The expenditure plan, including related documentation and program officials’ statements, satisfied four legislative conditions, partially satisfied four legislative conditions, and did not satisfy one legislative condition. The nine legislative conditions and the level of satisfaction are summarized below. Legislative condition 1: Define activities, milestones, and costs for implementing the program (partially satisfied). The SBInet expenditure plan included general cost information for proposed activities and some associated milestone information, such as beginning and ending dates. DHS estimates that the total cost for completing the acquisition phase for the southwest border is $7.6 billion for fiscal years 2007 through 2011. However, the plan and related documentation did not include sufficient details about the activities, milestones, or costs for implementing the program. Although the plan stated that about $790 million will be spent in the Tucson sector in Arizona for such elements as fencing, ground sensors, radars, cameras, and fixed and mobile towers, the plan did not specify how the funds will be allocated by element and did not provide specific dates for implementation. In addition, the plan did not include activities, milestones, or costs for the northern border. According to DHS, work on the northern border is not to begin before fiscal year 2009. Legislative condition 2: Demonstrate how activities will further the goals and objectives of the SBI, as defined in the SBI multiyear strategic plan (not satisfied). The SBInet expenditure plan included a section that describes SBI and SBInet goals; however, the expenditure plan and related documentation did not link individual activities with SBI’s goals, as called for by the legislative condition. Further, the December 2006 SBI strategic plan contained three strategic goals, one of which addresses border control. SBI and SBInet senior officials told us all SBInet activities link back to the overall goal of controlling the border and that the linkage between program goals and activities is intuitive. However, the SBInet expenditure plan did not link specific activities to more detailed SBI strategic plan goals, such as the annual performance goals. Legislative condition 3: Identify funding and organization staffing (including full-time equivalents, contractors, and detailees) requirements by activity (satisfied). The SBInet program is managed by the SBInet Program Management Office (PMO). The PMO plans to execute SBInet activities through a series of concurrent task orders and to rely on a mix of government and contractor staff. The PMO plans to nearly triple its current workforce, from approximately 100 to 270 personnel, by September 2007 in order to support and oversee this series of concurrent task orders. As of December 2006, SBInet officials told us that they have assigned lead staff for the task orders that have been awarded. Legislative condition 4: Report on costs incurred, the activities completed, and the progress made by the program in terms of obtaining operational control of the entire border of the United States (partially satisfied). The SBInet expenditure plan and related documentation discussed how approximately $1.5 billion will be allocated to SBInet activities. For example, about $790 million is allocated for the Tucson Border Patrol sector and $260 million for the Yuma sector in Arizona. However, the plan did not include costs incurred to date mainly because SBInet activities are in the early stages of implementation and costs had not yet been captured by DHS’s accounting system (e.g., the SBInet systems integration contract was awarded in September 2006 and the first two task orders were awarded in September and October 2006). Moreover, the expenditure plan did not include a baseline measure of miles under control of the border. While the plan did not discuss progress made to date by the program to obtain control of the border, related program documents, such as the bimonthly SBI reports to Congress, included information on the number of miles under control in the southwest border. According to the November 2006 bimonthly report, as of August 2006, 284 miles of the southwest border are under control. Legislative condition 5: Include a certification by DHS’s Chief Procurement Officer (CPO) that procedures to prevent conflicts of interest between the prime integrator and major subcontractors are established and a certification by DHS’s Chief Information Officer (CIO) that an independent verification and validation agent is currently under contract for the project (satisfied). On November 30, 2006, DHS’s CPO certified that the prime integrator had established procedures to prevent conflicts of interest between it and its major subcontractors and that DHS is developing a process to monitor and oversee implementation of the prime integrator’s procedures. Also, on November 30, 2006, DHS’s Deputy CIO certified that the SBInet program had contracted with a private company as the interim independent verification and validation (IV&V) agent. However, this company is also responsible for performing program activities, including requirements management and test and evaluation activities and thus is not independent of all the program’s products and processes that it could review. The Deputy CIO certified that a permanent IV&V agent is to be selected by February 28, 2007, and that CBP is to provide information sufficient to determine that this independence issue has been resolved. Legislative condition 6: Comply with all applicable acquisition rules, requirements, guidelines, and best systems acquisition management practices of the federal government (partially satisfied). SBInet is using, at least to some extent, several acquisition best practices. The extent to which these practices are in use varies, and outcomes are dependent on successful implementation. However, one acquisition requirement not followed was that the SBInet systems integration contract did not contain a specific number of units that may be ordered or a maximum dollar value. According to the Federal Acquisition Regulation (FAR), indefinite quantity contracts must specify the maximum quantity of supplies or services the agency will acquire. This may be stated as a number of units or as a dollar value. SBI and SBInet officials told us that the contract already contains a maximum quantity of “6,000 miles of secure U.S. border” and that this was sufficient to satisfy the FAR requirement. We disagree because the statement in the contract about the 6,000 miles of secure border merely reflects the agency’s overall outcome to be achieved with the supplies or services provided but does not specify the maximum quantity of supplies or services the agency may acquire. We believe that a maximum quantity or dollar value limit should be included in the contract in order to ensure that it is consistent with the FAR requirement. SBInet’s acquisition approach calls for considerable concurrency among related planned tasks and activities. The greater the degree of concurrency among related and dependent program tasks and activities, the greater a program’s exposure to cost, schedule, and performance risks. SBI and SBInet officials told us that they understand the risks inherent in concurrency and are addressing these risks. However, they have yet to provide evidence that shows they have identified the dependencies among their concurrent activities and that they are proactively managing the associated risk. Further, the program office did not fully define and implement key acquisition management processes, such as project planning, requirements management, and risk management. According to the SBInet Program Manager, this is due to the priority being given to meeting an accelerated program implementation schedule. However, the program office has begun implementing a risk management process and, according to the Program Manager, plans to develop a plan for defining and implementing the remaining processes by the spring of 2007. Legislative condition 7: Comply with the capital planning and investment control review requirements established by the Office of Management and Budget (OMB), including Circular A-11, part 7 (partially satisfied). As required by OMB, the plan and related documentation provided a brief description of SBInet and addressed the program’s management structure and responsibilities for most of the program office’s directorates. In addition, the program office developed a draft privacy impact assessment and established an earned value management (EVM) system to manage the prime integrator’s progress against cost and schedule goals. However, an OMB-required EVM system had not been fully implemented because the baselines against which progress can be measured for the two task orders that had been issued, as of December 4, 2006, were not yet established. Further, the program office had not yet developed a system security plan or determined SBInet’s compliance with the DHS enterprise architecture. Legislative condition 8: Include reviews and approvals by DHS’s Investment Review Board (IRB), the Secretary of Homeland Security, and OMB (satisfied). DHS’s IRB approved the plan on November 22, 2006; the Secretary of Homeland Security approved the expenditure plan on November 22, 2006; and OMB approved the plan on December 4, 2006. Legislative condition 9: Include a review by GAO (satisfied). On December 7, 2006, we briefed the House of Representatives Committee on Appropriations staff and on December 13, 2006, we briefed the Senate Committee on Appropriations staff regarding the results of our review. The legislatively mandated expenditure plan for SBInet is a congressional oversight mechanism aimed at ensuring that planned expenditures are justified, performance against plans is measured, and accountability for results is ensured. Because the SBInet expenditure plan lacked sufficient details on such things as planned activities and milestones, anticipated costs and staffing levels, and expected mission outcomes, Congress and DHS are not in the best position to use the plan as a basis for measuring program success, accounting for the use of current and future appropriations, and holding program managers accountable for achieving effective control of the southwest border. Under the FAR, indefinite quantity contracts such as the SBInet contract must contain the specific number of units that may be ordered or a maximum dollar value. However, the SBInet contract merely contains the maximum number of miles to be secured. While SBInet officials consider this sufficient to satisfy the FAR requirement, a maximum quantity expressed in units other than the overall outcome to be achieved or expressed as a dollar value limit would help ensure that the contract is consistent with this requirement. DHS’s approach to SBInet introduces additional risk because the program’s schedule entails a high level of concurrency. With multiple related and dependent projects being undertaken simultaneously, SBInet is exposed to possible cost and schedule overruns and performance problems. Without assessing this level of concurrency and how it affects project implementation, SBInet runs the risk of not delivering promised capabilities and benefits on time and within budget. To help ensure that Congress has the information necessary to effectively oversee SBInet and hold DHS accountable for program results, and to help DHS manage the SBInet program and ensure that future SBInet expenditure plans meet the legislative requirements, we recommend that the Secretary of Homeland Security direct the U.S. Customs and Border Protection Secure Border Initiative Program Management Office Executive Director to take the following three actions: ensure that future expenditure plans include explicit and measurable commitments relative to the capabilities, schedule, costs, and benefits associated with individual SBInet program activities; modify the SBInet systems integration contract to include a maximum quantity or dollar value; and re-examine the level of concurrency and appropriately adjust the acquisition strategy. In written comments on a draft of this report, DHS generally agreed with our findings and conclusions, but did not agree with our assessment that the SBInet contract does not contain specific numbers of units that may be ordered or a maximum dollar value. In addition, DHS stated that CBP intends to fully satisfy each of the legislative conditions in the near future to help minimize the program’s exposure to cost, schedule, and performance risks. DHS’s written comments are reproduced in appendix II. With respect to our recommendations, DHS concurred with two of our recommendations and disagreed with one. Specifically, DHS concurred with our recommendation for future expenditure plans to include explicit and measurable commitments relative to capabilities, schedule, costs, and benefits associated with individual SBInet program activities. According to DHS, future SBInet expenditure plans will include actual and planned progress, report against commitments contained in prior expenditure plans, and include a section that addresses and tracks milestones. DHS also concurred with our recommendation to re-examine the level of concurrency and appropriately adjust the acquisition strategy. In its written comments, DHS stated that CBP is constantly assessing the overall program as it unfolds, and adjusting it to reflect progress, resource constraints, refinements and changes in requirements, and insight gained from ongoing system engineering activities. DHS also stated that CBP recognizes the risk inherent in concurrency and has added this to the program’s risk management database. DHS did not agree with our recommendation to modify the SBInet integration contract to include a maximum quantity or dollar value. According to DHS, the quantity stated in the contract, “6,000 miles of secure U.S. border,” is measurable and is therefore the most appropriate approach to defining the contract ceiling. We do not agree. Under the FAR, an agency may use an indefinite delivery/indefinite quantity contract, such as that used for SBInet, when it is not possible to determine in advance the precise quantities of goods or services that may be required during performance of the contract. Though these types of contracts are indefinite, they are not open-ended. The FAR requires that indefinite quantity contracts contain a limit on the supplies or services that may be ordered, stated in terms of either units or dollars. This limit serves a variety of purposes, including establishing the maximum financial obligation of the parties. In our view, the purported maximum used in the SBInet contract, “the full panoply of supplies and services to provide 6,000 miles of secure U.S. border,” does not allow anyone to calculate with any degree of certainty what the maximum financial obligation of the parties might turn out to be since the contract does not make clear the total amount of supplies or services that would be required to secure even 1 mile of U.S. border. In order to ensure that the SBInet contract is consistent with the FAR, we continue to believe that it should be modified to include a maximum quantity, either units or a dollar value, rather than the total amount of miles to be secured. We are sending copies of this report to the Chairman and Ranking Minority Members of other Senate and House committees that have authorization and oversight responsibilities for homeland security. We are also sending copies to the Secretary of Homeland Security, the Commissioner of Customs and Border Protection, and the Director of the Office of Management and Budget. Copies of this report will also be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any further questions about this report, please contact Richard Stana at (202) 512-8816 or StanaR@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III. Pub. L. No. 109-295, 120 Stat. 1355, 1359-60. The Appropriations Act required an expenditure plan to establish a security barrier along the border of the United States of fencing and vehicle barriers and other forms of tactical infrastructure and technology. In response to this requirement, DHS submitted a plan on December 4, 2006, titled “SBInet Expenditure Plan,” that defines SBInet as “the component of SBI charged with developing and installing the technology and tactical infrastructure solution for border control.” The Appropriations Act also required GAO to review the expenditure plan. 1. detect illegal entries into the United States; 2. identify and classify these entries to determine the level of threat involved; 3. efficiently and effectively respond to these entries; and 4. bring events to a satisfactory law enforcement resolution. The initial focus of SBInet will be on southwest border investments and areas between the ports of entry that CBP has designated as having the highest need for enhanced border security due to serious vulnerabilities. Figure 2 shows the topography, interstate highways, and some major secondary roads along the southwest border. DHS estimates that the total cost for completing the acquisition phase for the southwest border is $7.6 billion from FY2007 through FY2011. $5.1 billion is for the design, development, integration and deployment of fencing, roads, vehicle barriers, sensors, radar units, and command, control, and communications and other equipment. $2.5 billion is for integrated logistics and operations support during the acquisition phase for the southwest border. DHS expects to have control of the southwest border by October 2011. DHS officials have yet to provide draft implementation plans by southwest border sectors and years for FY2007-FY2011. The expenditure plan does not include activities, milestones, or costs for the northern border. According to DHS, work on the northern border is not projected to begin before FY2009. Provide a brief description of the investment and its status in the CPIC review, including major assumptions made about the investment. contribute to achievement of cost, schedule, and performance goals. The expenditure plan and other documentation address the management structures and responsibilities. Specifically, the program office includes six line and four staff directorates reporting to the SBInet Program Manager. The management structure also includes the use of integrated project teams that consist of subject matter experts from a variety of disciplines required to effectively manage an acquisition project. The draft Program Management Plan, dated September 18, 2006, identified responsibilities for five of the six program office line directorates, and for two of the four staff directorates. The plan also identified responsibilities for some, but not all, divisions within each of the directorates. For example, the plan describes the responsibilities of the Mission Engineering Directorate, but it does not describe the responsibilities for the five divisions within the Directorate. We have not yet seen any documentation that describes the qualifications of the program office staff. Provide a summary of the investment’s risk assessment, including how 19 OMB- identified risk elements are being addressed. The program office has defined and begun implementing a risk management process, and developed a risk database that addresses 13 of the 19 OMB-identified risk. The risk elements that are not addressed include privacy and technical obsolescence. Provides a summary of the investment’s status in accomplishing baseline cost and schedule goals through the use of an earned value management (EVM) system or operational analysis, depending on the life-cycle stage. The program office is currently relying on the prime integrator’s EVM system to manage the prime contractor’s progress against cost and schedule goals. The prime integrator’s EVM system has been independently certified as meeting established standards. However, the EVM system has not yet been fully implemented because the baselines against which progress can be measured for the two task orders that have been issued to date has not yet been established. According to program officials, these baselines will be established for the program management task order and the Project 28 task order in mid-December 2006 and mid-January 2007, respectively. and CPIC process. The expenditure plan did not include a discussion of the program office’s activities in regard to the DHS enterprise architecture. Moreover, according to program officials, the program office has not yet determined if SBInet is aligned with the architecture. According to these officials, SBInet is to be reviewed by the Enterprise Architecture Center of Excellence, which is the DHS entity that determines enterprise architecture alignment, by the end of December 2006. Provides a description of an investment’s security and privacy issues. Summarizes the agency’s ability to manage security at the system or application level. Demonstrates compliance with the certification and accreditation process, as well as the mitigation of IT security weaknesses. The expenditure plan did not include a discussion of security and/or privacy. According to a program office security specialist, the program office has not yet developed a system security plan because it is too early in the system development life cycle. A system security plan is to be developed as a part of the system certification and accreditation process. Regarding privacy, the program office developed a draft privacy impact assessment dated October 2006. The assessment addresses several, but not all, of OMB’s criteria. Legislative Condition #8: Includes Approvals by IRB, DHS Secretary and OMB (Satisfied) The expenditure plan, including related documentation and program officials’ statements, satisfied the condition that the plan be reviewed and approved by DHS’s Investment Review Board, the Secretary of Homeland Security, and OMB. DHS’s Investment Review Board approved the plan on November 22, 2006. The Secretary of Homeland Security approved the expenditure plan on November 22, 2006. OMB approved the plan on December 4, 2006. The SBInet PMO provided draft versions of the expenditure plan and supporting documentation. We conducted our review from October 11, 2006, to December 5, 2006. program officials’ statements, has satisfied four, partially satisfied four and not satisfied one of the nine conditions legislated by the Congress. Satisfying the legislative conditions is important because the expenditure plan is intended to provide Congress with the information needed to effectively oversee the program and hold DHS accountable for program results. Satisfying the legislative conditions is also important to minimize the program’s exposure to cost, schedule, and performance risks. DHS’s approach to SBInet introduces additional risk because the program’s structure entails a high level of concurrency and lacks a maximum quantity or dollar value for the integration contract. The current expenditure plan offers a high-level and partial outline of a large and complex program that forms an integral component of a broader multi-year initiative. However, Congress and DHS need additional details of planned milestones, anticipated interim and final costs, and staffing to be reasonably assured that the current risk to the project’s cost, schedule, and ultimate effectiveness is minimized. ensure that future expenditure plans include explicit and measurable commitments relative to the capabilities, schedule, costs, and benefits associated with individual SBInet program activities; re-examine the level of concurrency and appropriately adjust the acquisition strategy; and modify the SBInet systems integration contract to include a maximum quantity or dollar value. DHS, SBI and SBInet officials also provided clarifying information that we incorporated as appropriate in this briefing. expenditure plan and supporting documentation, comparing them to relevant federal requirements and guidance, and applicable best practices. We reviewed draft versions of the expenditure plan, including versions 1.0 (November 15, 2006); 2.0 (November 27, 2006); and 2.1 (November 29, 2006). We also reviewed the final version of the plan submitted to Congress on December 4, 2006. We interviewed DHS, CBP, SBI, and SBInet program officials and contractors. We did not review the justification for cost estimates included in the expenditure plan. In addition, we did not independently verify the source or validity of the cost information. guidance (OMB-A-11) to determine whether the information complies with the capital planning and investment controls. We conducted our work at CBP headquarters in the Washington, D.C., metropolitan area from October 2006 to December 2006, in accordance with generally accepted government auditing standards. In addition to the person named above, Robert E. White, Assistant Director; Deborah Davis, Assistant Director; Richard Hung, Assistant Director; E. Jeanette Espínola; Frances Cook; Katherine Davis; Gary Delaney; Joseph K. Keener; Sandra Kerr; Raul Quintero; and Sushmita Srikanth made key contributions to this report.

Summary: In November 2005, the Department of Homeland Security (DHS) established the Secure Border Initiative (SBI) program to secure U.S. borders and reduce illegal immigration. One element of SBI is SBInet, the program responsible for developing a comprehensive border protection system. By legislative mandate, DHS developed a fiscal year 2007 expenditure plan for SBInet to address nine legislative conditions, including a review by GAO. DHS submitted the plan to the Appropriations Committees on December 4, 2006. To address the mandate, GAO assessed the plan against federal guidelines and industry standards and interviewed appropriate DHS officials. The SBInet expenditure plan, including related documentation and program officials' statements, satisfied four legislative conditions, partially satisfied four legislative conditions, and did not satisfy one legislative condition. Satisfying the legislative conditions is important because the expenditure plan is intended to provide Congress with the information needed to effectively oversee the program and hold DHS accountable for program results. Satisfying the legislative conditions is also important to minimize the program's exposure to cost, schedule, and performance risks. SBInet's December 2006 expenditure plan offered a high-level and partial outline of a large and complex program that forms an integral component of a broader multiyear initiative. However, the plan and related documentation did not include explicit and measurable commitments relative to capabilities, schedule, costs, and benefits associated with individual SBInet program activities. In addition, the SBInet systems integration contract did not contain a specific number of units that may be ordered or a maximum dollar value as required by Federal Acquisition Regulation. Further, DHS's approach to SBInet introduces additional risk because the program's schedule entails a high level of concurrency among related planned tasks and activities.