Homeland Security Presidential Directive 3 (HSPD-3) established the Homeland Security Advisory System in March 2002. Through the creation of the Homeland Security Advisory System, HSPD-3 sought to produce a common vocabulary, context, and structure for an ongoing discussion about the nature of threats that confront the nation and the appropriate measures that should be taken in response to those threats. Additionally, HSPD-3 established the Homeland Security Advisory System as a mechanism to inform and facilitate decisions related to securing the homeland among various levels of government, the private sector, and American citizens. The Homeland Security Advisory System is comprised of five color-coded threat conditions as described below, which represent levels of risk related to potential terror attack. Code-red or severe alert—severe risk of terrorist attacks. Code-orange or high alert—high risk of terrorist attacks. Code-yellow or elevated alert—significant risk of terrorist attacks. Code-blue or guarded alert—general risk of terrorist attacks. Code-green or low alert—low risk of terrorist attacks. As defined in HSPD-3, risk includes both the probability of an attack occurring and its potential gravity. Since its establishment in March 2002, the Homeland Security Advisory System national threat level has remained at elevated alert—code-yellow— except for five periods during which the administration raised it to high alert—code-orange. The periods of code-orange alert follow: September 10 to 24, 2002; February 7 to 27, 2003; March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004. The Homeland Security Advisory System is binding on the executive branch. HSPD-3 directs all federal departments, agencies, and offices, other than military facilities, to conform their existing threat advisory systems to the Homeland Security Advisory System. These agencies are responsible for ensuring their systems are consistently implemented in accordance with national threat levels as defined by the Homeland Security Advisory System. Additionally, federal departments and agency heads are responsible for developing protective measures and other antiterrorism or self-protection and continuity plans in response to the various threat levels and operating and maintaining these plans. While HSPD-3 encourages other levels of government and the private sector to conform to the system, their compliance is voluntary. When HSPD-3 first established the Homeland Security Advisory System, it provided the Attorney General with responsibility for administering the Homeland Security Advisory System, including assigning threat conditions in consultation with members of the Homeland Security Council, except in exigent circumstances. As such, the Attorney General could assign threat levels for the entire nation, for particular geographic areas, or for specific industrial sectors. Upon its issuance, HSPD-3 also assigned responsibility to the Attorney General for establishing a process and a system for conveying relevant threat information expeditiously to federal, state, and local government officials, law enforcement authorities, and the private sector. In November 2002, Congress passed the Homeland Security Act of 2002, P.L. 107-296, which established the Department of Homeland Security. Under the Homeland Security Act of 2002, the DHS Under Secretary for Information Analysis and Infrastructure Protection (IAIP) is responsible for administering the Homeland Security Advisory System. As such, the Under Secretary for IAIP is primarily responsible for issuing public threat advisories and providing specific warning information to state and local governments and to the private sector. The act also charges the Under Secretary for IAIP with providing advice about appropriate protective actions and countermeasures. In February 2003, in accordance with the Homeland Security Act, the administration issued Homeland Security Presidential Directive 5 (HSPD- 5), which amended HSPD-3 by transferring authority for assigning threat conditions and conveying relevant information from the Attorney General to the Secretary of Homeland Security. HSPD-5 directs the Secretary of Homeland Security to consult with the Attorney General and other federal agency heads the Secretary deems appropriate, including other members of the Homeland Security Council, when determining the threat level, except in exigent circumstances. In implementing the Homeland Security Advisory System, DHS assigns national threat levels and assesses the threat condition of specific geographic locations and industrial sectors. While the national threat level has been raised and lowered for five periods, DHS officials told us that the department has not yet assigned a threat level for an industrial sector or geographic location. However, DHS officials said that the department has encouraged specific sectors and regions to operate at heightened levels of security. According to DHS officials, decisions to change the national threat level and to encourage specific sectors and regions to operate at heightened levels of security involve both analysis and sharing of threat information, as well as an assessment of the vulnerability of national critical infrastructure assets that are potential targets of terrorist threats. DHS officials told us they use the criteria in HSPD-3 in determining whether to raise the national threat level or whether to suggest that certain regions or sectors operate at heightened security levels. These criteria include: the credibility of threat information; whether threat information is corroborated; the degree to which the threat is specific and/or imminent; and the gravity of the potential consequences of the threat. In determining whether these criteria are met and whether to raise the national threat level, DHS considers intelligence information and the vulnerability of potential targets, among other things. DHS officials told us that they use a flexible, “all relevant factors” approach to decide whether to raise or lower the national threat level or whether to suggest that certain regions or sectors operate at heightened security levels. They said that analysis of available threat information and determination of national threat levels and regional and sector threat conditions are specific for each time period and situation. According to these officials, given the nature of the data available for analysis, the process and analyses used to determine whether to raise or lower the national threat level or suggest that specific regions or sectors heighten their protective measures are inherently judgmental and subjective. DHS officials said that the intelligence community continuously gathers and analyzes information regarding potential terrorist activity. This includes information from such agencies as DHS, the Central Intelligence Agency, the Federal Bureau of Investigation (FBI), and the Terrorist Threat Integration Center, as well as from state and local law enforcement officials. DHS officials also noted that analyses from these and other agencies are shared with DHS’s IAIP, which is engaged in constant communication with intelligence agencies to assess potential homeland security threats. DHS also considers the vulnerability of potential targets when determining the national threat level. For example, DHS officials explained that they hold discussions with state and local officials to determine whether potential targets specified by threat information require additional security to prevent a terrorist attack or minimize the potential gravity of an attack. According to these officials, if the target is determined to be vulnerable, then DHS will consider raising the threat level. Last, DHS determines whether there is a nationwide threat of terrorist attack or if the threat is limited to a specific geographic location or a specific industrial sector. DHS officials said that, in general, upon assessment of the above criteria, if there appears to be a threat of terrorist attack nationwide, then IAIP recommends to the Secretary of Homeland Security that the national threat level should be raised. The Secretary of Homeland Security then consults with the other members of the Homeland Security Council on whether the national threat level should be changed. DHS officials told us that if the Homeland Security Council members could not agree on whether to change the national threat level, the President would make the decision. DHS officials also told us that when deciding whether to lower the national threat level, they consider whether the time period in which the potential threat was to occur has passed and whether protective measures in place for the code-orange alerts have been effective in mitigating the threats. DHS officials told us that if a credible threat against specific industrial sectors or geographic locations exists, DHS may suggest that these sectors or locations operate at a heightened level of security, rather than raising the national threat level. For example, for the third code-orange alert period in our review from December 31, 2003, to January 9, 2004, threat information raised concerns of potential terrorist activity for specific industrial sectors and geographic locations. In response, DHS officials said that they encouraged those responsible for securing chemical and nuclear power plants, transit systems, and aircraft, as well as certain cities, to maintain a heightened level of security, even after the national threat level was lowered to code-yellow. However, DHS officials noted that they did not assign a threat level to these sectors and regions at that time. DHS officials further indicated that these sectors and locations were not operating at code-orange alert levels. Rather, they operated at heightened levels of security. According to DHS officials, when encouraging specific sectors or regions to continue to operate at heightened levels of security, DHS may suggest that these sectors or regions (1) implement security measures that are in addition to those implemented during a code-orange alert period, (2) continue the measures implemented during the code-orange alert period, or (3) continue selected measures implemented during a code-orange alert period. DHS officials told us that not all threats to specific regions or sectors are communicated to the public or to officials in all regions or sectors. Rather, if intelligence information suggests a targeted threat to specific regions or industrial sectors, DHS officials said that they inform officials in the specific regions or sectors that are responsible for implementing protective measures to mitigate the terrorist threat. To inform these officials, DHS issues threat advisories or information bulletins. The threat advisories we reviewed contained actionable information about threats targeting critical national networks, infrastructures, or key assets such as transit systems. These products may suggest a change in readiness posture, protective actions, or response that should be implemented in a timely manner. If the threat is less urgent, DHS may issue information bulletins, which communicate risk and vulnerabilities of potential targets. In a February 2004 testimony, the Deputy Secretary of Homeland Security said that because threat advisories and information bulletins are derived from intelligence, they are generally communicated on a need-to-know basis to a targeted audience. The threat advisories and bulletins we reviewed also included advice on protective measures to be implemented by law enforcement agencies or the owners and operators of national critical infrastructure assets in response to the specific threat. DHS officials told us that they have not yet officially documented protocols for communicating information about changes in the national threat level to federal agencies and states. To ensure early and comprehensive information sharing and allow for informed decision making, risk communication experts suggest that threat warnings should include the following principles: (1) communication through multiple methods, (2) timely notification, and (3) specific information on the nature, location, and timing of threats as well as guidance on actions to take in response to threats. These principles can be applied to threat information shared with federal agencies and states through the Homeland Security Advisory System. DHS used multiple methods to notify federal agencies and states of changes in the national threat level. However, many federal agencies and states responding to our questionnaires indicated that they heard about threat level changes from media sources before being notified by DHS. Federal agencies and states also reported that they did not receive specific threat information and guidance for the three code-orange alert periods from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004. Documentation of communication protocols can assist DHS in better managing the expectations of federal agencies and states regarding the methods, timing, and content of guidance and threat information they receive when the national threat level is raised to code-orange. DHS officials told us that they have not yet officially documented protocols for notifying federal agencies and states of changes in the national threat level, but are working to do so. They noted that it is has been difficult to develop protocols that provide sufficient flexibility for sharing information in a variety of situations. Thus, while attempts have been made to officially document protocols for notifying federal agencies and states of national threat level changes, DHS officials said that they have not made much progress in doing so and could not provide a specific target date for completing this effort. Without documented communication protocols, recipients of threat level notifications are uncertain as to how, when, and from what entity, such as which DHS agency, they will be notified of threat level changes and the content and extent of guidance and threat information they may receive. Communication protocols would, among other things, help foster clear understanding and transparency regarding DHS’s priorities and operations. Moreover, protocols could help ensure that DHS interacts with federal, state, local, and other entities using clearly defined and consistently applied policies and procedures. Risk communication is the exchange of information among individuals and groups regarding the nature of risk, reactions to risk messages, and legal and institutional approaches to risk management. Risk communication experts have identified the following as important principles for communicating risks to individuals and groups: Threat information should be consistent, accurate, clear, and provided repeatedly through multiple methods. Threat information should be provided in a timely fashion. To the greatest extent possible, threat information should be specific about the potential threat, including: the nature of the threat, when and where it is likely to occur, and guidance on protective measures to take to prevent or respond to the threat. These risk communication principles have been used in a variety of warning contexts, from alerting the public about severe weather or providing traffic advisories, to less commonplace warnings of infectious disease outbreaks or potential dangers from hazardous materials or toxic contamination. However, warnings about terrorist threats differ from these relatively more familiar warnings. For example, specific terrorist threat warnings to the public may allow terrorists to alter tactics or targets in response to the issuance of warnings. Warnings of terrorist threats may also increase general anxiety for populations clearly not at risk. Moreover, government agencies may not always have specific information on terrorist threats, or may not be able to publicly share specific information in threat warnings. Yet, despite these differences, the purpose of warnings, regardless of the threat, is to provide information to citizens and groups that allows them to make informed decisions about actions to take to prevent and respond to threats. Thus, risk communication principles should be applicable to communicating terrorist threat information to federal agencies, states, and localities through the Homeland Security Advisory System. According to risk communication principles, threat information should be provided through multiple methods to ensure that dissemination of the information is comprehensive and that people receive the information regardless of their level of access to information. In addition, HSPD-3 states that the Homeland Security Advisory System should provide a comprehensive and effective means to disseminate information regarding the risk of terrorist acts to federal, state, and local authorities. One means of disseminating threat information is through notifications to federal agencies and states of changes in the national threat level. DHS officials told us that with each increase in the national threat level, they apply lessons learned from previous alerts to improve their notification and information sharing processes regarding threat level changes. Based on federal agencies’ and states’ responses to our questionnaires, it appears that DHS is making progress in expanding the scope of its notification process, which is consistent with HSPD-3. As shown in table 1, more federal agencies reported receiving direct notification from DHS for the third code-orange alert period than for the other two code-orange alert periods in our review. Similarly, more federal agencies reported receiving notification from DHS via multiple methods for the third code-orange alert period than for the other two code-orange alert periods. DHS used the following methods, among others, to notify entities of changes in the national threat level, according to federal agencies’ and states’ responses to our questionnaires and discussions with DHS and local government officials: Conference calls between the Secretary of Homeland Security and state governors and/or state homeland security officials. Telephone calls from Federal Protective Service (FPS) officials to federal agencies. E-mail, telephone, or electronic communications from Homeland Security Operations Center (HSOC) representatives to the federal, state, or local agencies they represent. FBI electronic systems, such as the National Law Enforcement Telecommunications System. E-mail and/or telephone communications with federal agencies’ chief of staff and public affairs offices. E-mail and/or telephone communications to local government associations such as the National Governors Association and the U.S. Conference of Mayors. Risk communication experts suggest that threat information should be provided in a timely fashion to prevent unofficial sources, such as the media, from reporting information before official sources, including government agencies, do so. These principles suggest that lack of early and open information sharing from official entities can undermine these entities’ credibility. HSPD-3, as amended by HSPD-5, states that the Secretary of Homeland Security should establish a process and a system for conveying relevant information regarding terrorist threats expeditiously. In addition, for an entity to control its operations, it must have relevant, reliable, and timely communications relating to internal and external events. Many federal agencies and some states responding to our questionnaires expressed concerns that they learned about national threat level changes from media sources before being notified by DHS. Specifically, 16 of 24 federal agencies indicated that they learned about threat level changes via media sources prior to being notified by DHS for at least one of the three code-orange alert periods. Likewise, 15 of 40 states reported learning about national threat level changes via media sources prior to being notified by DHS for at least one of the three code-orange alert periods. This raises questions about whether DHS is always conveying information regarding threat level changes to government entities expeditiously, as required by HSPD-3. Moreover, some states reported that their ability to provide credible information to state and local agencies and the public was hindered because they did not receive notification from DHS before the media reported on the threat level changes. For example, 6 states noted that when media sources reported national threat level changes before state and local emergency response officials were directly notified by DHS, these officials did not have sufficient time to prepare their response to the threat level change, including how they would respond to requests from the public for additional information on the threat level change. One other state reported that it would prefer to first learn about changes in the national threat level from DHS so that it has sufficient time to notify state agencies and localities of the change and so that these entities can prepare their responses before the public is notified of the change. Additionally, 8 localities from which we obtained information indicated that they first learned of threat level changes from media sources, and 4 of these localities would prefer to be notified of threat level changes prior to the public. Officials from some of these localities told us that after media sources reported the change, their agencies received requests for detailed information on the change from the public and other entities. They noted that their agencies appeared ineffective to the public and other entities because, without notification of the national threat level change before it was reported by media sources, they did not have time to prepare informed responses. DHS officials told us that they attempt to notify federal agencies and states of threat level changes before the media report on the changes. However, they noted that DHS has not established target time periods in which to notify these entities of the threat level changes. Furthermore, DHS officials indicated they were aware that the media sometimes reported threat level changes before DHS notified federal and state officials, and in the case of the second code-orange alert period in our review, before the decision to raise the threat level was even made. DHS officials told us that they send notifications/advisories to the media to inform them of impending press conferences and that the media may speculate about announcements of threat level changes that may be made at the press conferences. DHS officials indicated that the department is trying to determine the best approach for managing expectations created by this situation. Risk communication experts said that without specific information on the nature, location, and timing of threats and guidance on actions to take, citizens may not be able to determine whether they are at risk and make informed decisions about actions to take in response to threats, and thus may take inappropriate actions. According to HSPD-3, the Homeland Security Advisory System was established to inform and facilitate decisions appropriate to different levels of government regarding terrorist threats and measures to take in response to threats. However, federal agencies and states responding to our questionnaires generally indicated that they did not receive guidance and specific information on threats on the three occasions included in our review when the national threat level was raised to code-orange. These entities reported that insufficient information on the nature, location, and timing of threats and insufficient guidance on recommended measures hindered their ability to determine whether they were at risk as well as their ability to determine and implement protective measures. As shown in table 2, federal agencies and states responding to our questionnaires indicated that they generally did not receive specific information on threats with notification of increases in the national threat level for the three code-orange alert periods included in our review. Yet, as table 2 suggests, a greater number of federal agencies and states reported receiving more specific threat information for the third code-orange alert period than for the other two code-orange alert periods. As shown in tables 3 and 4, federal agencies and states responding to our questionnaires indicated that guidance and specific information on threats, if available, would have assisted them in determining their levels of risk and measures to take for the December 21, 2003, to January 9, 2004, code- orange alert period. Results for the other two code-orange alert periods are consistent with those reported in tables 3 and 4 for the third code-orange alert period. Furthermore, 13 localities reported to us that information on site-, area-, or event-specific threats would have been beneficial to them in responding to the code-orange alert periods. Six of the localities from which we obtained information reported that information on region- or sector-specific threats would have assisted them in determining their level of risk and measures to take in response to the three code-orange alerts in our review. When federal agencies and states perceive that they have not received sufficient guidance and threat information, these entities may not be able to determine whether they are at risk from possible threats or what measures to take in response to the threats. For example, 1 federal agency reported that DHS never notified the agency as to whether Washington, D.C., would remain at heightened security levels after the national threat level was lowered to code-yellow on January 9, 2004, which resulted in the agency maintaining code-orange alert measures for an additional week and incurring additional costs for doing so. Another federal agency reported that to respond to the code-orange alerts, it implemented measures at all facilities regardless of the specific location or risk involved, which spread resources across all facilities rather than focusing the measures on mitigating specific threats. Officials from 1 state and 1 locality noted that without specific threat information, these entities did not understand the true nature of the threat and what impact the threat may have on them. Federal agencies and states responding to our questionnaire also indicated that without guidance and specific threat information, they may not be able to effectively and efficiently target or enhance protective measures to respond to the code-orange alerts. Eighteen of the 25 federal agencies and 32 of the 41 states providing responses to the questions on operational challenges in our questionnaires reported that lack of sufficient threat information was a challenge they faced during the three code-orange alert periods. Moreover, in responding to our questionnaires, 16 federal agencies and 12 states noted that insufficient information on threats makes it difficult for these entities to focus resources on specific measures to respond to threats. At a February 2004 hearing, the Deputy Secretary of Homeland Security said that the department’s communications of national threat level changes are intended to provide specific information regarding the intelligence supporting the change in the threat level, and that protective measures are developed and communicated, along with the threat information, prior to a public announcement of the decision. DHS officials told us that they provide specific threat information, when available, to federal agencies, states, and localities at risk and with the authority to respond to threats. For example, the Deputy Secretary said that threat information that was shared by DHS regarding changes in the national threat level was primarily intended for security professionals at all levels of government and the private sector. Moreover, to provide more specific threat information and respond to sector- and location-specific security needs, DHS officials told us they have adjusted the system based on feedback from federal, state, local and private sector officials; tests of the system; and experience with previous periods of code-orange alert. For example, for the most recent code-orange alert from December 21, 2003, to January 9, 2004, the Deputy Secretary noted in his February 2004 testimony that DHS provided specific recommendations for protective measures to industrial sectors and for geographic areas in response to specific threat information. The majority of federal agencies responding to our questionnaire indicated that they maintain high security levels regardless of the national threat level and, as a result, they did not need to implement a substantial number of new or additional protective measures to respond to the three periods of code-orange alert from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004. For the most part, these federal agencies reported enhancing existing protective measures to respond to the three code-orange alerts. To a lesser extent, federal agencies continued the use of existing measures, without enhancement, during the code- orange alert periods. On the other hand, states differed in the extent to which they enhanced or maintained existing measures or implemented additional protective measures solely in response to the code-orange alerts. Federal agencies and states reported benefits, such as a heightened sense of security among employees, from enhancing or implementing protective measures for the code-orange alert periods. However, federal agencies and states also indicated that taking such measures negatively affected their operations, for example, by redirecting resources from normal operations to code-orange alert duties. More than half of the federal agencies responding to our questionnaire indicated that they operate at high security levels, regardless of the national threat level. Thus, they did not need to implement a significant number of new or additional protective measures to respond to code- orange alerts. For example, in response to the third code-orange alert period in our review—December 21, 2003 to January 9, 2004—10 of 24 federal agencies indicated that they most commonly enhanced existing protective measures, such as increasing facility security patrols. During the same code-orange alert period, 8 federal agencies reported most often continuing protective measures at their pre-code-orange alert levels, for example, relying on continuing activation of monitoring systems and intrusion detection devices. For the remaining 6 federal agencies, there were slight differences among the number of protective measures they enhanced during the third code-orange alert period, those they maintained at pre-code orange alert levels, and those they implemented solely in response to the code-orange alert. For one of these agencies, three of the protective measures in place for the third code-orange alert period were maintained at their pre-code-orange alert levels, three of the protective measures were enhanced beyond their pre-code- orange alert levels, and four protective measures were implemented solely for the code-orange alert period. Results for the other two code-orange alert periods in our review are similar to those reported for the third code-orange alert period. For more information on protective measures federal agencies most commonly reported having in place for the three code-orange alert periods and their testing of such measures, see appendix IV. Overall, states differed in the extent to which they implemented additional protective measures for the three code-orange alert periods in our review. Based on our analysis of questionnaire responses from the 40 states that provided information on protective measures for the third code-orange alert period in our review, 16 states most often enhanced protective measures that were already in place prior to the code-orange alert period; 6 states most often implemented new protective measures for the code- 5 states most often maintained protective measures that were already in place at their pre-code-orange alert levels; and 13 states employed a varied response, enhancing measures, continuing existing measures, and/or implementing new measures in roughly equal proportion. Results for the other two code-orange alert periods in our review are similar to those reported for the third code-orange alert period. Various reasons influenced the extent to which states responding to our questionnaire enhanced, maintained, or implemented new protective measures. For example, some states reported that they already operated at heightened security levels and, therefore, did not need to implement additional protective measures in response to the code-orange alerts in our review; rather they enhanced measures already in place. Other states indicated that the extent to which they implemented protective measures for the code-orange alert periods in our review depended on specific threat information. For example, 1 state indicated that it did not enhance existing protective measures or implement new protective measures for the code- orange alert periods in our review because there were no specific threats to the state that required it to do so. Other states indicated that the extent to which they implemented protective measures for code-orange alert periods depended on the required level of security for their critical infrastructure sites. For example, 1 state reported that it implemented new protective measures for its nuclear power plants during code-orange alert periods, but for some other critical infrastructure assets, it enhanced security measures already in place. Some states also indicated that resource constraints determined the extent to which they enhanced or implemented new protective measures for code-orange alert periods. For example, 2 states indicated that they had to implement a substantial number of new protective measures for the three code-orange alert periods in our review because they could not afford to always operate at a high level of security. For more detailed information on protective measures that states most commonly reported having in place for code-orange alert periods and testing of these measures, see appendix IV. Additionally, 4 localities from which we obtained information reported that they did not enhance or implement a substantial number of protective measures to respond to the code-orange alerts because they did not receive specific threat information indicating that the localities were at risk. For example, 1 locality reported that because it did not receive specific threat information on possible targets, the locality did not take any measures to respond to the code-orange alerts. Additionally, another locality noted that its emergency response staff was not able to implement additional measures in response to the code-orange alerts because the staff was too busy with regular duties such as responding to 911 calls. Federal agencies and states responding to our questionnaires indicated that they benefited in various ways from the protective measures they enhanced or implemented during the code-orange alert periods, but also noted that they faced operational challenges in responding to the three code-orange alert periods in our review. For example, federal agencies and states reported that protective measures increased employees’ sense of security, promoted staff awareness, and provided visible deterrents to possible threats. However, federal agencies and states responding to our questionnaires also reported that their operations were negatively affected during code-orange alerts as a result of protective measures they enhanced or implemented. For example, 10 federal agencies and 13 states reported that they had to redirect resources from normal operations to enhance or implement protective measures for code-orange alerts. One locality also reported that its operations were negatively affected by the redirection of personnel, which resulted in delays of maintenance activities and preventative exercises as well as postponement of training. Additionally, 15 federal agencies noted delays for visitors and employees. Some of these federal agencies and states reported that maintaining a code-orange alert level of security for more than a few days at a time significantly drained their security resources—an effect federal agencies and states have identified as “code-orange alert fatigue.” Federal agencies and states also indicated that the lack of federal governmentwide coordination hindered their ability to respond to threats. Without coordination of information and intelligence sharing during code- orange alert periods, federal agencies and states responding to our questionnaires noted that they may not receive threat information needed to help them determine and implement their responses to code-orange alerts. For example, 1 federal agency reported that it received different requests from several federal agencies to deploy personnel to different locations. This federal agency noted that improved federal governmentwide coordination might result in more efficient assignment of resources. Similarly, 1 locality noted that because different government agencies notified different local agencies of changes in the national threat level, first responders and local officials could not effectively and efficiently coordinate and implement protective resources. On the other hand, 1 state official raised concerns about whether federal agencies were fully informed of the information DHS provided to states and had the information needed to implement appropriate local security measures. This official noted that persons from the Transportation Security Administration, the Coast Guard, and the U.S. Army Corps of Engineers called his state’s homeland security office for advisories and bulletins DHS had provided to the state. Because of these information requests, this official noted that the state was concerned that officials from these federal agencies did not receive information needed to implement security measures, especially at airports. In commenting on a draft of this report, DHS officials stated that the department is working to address this problem. Six states also indicated that insufficient information from DHS on national critical infrastructure assets made it difficult to effectively protect these assets during the code-orange alert periods. Three of these states indicated that DHS asked them to protect specific national critical infrastructure sites, some of which were no longer operational or others that were closed, such as shopping malls. Officials in one state indicated that DHS did not coordinate with the state when it initially developed this list of national critical infrastructure assets. DHS officials told us that the department developed a list of national critical infrastructure assets to assist states in determining protective measures to implement at their national critical infrastructure sites. According to the Deputy Director of the Protective Security Division of IAIP, DHS initially developed a list of 145 national critical infrastructure assets, including nuclear power plants, chemical facilities, and transportation systems, to ensure their security during Operation Liberty Shield. This official told us that DHS identified national critical infrastructure assets for the list based on intelligence information indicating possible assets at risk, the vulnerabilities of these assets, and possible consequences of an attack on assets, including health, safety, and economic impacts. DHS did not coordinate with states and localities in developing the national critical infrastructure assets list for Operation Liberty Shield because planning and timing of military operations for the war in Iraq and for Operation Liberty Shield were given the highest classification levels and discussed only at the federal level. The Deputy Director said that since Operation Liberty Shield, DHS has continually expanded and revised its national critical infrastructure assets list based on ongoing analysis of threat information and input from states. In reviewing a draft of this report, DHS officials told us that its Protective Security Division has given all states and territories opportunities to suggest assets to be included in the National Asset Database as well as to verify and validate information DHS maintains on such assets. To enhance standard security levels at national critical infrastructure sites, this DHS official said that the department is working with states to develop plans for protecting the immediate areas surrounding national critical infrastructure assets and reducing vulnerabilities in those areas. In particular, the Deputy Director told us that DHS provided guidance and information to states and local law enforcement agencies to develop protection plans for areas around national critical infrastructure assets. The majority of states responding to our questionnaire indicated that, for all three code-orange alert periods in our review, DHS requested some information on protective measures taken by states in response to the heightened threat levels. However, as shown in table 5, most states reported that DHS did not request information on the effectiveness of these security measures. An Office of State and Local Government Coordination official said that DHS maintains close contact with states and localities during code-orange alert periods and fosters information sharing about actions taken to increase security. For example, this official noted that DHS co-sponsored a February 2003 workshop with the FBI to encourage state-level implementation of the Homeland Security Advisory System and provide a forum for information exchange among state and local homeland security representatives. More recently, on April 19, 2004, DHS launched a new Web site (www.llis.gov) to provide a nationwide network of lessons learned and best practices for homeland security officials and emergency responders. For the most recent code-orange alert from December 21, 2003 to January 9, 2004, DHS officials noted that they contacted states to inquire about protective measures that were put in place. According to DHS officials, they made such inquiries to (1) monitor the extent to which states implemented protective measures that DHS recommended, (2) apprise the White House of actions taken in response to code-orange alerts, and (3) enhance DHS officials’ understanding of protective measures for which states may seek reimbursement. Sixteen of 26 federal agencies responding to our questionnaire reported additional costs for at least one of the code-orange alert periods in our review. We examined the cost information provided by these agencies for obvious errors and inconsistencies and examined agencies’ responses to the questionnaire regarding the development of the cost information. In doing so, we found that these federal agencies’ cost data were generated from various sources, such as financial accounting systems, credit card logs, and security contracts. Additionally, this cost information is not precise, nor do the costs likely represent all additional costs incurred during code-orange alert periods. In some cases, we have concerns about the reliability of the data sources used to develop the costs reported to us. For example, 6 of the 16 federal agencies reported that they extracted some of the code-orange alert cost data from their agencies’ financial accounting systems. However, as reported in the fiscal year 2005 President’s Budget, 5 of these agencies’ financial management performance had serious flaws as of December 31, 2003. Despite these limitations, we believe the cost data to be sufficiently reliable as indicators of general ranges of cost and overall trends. However, the data should not be used to determine the cumulative costs incurred across all federal agencies. Based on the information provided by federal agencies, total additional costs reported by federal agencies responding to our questionnaire for the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert periods were less than 1 percent of these agencies’ fiscal year 2003 homeland security funding, as reported to OMB. On the basis of this cost information, we determined additional average daily costs ranged from about $190 to about $3.7 million across all three code-orange alert periods in our review. Based on information reported by these agencies, the additional average daily costs incurred across code-orange alert periods have declined over time. Some of these federal agencies attribute this decline to continued enhancement of standard levels of security. Some federal agencies reported that they did not have any additional costs during code-orange alert periods, as they either did not implement any additional protective measures or they redirected already existing resources to implement additional code-orange alert measures rather than employ additional resources. Although federal agencies may not have reported additional costs directly as a result of implementing protective measures for code- orange alerts, actions taken such as redirecting resources from normal operations would have resulted in indirect costs. Sixteen of 26 federal agencies responding to our questionnaire reported additional costs for the first code-orange alert period in our review—March 17 to April 16, 2003. Fifteen of these agencies also reported additional costs for the second code-orange alert period in our review—May 20 to 30, 2003. For 13 of the 15 federal agencies that reported additional costs for both the first and second code-orange alert periods in our review, we calculated that the additional costs reported by these agencies were less than 1 percent of these agencies’ fiscal year 2003 homeland security funding. This calculation is based on OMB’s 2003 Report to Congress on Combating Terrorism, which presented information federal agencies reported to OMB on the amount of homeland security funding authorized to federal agencies in fiscal year 2003. For the 16 federal agencies responding to our questionnaire that reported additional costs during the first code-orange alert period in our review, we calculated average daily additional costs, which ranged from about $190 to about $848,000. A cabinet level agency with security responsibilities limited to protecting its facilities and employees reported the least additional costs for this code-orange alert period, while another cabinet level agency that, in addition to securing its facilities, is responsible for the protection of national critical infrastructure assets reported the most additional costs. For the 15 federal agencies that reported additional costs for the second and third—December 21, 2003, to January 9, 2004—code- orange alert periods in our review, we calculated additional average daily costs that ranged from about $240 to about $3.7 million and from about $190 to about $1 million, respectively. The agency that reported the least additional costs for the second and third code-orange alert periods in our review was an independent agency, while the agencies that reported the most additional costs for these code-orange alert periods were generally cabinet agencies that are responsible for the protection of national critical infrastructure assets. Most of the additional costs federal agencies reported were personnel costs, such as overtime wages or costs for additional security personnel. Appendix V provides additional information regarding cost information submitted by federal agencies. Based on the cost information provided by federal agencies, we determined that there was a decline in the additional average daily costs incurred by these federal agencies over the three code-orange alert periods in our review. Of the 15 federal agencies that reported additional costs for the first and third code-orange alert periods, 11 federal agencies experienced an overall decline in the additional average daily costs across the code-orange alert periods. Five of these 11 federal agencies indicated that their additional costs declined across the three code-orange alert periods in our review because they were consistently enhancing their baseline levels of security, which, in turn, required fewer additional protective measures during subsequent code-orange alert periods. Three agencies indicated that the decline in additional average daily costs was due to a reduction in the number of protective measures they had in place. One of these agencies explained that rather than implementing general protective measures with the receipt of specific threat information for the third code-orange alert in our review, it was able to determine the most appropriate protective measures to put in place. Six federal agencies reported that they did not have additional costs for at least two of the code-orange alert periods in our review. Four of these agencies indicated that they did not have additional costs because they redirected already existing resources to implement additional protective measures for the code-orange alert periods rather than employ additional resources. For example, 2 agencies said that they were able to increase the frequency of their facility patrols without hiring additional guards or requiring guards to work overtime by closing one of the facility’s entrances during code-orange alert. Therefore, the guards who would normally secure that entrance were assigned to conduct additional roaming facility patrols. Furthermore, 2 of the 4 agencies indicated that they planned their protective measures with the specific intent that the agency would not incur any additional security-related costs during code-orange alert periods. The remaining 2 agencies reported that they did not have any additional costs because they did not implement additional protective measures for the code-orange alert periods. One agency explained that it did not implement any protective measures during code-yellow or code- orange alert periods because it is located in a privately owned building and is not responsible for the security of its facility, nor does this agency have field offices for which it is responsible. Although these federal agencies reported that they did not directly incur additional costs to implement protective measures for code-orange alert periods, the consequences of implementing such protective measures may have resulted in indirect costs for these agencies. Some federal agencies responding to our questionnaire indicated they could not quantify these indirect costs. However, federal agencies provided examples of redirection of resources that may have caused them to incur such costs. For example, 13 federal agencies noted that in order to implement code-orange alert measures, they had to redirect existing resources from normal operations. Furthermore, one agency indicated that redirecting resources in response to code-orange alerts prevented the agency from performing mission- related activities, such as deterrence of criminal activity other than terrorism. Additionally, 16 federal agencies said that as a result of implementing measures for code-orange alerts, there were delays for employees and visitors entering facilities, which may have resulted in loss of productivity among employees and a delay in provision of services. Seven federal agencies indicated that as part of their response to code- orange alerts, they postponed or cancelled agency-sponsored activities such as training for staff development. DHS has collected limited information on costs incurred by states and localities during code-orange alert periods through its State Homeland Security Grant Program – Part II and the Urban Areas Security Initiative – Part II. States must submit information to DHS to be reimbursed for costs incurred as a result of actions taken to increase critical infrastructure protection during code-orange alerts. However, this cost information does not represent all costs incurred by states and their localities during code- orange alert periods. Therefore, it cannot be used to assess the financial impact of code-orange alerts on states and localities. The U.S. Conference of Mayors also collected information and reported estimates of costs localities incurred in response to code-orange alerts. Moreover, a Director with the Center for Strategic and International Studies estimated and reported costs incurred by federal agencies during code-orange alerts. However, because of limitations in the scope and methodologies used in these estimates, the cost information they reported may not be adequate for making generalizations regarding additional costs states and localities incurred in response to code-orange alerts. DHS issued an information bulletin to states on March 21, 2003, advising them to capture additional costs incurred by the state and its localities during the March 17 to April 16, 2003, code-orange alert period for the protection of critical infrastructure, in the event that funds became available to reimburse states and localities for these additional costs. Through the fiscal year 2003 State Homeland Security Grant Program – Part II (SHSGP II), DHS made a total of $200 million available to states and local communities to mitigate costs of critical infrastructure protection during the period of hostilities with Iraq and future periods of heightened threat. According to SHSGP II guidelines, SHSGP II funds can be used for public safety agency overtime costs, contract security personnel costs, and state-ordered National Guard deployments required to augment security at critical infrastructure. Additionally, at least 50 percent of a state’s award must be allocated to local communities. Through the fiscal year 2003 Urban Areas Security Initiative – Part II (UASI II), DHS made approximately $125 million available to reimburse select urban areas for costs incurred during the February 7 to February 27, 2003; March 17, 2003, to April 16, 2003; and May 20 to 30, 2003, code-orange alert periods. Specifically, UASI guidelines allowed for the reimbursement of costs associated with overtime and critical infrastructure protection. On January 23, 2004, DHS issued a memorandum to state officials indicating that SHSGP II and UASI II funding could also be used to reimburse states and localities for additional costs incurred for protection of critical infrastructure for the December 21, 2003, to January 9, 2004, code-orange alert period. For the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert periods, DHS required states to submit budget detail worksheets, including the name of the state agency or local jurisdiction that incurred the additional critical infrastructure protection costs and the amount the agency or locality requested for reimbursement. For the December 21, 2003, to January 9, 2004, code-orange alert period, DHS provided a more detailed template for the budget detail worksheet, which asked states to identify the critical infrastructure site protected and the amount of costs incurred and personnel deployed for each of the following categories: contract security personnel, and emergency operations center overtime. Additionally, for all three code-orange alert periods in our review, DHS asked states to distinguish between state-level and local-level costs. Through SHSGP II and UASI II, states were awarded a specified amount from which they could draw down over a period of 2 years to reimburse them for additional costs incurred during code-orange alert periods. According to the grant guidelines, DHS must approve the budget detail worksheet before states and localities can obligate, expend, or draw down these grant funds. DHS, in monitoring these grant programs, takes steps to validate critical infrastructure protection costs. Additionally, amounts that states and localities expend in excess of $300,000 are subject to an external audit which, when completed, provides assurance regarding the reliability of the cost data. Based on the following, it is unlikely that the cost information submitted by states to DHS represents all additional costs incurred by states and localities during code-orange alert periods: States have up to 2 years from the time when the grant is awarded to submit requests for reimbursement of additional code-orange alert costs. Some states are still in the process of validating proposed costs incurred by the state and its localities. For example, one state estimated that its state agencies and localities incurred an additional $3.7 million for the March 17 to April 16, 2003, code-orange alert period. However, the state could only validate additional code-orange alert costs of about $1.3 million, and thus could only report this amount as eligible for DHS reimbursement. The cost information submitted by states does not include additional costs for training or the purchase of equipment and materials during code-orange alert periods. Additionally, DHS officials told us that not all states and localities that incurred additional costs have requested reimbursement; therefore, not all states and localities have submitted information to DHS on additional code- orange alert costs. Since the cost information does not include all costs incurred by states and localities for code-orange alerts, it should not be used to reach conclusions about the financial impact of these alerts on states and localities. According to the cost information collected by DHS, as of April 14, 2004, 40 states provided cost information to DHS in order to draw down funds to reimburse additional costs incurred during the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert periods. Based on this cost information, the reported state share of additional code-orange alert costs ranged from about $7,900 to about $8 million for both the first and second code-orange alert periods, which lasted a total of 40 days. The locality share of additional costs incurred during these two code-orange alert periods ranged from about $2,800 to about $28 million. As of April 14, 2004, 33 states provided information on additional costs incurred during the December 21, 2003, to January 9, 2004, code-orange alert period to DHS. Based on this information, additional costs incurred by state agencies for this code-orange alert period, which lasted 19 days, ranged from about $2,000 to about $7 million. Additional costs incurred by localities during this code-orange alert period ranged from about $3,000 to about $4 million. In general, the states that have numerous critical infrastructure sites, as identified by DHS, were the ones that reported the most additional code-orange alert costs collectively for the state and its localities. Additionally, DHS officials noted that overtime costs for law enforcement or security personnel appear to be the primary expense incurred by states and localities. You also requested that we determine the extent to which DHS analyzes available cost data related to code-orange alerts and the role that OMB plays in providing guidance to DHS on capturing such costs. Though not required to do so, DHS has not analyzed the cost data collected to identify trends or assess the financial impact code-orange alerts have on states and localities. DHS has not tallied individual or overall state and local costs for any of the increased threat alert periods. However, as cost information submitted by states for reimbursement through SHSGP II and UASI II does not include all costs incurred by states and localities during code-orange alert periods, such analysis may not be appropriate using these data. According to an OMB representative, OMB has not provided specific guidance to DHS in capturing and totaling additional costs that states and localities incurred during periods of heightened national threat levels, nor is it required to do so. However, the representative noted that OMB is concerned about the funds that the federal government expends on these programs and activities. Prior to this report, the U.S. Conference of Mayors and a Director with the Center for Strategic and International Studies have been the only organization or official to attempt to report estimates of costs incurred by various governmental entities in response to code-orange alerts. However, despite their efforts, the information reported by the U.S. Conference of Mayors and a Director at the Center for Strategic and International Studies Homeland Security Initiatives, may not be adequate to draw conclusions regarding the extent to which responding to code-orange alerts imposes a financial burden on governmental entities. On March 27, 2003, the Conference of Mayors published a report that estimated localities within the United States were spending $69.5 million per week in response to the March 17 to April 16, 2003, code-orange alert period. However, the U.S. Conference of Mayors’ estimate may not provide an adequate basis for drawing conclusions regarding the financial impact of code-orange alerts on localities due to several factors such as: lack of guidance to localities for developing their estimates, the absence of independent verification or confirmation of amounts reported to the Conference of Mayors. For example, the Conference of Mayors surveyed its membership asking them to report, “What are you spending extra per week?” However, according to a Conference of Mayors’ official, members were not provided guidance on how to develop their costs. Thus, localities could have used different methodologies potentially resulting in the inclusion of certain costs in one locality’s estimate that may not be included in another locality’s estimate. Additionally, only 145 cities out of the U.S. Conference of Mayors total membership of 1,185 responded to the survey, representing a 12 percent response rate. The scope for this study was also somewhat limited in that the U.S. Conference of Mayors issued its report and estimates prior to the conclusion of the March 17 to April 16, 2003, code- orange alert period. Thus, the estimate may not represent all costs incurred during that time period. Finally, the U.S. Conference of Mayors’ staff did not take any additional steps to verify the validity of the estimates provided in response to its survey nor did they request that localities provide information to assist them in corroborating the localities’ responses. Similarly, a December 21, 2003, news release from the Center for Strategic and International Studies cited remarks by one of its directors who independently estimated that it costs the nation $1 billion a week to implement protective measures in response to a code-orange alert. According to the official that generated this estimate, it was an informal calculation based primarily on the funds appropriated by Congress to federal agencies for Operation Liberty Shield. The director divided the total amount of federal appropriations related to Operation Liberty Shield by the number of weeks that Operation Liberty Shield lasted. However, appropriated funds are not accurate representations of expenditures or costs incurred by federal agencies. Additionally, Operational Liberty Shield was a comprehensive national plan to increase protection for America’s citizens and the nation’s infrastructure during the war with Iraq. Thus, federal agencies may have taken additional protective measures in relation to the war that are not normally associated with code-orange alerts. As a result, this estimate may not be an accurate reflection of costs incurred by federal agencies in relation to other code-orange alerts. DHS’s implementation of the Homeland Security Advisory System is evolving, and the responses to our questionnaires from federal agencies and states suggest that DHS has made progress in providing more specific information to federal agencies and states and localities regarding the specific threats and risks they may face. However, DHS has not yet officially documented its protocols for communicating changes in the national threat level, as well as guidance and threat information, to federal agencies and states. The responses we received to our questionnaires indicated continuing confusion on the part of federal agencies and states and localities regarding the process and methods that DHS uses to communicate changes in the national threat level or recommendations for heightened security measures in specific regions or sectors. Without clearly defined and consistently applied communication policies and procedures, DHS may have difficulty managing the communication expectations of federal agencies and states and effectively communicating the methods, timing, and content of guidance and information—including information on protective measures and potential threats—the department provides to federal agencies and states. We believe that risk communication principles are applicable to the Homeland Security Advisory System and should be applied in DHS communications with federal agencies, states, and localities. Risk communication experts suggest that warnings should include the following principles to provide for early, open, and comprehensive information dissemination and for informed decision making: (1) communication through multiple methods, (2) timely notification, and (3) specific information about the nature, location, and timing of the threat and guidance on actions to take. To the extent that DHS does not communicate specific threat information and guidance on actions to take, federal agencies, states, and localities may not be able to effectively determine their levels of risk, the appropriate protective measures to implement in response to threats, and how to effectively and efficiently focus their limited resources on implementing those appropriate protective measures. Finally, it is important to note that although periods of code-orange alert do result in some additional costs for many federal agencies, states, and localities, the available cost data have many limitations, are not precise or complete, and thus, any conclusions based on these data must reflect those limitations. We recommend that the Secretary of Homeland Security direct the Under Secretary for Information Analysis and Infrastructure Protection to take the following two actions: (1) document communication protocols for notifying federal agencies and states of changes in the national threat level and for providing guidance and threat information to these entities, including methods and time periods for sharing information, to better manage these entities’ expectations regarding the methods, timing, and content of information shared; and (2) incorporate risk communication principles into the Homeland Security Advisory System to assist in determining and documenting information to provide to federal agencies and states, including, to the extent possible, information on the nature, location, and time periods of threats and guidance on protective measures to take in response to those threats. We provided a draft copy of this report to DHS for comment. DHS generally concurred with the findings and recommendations in the report and provided formal written comments, which are presented in appendix IX. In commenting on the draft report, DHS expressed concern that we generalize examples cited in the report across all states and localities, rather than characterizing the examples as isolated experiences. As previously discussed, we surveyed 56 states and territories to obtain information on their experiences related to national threat level changes. We discuss the results of this questionnaire throughout the report, including information on the number of states that provided similar responses. After citing the number of states that provide a similar response related to a code-orange alert issue, we frequently use examples to illustrate those perspectives. We did not cite all examples we received, but rather those that most effectively illustrate our message. Thus, we believe the report accurately portrays state perspectives on code-orange alerts. In regard to DHS’s comments on the examples we discuss related to localities, we believe that we appropriately cautioned the reader in the report’s introduction and scope and methodology sections that information from the 16 localities we visited or from which we received questionnaire responses were used only as anecdotal examples and cannot be generalized across all localities in the United States. DHS also provided technical comments, which we have incorporated as appropriate. We plan no further distribution of this report until 14 days after the date of this report. At that time, we will send copies of this report to the Subcommittee on Terrorism, Technology, and Homeland Security, Senate Committee on the Judiciary; the Subcommittee on National Security, Emerging Threats, and International Relations, House Committee on Government Reform; the Secretary of Homeland Security; the Director, Office of Management and Budget; and other interested parties. Copies will be made available to others on request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-8777 or by e-mail at jenkinswo@gao.gov. Other GAO contacts and key contributors are listed in appendix X. William O. Jenkins, Jr. Some federal agencies, states, localities, and foreign countries had threat advisory systems in place prior to the implementation of the Homeland Security Advisory System in March 2002, while others have since developed such systems. Some of these advisory systems were generally similar to the Homeland Security Advisory System, identifying different threat levels and requiring or suggesting certain protective actions be taken at each threat level. However, other systems differed in terms of structural and operational characteristics—such as the number of threat levels, the issuance of local or regional alerts, and the dissemination of threat advisories to the public. Seven of the 25 federal agencies responding to our questionnaire reported that they operated their own threat advisory systems prior to the establishment of the Homeland Security Advisory System in March 2002. One agency, for example, indicated that it developed its own five-level alert system 8 years ago to ensure protection of critical national security assets. These seven agencies currently follow the Homeland Security Advisory System as well as their own agency advisory system that conforms to the Homeland Security Advisory System. Three of these agencies also reported they could independently raise agency threat levels in response to threats or events that specifically affect their operations, regardless of whether the national threat level is raised at the same time. However, they generally cannot lower a facility threat level below that specified by the agency head or other designated agency authority. Further, although these agencies can operate at a threat level that is higher than the Homeland Security Advisory System national threat level (e.g., at code-orange when the national threat level is code-yellow), they generally cannot operate at a lower threat level. Unlike federal civilian agencies, Department of Defense (DOD) military installations are exempt from following the Homeland Security Advisory System. Accordingly, DOD operates under its own terrorist threat advisory system—known as the Force Protection Condition system. According to DOD officials, this system has five threat conditions—normal, alpha, bravo, charlie, delta—indicating increasing threats of a terrorist attack, and the system prescribes mandatory minimum protective measures for all units and installations for each condition level. Each of the nine DOD Unified Combatant Commands—for example, Central Command (Middle East and Asia)—establishes a force protection condition for the entire Command, based on a variety of information including threat and vulnerability assessments from such sources as the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the Defense Intelligence Agency. Beyond this level of protection, installation and unit commanders may then require additional protective measures, also based on intelligence assessments. This system, therefore, provides flexibility to base commanders to set protective measures based on local threat conditions. In contrast to civilian federal agencies, changes in the Homeland Security Advisory System do not necessarily result in changes in DOD’s force protection condition. When the national threat level is raised to code-orange, DOD reviews and analyzes the same intelligence used by DHS to decide to raise the national threat level. Based on this analysis, DOD military commanders then decide whether any change is warranted in their own force protection condition. As discussed earlier in the report, the Homeland Security Advisory System is not binding on states or localities and they are not required to conform their advisory systems to the Homeland Security Advisory System. However, 42 of the 43 states responding to our questionnaire indicated they currently followed the Homeland Security Advisory System, an equivalent state system, or both. Eight of the states responding to our questionnaire and 1 locality we visited indicated that they had implemented their threat advisory systems prior to the Homeland Security Advisory System. For example, 1 state told us that it amended its state emergency response plan and implemented a state advisory system in 1998, in response to the bombing of the federal building in Oklahoma City. Twenty-two states responding to our questionnaire and 5 localities we visited indicated that they currently operate their own advisory systems. Most of these states reported that their systems provided information about the type or location of the threat, notified other governmental entities, and identified protective measures to be taken—while most localities indicated their systems conformed to the Homeland Security Advisory System. Some state and local advisory systems are similar to the Homeland Security Advisory System, but contain a different number of threat levels than the Homeland Security Advisory System. For example: One state uses a numbered, 4-level threat advisory system, which is similar to the Homeland Security Advisory System but combines the levels of Blue and Yellow into a single threat level. One locality uses a 4-level advisory system, which does not include the Homeland Security Advisory System Blue threat level. State and local advisory systems typically identified actions or protective measures that were to be taken at each threat level. For example, one state advisory system identified state, county, and local government actions, as well as specific security recommendations; while another identified actions for law enforcement agencies, non-law enforcement agencies, businesses, and citizens. One locality advisory system identified general security recommendations, as well as specific agency action checklists identifying a minimum level of response by agencies and departments within the locality. Some states and localities can raise their systems’ threat levels based on specific threats or events independent of changes in the national threat level. One state, for example, raised its state threat level in early February 2003 (prior to the February 2003 code-orange alert) in response to the crash of the space shuttle Columbia. One locality could change its threat level locally based on information and coordination with the local FBI office, the state’s department of public safety, and the locality’s police department. The United Kingdom has a developed threat advisory system and processes for communicating threat information that are similar to the Homeland Security Advisory System but, unlike the U.S. system, it does not require that terrorism threat alerts be issued to the public. According to United Kingdom officials, under the United Kingdom’s threat advisory system, (1) threat levels are assigned nationwide, as well as to specific regions and economic sectors; and (2) these levels and related changes are communicated to government and law enforcement agencies and private sector entities with responsibility for critical infrastructure protection, but not to the public. The United Kingdom does not publicly announce these threat warnings because it wants to protect its intelligence sources and avoid alerting terrorists that the government is aware of the threat. If terrorists know that the government is aware of their planned attack, the terrorists may change their plans and modes of operation, allowing them to carry out attacks that are even more lethal. Additionally, the United Kingdom is concerned about causing public anxiety regarding possible threats, when, in most cases, the public cannot do anything to mitigate the threat. However, United Kingdom officials noted that if warnings are necessary to protect public safety from specific and credible threats, the United Kingdom will issue public warnings. Additionally, the United Kingdom instituted a public campaign to encourage public vigilance regarding potential terrorist activity. The campaign included posters warning the public to alert the police to unattended baggage, as shown in figure 1. Unlike the United Kingdom system, the Australian threat advisory system places a greater emphasis on publicizing changes in national threat levels. Australia implemented its current four-level, national counter-terrorist threat alert system in June 2003. As in the United States, a threat level condition is publicly announced and defined. Under the Australian system, each level of alert is defined as follows: Low—no information to suggest a terrorist attack in Australia. Medium—medium risk of a terrorist attack in Australia. High—high risk of a terrorist attack in Australia. Extreme—terrorist attack is imminent or has occurred. According to the Australian Attorney-General’s Department, the system was not introduced as a reaction to any particular threat, but rather as an arrangement to help inform national preparation and planning and provide greater flexibility for responding to threats. Accordingly, should any intelligence information come to light which causes the government to change the assessed level of threat, the public is to be advised immediately. Conversely, Norway does not have a nationwide threat advisory system. According to Norwegian officials, the Norwegian Police Security Service conducts threat assessments—which are graded into levels of low, medium, and high—and these are issued to government agencies with responsibilities for preventing and responding to threats within their jurisdictions. Unlike the Homeland Security Advisory System, there are no routines in place for communicating these threat assessments directly to local governments, private sector entities or the general public, but a decision to do so can be made depending on the situation. National government agencies and county governors can be instructed to take action to address various types of emergencies. However, municipalities, private sector entities, and the general public cannot be instructed to take specific action, except in situations where such instructions are warranted by law. Like Norway, Germany does not have a uniform nationwide system of threat levels or requirements that specific actions be taken by governmental entities in response to different types of emergencies, including terror attacks. However, Germany does have a single, central 24- hour communication center. For natural disasters and other threats, this center collects, screens, and processes the incoming information for subsequent forwarding to other government agencies regarding actions to take. According to German officials, the central communication center is concerned primarily with information management, rather than with controlling and warning functions. After receiving the threat assessments from the central communication center, governmental entities at the German federal and state level are each responsible for deciding which measures are to be taken, based on the threat. According to German officials, threat information is communicated to affected persons, individual institutions, the business community, and the general public by law enforcement agencies, the state governments or the German federal government, according to the nature of the threat or danger concerned and the underlying situation. For example, the federal Criminal Police Office informs the business community on a regular basis as to the current assessment of the situation regarding Islamic terrorism. Additionally, Germany has a satellite-based warning system that enables official warnings to be broadcast to the public. Government agencies and emergency situation centers are linked via satellite and are able to relay warnings and information on prevailing dangers to the connected media in a matter of seconds. To determine the process that the Department of Homeland Security (DHS) used to make decisions about changes in the national threat level, we met with and obtained information from DHS officials. We examined this information to identify DHS’s processes for determining whether to raise or lower the national threat level and for issuing threat products to federal agencies, states, localities, and private sector entities. We also analyzed DHS threat products to determine the type of threat information and guidance on protective measures that DHS included in the products. To determine guidance and information provided to federal agencies, states, and localities; protective measures these entities implemented in response to the three code-orange alerts from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004; and additional costs these entities reported for the code-orange alert periods, we sent questionnaires to (1) 28 federal agencies; and (2) the homeland security or emergency management offices in the 50 states, the District of Columbia, American Samoa, Guam, the Northern Islands, Puerto Rico, and the U.S. Virgin Islands. We selected the 28 federal agencies because they reported receiving homeland security funding for fiscal year 2003 to the Office of Management and Budget (OMB) and are Chief Financial Officers Act agencies. We sent the questionnaire to the 25 federal agencies that reported homeland security funding for fiscal year 2003 to OMB and to 3 other federal agencies that are Chief Financial Officers Act agencies but did not report homeland security funding for fiscal year 2003. To develop the questionnaires, we met with and obtained information from 8 federal agencies, 4 states, the District of Columbia, and 9 localities. Overall, the questionnaires sent to federal agencies and states were very similar. We obtained comments on draft versions of the federal questionnaire from the 8 federal agencies. We adapted the final version of the federal questionnaire to create the state questionnaire. We pretested the questionnaires with 4 federal agencies and 3 states and made relevant changes to the questions based on these pretests. See appendixes VII and VIII for the federal and state questionnaires. As of April 20, 2004, we received questionnaire responses from 26 federal agencies, which account for about 99 percent of total fiscal year 2003 nondefense homeland security funding as reported to OMB, and 43 states, for a 77 percent response rate. We made extensive efforts to encourage federal agencies and states to complete and return the questionnaires, such as contacting all nonrespondents on multiple occasions and sending additional copies of questionnaires when requested. We performed this work from October 2003 through May 2004. Because our surveys were not statistical sample surveys, but rather a survey of a nonprobability selection of federal agencies and a census of all states, there are no sampling errors. However, the practical difficulties of conducting any survey may introduce errors, commonly referred to as nonsampling errors. For example, measurement errors are introduced if difficulties exist in how a particular question is interpreted or in the sources of information available to respondents in answering a question. In addition, coding errors may occur if mistakes are entered into a database. We took extensive steps in the development of the questionnaires, the collection of data, and the editing and analysis of data to minimize total survey error. As noted above, to reduce measurement error and ensure questions and response categories were interpreted in a consistent manner, we pretested the questionnaires with several federal agencies and states. We edited all completed surveys for consistency, such as ensuring that responses were provided for all appropriate questions, and, if necessary, contacted respondents to clarify responses. All questionnaire responses were double key-entered into our database (i.e., the entries were 100 percent verified), and random samples of the questionnaires were further verified for completeness and accuracy of data entry. Furthermore, all computer syntax was peer reviewed and verified by separate staff to ensure that the syntax was written and executed correctly. In addition to sending questionnaires to 28 federal agencies and 56 states, we conducted site visits at 12 localities (eight cities and four counties) and sent a questionnaire to another 8 localities. The 12 localities were Atlanta and Fulton County, Georgia; Denver, Colorado Springs, and Douglas County, Colorado; Norfolk, Virginia; Portland and Wasco County, Oregon; Chicago and Cook County, Illinois; and Boston and Fitchburg, Massachusetts. We selected these localities based on the following criteria: the locality’s receipt of urban area grants from DHS, geographic location, topography (e.g., inland, border, or seaport), and type of locality (e.g., metropolitan or nonmetropolitan area). We selected four cities and one county that received grants from DHS and four cities and three counties that did not. We also selected cities and counties from different geographic regions and with different topographic characteristics, as well as some cities and counties located in metropolitan areas and some cities and counties located in nonmetropolitan areas. We used a structured data collection instrument to interview emergency management officials and first responders in these localities. We selected the 8 localities that we surveyed based on their populations and geographic locations. We received responses from 4 of these localities; 3 with populations of less than 40,000 – Helena, Montana; Mankato, Minnesota; and Rock Springs, Wyoming – and 1 with a population of greater than 40,000 – San Jose, California. To determine the extent to which risk communication principles could be incorporated into the Homeland Security Advisory System, we spoke with and obtained information from individuals and organizations with expertise in homeland security issues and risk communication. We analyzed reports and documents from the ANSER Institute for Homeland Security, Carnegie Mellon University, the Center for Strategic and International Studies, the Department of Health and Human Services, the Harvard Center for Risk Analysis, the Oak Ridge National Laboratory, and the Partnership for Public Warning. To assess the reliability of cost data provided by federal agencies on our questionnaire, we examined the cost information for obvious errors and inconsistencies and examined responses to the questionnaire items requesting information regarding the development of the cost data. If necessary, we contacted respondents to clarify responses and, when provided, reviewed documentation about the cost data. Federal agencies generated their cost data from various sources such as their financial accounting systems, credit card logs, and security services contracts. This cost information is not precise, nor do the costs likely represent all additional costs for the code-orange alert periods. In some cases, we have concerns about the reliability of the cost data source within particular agencies. For example, 6 of the 16 federal agencies reported that they extracted some of the code-orange alert cost data from their agencies’ financial accounting systems. As reported in the fiscal year 2005 President’s Budget, 5 of these agencies’ financial management performance had serious flaws as of December 31, 2003. Despite these limitations, we believe the cost data to be sufficiently reliable as indicators of general ranges of cost and overall trends. However, the data should not be used to determine the cumulative costs for all federal agencies for code-orange alert periods. See appendix V for additional information on cost information reported by federal agencies. To determine the extent to which DHS has collected information on costs reported by states and localities during periods of code-orange alert, we met with and obtained information from DHS officials on costs that states and their localities submitted to DHS for reimbursement for increased critical infrastructure asset protection during the three code-orange alert periods. We examined this information to identify the methods used by DHS to collect cost information from states and localities. We also met with and obtained information from representatives of OMB regarding the extent to which the office provided guidance to DHS for collecting cost information from states and localities. We reported these cost data that DHS collected from states and localities for the three code-orange alert periods only to illustrate the range of costs that states reported to DHS for reimbursement. Cost information submitted by states to DHS does not include all costs for states and localities during the code-orange alert periods. In particular, not all states submitted costs to DHS for reimbursement, and not all state agencies and localities in states that submitted cost information to DHS may have reported costs to their states for submission to DHS. In addition, the cost information submitted by states does not include additional costs for training or equipment and material purchases during code-orange alert periods because these costs are not reimbursable through the critical infrastructure protection grant programs. Moreover, some states have not finished validating costs they plan to submit for reimbursement. Despite these limitations, we believe the cost data to be sufficiently reliable as indicators of general ranges of costs that states submitted for reimbursement to DHS and overall trends. However, because this cost information from states and localities is not complete, it should not be used to reach conclusions about the financial impact of code-orange alerts on states and localities. To determine the methodologies used by other organizations to develop estimates of costs reported by federal agencies, states, and localities during code-orange alert periods, we spoke with and obtained information from officials at the U.S. Conference of Mayors and the Director of the Center for Strategic and International Studies Homeland Security Initiatives regarding how this organization and this individual developed their estimates. We evaluated methodologies used by the U.S. Conference of Mayors and the Director of the Center for Strategic and International Studies Homeland Security Initiatives based on their scopes, data collection methods, and analyses to assess the reliability of the cost estimates. Moreover, we examined costs estimates reported by other organizations, including the Council on Foreign Relations, the National League of Cities, the National Association of Counties, and the International Association of Emergency Managers. We did not include these organizations’ reports in our review because they did not specifically address costs associated with responses to increases in the national threat level. To obtain information on federal agencies’, states’, and localities’ threat advisory systems, we analyzed questionnaire responses and other documents to determine the number of federal agencies, states, and localities that had their own threat advisory systems in place prior to the establishment of the Homeland Security Advisory System as well as the number of federal agencies, states, and localities that follow their own threat advisory systems and the Homeland Security Advisory System. We reviewed documentation of the threat advisory systems that these federal agencies, states, and localities provided with their questionnaire responses to identify the characteristics of the systems, including systems’ threat levels and protective measures and conformance to the Homeland Security Advisory System. We also met with and received documents from the Department of Defense on its Force Protection Condition System. Furthermore, we spoke with and obtained information from officials of four foreign countries—Australia, Germany, Norway, and the United Kingdom—on these countries’ threat advisory systems and information sharing processes. We compared the characteristics of these systems with characteristics of the Homeland Security Advisory System to identify similarities and differences between the systems. We selected the four countries because they are democracies similar to the United States that have generally faced terrorist threats. Federal agencies and states responding to our questionnaire indicated that they used guidance from various sources, such as the Federal Emergency Management Agency (FEMA), the Federal Protective Service (FPS), the Department of Justice, and the White House, among other sources, to develop plans for responding to each Homeland Security Advisory System threat level. For example, 12 federal agencies reported using the Department of Justice’s Vulnerability Assessment of Federal Facilities that established security levels for various types of federal facilities and minimum-security standards for each security level. In addition, to develop their response plans, 8 federal agencies indicated that they used Homeland Security Presidential Directive 3, which established the Homeland Security Advisory System and suggested general protective measures for each advisory system threat level. Six states reported using terrorism alerts and guidelines from FEMA to develop their plans for protective measures for national threat levels. In addition to their response plans for national threat levels, federal agencies and states responding to our questionnaires reported using guidance and information from various sources to determine protective measures to implement or enhance in response to the three code-orange alert periods from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004. As shown in tables 6 and 7, these federal agencies reported using guidance and information and intelligence from such sources as the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the White House to determine measures to take in response to the third code-orange alert period in our review. These federal agencies generally reported that this guidance and information and intelligence was useful and timely. Results for the other two code-orange alert periods – March 17 to April 16, 2003; and May 20 to 30, 2003 – were consistent with those reported in tables 6 and 7 for the third code-orange alert period. As shown in tables 8 and 9, states responding to our questionnaire also indicated that they used guidance and information from sources such as DHS, other federal entities, and state, territory, and local law enforcement agencies to determine actions to take in response to the third code-orange alert period. These states generally reported that this guidance and information and intelligence was useful and timely. Results for the other two code-orange alert periods in our review were similar to those reported in tables 8 and 9. Federal agencies and states responding to our questionnaires reported having a variety of protective measures in place for responding to the three code-orange alert periods from March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004, regardless of whether the measures were most commonly enhanced, maintained at pre-code-orange alert levels, or implemented solely in response to the code-orange alerts. Table 10 provides examples of the protective measures that federal agencies most commonly reported having in place for the third code- orange alert period in our review. Results from the other two code-orange alert periods are consistent with those reported in the following table for the third code-orange alert period. Table 11 provides examples of the protective measures that states most commonly reported having in place during the third code-orange alert period in our review. Results for the other two code-orange alert periods in our review are similar to those reported in table 11. To ensure that protective measures operate as intended and are implemented as planned, most of the federal agencies and states responding to our questionnaires indicated that they had conducted tests or exercises on the functionality and reliability of protective measures within the past year. Table 12 provides examples of protective measures on which federal agencies and states reported conducting tests and exercises. In addition, most of the federal agencies and states responding to our questionnaires reported receiving confirmation from component entities, offices, or personnel that protective measures were actually enhanced or implemented during the three code-orange alert periods. Table 13 provides examples of the methods by which federal agencies and states reported receiving confirmation from their component entities, offices, and personnel, for the code-orange alert period from December 21, 2003, to January 9, 2004. Results for the other two code-orange alert periods from March 17 to April 16, 2003, and May 20 to 30, 2003, are consistent with those reported in table 13. In our questionnaire, we asked states to provide information on additional costs incurred by the state during the three code-orange alert periods in our review. However, of the 42 states that responded to our questionnaire and follow the Homeland Security Advisory System, only 6 reported additional costs incurred by state agencies during at least one of the three code- orange alerts in our review. Therefore, we did not collect sufficient cost information from our questionnaire to provide ranges or assess general trends in costs incurred by states during code-orange alert periods. Twenty-two of the 42 states that responded to our questionnaire and follow the Homeland Security Advisory System provided us with cost information they submitted to DHS in order to be reimbursed for state and local critical infrastructure protection costs through the State Homeland Security Grant Program – Part II and the Urban Areas Security Initiative – Part II. As discussed previously in this report, through these two grant programs, DHS offered financial assistance to reimburse costs incurred by state agencies and localities as a result of increased security measures at critical infrastructure sites during the period of hostilities with Iraq and for other periods of heightened alert. We obtained this critical infrastructure protection cost information from DHS for 40 states and their localities for the March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert periods and for 33 states and their localities for the December 21, 2003, to January 9, 2004, code-orange alert period. However, this cost information does not represent all additional costs incurred by states and localities during code-orange alert periods. We also received information on additional code-orange alert costs from 14 select metropolitan and rural localities. However, information on localities’ costs is most appropriately used anecdotally, as these cities and counties represent a small, nonprobability sample of localities within the United States. The rural localities from which we obtained information indicated that they did not incur additional costs for any of the code-orange alert periods because they did not take significant action in response to the alert. These localities explained that they had insufficient resources to do so or did not perceive their localities to be at risk. We would like to acknowledge the time and effort made by agencies and governments that provided information by responding to questionnaires and talked with us during site visits. Atlanta, Ga. Fulton County, Ga. Denver, Colo. Douglas County, Colo. Colorado Springs, Colo. Portland, Ore. Wasco County, Ore. Boston, Mass. Fitchburg, Mass. Norfolk, Va. Chicago, Ill. Cook County, Ill. Mankato, Minn. Helena, Mont. San Jose, Calif. Rock Springs, Wyo. The U.S. General Accounting Office (GAO) has been requested by Congress to review federal agencies’ security-related protective measures, guidance, and costs for periods when the national threat level was raised from yellow (elevated) to orange (high). As part of this request, GAO is surveying 28 federal agencies that received homeland security funding in fiscal year 2003, as reported to the Office of Management and Budget, and/or are Chief Financial Officers Act agencies. Results from this survey will help GAO to inform Congress of (1) protective measures taken by federal agencies during periods of orange alert, specifically for the periods March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004; (2) guidance and other information used by federal agencies in implementing those measures; and (3) costs incurred by federal agencies as a result of protective measures implemented during those three orange alert periods. This questionnaire should be completed by the person(s) most knowledgeable about your agency’s security-related measures, guidance, and costs for the orange alerts from March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004, including your agency’s protective measures for threat levels; guidance and other information used by your agency in developing and implementing protective measures during those periods; your agency’s methods for tracking or collecting cost data and ensuring data reliability; your agency’s national threat level notification processes; and financial and operational challenges your agency faced during the three orange alert periods. If your agency, or certain of its facilities, remains on orange alert even though the national threat level has been lowered, please answer the questions about the most recent orange alert period considering your agency’s actions and costs through January 9, 2004. Most of the questions can be answered by marking boxes or filling in blanks. Space has been provided at the end of the survey for any additional comments, and we encourage you to provide whatever additional comments you think appropriate. In our report, the responses from your agency will be presented only after they have been aggregated with responses from other responding agencies. GAO will not release individual agency responses to any entity unless requested by Congress or compelled by law. In addition, GAO will take appropriate measures to safeguard any sensitive information provided by your agency, and, upon request, can provide security clearance information for staff reviewing survey responses. Please complete this questionnaire within 2 weeks of receipt. Your agency’s participation is important! A member of our staff will pick up your completed questionnaire. If you have any questions or when you are ready for your questionnaire and any accompanying materials to be picked up, please contact Dr. Jonathan Tumin on (202) 512-3595, Rebecca Gambler on (202) 512-6912, or Kristy Brown on (202) 512-8697. Please provide the name, title, agency, and telephone number of the primary person completing this questionnaire so that we may contact that person if we need to clarify any responses. Telephone number: (_____)___________________________________ We modified the format of this questionnaire slightly for inclusion in this report, but we did not change the content of the questionnaire. Definition of term "agency": Any entity within the executive branch, including federal departments, independent establishments, and government corporations. If the questionnaire is to be completed by a federal agency's components, then "agency" refers to the component entity rather than the department. Agency Protective Measures for National Threat Levels 1. According to Homeland Security Presidential Directive 3, issued in March 2002, federal agencies are responsible for developing their own protective measures and other antiterrorism or self-protection and continuity plans for national threat levels. (See highlighted passage on page 2 of the attachment.) Please provide a copy of the measures along with your completed questionnaire. Please provide a copy of the measures along with your completed questionnaire. If you answer #4, please skip to question 5; otherwise, please continue. GAO Survey on Threat Alerts 2. Did your agency use guidance and/or information from any of the following sources in developing your protective measures for national threat levels? (Please check one answer in each row.) a. Federal Emergency Management Agency (FEMA) b. Federal Protective Service (FPS) g. Vulnerability assessments for your agency h. Other sources (Please specify.) If you answered “yes” for any source in question 2, please answer: Please list the source and titles or topics of any written guidance used by your agency in developing your protective measures for national threat levels. GAO Survey on Threat Alerts 5. Homeland Security Presidential Directive 3 requires federal agencies to develop and submit to the President, through the Assistant to the President for Homeland Security, an annual written report on steps taken to develop and implement protective measures for national threat levels. (See highlighted passage on page 2 of the attachment.) Please provide a copy of the report along with your completed questionnaire. Please provide the name of your agency’s threat-advisory system and a copy of system documentation, if available, along with your completed questionnaire. Please provide the name of your agency’s threat-advisory threat–advisory system that does not system and a copy of system documentation, if available, along with your completed questionnaire. Please provide the name of your agency’s threat-advisory uses its own threat–advisory system system and a copy of system documentation, if available, along with your completed questionnaire. If you answered #4, please stop and return this questionnaire according to the instructions on page 1. 5. Agency does not follow the HSAS and does Please provide the name of the other threat-advisory not use its own threat–advisory system, but system used by your agency. uses another threat-level system (e.g., the Department of Defense’s Force Protection Condition system) If you answered #5, please stop and return this questionnaire according to the instructions on page 1. 6. Agency does not follow any threat-advisory system If you answered #6, please stop and return this questionnaire according to the instructions on page 1. Orange alerts, that is, measures implemented in addition to the measures used in the “Yes”, “No”, or “Not applicable-N/A” for preceding Code-Yellow alert period. (Please check “Implemented, Code-Orange only”, each measure.) Increased use of N/A or no change in s. Other measures in this category (Please specify.) Increased use of N/A or no change in j. Other measures in this category (Please specify.) Dec. 21, 2003–Jan. 9, 2004 3. Information collection, analysis, and dissemination If your agency did not implement any types of measures in category “3”, please check this box and skip to category “4”. Increased use of N/A or no change in i. Other measures in this category (Please specify.) Increased use of N/A or no change in i. Other measures in this category (Please specify.) Increased use of N/A or no change in 5. Other types of measures (Please specify.) Increased use of N/A or no change in measure GAO Survey on Threat Alerts 9. We would like to know about the guidance and/or information/intelligence your agency received and used to determine the protective measures implemented specifically in response to the Code-Orange alert from March 17 to April 16, 2003. 9a. In addition to your agency’s planned protective measures for national 9c. For each item you answer “yes” in threat levels, did your agency receive guidance and/or question 9b, please answer questions 9c and information/intelligence from any of the following sources to determine the 9d: How useful was the guidance and/or measures implemented specifically in response to the HSAS Code-Orange information/ intelligence from the source? alert from March 17 to April 16, 2003? (Please check one answer in each row under question 9a.) 9d. Was the guidance and/or information/ intelligence from the source timely? 9b. For each item you answer “yes” in question 9a, please answer: Did your agency use the guidance and/or information/intelligence received from the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from March 17 to April 16, 2003? Received? Used? Useful? Timely? “yes” “yes” 1. Guidance (e.g., a. DHS (including FPS and FEMA) b. Federal Bureau of Investigation (FBI) e. Other sources (Please specify.) 2. Information/Intelligence (e.g., region, sector or site- “yes” “yes” GAO Survey on Threat Alerts 10. We would like to know about the guidance and/or information/intelligence your agency received and used to determine the protective measures implemented specifically in response to the Code-Orange alert from May 20 to May 30, 2003. 10a. In addition to your agency’s planned protective measures for national 10c. For each item you answer “yes” in threat levels, did your agency receive guidance and/or information/intelligence question 10b, please answer questions 10c and from any of the following sources to determine the measures implemented 10d: How useful was the guidance and/or specifically in response to the HSAS Code-Orange alert from May 20 to May information/intelligence from the source? 30, 2003? (Please check one answer in each row under question 10a.) 10d. Was the guidance and/or information/ 10b. For each item you answer “yes” in question 10a, please answer: Did intelligence from the source timely? your agency use the guidance and/or information/intelligence received from the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from May 20 to May 30, 2003? Received? Used? Useful? Timely? “yes” “yes” 1. Guidance (e.g., a. DHS (including FPS and FEMA) e. Other sources (Please specify.) (e.g., region, sector or site- “yes” “yes” GAO Survey on Threat Alerts 11. We would like to know about the guidance and/or information/intelligence your agency received and used to determine the protective measures implemented specifically in response to the Code-Orange alert from December 21, 2003 to January 9, 2004. 11a. In addition to your agency’s planned protective measures for national 11c. For each item you answer “yes” in threat levels, did your agency receive guidance and/or information/intelligence from any of the following sources to determine the measures implemented question 11b, please answer questions 11c and 11d: How useful was the guidance and/or specifically in response to the HSAS Code-Orange alert from December 21, information/intelligence from the source? 2003 to January 9, 2004? (Please check one answer in each row under question 11a.) 11d. Was the guidance and/or information/ intelligence from the source timely? 11b. For each item you answer “yes” in question 11a, please answer: Did your agency use the guidance and/or information/intelligence received from the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from December 21, 2003 to January 9, 2004? Received? Used? Useful? Timely? “yes” “yes” 1. Guidance (e.g., a. DHS (including FPS and FEMA) e. Other sources (Please specify.) 2. Information/Intelligence (e.g., region, sector or site- “yes” “yes” GAO Survey on Threat Alerts 12. In addition to guidance and information indicated above, what other types of information, if any, would have been helpful to your agency in deciding what protective measures to implement specifically in response to the HSAS Code- Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK f. Other types of information (Please specify.) Yes No DK Yes No DK Yes No DK 13. Please describe examples of ways in which protective measures implemented during the Code-Orange alerts (March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004) benefited your agency. 14. Please describe examples of ways in which your agency’s operations were affected during the Code-Orange alerts (March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004), such as longer lines for visitors or shifting of resources from normal operations. ____________________________________________________________________________________________ GAO Survey on Threat Alerts 15. Did your agency receive confirmation from component entities, offices, and/or personnel that the additional protective measures indicated in questions 8b, 8c, and 8d (on pages 6 through 10) were actually implemented during the HSAS Code-Orange alert from: (Please check one answer in each row.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? If you answered “yes” for any of the three Code-Orange alert periods in question 15 (a, b, or c), please answer question 16; otherwise, skip to question 17: 16. How did your agency receive confirmation that the additional protective measures indicated in questions 8b, 8c, and 8d were actually implemented during the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK d. Other methods (Please specify.) 17. Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please check only one answer.) 1. Yes (Continue with question 18.) 2. No (Skip to question 23.) To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from March 17 to April 16, 2003, please answer: 18. What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, that immediately preceded the HSAS Code-Orange alert period from March 17 to April 16, 2003? 19. What additional security-related costs, if any, did your agency incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from March 17 to April 16, 2003? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know” costs for the category. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, March 17 to April 16, 2003 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) otherwise, skip to question 22: 20. Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from March 17 to April 16, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet). 21. Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g., internal auditing procedures). ______________________________________________________________________________________________ GAO Survey on Threat Alerts If you provided data for estimated security-related costs in questions 18 and/or 19, please answer question 22; otherwise, skip to question 23: 22. Please briefly describe how your agency developed the estimates for total and/or additional security-related costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from March 17 to April 16, 2003. 23. Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from May 20 to May 30, 2003? (Please check only one answer.) 1. Yes (Continue with question 24.) 2. No (Skip to question 29.) To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from May 20 to May 30, 2003, please answer: 24. What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, that preceded the HSAS Code-Orange alert period from May 20 to May 30, 2003? 25. What additional security-related costs, if any, did your agency incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from May 20 to May 30, 2003? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know” costs for the category. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, May 20 to May 30, 2003 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) GAO Survey on Threat Alerts If you provided data for actual security-related costs in questions 24 and/or 25, please answer questions 26 and 27; otherwise, skip to question 28: 26. Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to May 30, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet). 27. Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g., internal auditing procedures). If you provided data for estimated security-related costs in questions 24 and/or 25, please answer question 28; otherwise, skip to question 29: 28. Please briefly describe how your agency developed the estimates for total and/or additional security-related costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to May 30, 2003. ______________________________________________________________________________________________ GAO Survey on Threat Alerts 29. Does your agency have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please check only one answer.) 1. Yes (Continue with question 30.) 2. No (Skip to question 35.) To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004, please answer: 30. What were your agency’s total security-related costs for the HSAS Code-Yellow alert period from May 31 to December 20, 2003, that preceded the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? 31. What additional security-related costs, if any, did your agency incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know” costs for the category. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, Dec. 21, 2003 to Jan. 9, 2004 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) Actual costs Estimated costs Don’t know costs Actual costs Estimated costs Don’t know costs Actual costs Estimated costs Don’t know costs Actual costs Estimated costs Don’t know costs $_______________ GAO Survey on Threat Alerts If you provided data for actual security-related costs in questions 30 and/or 31, please answer questions 32 and 33; otherwise, skip to question 34: 32. Please describe how your agency determined the total and/or additional security-related costs for the HSAS Code- Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004 (e.g., financial accounting system, Microsoft Excel spreadsheet). 33. Please briefly list the procedures used by your agency to review and certify the reliability of this financial data (e.g., internal auditing procedures). 35. How did your agency learn about the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Dec. 21, 2003 - a. Direct notification from DHS (not via media sources) Yes No DK Yes No DK Yes No DK (not via media sources) Yes No DK Yes No DK Yes No DK d. Other methods (Please specify.) Yes No DK Yes No DK Yes No DK If you answered “yes” that your agency received direct notification from DHS for any period in question 35 (Part A, Part B, or Part C) above, please answer questions 36 and 37; otherwise, skip to question 38: 36. How did DHS notify your agency about the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Warning Alert System (WAWAS) e. Other methods (Please specify.) GAO Survey on Threat Alerts 37. What type(s) of information was included in DHS’s official notification for the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK h. Other methods (Please specify.) GAO Survey on Threat Alerts 39. For each of the methods listed below, please indicate whether or not your agency would like to be notified of future changes in the national threat-level through this method. (Please check one answer in each row.) a. Through your agency representatives at the Homeland Security Operations Center b. Through a single official announcement to all federal agencies via telephone, E-mail, or fax c. Through an individual agency message via telephone, E-mail, or fax d. Through an electronic communications system such as the Washington Area Warning Alert System (WAWAS) e. Other methods (Please specify.) _________________________________________________ Financial and Operational Challenges in Implementing HSAS Code-Orange Alert Measures 40. What financial challenges, if any, did your agency face in responding to the HSAS Code-Orange alert from: (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK d. Other methods (Please specify.) Yes No DK Yes No DK Yes No DK If you answered “yes” to any financial challenge in rows a through d in question 40 (Part A, Part B, or Part C) above, please answer question 41; otherwise, skip to question 42: 41. Briefly describe one or more examples of financial challenges faced during the alerts. ______________________________________________________________________________________________ GAO Survey on Threat Alerts 42. What operational challenges, if any, did your agency face in responding to the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK i. Other (Please specify.) Yes No DK Yes No DK Yes No DK If you answered “yes” to any operational challenge in rows a through i in question 42 (Part A, Part B, or Part C) above, please answer question 43; otherwise, skip to question 44: 43. Briefly describe one or more examples of operational challenges faced during the alerts. ______________________________________________________________________________________________ GAO Survey on Threat Alerts 44. If you have any comments regarding any of the issues covered in this questionnaire or have any other comments about protective measures, guidance, and costs for HSAS Code-Orange alerts, please use the space provided. Thank you for your assistance. Please return the questionnaire and, dependent on your answers to questions 1, 5, 6, or 7, any accompanying documentation according to the instructions on page 1. The U.S. General Accounting Office (GAO), an investigative arm of Congress, has been requested by the Congress to review states’ and U.S. territories’ security-related protective measures, guidance, and costs for periods when the national threat level was raised from yellow (elevated) to orange (high). As part of this request, GAO is surveying the 50 states, U.S. territories, and Washington, D.C. to determine (1) what, if any, protective measures were taken during periods of orange alert, specifically for periods March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004; (2) guidance and other information used by states and territories in implementing those measures; and (3) costs incurred by states and territories as a result of protective measures implemented during these three orange alert periods. To better inform the Congress on the Homeland Security Advisory System (HSAS) and identify potential improvements, GAO is also collecting data on (1) applicable threat alert systems used by states and territories prior to the establishment of the HSAS and (2) operational and financial challenges faced by states and territories as a result of responding to code-orange alerts. This questionnaire should be completed by the person(s) most knowledgeable about the guidance received and protective measures taken by your state or territory during the periods identified above, including the protective measures your jurisdiction developed to respond to national threat levels, any threat-advisory system you have in place, types of protective measures taken, costs incurred during these periods of orange alert, how your state or territory was notified of the increase in the national threat level, and financial and operational challenges your state or territory faced during these periods of orange alert. If your state or territory, or certain of its facilities, remains on orange alert even though the national threat level has been lowered, please answer the questions about the most recent orange alert period considering your state or territory’s actions and costs through January 9, 2004. Most of the questions can be answered by marking boxes or filling in blanks. Space has also been provided for comments and we encourage you to provide whatever additional comments you think appropriate; please feel free to type out these comments on a separate attachment (identified by question number) if you prefer. In our report, the responses from your state or territory will be presented only after they have been aggregated with responses from other states and territories. GAO will not release individual responses to any entity unless requested by Congress or compelled by law. In addition, GAO will take appropriate measures to safeguard any sensitive information you provide, and, upon request, can provide security clearance information for staff reviewing survey responses. Please complete this questionnaire and return it within 2 weeks of receipt. Your participation is important! A pre- addressed Federal Express envelope has been included to return this questionnaire. If you have any questions or misplace the return envelope, please contact Nancy Briggs at (202) 512-5703 or Gladys Toro at (202) 512-3047. Please provide the name, title, and telephone number of the primary person completing this questionnaire and your state or territory name so that we may contact that person if we need to clarify any responses. Telephone number: (______)__________________________________ State or Territory: ___________________________________________ We modified the format of this questionnaire slightly for inclusion in this report, but we did not change the content of the questionnaire. GAO State Survey on Terrorist Alerts Sections I and II of this questionnaire ask you to report on your state’s or territory’s protective measures and advisory systems for all levels of national alert; the remaining sections ask you specifically about Code-Orange alerts. When completing this questionnaire, please consider only actions taken and costs incurred at the state or territory level; do not include local level actions and costs. I. State and Territory Protective Measures for Responding to National Threat Levels 1. According to Homeland Security Presidential Directive 3, issued in March 2002, states and territories are encouraged to develop protective measures and other antiterrorism or self-protection and continuity plans for responding to national threat levels (see bolded passage on page 2 of the attachment). If you answered “yes” for any source in question 2, answer question 3; otherwise, skip to question 4. 3. Please list the source and titles or topics of any written guidance used by your state or territory in developing protective measures for responding to national threat levels? If you answered #4, #5, or #6 to question 9, please stop and return this questionnaire according to the instructions on page 1. Orange Alerts from March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 10. We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the protective measures to implement specifically in response to the Code-Orange alert from March 17 to April 16, 2003. 10a. Please indicate the protective measures your state or territory (or at least 10b, 10c, and 10d. Please indicate the protective measures one state or territory department) has in place for Code-Yellow alerts. your state or territory (or at least one state or territory (Please check “Yes”, “No”, “Not applicable-N/A”, or “Don’t Know-DK” department) implemented or increased the use of specifically for each measure). in response to the Code-Orange alerts, that is, measures implemented in addition to the measures used in the preceding Code-Yellow alert period. (Please check “Implemented, Code-Orange only”, “Increased use of”, “N/A or no change,” or “Don’t Know-DK” for each measure in each column) Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK s. Other measures in this category (Please specify.) Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK j. Other measures in this category (Please specify.) Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK i. Other measures in this category (Please specify.) Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK Implemented, Code-Orange only Increased use of N/A or no change DK i. Other measures in this category (Please specify.) Implemented, Code-Orange only Increased use of N/A or no change DK 5. Other types of measures (Please specify.) Implemented, Code-Orange only Increased use of N/A or no change DK GAO State Survey on Terrorist Alerts 11. We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the protective measures to implement specifically in response to the Code-Orange alert from March 17 to April 16, 2003. 11a. In addition to planned protective measures for national threat levels, did your 11c. For each item you answer “yes” in state or territory receive guidance and/or information/intelligence from any of the question 11b, please answer questions 11c following sources to determine the measures implemented specifically in response and 11d: How useful was the guidance and/or to the HSAS Code-Orange alert from March 17 to April 16, 2003? (Please check information/intelligence from the source? one answer in each row under question 11a.) 11d. Was the guidance and/or 11b. For each item you answer “yes” in question 11a, please answer: Did your state or territory use the guidance and/or information/intelligence received from the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from March 17 to April 16, 2003? Received? Used? Useful? Timely? 1. Guidance (e.g., “yes” “yes” a. DHS (including FEMA) b. Other federal agency, such as the FBI and its Joint (JTTF) (Please specify. c. Other state, territorial, or (Please specify.) e. Regional, state or local law g. Other sources (Please specify.) (e.g., region, sector or site- “yes” “yes” GAO State Survey on Terrorist Alerts 12. We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the protective measures to implement specifically in response to the Code-Orange alert from May 20 to May 30, 2003. 12a. In addition to planned protective measures for national threat levels, did your 12c. For each item you answer “yes” in state or territory receive guidance and/or information/intelligence from any of the question 12b, please answer questions 12c following sources to determine the measures implemented specifically in response and 12d: How useful was the guidance and/or to the HSAS Code-Orange alert from May 20 to May 30, 2003? (Please check information/intelligence from the source? one answer in each row under question 12a.) 12d. Was the guidance and/or 12b. For each item you answer “yes” in question 12a, please answer: Did your state or territory use the guidance and/or information/intelligence received from timely? the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from May 20 to May 30, 2003? Received? Used? Useful? Timely? 1. Guidance (e.g., “yes” “yes” a. DHS (including FEMA) b. Other federal agency, such as the FBI and its JTTF (Please specify.) c. Other state, territorial, or (Please specify.) e. Regional, state, or local law g. Other sources (Please specify.) (e.g., region, sector or site- “yes” “yes” GAO State Survey on Terrorist Alerts 13. We would like to know about the guidance and/or information/intelligence your state or territory received and used to determine the protective measures to implement specifically in response to the Code-Orange alert from December 21, 2003 to January 9, 2004. 13a. In addition to planned protective measures for national threat levels, did your 13c. For each item you answer “yes” in state or territory receive guidance and/or information/intelligence from any of the question 13b, please answer questions 13c and following sources to determine the measures implemented specifically in response 13d: How useful was the guidance and/or to the HSAS Code-Orange alert from December 21, 2003 to January 9, 2004? information/intelligence from the source? (Please check one answer in each row under question 13a.) 13d. Was the guidance and/or information/ 13b. For each item you answer “yes” in question 13a, please answer: Did your intelligence from the source timely? state or territory use the guidance and/or information/intelligence received from the source to determine the measures implemented specifically in response to the HSAS Code-Orange alert from Dec. 21, 2003 to Jan. 9, 2004? Received? Used? Useful? Timely? 1. Guidance (e.g., “yes” “yes” a. DHS (including FEMA) b. Other federal agency, such as the FBI and its JTTF (Please specify.) c. Other state, territorial, or (Please specify.) e. Regional, state or local law g. Other sources (Please specify.) (e.g., region, sector or site- “yes” “yes” GAO State Survey on Terrorist Alerts 14. In addition to guidance and information indicated above, what other types of information, if any, would have been helpful in deciding what protective measures to implement specifically in response to the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, “Don’t Know-DK”, or “Already Received”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Already received Yes No DK Already received Yes No DK Already received Yes No DK Already received Yes No DK Already received f. Other methods (Please specify.) Yes No DK Already received 15. Please describe examples of ways in which protective measures implemented during the Code-Orange alerts benefited your state or territory. 16. Please describe examples of ways in which your state or territory’s operations were affected during the Code-Orange alerts, such as, but not limited to, shifting resources from normal operations or reduced tourism. ____________________________________________________________________________________________ GAO State Survey on Terrorist Alerts 17. Did your state or territory receive confirmation from agencies, offices, and/or personnel within your jurisdiction that the additional protective measures indicated in questions 10b, 10c, and 10d (on pages 6 through 10) were actually implemented during the HSAS Code-Orange alert from: (Please check one answer in each row.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? If you answered “yes” or “some” for any of the three Code-Orange alert periods in question 17 (a, b, or c), please answer question 18; otherwise, skip to question 19: 18. How did your state or territory receive confirmation that the additional protective measures indicated in questions 10b, 10c, and 10d were actually implemented during the HSAS Code-Orange alert from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK d. Other methods (Please specify.) GAO State Survey on Terrorist Alerts 19. Has DHS requested any of the following types of information on protective measures taken in response to increased national threat levels? (Please check one answer in each row in each applicable column.) Yes No DK Yes No DK Yes No DK d. Other information (Please specify.) 20. Does your state or territory have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please check only one answer.) 1. Yes (Continue with question 21.) 2. No (Skip to question 26.) GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from March 17 to April 16, 2003, we are assuming that the total security costs incurred during the HSAS Code-Yellow alert period from February 28 to March 16, 2003 will serve as your baseline. 21. What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, that immediately preceded the HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please provide your answer in the table below.) 22. What additional security-related costs, if any, did your state or territory incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from March 17 to April 16, 2003? (Please provide your answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, March 17 to April 16, 2003 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) otherwise, skip to question 25: 23. Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from March 17 to April 16, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet). 24. Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial data (e.g., internal auditing procedures). ______________________________________________________________________________________________ GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 21 and/or 22, please answer question 25; otherwise, skip to question 26: 25. Please briefly describe how your state or territory developed the estimates for total and/or additional security-related costs for the HSAS Code-Yellow alert period from February 28 to March 16, 2003, and/or the HSAS Code-Orange alert period from March 17 to April 16, 2003. 26. If you have any other data on costs incurred during the HSAS Code-Orange alert period from March 17 to April 16, that are not reported above, please briefly describe. 27. Does your state or territory have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from May 20 to May 30, 2003? (Please check only one answer.) 1. Yes (Continue with question 28.) 2. No (Skip to question 33.) GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from May 20 to May 30, 2003, we are assuming that the total security costs incurred during the HSAS Code-Yellow alert period from April 17 to May 19, 2003 will serve as your baseline. 28. What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, that preceded the HSAS Code-Orange alert period from May 20 to May 30, 2003? (Please provide your answer in the table below.) 29. What additional security-related costs, if any, did your state or territory incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from May 20 to May 30, 2003? (Please provide your answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, May 20 to May 30, 2003 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) otherwise, skip to question 32: 30. Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to May 30, 2003 (e.g., financial accounting system, Microsoft Excel spreadsheet). 31. Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial data (e.g., internal auditing procedures). ______________________________________________________________________________________________ GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 28 and/or 29, please answer question 32; otherwise, skip to question 33: 32. Please briefly describe how your state or territory developed the estimates for total and/or additional security-related costs for the HSAS Code-Yellow alert period from April 17 to May 19, 2003, and/or the HSAS Code-Orange alert period from May 20 to May 30, 2003. 33. If you have any other data on costs incurred during the HSAS Code-Orange alert period from May 20 to May 30, that are not reported above, please briefly describe. 34. Does your state or territory have any data on actual or estimated additional security-related costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please check only one answer.) 1. Yes (Continue with question 35.) 2. No (Skip to question 40.) GAO State Survey on Terrorist Alerts To provide a context for assessing additional costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004, we are assuming that the total security costs incurred during the HSAS Code-Yellow alert period from May 31 to December 20, 2003 will serve as your baseline. 35. What were your state or territory’s total security-related costs for the HSAS Code-Yellow alert period from May 31 to December 20, 2003, that preceded the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please provide your answer in the table below.) 36. What additional security-related costs, if any, did your state or territory incur for protective measures implemented specifically in response to the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004? (Please provide your answer in the table below.) (NOTE: For each category, please indicate whether the costs provided are actual or estimated, or if you “Don’t Know”. For categories where no costs were incurred, please list costs as $0. If costs by category cannot be provided, give “Grand total costs”.) Orange alert, Dec. 21, 2003 to Jan. 9, 2004 a. Personnel (e.g., security personnel, overtime) b. Equipment/materials (e.g., screening materials, patrol vehicles) c. Other costs (e.g., travel, training) d. Grand total costs (add items a, b, c from above) otherwise, skip to question 39: 37. Please describe how your state or territory determined the total and/or additional security-related costs for the HSAS Code-Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004 (e.g., financial accounting system, Microsoft Excel spreadsheet). 38. Please briefly list the procedures used by your state or territory to review and certify the reliability of this financial data (e.g., internal auditing procedures). ______________________________________________________________________________________________ GAO State Survey on Terrorist Alerts If you provided data for estimated security-related costs in questions 35 and/or 36, please answer question 39; otherwise, skip to question 40: 39. Please briefly describe how your state or territory developed the estimates for total and/or additional security-related costs for the HSAS Code-Yellow alert period from May 31 to December 20, 2003, and/or the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004. 40. If you have any other data on costs incurred during the HSAS Code-Orange alert period from December 21, 2003 to January 9, 2004 that are not reported above, please briefly describe. 41. What guidance, if any, did your state or territory use to track costs incurred in response to the Code-Orange alerts of March 17 to April 16, 2003, May 20 to May 30, 2003, and/or December 21, 2003 to January 9, 2004? (Please provide the source and the title or topic of the guidance.) If you answer “yes” to question 42, please answer question 43; otherwise skip to question 44. 43. How useful were the following types of guidance from DHS on how or whether to track costs, if provided? (Please check one answer in each row.) a. Tracking total costs incurred in response to elevated threat b. Tracking costs incurred that are eligible for federal c. Other methods (Please specify.) 44. Has DHS requested any data on additional costs incurred in response to the Code-Orange alert periods March 17 to April 16, 2003, May 20 to May 30, 2003, and December 21, 2003 to January 9, 2004 from your state or territory? (Please check one answer in each row.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? 45. Have you submitted any security-related costs for reimbursement to DHS for any of the following Code-Orange alert periods? (Please check one answer in each row.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? 46. Have you used any grant funds to reimburse your Code-Orange alert costs? (Please check only one answer.) Please provide the name of the grant(s) and amount(s). 47. In which of the following ways did your state or territory learn about the HSAS Code-Orange alerts for: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK as the FBI (not via media sources) Yes No DK Yes No DK Yes No DK e. Other methods (Please specify.) Yes No DK Yes No DK Yes No DK If you answered “yes” that your state or territory received direct notification from DHS for any period in question 47 (Part A, Part B, or Part C) above, please answer questions 48 and 49; otherwise, skip to question 50: 48. How did DHS notify your state or territory about the HSAS Code-Orange alerts from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Telecommunications System (NLETS) e. Other methods (Please specify.) GAO State Survey on Terrorist Alerts 49. What type(s) of information was included in DHS’s official notification for the HSAS Code-Orange alerts from: (Please check one answer (“Yes”, “No”, or “Don’t Know-DK”) in each row in each applicable column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK h. Other methods (Please specify.) GAO State Survey on Terrorist Alerts 51. For each of the methods listed below, please indicate whether or not your state or territory would like to be notified of future changes in the national threat-level through this method. (Please check one answer in each row.) a. Through your representatives at the Department of Homeland Security Operations b. Through a single official announcement to all state and territories via telephone, c. Through an individual message via telephone, E-mail, or fax d. Through an electronic communications system, such as the National Law Enforcement Telecommunications System (NLETS) e. Other methods (Please specify.) VI. Financial and Operational Challenges in Implementing HSAS Code-Orange Alert Measures 52. What financial challenges, if any, did your state or territory face in responding to the HSAS Code-Orange alerts from: (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK d. Other challenges (Please specify.) GAO State Survey on Terrorist Alerts 53. Briefly describe examples of financial challenges and the consequences of these faced during the alerts. 54. What operational challenges, if any, did your state or territory face in responding to the HSAS Code-Orange alerts from: (Please check one answer (“Yes”,” No”, or “Don’t Know-DK”) in each row in each column.) a. March 17 to April 16, 2003? b. May 20 to May 30, 2003? c. December 21, 2003 to January 9, 2004? Yes No DK Yes No DK Yes No DK j. Other challenges (Please specify.) GAO State Survey on Terrorist Alerts 55. Briefly describe examples of operational challenges and the consequences of these faced during the alerts. 56. During the HSAS Code-Orange alerts, was your state prevented from taking any specific protective measure because of a legal prohibition(s)? 1. Yes, state or territory was prevented from taking specific protective measures because of a legal prohibition(s) 2. No, state or territory was not prevented from taking specific protective measures because of a legal prohibition(s) If you answered “yes” to question 56, please continue with question 57; otherwise, skip to question 58. 57. Please identify the specific HSAS Code-Orange alert(s), the protective measure involved, and the prohibition(s) that prevented its implementation, along with any relevant legal citation(s). ______________________________________________________________________________________________ GAO State Survey on Terrorist Alerts 58. If you have any comments regarding any of the issues covered in this questionnaire or have any other comments about protective measures, guidance, and costs for HSAS Code-Orange alerts, please use the space provided. Thank you for your assistance. Please return the questionnaire according to the instructions on page 1. In addition to the individuals named above, David P. Alexander, Fredrick D. Berry, Nancy A. Briggs, Kristy N. Brown, Philip D. Caramia, Christine F. Davis, Michele Fejfar, Rebecca Gambler, Catherine M. Hurley, Gladys Toro, Jonathan R. Tumin, Tamika S. Weerasingha, and Kathryn G. Young made key contributions to this report. Dory, Amanda. “American Civil Security: The U.S. Public and Homeland Security.” The Washington Quarterly, vol. 27, no. 1 (2003-2004) 37-52. Fischoff, Baruch. “Assessing and Communicating the Risks of Terrorism.” Science and Technology in a Vulnerable World. eds. Albert H. Teich, Stephen D. Nelson, and Stephen J. Lita. Washington, D.C.: American Association for the Advancement of Science, 2003: 51-64. Fischoff, Baruch, Roxana M. Gonzalez, Deborah A. Small, and Jennifer S. Lerner. “Evaluating the Success of Terror Risk Communications.” Biosecurity and Bioterrorism: Biodenfense Strategy, Practice, and Science, vol. 1, no. 4 (2003) 255-258. Gray, George M., and David P. Ropeik. “Dealing with the Dangers of Fear: The Role of Risk Communication.” Health Affairs, vol. 21, no. 6 (2002) 106- 116. Mileti, Dennis S., and John H. Sorensen. Communication of Emergency Public Warnings: A Social Science Perspective and State-of-the-Art Assessment, a report prepared for the Federal Emergency Management Agency, August 1990. Mitchell, Charles, and Chris Decker. “Apply Risk-Based Decision-Making Methods and Tools to U.S. Navy Antiterrorism Capabilities.” Journal of Homeland Security. February 2004. National Research Council. Improving Risk Communication. Washington, D.C.: National Academy Press, 1989. Partnership for Public Warning. A National Strategy for Integrated Public Warning Policy and Capability. McLean, VA: May 16, 2003. Partnership for Public Warning. Developing a Unified All-Hazard Public Warning System. Emmitsburg, MD: Nov. 25, 2002. Ropeik, David, and Paul Slovic. “Risk Communication: A Neglected Tool in Protecting Public Health.” Risk in Perspective, vol. 11, no. 2 (2003) 1-4. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: Established in March 2002, the Homeland Security Advisory System was designed to disseminate information on the risk of terrorist acts to federal agencies, states, localities, and the public. However, these entities have raised questions about the threat information they receive from the Department of Homeland Security (DHS) and the costs they incurred as a result of responding to heightened alerts. This report examines (1) the decision making process for changing the advisory system national threat level; (2) information sharing with federal agencies, states, and localities, including the applicability of risk communication principles; (3) protective measures federal agencies, states, and localities implemented during high (codeorange) alert periods; (4) costs federal agencies reported for those periods; and (5) state and local cost information collected by DHS. DHS assigns threat levels for the entire nation and assesses threat conditions for geographic regions and industrial sectors based on analyses of threat information and vulnerability of potential terrorist targets. DHS has not yet officially documented its protocols for communicating threat level changes and related threat information to federal agencies and states. Such protocols could assist DHS to better manage these entities' expectations about the methods, timing, and content of information received from DHS. To ensure early, open, and comprehensive information dissemination and allow for informed decisionmaking, risk communication experts suggest that warnings should include (1) multiple communication methods, (2) timely notification, and (3) specific threat information and guidance on actions to take. Federal agencies and states responding to GAO's questionnaires sent to 28 federal agencies and 56 states and territories generally indicated that they did not receive specific threat information and guidance, which they believe hindered their ability to determine and implement protective measures. The majority of federal agencies reported operating at heightened security levels regardless of the threat level, and thus, did not need to implement a substantial number of additional measures to respond to code-orange alerts. States reported that they varied in their actions during code-orange alerts. The costs reported by federal agencies, states, and selected localities are imprecise and may be incomplete, but provide a general indication of costs that may have been incurred. Additional costs reported by federal agencies responding to GAO's questionnaire were generally less than 1 percent of the agencies' fiscal year 2003 homeland security funding. DHS collected information on costs incurred by states and localities for critical infrastructure protection during periods of code-orange alert. However, this information does not represent all additional costs incurred by these entities during the code-orange alert periods.