FPS assesses risk and recommends countermeasures to GSA and tenant agencies; however, FPS’s ability to use risk management to influence the allocation of resources is limited because resource allocation decisions are the responsibility of GSA and tenant agencies—in the form of Facility Security Committees (FSC)—who have at times been unwilling to fund the countermeasures FPS recommends. We have found that, under the current risk management approach, the security equipment that FPS recommends and is responsible for acquiring, installing, and maintaining may not be implemented for several reasons including the following: tenant agencies may not have the security expertise needed to make risk- based decisions, tenant agencies may find the associated costs prohibitive, the timing of the assessment process may be inconsistent with tenant agencies’ budget cycles, consensus may be difficult to build amount multiple tenant agencies, or tenant agencies may lack a complete understanding of why recommended countermeasures are necessary because they do not receive security assessments in their entirety. For example, in August 2007, FPS recommended a security equipment countermeasure—the upgrade of a surveillance system shared by two high-security locations that, according to FPS officials, would cost around $650,000. While members of one FSC told us they approved spending between $350,000 and $375,000 to fund their agencies’ share of the countermeasure, they said that the FSC of the other location would not approve funding; therefore, FPS could not upgrade the system as it had recommended. In November 2008, FPS officials told us that they were moving ahead with the project by drawing on unexpended revenues from the two locations’ building-specific fees as well as the funding that was approved by one of the FSCs. Furthermore, FPS officials, in May 2009, told us that all cameras had been repaired, and all monitoring and recording devices had been replaced, and that the two FSCs had approved additional upgrades, which FPS was implementing. As we reported in June 2008, we have found other instances in which recommended security countermeasures were not implemented at some of the buildings we visited because FSC members could not agree on which countermeasures to implement or were unable to obtain funding from their agencies. Currently no guidelines exist outlining the requirements for FSCs including their composition, requirements, and relationship with FPS. The Interagency Security Committee (ISC), which is chaired within NPPD, recently began to develop guidance for FSC operations, which may address some of these issues. The ISC, however, has yet to announce an anticipated date for issuance of this guidance. Compounding this situation, FPS takes a building-by-building approach to risk management, using an outdated risk assessment tool to create facility security assessments (FSA), rather than taking a more comprehensive, strategic approach and assessing risks among all buildings in GSA’s inventory and recommending countermeasure priorities to GSA and tenant agencies. As a result, the current approach provides less assurance that the most critical risks at federal buildings across the country are being prioritized and mitigated. Also, GSA and tenant agencies have concerns about the quality and timeliness of FPS’s risk assessment services and are taking steps to obtain their own risk assessments. For example, GSA officials told us they have had difficulties receiving timely risk assessments from FPS for space GSA is considering leasing. These risk assessments must be completed before GSA can take possession of the property and lease it to tenant agencies. An inefficient risk assessment process for new lease projects can add to costs for GSA and create problems for both GSA and tenant agencies that have been planning for a move. Therefore, GSA is updating a risk assessment tool that it began developing in 1998, but has not recently used, to better ensure the timeliness and comprehensiveness of these risk assessments. GSA officials told us that, in the future, they may use this tool for other physical security activities, such as conducting other types of risk assessments and determining security countermeasures for new facilities. Additionally, although tenant agencies have typically taken responsibility for assessing risk and securing the interior of their buildings, assessing exterior risks requires additional expertise and resources. This is an inefficient approach considering that tenant agencies are paying FPS to assess building security. While FPS is currently operating at its congressionally mandated staffing level of no fewer than 1,200 full-time employees, FPS has experienced difficulty determining its optimal staffing level to protect federal facilities. Prior to this mandate, FPS’s staff was steadily declining and, as a result, critical law enforcement services have been reduced or eliminated. For example, FPS has largely eliminated its use of proactive patrol to prevent or detect criminal violations at many GSA buildings. According to some FPS officials at regions we visited, not providing proactive patrol has limited its law enforcement personnel to a reactive force. Additionally, officials stated that, in the past, proactive patrol permitted its police officers and inspectors to identify and apprehend individuals that were surveilling GSA buildings. In contrast, when FPS is not able to patrol federal buildings, there is increased potential for illegal entry and other criminal activity. In one city we visited, a deceased individual had been found in a vacant GSA facility that was not regularly patrolled by FPS. FPS officials stated that the deceased individual had been inside the building for approximately 3 months. In addition to the elimination of proactive patrol, many FPS regions have reduced their hours of operation for providing law enforcement services in multiple locations, which has resulted in a lack of coverage when most federal employees are either entering or leaving federal buildings or on weekends when some facilities remain open to the public. Moreover, some FPS police officers and inspectors also said that reducing hours has increased their response times in some locations by as much as a few hours to a couple of days, depending on the location of the incident. The decrease in FPS’s duty hours has also jeopardized police officer and inspector safety, as well as building security. Some inspectors said that they are frequently in dangerous situations without any FPS backup because many regions have reduced their hours of operations and overtime. In 2008, FPS transitioned to an inspector-based workforce—eliminating the police officer position—and is relying primarily on FPS inspectors for both law enforcement and physical security activities, which has hampered its ability to protect federal facilities. FPS believes that an inspector-based workforce approach ensures that its staff has the right mix of technical skills and training needed to accomplish its mission. However, FPS’s ability to provide law enforcement services under its inspector-based workforce approach may be diminished because FPS relies on its inspectors to provide both law enforcement and physical security services simultaneously. This approach has contributed to a number of issues. For example, FPS faces difficulty ensuring the quality and timeliness of FSAs and adequate oversight of its 15,000 contract security guards. In addition, in our 2008 report, we found that representatives of several local law enforcement agencies we visited were unaware of FPS’s transition to an inspector-based workforce and stated that their agencies did not have the capacity to take on the additional job of responding to incidents at federal facilities. In April 2007, a DHS official and several FPS inspectors testified before Congress that FPS’s inspector- based workforce approach requires increased reliance on state and local law enforcement agencies for assistance with crime and other incidents at GSA facilities and that FPS would seek to enter into memorandums of agreement (MOA) with local law enforcement agencies. However, according to FPS’s Director, the agency decided not to pursue MOA with local law enforcement officials, in part because of reluctance on the part of local law enforcement officials to sign such MOAs. In addition, FPS believes that the MOAs are not necessary because 96 percent of the properties in its inventory are listed as concurrent jurisdiction facilities where both federal and state governments have jurisdiction over the property. Nevertheless, these MOAs would clarify roles and responsibilities of local law enforcement agencies when responding to crime or other incidents. FPS does not fully ensure that its contract security guards have the training and certifications required to be deployed to a GSA building. FPS maintains a contract security guard force of about 15,000 guards that are primarily responsible for controlling access to federal facilities by (1) checking the identification of government employees, as well as members of the public who work in and visit federal facilities and (2) operating security equipment, including X-ray machines and magnetometers, to screen for prohibited materials such as firearms, knives, explosives, or items intended to be used to fabricate an explosive or incendiary device. We reported in July 2009, that 411 of the 663 guards (62 percent) employed by seven FPS contractors and deployed to federal facilities had at least one expired certification, including a declaration that the guards have not been convicted of domestic violence, which makes them ineligible to carry firearms. We also reported in July 2009, that FPS guards had not received adequate training to conduct their responsibilities. FPS requires that all prospective guards complete about 128 hours of training including 16 hours of X-ray and magnetometer training. However, in one region, FPS has not provided the X-ray or magnetometer training to its 1,500 guards since 2004. Nonetheless, these guards are assigned to posts at GSA buildings. X-ray training is critical because guards control access points at buildings. In addition, we also found that some guards were not provided building- specific training, such as what actions to take during a building evacuation or a building emergency. This lack of training may have contributed to several incidents where guards neglected their assigned responsibilities. Following are some examples: at a level IV facility, the guards did not follow evacuation procedures and left two access points unattended, thereby leaving the facility vulnerable; at a level IV facility, the guard allowed employees to enter the building while an incident involving suspicious packages was being investigated; and at a level III facility, the guard allowed employees to access the area affected by a suspicious package; this area was required to be evacuated. We also found that FPS has limited assurance that its guards are complying with post orders. In July 2009, we reported that FPS does not have specific national guidance on when and how guard inspections should be performed. Consequently, inspections of guard posts in 6 of the 11 regions we visited were inconsistent and varied in quality. We also found that guard inspections in the 6 regions we visited are typically completed by FPS during regular business hours and in locations where FPS has a field office and seldom at nights or on weekends or in nonmetropolitan areas. For example, in 2008, tenants in a level IV federal facility in a nonmetropolitan area complained to a GSA property manager that they had not seen FPS in over 2 years, there was no management of their guards, and the number of incidents at their facility was increasing. GSA officials contacted FPS officials and requested FPS to send inspectors to the facility to address the problems. Most guards are also stationed at fixed posts that they are not permitted to leave, which can impact their response to incidents. For example, we interviewed over 50 guards and asked them whether they would assist an FPS inspector chasing an individual in handcuffs escaping a federal facility. The guards’ responses varied, and some guards stated they would likely do nothing and stay at their posts because they feared being fired for leaving. Other guards also told us that they would not intervene because of the threat of a liability suit for use of force and did not want to risk losing their jobs. Additionally, guards do not have arrest authority, although contract guards do have authority to detain individuals. However, according to some regional officials, contract guards do not exercise their detention authority also because of liability concerns. We found that GSA—the owner and lessee of many FPS protected facilities—has not been satisfied with the level of service FPS has provided since FPS transferred to DHS. For example, according to GSA officials, FPS has not been responsive and timely in providing assessments for new leases. GSA officials in one region told us that the quality of the assessments differs depending on the individual conducting the assessment. This official added that different inspectors will conduct assessments for the same building so there is rarely consistency from year to year, and often inspectors do not seem to be able to fully explain the countermeasures that they are recommending. We believe that FPS and GSA’s information sharing and coordination challenges are primarily a result of not finalizing a new MOA that formalizes their roles and responsibilities. According to GSA officials, in November 2009, the two agencies have met to start working through the MOA section by section, and as of early March 2010 they have had four working group sessions and are anticipating an initial agreed upon draft in late spring 2010. In the absence of a clearly defined and enforced MOA, FPS officials told us they feel they are limited in their ability to protect GSA properties. Additionally, in 2009, we reported that tenant agencies have mixed views about some of the services they pay FPS to provide. For example, according to our generalizable survey of tenant agencies, About 82 percent of FPS’s customers indicated they do not use FPS as their primary law enforcement agency in emergency situations, and said they primarily rely on other agencies such as local law enforcement, the U.S. Marshals Service, or the Federal Bureau of Investigation; 18 percent rely on FPS. About one-third of FPS’s customers indicated that they were satisfied with FPS’s level of communication, one-third were neutral or dissatisfied, while the remaining one-third could not comment on how satisfied or dissatisfied they were with FPS’s level of communication on various topics including building security assessments, threats to their facility, and security guidance This response that suggests that the division of roles and responsibilities between FPS and its customers is unclear. Our survey also suggests that this lack of clarity is partly due to the little or no interaction customers have with FPS officers. Examples are as follows: A respondent in a leased facility commented that FPS has very limited resources, and the resources that are available are assigned to the primary federally owned building in the region. A respondent remembered only one visit from an FPS officer in the last 12 years. Over the past 5 years, we have conducted a body of work reviewing the operations of FPS and its ability to adequately protect federal facilities and we have made numerous recommendations to address these challenges. For example, we recommended FPS improve its effective long-term human capital planning, clarify roles and responsibilities of local law enforcement agencies in regard to responding to incidents at GSA facilities, develop and implement performance measures in various aspects of its operations, and improve its data collection and quality across its operations. While FPS has generally agreed with all of our recommendations, it has not completed many related corrective actions. At the request of Congress we are in the process of evaluating some of FPS’s most recent actions. For example, FPS is developing the Risk Assessment and Management Program (RAMP), which could enhance its approach to assessing risk, managing human capital, and measuring performance. With regard to improving the effectiveness of FPS’s risk management approach and the quality of FSAs, FPS believes RAMP will provide inspectors with the information needed to make more informed and defensible recommendations for security countermeasures. FPS also anticipates that RAMP will allow inspectors to obtain information from one electronic source, generate reports automatically, track selected countermeasures throughout their life cycle, and address some concerns about the subjectivity inherent in FSAs. In response to our July 2009 testimony, FPS took a number of immediate actions with respect to contract guard management. For example, the Director of FPS instructed Regional Directors to accelerate the implementation of FPS’s requirement that two guard posts at Level IV facilities be inspected weekly. FPS also required more X-ray and magnetometer training for inspectors and guards. To improve its coordination with GSA, the FPS Director and the Director of GSA’s Public Buildings Service Building Security and Policy Division participate in an ISC executive steering committee, which sets the committee’s priorities and agendas for ISC’s quarterly meetings. Additionally, FPS and GSA have established an Executive Advisory Council to enhance the coordination and communication of security strategies, policies, guidance, and activities with tenant agencies in GSA buildings. This council could enhance communication and coordination between FPS and GSA, and provide a vehicle for FPS, GSA, and tenant agencies to work together to identify common problems and devise solutions. We plan to provide Congress with our final reports on FPS’s oversight of its contract guard program and our other ongoing FPS work later this year. Mr. Chairman, this completes my prepared statement. I would be happy to respond to any questions you or other members of the committee may have at this time. For further information on this testimony, please contact me at (202) 512- 2834 or by e-mail at goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Tammy Conquest, Assistant Director; Tida Barakat; Jonathan Carver; Delwen Jones; and Susan Michal-Smith. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Recent events including last month's attack on Internal Revenue Service offices in Texas, and the January 2010 shooting in the lobby of the Nevada, federal courthouse demonstrate the continued vulnerability of federal facilities and the safety of the federal employees who occupy them. These events also highlight the continued challenges involved in protecting federal real property and reiterate the importance of protecting the over 1 million government employees, as well as members of the public, who work in and visit the nearly 9,000 federal facilities. This testimony is based on past GAO reports and testimonies and discusses challenges Federal Protective Service (FPS) faces in protecting federal facilities and tenant agencies' perspective of FPS's services. To perform this work, GAO visited a number of federal facilities, surveyed tenant agencies, analyzed documents, and interviewed officials from several federal agencies. Over the past 5 years GAO has reported that FPS faces a number of operational challenges protecting federal facilities, including: (1) FPS's ability to manage risk across federal facilities and implement security countermeasures is limited. FPS assesses risk and recommends countermeasures to the General Services Administration (GSA) and its tenant agencies, however decisions to implement these countermeasures are the responsibility of GSA and tenant agencies who have at times been unwilling to fund the countermeasures. Additionally, FPS takes a building-by-building approach to risk management, rather than taking a more comprehensive, strategic approach and assessing risks among all buildings in GSA's inventory and recommending countermeasure priorities to GSA and tenant agencies. (2) FPS has experienced difficulty ensuring that it has sufficient staff and its inspector-based workforce approach raises questions about protection of federal facilities. While FPS is currently operating at its congressionally mandated staffing level of no fewer than 1,200 full-time employees, FPS has experienced difficulty determining its optimal staffing level to protect federal facilities. Additionally, until recently FPS's staff was steadily declining and as a result critical law enforcement services have been reduced or eliminated. (3) FPS does not fully ensure that its contract security guards have the training and certifications required to be deployed to a federal facility. GAO found that FPS guards had not received adequate training to conduct their responsibilities. Specifically, some guards were not provided building-specific training, such as what actions to take during a building evacuation or a building emergency. This lack of training may have contributed to several incidents where guards neglected their assigned responsibilities. GSA has not been satisfied with FPS's performance, and some tenant agencies are unclear on FPS's role in protecting federal facilities. According to GSA, FPS has not been responsive and timely in providing security assessments for new leases. About one-third of FPS's customers could not comment on FPS's level of communication on various topics including security assessments, a response that suggests that the division of roles and responsibilities between FPS and its customers is unclear. FPS is taking some steps to better protect federal facilities. For example, FPS is developing a new risk assessment program and has recently focused on improving oversight of its contract guard program.