Since DHS began operations in March 2003, it has developed and implemented key policies, programs, and activities for implementing its homeland security missions and functions that have created and strengthened a foundation for achieving its potential as it continues to mature. However, the department’s efforts have been hindered by challenges faced in leading and coordinating the homeland security enterprise; implementing and integrating its management functions for results; and strategically managing risk and assessing, and adjusting as necessary, its homeland security efforts. DHS has made progress in these three areas, but needs to take additional action, moving forward, to help it achieve its full potential. DHS has made important progress in implementing and strengthening its mission functions over the past 8 years, including implementing key homeland security operations and achieving important goals and milestones in many areas. The department’s accomplishments include developing strategic and operational plans across its range of missions; hiring, deploying and training workforces; establishing new, or expanding existing, offices and programs; and developing and issuing policies, procedures, and regulations to govern its homeland security operations. For example:  DHS issued the QHSR, which provides a strategic framework for homeland security, and the National Response Framework, which outlines guiding principles for disaster response.  DHS successfully hired, trained, and deployed workforces, such as a federal screening workforce which assumed security screening responsibilities at airports nationwide, and the department has about 20,000 agents to patrol U.S. land borders.  DHS created new programs and offices, or expanded existing ones, to implement key homeland security responsibilities, such as establishing the United States Computer Emergency Readiness Team to, among other things, coordinate the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. DHS also expanded programs for identifying and removing aliens subject to removal from the United States and for preventing unauthorized aliens from entering the country.  DHS issued policies and procedures addressing, among other things, the screening of passengers at airport checkpoints, inspecting travelers seeking entry into the United States, and assessing immigration benefit applications and processes for detecting possible fraud. Establishing these elements and others are important accomplishments and have been critical for the department to position and equip itself for fulfilling its homeland security missions and functions. However, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. For example, we have reported that many DHS programs and investments have experienced cost overruns, schedule delays, and performance problems, including, for instance, DHS’s recently cancelled technology program for securing U.S. borders, known as the Secure Border Initiative Network, and some technologies for screening passengers at airport checkpoints. Further, with respect to the cargo advanced automated radiography system to detect certain nuclear materials in vehicles and containers at ports DHS pursued the acquisition and deployment of the system without fully understanding that it would not fit within existing inspection lanes at ports of entry. DHS subsequently canceled the program. DHS also has not yet fully implemented its roles and responsibilities for developing and implementing key homeland security programs and initiatives. For example, DHS has not yet developed a set of target capabilities for disaster preparedness or established metrics for assessing those capabilities to provide a framework for evaluating preparedness, as required by the Post-Katrina Emergency Management Reform Act. Our work has shown that DHS should take additional action to improve the efficiency and effectiveness of a number of its programs and activities by, for example, improving program management and oversight, and better assessing homeland security requirements, needs, costs, and benefits, such as those for key acquisition and technology programs. Table 1 provides examples of key progress and work remaining in DHS’s functional mission areas, with an emphasis on work we completed since 2008. Impacting the department’s ability to efficiently and effectively satisfy its missions are: (1) the need to integrate and strengthen its management functions; (2) the need for increased utilization of performance assessments; (3) the need for an enhanced use of risk information to inform planning, programming, and investment decision-making; (4) limitations in effective sharing and use of terrorism-related information; (5) partnerships that are not sustained or fully leveraged; and (6) limitations in developing and deploying technologies to meet mission needs. DHS made progress in addressing these areas, but more work is needed, going forward, to further mitigate these challenges and their impact on DHS’s mission implementation. For instance, DHS strengthened its performance measures in recent years and linked its measures to the QHSR’s missions and goals. However, DHS and its components have not yet developed measures for assessing the effectiveness of key homeland security programs, such as programs for securing the border and preparing the nation for emergency incidents. For example, with regard to checkpoints DHS operates on U.S. roads to screen vehicles for unauthorized aliens and contraband, DHS established three performance measures to report the results of checkpoint operations. However, the measures did not indicate if checkpoints were operating efficiently and effectively and data reporting and collection challenges hindered the use of results to inform Congress and the public on checkpoint performance. Moreover, DHS has not yet established performance measures to assess the effectiveness of its programs for investigating alien smuggling operations and foreign nationals who overstay their authorized periods of admission to the United States, making it difficult for these agencies to determine progress made in these areas and evaluate possible improvements. Further, DHS and its component agencies developed strategies and tools for conducting risk assessments. For example, DHS has conducted risk assessments of various surface transportation modes, such as freight rail, passenger rail, and pipelines. However, the department needs to strengthen its use of risk information to inform its planning and investment decision-making. For example, DHS could better use risk information to plan and prioritize security measures and investments within and across its mission areas, as the department cannot secure the nation against every conceivable threat. In addition, DHS took action to develop and deploy new technologies to help meet its homeland security missions. However, in a number of instances DHS pursued acquisitions without ensuring that the technologies met defined requirements, conducting and documenting appropriate testing and evaluation, and performing cost-benefit analyses, resulting in important technology programs not meeting performance expectations. For example, in 2006, we recommended that DHS’s decision to deploy next-generation radiation-detection equipment, or advanced spectroscopic portals, used to detect smuggled nuclear or radiological materials, be based on an analysis of both the benefits and costs and a determination of whether any additional detection capability provided by the portals was worth their additional cost. DHS subsequently issued a cost-benefit analysis, but we reported that this analysis did not provide a sound analytical basis for DHS’s decision to deploy the portals. In June 2009, we also reported that an updated cost-benefit analysis might show that DHS’s plan to replace existing equipment with advanced spectroscopic portals was not justified, particularly given the marginal improvement in detection of certain nuclear materials required of advanced spectroscopic portals and the potential to improve the current- generation portal monitors’ sensitivity to nuclear materials, most likely at a lower cost. In July 2011, DHS announced that it would end the advanced spectroscopic portal project as originally conceived given the challenges the program faced. As we have previously reported, while it is important that DHS continue to work to strengthen each of its functional areas, it is equally important that these areas be addressed from a comprehensive, departmentwide perspective to help mitigate longstanding issues that have impacted the department’s progress. Our work at DHS has identified several key themes—leading and coordinating the homeland security enterprise, implementing and integrating management functions for results, and strategically managing risks and assessing homeland security efforts—that have impacted the department’s progress since it began operations. These themes provide insights that can inform DHS’s efforts, moving forward, as it works to implement its missions within a dynamic and evolving homeland security environment. DHS made progress and has had successes in all of these areas, but our work found that these themes have been at the foundation of DHS’s implementation challenges, and need to be addressed from a departmentwide perspective to position DHS for the future and enable it to satisfy the expectations set for it by the Congress, the administration, and the country. Leading and coordinating the homeland security enterprise. While DHS is one of a number of entities with a role in securing the homeland, it has significant leadership and coordination responsibilities for managing efforts across the homeland security enterprise. To satisfy these responsibilities, it is critically important that DHS develop, maintain and leverage effective partnerships with its stakeholders, while at the same time addressing DHS-specific responsibilities in satisfying its missions. Before DHS began operations, we reported that the quality and continuity of the new department’s leadership would be critical to building and sustaining the long-term effectiveness of DHS and achieving homeland security goals and objectives. We further reported that to secure the nation, DHS must form effective and sustained partnerships between components and also with a range of other entities, including federal agencies, state and local governments, the private and nonprofit sectors, and international partners. DHS has made important strides in providing leadership and coordinating efforts. For example, it has improved coordination and clarified roles with state and local governments for emergency management. DHS also strengthened its partnerships and collaboration with foreign governments to coordinate and standardize security practices for aviation security. However, DHS needs to take additional action to forge effective partnerships and strengthen the sharing and utilization of information, which has affected its ability to effectively satisfy its missions. For example, we reported that the expectations of private sector stakeholders have not been met by DHS and its federal partners in areas related to sharing information about cyber-based threats to critical infrastructure. Without improvements in meeting private and public sector expectations for sharing cyber threat information, private-public partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information and mechanisms needed to thwart sophisticated cyber attacks that could have catastrophic effects on our nation’s cyber-reliant critical infrastructure. Moreover, we reported that DHS needs to continue to streamline its mechanisms for sharing information with public transit agencies to reduce the volume of similar information these agencies receive from DHS, making it easier for them to discern relevant information and take appropriate actions to enhance security. In 2005, we designated information sharing for homeland security as high risk because the federal government faced serious challenges in analyzing information and sharing it among partners in a timely, accurate, and useful way. Gaps in sharing, such as agencies’ failure to link information about the individual who attempted to conduct the December 25, 2009, airline bombing, prevented the individual from being included on the federal government’s consolidated terrorist watchlist, a tool used by DHS to screen for persons who pose a security risk. The federal government and DHS have made progress, but more work remains for DHS to streamline its information sharing mechanisms and better meet partners’ needs. Moving forward, it will be important that DHS continue to enhance its focus and efforts to strengthen and leverage the broader homeland security enterprise, and build off the important progress that it has made thus far. In addressing ever-changing and complex threats, and with the vast array of partners with which DHS must coordinate, continued leadership and stewardship will be critical in achieving this end. Implementing and integrating management functions for results. Following its establishment, the department focused its efforts primarily on implementing its various missions to meet pressing homeland security needs and threats, and less on creating and integrating a fully and effectively functioning department from 22 disparate agencies. This initial focus on mission implementation was understandable given the critical homeland security needs facing the nation after the department’s establishment, and the enormous challenge posed by creating, integrating, and transforming a department as large and complex as DHS. As the department matured, it has put into place management policies and processes and made a range of other enhancements to its management functions—acquisition, information technology, financial, and human capital management. However, DHS has not always effectively executed or integrated these functions. In 2003, we designated the transformation and integration of DHS as high risk because DHS had to transform 22 agencies into one department, and failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Eight years later, DHS remains on our high-risk list. DHS has demonstrated strong leadership commitment to addressing its management challenges and has begun to implement a strategy to do so. Further, DHS developed various management policies, directives, and governance structures, such as acquisition and information technology management policies and controls, to provide enhanced guidance on investment decision making. DHS also reduced its financial management material weaknesses in internal control over financial reporting and developed strategies to strengthen human capital management, such as its Workforce Strategy for Fiscal Years 2011-2016. However, DHS needs to continue to demonstrate sustainable progress in addressing its challenges, as these issues have contributed to schedule delays, cost increases, and performance problems in major programs aimed at delivering important mission capabilities. For example, in September 2010, we reported that the Science and Technology Directorate’s master plans for conducting operational testing of container security technologies did not reflect all of the operational scenarios that U.S. Customs and Border Protection was considering for implementation. In addition, when it developed the US-VISIT program, DHS did not sufficiently define what capabilities and benefits would be delivered, by when, and at what cost, and the department has not yet determined how to deploy a biometric exit capability under the program. Moreover, DHS does not yet have enough skilled personnel to carry out activities in various areas, such as acquisition management; and has not yet implemented an integrated financial management system, impacting its ability to have ready access to reliable, useful, and timely information for informed decision making. Moving forward, addressing these management challenges will be critical for DHS’s success, as will be the integration of these functions across the department to achieve efficiencies and effectiveness. Strategically managing risks and assessing homeland security efforts. Forming a new department while working to implement statutorily mandated and department-initiated programs and responding to evolving threats, was, and is, a significant challenge facing DHS. Key threats, such as attempted attacks against the aviation sector, have impacted and altered DHS’s approaches and investments, such as changes DHS made to its processes and technology investments for screening passengers and baggage at airports. It is understandable that these threats had to be addressed immediately as they arose. However, limited strategic and program planning by DHS and limited assessment to inform approaches and investment decisions have contributed to programs not meeting strategic needs or not doing so in an efficient manner. For example, as we reported in July 2011, the Coast Guard’s planned acquisitions through its Deepwater Program, which began before DHS’s creation and includes efforts to build or modernize ships and aircraft and supporting capabilities that are critical to meeting the Coast Guard’s core missions in the future, is unachievable due to cost growth, schedule delays and affordability issues. In addition, because FEMA has not yet developed a set of target disaster preparedness capabilities and a systematic means of assessing those capabilities, as required by the Post-Katrina Emergency Management Reform Act and Presidential Policy Directive 8, it cannot effectively evaluate and identify key capability gaps and target limited resources to fill those gaps. Further, DHS has made important progress in analyzing risk across sectors, but it has more work to do in using this information to inform planning and resource allocation decisions. Risk management has been widely supported by Congress and DHS as a management approach for homeland security, enhancing the department’s ability to make informed decisions and prioritize resource investments. Since DHS does not have unlimited resources and cannot protect the nation from every conceivable threat, it must make risk-informed decisions regarding its homeland security approaches and strategies. Moreover, we have reported on the need for enhanced performance assessment, that is, evaluating existing programs and operations to determine whether they are operating as intended or are in need of change, across DHS’s missions. Information on the performance of programs is critical for helping the department, Congress, and other stakeholders more systematically assess strengths and weaknesses and inform decision making. In recent years, DHS has placed an increased emphasis on strengthening its mechanisms for assessing the performance and effectiveness of its homeland security programs. For example, DHS established new performance measures, and modified existing ones, to better assess many of its programs and efforts. However, our work has found that DHS continues to miss opportunities to optimize performance across its missions because of a lack of reliable performance information or assessment of existing information; evaluation among feasible alternatives; and, as appropriate, adjustment of programs or operations that are not meeting mission needs. For example, DHS’s program for research, development, and deployment of passenger checkpoint screening technologies lacked a risk-based plan and performance measures to assess the extent to which checkpoint screening technologies were achieving the program’s security goals, and thereby reducing or mitigating the risk of terrorist attacks. As a result, DHS had limited assurance that its strategy targeted the most critical risks and that it was investing in the most cost-effective new technologies or other protective measures. As the department further matures and seeks to optimize its operations, DHS will need to look beyond immediate requirements; assess programs’ sustainability across the long term, particularly in light of constrained budgets; and evaluate tradeoffs within and among programs across the homeland security enterprise. Doing so should better equip DHS to adapt and respond to new threats in a sustainable manner as it works to address existing ones. Given DHS’s role and leadership responsibilities in securing the homeland, it is critical that the department’s programs and activities are operating as efficiently and effectively as possible, are sustainable, and continue to mature, evolve and adapt to address pressing security needs. DHS has made significant progress throughout its missions since its creation, but more work is needed to further transform the department into a more integrated and effective organization. DHS has also made important progress in strengthening partnerships with stakeholders, improving its management processes and sharing of information, and enhancing its risk management and performance measurement efforts. These accomplishments are especially noteworthy given that the department has had to work to transform itself into a fully functioning cabinet department while implementing its missions—a difficult undertaking for any organization and one that can take years to achieve even under less daunting circumstances. Impacting the department’s efforts have been a variety of factors and events, such as attempted terrorist attacks and natural disasters, as well as new responsibilities and authorities provided by Congress and the administration. These events collectively have forced DHS to continually reassess its priorities and reallocate resources as needed, and have impacted its continued integration and transformation. Given the nature of DHS’s mission, the need to remain nimble and adaptable to respond to evolving threats, as well as to work to anticipate new ones, will not change and may become even more complex and challenging as domestic and world events unfold, particularly in light of reduced budgets and constrained resources. To better position itself to address these challenges, our work has shown that DHS should place an increased emphasis and take additional action in supporting and leveraging the homeland security enterprise, managing its operations to achieve needed results, and strategically planning for the future while assessing and adjusting, as needed, what exists today. Addressing these issues will be critically important for the department to strengthen its homeland security programs and operations. Eight years after its establishment and 10 years after the September 11, 2001, terrorist attacks, DHS has indeed made significant strides in protecting the nation, but has yet to reach its full potential. Chairman King, Ranking Member Thompson, and Members of the Committee, this concludes my prepared statement. I would be pleased to respond to any questions you may have at this time. For further information regarding this testimony, please contact Cathleen A. Berrick at (202) 512-3404 or berrickc@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Rebecca Gambler, Assistant Director; Melissa Bogar; Susan Czachor; Sarah Kaczmarek; Tracey King; Taylor Matheson; Jessica Orr; and Meghan Squires. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The terrorist attacks of September 11, 2001, led to profound changes in government agendas, policies and structures to confront homeland security threats facing the nation. Most notably, the Department of Homeland Security (DHS) began operations in 2003 with key missions that included preventing terrorist attacks from occurring in the United States, reducing the country's vulnerability to terrorism, and minimizing the damages from any attacks that may occur. DHS is now the third-largest federal department, with more than 200,000 employees and an annual budget of more than $50 billion. Since 2003, GAO has issued over 1,000 products on DHS's operations in such areas as transportation security and emergency management, among others. As requested, this testimony addresses DHS's progress and challenges in implementing its homeland security missions since it began operations, and issues affecting implementation efforts. This testimony is based on a report GAO issued in September 2011, which assessed DHS's progress in implementing its homeland security functions and work remaining. Since it began operations in 2003, DHS has implemented key homeland security operations and achieved important goals and milestones in many areas to create and strengthen a foundation to reach its potential. As it continues to mature, however, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. DHS's accomplishments include developing strategic and operational plans; deploying workforces; and establishing new, or expanding existing, offices and programs. For example, DHS (1) issued plans to guide its efforts, such as the Quadrennial Homeland Security Review, which provides a framework for homeland security, and the National Response Framework, which outlines disaster response guiding principles; (2) successfully hired, trained, and deployed workforces, such as a federal screening workforce to assume security screening responsibilities at airports nationwide; and (3) created new programs and offices to implement its homeland security responsibilities, such as establishing the U.S. Computer Emergency Readiness Team to help coordinate efforts to address cybersecurity threats. Such accomplishments are noteworthy given that DHS has had to work to transform itself into a fully functioning department while implementing its missions--a difficult undertaking that can take years to achieve. While DHS has made progress, its transformation remains high risk due to its management challenges. Examples of progress made and work remaining include: Border security. DHS implemented the U.S. Visitor and Immigrant Status Indicator Technology program to verify the identities of foreign visitors entering and exiting the country by processing biometric and biographic information. However, DHS has not yet determined how to implement a biometric exit capability and has taken action to address a small portion of the estimated overstay population in the United States (individuals who legally entered the country but then overstayed their authorized periods of admission). Aviation security. DHS developed and implemented Secure Flight, a program for screening airline passengers against terrorist watchlist records. DHS also developed new programs and technologies to screen passengers, checked baggage, and air cargo. However, DHS does not yet have a plan for deploying checked baggage screening technologies to meet recently enhanced explosive detection requirements, a mechanism to verify the accuracy of data to help ensure that air cargo screening is being conducted at reported levels, or approved technology to screen cargo once it is loaded onto a pallet or container. Emergency preparedness and response. DHS issued the National Preparedness Guidelines that describe a national framework for capabilities-based preparedness, and a Target Capabilities List to provide a national-level generic model of capabilities defining all-hazards preparedness. DHS is also finalizing a National Disaster Recovery Framework. However, DHS needs to strengthen its efforts to assess capabilities for all-hazards preparedness, and develop a long-term recovery structure to better align timing and involvement with state and local governments' capacity. Chemical, biological, radiological and nuclear (CBRN) threats. DHS assessed risks posed by CBRN threats and deployed capabilities to detect CBRN threats. However, DHS should work to improve its coordination of CBRN risk assessments, and identify monitoring mechanisms for determining progress made in implementing the global nuclear detection strategy. GAO's work identified three themes at the foundation of DHS's challenges: Leading and coordinating the homeland security enterprise; Implementing and integrating management functions for results; and Strategically managing risks and assessing homeland security efforts. This testimony contains no new recommendations.