Although State has not yet formally defined what constitutes a soft target, State Department travel warnings and security officers generally consider soft targets to be places where Americans and other westerners live, congregate, shop, or visit, such as hotels, clubs, restaurants, shopping centers, housing compounds, places of worship, schools, or public recreation events. Travel routes of U.S. government employees are also considered soft targets, based on their history of terrorist attacks. The State Department is responsible for protecting more than 60,000 government employees, and their family members, who work in embassies and consulates abroad in 180 countries. Although the host nation is responsible for providing protection to diplomatic personnel and missions under the 1961 Vienna Convention, State has a variety of programs and activities to further protect U.S. officials and family members both inside and outside of the embassy. Following a terrorist attack that involves serious injury or loss of life or significant destruction of a U.S. government mission, State is required to convene an Accountability Review Board (ARB). ARBs investigate the attack and issue a report with recommendations to improve security programs and practices. State is required to report to Congress on actions it has taken in response to ARB recommendations. As of March 2005, there have been 11 ARBs convened since the board’s establishment in 1986. Concerned that State was not providing adequate security for U.S. officials and their families outside the embassy, the American Foreign Service Association testified on a number of occasions before the Senate Appropriations Subcommittee on Commerce, Justice, State and the Judiciary on the need for State to expand its security measures. The subcommittee, in its 2002 and subsequent reports, urged State to formulate a strategy for addressing threats to locales abroad that are frequented by U.S. officials and their families. It focused its concern about soft targets on schools, residences, places of worship, and other popular gathering places. In fiscal years 2003, 2004, and 2005, Congress earmarked a total of $15 million for soft target protection each year, particularly to address security vulnerabilities at overseas schools. Moreover, in 2005, the Senate appropriations report directed State to develop a comprehensive strategy for addressing the threats posed to soft targets no later than June 1, 2005. State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. official and their families. State officials cited several complex issues involved with protecting soft targets. As the terrorist threat grows, State is being asked to provide ever greater levels of protection to more people in more dangerous locations, and they questioned how far State’s protection of soft targets should extend. They said that providing U.S. government funds to protect U.S. officials and their families at private sector locations or places of worship was unprecedented and raised a number of legal and financial challenges—including sovereignty and separation of church and state— that have not been resolved by the department. State officials also indicated they have not yet fully defined the universe of soft targets— including taking an inventory of potentially vulnerable facilities and areas where U.S. officials and their families congregate—that would be necessary to complete a strategy. Although State has not developed a comprehensive soft target strategy, some State officials told us that several existing programs could help protect soft targets. However, they agreed that these existing programs are not tied together in an overall strategy. State officials agreed that they should undertake a formal evaluation of how existing programs can be more effectively integrated as part of a soft target strategy, and whether new programs might be needed to fill any potential gaps. A senior official with State’s Bureau of Diplomatic Security (DS) told us that in January 2005, DS formed a working group to develop a comprehensive soft targets strategy to address the appropriate level of protection of U.S. officials and their families at schools, residences, and other areas outside the embassy. According to State, the strategy should be completed by June 1, 2005. To identify vulnerabilities in State’s soft target protection, and determine if State had corrected these vulnerabilities, we reviewed the ARB reports conducted after U.S. officials were assassinated outside the embassy. Of the 11 ARBs conducted since 1986, the majority (5) have focused on soft target attacks, compared with attacks against embassies (2) or other U.S. facilities (4). We found that, 17 years after the first soft target ARB, State has still not addressed the vulnerabilities and recommendations identified in that and more recent reports: specifically, the need for hands-on counterterrorism training and accountability mechanisms to promote compliance with personal security procedures. Despite State’s assurances to Congress that it would implement recommendations aimed at reducing these vulnerabilities, we found that State’s hands-on training course is still not mandatory, and procedures to monitor compliance with security requirements have not been fully implemented. We also found that ambassadors, deputy chiefs of mission, and regional security officers were not trained in how to implement embassy procedures intended to protect U.S. officials outside the embassies. Since 1988, State has reported to Congress that it agreed with ARB recommendations to provide counterterrorism training. For example, in 1995, State reported that it “re-established the Diplomatic Security Antiterrorism Course (DSAC) for those going to critical-threat posts to teach surveillance detection and avoidance, and defensive and evasive driving techniques.” In 2003, State reported it agreed with the recommendations that employees from all agencies should receive security briefings and indicated that it would review the adequacy of its training and other personal security measures. Although State implemented the board’s recommendation to require security briefings for all staff, hands-on counterterrorism training is still not mandatory, and few officials or family members have taken DSAC. Senior DS officials said they recognize that security briefings are no longer adequate to protect against current terrorist threats. In June 2004, DS developed a proposal to make DSAC training mandatory. DS officials said that DSAC training should be required for all officials, but that issues such as costs and adequacy of training facilities were constraining factors. As of April 18, 2005, the proposal had not been approved. Although State has agreed on the need to implement an accountability system to promote compliance with personal security procedures since 1988, there is still no such system in place. Beginning in 2003, State has tried to incorporate some limited accountability to promote compliance. However, based on our work at five posts, we found that post officials are following few, if any, of these new procedures. In response to a 2003 ARB, State took a number of steps to improve compliance with State’s personal security procedures for officials outside the embassy. In June 2003, State revised its annual assessment criteria to take personal security into account when preparing performance appraisals, and in December 2003, State revised its Foreign Affairs Manual to mandate and improve implementation of personal security practices. In May 2004, State notified posts worldwide on use of a Personal Security Self-Assessment Checklist to improve security outside the embassy. However, none of the posts we visited were even aware of these and other key policy changes. For example, none of the officials we met with, including ambassadors, deputy chiefs of mission, regional security officers, or staff, were aware that the annual ratings process now includes an assessment of whether staff are following the personal security measures or that managers are now responsible for the reasonable oversight of subordinates’ personal security activities. Furthermore, none of the supervisors were aware of the checklist, and we found no one was using the checklists to improve their personal security practices. In explaining why posts were not aware of the new personal security regulations, DS officials noted that posts were often overwhelmed by work and may have simply missed the cables and changes in the Foreign Affairs Manual. They also noted that changes like this take time to be implemented globally. Furthermore, State’s original plan, to use the checklist as an accountability mechanism, was dropped before it was implemented. In its June 2003 report to Congress on implementation of the 2003 ARB recommendations, State stipulated that staff would be required to use the checklist periodically and that managers would review the checklists to ensure compliance. However, State never implemented this accountability mechanism out of concern it would consume too much staff time. We also found that key officials receive no training on how to promote personal security outside the embassy. According to a number of State officials, improvements in this area must start with the ambassador and the deputy chief of mission. Yet no ambassadors, deputy chiefs of mission, or regional security officers receive any training in how to maximize soft target protection at embassies. DS officials agreed that this critical component should be added to their training curriculum. In response to several congressional committee reports, State began developing a “Soft Targets” program in 2003 to help protect overseas schools against terrorism. The program has four proposed phases. The first two phases are focused on department-sponsored schools that have previously received grant funding from the State Department, and the third and fourth phases focus on the nondepartment-sponsored schools with American students. In phase one, department-sponsored schools were offered funding for basic security hardware such as shatter-resistant window film, two-way radios for communication between the school and the embassy, and public address systems. As of November 19, 2004, 189 department-sponsored schools had received $10.5 million in funding for security equipment in phase one of the program. The second phase provided additional security enhancements, such as perimeter fencing, walls, lighting, gates, and guard booths. As of November 2004, State has obligated over $15 million for phase two security upgrades. For phases three and four, State plans to provide similar types of security upgrades to eligible nondepartment- sponsored schools. The program also funds security enhancements for off-compound embassy employee association facilities, such as recreation centers. Security upgrades include funding for perimeter walls and shatter-resistant window film. In fiscal year 2004, almost $1 million was obligated for these enhancements. Regional Security Officers (RSO) said that identifying and funding for security enhancements at department-sponsored schools were straightforward because of the department’s pre-existing relationship with these schools. However, they said it has been difficult to identify eligible nondepartment-sponsored schools for phase three because of the vast number of schools that might qualify, the lack of any pre-existing relationship, and limited guidance on eligibility criteria. For example, some RSOs questioned how many American students should attend a school for it to be eligible for security upgrades. Some RSOs were considering funding schools with just a few American students. Moreover, one RSO was considering providing security upgrades to informal educational facilities, such as those attended by children of U.S. missionaries. State is trying to determine the appropriate scope of the program, and sent cables to posts in the summer of 2004 asking RSOs to gather data on nondepartment-sponsored schools attended by American students, particularly U.S. government dependents. State officials acknowledged that the process of gathering data has been difficult since there are hundreds of such schools worldwide. According to an Overseas Buildings Operations (OBO) official, as of December 2004, only about 81 out of the more than 250 posts have provided responses regarding such schools. OBO plans to use the data to develop criteria for which schools might be eligible for funding under phase three and, eventually, phase four of the program. In anticipation of any future phases of the Soft Targets program, RSOs have been asked to identify other facilities and areas that Americans frequent, beyond schools and off-compound employee association facilities, that may be vulnerable to a terrorist attack. State Department officials were concerned about the large number of sites RSOs could identify as potential soft target sites, and the department’s ability to protect them. State has a responsibility for providing a secure housing environment for U.S. officials and their families overseas. However, we found that State’s primary program in place to protect U.S. officials and their families at residences, the Residential Security program, is principally designed to deter crime, not terrorism. The program includes basic security hardware and guard service; and as the crime threat increases, the hardware and guard services can be correspondingly increased at the residences. State officials said that while the Residential Security program, augmented by the local guard program, provides effective deterrence against crime, it could provide limited or no deterrence to minimize the risk and consequences of a residential terrorist attack. State officials told us that the best residential scenario for posts is to have a variety of housing options, including apartments and single-family homes, to reduce the potential for a catastrophic attack. To provide greater protection against terrorist attacks, most posts we visited used surveillance detection teams in the residential areas. The program is intended to enhance the embassies’ ability to detect preoperational terrorist surveillance and stop the attack. According to State’s guidance, surveillance detection units are primarily designed to protect embassies, and their use in residential areas is discouraged. However, we found RSOs at some of the posts we visited were routinely utilizing surveillance detection units to cover areas outside the embassies, such as residences, school bus stops and routes, and schools attended by U.S. embassy dependents. RSOs told us that the Surveillance Detection program is instrumental in providing deterrence against potential terrorist attacks, and argued that the current program guidelines are too restrictive. Senior State officials agreed that the use of the surveillance detection in soft target areas could be beneficial, but noted that the program is labor intensive and expensive, and any expansion of the program could require significant funding. Mr. Chairman and Members of the Subcommittee, this concludes my prepared statement. I will be happy to answer any questions you may have. For questions regarding this testimony, please call Diana Glod at (202) 512-8945. Individuals making key contributions to this testimony included Edward George and Andrea Miller. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: U.S. government officials working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked--23 fatally--by terrorists outside the embassy. As the State Department continues to improve security at U.S. embassies, terrorist groups are likely to focus on "soft" targets--such as homes, schools, and places of worship. GAO was asked to determine whether State has a strategy for soft target protection; assess State's efforts to protect U.S. officials and their families while traveling to and from work; assess State's efforts overseas to improve security at schools attended by the children of U.S. officials; and describe issues related to protection at their residences. State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. They also indicated that they have recently initiated an effort to develop a soft targets strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. Three State initiated investigations into terrorist attacks against U.S. officials outside of embassies found that the officials lacked the necessary hands-on training to help counter the attack. The investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. After each of these investigations, State reported to Congress that it planned to implement the recommendations, yet we found that State's hands-on training course is not required, the accountability procedures have not been effectively implemented, and key embassy officials are not trained to implement State's counterterrorism procedures. State instituted a program in 2003 to improve security at schools, but its scope has not yet been fully determined. In fiscal years 2003 and 2004, Congress earmarked $29.8 million for State to address security vulnerabilities against soft targets, particularly at overseas schools. The multiphase program provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities from terrorist threats. However, during our visits to posts, regional security officers were unclear about which schools could qualify for security assistance under phase three of the program. State's program to protect U.S. officials and their families at their residences is primarily designed to deter crime, not terrorism. The Residential Security program includes basic security hardware and local guards, which State officials said provide effective deterrence against crime, though only limited deterrence against a terrorist attack. To minimize the risk and consequences of a residential terrorist attack, some posts we visited limited the number of U.S. officials living in specific apartment buildings. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in residential areas.