance documents related to force protection. We selected the 10 key policies and other guidance documents by reviewing the DOD Directive 5205.16, The DOD Insider Threat Program, and the DOD independent and internal reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings for references to policies and guidance related to force protection. We verified these 10 policies and other guidance documents with officials within the Office of the Assistant Secretary of Defense for Homeland Defense and Global Security (OASD) and the Office of the Under Secretary of Defense for Intelligence as key to addressing force protection across the department.

The 10 policies and other guidance documents we selected were 1. Chairman of the Joint Chiefs of Staff, Joint Publication 3-07.2, Antiterrorism (Mar. 14, 2014); 2. DOD Instruction 1438.06, DOD Workplace Violence Prevention and Response Policy (Jan. 16, 2014); 3. DOD Instruction 2000.12, DOD Antiterrorism (AT) Program (Mar. 1, 2012) (incorporating change 1, effective Sept. 9, 2013); 4. DOD Instruction 2000.16, DOD Antiterrorism (AT) Standards (Oct. 2, 2006) (incorporating change 1, effective Dec. 8, 2006); 5. DOD Instruction 2000.26, Suspicious Activity Reporting (SAR) (Sept. 23, 2014); 6. DOD Directive 5200.43, Management of the Defense Security Enterprise (Oct. 1, 2012) (incorporating change 1, effective Apr. 24, 2013); 7. DOD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR) (May 17, 2011) (incorporating change 1, effective May 30, 2013); 8. DOD Instruction 5240.22, Counterintelligence Support to Force Protection (Sept. 24, 2009) (incorporating change 1, effective Oct. 15, 2013); 9. DOD Instruction 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence Insider (CI) Threat (May 4, 2012) (incorporating change 1, effective Oct. 15, 2013); and 10. DOD Instruction 6055.17, DOD Installation Emergency Management (IEM) Program (Jan. 13, 2009) (incorporating change 1, effective Nov. 19, 2010).

We reviewed the key policies and other guidance documents to determine whether DOD had reviewed and updated them to incorporate recommendations from the independent review of the 2009 Fort Hood shooting that directed the department to integrate force protection efforts, such as developing policy and procedures to defend against insider threats; insider threat considerations based on annual review requirements outlined in DOD Instruction 5025.01, DOD Issuances Program; and requirements for four minimum training topics addressing insider threat awareness: the importance of detecting potential insider threats by cleared employees and reporting suspected activity to insider threat personnel or other designated officials; methodologies of adversaries to recruit trusted insiders and collect classified information; indicators of insider threat behavior and procedures to report such behavior; and counterintelligence and security reporting requirements.

We also interviewed officials within the Office of the Secretary of Defense and the military services (the Army, Navy, Marine Corps, and Air Force) to obtain their perspectives on DOD force protection policy and its application to addressing insider threats.

To evaluate the extent to which DOD has shared actions that U.S. installations have taken to protect against insider threats, we selected and conducted site visits at eight military installations located in the United States. Although findings from these eight installations are not generalizable to all installations, they provide context about the actions taken by these selected installations to protect against insider threats. In selecting installations to visit, we developed a methodology that included installations that experienced insider attacks since 2009—Fort Hood and Washington Navy Yard—as well as a selection of installations that have not had an attack during this period. We also included the Pentagon in our selection of installations to visit based on it being a high-value installation as the headquarters of the Department of Defense. We used the Department of Defense military installations website (www.militaryinstallations.dod.mil) as the source of information for the universe of military installations. We determined the list of installations on this website to be sufficiently reliable as a source of information on U.S. installations for each of the military services for the purposes of site selection. We based our selection of installations that have not had an insider attack since 2009 on proximity to Fort Hood and Washington Navy Yard and proximity to GAO office locations. In addition, we considered military service representation, joint basing, and geographic representation based on U.S. Census regions as additional selection criteria. Based on these considerations, we selected five additional installations—one from each military service and one joint base—to visit from our universe of installations. For the purpose of site selection, we focused on active-duty military installations and did not select Reserve and National Guard installations, military service depots, or recruiting stations and commands as part of our review. In order to avoid duplication of effort with other ongoing DOD Inspector General work reviewing DOD’s efforts to address workplace violence prevention, we did not include two installations—Joint Base Lewis-McChord and Travis Air Force Base. Based on this methodology, we selected the following installations to visit: Fort Hood, Texas; Rock Island Arsenal, Illinois; Washington Navy Yard, D.C.; Naval Submarine Base New London, Connecticut; Peterson Air Force Base, Colorado; Joint Base San Antonio, Texas; Marine Corps Base Quantico, Virginia; and the Pentagon, Virginia.

As part of our site visits, we reviewed installation exercise information and after-action reports provided to us by installation officials, as well as DOD policies and guidance on antiterrorism, force protection, and lessons learned. We compared information gathered from installation officials on actions taken at their respective installation to DOD guidance containing recommendations for promoting information sharing on measures to address insider threats, and to federal internal control standards for sharing information within an organization. We also conducted interviews with officials from the Office of the Under Secretary of Defense for Intelligence, OASD(HD&GS), and each military service headquarters to determine what actions the department and military services have taken to address insider threats, including the identification and sharing of any measures to address insider threats across the department. Further, we interviewed officials at the eight selected U.S. installations to discuss their knowledge of efforts to protect against insider threats at their respective installations.

To determine the extent to which DOD has implemented recommendations from the official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings, we evaluated the actions that DOD components had taken in response to reviews that either the Secretary of Defense or Secretary of Navy tasked appropriate DOD components to take as a result of the 2009 Fort Hood shooting and the 2013 Washington Navy Yard shooting. Specifically, for the 2009 Fort Hood shooting, we considered the DOD independent review commissioned by the Secretary of Defense and the service internal reviews that were directed by the Secretary of Defense as “official reviews” for the 2009 Fort Hood shooting. Similarly, we considered the DOD internal review and the independent review—both of which were directed by the Secretary of Defense—and the two Navy internal reviews directed by the Secretary of the Navy as “official reviews” for the 2013 Washington Navy Yard shooting. In addition, we sent two separate questionnaires about the two shootings to OASD(HD&GS) and the Office of the Under Secretary of Defense for Intelligence. In addition, we sent the military services copies of the two questionnaires and requested information on the implementation status at the military service level of each recommendation from the Fort Hood and Washington Navy Yard reviews. For each of the Fort Hood and Washington Navy Yard recommendations, DOD and the military services were asked to state whether no actions had been taken; efforts had been taken, but the recommendation had not been fully implemented; the recommendation was fully implemented; or the recommendation was closed without implementation. We compared the questionnaire responses from OASD(HD&GS) to the responses from the military services and found that we were unable to confirm the number of recommendations fully implemented by DOD and the military services for the Fort Hood independent review because they were inconsistently reporting information and had conducted limited monitoring of recommendation implementation. For example, DOD officials reported that as many as 73 of the 79 recommendations from the review of the 2009 Fort Hood shooting had been closed as implemented, but this reporting was not consistent with responses from the military services. Further, although we reviewed these 79 recommendations and determined that the military services were tasked to lead or support at least 16 of the Fort Hood recommendations, DOD and military service officials provided differing questionnaire responses on the implementation status of 10 recommendations that the military services were tasked lead or support.

In addition to this analysis, we also reviewed the military services’ internal reviews of the incidents. We analyzed documents from and interviewed military service officials to better understand the services’ efforts to address insider threats and the recommendations from service internal reviews. We conducted interviews with officials from the Office of the Under Secretary of Defense for Intelligence, the OASD(HD&GS), the Department of the Navy, each military service headquarters, and eight selected U.S. installations to review the extent to which DOD has implemented recommendations from official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings. We also interviewed officials from the Department of Homeland Security and Federal Bureau of Investigation to understand the extent to which they supported DOD in implementing recommendations from the official reviews. Finally, we consulted with officials from the DOD Office of Inspector General and Army Audit Agency—both of whom were conducting similar reviews during our engagement—and obtained documents from those two agencies.

We conducted this performance audit from July 2014 to July 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Department of Defense (DOD) and Service Reviews of the 2009 Fort Hood and 2013 Washington Navy Yard Shootings

Independent Review of 2009 Fort Hood Shooting

In the wake of the 2009 Fort Hood shooting, the Secretary of Defense directed an independent review of the incident to determine whether there were programs, policies, and procedural weaknesses within DOD that created vulnerabilities to the health and safety of the department’s employees and their families. Specifically, the Secretary of Defense asked the independent review panel to identify and address (1) possible gaps, deficiencies, or both in DOD’s programs, processes, and procedures related to identifying DOD employees who could potentially pose credible threats to themselves or others; (2) the sufficiency of DOD’s force protection programs; (3) the sufficiency of DOD’s emergency response to mass casualty situations at DOD facilities; and (4) the response to care for victims and families in the aftermath of a mass casualty situation. The results of the independent review, which were released in January 2010, identified 79 recommendations that the department should take to address findings associated with personnel policies, force protection, emergency and mass casualty response, and support to DOD healthcare providers.

In January 2010, the Secretary of Defense directed the Assistant Secretary of Defense for Homeland Defense and Global Security (ASD) to conduct a follow-on review to determine appropriate implementation of corrective actions recommended by the independent review. The Secretary of Defense also directed the Secretaries of the military departments, combatant commanders, and the heads of the other DOD components, informed by the report of the independent review panel, to initiate internal reviews in support of the follow-on review. These reviews were to assess their organization’s ability below the headquarters level to identify internal threats and force protection and emergency response programs, policies, and procedures. As directed, the military services each produced a report based on their respective Fort Hood internal reviews and submitted them to the Secretary of Defense for his consideration in determining which recommendations to implement from the independent review of the 2009 Fort Hood shooting.

On August 18, 2010, the Secretary of Defense generally approved 79 recommendations identified in the independent review and directed the DOD components to take specific actions associated with those recommendations as identified in an attachment to the memorandum. The Secretary of Defense in his August 2010 memorandum also directed the ASD(HD&GS) to provide regular implementation progress reports to the Secretary of Defense, not only on those measures he approved, but also on progress by the military department Secretaries and combatant commanders to mitigate issues identified in their independent internal reviews. The Force Protection Senior Steering Group, which was established in August 2010, was responsible for monitoring implementation of the Fort Hood force protection-related recommendations. In October 2013, the Mission Assurance Coordination Boards assumed responsibility for monitoring recommendation implementation from the independent review of the 2009 Fort Hood shooting. The boards established a Fort Hood Working Group to track and monitor the status of implementation of the Fort Hood recommendations. The Mission Assurance Coordination Boards include representatives from the military departments, the offices of the Under Secretaries of Defense, the Office of the Director of Cost Assessment and Program Evaluation, the Office of the DOD Chief Information Officer, the Office of the Director of Administration and Management, the National Guard Bureau, the combatant commands, and the Office of the General Counsel.

DOD Internal Review and an Independent Review of the 2013 Washington Navy Yard Shooting

In response to the September 2013 Washington Navy Yard shooting, the Secretary of Defense directed an independent review and an internal review of the incident to identify and recommend actions to address gaps or deficiencies in DOD programs, policies, or procedures regarding security at DOD installations and the granting and renewing of security clearances for DOD employees and contractor personnel. Both the Washington Navy Yard independent review and internal review were released in November 2013 and identified actions that were intended to improve DOD’s force protection posture from insider threats. In March 2014, the Secretary of Defense directed DOD to implement four key recommendations that were a compilation of a number of recommendations from the Washington Navy Yard independent review and internal review. The Secretary of Defense tasked the Under Secretary of Defense for Intelligence to lead a task force to develop and coordinate an implementation plan for the four key recommendations. The Secretary of Defense also directed the Under Secretary of Defense for Intelligence to study three additional recommendations from the Washington Navy Yard independent review. The Defense Security Enterprise Executive Committee—chaired by the Deputy Under Secretary of Defense for Intelligence and Security—assumed responsibility for monitoring progress of actions taken to implement the four approved recommendations from the Washington Navy Yard implementation plan.

Internal Service Reviews of the 2013 Washington Navy Yard Shooting

In addition, the Department of the Navy conducted two internal service reviews in response to the Washington Navy Yard shootings. Specifically, in a September 2013 memorandum, the Secretary of the Navy directed Admiral John M. Richardson to conduct an in-depth investigation into the full range of security, contractor, personnel, and other factors related to the Washington Navy Yard shootings. As a result of this in-depth investigation, Admiral Richardson issued a report that identified 15 recommendations to the Department of the Navy addressing contractor security; personnel security management; and additional actions to improve force protection, antiterrorism, and emergency management. Additionally, in an October 11, 2013, memorandum, the Secretary of the Navy directed the Chief of Naval Operations and the Commandant of the Marine Corps to conduct a thorough ongoing review of physical security on naval installations that, among other things, assessed military service access control policy and procedures and risk mitigation measures; evaluated training and education programs to identify contributing factors and behavioral indicators of potentially violent actors; and identified barriers to physical security and access control policy implementation. On October 31, 2013, the commanders of U.S. Fleet Forces Command and U.S. Marine Corps Forces Command issued a consolidated report that identified 79 recommendations for the Navy to implement and 29 recommendations for the Marine Corps to implement. The recommendations focused on a range of topics, such as assessments of behavioral indicators, an insider threat analysis entity within the Marine Corps, and improved training for commanders and security personnel on violence prevention and active shooter response.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Tommy Baril, Assistant Director; Ashley Hess; Amber Lopez Roberts; Michael Pose; and Edwin Yuen made key contributions to this report. Tracy Barnes, Richard Powelson, Terry Richardson, Monica Savoy, and Amie Steele also made important contributions.

Related GAO Reports

Insider Threats: DOD Should Strengthen Management and Guidance to Protect Classified Information and Systems. GAO-15-544. Washington, D.C.: June 2, 2015.

Personnel Security Clearances: Funding Estimates and Governmentwide Metrics Are Needed to Implement Long-Standing Reform Efforts. GAO-15-179SU. Washington, D.C.: April 23, 2015.

Military Personnel: DOD Needs to Take Further Actions to Prevent Sexual Assault during Initial Military Training. GAO-14-806. Washington, D.C.: September 9, 2014.

Personnel Security Clearances: Additional Guidance and Oversight Needed at DHS and DOD to Ensure Consistent Application of Revocation Process. GAO-14-640. Washington, D.C.: September 8, 2014.

Federal Facility Security: Additional Actions Needed to Help Agencies Comply with Risk Assessment Methodology Standards. GAO-14-86. Washington, D.C.: March 5, 2014.

Personnel Security Clearances: Actions Needed to Ensure Quality of Background Investigations and Resulting Decisions. GAO-14-138T. Washington, D.C.: February 11, 2014.

Personnel Security Clearances: Opportunities Exist to Improve Quality Throughout the Process. GAO-14-186T. Washington, D.C.: November 13, 2013.

Personnel Security Clearances: Full Development and Implementation of Metrics Needed to Measure Quality of Process. GAO-14-157T. Washington, D.C., October 31, 2013.

Afghanistan Security: New Steps Taken to Address Insider Attacks, but DOD Has Not Always Ensured That Personnel Are Prepared for Casualty Assessment Teams. GAO-13-838SU. Washington, D.C.: September 30, 2013.

Information Sharing: Additional Actions Could Help Ensure That Efforts to Share Terrorism-Related Suspicious Activity Reports Are Effective. GAO-13-233. Washington, D.C.: March 13, 2013.

Afghanistan Security: Renewed Sharing of Biometric Data Could Strengthen U.S. Efforts to Protect U.S. Personnel from Afghan Security Force Attacks. GAO-12-471SU. Washington, D.C.: April 20, 2012.