The United States has long been open and receptive toward foreign investment. In 2011, the President issued Executive Order 13,577, creating the SelectUSA Initiative, in part, to encourage foreign investment in the United States. In addition, legislation introduced in the 114th Congress is aimed, in part, at attracting more foreign investment in real estate through changes in the tax code. According to some real estate companies we interviewed, investors are attracted to government-leased buildings because they provide a safe and reliable rate of return. Representatives from one real estate company added that the advantages of leasing to the federal government include the ability of investors to receive higher rates of return, compared with Treasury bonds, that the real estate also appreciates in value, and that the projects help promote underdeveloped areas. A representative from another firm said that foreign investors are also interested in the government’s long- term lease of space. Foreign investment in U.S. commercial office buildings has been increasing in recent years. According to Real Capital Analytics, annual foreign investment in significant U.S. commercial office buildings increased from $11.7 billion in 2011 to $26.5 billion in 2015. As shown in figure 1, of those amounts, investors from Canada, Germany, China, Norway, and South Korea invested the most during those 5 years. For example, data from Real Capital Analytics indicated that in 2015, foreign investors purchased 336 commercial office buildings in the United States, 106 of which were purchased by Chinese investors for a total of $2.8 billion. Chinese investment in U.S. commercial office buildings was part of overall increased Chinese investment in the United States. According to the National Committee on U.S.-China Relations and the Rhodium Group, overall Chinese investment in the United States could reach $30 billion in 2016, up from $15 billion in 2015 and $4.9 billion in 2011. GSA is responsible for leasing space for many agencies of the federal government and has about 8,300 leases of space. GSA develops, coordinates, issues, and administers real property policies, guidelines, and standards for property under its custody and control and for agencies operating under, or subject to, the authorities of the GSA Administrator. As of March 2016, GSA had about 1,400 leases of high-security space in about 850 buildings. Since 2008, GSA has leased more space than is federally-owned and under its custody and control. For example, in fiscal year 2015, GSA leased 190.8 million square feet of space, compared with having custody and control of 183.2 million square feet of federally-owned space. Overreliance on costly leasing is one of the major reasons that federal real property management remains on GAO’s high-risk list. Our work over the years has shown that leasing space often costs the government more than owning buildings, especially for long-term space needs. GSA and DHS’s Federal Protective Service (FPS) have joint responsibility for protecting federal facilities held or leased by GSA. FPS has primary responsibility for the security and protection of buildings and their occupants, whereas GSA has primary responsibility for security fixtures, maintenance, and building access. Some agencies also use their own police forces to protect their facilities. FPS and the client agencies set the facility security levels in consultation with GSA. As discussed later, these levels determine the frequency of required risk assessments of facilities, among other things. CFIUS, an interagency committee chaired by the Treasury Department, reviews transactions that could result in foreign control of a U.S. business, which could include a company that leases space to the federal government, in order to determine the effect of such transactions on the national security of the United States. Under the Foreign Investment and National Security Act of 2007 (FINSA), CFIUS shall review “any merger, acquisition, or takeover…by or with any foreign person which could result in foreign control of any person engaged in interstate commerce in the United States” to determine the effects of such transaction on the national security of the United States. To review a foreign acquisition of a U.S. business, CFIUS must determine that the acquisition is a “covered transaction.” CFIUS may recommend that the President suspend or prohibit any covered transaction that presents unresolved national security concerns. Under FINSA, the President may block a foreign acquisition that raises national security concerns, but this has rarely occurred. CFIUS’s reviews are confidential and protected from public disclosure. FinCEN is one of the Treasury Department’s primary bureaus to oversee and implement policies to prevent and detect money laundering. FinCEN uses anti-money laundering laws such as the Bank Secrecy Act to require reporting and recordkeeping by banks and other financial institutions. The regulation and enforcement of the Bank Secrecy Act involves several different federal agencies, including FinCEN, the federal depository institution regulators—the Federal Deposit Insurance Corporation, Federal Reserve, National Credit Union Administration, and the Office of the Comptroller of the Currency—the Internal Revenue Service (IRS), the Commodity Futures Trading Commission, DOJ, and SEC. Because owning property can provide access to the buildings and building systems, foreign ownership of government-leased space can pose security risks particularly regarding cybersecurity. In 2014, we reported that federal facilities are vulnerable to cyber attacks to their building and access control systems (e.g., heating, ventilation, and air- conditioning; surveillance cameras; and electronic card readers), which could provide unauthorized access to the facilities, endanger the occupants, and provide access to information systems. We found that insider threats—which can include disgruntled employees, contractors, or other persons abusing their positions of trust—represent a significant threat to building and access control systems, given insiders’ access to and knowledge of these systems. These insider threats can also include the owners and the people they employ to operate the buildings. In addition, we reported that nations use cyber tools as part of their information-gathering and espionage activities. In our 2014 report, we recommended that the Secretary of Homeland Security direct the Interagency Security Committee (ISC), housed within DHS, to incorporate the cyber threat to building and access control systems into ISC’s list of undesirable events in its Design-Basis Threat report, which informs agencies about the threats they face. DHS implemented our recommendation in 2016. DHS has identified or received reports of cyber attacks on government facilities in recent years such as incidents at a state law enforcement crime lab and a wastewater plant. Furthermore, in March 2016, the U.S. Attorney for the Southern District of New York announced the indictment of seven Iranians in a cyber attack on a city- owned dam in Rye, NY. In this regard, multiple sources cite China as a primary source of cyber intrusions. In 2011, the Office of the National Counterintelligence Executive reported that “Chinese actors are the world’s most active and persistent perpetrators of economic espionage.” Attorneys specializing in Chinese business practices and a real estate company representative told us that companies in China are likely to have ties to the Chinese government. In 2014, the Justice Department charged Chinese military hackers with cyber espionage against U.S. corporations and a labor organization for the purpose of gaining a commercial advantage—the first time that criminal charges have been filed against known state actors for hacking. Moreover, according to the Director of National Intelligence, China is the leading suspect in the cyber intrusion into the Office of Personnel Management’s (OPM) systems affecting background investigation files for 21.5 million individuals which OPM reported in July 2015. To acquire a building for federal agencies, GSA may work with the private sector to design and construct a building that the government then leases—which would give the construction firm access to the building’s structure. The security risk of having access to a building structure was evident in 1987 when the Senate Select Committee on Intelligence reported that “n 1985, the Committee received its first testimony indicating that there was strong evidence that the Soviets had succeeded in incorporating a complex and comprehensive electronic surveillance system into the structure of the new U.S. Embassy under construction in Moscow….” We reported in 1987 that the U.S. government contracted with a Soviet firm to construct the embassy building. Foreign-owned property located near federal facilities may also pose security risks. In 2014, we reported about DOD’s concerns over encroachment by foreign entities conducting business near its test and training ranges. We reported that foreign encroachment may provide an opportunity for surveillance of DOD test and training activities. Another potential risk to the government regarding foreign-owned leased space is the source of funds used to finance the projects. According to FinCEN, money laundering involves disguising financial assets so they can be used without detection of the illegal activity that produced them. Through money laundering, criminals transform the monetary proceeds derived from criminal activity into funds with an apparently legal source. According to the Federal Financial Institutions Examination Council’s Bank Secrecy Act/Anti-Money Laundering Examination Manual, a compilation of guidance developed by the federal banking agencies and FinCEN, once illegal funds are in the financial system, additional transactions are used to create the appearance of legality. These transactions further shield the criminal from a recorded connection to the funds by providing a plausible explanation for the source of the funds. Examples include the purchase and resale of real estate, investment securities, foreign trusts, or other assets. A 2015 State Department report on money laundering indicated that of 211 countries and jurisdictions, 67 are listed as being “of primary concern” regarding money laundering, including the United States, and 69 are listed as being “of concern.” The report indicated that economies in countries such as the United States that attract funds globally are vulnerable to money laundering activity because the volume and complexity of the available financial options may make criminals believe they may more easily hide their funds. In May 2016, the President announced steps to strengthen financial transparency and combat money laundering, corruption, and tax evasion, including a FinCEN rulemaking intended to strengthen customer due diligence requirements, in part, by requiring covered financial institutions to identify and verify the identity of beneficial owners. In the final rule, FinCEN discussed the importance of identifying beneficial owners in the context of assisting financial investigations by law enforcement. Specifically, FinCEN discussed a 2013 case in which New York prosecutors indicted 34 alleged members of Russian-American organized crime groups with having moved millions of dollars in unlawful gambling proceeds through a network of shell companies in Cyprus and the United States. In October 2015, GSA provided us with a list of all the space that the agency believed it was leasing from foreign owners. GSA indicated that this list, which included 17 leases, was compiled using information that lessors provided in SAM. Prior to November 1, 2014, GSA was not required to collect certain information from lessors through SAM, such as the parent, subsidiary, or successor entities to the lessor. All except one of these leases was entered into prior to November 1, 2014. We tried to validate the ownership through Real Capital Analytics’ real property database which indicated that 6 of the 17 leases were with foreign companies, 4 of which were of high-security space. We were unable to validate foreign ownership regarding the other 11 leases because (1) the database indicated that two of the buildings are not owned by foreign companies, (2) the database did not contain ownership information on many of the buildings with GSA-leased space, and (3) two leases on the list were no longer in effect. Based on our independent analysis using the real property database, foreign entities owned high-security space that GSA is leasing in 20 buildings through 25 leases as of March 2016. Our analysis indicated that this space was owned by 16 different foreign entities, 7 of which are based in non-NATO countries. However, the real property database did not include information on all of the buildings in which GSA leases high- security space. Therefore, the results of our analysis are likely understated and GSA may be leasing more high-security space than what we identified in the 25 leases. For example, we also found that a Japanese parent company ultimately owns a building in Washington, D.C., that was not in the database but which contains high-security space leased by DOJ that is not listed in table 1. According to Real Capital Analytics, its database shows information on the chain of title, which is the succession of title ownership to real property from the present owner back to the original owner, when available. We contacted, or attempted to contact, each company to confirm that the company owned the property and was based in the country identified in the database. In some cases, we were unable to reach the companies to confirm ownership, but reviewed other information that confirmed ownership such as leasing documentation or found that the buildings were part of the companies’ portfolios posted on their websites. In four cases, when we contacted the parties that were identified in the database as the owners or their representatives, we were told that the information was outdated—that they sold the buildings and no longer owned them—or that the database information was incorrect—that the buildings were not owned by foreign affiliates. We excluded those cases from our review. See table 1 for information on 20 of the 25 leases of high-security space that we identified as foreign-owned. When we found that the lessors were incorporated in the United States but their parent companies were based in foreign countries, we included them as foreign owned. In one case, because of the complexity of the transaction involving the purchase of a building containing high-security GSA-leased space, we were unable to determine in which country the immediate owner of the building was based. That property is noted in the table. We found that 26 different agencies and departmental components occupy high-security leased space in buildings that we identified as foreign owned, 22 of which occupy space that we identified as owned by companies based in non-NATO countries (China, Israel, South Korea, and Japan). For example, we identified eight leases of high-security space from Chinese companies entered into prior to November 1, 2014. These leases are for space occupied by the Drug Enforcement Administration (DEA), Secret Service, Social Security Administration, and GAO. GSA indicated that SAM did not contain information on lessors that listed physical or mailing addresses in China. The leases of space that we identified as being in foreign-owned buildings are occupied by agencies such as six FBI field offices, three DEA field offices, and two Social Security Administration offices. Because the tenants include intelligence and law enforcement agencies, this high-security space is used, among other things, for classified operations and storage of weapons, law enforcement evidence, and sensitive data. Examples of high-security leased space are shown in figure 2. Of the 25 leases, we found that the amount of space leased ranged from about 5,600 square feet to more than 800,000 square feet and that annual rent ranged from about $174,000 to about $24 million in 2016. We also found that 10 are high-value leases—those with a net annual rent above a threshold for which GSA is required to submit a prospectus, or proposal, to the House and Senate authorizing committees for their review and approval. The threshold for submitting a prospectus was $2.85 million for fiscal year 2014, the most recent threshold established. The total amount of space leased was about 3.3 million square feet at an annual cost of about $97 million. Nine of the 14 tenant agencies that we contacted indicated they were not aware that the space they were occupying was in buildings that we identified as being owned by foreign companies. For example, the Executive Office for United States Attorneys indicated that it has no records showing that GSA notified the office that a building it was occupying was foreign owned. The other five agencies that knew about occupying foreign-owned space had taken actions to mitigate the risk or were not concerned. Besides GSA, other agencies use their own statutory authority to lease space from foreign companies. For example, the State Department is leasing space for the U.S. ambassador to the United Nations in the Waldorf-Astoria Hotel in New York City, which was acquired by a Chinese company in 2014. We also found that the U.S. Mint, using its own authority, is leasing its headquarters building in Washington, D.C., from a Japanese parent company that is the ultimate owner. Several federal officials who assess foreign investments in the United States and selected real estate company representatives we spoke to told us that leasing space in foreign-owned buildings could present security risks such as espionage, unauthorized cyber and physical access to the facilities, and sabotage. For example, a DHS foreign investment official said that potential threat actors could coerce owners into collecting intelligence about the personnel and activities of the facilities when maintaining the property. The official said this situation could occur by direct observation or surreptitious placement of devices in sensitive spaces or on the telecommunications infrastructure of the facility. In addition, a DHS cybersecurity official said that advanced persistent cyber threats (adversaries possessing sophisticated levels of expertise and significant resources to pursue their objectives) tend to come from foreign sources. In addition, a representative from a real estate company said that foreign ownership could pose a cyber risk in buildings with data systems and sensitive information. Based on our analysis, interviews, and other information, we identified low, moderate, and high security risk levels associated with leasing space from foreign owners. At the lower level of risk, foreign entities that invested through real estate investment trusts (REIT) and other passive investments may be removed from accessing or managing the facilities. At the next level, foreign entities that have directly purchased the buildings may have access and operational control in the event that a lease or mitigation measure (discussed later in this report) does not exist to restrict such access. At the highest level, foreign entities that constructed the buildings could provide access to their structure and design, increasing the risk of nefarious action as demonstrated by the construction of the U.S. Embassy in Moscow and design-construction leased space, described earlier. Conversely, representatives from two real estate companies whom we interviewed said that it is not a security risk for the government to lease space in foreign-owned buildings or that the risks could be addressed. For example, one of the representatives said that access at high-security facilities is strictly controlled, including access by the owners, and that passive investors in properties do not have access to the buildings. A representative from a third real estate company said that it is not a security risk for the government to lease space in foreign-owned buildings because that company’s properties are managed by U.S. companies with no involvement from the passive investors. He said that passive investors have on rare occasions toured the properties, but they were subject to the agencies’ security clearance procedures. A representative from a fourth company said that foreign ownership is irrelevant when capital funds come from many investors that do not control the buildings. A representative from a fifth company said that people such as property managers, asset managers and building engineers, have more direct access to building systems and data than the owners and that they are subject to background checks and must be escorted in high-security buildings. He added that there could be cheaper ways to conduct nefarious action than by buying a building. Regarding the construction of new buildings, one company representative noted that construction contractors are vetted. A representative from a real estate association said that the federal government leasing space in foreign-owned buildings is not “in and of itself” a security risk. He said that foreign owners of U.S. real estate—including in some cases foreign governments—often will have meaningful, but noncontrolling, interests in that property which may give the foreign owner a sizable financial interest in the property’s leasing income and appreciation, but no involvement in the actual management or operation of the property. However, he added that the security risk may increase if the federal government is leasing from ownership entities controlled by companies from countries that are not allies of the United States. Some agencies that are occupying buildings that we identified as owned by companies based in non-NATO countries raised the following concerns: The Secret Service indicated that its counterintelligence branch determined that foreign ownership of a building it occupies could raise counterintelligence and security concerns. According to the Secret Service, the protection of its information, technology, personnel and space could be in jeopardy if the space were compromised through any unannounced inspections, emergency repairs to the building or any component within, the use of foreign nationals to provide any type of service, and any unescorted access throughout the space by the facility owner or representatives. Furthermore, the Secret Service indicated that the integrity and protection against potential compromise of the agency’s protection and intelligence information, criminal investigations and personal identifiable information would require implementing additional countermeasures to mitigate any threats and protect the agency’s operations as a result of occupying space in a building that we identified as being foreign owned. DEA indicated that foreign ownership raises security risks that should be mitigated. DEA’s primary concern is the possible unauthorized access to its secure areas and information. According to the agency, two important mitigation methods are ensuring that independent locksmiths are utilized to secure the office and that the security vendor is not affiliated with the owner. DEA also indicated that it would be useful for GSA to inform the agency about changes in ownership because this information would help its security assessment. DOJ, which has three agencies occupying a building that we identified as being foreign owned, indicated that it would conduct additional reviews before occupying space leased from a landlord under the ownership, control, or influence of a country that is not an ally of the United States or with which the United States has no diplomatic relations. DHS’s National Protection and Programs Directorate indicated that it has contacted GSA to identify any steps that it takes to assess the potential risk posed by a foreign-owned property and that in the future, DHS will use this information to assess space that GSA proposes that it occupy. By contrast, the Administrative Office of the United States Courts, another tenant in foreign-owned space, indicated that knowing that the building is foreign owned would have been immaterial in occupying the space because, to its knowledge, GSA does not consider whether a company is foreign when reviewing potential offers and awarding a lease. Similarly, four other tenant agencies occupying space in buildings that we identified as being owned by companies based in non-NATO countries—FBI, IRS, Social Security Administration, and the Treasury Department Inspector General for Tax Administration—indicated that foreign ownership of those buildings did not raise security concerns. Tenant agencies such as the Administrative Office of the United States Courts, the Social Security Administration, and Department of Veterans Affairs also emphasized that GSA selects the leased space, not the tenants. GSA leases of foreign-owned space generally restrict the owners from physically accessing the space except to maintain or inspect the facilities. According to GSA, every standard lease contains the same general restrictions on owner access without regard to the owner’s nationality. Specifically, the restriction states that “the Lessor may at reasonable times enter the premises with the approval of the authorized Government representative in charge.” Of the 11 buildings owned by companies based in non-NATO countries, the tenant agencies or the owners told us that the owners or their representatives had entered 8 of them, for example, for inspection purposes. If CFIUS has national security concerns about a covered transaction and does not believe those concerns can reasonably be addressed through the U.S. Government lease or other existing authorities, it may propose that the acquiring company enter into a mitigation agreement or impose conditions. Another potential risk to the government regarding foreign-owned leased space is the possibility of entering into leases with hidden beneficial owners of buildings that are using the investment to launder money. A 2006 FinCEN report found that hidden beneficial owners launder money through commonly reported entities, such as property management, real estate investment, realty, and real estate development companies. Furthermore, we have reported that money laundering and terrorist financing are crimes that can destabilize national economies and threaten global security. GSA checks whether potential lessors have sufficient funds to meet their lease obligations, but is not required to collect beneficial ownership information and therefore does not know the beneficial owners of the buildings it leases. However, federal internal control standards indicate that management should identify, analyze, and respond to risks related to achieving the defined objectives. When leasing space, GSA checks the Excluded Parties List System, which is a list of companies and individuals that are excluded from receiving federal contacts, and Treasury’s Specially Designated Nationals and Blocked Persons List, which is a list of individuals and companies whose assets are blocked and U.S. persons are generally prohibited from dealing with them. In leasing from foreign companies, GSA does not consider whether the lessors are “politically exposed persons,” which the Financial Action Task Force (FATF) defines as individuals who are or have been entrusted with a prominent function. According to FATF, many politically exposed persons hold positions that “can be abused for the purpose of laundering illicit funds or other predicate offenses such as corruption or bribery.” In 2010, the Senate examined how politically powerful foreign officials, their relatives, and close associates—politically exposed persons—have used the services of U.S. professionals and financial institutions to bring large amounts of suspect funds into the United States to advance their interests. Furthermore, in July 2016, DOJ announced the filing of civil forfeiture complaints seeking the forfeiture and recovery of more than $1 billion in assets, including real estate in New York and Los Angeles, associated with an international conspiracy to launder funds misappropriated from a Malaysian sovereign wealth fund. We found that commercially available screening software can be used to identify heightened risk individuals and organizations and mitigate risks associated with illicit funds, money laundering, fraud, organized crime, sanctions program violations, terrorist financing, among other risks. GSA’s lease of space for the FBI field office in Seattle may be an example of GSA leasing high-security space from a beneficial owner who is a politically exposed person. Our review found that the FBI field office in Seattle is ultimately owned by the Taib family of Malaysia through a series of domestic and foreign companies. Advocacy groups such as Global Witness allege that the Taib family has profited from corrupt practices in Malaysia. The lease was executed by Wallyson’s, a Washington state corporation, which is owned by Sakti International Corporation, a California corporation. According to a Dun & Bradstreet report in GSA’s leasing file, Sakti International Corporation is 100 percent financed by the Taib family of Malaysia. Furthermore, according to a 2008 document in the GSA leasing file, Sakto International, located in Canada, is the parent company of Sakti International Corporation. The lease was signed by Rahman Taib—the president, secretary, and chief financial officer of Wallyson’s—who is also the son of the former chief minister of Sarawak, Malaysia. We found no evidence that the family has been indicted or convicted of wrongdoing that would disqualify them from leasing to the government. However, Global Witness representatives told us that the government runs financial and non-financial risks as well as a reputational risk if it leases from individuals who have been accused of wrongdoing, regardless of whether they have been indicted or convicted. GSA and FBI officials said that they are not concerned about the ownership of the FBI field office in Seattle. According to GSA, “as long as the lessor performs according to the contract, additional concerns about ownership would not be raised.” FBI officials told us that the FBI does not have any concerns about either the physical or cyber security of the building or the sources of funding used to finance the building. The officials said that the owners may not enter the building. Our review of the lease for this building indicated that the government will have paid a total of $56 million in rent over the 20-year term ending in 2019. GSA officials said that leasing specialists must review the lists of excluded parties at least twice—after receiving offers and before awards. We asked GSA to provide evidence that it checked these lists with regard to the lease of space for the FBI field office in Seattle. Federal internal control standards indicate that documentation is a necessary part of an effective internal control system. However, GSA could not produce evidence that it had conducted these checks at those times. We did not find Taib family members on the Excluded Parties List or the Specially Designated Nationals and Blocked Persons List. GSA indicated that most lessors establish a separate entity—usually a limited liability corporation (LLC)—for each building. Private LLCs are not subject to the same public disclosure requirements as publicly traded companies. Representatives from a real estate LLC that leases many buildings to GSA told us that its investment capital comes from foreign sources that use financial institutions in the United States. Because the real estate LLC is privately-owned, we found no publicly available information about its investment sources. In May 2016, FinCEN issued final rules that would, in part, require covered financial institutions to identify and verify the beneficial owners of legal entity customers. According to the rulemaking, covered financial institutions are not presently required to know the identity of beneficial owners, “enabling criminal, kleptocrats, and others looking to hide ill- gotten proceeds to access the financial system anonymously.” Covered financial institutions must comply with the new rules by May 11, 2018. Also in May 2016, Treasury announced that it sent beneficial ownership legislation to Congress for consideration that, among other things, would require companies formed within the United States to file beneficial ownership information with the Treasury Department, and face penalties for failure to comply. The legislation would also require the Secretary of the Treasury to define “beneficial owner” for the purposes of implementing the proposed legislation. Separately, members of the House and Senate have independently introduced various pieces of beneficial ownership legislation. According to the sponsors, law enforcement efforts to investigate corporations and LLCs suspected of committing crimes such as money laundering have been impeded by the lack of available beneficial ownership information. In 2002, FinCEN temporarily exempted certain financial institutions, including persons involved in real estate closings and settlements, from the requirement to establish an anti-money laundering program that includes verifying customer identities. The exemption is still in place and, in 2015, advocacy organizations such as Global Financial Integrity, Global Witness, and the FACT Coalition urged FinCEN to remove the exemption. The organizations said that investors can mask the true ownership of property in the United States when the real estate purchase is made through anonymous companies, allowing millions of dollars to be invested in real estate transactions without detection. Global Financial Integrity, Global Witness, and the FACT Coalition representatives also told us that it is easy in the United States to create untraceable shell companies—which have no operations and can be used for illicit purposes such as laundering money. However, GSA officials said that they rely on due diligence processes conducted by real estate companies and banks to check the legitimacy of the funds that are used to finance the buildings that GSA leases. Representatives from a real estate company that uses foreign investments to finance buildings that are leased to GSA told us that they rely on banks and an independent global firm that provides fiduciary services to ensure that the sources of funds comply with applicable regulations. However, banking and real estate associations expressed different views on which parties are primarily responsible for checking the sources of funds used for commercial real estate. A representative from the American Bankers Association said that while it might seem reasonable for real estate companies to rely on banks (and for GSA to rely on real estate companies) to check the legitimacy of the funds that are used to finance real estate projects, banks do not always have sufficient information about the transaction. He said that when these transactions are put together, the lender may not have direct contact with the purchaser or the seller and if the purchaser or a seller is a corporation, the bank knows the corporation but not necessarily the details about the corporation, its structure or its management. The representative added that because the real estate company is dealing directly with the corporation as its client and has access to the individuals who can provide that information, the real estate company has a direct relationship and is in the best position to obtain any detailed information about the purchaser or seller. However, a representative from the Real Estate Roundtable, an association of real estate firms and associations, said that the many participants in the commercial real estate transactional process such as mortgage bankers, brokers, and title agents, are unlikely to have any significant and important information bearing on the possibility of money laundering activities given their function in commercial real estate transactions. He said that these participants are generally small businesses unequipped to deal with significant training on regulations, policing, audit and record keeping responsibilities. The Real Estate Roundtable representative also said that anonymity and liquidity—two characteristics important to money launderers—typically do not exist in real estate transactions because real estate transactions generally involve illiquid and visible assets. In addition, a representative from the National Association of Real Estate Investment Trusts told us there is a low risk of illegal foreign money being used to finance publicly traded REITs. He noted that because a publicly traded REIT is financed and operated in effectively the same manner as any other publicly traded company it is very unlikely it would be used as a mechanism to launder money. Furthermore, the Real Estate Roundtable representative said that because real estate is not a highly liquid asset and real estate transactions generally create a detailed “paper trail” of debt and equity investors, commercial buildings are not ideally suited to be money laundering vehicles. However, in its 2006 report on money laundering in the commercial real estate market, FinCEN stated that although real estate historically has been a relatively illiquid asset, money launderers may use real estate both as an investment and vehicle to store laundered funds. GSA’s leasing policies and procedures do not distinguish between leasing from domestic or foreign companies. When leasing space, GSA is required, among other things, to determine whether the prospective lessor is a responsible party. As discussed earlier, GSA officials said that this process includes, among other things, checking whether the entity has the financial means to fulfill the contract and assessing whether the building will be operated properly. However, under GSA’s Acquisition Manual, foreign ownership is not one of the factors that GSA must consider when deciding whether to contract for a lease. Offerors are required to disclose certain ownership information that may indicate whether they are foreign owned. The Homeland Security Act of 2002 authorizes GSA to protect federal facilities except those functions delegated to the Department of Homeland Security. Tenant agencies and FPS also have responsibility for protecting federal facilities. According to the Interagency Security Committee (ISC) standard on protecting federal facilities, tenant agencies and FPS are to conduct risk assessments for facilities with security levels III, IV, and V at least every 3 years. The standard also states that tenant agencies are responsible for making final facility security level determinations, must devise a risk management strategy, and, if possible, fund appropriate security countermeasures to mitigate the identified risk. As discussed earlier, GSA’s information on foreign ownership of high- security space was not reliable, and, as a result, tenant agencies lack information on such foreign ownership even though it can pose risks involving physical and cyber security and foreign financing. As discussed below, GSA’s existing procedures for obtaining information provide the agencies with some information on foreign ownership, but this information is incomplete. GSA officials said that they do not have the ability or authority to check foreign ownership beyond certain sources currently available to them. In addition, although GSA checks whether potential lessors have sufficient funds to meet their lease obligations, it does not check the lessors’ source of funds. As discussed below, various steps in the leasing process may disclose whether an offeror’s company is foreign owned as well as whether the company is owned by an immediate or highest level owner. However, these sources provide incomplete information on foreign ownership and foreign investment in space leased by GSA. In addition, GSA officials said that they do not validate the information on foreign ownership that contractors disclose in SAM. Lessors are required to self-disclose whether they are foreign owned. One way that GSA can identify a foreign company during the leasing process is when the lessor completes the representations and certifications form, which is part of the lease agreement, as required by the Federal Acquisition Regulation (FAR). When completing this form, the lessor is required to certify with respect to whether a taxpayer identification number is needed if it is a (1) “nonresident alien, foreign corporation, or foreign partnership that does not have income effectively connected with the conduct of a trade or business in the United States and does not have an office or place of business or a fiscal paying agent in the United States” or (2) “an agency or instrumentality of a foreign government.” GSA is required to check whether prospective lessors are barred from conducting business with the government. GSA’s Leasing Desk Guide requires GSA to ascertain whether the offeror has been disqualified or excluded from participating in federal contracts. As previously discussed, GSA indicated that it checks the Excluded Parties List System and Treasury’s Specially Designated Nationals and Blocked Persons List. We did not find any of the owners based in foreign countries listed in table 1 on the Excluded Parties List or the Specially Designated Nationals and Blocked Persons List. Companies are required to report information about their identities using various business codes. Under the FAR, an offeror must register with Dun & Bradstreet’s Data Universal Numbering System (DUNS), which are unique identifiers for business, and include the DUNS number when registering in SAM. Companies are assigned a Commercial and Government Entity (CAGE) code—an identification number assigned by the Defense Logistics Agency that is used within the federal government—to participate in SAM. Each entity (business, individual, or government agency) must register with SAM to conduct business with the federal government. Starting on November 1, 2014, the Federal Acquisition Regulation (FAR) began requiring offerors to provide additional ownership information through SAM, including, among other things, the “immediate” and “highest” level ownership of the offeror, and the CAGE or North Atlantic Treaty Organization CAGE (NCAGE) codes for these entities. “Immediate owner” means an “entity, other than the offeror, that has direct control of the offeror.” This definition includes “ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.” A highest level owner means “the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offer.” Of the 8 lessors based in non-NATO countries that we identified from leases entered into prior to November 1, 2014, and thus not required to include immediate and highest level ownership information, 7 did not self-identify as foreign owners on their certifications and representations form. Our review of GSA’s lease inventory found that the business entity names are frequently building names or street addresses that do not reflect useful ownership information. FBI officials told us that GSA could contact the FBI if it had concerns about a particular foreign company, but declined to state what types of information it could provide to GSA. CFIUS has a limited role in identifying risks of GSA leasing from foreign companies. CFIUS officials said that, consistent with the scope of FINSA, CFIUS could not review GSA leasing from a foreign company unless a foreign person, as defined in CFIUS’s regulations, acquired control of a U.S. business that owned the building in which GSA was leasing space. Additionally, CFIUS could not review a foreign company’s construction of a building in the United States if the company did not acquire control of a U.S. business. During 2014 (the most recent available information) CFIUS conducted 147 reviews of covered transactions. Because GSA is not required to identify beneficial ownership information for the space it leases and because GSA is not informing tenant agencies when the space they are occupying is leased from foreign owners, tenants may not be aware that they are occupying space that is foreign owned and may not be addressing any security risks associated with foreign ownership. Because GSA is not identifying the beneficial owners of the properties it leases, it cannot check whether those owners raise any issues that may represent security risks to tenant agencies. GSA’s incomplete information and lack of policies and procedures regarding foreign ownership of high-security leased space may undermine the security of the tenants’ facilities. When GSA does not know the beneficial owners of the high-security properties that it is leasing, it lacks information that should be shared with its tenants for their facility risk assessments. Moreover, when tenant agencies lack information about the beneficial owners of their high-security facilities, they may not correctly evaluate the security risks and, consequently, not take the most appropriate steps to secure their buildings, leaving the facilities vulnerable, for example, to cyber intrusions. Our review found that GSA is leasing a small portion of its high-security leased space from foreign owners. However, because ownership information was not available regarding about one-third of the buildings with high-security leased space, GSA is likely leasing from more foreign companies than is readily identifiable. Because CFIUS’s authority is limited to reviewing foreign acquisitions that could result in control of a U.S. business, which rarely involves GSA-leased space, CFIUS has a limited role in identifying and mitigating risks of GSA leasing from foreign companies. As a result, GSA cannot rely on CFIUS to identify and mitigate these risks. As the leasing agent, GSA is in the best position to identify the beneficial owners of the high-security space that it leases and communicate the relevant information to its federal tenants so that they may adequately assess and mitigate any potential security risks associated with them. We recommend that the Administrator of the General Services Administration determine whether the beneficial owner of high-security space that GSA leases is a foreign entity and, if so, share that information with the tenant agencies so they can adequately assess and mitigate any security risks. We provided a draft of this report for review and comment to GSA, the departments of Defense (DOD), Energy (DOE), Homeland Security (DHS), Justice (DOJ), State, the Treasury, and Veterans Affairs (VA); the Administrative Office of United States Courts; the Federal Deposit Insurance Corporation (FDIC); the Office of the Director of National Intelligence (ODNI); the Securities and Exchange Commission (SEC); the Social Security Administration, and agencies which determined that the information about the foreign-owned buildings that they occupy is for official use only and is not included in this report. GSA provided written comments, reprinted in appendix I, agreeing with the report’s recommendation. DOD provided a letter, reprinted in appendix II, indicating that it had no comments on the report. ODNI provided a letter, reprinted in appendix III, indicating that ODNI and the Intelligence Community concur with the recommendation. The Social Security Administration provided a letter, reprinted in appendix IV, indicating that the report accurately reflects its activities regarding this review. DHS, DOJ, the Department of the Treasury, and the Social Security Administration provided technical comments which we incorporated as appropriate. The Administrative Office of the United States Courts, DOE, FDIC, SEC, the State Department, and VA had no comments. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Administrator of the General Services Administration, the Secretaries of Defense, Energy, Homeland Security, State, Treasury, and Veterans Affairs; the Attorney General; Director of the Administrative Office of the United States Courts, Director of National Intelligence, Chairman of the Federal Deposit Insurance Corporation, Chair of the Securities and Exchange Commission, Commissioner of the Social Security Administration, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. In addition to the individual named above, Keith Cunningham, Assistant Director; Bob Homan, Analyst-in-Charge; Lisa Shibata; Camilo Flores; Tonita Gillich; and Michelle Weathers made key contributions to this report.

Summary: GAO has previously reported that federal facilities are vulnerable to threats from foreign sources that may target their information systems and affect the physical security of the occupants. GAO was asked to examine GSA's lease of high-security space from foreign owners. This report addresses (1) what is known about foreign ownership of high-security space leased by GSA, (2) potential risks posed by such foreign ownership, and (3) policies and procedures regarding GSA's leasing of space from foreign-owned entities. GAO reviewed GSA's leasing documents; identified and checked ownership information regarding high-security leased space to the extent possible using data, as of March 2016, from a firm that specializes in analyzing the commercial real estate market; interviewed GSA and federal foreign investment officials, tenant agencies that were occupying space owned by foreign entities, and five real estate companies that lease space to GSA or provide related services; and visited three foreign-owned high-security leased facilities selected to represent a variety of owners and tenants. GAO reviewed available information on the ownership of General Services Administration (GSA) leased space that requires higher levels of security protection based on factors such as mission criticality and facility size (high-security space) as of March 2016 and found that GSA is leasing high-security space from foreign owners in 20 buildings. The 26 tenant agencies occupy about 3.3 million square feet at an annual cost of about $97 million and use the space, in some cases, for classified operations and to store law enforcement evidence and sensitive data. The foreign-owned leased space included six Federal Bureau of Investigation field offices and three Drug Enforcement Administration field offices. GAO determined that the high-security space is owned by companies based in countries such as Canada, China, Israel, Japan, and South Korea. GAO was unable to identify ownership information for about one-third of GSA's 1,406 high-security leases as of March 2016 because ownership information was not readily available for all buildings. Federal officials who assess foreign investments in the United States and some tenant agencies occupying high-security leased space told GAO that leasing space in foreign-owned buildings could present security risks such as espionage and unauthorized cyber and physical access. However, 9 of the 14 tenant agencies GAO contacted were unaware that the space they occupy is in a building that we identified as foreign owned. The other five agencies that knew about occupying foreign-owned space had taken actions to mitigate the risk or were not concerned. Another risk is possibly entering into leases with hidden beneficial owners—the persons who ultimately own and control a building. According to the Treasury Department's Financial Crimes Enforcement Network, the risks of contracting with hidden beneficial owners include money laundering. GSA is not required to collect beneficial ownership information and therefore does not know the beneficial owners of the buildings it leases. Federal agencies are required to assess and address the risks to their high-security facilities but GSA does not inform tenants when leasing space from foreign owners. When leasing space, GSA is required, among other things, to determine whether the prospective lessor is a responsible party, but foreign ownership is not one of the factors that it must consider. As a result, tenants may be unaware that they are occupying foreign-owned space and not know whether they need to address any security risks associated with such foreign ownership. GAO recommends that GSA determine whether the beneficial owner of high-security leased space is a foreign entity and, if so, share that information with the tenant agencies for any needed security mitigation. GSA agreed with the recommendation.