Five ESE sites collectively contain substantial quantities of Category I special nuclear material. These include the following: the Savannah River Site near Aiken, South Carolina, and the Hanford Site in Richland, Washington, which are managed by the Office of Environmental Management; the Idaho National Engineering and Environmental Laboratory and the Argonne National Laboratory-West, which are located in Idaho Falls, Idaho, and are managed by the Office of Nuclear Energy, Science and Technology; and the Oak Ridge National Laboratory in Oak Ridge, Tennessee, which is managed by the Office of Science. Contractors operate each site for ESE. DOE has requested over $300 million in fiscal year 2006 for security at these five sites. Within DOE’s Office of Security and Safety Performance Assurance, DOE’s Office of Security develops and promulgates orders and policies to guide the department’s safeguards and security programs. DOE’s overall security policy is contained in DOE Order 470.1, Safeguards and Security Program, which was originally approved in 1995. The key component of DOE’s approach to security is the DBT, a classified document that identifies the characteristics of the potential threats to DOE assets. A classified companion document, the Adversary Capabilities List, provides additional information on terrorist capabilities and equipment. The DBT traditionally has been based on a classified, multiagency intelligence community assessment of potential terrorist threats, known as the Postulated Threat. The threat from terrorist groups is generally the most demanding threat contained in the DBT. DOE counters the terrorist threat specified in the DBT with a multifaceted protective system. While specific measures vary from site to site, all protective systems at DOE’s most sensitive sites employ a defense-in- depth concept that includes the following: a variety of integrated alarms and sensors capable of detecting intruders; physical barriers, such as fences and antivehicle obstacles; numerous access control points, such as turnstiles, badge readers, vehicle inspection stations, radiation detectors, and metal detectors; operational security procedures, such as a “two person” rule that prevents only one person from having access to special nuclear material; and hardened facilities and vaults. Each site also has a heavily armed protective force that is often equipped with such items as automatic weapons, night vision equipment, body armor, and chemical protective gear. These protective forces are comprised of Security Police Officers who are classified into three groups: Security Police Officer-I, Security Police Officer-II, and Security Police Officer-III. Security Police Officer-Is are only assigned to fixed, armed posts. Generally, very few of these officers are used at ESE sites because of the limited roles they can fill. Security Police Officer-IIs generally are assigned to posts such as access control booths, or to foot or vehicle patrols. Finally, Security Police Officer-IIIs are responsible for operations such as hostage rescue and the recapture and recovery of special nuclear material. According to federal regulations, Security Police Officer-IIIs have more demanding physical fitness and training standards than Security Police Officer-Is or Security Police Officer-IIs. The ESE sites we visited employ about 1,000 Security Police Officer-IIs and Security Police Officer-IIIs. ESE protective forces work for private contractors and are unionized. Protective force duties and requirements, such as physical fitness standards, are explained in detail in DOE Manual 473.2-2, Protective Force Program Manual, as well as in DOE regulations (10 C.F.R. pt. 1046, Physical Protection of Security Interests). DOE issued the current Protective Force Program Manual in June 2000. Although protective forces are expected to comply with the duties and requirements established in DOE policies, deviations from these policies are allowed as long as certain approval and notification criteria are met. In addition to complying with these security requirements, DOE protective systems, including protective forces, also must meet performance standards. For example, DOE sites are required to demonstrate that their protective systems are capable of defending special nuclear material against terrorist forces identified in the DBT. The performance of protective systems is formally and regularly examined through vulnerability assessments. A vulnerability assessment is a systematic evaluation process in which qualitative and quantitative techniques are applied to detect vulnerabilities and arrive at effective protection of specific assets, such as special nuclear material. To conduct such assessments, DOE uses, among other things, subject matter experts, such as U.S. Special Forces; computer modeling to simulate attacks; and force- on-force exercises, in which the site’s protective forces undergo simulated attacks by a group of mock terrorists. In addition to their use in evaluating the effectiveness of physical protection strategies, DOE believes force-on- force exercises are the most realistic representation of adversary attacks that can be used to train protective forces. Protective forces at the five ESE sites containing Category I special nuclear material generally meet existing key DOE readiness requirements. Specifically, we determined that ESE protective forces generally comply with DOE standards for firearms proficiency, physical fitness levels, and equipment standardization and that the five ESE sites had the required training programs, facilities, and equipment. In addition, we found that the majority of the 105 protective force members we interviewed at ESE sites generally believe that they currently are ready to perform their mission of protecting the site’s special nuclear material. However, we did find some weaknesses at ESE sites that could impair the ability of ESE protective forces to defend their sites. A ready force should possess a sufficient number of experienced, trained, and properly equipped personnel. Through realistic and comprehensive training, these personnel are forged into a cohesive unit that can perform its tasks even under extreme conditions. DOE orders and federal regulations establish the framework for ensuring that DOE protective forces are ready to perform their mission. We found that ESE protective force officers generally believe that they are ready to perform their mission. Specifically, 102 of the 105 officers we interviewed stated that they believed that they, and their fellow officers, understood what was expected of them should the site be attacked by a terrorist group. Moreover, 65 of the 105 officers rated the readiness of their site’s protective force as high, while 20 officers rated their protective force as somewhat or moderately ready to defend the site. Only a minority of the officers (16 of 105) we interviewed rated the readiness of their force to defend their sites as low. In addition, the majority of officers we interviewed believed they and the protective force officers with whom they worked on a regular basis have formed a cohesive unit that would be able to perform their most essential mission—that of protecting special nuclear material. For example, of the 105 officers we interviewed, 84 officers responded that they had a high degree of confidence in their fellow officers in the event of a terrorist attack, and 88 reported that their fellow officers would be willing to risk their lives in defense of their site. As called for in DOE’s Protective Force Program Manual, readiness is achieved through appropriate training and equipment. Each of the five sites we visited had formally approved annual training plans. Each site generally had the training facilities, such as firearms ranges, classrooms, computer terminals, and exercise equipment, which enabled them to meet their current DOE and federal training requirements. Furthermore, each site maintained computerized databases for tracking individual protective force officers’ compliance with training requirements. To determine if these programs and facilities were being used to implement the DOE requirements and federal regulations, we focused on three key areas— firearms proficiency, physical fitness, and protective force officer equipment. Firearms Proficiency. DOE’s Protective Force Program Manual states that protective force officers must demonstrate their proficiency with the weapons that are assigned to them every 6 months. According to the training records of the 105 protective force officers we interviewed, 79 had met this proficiency requirement with their primary weapon, the M-4 or M- 16 semiautomatic rifle. Of the 26 officers who had not met this requirement within the 6 month time frame, 11 officers were all located at one site and 8 of these 11 officers did not meet the requirement until 2 to 5 months after the required time. According to an official at this site, seven of the eight officers could not complete the requirement in a timely fashion because the site’s firing range was closed for the investigation of an accidental weapon discharge that had resulted in an injury to a protective force officer. We determined that 2 of the 26 officers did not complete the requirement for medical reasons. We were not given reasons why the remaining officers did not meet the requirement. Physical Fitness. Under DOE regulations, DOE’s contractors’ protective force personnel who are authorized to carry firearms must meet a minimum standard for physical fitness every 12 months. There are two standards for such personnel—Offensive Combative and Defensive Combative. All Security Police Officer-IIIs, which include DOE special response team members, must meet the Offensive Combative standard, which requires a 1-mile run in no more than 8 minutes 30 seconds and a 40-yard prone-to-running dash in no more than 8 seconds. All other protective officers authorized to carry firearms must meet the Defensive Combative standard, which requires a one-half mile run in no more than 4 minutes 40 seconds and a 40-yard prone-to-running dash in no more than 8.5 seconds. According to the training records of the 105 protective force officers we reviewed, 103 of the 105 protective force officers had met the standard required by federal regulation for their position. Two officers who did not meet the requirement were on medical restriction. The records for another officer showed him as having met the requirement, but additional records provided by the site showed the officer had completed the run in a time that exceeded the standard. Site officials could not provide an explanation for this discrepancy. Protective Officer Equipment. DOE’s Protective Force Program Manual sets a number of requirements for protective force equipment. For example, all Security Police Officers are required to carry a minimum set of equipment, including a portable radio, a handgun, and an intermediate force weapon such as a baton. In addition, a mask to protect against a chemical attack must be carried or available to them. All Security Police Officer-IIs and Security Police Officer-IIIs must also have access to personal protective body armor. In addition, firearms must be kept serviceable at all times and must be inspected by a DOE-certified armorer at least twice a year to ensure serviceability. Issued firearms must be inventoried at the beginning of each shift, an inventory of all firearms in storage must be conducted weekly, and a complete inventory of all firearms must be conducted on a monthly basis. Finally, DOE protective forces equipment must be tailored to counter adversaries identified in the DBT. To this end, sites employ a variety of equipment, including automatic weapons, night vision equipment, and body armor. In most cases, each site’s protective forces carried or had access to the required minimum standard duty equipment. Most sites demonstrated that they had access to certified armorers, and each site maintained the required firearms maintenance, inspection, and inventory records, often kept in a detailed computerized database. The appropriate policies and procedures were also in place for the inventory of firearms. In addition, some sites have substantially increased their protective forces weaponry since September 11, 2001, or have plans to further enhance these capabilities to meet the 2004 DBT. While protective forces at ESE sites are generally meeting current DOE requirements, we identified some weaknesses in ESE protective force practices that could adversely affect the current readiness of ESE protective forces to defend their sites. These include protective force officers’ lack of participation in realistic force-on-force exercises; the frequency and quality of training opportunities; the lack of dependable communications systems; insufficient protective gear, including protective body armor and chemical protective gear; and the lack of armored vehicles. Performance Testing and Training. According to DOE’s Protective Force Program Manual, performance tests are used to evaluate and verify the effectiveness of protective force programs and to provide needed training. A force-on-force exercise is one type of performance test during which the protective force engages in a simulated battle against a mock adversary force, employing the weapons, equipment, and methodologies postulated in the DBT. DOE believes that force-on-force exercises are a valuable training tool for protective force officers. Consequently, DOE policy requires that force-on-force exercises be held at least once a year at sites that possess Category I quantities of special nuclear material or Category II quantities that can be rolled up to Category I quantities. However, DOE neither sets standards for individual protective force officers’ participation in these exercises, nor requires sites to track individual participation. While 84 of the 105 protective force officers we interviewed stated they had participated in a force-on-force exercise, only 46 of the 84 protective force officers believed that the force-on-force exercises they had participated in were either realistic or somewhat realistic. Additionally, protective force officers often told us that they did not have frequent and realistic tactical training. In this regard, 33 of the 84 protective force officers reported that safety considerations interfered with the realism of the force-on-force exercises, with some protective force officers stating that they were limited in the tactics they could employ. For example, some protective force officers stated that they were not allowed to run up stairwells, climb fences, or exceed the speed limit in patrol vehicles. Contractors’ protective force managers agreed that safety requirements limited the kind of realistic force-on-force training that are needed to ensure effective protective force performance. Communications Equipment. According to DOE’s Protective Force Program Manual, the radios protective force officers use must be capable of two-way communications, provide intelligible voice communications, and be readily available in sufficient numbers to equip protective force personnel. In addition, a sufficient number of batteries must be available and maintained in a charged condition. Protective force officers at all five of the sites we visited reported problems with their radio communications systems. Specifically, 66 of the 105 protective force officers reported that they did not always have dependable radio communications, with 23 officers identifying sporadic battery life, and 29 officers reporting poor reception at some locations on site as the two most significant problems. In addition, some of the protective force officers believed that radio communications were not sufficient to support their operations and could not be relied on if a terrorist attack occurred. Site security officials at two sites acknowledged that efforts were under way to improve radio communications equipment. In addition, security officials said other forms of communications, such as telephones, cellular telephones, and pagers, were provided for protective forces to ensure that they could communicate effectively. Protective Body Armor. DOE’s Protective Force Program Manual requires that Security Police Officer-IIs and -IIIs wear body armor or that body armor be stationed in a way that allows them to quickly put it on to respond to an attack without negatively impacting response times. At one site, we found that most Security Police Officer-IIs had not been issued protective body armor because the site had requested and received in July 2003 a waiver to deviate from the requirement to equip all Security Police Officer-IIs with body armor. The waiver was sought for a number of reasons, including the (1) increased potential for heat-related injuries while wearing body armor during warm weather, (2) increased equipment load that armor would place on protective force members, (3) costs of acquiring the necessary quantity of body armor and the subsequent replacement costs, and (4) associated risks of not providing all Security Police Officer-IIs with body armor could be mitigated by using cover provided at the site by natural and man-made barriers. According to a site security official, this waiver is currently being reviewed because of the increased threat contained in the 2004 DBT. Special Response Team Capabilities. Security Police Officers-IIIs serve on special response teams responsible for offensive operations, such as hostage rescue and the recapture and recovery of special nuclear material. Special response teams are often assigned unique equipment, including specially encrypted radios; body armor that provides increased levels of protection; special suits that enable officers to operate and fight in chemically contaminated environments; special vehicles, including armored vehicles; submachine guns; light machine guns; grenade launchers; and precision rifles, such as Remington 700 rifles and Barrett .50 caliber rifles. These response teams are also issued breaching tools to allow them to reenter facilities to which terrorists may have gained access. Each site with Category I special nuclear material must have a special response team capability available on a continuous basis. However, one ESE site does not have this capability and, instead, relies on another organization, through a formal memorandum of understanding, to provide a special response team. This arrangement, however, has not been comprehensively performance-tested, as called for in the memorandum of understanding. Site officials state that they will soon conduct the first comprehensive performance test of this memorandum of understanding. Chemical Protective Gear. DOE’s Protective Force Program Manual specifies that all Security Police Officer-IIs and -IIIs be provided, at a minimum, with protective masks that provide for nuclear, chemical, and biological protection. Other additional chemical protective gear and procedures are delegated to the sites. At the four sites with special response teams, we found that the teams all had special suits that allowed them to operate and fight in environments that might be chemically contaminated. For Security Police Officers-IIs, chemical protective equipment and expectations for fighting in chemically contaminated environments varied. For example, two sites provided additional protective equipment for their Security Police Officer-IIs and expected them to fight in such environments. Another site did not provide additional equipment but expected its Security Police Officer-IIs to evacuate along with other site workers. Finally, the one site that did not have a special response team expected its Security Police Officer-IIs to fight in chemically contaminated environments. However, the site provided no additional protective gear for its officers other than standard-duty issue long-sleeved shirts and the required protective masks. Protective Force Vehicles. We found that ESE sites currently do not have the same level of vehicle protection as National Nuclear Security Administration (NNSA) sites that also have Category I special nuclear material. Specifically, while not a DOE requirement, all NNSA sites with Category I special nuclear material currently operate armored vehicles. However, only one of the five ESE sites with Category I special nuclear material operated armored vehicles at the time of our review. One other ESE site was planning to deploy armored vehicles. To successfully defend against the larger terrorist threat contained in the 2004 DBT by October 2008, DOE and ESE officials recognize that they need to take several actions. These include transforming its current protective force into an elite force, developing and deploying new security technologies, consolidating and eliminating special nuclear material, and making organizational improvements within ESE’s security program. However, because these initiatives, particularly an elite force, are in early stages of development and will require a significant commitment of resources and coordination across DOE and ESE, their completion by the October 2008 DBT implementation deadline is uncertain. The status of these initiatives is as follows: Elite Forces. DOE officials believe that the way its sites, including those sites managed by ESE, currently train their contractor-operated protective forces will not be adequate to defeat the terrorist threat contained in the 2004 DBT. This view is shared by most protective force officers (74 out of 105) and their contractor protective force managers who report that they are not at all confident in their current ability to defeat the new threats contained in the 2004 DBT. In response, the department has proposed the development of an elite force that would be patterned after U. S. Special Forces and might eventually be converted from a contractor-operated force into a federal force. Nevertheless, despite broad support, DOE’s proposal for an elite force remains largely in the conceptual phase. DOE has developed a preliminary draft implementation plan that lays out high- level milestones and key activities, but this plan has not been formally approved by the Office of Security and Safety Performance Assurance. The draft implementation plan recognizes that DOE will have to undertake and complete a number of complex tasks in order to develop the elite force envisioned. For example, DOE will have to revise its existing protective forces policies to incorporate, among other things, the increased training standards that are needed to create an elite force. Since this proposal is only in the conceptual phase, completing this effort by the October 2008 DBT implementation deadline is unlikely. New Security Technologies. DOE is seeking to improve the effectiveness and survivability of its protective forces by developing and deploying new security technologies. It believes technologies can reduce the risk to protective forces in case of an attack and can provide additional response time to meet and defeat an attack. Sixteen of the 105 protective force officers we interviewed generally supported this view and said they needed enhanced detection technologies that would allow them to detect adversaries at much greater ranges than is currently possible at most sites. However, a senior DOE official recently conceded that the department has not yet taken the formal steps necessary to coordinate investment in emerging security technologies and that the role of technology in helping sites meet the new threats contained in the 2004 DBT by the department’s deadline of October 2008 is uncertain. Consolidation and Elimination of Materials. ESE’s current strategy to meet the October 2008 deadline relies heavily on consolidating and eliminating special nuclear material between and among ESE sites. For example, the Office of Nuclear Energy, Science and Technology plans to down-blend special nuclear material and extract medically useful isotopes at the Oak Ridge National Laboratory—an Office of Science site. This action would eliminate most of the security concerns surrounding the material. Neither program office, however, has been able to formally agree on its share of additional security costs, which have increased significantly because of the new DBT. In addition, neither ESE nor DOE has developed a comprehensive, departmentwide plan to achieve the needed cooperation and agreement among the sites and program offices to consolidate special nuclear material, as we recommended in our April 2004 report. In the absence of a comprehensive plan, completing most of these consolidation activities by the October 2008 DBT implementation deadline is unlikely. Organizational Improvements. The ESE headquarters security organization is not well suited to meeting the challenges associated with implementing the 2004 DBT. Specifically, there is no centralized security organization within the Office of the Under Secretary, ESE. The individual who serves as the Acting ESE Security Director has been detailed to the Office by DOE’s Office of Security and Safety Performance Assurance and has no programmatic authority or staff. This lack of authority limits the Director’s ability to facilitate ESE and DOE-wide cooperation on such issues as material down-blending at Oak Ridge National Laboratory and material consolidation at other ESE sites. Mr. Chairman, this concludes my prepared statement. I would be happy to respond to any questions that you or Members of the Subcommittee may have. For further information on this testimony, please contact Gene Aloise at (202) 512-3841. James Noel, Jonathan Gill, Don Cowan, and Preston Heard made key contributions to this testimony. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: A successful terrorist attack on a Department of Energy (DOE) site containing nuclear weapons material could have devastating effects for the site and nearby communities. DOE's Office of the Under Secretary for Energy, Science and Environment (ESE), which is responsible for DOE operations in areas such as energy research, manages five sites that contain weapons-grade nuclear material. A heavily armed security force equipped with such items as automatic weapons protects ESE sites. GAO was asked to examine (1) the extent to which ESE protective forces are meeting DOE's existing readiness requirements and (2) the actions DOE and ESE will need to take to successfully defend against the larger, revised terrorist threat identified in the October 2004 design basis threat (DBT) by DOE's implementation deadline of October 2008. Protective forces at the five ESE sites containing weapons-grade nuclear material generally meet existing key DOE readiness requirements. Specifically, GAO determined that ESE protective forces generally comply with DOE standards for firearms proficiency, physical fitness levels, and equipment standardization and that the five ESE sites had the required training programs, facilities, and equipment. However, GAO did find some weaknesses at ESE sites that could adversely affect the ability of protective forces to defend these sites. For example, despite the importance of training exercises in which protective forces undergo simulated attacks by a group of mock terrorists (force-on-force exercises), DOE neither sets standards for individual protective force officers to participate in these exercises, nor does it require sites to track individual participation. GAO also found that protective force officers at all five of the ESE sites reported problems with their radio communications systems. Specifically, according to 66 of the 105 protective force officers GAO interviewed, they did not always have dependable radio communications as required by the DOE Manual 473.2-2, Protective Force Program Manual. Security officials stated that related improvements were under way. To successfully defend against the larger terrorist threat contained in the 2004 DBT by October 2008, DOE and ESE officials recognize that they will need to take several prompt and coordinated actions. These include transforming its current protective force into an elite, possibly federalized, force, developing and deploying new security technologies to reduce the risk to protective forces in case of an attack, consolidating and eliminating nuclear weapons material between and among ESE sites, and creating a sound ESE management structure that has sufficient authority to ensure coordination across all ESE offices that have weapons-grade nuclear material. However, because these initiatives, particularly an elite force, are in early stages of development and will require significant commitment of resources and coordination across DOE and ESE, their completion by the October 2008 DBT implementation deadline is uncertain.