We provided a draft of this report to State, DOD, and USAID for review. None of the agencies provided formal comments. However, State provided technical comments, which we have incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretaries of State and Defense, and to the USAID Administrator. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-8980 or courtsm@gao.gov, or the individual(s) listed at the end of each enclosure. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff members who made key contributions to this report are listed in appendix VII. Background The Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security) manages much of the security-related funding within State’s Diplomatic and Consular Programs budget, the largest category of which comes from the Worldwide Security Protection account. Salaries for Diplomatic Security personnel are managed separately by State’s Bureau of Budget and Planning. Issue Total funding for Diplomatic Security operations was almost $4.8 billion in fiscal year 2016. Total funding for Diplomatic Security includes its bureau managed funds as well as other funding—such as personnel salaries— managed by other bureaus and offices but necessary for Diplomatic Security operations. Diplomatic Security’s bureau managed funds ($3.3 billion in fiscal year 2016) are composed of funds received through annual appropriations, fees collected through visa processing, reimbursements from other agencies, and appropriated funds carried over from prior fiscal years. These funds support regular, ongoing operations and Overseas Contingency Operations (OCO) for temporary, war-related operations. State directed an additional $1.5 billion to Diplomatic Security and its employees in 2016, through other bureaus and offices. Key Findings In fiscal year 2016, Diplomatic Security’s bureau managed funds totaled approximately $3.3 billion. Bureau managed funds have increased in response to multiple security incidents since the 1998 bombings of the U.S. embassies in Kenya and Tanzania. (Fig. 1 shows that Diplomatic Security’s bureau managed funds had tremendous growth from 1998 through 2016 in both real and nominal dollars.) F Figure 1: Historical Trend in Department of State Bureau of Diplomatic Security Managed Funds, 1998-2016 From 1995 to 1998, Diplomatic Security’s bureau managed funds averaged about $173 million annually. After the 1998 bombings in Africa, bureau managed funds grew to $784 million in 1999 as Congress provided Diplomatic Security with emergency supplemental funding to address security vulnerabilities at posts worldwide. By fiscal year 2009, bureau managed funds had grown to about $2.0 billion, largely due to new security procedures put in place after 1998 as well as the need to provide security for diplomats in the conflict zones of Iraq and Afghanistan. Bureau managed funds increased in 2010 to $2.7 billion and in 2012 to $3.3 billion, as the U.S. military began to withdraw from Iraq and Diplomatic Security assumed many of the protective and security functions previously provided by the U.S. military in that country. Congress appropriated less funding in 2013 to the Worldwide Security Protection account because, according to Diplomatic Security, appropriated funds were carried over from prior years. The subsequent increases in funding for that account in 2014 through 2016 followed the 2012 attack in Benghazi, Libya. Since 2012, OCO supplemental funding has made up 34-62 percent of Diplomatic Security’s bureau managed funds. For example, in fiscal year 2016, OCO funding totaled over $2.0 billion—or 62 percent—of bureau managed funds for that year. According to a bureau official, State’s OCO funding was intended to be temporary funding to support operations in Iraq, Afghanistan, and Pakistan but continues to exist, given the security situation in those countries, and has expanded beyond those three countries. Some State officials are concerned that if OCO is discontinued, State would not have sufficient funding to provide necessary security services. For fiscal year 2018, the administration is requesting less OCO funding than the final appropriated amount for fiscal year 2017. Funding for Diplomatic Security operations totaled almost $4.8 billion in fiscal year 2016. This amount includes both bureau managed funds— which were almost $3.3 billion—and other funding directed to Diplomatic Security and its employees but managed by other bureaus and offices within State (personnel salaries, Antiterrorism Assistance funding, guard services funding, and fraud prevention and detection fees), which totaled almost $1.5 billion. For example, State’s Bureau of Budget and Planning manages the salaries of Diplomatic Security personnel. Funding for Diplomatic Security personnel increased from $12 million in 2000 to $419 million in 2016. In addition, State allocates funding to its Bureau of Overseas Buildings Operations for security construction at overseas facilities. Point of Contact For more information, contact: Michael J. Courts, (202) 512- 8980, courtsm@gao.gov 1. What impact has Diplomatic Security’s increased funding had on its ability to carry out its mission? Are current funding levels sufficient? 2. What are State’s plans for utilizing future Diplomatic Security funding? Will there be additional carryover funds in future years, as in 2013? Background The Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security), which is responsible for the protection of State’s people, property, and information, relies on a broad workforce to carry out its mission and activities. Its workforce includes direct-hire personnel, military support, and contractors. Posts also engage locally employed staff. Issue Over the last 2 decades, Diplomatic Security’s mission and activities have expanded in response to a number of security incidents, which has led to a dramatic increase in the size of its workforce. The growth in its responsibilities overseas began with the 1998 attacks in Africa and continued with the U.S. policy of maintaining a diplomatic presence in war zones such as Afghanistan and Iraq and other increasingly hostile environments. In addition, the September 11, 2001, terrorist attacks underscored the importance of enhancing domestic security, including Diplomatic Security’s investigative capacity, technical programs, and counterintelligence work. This sustained and at times rapid growth has taxed Diplomatic Security’s ability to staff positions with the appropriate level of experience and skills. Key Findings Diplomatic Security’s workforce—numbering over 51,000 direct-hire, other U.S. government, and contract personnel as of May 2017—has experienced continued growth in almost all staffing categories. We previously reported in 2009 that Diplomatic Security’s direct-hire work force doubled from 1998 to 2008. Since then, it has increased by another 36 percent to 3,488 personnel in 2017. If State’s current hiring freeze is lifted, Diplomatic Security officials told us that they plan to hire an additional 384 special agents in 2017 through 2018. The number of other U.S. government personnel reporting to Diplomatic Security increased by 60 percent, driven largely by the expansion of the Marine Security Guard program after the 2012 Benghazi attacks. Diplomatic Security increased its contracted and support staff by 22 percent. (Table 1 provides information on the increases in Diplomatic Security staff from 2008 through 2017; see app. IV for further staffing details.) In response to a Benghazi Accountability Review Board recommendation, State established a panel to reexamine Diplomatic Security’s organization and management. In 2013, the panel reported that, in part, Diplomatic Security had become more focused on its law enforcement and personnel protection functions. This was not surprising, according to the panel, given that Diplomatic Security provided security in two war zones and numerous other high-threat posts. Simultaneously, Diplomatic Security had experienced an increased demand on its domestic criminal investigative and dignitary protection programs. Nonetheless, the panel noted that Diplomatic Security’s primary mission is “to provide a secure environment for the conduct of U.S. foreign policy” and stated that Diplomatic Security should reflect this priority in its allocation of manpower and other resources. For example, the panel recommended that Diplomatic Security review personnel allocations both domestically and abroad. As of June 2017, Diplomatic Security had completed an initial classified review of its staffing and begun a follow- on study to (1) determine how Diplomatic Security has distributed its staff relative to its priorities; and (2) develop a methodology to assess the quantity, mix, and distribution of Diplomatic Security staff worldwide. According to Diplomatic Security, the second study is expected to result in two tools that Diplomatic Security can use for evaluating its staffing levels: one for domestic staffing and one for overseas staffing. In fiscal year 2010, we reported that 34 percent of Diplomatic Security’s positions were filled with officers below the position’s grade. In 2013, the organization and management panel noted that many Diplomatic Security regional director positions were filled by officers holding ranks below the levels established for that position (not including agents posted to Baghdad, Iraq). The panel recommended that Diplomatic Security prioritize filling these positions with at-grade personnel. While State concurred, as of June 2017, it had not identified any new, concrete actions for implementing this recommendation. Instead, State noted that it “will continue to make every effort to place at-grade, experienced, and highly qualified individuals into these positions.” As of December 2016, Diplomatic Security had 422 staffed language- designated positions (LDP), of which 304—or 72 percent—were filled with special agents who met the language requirement. This is an improvement since 2009, when we reported that only 47 percent of Diplomatic Security special agents at LDPs met the requirement. Officials cited two reasons for this increase in compliance: (1) greater agency emphasis on the need for agents to have language skills following the 2012 Benghazi attacks and (2) increased emphasis on speaking rather than reading skills. As a result, Diplomatic Security has an increased number of “asymmetrical” language requirements, where the speaking-level requirement is higher than the reading-level requirement. Diplomatic Security also adopted the “Alert” language training program, which provides special agents with speaking skills relevant to their technical work, particularly for languages spoken at certain high-threat posts. State officials told us that agents can become proficient in 10 weeks using this program, versus 30 weeks typically required for traditional methods. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov ensure that it has the appropriate quantity, mix, and distribution of staff to address its overseas and domestic responsibilities? 2. What steps has Diplomatic Security taken to ensure that its positions are filled with appropriately experienced staff? 3. What is State doing to further close the gaps in Diplomatic Security’s LDPs? Background Responsibility for the security of the Department of State’s (State) diplomatic facilities falls principally on State’s Bureaus of Overseas Buildings Operations (OBO) and Diplomatic Security (Diplomatic Security). OBO is responsible for the design, construction, acquisition, maintenance, and sale of U.S. diplomatic property abroad. Diplomatic Security is responsible for establishing security and protective procedures at posts and developing and implementing the physical security programs. Maintaining the physical security of U.S. diplomatic facilities is a critical component of ensuring the safety of U.S. personnel, property, and information. According to OBO, State maintains approximately 1,600 work facilities at 275 diplomatic posts worldwide under chief-of-mission authority. In addition, State has a limited number of temporary work facilities, mostly in dangerous locations such as Afghanistan. All facilities at a post are expected to meet physical security standards set by the Overseas Security Policy Board. In fiscal years 2009 through 2016, State allocated about $11.1 billion to the construction of new, secure facilities and physical security upgrades to existing and acquired facilities. While Diplomatic Security has a few small programs to provide physical security upgrades to facilities abroad, OBO managed most of the allocated funds. Key Findings Following the 1998 attacks on U.S. embassies in Kenya and Tanzania, State determined that diplomatic facilities in over 180 posts—more than half of U.S. overseas missions—needed to be replaced to meet security standards. In 1999, State began a new embassy construction program, administered by OBO, to replace these posts. To expedite the delivery of new, secure compounds, OBO adopted a standard embassy design (SED) approach. However, some stakeholders raised concerns about the aesthetics, quality, location, and functionality of those facilities. For example, the 10-acre lot specified by the SED sometimes required situating an embassy far from urban centers, where foreign government offices and other embassies are located. In response to these concerns, State established the “Excellence” approach in 2011. (See fig. 3 for a picture of an embassy built under SED and a rendering of a consulate to be delivered under the Excellence approach.) OBO’s changes under the Excellence approach focus on producing more innovative, functional, and sustainable embassies that are just as secure as those built using the SED. However, some stakeholders have raised concerns that the new approach may result in embassies that take longer and cost more to build. This would delay getting U.S. personnel into facilities that meet current security standards. In 2017, we reported that, while the Excellence approach may result in improvements, it carries increased risk to cost and schedule—including up to 24 additional months to develop designs. While OBO is attempting to manage this risk, it does not have performance measures specific to the Excellence goals and, therefore, cannot fully assess the merits of the new approach. We made four recommendations to strengthen performance measures and reporting, monitoring mechanisms, and data systems. While State concurred with these recommendations, they remain open. When facilities do not or cannot meet certain security standards, State works to mitigate identified vulnerabilities through various construction programs and its waivers and exceptions process. However, in 2014, we reported that the waivers and exceptions process had weaknesses. Of the 43 facilities we reviewed, none met all applicable security standards and therefore required waivers, exceptions, or both. However, we found that neither posts nor headquarters systematically tracked the waivers and exceptions and that State had no process to reevaluate waivers and exceptions when the threat or risk changes. Furthermore, posts did not always request required waivers and exceptions or consistently take required mitigation steps. We concluded that with such deficiencies, State cannot be assured it has all the information needed to mitigate facility vulnerabilities. We made 13 recommendations for State to address gaps in its security-related activities, standards, and policies. State generally agreed with our recommendations and, as of June 2017, had addressed five of them. Future State construction in dangerous posts—such as Kabul, Afghanistan—will likely entail the continued use of temporary office or residential facilities, especially in conflict areas. However, in 2015, we found that in Kabul—without security standards or other guidance to guide temporary facility construction in conflict environments—State inconsistently applied alternative security measures that resulted in insufficient and different levels of security for temporary offices and housing as well as increased costs and extended schedules. We concluded that without temporary facility security standards or guidance, future construction in conflict environments could encounter similar problems. We recommended that State consider establishing security standards or guidance for temporary facilities in conflict zones. State partially concurred and subsequently reported that it was developing additional guidance relating to physical security systems such as Hardened Alternative Trailer Systems, surface-mounted, antiram barriers, and anticlimb wall toppings. As of May 2017, State was continuing to address this recommendation. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov schedules associated with the Excellence approach to building new embassies? 2. To what extent do State’s facilities have or require waivers and exceptions to security standards? What steps has State taken to address weaknesses in its waivers and exceptions program? 3. How extensively does State rely on temporary facilities that have been in place for extended periods of time? What progress has State made in creating additional guidance relating to temporary facilities? Background The Secretary of State, in consultation with the heads of other federal agencies, is responsible for protecting U.S. government personnel on official duty abroad, along with their accompanying dependents. At overseas posts, the Department of State’s (State) Bureaus of Diplomatic Security (Diplomatic Security)—represented by a Regional Security Officer (RSO)—and Overseas Buildings Operations share responsibility for the security of residences and other soft targets overseas. More than 25,000 U.S. diplomatic personnel live overseas with their families in an environment that presents myriad security threats and challenges. While State has taken measures to enhance security at its embassies and consulates since the 1998 East Africa embassy bombings, these same actions have given rise to concerns that would-be attackers may shift their focus to what they perceive as more accessible targets, such as diplomatic residences, schools, and other places frequented by U.S. personnel and their families. For example, a 2014 posting on a jihadist website called for attacks on American and other international schools in the Middle East. (See fig. 4 for examples of diplomatic residences.) Key Findings State acquires housing for overseas personnel by leasing, purchasing, or constructing various types of residences, each of which is subject to a set of security standards. State assesses risks to residences using a range of activities—including a periodic security survey to identify and address vulnerabilities. In fiscal years 2010 through 2016, State allocated about $175 million for residential security upgrades. However, in 2014, we found that State did not complete all residential surveys as required, thereby limiting its ability to address vulnerabilities. In addition, we reviewed 68 overseas diplomatic residences and found that 38 did not meet all of the applicable standards, potentially placing their occupants at risk. In instances when a residence does not and cannot meet applicable security standards, posts are required to either seek other residences or request exceptions, which identify steps to mitigate vulnerabilities. However, we found that Diplomatic Security had an exception on file for only 1 of the 38 residences that did not meet all standards. We concluded that without documenting the necessary exceptions, State lacked a complete picture of security vulnerabilities at residences and information that would enable it to make better risk management decisions. In addition, more rigorous security standards that went into effect in July 2014 would likely increase posts’ need for exceptions and lead to costs for upgrades. We made four recommendations regarding the management of risks to residences. State concurred with all four and, as of May 2017, had addressed one. (Fig. 5 portrays key security standards at a notional residence.) State has taken a variety of actions to manage risks to schools and other soft targets. These actions fall into three main categories: (1) funding security upgrades at K-12 schools with enrolled U.S. government dependents and off-compound employee association facilities, (2) sharing threat information and providing advice for mitigating threats at schools and other soft targets, and (3) conducting security surveys to identify and manage risks to schools and other soft targets. However, RSOs at most of the posts we reviewed in 2015 were unaware of some guidance and tools for securing these facilities—such as a booklet and compact disc entitled “Security Guide for International Schools” aimed at assisting international schools in designing and implementing a security program. As a result, we concluded that RSOs may not have been taking full advantage of State’s programs and resources for managing risks at soft targets. We recommended that State take steps to ensure that RSOs are aware of existing guidance and tools regarding the security of soft targets. In response, State issued a cable to all diplomatic and consular posts updating policies and procedures for State's Soft Targets Security Upgrade Program for overseas schools and department-chartered employee associations, thereby distributing important information to security personnel who were previously unaware of available guidance and information. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov standards at overseas residences? Have the standards implemented in July 2014 affected the number of waivers and exceptions requested? 2. What steps has State taken to ensure that posts conduct residential physical security surveys and request security exceptions, when needed, in a timely manner? 3. To what extent has State adapted its Soft Targets Security Upgrade Program in light of recent public terrorist attacks? Background To help safeguard and prepare U.S. personnel to live and work in some of the most dangerous overseas locations, the Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security) provides training on personal security skills necessary for recognizing, avoiding, and responding to potential terrorism and other threat situations. Diplomatic Security also provides refresher briefings on certain topics, as well as cyber and technical security training. To consolidate the hands-on training that Diplomatic Security provides, State is constructing a training center in Fort Pickett, Virginia, which it expects will be completed in 2019. Issue State has a robust security awareness training program provided by Diplomatic Security. For example, State requires specified U.S. personnel traveling for less than 45 days in a calendar year to certain posts to complete its online High Threat Security Overseas Seminar (HTSOS). If specified U.S. personnel are traveling for 45 days or more in a calendar year, State requires that they complete the 5-day Foreign Affairs Counter Threat (FACT) training before departure. Diplomatic Security designed the FACT course to address the dangers that U.S. personnel might face in a number of high-threat, high-risk locations overseas. The course provides hands-on instruction in topics such as detection of surveillance, familiarization with firearms, and awareness of improvised explosive devices (see fig. 6 for examples of other FACT training topics). Key Findings State’s oversight of compliance with the FACT training requirement has weaknesses that limit its ability to ensure that U.S. personnel are adequately prepared for work in high-threat environments. We reported in 2011 and 2014 that State did not have the ability to systematically identify which people required to take the course had not taken it. We made several recommendations to State to improve its management oversight of compliance with mandatory FACT training. These included four recommendations for State to update its policy guidance to reflect changes made to the FACT training requirement in June 2013 (State had doubled the number of countries for which it required FACT training) and to provide clear information on which personnel are required to take FACT training. State concurred with the recommendations and took steps to address them. However, our recommendation that State monitor or evaluate overall levels of compliance with the FACT training requirement remains open. In May 2015, State officials said they were developing a plan to utilize various electronic systems to monitor overall levels of compliance with the FACT training requirement. As of June 2017, State reported that it continues to work on this issue. This lack of oversight is particularly concerning given the significant increase in the number of students taking Diplomatic Security-provided FACT training, from 912 in fiscal year 2006 to 4,482 in fiscal year 2016 (see fig. 7). In addition, in July 2014, State expanded the FACT training requirement to apply to all posts (not just those in high-threat, high-risk locations) by 2019. The gaps we have previously identified in State oversight may increase the risk that personnel do not complete FACT training, potentially placing their own and others’ safety in jeopardy. We reported in 2016 that weaknesses exist in State’s guidance on and management oversight of refresher briefings related to transportation security, potentially putting U.S. personnel overseas at greater risk. We found that personnel had difficultly remembering key details covered in new arrival briefings or described the one-time briefings as inadequate. We found that State lacked a clear requirement for Diplomatic Security to provide and track compliance with periodic refresher briefings that could help reinforce information covered in new arrival briefings. In part, this may result from State guidance lacking clarity and comprehensiveness on this matter. Specifically, its guidance states that regional security officers must conduct refresher briefings “periodically” at “certain posts where personnel live under hostile intelligence or terrorist threats for long periods” but does not define “periodically” or “long periods.” Further, according to Diplomatic Security officials, there is no requirement for affirming that post personnel have received refresher briefings. We recommended that State clarify existing guidance on refresher briefings, such as by delineating how often briefings should be provided at posts facing different types and levels of threats, which personnel should receive them, and how their completion should be documented. Diplomatic Security headquarters officials stated that most violations of post travel policies are due to personnel forgetting the information conveyed in new arrival briefings. Without effective reinforcement of the information that is covered in new arrival briefings, State cannot ensure that U.S. personnel and their families overseas have the knowledge they need to protect themselves from transportation-related security risks. Michael J. Courts, (202) 512-8980, courtsm@gao.gov compliance with all applicable security training requirements, including mandatory HTSOS and FACT training? 2. Does State have the capacity to train the number of U.S. personnel required to take Diplomatic Security-provided FACT training? 3. What steps is State taking to reinforce information covered in new arrival briefings with U.S. personnel and their families? Background The Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security) is responsible for ensuring that overseas post personnel and their family members are prepared for crisis situations and evacuations. Issue From October 2012 to September 2016, in response to various threats, such as terrorism, civil unrest, and natural disasters, State evacuated staff and family members from 23 overseas posts. During this period, several posts—such as Embassy Bujumbura in Burundi and Consulate Adana in Turkey—evacuated post staff or family members on more than one occasion. Overseas posts undergoing evacuations generally experience authorized departure or ordered departure of specific post staff or family members before leading to suspended operations. To help mitigate risks, State requires posts to create Emergency Action Plans (EAP), practice security drills and, if an evacuation is needed, review the event in order to learn from the experience. Key Findings State requires every post to update its EAP on an annual basis. EAPs contain information to assist overseas posts in responding to emergencies, such as checklists of response procedures and decision points to help determine when to evacuate post staff or family members. In 2017, we found that, from fiscal years 2013 through 2016, a quarter of overseas posts, on average, were late completing required annual EAP updates. While the completion rate improved from 46 percent to 92 percent of posts completing updates on time in fiscal years 2013 and 2016, respectively, our review of a nongeneralizable, judgmental sample of EAPs from 20 posts that had been approved by Diplomatic Security showed that only 2 of 20 had updated all key EAP sections. We also found that EAPs are viewed as lengthy and cumbersome documents that are not readily usable in emergency situations, as required by State policy. We recommended that State take several actions to improve their EAPs, such as developing a procedure to ensure that overseas posts complete comprehensive, annual EAP updates on time; develop a monitoring and tracking process to ensure EAP updates are reviewed; and make the EAP more readily usable during emergency situations. State agreed with all of our recommendations and reported that it has started to address them. For example, State is developing a redesigned EAP that will minimize redundancy, group content according to posts’ planning and response needs, and make the EAP better organized and more user-friendly. Posts are required to conduct nine types of drills each fiscal year to prepare for crises and evacuations. In 2017, we found that, on average for fiscal years 2013 through 2016, posts worldwide reported completing 52 percent of required annual drills; posts rated high or critical for political violence or terrorism reported completing 44 percent of these drills. Overall, less than 4 percent of posts reported completing all required drills during fiscal years 2013 through 2016. As shown in figure 8 below, 78 percent of posts reported completing duck-and-cover drills, but only 36 percent of posts reported completing evacuation training drills. We recommended that State improve the completion and reporting of required drills. State concurred and is updating the system it uses to report drills. After an authorized or ordered departure has terminated, State’s Foreign Affairs Handbook requires post staff to transmit an after-action report listing any lessons learned from the experience to State headquarters. In 2017, we found that, during fiscal years 2013 through 2016, there were 31 evacuations from overseas posts; however, according to State officials, none of the posts submitted the required lessons learned report. These reports could have been used to modify the post’s guidance on how to best respond to an emergency situation. According to State officials, these reports also could help staff at other posts learn about the challenges faced by the evacuated posts, identify relevant best practices, and prepare for potential future evacuations. We recommended that State take steps to improve the completion and submission of required lessons learned reports following evacuations from overseas posts. State concurred and has developed tools to improve the process. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov annually update their EAPs and (2) Diplomatic Security comprehensively reviews key EAP sections? 2. What efforts is Diplomatic Security making to ensure that posts complete and report completion of required crisis and evacuation drills within required time frames? 3. What steps is State taking to ensure that overseas posts complete required lessons learned reports following evacuations and submit those reports to State headquarters for analysis? Background The Department of Defense (DOD) has long provided military protection and support for the security and safety of U.S. diplomatic missions and personnel during normal operations and emergencies. This support is particularly critical in times of crisis, such as when DOD provides security reinforcements to facilities under threat or assists with evacuations. Several entities within DOD and the Department of State (State) prepare for and coordinate these efforts. Memoranda of Agreement between State and DOD establish frameworks for cooperation on scenarios requiring security augmentation, crisis response, and evacuation for U.S. diplomatic and consular missions overseas. The September 2012 attacks in Benghazi, Libya, and the related wave of protests and threats to U.S. missions in Africa and the Middle East prompted a reexamination of how State and DOD collaborate to provide emergency military protection and other support to overseas posts. The possibility of similar threats and attacks requiring additional DOD support at U.S. diplomatic facilities is spread across a large geographic area. Given the chaos and complexities inherent in such acute crises, and the possibility that unrest could affect multiple U.S. facilities at one time, the need for DOD support will likely continue. From 2013 to 2016, 24 overseas posts experienced some level of increased threat resulting in the evacuation of some or all U.S. personnel. While not all periods of increased threat warrant additional DOD assistance, many do. For instance, in 2014 alone, the U.S. military provided support for embassy reinforcement, military-assisted departures, or evacuations, including in South Sudan, Libya, and Iraq. (Fig. 9 shows one of the DOD units and aircraft that may be used in evacuations or other emergencies.) Key Findings As part of the reorganization following the 2012 attacks, DOD—in coordination with State—increased the military resources provided to overseas posts. According to State and DOD officials, this represented a whole-of-government approach to countering threats to U.S. overseas personnel and facilities. Drawing from existing U.S. Marine Corps and U.S. Army units, DOD created three dedicated military forces to respond to crises across Africa and the Middle East: (1) a Special Purpose Marine Air-Ground Task Force for Crisis Response (SPMAGTF-CR) assigned to DOD’s U.S. Central Command, which supports U.S. diplomatic missions in the Middle East; (2) a SPMAGTF-CR assigned to U.S. Africa Command, which supports U.S. missions in North and West Africa; and (3) the East Africa Response Force, a U.S. Army force that supports U.S. diplomatic missions in East Africa. These forces can provide a variety of functions, from security reinforcement during increased threats, to military-assisted departures and evacuation support. According to DOD officials, in 2014, U.S. Africa Command experienced some logistical challenges associated with covering such a large geographic area, with particular concern should multiple crises occur simultaneously. In 2014, State and DOD announced several changes to the Marine Security Guard (MSG) program, which deploys units of marines to provide certain types of security to U.S. overseas missions. Specifically, in coordination with State’s implementation of the Benghazi Accountability Review Board recommendations, DOD has since increased the size of MSG detachments at all posts, with further increases at high-threat posts; accelerated the deployment of additional detachments to other U.S. diplomatic facilities; and created a Marine Security Guard Security Augmentation Unit based in Quantico, Virginia, to provide additional support on short notice. State and DOD officials reported in June 2017 that they have experienced some challenges associated with deploying the increased MSG units, including obtaining sufficient numbers of marines to fill the desired number of units and logistical and other support at some posts. The agencies continue to work to add certain nonlethal weapons to the MSG equipment set. In 2015, we reported on State and DOD’s post-Benghazi approach to provide additional military support to U.S. overseas posts. While State and DOD had updated some guidance to reflect the new approach, we recommended that the departments more clearly define the roles, responsibilities, and circumstances under which DOD support would be provided and that they update related interagency and departmental guidance. In response to our recommendations, State and DOD have taken steps to update such interagency guidance. These steps included interdepartmental exercises and other collaboration, which resulted in a joint concept paper and a subsequent December 2016 State-DOD memorandum of agreement outlining common terms, roles, responsibilities, and scenarios under which DOD assistance may be requested, among other things. State and DOD officials have indicated that each department will produce further department-specific guidance in the form of a forthcoming diplomatic cable; a DOD update to a 2013 military order; and a new, related DOD instruction. DOD officials expect to issue the updated order by the end of fiscal year 2017 and to complete the instruction in fiscal year 2018. John H. Pendleton, (202) 512- 3489, pendletonj@gao.gov to ensure support to U.S. missions in crisis situations? 2. What is the progress of increasing MSG detachments at identified diplomatic facilities? What challenges exist to providing the personnel or support needed for these additional units? 3. What steps have been taken to ensure that recent State and DOD policy and procedure updates are institutionalized and readily available in future emergencies? Background Issue The Department of State’s (State) Diplomatic Security and overseas posts have processes for Bureau of Diplomatic Security communicating threat information to post personnel (U.S. employees and (Diplomatic Security) is locally employed staff) as well as U.S. citizens in country. However, these responsible for disseminating populations do not always receive important threat information in a timely threat information to posts. At manner. Diplomatic Security’s Office of Intelligence and Threat Analysis, posts, the Emergency Action based at State headquarters, analyzes threat information from multiple Committee (EAC), which includes sources, including the U.S. Intelligence Community, and shares the results the Regional Security Officer of its analysis with posts’ RSOs via cables and other reports. Before (RSO) and Consular Officer, analyzing the information, Diplomatic Security sends an initial notification among other subject matter to posts, according to bureau officials. In addition, posts collect, analyze, experts, disseminates threat and report threat information to headquarters for further distribution. At information to post personnel, as posts, RSOs, at the direction of the EAC, may adjust the post’s security appropriate. In addition, consular posture and disseminate threat information to post personnel. In addition, officers are responsible for if State shares information with the official U.S. community, its policy is to disseminating information to the make the same or similar information available to the nonofficial U.S. nonofficial U.S. community—U.S. community if the threat applies to both. (See fig. 10 for a schematic of citizens living in or traveling State’s threat information dissemination process.) through the affected area. Key Findings State has taken steps to improve RSOs’ reporting of terrorism-related threat information to headquarters. In June 2015, we found that RSOs at some posts designated critical for terrorism were not complying fully with directions from the Secretary of State to use terrorist reporting cables to report all terrorism-related incidents or threats to ensure proper handling and dissemination of the information. For example, we found that in some cases, terrorism-related incidents were not reported in required terrorist reporting cables. We concluded that without comprehensive and accurate reporting, State may lack assurance that it received complete information about terrorist threats that could help prevent and mitigate such threats. We recommended that Diplomatic Security take steps to remind RSOs and posts of the critical importance of using the proper type of cable to report all terrorism-related threats. In December 2015, State sent guidance to all posts specifying that terrorism-related threats must be reported through terrorist reporting cables to ensure appropriate dissemination of the information. Further, in January 2017, State provided reporting instructions to RSOs to help ensure the timely and accurate reporting of all security-related information through the correct reporting channels. Diplomatic Security uses various methods to communicate threat information to overseas post personnel—both U.S. and locally employed staff. However, in our 2016 report on transportation security, we reported that post personnel do not always receive threat information in time to avoid potential threats. We found that several factors can lead to untimely receipt of transportation-related threat information. We recommended that State address these factors. First, some RSOs reported that they send security notices exclusively to state.gov e-mail addresses; however, not all post personnel have state.gov e-mail addresses. In one case, this resulted in post personnel traveling through a prohibited area and an embassy vehicle being attacked with rocks and seriously damaged. Second, limited guidance existed for RSOs on how to promote timely communication of threat information. Third, RSOs and other staff at some posts mistakenly believed that RSOs cannot share threat information with the official U.S. community until consular officials received approval from State to share the same information with the nonofficial U.S. community— a clearance process that can take as long as 8 hours. State reported that it is reviewing the option to forward e-mails outside its system. It also reported that it is developing a two-way emergency notification system that would provide a redundant method for distributing messages during crises. In addition, State updated its policy manual to clarify that RSOs’ sharing of threat information should not be delayed by the clearance process, according to Diplomatic Security officials. To ensure that overseas posts can disseminate information to U.S. citizens in country in the event of an emergency, disaster, or threat, State requires posts to annually conduct a drill of the consular warden system. The consular warden system is a pyramidal contact system designed to reach the U.S. citizen population. However, we found in 2017 that, on average between fiscal years 2013 and 2016, 78 percent of overseas posts did not report the completion of required consular warden system drills. We concluded that this gap in State’s crisis and evacuation preparedness creates a risk that U.S. citizens in country may be insufficiently warned about emergency situations. We recommended that State take steps to improve the completion and reporting of required drills, and State concurred, noting it is forming a working group to review its policies. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov nonofficial U.S. community been in past emergencies? 2. What is the status of State’s plan to use new technology to disseminate information to U.S. personnel and U.S. citizens overseas? 3. What steps has State taken to ensure that posts complete the annual tests of the consular warden system? Background The Department of State’s (State) Counterintelligence Division— under the Office of Investigations and Counterintelligence in the Bureau of Diplomatic Security (Diplomatic Security)—is responsible for overseeing State’s counterintelligence efforts, including assisting Regional Security Officers (RSO) with implementation at overseas posts. Foreign intelligence entities from host nations and third parties are motivated to collect information on a variety of sensitive topics of national importance, including intelligence, defense, and economic information. These entities may attempt to collect information through the use of sophisticated overt, covert, and clandestine means, including human intelligence collection. Because State operates diplomatic posts in many countries, State and other U.S. agency employees at these posts—and their family members—can be targeted by host governments and other entities. National counterintelligence guidance requires that State and other executive agencies implement programs to counter the intelligence threat to U.S. national security and interests by protecting personnel and information. Key Findings State has established several measures to counter the human intelligence threat at overseas posts. Those measures include (1) requiring all State and other agency personnel serving at these posts to report contacts with foreign nationals, particularly those from countries with critical human intelligence posts; (2) prescreening State personnel assigned to certain posts against 13 criteria designed to identify vulnerabilities and directing other agencies to prescreen their personnel; and (3) briefing personnel about what to expect when working and living in potentially hostile intelligence environments. While State prepares personnel at all posts to be aware of human intelligence threats, it uses enhanced counterintelligence strategies for personnel assigned to posts designated as “critical threat” for human intelligence. For example, personnel at critical threat posts receive counterintelligence briefings before departure and annually while serving at these posts. (See fig. 11.) Diplomatic Security assesses counterintelligence efforts at overseas posts through Counterintelligence Post Surveys and Post Security Program Reviews, making recommendations to improve any gaps identified in countermeasures. In addition, as part of a government-wide effort, the Office of the Director of National Intelligence evaluates State’s counterintelligence activities to identify gaps and make recommendations to strengthen State’s counterintelligence program. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov by State domestically and overseas changed in recent years? 2. How does State ensure that personnel are prepared to live and work at posts facing a high or critical human intelligence threat? 3. How does State evaluate the effectiveness of its human intelligence countermeasures domestically and at overseas posts? How does State adjust its countermeasures, if warranted? Background The Department of State (State) created its information security program to address requirements in both the Omnibus Diplomatic Security and Antiterrorism Act of 1986 and the Federal Information Security Modernization Act of 2014 (FISMA). State’s Bureaus of Diplomatic Security (Diplomatic Security) and Information Resource Management (IRM) share responsibility for implementing the information security responsibilities in these laws. In May 2017, Diplomatic Security created the new Directorate for Cyber and Technology Security to consolidate relevant elements from other directorates. Issue Since 1997, GAO has designated federal information security as a government-wide high-risk area and in 2003 expanded this area to include computerized systems supporting the nation’s critical infrastructure. The number of information security incidents reported by federal agencies—including State—increased from 5,503 in fiscal year 2006 to 77,183 in fiscal year 2015. Cyberattacks forced State to shut down its unclassified e-mail system and parts of its public website in both 2014 and 2015 after finding evidence that its systems had been breached. Cyber-based threats to federal systems and information come from unintentional sources, such as natural disasters, coding errors, and careless employees, or from intentional sources, such as disgruntled insiders, hackers, or hostile nations. State’s outdated technology makes it increasingly difficult to ensure security. In addition, State’s information security program is split between two bureaus, each responsible for aspects of the program. Further, State makes extensive use of contractors to perform information security functions such as the monitoring and assessment of systems. Protecting those systems and information from unauthorized disclosure or alteration is particularly important at State, where inappropriate disclosure could cause catastrophic harm to the nation’s diplomacy and security. Key Findings In 2016, we surveyed 24 federal agencies—including State—to identify the sources of malicious attacks on their high-impact systems—any system that holds sensitive information, the loss of which could cause individuals, the government, or the nation catastrophic harm. Consequently, these systems warrant increased security to protect them. Eighteen of these 24 agencies—including State—identified cyberattacks originating from nation states as the most serious and frequent threat to the security of their systems. They identified e-mail cyberattacks as the most serious and frequent delivery method. We made recommendations to the Office of Management and Budget (OMB) to improve security over federal systems, including those at State. State relies on several aging and obsolete technology systems, which require significant resources to operate and create challenges to ensuring information security. We found that State spent about 87 percent of its information technology budget on operating and maintaining its computer systems in 2015. This segment of State’s technology budget increased by approximately $109 million between 2010 and 2015. A State official stated that the increase is largely due to the cost of maintaining the infrastructure, including meeting security requirements. For example, three of State’s visa systems were more than 20 years old. The software for one of these systems is no longer supported by the vendor, creating challenges related to information security. State is planning to upgrade the software to a newer version that also is not supported by the vendor. As a result, we recommended that State identify and plan to modernize or replace legacy systems, consistent with OMB guidance. FISMA directs State and other agencies to designate a Chief Information Security Officer (CISO)—who, at State, reports to the Chief Information Officer in IRM—to develop, document, and implement a department-wide information security program that protects the agency from cyberattacks. In a 2016 report, we evaluated 24 federal agencies to determine whether they followed FISMA and other requirements defining the CISO’s responsibilities. Twenty-two of the 24 agencies—including State—had defined almost all CISO responsibilities properly. However, we found that State had assigned responsibility for responding to information security incidents—a FISMA-designated CISO responsibility—to Diplomatic Security without also defining the CISO’s role in that activity. We concluded that not having a defined role may limit the CISO’s ability to effectively oversee State’s information security incident response process. We recommended that State define the CISO’s role in department policy for ensuring that State had procedures for incident detection, response, and reporting. State concurred with the recommendation and noted that IRM and Diplomatic Security coordinate communications for the incident response process. Gregory C. Wilshusen, (202) 512-6244, wilshuseng@gao.gov contractors, what unique information security challenges, if any, does it face? How does it manage its global cybersecurity program? 2. Given the rapidly changing nature of technology, how does State assess and address threats to its systems and users from changing cyber threats? 3. How will the new Directorate for Cyber and Technology Security improve State’s capability to address cybersecurity issues? 4. To what extent, if any, does assigning CISO responsibilities to multiple bureaus increase State’s risk for duplication, overlap, or fragmentation of information security responsibilities? Background The Secretary of State is generally required by law to convene Accountability Review Boards (ARB) in cases of serious injury, loss of life, or significant destruction of property involving U.S. diplomatic missions or personnel abroad, and in any case of a serious breach of security involving intelligence activities of a foreign government directed at a mission abroad. State has convened 12 ARBs since 1998. ARBs are responsible for reporting their findings about the circumstances of the attack and making recommendations. Issue On September 11, 2012, the acquired facilities at the U.S. Special Mission in Benghazi, Libya, came under attack (see fig. 13). Tragically, four U.S. officials were killed, including the U.S. Ambassador. In response to the attack, the Department of State (State), working with the Department of Defense, formed Interagency Security Assessment Teams to evaluate the security at 19 dangerous posts. Those teams made a number of recommendations to improve physical and procedural security at each post. In addition, an ARB was convened in response to the Benghazi attack; it resulted in 29 recommendations, including several concerning how State manages risk at dangerous posts. Furthermore, two of State’s actions resulting from that ARB led to additional reports that included more recommendations. Key Findings The Interagency Security Assessment Teams assessed all facilities at the 19 posts for any security vulnerabilities—physical or procedural. Their assessments resulted in 287 recommendations including for State to install physical security upgrades, improve security procedures, and construct or acquire new or replacement facilities. State officials told us that State immediately began implementing the recommendations. In addition, State created the new High Threat Programs Directorate within its Bureau of Diplomatic Security (Diplomatic Security) to ensure that those posts facing the greatest risk receive additional, security-related attention. As of June 2017, State reported having addressed 268 of the 287 recommendations. In December 2012, the ARB that State convened to investigate the Benghazi attack released the report of its investigation. The ARB made 23 unclassified recommendations in six areas: (1) overarching security considerations; (2) staffing dangerous posts; (3) training and awareness; (4) security and fire safety equipment; (5) intelligence and threat analysis; and (6) personnel accountability. In addition, the ARB, according to State, made six classified recommendations. State accepted all 29 of the ARB’s recommendations and pledged to fully implement them. For example, in response to the ARB, State expanded the mandatory Foreign Affairs Counter Threat training requirement to all dangerous posts (and, subsequently, to all posts by 2019). As of June 2017, State reported having addressed all but three of the ARB’s recommendations. In response to the Benghazi ARB’s second recommendation, State established a panel to evaluate the organization and management of Diplomatic Security. In May 2013, the panel provided its report to State. It made 35 recommendations in three areas: (1) organization, (2) training, and (3) management. State accepted 29 of the panel’s 35 recommendations. For instance, State did not accept a recommendation for Diplomatic Security to establish a chief of staff position at the GS-15 level within its Principal Deputy Assistant Secretary’s office, noting that no other bureau has an equivalent position. As of June 2017, State reported having addressed 28 of the 29 recommendations it accepted. For example, as a result of the panel’s report, Diplomatic Security is undertaking a strategic review of its staffing. In response to the Benghazi ARB’s fourth recommendation, State established a panel to help Diplomatic Security identify best practices for operating in dangerous environments. The panel provided its report to State in August 2013. It made 40 recommendations in 12 areas, including organization and management; program criticality and acceptable risk; lessons learned; training and human resources; intelligence, threat analysis, and security assessments; and host nations and guard forces’ capability enhancement, among others. State accepted 38 of the panel’s 40 recommendations. State did not accept the panel’s first recommendation, that it establish an Under Secretary for Diplomatic Security. It asserted that doing so would compound the “stove-piping” that the ARB and others reported in the wake of the Benghazi attack. In addition, State did not accept the panel’s 13th recommendation, which stated that waivers to established security standards should only be provided subsequent to the implementation of all mitigating measures. State noted that in time-sensitive situations, exceptions might be appropriate when some mitigating measures are in place. As of June 2017, State reported having addressed 36 of the 38 recommendations it accepted. For example, as a result of the panel’s report, Diplomatic Security created a Strategic Advisory Unit within Diplomatic Security to advise and perform ad hoc analysis for the Assistant Secretary. Michael J. Courts, (202) 512- 8980, courtsm@gao.gov recommendations? 2. What effect, if any, has implementing the Benghazi-related recommendations had on the security of diplomatic facilities, personnel, and information? 3. Since 1998, 12 attacks have resulted in the formation of ARBs. What is the status of all recommendations made by the 12 ARBs? This special publication is largely based on previously published GAO work. To generate a list of possible key issues, we reviewed past products concerning the Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security), by GAO, State’s Inspector General, and the Congressional Research Service. Working with GAO’s subject matter experts, we narrowed the list of issues and identified potential oversight questions. We interviewed cognizant agency officials in Washington, D.C., and Arlington, Virginia, from State—including from the Bureaus of Management, Diplomatic Security, Overseas Buildings Operations (OBO), and Information Resource Management—the Department of Defense, and the U.S. Agency for International Development. We used these interviews to refine our key issues, gain updated information and data, follow up on actions taken regarding our past recommendations, and identify relevant lessons learned. We also worked with the officials to determine what portions of our past classified or restricted work could be presented in a public product. We then synthesized this information to provide a balanced and comprehensive overview for each issue and to formulate oversight questions. We updated relevant data when possible and performed additional data reliability assessments when necessary. These additional assessments were conducted only on data that we had not previously reported; all other data were assessed as part of our work for our previously published reports. We assessed the reliability of various types of data— funding, staffing, and training—from Diplomatic Security and, as appropriate, its partner agencies. Specifically, we assessed the reliability of the following data: Diplomatic Security bureau managed funds, from fiscal years 2010 to 2016. (We used previously reported data for fiscal years 1998 to 2007, and updated previously reported data for fiscal years 2008 to 2009.) Dedicated allocations to Diplomatic Security and OBO for physical security at diplomatic facilities for fiscal years 2015 to 2016. (We used previously reported data for fiscal years 2009 to 2014.) Diplomatic Security staffing numbers for its workforce of direct-hire employees, other U.S. government support staff, and contractors. (We used previously reported data for 1998, 2008, and 2011.) Number of students who completed Diplomatic Security-provided Foreign Affairs Counter Threat training for fiscal years 2011 to 2016. (We used previously reported data for fiscal years 2006 to 2010.) To assess the reliability of the data, we interviewed cognizant officials about how the data were produced and their opinion of the quality of the data, specifically the data’s completeness, accuracy, and comparability to previously reported data. We also worked with the cognizant officials to identify any limitations associated with the data and to mitigate those issues or note these limitations in our report, as appropriate. In addition, we updated previously reported data on the percentage of Diplomatic Security employees who do not speak and read foreign languages at the level required by their positions and interviewed knowledgeable officials to corroborate and clarify the data. We determined that the data mentioned above were sufficiently reliable for our purposes. We prepared this report under the authority of the Comptroller General to conduct work on his initiative because of broad congressional interest in the oversight and accountability of providing security to U.S. personnel working at diplomatic missions and to assist Congress with its oversight responsibilities. We conducted this performance audit from January 2017 to September 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. U.S. diplomatic missions have faced numerous attacks that were followed by legal and policy changes. Between 1998 and 2016, there were 419 attacks against U.S. diplomatic interests, according to the Department of State’s Bureau of Diplomatic Security. Several of the deadly attacks against U.S. personnel and facilities overseas were followed by new legislation, independent reviews with corresponding recommendations, or both. For example, the Omnibus Diplomatic Security and Antiterrorism Act of 1986, which followed the attacks against the U.S. embassy in Beirut, Lebanon, in 1983, established the Bureau of Diplomatic Security and set forth its responsibility for post security and protective functions abroad. The Secure Embassy Construction and Counterterrorism Act of 1999, which followed the Africa embassy bombings of 1998, set requirements for colocation of all U.S. government personnel at an overseas diplomatic post (except those under the command of an area military commander) and for a 100-foot perimeter setback for all new U.S. diplomatic facilities. In addition, the Secretary of State is generally required by law to convene an Accountability Review Board (ARB) following incidents that result in serious injury, loss of life, or significant destruction of property involving U.S. diplomatic missions or personnel abroad. An ARB is responsible for reporting its findings about the circumstances of an attack and making recommendations as appropriate. Since 1998, 12 attacks have resulted in the formation of an ARB, the most recent of which was formed in response to the 2012 attacks in Benghazi. (See fig. 14 for a time line of selected attacks and related laws and reports.) The Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security) has responsibilities set forth in State’s Foreign Affairs Manual; to help meet its responsibilities, the bureau relies on multiple organizational components within State. (Fig. 15 highlights State offices with key security responsibilities.) State also collaborates with other U.S. government agencies to secure U.S. missions overseas. As established by the 1961 Vienna Convention on Diplomatic Relations, host country governments are required to protect the diplomatic personnel and missions of foreign governments. More than two decades later, following an attack against the U.S. embassy in Beirut, Lebanon, Congress enacted the Omnibus Diplomatic Security and Antiterrorism Act of 1986 to provide enhanced diplomatic security and to combat international terrorism. The act assigns the Secretary of State responsibility for providing security for all diplomatic operations, in consultation with the heads of other federal agencies that have personnel or missions abroad. The act also created Diplomatic Security to provide a broad range of security and protective functions internationally and domestically. In addition, the act specifies that other federal agencies will cooperate with State to fulfill all security operations of a diplomatic nature. The Bureau of Diplomatic Security is State’s security and law enforcement arm. The bureau’s eight operational directorates—listed below—are collectively known as the Diplomatic Security Service. In addition, Diplomatic Security has three administrative offices that assist the mission: Executive Office, Strategic Advisory Unit, and Public Affairs. International Programs: Directs the formulation, planning, coordination, policy development, and implementation of security programs that protect U.S. diplomatic missions for most posts. Manages high-profile security programs such as the Embassy Local Guard Program, Emergency Action Planning, the Worldwide Protective Services Program, Surveillance Detection, and the Marine Security Guard Program. High Threat Programs: Directs the formulation, planning, coordination, policy development, and implementation of security programs that protect U.S. diplomatic missions at high-threat, high-risk posts. Manages security programs to include personnel recovery, tactical and strategic planning, special operations, evacuation operations, and State’s responses to international crises at high-threat, high-risk posts. Diplomatic Security created this directorate following the 2012 attack on Benghazi to ensure that those posts facing the greatest risk—now designated as high-threat, high-risk posts—received additional, security-related attention. Domestic Operations: Oversees criminal investigations domestically and abroad related to State personnel, facilities, and visiting foreign dignitaries, including passport and visa violations, counterintelligence investigations, and use of force incidents involving State personnel. Oversees the protection of the Secretary of State, the U.S. Ambassador to the United Nations, foreign dignitaries, and other persons of interest. Training: Formulates and implements all security and law enforcement training programs and policies for Diplomatic Security. Directs the formulation, coordination, and implementation of security and law enforcement training programs that promote the professional development of Diplomatic Security personnel. Oversees specialized security training at overseas posts on a regular and emergency basis and provides emergency security support to posts abroad during periods of high threat, crisis, or natural disaster. Threat Investigations and Analysis: Directs, coordinates, and conducts the analysis of terrorist threats and hostile activities directed against U.S. government personnel, facilities, and interests abroad. Conducts protective intelligence investigations, coordinates foreign- government and private-sector requests for assistance relating to terrorist incidents, and directs the operations of the Diplomatic Security Command Center and the Overseas Security Advisory Council. Security Infrastructure: Manages all matters relating to security infrastructure in Diplomatic Security functional areas of personnel security and suitability and insider threats. Formulates strategic operational planning, priorities, and funding for security infrastructure operations. Countermeasures: Manages, plans, and develops policy for worldwide physical and technical security countermeasures programs. Represents State in negotiations with other federal agencies on issues regarding physical and technical security countermeasures. Directs the offices of Physical Security Programs, Security Technology, and Diplomatic Courier Service. Cyber and Technology Security: Manages cyber and technical elements of State’s security program. In May 2017, Diplomatic Security created this new directorate by consolidating cyber technology and investigative support elements from other directorates. The goal is to increase State’s ability to enable secure innovation in areas such as e-mail messaging services, Wi-Fi, cloud services, mobile communications, and social media. To complete parts of its mission, Diplomatic Security collaborates with other State entities, most notably the overseas missions and the Bureaus of Overseas Buildings Operations (OBO) and Information Resource Management (IRM). Overseas Missions: At posts, the Chief of Mission (Ambassador or Principal Officer), is ultimately responsible for the security of facilities, information, and all personnel under chief-of-mission authority. He or she is assisted by Diplomatic Security, which is represented at post by a head special agent known as the Regional Security Officer (RSO). RSOs—working with assistant RSOs and other security personnel— are responsible for implementing a wide range of duties such as protecting personnel and property, documenting threats and residential vulnerabilities, and identifying possible mitigation efforts to address those vulnerabilities. The overseas missions also play a role in setting post-specific security measures and funding some physical security upgrades, with approval from Diplomatic Security. In addition, each post has an Emergency Action Committee (EAC) that provides guidance in preparing for and responding to potential changes in risk that might affect the safety and security of the post and the American citizens in country. The EAC may include the Ambassador, Deputy Chief of Mission, Principal Officer, Defense Attaché, Political Officer, Economic Officer, RSO, Management Officer, Consular Officer, Public Affairs Officer, Human Resources Officer, Medical Officer, U.S. Agency for International Development (USAID) Mission Director, Community Liaison Office Coordinator, and others, including non- State officials, as appropriate. Further, as the 2005 Iraq Accountability Review Board (ARB) noted, all mission personnel bear “personal responsibility” for their own and others’ security. Overseas Buildings Operations (OBO): OBO manages the acquisition, design, construction, maintenance, and sale of U.S. government diplomatic property abroad. Through the Capital Security Construction Program, OBO replaces and constructs diplomatic facilities to provide U.S. embassies and consulates with safe, secure, functional, and modern buildings. In addition, OBO tracks information on State’s real properties, including residences; provides funding for certain residential security upgrades; and funds and manages the Soft Targets Program, State’s program for providing security upgrades to schools attended by U.S. government dependents and off-compound employee association facilities. Information Resource Management (IRM): State’s Chief Information Officer leads IRM to provide the information technology and services State needs to carry out its foreign policy mission. The Federal Information Security Modernization Act of 2014 (FISMA) directs the heads of federal agencies, including State, to designate a Chief Information Security Officer to develop, document, and implement a department-wide information security program. In addition, the Office of Management Policy, Rightsizing, and Innovation (M/PRI) tracks State’s implementation of ARB recommendations. Diplomatic Security, OBO, IRM, and M/PRI all report to the Under Secretary for Management. Diplomatic Security coordinates its work overseas with a number of U.S. government entities and agencies: The Overseas Security Policy Board (OSPB) develops security standards for executive agencies working overseas. Chaired by the Assistant Secretary for Diplomatic Security, OSPB includes representatives from approximately 20 U.S. agencies with personnel overseas, including intelligence, foreign affairs, and other agencies. State incorporates the OSPB’s physical security standards in the Foreign Affairs Handbooks. Diplomatic facilities overseas—whether permanent, interim, or temporary—and residences are required to meet the standards applicable to them. The OSPB standards vary by facility type, date of construction or acquisition, and threat level. If facilities do not meet all applicable standards, posts are required to request waivers, exceptions, or both. The Department of Defense (DOD) has long provided military protection and support for the security and safety of U.S. diplomatic missions and personnel during normal operations and emergencies. For example, DOD provides Marine Security Guards at some U.S. diplomatic missions to help protect U.S. personnel, classified material, and property. DOD support is particularly critical in times of crisis, such as when DOD provides security reinforcements to facilities under threat or assists with evacuations. Several entities within State, DOD, and the military branches prepare for and coordinate these efforts. Memoranda of Agreement between State and DOD establish frameworks for cooperation on scenarios requiring security augmentation, crisis response, and evacuation for U.S. diplomatic and consular missions overseas. USAID maintains its own Office of Security, which is responsible for the physical security of its facilities and coordination with Diplomatic Security. Other agencies operating overseas—such as the Departments of Commerce or the Treasury—may also have security offices, but none of them operating under chief-of-mission authority maintain their own facilities outside of Diplomatic Security’s responsibility. The Department of State’s Bureau of Diplomatic Security (Diplomatic Security) employs a broad workforce of over 51,000 individuals to carry out its mission and activities. Its workforce includes direct-hire security specialists and management support staff, military support, and contractors. See table 2 for a description of each position and a comparison of Diplomatic Security staffing levels in fiscal years 2008, 2011, and 2017. Over the course of our work on the Department of State’s (State) Bureau of Diplomatic Security (Diplomatic Security) and related efforts, we have identified conditions that affect the success of its programs and recommended a range of improvements that should be considered in program planning and implementation. For example, we have made recommendations on the need for State to address gaps in its security- related activities, standards, and policies, such as developing a process to ensure that mitigating steps agreed to in granting waivers and exceptions for older, acquired, and temporary work facilities have been implemented. We have also made recommendations on the need for improved information sharing between Diplomatic Security directorates, such as sharing information with each other on the residential security exceptions they have processed to help provide Diplomatic Security with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions. State and its partner agencies have generally concurred with our recommendations and have taken steps to address a number of them, several of which are noted in the enclosures. In addition, we have identified several existing conditions— such as gaps in State oversight of personnel compliance with mandatory security training and many overseas diplomatic residences not meeting all applicable security standards—that continue to challenge the U.S. government’s ability to protect its people, property, and information around the world. In letters addressed to the Secretary of State, we identified which of these recommendations we believe should be given high priority for implementation. As of August 14, 2017, State had 27 open recommendations that have been deemed by GAO as being among the highest priorities for implementation. Of the 27 priority recommendations, 24 are listed below (see table 3) and are related to this report in four areas, as follows: Security of overseas personnel. Fully implementing GAO’s priority recommendations on personnel security, such as those related to the Foreign Affairs Counter Threat (FACT) training, would help ensure that State personnel are prepared to operate in dangerous situations. Security of overseas facilities. Fully implementing GAO’s priority recommendations on physical security at overseas posts, such as those regarding risk management associated with physical security of diplomatic facilities, will improve the safety and security of personnel serving overseas, particularly in high-threat locations. Transportation security. Fully implementing recommendations related to transportation security would improve State’s efforts to manage transportation-related security risks overseas. Information security. Fully implementing GAO’s priority recommendation regarding obsolete computer systems will improve State’s ability to secure its information technology systems and access to potentially sensitive information. GAO will continue to monitor State’s progress in implementing these recommendations and will update their status on the GAO website at http://www.gao.gov. This appendix provides a list of recent GAO products related to each enclosure. Copies of most products can be found on our website: http://www.gao.gov/. GAO also has done work on some of the key issues identified in the enclosures that resulted in Sensitive But Unclassified or Classified products. (Report numbers with an SU suffix are Sensitive But Unclassified, and those with a C suffix are Classified.) Sensitive But Unclassified and Classified reports are available to personnel with the proper clearance and need-to-know, upon request. For a copy of a Sensitive But Unclassified or Classified report, please call or e-mail the point of contact listed in the related enclosure. State Department: Diplomatic Security Challenges. GAO-13-191T. Washington, D.C.: November 15, 2012. State Department: Diplomatic Security's Recent Growth Warrants Strategic Review. GAO-10-156. Washington, D.C.: November 12, 2009. Department of State: Foreign Language Proficiency Has Improved, but Efforts to Reduce Gaps Need Evaluation. GAO-17-318. Washington, D.C.: March 22, 2017. State Department: Diplomatic Security Challenges. GAO-13-191T. Washington, D.C.: November 15, 2012. State Department: Diplomatic Security's Recent Growth Warrants Strategic Review. GAO-10-156. Washington, D.C.: November 12, 2009. Embassy Construction: State Needs to Better Measure Performance of Its New Approach. GAO-17-296. Washington, D.C.: March 16, 2017. Afghanistan: Embassy Construction Cost and Schedule Have Increased, and Further Facilities Planning Is Needed. GAO-15-410. Washington, D.C.: May 19, 2015. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-655. Washington, D.C.: June 25, 2014. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-380SU. Washington, D.C.: June 5, 2014. Diplomatic Security: State Department Should Better Manage Risks to Residences and Other Soft Targets Overseas. GAO-15-700. Washington, D.C.: July 9, 2015. Diplomatic Security: State Department Should Better Manage Risks to Residences and Other Soft Targets Overseas. GAO-15-512SU. Washington, D.C.: June 18, 2015. Diplomatic Security: State Should Enhance Its Management of Transportation-Related Risks to Overseas U.S. Personnel. GAO-17-124. Washington, D.C.: October 4, 2016. Diplomatic Security: State Should Enhance Management of Transportation-Related Risks to Overseas U.S. Personnel. GAO-16-615SU. Washington, D.C.: September 9, 2016. Diplomatic Security: Options for Locating a Consolidated Training Facility. GAO-16-139T. Washington, D.C.: October 8, 2015. Diplomatic Security: Options for Locating a Consolidated Training Facility. GAO-15-808R. Washington, D.C.: September 9, 2015. Countering Overseas Threats: Gaps in State Department Management of Security Training May Increase Risk to U.S. Personnel. GAO-14-360. Washington, D.C.: March 10, 2014. Countering Overseas Threats: Gaps in State Department Management of Security Training May Increase Risk to U.S. Personnel in High-Threat Countries. GAO-14-185SU. Washington, D.C.: February 26, 2014. Diplomatic Security: Expanded Missions and Inadequate Facilities Pose Critical Challenges to Training Efforts. GAO-11-460. Washington, D.C.: June 1, 2011. Embassy Evacuations: State Should Take Steps to Improve Emergency Preparedness. GAO-17-714. Washington, D.C.: July 17, 2017. Embassy Evacuations: State Should Take Steps to Improve Emergency Preparedness. GAO-17-560SU. Washington, D.C.: June 28, 2017. Interagency Coordination: DOD and State Need to Clarify DOD Roles and Responsibilities to Protect U.S. Personnel and Facilities Overseas in High-Threat Areas. GAO-15-219C. Washington, D.C.: March 4, 2015. Embassy Evacuations: State Should Take Steps to Improve Emergency Preparedness. GAO-17-714. Washington, D.C.: July 17, 2017. Embassy Evacuations: State Should Take Steps to Improve Emergency Preparedness. GAO-17-560SU. Washington, D.C.: June 28, 2017. Diplomatic Security: State Should Enhance Its Management of Transportation-Related Risks to Overseas U.S. Personnel. GAO-17-124. Washington, D.C.: October 4, 2016. Diplomatic Security: State Should Enhance Management of Transportation-Related Risks to Overseas U.S. Personnel. GAO-16-615SU. Washington, D.C.: September 9, 2016. Combating Terrorism: Steps Taken to Mitigate Threats to Locally Hired Staff, but State Department Could Improve Reporting on Terrorist Threats. GAO-15-458SU. Washington, D.C.: June 17, 2015. Federal Chief Information Security Officers: Opportunities Exist to Improve Roles and Address Challenges to Authority. GAO-16-686. Washington, D.C.: August 26, 2016. Information Technology: Federal Agencies Need to Address Aging Legacy Systems. GAO-16-468. Washington, D.C.: May 25, 2016. Information Security: Agencies Need to Improve Controls over Selected High-Impact Systems. GAO-16-501. Washington, D.C.: May 18, 2016. Federal Information Security: Agencies Need to Correct Weaknesses and Fully Implement Security Programs. GAO-15-714. Washington, D.C.: September 29, 2015. Information Security: Agencies Need to Improve Oversight of Contractor Controls. GAO-14-612. Washington, D.C.: August 8, 2014. State Department Telecommunications: Information on Vendors and Cyber-Threat Nations. GAO-17-688R. Washington, D.C.: July 27, 2017. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-655. Washington, D.C.: June 25, 2014. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-380SU. Washington, D.C.: June 5, 2014. In addition to the contact named above, the following individuals made key contributions to this report: Thomas Costa (Assistant Director), Miriam Carroll Fenton (Analyst-in-Charge), Esther Toledo, Mason Calhoun, David Dayton, Neil Doherty, David Hancock, Thomas Johnson, Owen Starlin, and Sally Williamson. The following individuals provided technical assistance and additional support: Joshua Akery, J.P. Avila-Tournut, Jeffrey Baldwin-Bott, Amanda Bartine, John Bauckman, Aniruddha Dasgupta, Mark Dowling, Wayne Emilien, Ian Ferguson, Justin Fisher, Brian Hackney, Brandon Hunt, Guy LoFaro, Michael Rohrback, and Martin Wilson. In addition, each GAO report cited in the preceding enclosures and in appendix VI includes a list of staff who contributed to that product.

Summary: Terrorist attacks against U.S. diplomats and personnel overseas have led to increased attention of State's diplomatic security efforts. In this special publication, GAO identifies key issues affecting Diplomatic Security for Congressional oversight. These issues were identified from a body of related GAO work and State and other reports. GAO also interviewed U.S. officials from State and other agencies to obtain their views on key issues, obtain updated information and data, and follow up on actions they have taken on past GAO and other oversight report recommendations. In response to increasing threats to U.S. personnel and facilities at overseas diplomatic posts since 1998, the Department of State (State) has taken a number of steps to enhance its risk management and security efforts. State's Bureau of Diplomatic Security (Diplomatic Security) leads many of these efforts with assistance from other bureaus and U.S. government agencies. Given the ongoing threats and the amount of resources needed to counter them, GAO has identified 11 key issues regarding Diplomatic Security that warrant significant Congressional oversight to monitor the cost, progress, and impact: Diplomatic Security Funding : Diplomatic Security funding has increased considerably in reaction to a number of security incidents overseas and domestically. In fiscal year 2016, total funding for Diplomatic Security operations--which includes its bureau managed funds as well as other funding such as personnel salaries--was almost $4.8 billion. Diplomatic Security Staffing Challenges : Diplomatic Security's workforce--including 3,488 direct-hire, 1,989 other U.S. government, and 45,870 contract personnel--continues to grow. However, potential challenges exist regarding the distribution of domestic and overseas positions, posting fully qualified individuals in the assignments with the greatest needs, and ongoing efforts to fill language-designated positions. Physical Security of U.S. Diplomatic Facilities : Diplomatic Security and the Bureau of Overseas Buildings Operations collaborate to meet safety standards when constructing new embassies and mitigating risks at existing facilities. However, GAO made recommendations to address gaps in State's security related activities and processes. Physical Security of Diplomatic Residences and Other Soft Targets : State has taken steps to address residential security vulnerabilities and manage risks at schools and other soft targets overseas. However, GAO recommended actions to address weaknesses in State's efforts. Security Training Compliance : While State has robust security training requirements, it lacks consistent monitoring and enforcement processes, particularly for its Foreign Affairs Counter Threat training and for security refresher briefings at posts. Embassy Crisis and Evacuation Preparedness : Gaps in State's implementation and monitoring of crisis and evacuation preparedness could endanger staff assigned to overseas posts and the family members accompanying them. GAO has recommended actions to address these issues. Department of Defense (DOD) Support to U.S. Diplomatic Missions : Following the Benghazi attacks, DOD increased its support to U.S. diplomatic missions by creating dedicated military forces to respond to crises and expanding the Marine Security Guard program at overseas missions. However, State and DOD reported that they have experienced some logistical and other challenges. Dissemination of Threat Information : State has processes for communicating threat information to post personnel and U.S. citizens in-country. However, post personnel--including locally employed staff--have not always received important information in a timely manner. GAO has recommended steps State needs to take to address this concern. Countering Human Intelligence Threats : Foreign intelligence entities from host nations and third parties are motivated to collect information on U.S. operations and intentions. State has established measures to counter the human intelligence threat and works with other U.S. government agencies to identify and assess this threat. Ensuring Information Security : GAO has designated federal information security as a government-wide high-risk area and made recommendations to address these issues. State faces evolving threats and challenges to maintaining obsolete technology, defining clear roles and responsibilities for information security, and overseeing technology contractors. Status of Recommendations Made in Reports following the Benghazi Attack : In response to the Benghazi attack, State formed interagency teams to evaluate the security at 19 dangerous posts, convened an Accountability Review Board (ARB) to investigate the attack, and established panels to conduct further assessments. As of June 2017, State reported having addressed recommendations as follows: 268 of 287 made by the interagency teams, 26 of 29 by the ARB, and 64 of 75 by the panels. While State has taken steps to close recommendations made in past GAO reports, GAO identified 27 open recommendations from these reports (as of August 2017) that it believes should be given high priority for implementation. Of the 27 priority recommendations, 24 were related to diplomatic security.