In April 2011 DOD issued a directive establishing a “defense forensic enterprise” that, among other things, provided policy and assigned responsibilities within the department to develop and maintain an enduring and holistic forensic capability to support the full range of military operations. In January 2016 DOD reissued a directive establishing a “defense biometrics enterprise” that, among other things, provided policies and assigned responsibilities within the department to provide a critical end-to-end biometric capability to support decision- making across the full range of military operations. These directives assigned USD(AT&L) responsibility for overseeing and coordinating the department’s biometric and forensic enterprise activities. USD(AT&L) utilizes the Defense Biometrics and Forensics Office to carry out its oversight and coordination responsibilities. The office coordinates and synchronizes biometric and forensic requirements, as well as facilitates the development and implementation of enterprise-wide policies. In 2008 and 2011 the Secretary of Defense designated the Secretary of the Army as the executive agent for DOD’s biometric and forensic activities, respectively. In 2013 the Secretary of the Army designated the Defense Forensics and Biometrics Agency (DFBA) as the executive manager and tasked the agency with carrying out the Army’s biometric and forensic executive agent responsibilities, which include, among other things, leading enterprise coordination, acquiring common capabilities, ensuring that capabilities are planned and budgeted for, and overseeing and maintaining DOD’s authoritative biometric database through its Biometrics Operations Division. DFBA, in carrying out the Army’s forensics executive agent functions, also coordinates with the Army’s Criminal Investigations Command, which manages the Defense Forensic Science Center—the Army entity tasked with planning, programming, and providing joint or common forensic capabilities. By directive, the Office of the Secretary of Defense, the Joint Staff, the military services, and the combatant commands are required to support various programs and policies within the biometric and forensic enterprises, such as coordinating and integrating requirements and capabilities to prevent unnecessary duplication. For example, the combatant commands are responsible for identifying, validating, and prioritizing theater-specific, joint biometric and forensic requirements while the military services and other DOD components plan, program, and field biometric and forensic capabilities to meet warfighter needs. The individual military services, the geographic combatant commands, and Special Operations Command (SOCOM) all have their own offices to oversee their biometric and forensic activities. DOD utilizes the Joint Capabilities Integration and Development System to identify, assess, prioritize, and validate joint military requirements, including deployable biometric and forensic requirements. The Joint Capabilities Integration and Development System process is overseen by the Joint Staff’s Joint Requirements Oversight Council. Joint military requirement gaps are identified, typically by geographic combatant commands, and validated often by a military service or by the Joint Staff. DOD then studies potential non-materiel and materiel solutions to reduce or eliminate validated capability gaps. Non-materiel solutions include changes to doctrine, organization, training, or policy. Materiel solutions are items necessary to equip, operate, maintain, and support military activities, and they include biometric and forensic collection kits and communications equipment for transmitting biometric and forensic data to and from the warfighter. Potential materiel solutions are evaluated through an analysis-of-alternatives process whereby the performance, effectiveness, suitability, and estimated costs of potential materiel solutions are determined. DOD has a rapid acquisition process to support urgent and emergent combatant commander needs during ongoing and anticipated contingency operations. Urgent and emergent operational needs are generated when other means—such as the department’s traditional requirements and acquisition processes—cannot be tailored to address operational requirements in a timely fashion. A goal of the rapid acquisition process is to typically field a capability solution to an urgent or emergent operational need within 2 years. The rapid acquisition process is generally overseen by the Joint Staff and the Joint Rapid Acquisition Cell within the Office of the Secretary of Defense. Once a joint urgent or emergent operational need is validated by the Joint Staff, DOD may designate a sponsor—usually a military service—with responsibility for evaluating potential non-materiel and materiel solutions, and assigning a milestone decision authority to approve a solution and oversee its implementation. Based on validated requirements to support a range of military operations, DOD has fielded a number of deployable capabilities to collect, analyze, match, transmit, store, and share biometric and forensic information. Biometric collection capabilities include the following: Secure Electronic Enrollment Kit: Army, Navy, Marine Corps, and SOCOM hand-held device used to collect fingerprint, iris, facial images, and biographical information. Biometrics Automated Toolset: Army hand-held device and computer equipment used to collect (and transmit) fingerprint, iris, and facial images. Identity Dominance System: Navy and Marine Corps hand-held device and computer equipment used to collect (and transmit) fingerprint, iris, and facial images in both shore and maritime environments. The Navy and Marine Corps capabilities are separately managed, acquired, and funded through the individual services. BioSled: SOCOM hand-held device attached to a cellular phone used to collect fingerprint, iris, facial images, and biographical information. For examples of biometric collection devices, see figure 1. Forensic analysis capabilities include the following: Exploitation Analysis Center: SOCOM exploitation kit used to collect and process latent fingerprints and DNA samples, among other forensic material. Expeditionary Forensic Exploitation Capability: Marine Corps exploitation kit modeled after SOCOM’s exploitation analysis center and used to collect and process latent fingerprints and DNA samples, among other forensic material. Forensic Exploitation Analysis Tool: Managed by the Navy, this tool is a laboratory-information management and database sharing software system for documenting, tracking, reporting, and sharing forensic data. Forensic Exploitation Laboratories: Owned and operated by the Army’s Defense Forensics Science Center, these laboratories provide a modularized, scalable capability to forensically analyze latent fingerprints, DNA, explosives, drugs, and firearm and tool marks. The Army has also established a “reachback” operations center at the Gillem Enclave, Georgia, to oversee the deployment and management of the forensic exploitation laboratories, and to provide expertise and analytical capabilities to process forensic material (see figure 2). Biometric and forensic transmission, storage, and sharing capabilities include the following: DOD Automated Biometric Information System (DOD ABIS): DOD ABIS is the department’s authoritative biometric repository for non- U.S. persons. It supports the storing, matching, and sharing of biometric data collected as part of military operations, including fingerprint, iris, palm, facial images, and biographical information, as well as forensically collected latent fingerprint information. Biometric submissions and match requests are prioritized for processing based on agreements between DFBA and the submitting organization. Figure 3 shows a person of interest whom DOD identified through biometric data that were collected, analyzed, and stored in DOD ABIS. Special Operations Forces Exploitation: SOCOM communications architecture utilizing global satellite networks to transmit biometric and forensic information through an online portal to and from DOD ABIS with match/no-match responses. Department of the Navy Identification and Screening Information System: Navy and Marine Corps communications architecture to transmit biometric information through an online portal to and from DOD ABIS with match/no-match responses. The system is modeled after SOCOM’s Special Operations Forces Exploitation capability. Near Real Time Identity Operations: Army-provided regional forward server, communications platform, and collection devices that are fielded in U.S. Central Command’s (CENTCOM) area of responsibility in response to a 2014 CENTCOM joint emergent operational need. In September 2014 CENTCOM submitted a joint emergent operational need to meet 21 command-specific requirements. In November 2014 the Joint Requirements Oversight Council validated CENTCOM’s operational need and directed the executive agent to establish it as an enduring capability. In January 2015 the Joint Rapid Acquisition Cell assigned the Army as the office of primary responsibility for fulfilling the need. DOD has validated enduring non-materiel and materiel requirements for deployable biometric and forensic capabilities. DOD officials emphasized the importance of this step, given DOD’s increasing operational demand for biometric and forensic capabilities, as shown in figure 4—an interactive graphic—and in appendix II. To better support current and anticipated warfighter demand, DOD validated 30 non-materiel enduring requirements for deployable biometric and forensic capabilities, as shown in table 1. These requirements are designed to transition DOD’s biometric and forensic capabilities, over a multi-year period, from rapidly acquired and OCO-funded capabilities to enduring capabilities that are resourced through base funding. According to DOD officials, the 30 non-materiel requirements remain current and comprehensive, as of May 2017. We found that each biometric and forensic non-materiel requirement was submitted by the Army, as DOD’s executive agent for biometrics and forensics; coordinated across the department; and approved and documented by the Joint Requirements Oversight Council in August 2013 and November 2014, respectively. DOD has validated several materiel enduring requirements for deployable biometric and forensic capabilities that facilitate the recognition, collection, preservation, analysis, transmission, matching, storage, and sharing of biometric and forensic data. While DOD does not have a consolidated list of its validated biometric and forensic materiel requirements at this time, it is in the process of developing such a list. DOD’s materiel requirements are currently described in department, military service, and SOCOM strategies and acquisition documents, and in geographic combatant command operational plans. For example, the 2012 Marine Corps Identity Strategy identified a requirement for biometric and forensic collection, transmission, and storage capabilities to support operations globally. Additionally, the Army identified enduring requirements for DOD’s authoritative biometric database in documents such as its draft 2016 capability production document and its 2015 analysis of alternatives. DOD has made significant progress in addressing 7 of the 30 validated non-materiel enduring requirements for deployable biometric and forensic capabilities. The military services and SOCOM have also taken actions to ensure the continued availability of several deployable materiel biometric and forensic capabilities to meet enduring requirements. However, DOD’s efforts to institutionalize deployable biometric and forensic capabilities are limited by strategic planning gaps and acquisition management challenges. DOD has made significant progress in addressing 7 of the 30 validated non-materiel requirements for biometric and forensic capabilities that were identified in 2013 and 2014, as shown in table 2. According to DFBA documentation, DOD is in the process of addressing the remaining 23 non-materiel requirements, but as of May 2017 their status was below 75 percent complete. DFBA is leading DOD’s effort to address all 30 validated non-materiel requirements, and it has prioritized and established timeframes for their completion by 2020, as directed by the Joint Requirements Oversight Council. DFBA officials told us that they initially focused on doctrine requirements, such as issuing Joint Doctrine Note 2-16, Identity Activities, and integrating biometric and forensic activities into existing joint publications, to better address training and policy requirements. Appendix III includes a description of all 30 validated non-materiel enduring requirements by area, status, and anticipated completion, as of May 2017. DOD has developed biometric and forensic capabilities to meet several validated enduring materiel requirements, and it has made progress in transitioning these capabilities from OCO to base funding. The military services and SOCOM have initiated acquisition and sustainment programs, based on validated requirements, to ensure the continued availability of several materiel biometric and forensic capabilities, including the following: Army Next Generation Biometric Collection Device. The Army has initiated an acquisition program to identify a follow-on capability for its existing biometric collection device, the Biometrics Automated Toolset, which is scheduled to reach end-of-life in 2022, according to Army officials. The Army is conducting an analysis of alternatives to be completed at the end of fiscal year 2017 to inform its decision, according to the same officials. Biometric Enabling Capability (hereinafter referred to as the DOD ABIS follow-on system). In 2015 the Army completed an analysis of more than 10 alternatives to inform DOD’s decision regarding a DOD ABIS replacement. DOD ABIS is scheduled to be replaced in fiscal year 2022. Forensic Exploitation Laboratories. Army officials expect to transition these laboratories to an enduring, base-funded capability in 2019. Officials from the Defense Forensics Science Center noted that the Army’s draft expeditionary forensic strategy calls for an expeditionary lab to be aligned with each of the six geographic combatant commands. Identity Dominance System. The Navy and Marine Corps are jointly pursuing a replacement for their existing biometric collection device, the Secure Electronic Enrollment Kit, which, according to Navy and Marine Corps officials, is scheduled to reach end-of-life in 2019. SOCOM Biometric Collection Device. SOCOM has initiated an acquisition program to replace its existing Secure Electronic Enrollment Kit and BioSled collection devices, which currently fulfill validated requirements. SOCOM officials anticipate that the replacement capability will be available in 2019. DOD officials stated that the department has made progress in transitioning enduring biometric and forensic materiel capabilities from OCO to base budget funding. For example, Army officials stated that DOD ABIS has transitioned from a combination of OCO and base budget funding to an enduring capability funded through DOD’s base budget. The Navy, Marine Corps, and SOCOM have also developed comprehensive programs of record for their biometric and forensic materiel capabilities that are expected to be funded through their respective base budgets. In addition, the Army anticipates transitioning its forensic exploitation laboratories from OCO to base funding by 2019. Officials from across DOD noted the importance of continuing to transition biometric and forensic materiel capabilities from OCO to base funding, to better ensure their continued availability. DOD’s efforts to institutionalize its enduring deployable biometric and forensic capabilities are limited by strategic planning gaps and acquisition management challenges. These limitations include the absence of a current biometric strategic plan and supporting implementation plan, the absence of acquisition professionals to oversee CENTCOM’s Near Real Time Identity Operations solution, the absence of a geographically dispersed DOD ABIS back-up capability, and difficulties in hiring and retaining qualified personnel to operate and maintain DOD ABIS. While DOD has a current and approved forensic strategic plan, it does not have a current and approved biometric strategic plan. According to Standards for Internal Control in the Federal Government, strategic plans set the goals and objectives for an entity to achieve more effective and efficient operations and to minimize waste. Furthermore, the standards call for set goals and objectives to be reviewed periodically and updated as necessary. In 2015 DOD issued a forensic strategic plan to guide its forensic enterprise through fiscal year 2020. The plan identifies several goals and objectives, such as enhancing enterprise effectiveness and information- sharing. DOD also issued a supporting forensic implementation plan in 2015 that includes strategic planning elements for each of the objectives, such as intended outcomes, measures of effectiveness, and assigning offices of primary responsibility. According to USD(AT&L) officials, the forensic strategic plan plays a critical role in focusing and prioritizing DOD’s forensic enterprise activities. In contrast, DOD’s biometric strategic plan is out of date, and the department has not developed a supporting implementation plan. Specifically, DOD issued a biometric strategic plan in 2008, covering the 2008 – 2015 timeframe. The plan identifies several goals and objectives, such as institutionalizing biometric capabilities and coordinating biometric efforts across the department more effectively. The plan includes a requirement to be reviewed annually and updated as necessary. The plan also directs that a supporting implementation plan be developed. However, according to DOD officials, the biometric strategic plan has not been reviewed or updated since 2008, and a supporting implementation plan has not been issued. USD(AT&L), Army, Navy, Marine Corps, and DFBA officials agreed that the biometric strategic plan should be updated and a supporting implementation plan issued to better focus and prioritize enterprise goals and objectives for matters such as doctrine and policy, coordination, and acquisition and sustainment efforts. For example, DOD officials noted that the military services and SOCOM have a number of ongoing biometric acquisition and sustainment initiatives that are not articulated and synchronized in a single document, and that including information about these initiatives in an updated biometric strategic plan would enhance long-range enterprise planning. According to DOD officials, the 2008 biometric strategic plan has not been reviewed and updated, and a supporting implementation plan has not been issued, because no organization has been assigned responsibility for completing these tasks. Further, these officials stated that if an entity were to independently undertake these tasks without being assigned to do so, there likely would be mixed acceptance across the enterprise. Without a strategic plan that identifies goals and objectives and a supporting implementation plan that identifies outcomes, measures of effectiveness, and responsibilities, among other things, DOD may be missing an opportunity to reprioritize and better align enterprise efforts in important areas such as acquisition and sustainment. DOD’s acquisition management challenges that are specific to its biometric and forensic enterprises include the absence of a milestone decision authority to oversee CENTCOM’s Near Real Time Identity Operations solution, the absence of a geographically dispersed DOD ABIS back–up capability, and difficulties in hiring and retaining qualified personnel to operate and maintain DOD ABIS. CENTCOM’s Near Real Time Identity Operations solution lacks a milestone decision authority supported by acquisition professionals. According to DOD officials, the Army could have more thoroughly considered existing, viable, and potentially less costly alternatives to address CENTCOM’s 2014 operational need for a Near Real Time Identity Operations capability. In 2015 SOCOM offered the Army its Special Operations Forces Exploitation capability as a potential solution. According to military service, SOCOM, and DFBA documentation and officials, SOCOM’s capability was a proven, highly effective, and cost-efficient communications architecture that met many of CENTCOM’s 21 operational need requirements, including the ability to transmit and receive a match/no-match response from DOD ABIS within 3 minutes. Navy and Marine Corps officials stated that they modeled their communication architecture (i.e., the Department of the Navy Identification and Screening Information System) on the Special Operations Forces Exploitation capability, based on its demonstrated high performance and reliability. Other Army officials noted that the Army’s fielded Biometrics Automated Toolset capability could potentially have been leveraged to satisfy some of CENTCOM’s operational need requirements. When CENTCOM’s joint emergent operational need was validated by the Joint Staff and assigned by the Joint Rapid Acquisition Cell, the Army office responsible for overseeing the Near Real Time Identity Operations solution was given 90 days to identify and field a potential solution; thus, according to DOD officials, they had limited time to thoroughly assess alternative options. Army officials observed that while they discussed the feasibility of the Special Operations Forces Exploitation capability and other potential solutions with DOD, military service, and SOCOM officials in 2015, they rejected these alternatives because they did not meet all of CENTCOM’s requirements, including the ability to share unclassified information with allied partners and the ability to transmit and receive all match/no-match responses within 3 minutes. While we did not, in the following assessments, validate the findings or the Army’s efforts to address the corresponding deficiencies identified in them, the assessments highlight concerns within DOD regarding the performance of the Near Real Time Identity Operations solution. In June 2016 the Center for Naval Analyses issued an analysis of biometric and forensic data collected through November 2015 which examined several DOD information systems and found that the Near Real Time Identity Operations solution produced inconsistent match/no-match responses due to data synchronization challenges that could increase risk for existing and future missions conducted in the CENTCOM area of responsibility. In September 2016 the Army completed its operational assessment of the Near Real Time Identity Operations solution and found that it provided inconsistent match/no-match responses that “reduced warfighter confidence in the system.” Based on their lack of confidence in the system, SOCOM and the Marine Corps sought and received approval for their forces in the CENTCOM area of responsibility to use their existing capabilities instead of the Near Real Time Identity Operations solution. Marine Corps officials asserted that the Near Real Time Identity Operations solution continued to provide incomplete match/no-match data as of May 2017. Army officials acknowledged that the Near Real Time Identity Operations solution operational assessment identified major deficiencies; however, they stated that the Army had addressed the major deficiencies as of May 2017. In addition, CENTCOM determined that the solution has military utility, and CENTCOM is interested in pursuing further enhancements to meet all of its 21 operational need requirements. According to DOD Instruction 5000.02, a milestone decision authority, supported by acquisition professionals, will be assigned to oversee a rapid acquisition program such as the Near Real Time Identity Operations solution. The milestone decision authority is responsible for, among other things, overseeing the evaluation of alternative existing technologies to consider cost, schedule, performance, and operational risk before selecting a solution. However, according to DOD officials, the Army did not assign a milestone decision authority and also did not assign an office with experienced acquisition professionals to oversee the Near Real Time Identity Operations solution. DOD acquisition officials noted that if acquisition professionals had overseen the solution, they might have considered different performance, cost, or schedule trade-offs, which may have resulted in a different outcome. In 2015 DOD officials informed the Army of the need to assign a milestone decision authority, but as of May 2017 the Army had not assigned such an authority. Some Army officials told us that the office currently responsible for overseeing the Near Real Time Identity Operations solution has provided sufficient oversight. According to DOD guidance, no later than 1 year after a system enters operation and sustainment, DOD should complete a disposition analysis that recommends a course of action, including whether to retain the system. Given the absence of a milestone decision authority and the acquisition and performance challenges incurred with the Near Real Time Identity Operations solution, we believe that the department could benefit from a disposition analysis that is completed before the solution reaches operation and sustainment. A disposition analysis not only would inform DOD’s management of the Near Real Time Identity Operations solution, but also would inform the department’s other biometric and forensic acquisition programs, such as the DOD ABIS follow-on system. DOD ABIS lacks a geographically dispersed back-up capability. DOD’s mission-critical authoritative biometrics database (i.e., DOD ABIS) faces heightened operational risk because it does not have a geographically dispersed back-up capability. According to officials from across the biometric enterprise, U.S. forces rely on DOD ABIS to store and match biometric and latent fingerprint information. Without a geographically dispersed back-up, there is increased risk that if DOD ABIS were unavailable for unexpected and extended periods, U.S. forces would be unable to receive timely match/no-match information to identify enemy combatants and terrorists. DOD ABIS has a partial back-up system that is located less than 20 miles away from its primary site in West Virginia, thereby making it vulnerable to many of the same natural and man-made disasters to which the primary site is vulnerable. According to the National Institute of Standards and Technology, mission-critical information systems, such as DOD ABIS, should have a back-up capability located in a geographic area that is unlikely to be affected by the same hazards as the primary site. The Army, which has responsibility for operating and maintaining DOD ABIS, considered geographic dispersal as part of the 2015 DOD ABIS follow-on system analysis of alternatives. However, according to DOD officials, the Army has not included geographic dispersal as part of the selection criteria for the DOD ABIS follow-on system. When the Army fielded DOD ABIS in 2004 it was responding to a CENTCOM urgent need to support military operations, and therefore it focused on rapidly fielding an initial capability, according to DOD officials. At that time the Army did not develop a geographically dispersed DOD ABIS back-up capability, and it has not subsequently developed such a capability because of anticipated costs and the assumption that the existing back-up system suffices, according to DOD officials. However, DOD officials stated that the Army has an opportunity to consider the pros and cons of developing a geographically dispersed capability as part of the DOD ABIS follow-on system acquisition program. For example, one of the options under consideration entails transitioning DOD ABIS’s data to a virtual cloud format. According to DOD officials, doing so could reduce the operational risk associated with having limited geographic dispersal. DOD’s contractors face challenges in hiring and retaining qualified personnel to operate and maintain DOD ABIS. DOD ABIS’s operational risk is exacerbated by DFBA’s challenges in hiring and retaining qualified personnel to operate and maintain the system. DFBA’s Biometrics Operations Division is responsible for managing DOD ABIS’s day-to-day operations and uses contractors to support several services, including information technology security, staffing an around-the-clock watch desk to support warfighter requirements, and providing latent fingerprint examiners to adjudicate potential fingerprint matches when automated determinations are not definitive, according to officials. However, DFBA officials stated that its contractors have experienced difficulty in hiring and retaining staff for these functions because the current support contracts were issued using a lowest-price technically acceptable source selection process—that is, awarding contracts to the lowest bidder deemed technically qualified. This contracting approach limits DOD’s ability to attract bids from companies with less restrictive compensation, according to DOD officials. In contrast, a tradeoff contracting approach permits tradeoffs among cost and non-cost factors and allows a contract to be awarded to a contractor that is not the lowest bidder. According to DOD officials, a tradeoff approach could enhance the quality of contract offers and improve contractor hiring and retention through better compensation. According to DOD acquisition officials, a lowest-price technically acceptable approach should be used for basic services, such as sanitation and landscaping, and not for technical, highly-skilled services, such as information technology security and latent fingerprint examination. DFBA pursued a tradeoff approach for its DOD ABIS mission-critical functions, but a lowest- price technically acceptable approach was settled upon by Army Contracting Command, according to DFBA and Army Contracting Command officials. Specifically, DFBA’s inability to attain a tradeoff approach was caused by difficulty in completing required documentation, such as detailed job position descriptions, in a timely manner, despite DFBA’s and Army Contracting Command’s combined efforts. The National Defense Authorization Act for 2017 directs DOD to avoid the use of lowest- price technically acceptable selection criteria to acquire knowledge-based professional services such as information technology, cybersecurity, systems engineering, and technical assistance to the maximum extent practicable. Although the current DOD ABIS support contracts pre-date the passage of the Act, USD(AT&L) and DFBA officials stated that daily operation and maintenance of DOD ABIS are considered knowledge-based professional services that require highly skilled personnel to perform and therefore, consistent with the Act, the department should consider pursuing a tradeoff contracting approach when it is practicable to do so, such as during future contract solicitations. Standards for Internal Control in the Federal Government emphasizes the importance of recruiting, developing, and retaining competent personnel. DFBA’s ability to provide timely and authoritative match/no-match responses to U.S. forces engaged in ongoing operations might be negatively affected if its contractors cannot hire and retain sufficient numbers of highly skilled personnel to operate and maintain DOD ABIS’s mission- critical functions. In our prior reports on DOD’s biometric and forensic activities issued since 2011, we made 16 recommendations to enhance the biometric and forensic enterprises. As of May 2017, DOD had implemented 15 of the 16 recommendations and was making progress toward implementing the remaining recommendation, as shown in table 3. The 15 closed recommendations and additional steps DOD has taken since they were closed are summarized in appendix IV. In March 2011 we found that a biometric collection device used primarily by the Army did not meet DOD-adopted standards; and that DOD did not have a finalized biometric information-sharing agreement with the Department of Homeland Security; and we identified concerns that DOD ABIS might be unable to meet the search demands of non-DOD biometric systems. We made five recommendations addressing DOD’s process and policies for updating and testing collection devices and improving information-sharing across federal agencies. DOD has implemented each of these recommendations. For example, in January 2016 DOD updated its biometric directive that, among other things, now assigns responsibility for ensuring that its biometric-related systems conform to federal standards. In addition, in January 2016 the Assistant Secretary of Defense for Homeland Defense and Global Security, in coordination with the Department of Homeland Security, updated guidance to further improve the sharing of biometric, biographical, and identity-management data between the two departments for screening and identity-verification purposes. In April 2012 we found that biometric training for leaders did not provide instruction on the effective use of biometrics; several factors during the data transmission process limited the use of biometrics in Afghanistan; and requirements did not exist for DOD to disseminate biometric lessons learned across the department. We made seven recommendations to address these findings, six of which the department has implemented. For example, between February 2015 and January 2017 DOD approved 25 new universal joint tasks that relate to biometric and forensic training. This action is one of the first steps DOD must take in order to institutionalize biometric-related training and education to support its operational requirements. With respect to the recommendation that is not implemented, DOD officials told us that the department is taking actions to address several data transmission factors that hindered the Army’s and Marine Corps’ ability to identify (and capture) enemy combatants in Afghanistan in a timely manner. These factors include mountainous terrain, competing demands for communications infrastructure, and delays in updating hand-held biometric collection devices with the most current biometrically enabled watchlist. During this review, USD(AT&L) and military service officials told us that these data transmission factors will be analyzed and potentially addressed through the DOD ABIS follow- on system acquisition program and the CENTCOM Near Real Time Identity Operations solution. We believe that these actions will address the intent of our 2012 recommendation. DOD officials also stated that they have improved the reliability and responsiveness of DOD ABIS. From fiscal years 2014 through 2016, DOD ABIS was available more than 98 percent of the time, excluding brief scheduled periods of unavailability for system updates and planned maintenance actions. Additionally, in fiscal year 2016 DOD ABIS’s average match/no-match response time was generally between 1 and 11 minutes, depending on the prioritization level assigned to the biometric submission. In June 2013 we found that DOD’s draft forensic strategic plan was missing important elements such as milestones and metrics to gauge progress; that USD(AT&L) had not reviewed and evaluated military service and SOCOM budget estimates, as required by DOD’s forensic directive; and that DOD had not provided guidance to the military services on how they were to collect and report forensic budget data to USD(AT&L). We made four recommendations addressing DOD’s forensic strategic plan and the review and evaluation of forensic budget estimates. DOD has implemented each of these recommendations. For example, DOD issued a forensic enterprise strategy in March 2015 and a supporting implementation plan in September 2015. The strategic plan and implementation plan, when viewed together, contain several important elements for effective strategic planning, including goals, milestones, and metrics. DOD relies on its deployable biometric and forensic capabilities to support a range of military operations, including the identification and targeting of enemy combatants and terrorists. Since 2011 DOD has made considerable progress in institutionalizing these capabilities, the majority of which were developed through rapid acquisition processes and funded with OCO funds to meet urgent and emergent warfighter needs in Iraq and Afghanistan. For example, DOD has validated a number of non- materiel and materiel enduring requirements, and several of the resulting capabilities have transitioned, or are in the process of transitioning, from OCO to base funding. Furthermore, DOD has implemented almost all of our prior biometric- and forensic-related recommendations that we believe are consistent with the department’s efforts to institutionalize its deployable biometric and forensic capabilities. However, DOD’s continued success could be diminished by gaps in strategic planning documents and acquisition management challenges. Specifically, without a current biometric strategic plan and supporting implementation plan, DOD is not well positioned to prioritize and focus enterprise-wide activities. Furthermore, without a milestone decision authority to oversee DOD’s development of a Near Real Time Identity Operations solution, and a disposition analysis to recommend a path forward, DOD risks facing continued cost, schedule, and performance issues. Lastly, the ability of DOD ABIS to support future warfighter needs could be adversely impacted by not having a geographically dispersed back-up capability and challenges in hiring and retaining qualified personnel to operate and maintain the system. Addressing these strategic planning and acquisition management challenges will help DOD sustain the progress it has made toward establishing enduring deployable biometric and forensic capabilities. To enhance enterprise-wide biometric strategic planning, we recommend that the Under Secretary of Defense for Acquisition, Technology, and Logistics take the following two actions: 1. Publish an updated biometric strategic plan to identify enterprise goals 2. Publish a supporting biometric implementation plan that includes intended outcomes, measures of effectiveness, and responsibilities, among other things. To facilitate more effective and efficient acquisition management of DOD’s biometric and forensic enterprises, we recommend that the Secretary of the Army, in coordination with the Under Secretary of Defense for Acquisition, Technology, and Logistics take the following four actions: 3. Assign a milestone decision authority to oversee the Near Real Time 4. Complete a disposition analysis for the Near Real Time Identity Operations solution before the solution reaches operation and sustainment; 5. Consider including geographic dispersal as part of the selection criteria for the DOD ABIS follow-on system; and 6. Use tradeoff selection criteria, rather than lowest-price technically acceptable criteria, for determining contractor support for DOD ABIS mission-critical functions when it is practicable to do so. DOD reviewed a draft of this report and concurred with all of our recommendations. DOD also cited actions it plans to take to address them. We believe that if DOD completes the actions it outlines in its response, this will address the intent of our recommendations. DOD’s written comments are reprinted in their entirety in appendix V. We are sending copies of this report to the appropriate congressional committees; the Secretary of Defense; the Under Secretary of Defense for Acquisition, Technology, and Logistics; the Chairman, Joint Chiefs of Staff; the Secretaries of the Army, the Navy, and the Air Force; and the Commandant of the Marine Corps. In addition, the report is available at no charge on the GAO website at http://www.gao.gov If you or your staff have any questions about this report, please contact me at (202) 512-9971 or at kirschbaumj@gao.gov. Key contributors to this report are listed in appendix VI. This report evaluates the extent to which the Department of Defense (DOD) has since 2011 (1) validated enduring requirements for deployable biometric and forensic capabilities; (2) taken actions to meet enduring requirements for deployable biometric and forensic capabilities and overcome any related challenges; and (3) taken actions to address prior GAO recommendations regarding DOD’s biometric and forensic capabilities. We did not assess digital; multimedia; cyber; or chemical, biological, radiological, and nuclear forensic requirements and capabilities. To evaluate the extent to which DOD has validated enduring requirements for deployable biometric and forensic capabilities since 2011, we identified and analyzed non-materiel requirements documents drafted by the Army, as DOD’s executive agent for biometrics and forensics, and validated by the Joint Requirements Oversight Council; and compared them to DOD’s requirements validation process. We met with officials from the Defense Forensics and Biometrics Agency (DFBA) and the Army’s Training and Doctrine Command to obtain greater specificity on the objective of each non-materiel requirement. We also identified biometric and forensic materiel requirements by analyzing relevant Office of the Secretary of Defense, military service, and combatant command strategies, plans, acquisition and sustainment documents, as well as written responses to question sets provided to each of the geographic combatant commands through the Joint Staff. This included reviewing and assessing the Army’s 2015 analysis of alternatives and 2016 draft capability production document for DOD’s authoritative biometric database to identify key performance requirements for the department’s follow-on biometric database. We discussed the materiel biometric and forensic requirements with Joint Staff, military service, combatant command, and DFBA officials responsible for requirements planning and oversight to understand the requirements validation process for materiel solutions. We also met with geographic combatant command officials and analyzed the commands’ written responses to a questionnaire to better understand their current and anticipated demand for biometric and forensic capabilities. To evaluate the extent to which DOD has taken actions to meet enduring requirements for deployable biometric and forensic capabilities since 2011, we reviewed and analyzed relevant planning, acquisition, and sustainment documents, including emergent and urgent operational needs statements, analyses of alternatives, and capability development documents, to identify any challenges and gaps in meeting validated joint requirements. During the course of our analysis, we determined that a DOD-reported completion status of 75 percent or more was reflective of the validated non-materiel requirement having made significant progress. We also compared the content and process for developing DOD’s biometric and forensic strategic plans with Standards for Internal Controls in the Federal Government for control activities to determine their enterprise utility. In addition, we compared federal information systems guidance on contingency planning with acquisition planning and development documents for DOD’s follow-on authoritative biometric database. Furthermore, we reviewed and compared contracting information for providing service contracts to DFBA’s Biometrics Operations Division, which manages the authoritative biometric database, with contracting provisions in the National Defense Authorization Act for Fiscal Year 2017 discouraging the use of lowest-price technically acceptable selection criteria in certain types of procurements. Finally, we met with Office of the Secretary of Defense, Joint Staff, military service, Special Operations Command (SOCOM), geographic combatant command, and DFBA officials responsible for biometric and forensic activities to determine the status of DOD’s deployable non-materiel and materiel biometric and forensic capabilities, current and anticipated funding sources for materiel solutions, and estimated timeframes for completion. To evaluate the extent to which DOD has taken actions to address our prior recommendations regarding its biometric and forensic capabilities since 2011, we reviewed our internal recommendation tracking system for status updates. We also analyzed DOD directives, guidance, and plans that had been updated or released since 2011, and written responses to our question set from each of the geographic combatant commands to determine whether the department had taken actions that met the intent of our recommendations. Finally, we met with program management, planning, and acquisition officials from the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD(AT&L)) and the military services to gather information and clarification on additional steps the department had taken or planned to take to address our prior recommendations. To address our three reporting objectives, we met with biometric and forensic acquisition, operations, planning, and programming officials from the DOD organizations identified in table 4. We also met with officials from the Center for Naval Analyses to discuss their body of work on DOD biometrics and forensics. Between 2013 and 2014, DOD validated 30 non-materiel enduring requirements for its deployable biometric and forensic capabilities. These requirements are designed to transition DOD’s biometric and forensic capabilities, over a multi-year period, from rapidly acquired and OCO- funded capabilities to enduring capabilities resourced through base funding. The status and anticipated completion date of each requirement is detailed in table 5. As of May 2017, DOD had implemented 15 of 16 recommendations from our prior reports. Table 6 summarizes the 15 closed recommendations and additional steps that DOD has taken since they were closed. In addition to the contact above, Marc Schwartz, Assistant Director; David Adams; Vincent Buquicchio; Pamela Davidson; Richard Hung; Amber Lopez Roberts; Paul Seely; Sarah Warmbein; and Cheryl Weissman made key contributions to this report. Defense Forensics: Additional Planning and Oversight Needed to Establish an Enduring Expeditionary Forensic Capability. GAO-13-447. Washington, D.C.: June 27, 2013. Afghanistan: Key Oversight Issues. GAO-13-218SP. Washington, D.C.: February 11, 2013. Defense Biometrics: Additional Training for Leaders and More Timely Transmission of Data Could Enhance the Use of Biometrics in Afghanistan. GAO-12-442. Washington, D.C.: April 23, 2012. Afghan Security: Renewed Sharing of Biometric Data Could Strengthen U.S. Efforts to Protect U.S. Personnel from Afghan Security Force Attacks. GAO-12-471SU. Washington, D.C.: April 20, 2012. Defense Biometrics: DOD Can Better Conform to Standards and Share Biometric Information with Federal Agencies. GAO-11-276. Washington, D.C.: March 31, 2011. Defense Management: DOD Can Establish More Guidance for Biometrics Collection and Explore Broader Data Sharing. GAO-09-49. Washington, D.C.: October 15, 2008. Defense Management: DOD Needs to Establish Clear Goals and Objectives, Guidance, and a Designated Budget to Manage Its Biometrics Activities. GAO-08-1065. Washington, D.C.: September 26, 2008.

Summary: Since 2008 DOD has used biometric and forensic capabilities to capture or kill 1,700 individuals and deny 92,000 individuals access to military bases. These capabilities were mainly developed through rapid acquisition processes and were resourced with Overseas Contingency Operations funds—funds that are provided outside of DOD's base budget process. As a result, concerns have been raised about DOD's long-term ability to fund these capabilities. The House Armed Services Committee and House Permanent Select Committee on Intelligence included provisions in committee reports for GAO to review DOD's progress in institutionalizing deployable biometric and forensic capabilities. This report examines, among other issues, the extent to which DOD since 2011 has (1) validated long-term requirements for deployable biometric and forensic capabilities; and (2) taken actions to meet long-term requirements for deployable biometric and forensic capabilities and overcome any related challenges. GAO examined DOD directives, strategies, policies, plans, and requirements and met with cognizant DOD officials. The Department of Defense (DOD) has validated its requirements for long-term deployable biometric capabilities (such as fingerprint collection devices) and forensic capabilities (such as expeditionary laboratories). Biometric capabilities are used to identify individuals based on measurable anatomical, physiological, and behavioral characteristics such as fingerprints, iris scans, and voice recognition. Forensic capabilities support the scientific analysis of evidence—such as deoxyribonucleic acid (DNA) and latent fingerprints—to link persons, places, things, and events. DOD utilizes deployable biometric and forensic capabilities to support a range of military operations, such as targeting, force protection, and humanitarian assistance. DOD has made significant progress in addressing its long-term requirements for deployable biometric and forensic capabilities, such as issuing new doctrine and establishing long-term funding for several capabilities, including DOD's authoritative biometric database that is used for identifying enemy combatants and terrorists. However, DOD's efforts to institutionalize these capabilities are limited by the following strategic planning gaps and acquisition management challenges: While DOD has a current and approved forensic strategic plan, it does not have one for its biometric capabilities, because no entity has been assigned responsibility for developing such a plan, according to DOD officials. The Army did not follow DOD's acquisition protocols in developing a recent key biometric capability, and it may have missed an opportunity to leverage existing, viable, and less costly alternatives. DOD's authoritative biometric database that is used for identifying enemy combatants and terrorists does not have a geographically dispersed back-up capability to protect against threats such as natural hazards. Having such a back-up could enhance the database's availability. Addressing these strategic planning and acquisition management challenges could help DOD sustain the progress it has made to establish enduring deployable biometric and forensic capabilities. The photographs above depict a warfighter obtaining a biometric iris image (left) and a forensic investigator collecting a latent fingerprint (right). GAO is making 6 recommendations, including that DOD update its biometric enterprise strategic plan; take steps to more effectively manage the acquisition of a recent biometric capability; and consider developing a geographically dispersed back-up capability for its authoritative biometric database. DOD concurred with all of the recommendations and cited actions it plans to take to address them.