To accomplish its mission of protecting federal facilities, FPS has become increasingly reliant on its guard force. As of June 2009, FPS’s guard program has cost $613 million and represents the single largest item in its fiscal year 2009 budget. While the contractor has the primary responsibility for training and ensuring that the guards have met certification requirements, FPS is responsible for oversight of the guards and relies on about 930 law enforcement personnel located in its 11 regions to inspect guard posts and verify that training, certifications, and timecards are accurate. Figure 1 shows the location of FPS’s 11 regions and the number of guards and federal facilities with guards in each of these regions. Some of the key responsibilities of FPS’s guards include controlling access; enforcing property rules and regulations; detecting and reporting criminal acts; and responding to emergency situations involving the safety and security of the facility. Guards may only detain, not arrest, an individual, and their authority typically does not extend beyond the facility. Before being assigned to a post or an area of responsibility at a federal facility, FPS requires that all guards undergo background suitability checks and complete approximately 128 hours of training provided by the contractor or FPS, including 8 hours of x-ray and magnetometer training. Guards must also pass an FPS-administered written examination and possess the necessary certificates, licenses, and permits as required by the contract. Table 1 shows the training and certifications that FPS requires its guards to (1) obtain before standing post and (2) maintain during the course of their employment. FPS also requires its guards to complete 40 hours of refresher training every 2 to 3 years depending on the terms of the contract. In addition to FPS’s requirements, some states require that guards obtain additional training and certifications. FPS currently has contracts with 67 private companies for guard services. These contractors are responsible for providing and maintaining all guard services as described in the contract statement of work, including management, supervision, training, equipment, supplies and licensing. FPS is also required to actively monitor and verify the contractors’ performance and ensure that the terms of the contract are met. FPS does not fully ensure that its guards have the training and certifications required to be deployed to a federal facility. While FPS requires that all prospective guards complete approximately 128 hours of training, including 8 hours of x-ray and magnetometer training, it was not providing some of its guards with all of the required training in the six regions we visited. For example, in one region, FPS has not provided the required 8 hours of x-ray or magnetometer training to its 1,500 guards since 2004. X-ray and magnetometer training is important because the majority of the guards are primarily responsible for using this equipment to monitor and control access points at federal facilities. Controlling access and egress to a facility helps ensure that only authorized personnel, vehicles, and materials are allowed to enter, move within, and leave the facility. According to FPS officials, the 1,500 guards were not provided the required x-ray or magnetometer training because the region does not have the employees that are qualified or who have the time to conduct the training. Nonetheless, these guards continue to control access points at federal facilities in this region. In absence of the x-ray and magnetometer training, one contractor in the region said that they are relying on veteran guards who have experience operating these machines to provide some “on-the-job” training to new guards. Moreover, in the other five regions we visited where FPS is providing the x-ray and magnetometer training, some guards told us that they believe the training, which is computer based, is insufficient because it is not conducted on the actual equipment located at the federal facility. Lapses and weaknesses in FPS’s x-ray and magnetometer training have contributed to several incidents at federal facilities in which the guards were negligent in carrying out their responsibilities. For example, at a level IV federal facility in a major metropolitan area, an infant in a carrier was sent through the x-ray machine. Specifically, according to an FPS official in that region, a woman with her infant in a carrier attempted to enter the facility, which has child care services. While retrieving her identification, the woman placed the carrier on the x-ray machine. Because the guard was not paying attention and the machine’s safety features had been disabled, the infant in the carrier was sent through the x-ray machine. FPS investigated the incident and dismissed the guard. However, the guard subsequently sued FPS for not providing the required x-ray training. The guard won the suit because FPS could not produce any documentation to show that the guard had received the training, according to an FPS official. In addition, FPS officials from that region could not tell us whether the x- ray machine’s safety features had been repaired. We also found that some guards were not provided building-specific training, such as what actions to take during a building evacuation or a building emergency. This lack of training may have contributed to several incidents where guards neglected their assigned responsibilities. For example, at a level IV facility, the guards did not follow evacuation procedures and left two access points unattended, thereby leaving the facility vulnerable; at a different level IV facility, the guard allowed employees to enter the building while an incident involving suspicious packages was being investigated; and, at a level III facility, the guard allowed employees to access the area affected by a suspicious package, which was required to be evacuated. In addition to insufficient building-specific training, some guards said they did not receive scenario-based training and thus were not sure what they should do in certain situations. During our site visits at 6 FPS regions, we interviewed over 50 guards and presented them with an incident that occurred at a federal facility in 2008. Specifically, we asked the guards whether they would assist an FPS inspector chasing an individual escaping a federal facility in handcuffs. The guards’ responses varied. Some guards stated that they would assist the FPS inspector and apprehend the individual, while others stated that they would likely do nothing and stay at their post because they feared being fired for leaving their post. Some guards also told us that they would not intervene because of the threat of a liability suit for use of force and did not want to risk losing their job. The guard’s different responses suggest that more scenario-based training may be needed. FPS’s primary system—CERTS—for monitoring and verifying whether guards have the training and certifications required to stand post at federal facilities is not fully reliable. We reviewed training and certification data for 663 randomly selected guards in 6 of FPS’s 11 regions maintained either in CERTS, which is the agency’s primary system for tracking guard training and certifications, databases maintained by some of FPS’s regions, or contractor information. We found that 62 percent, or 411 of the 663 guards who were deployed to a federal facility had at least one expired certification, including for example, firearms qualification, background investigation, domestic violence declaration, or CPR/First Aid training certification. More specifically, according to the most recent information from a contractor, we found that over 75 percent of the 354 guards at one level IV facility had expired certifications, or the contractor had no record of the training. Based on the contractor information for another contract, we also found that almost 40 percent of the 191 guards at another level IV facility had expired domestic violence declarations. Without domestic violence declarations certificates, guards are not permitted to carry a firearm. FPS requires its guards to carry weapons in most cases. Moreover, five of the six regions we visited did not have current information on guard training and certifications. According to FPS officials in these five regions, updating CERTS is time consuming and they do not have the resources needed to keep up with the thousands of paper files. Consequently, these five regions were not generally relying on CERTS and instead were relying on the contractor to self-report training and certification information about its guards. In addition, not having a fully reliable system to better track whether training has occurred may have contributed to a situation in which a contractor allegedly falsified training records. In 2007, FPS was not aware that a contractor who was responsible for providing guard service at several level IV facilities in a major metropolitan area had allegedly falsified training records until it was notified by an employee of the company. According to FPS’s affidavit, the contractor allegedly repeatedly self-certified to FPS that its guards had satisfied CPR and First Aid training, as well as the contractually required bi-annual recertification training, although the contractor knew that the guards had not completed the required training and was not qualified to stand post at federal facilities. According to FPS’s affidavit, in exchange for a $100 bribe, contractor officials provided a security guard with certificates of completion for CPR and First Aid. The case is currently being litigated in U.S. District Court. FPS has limited assurance that its 13,000 guards are complying with post orders. FPS does not have specific national guidance on when and how guard inspections should be performed. FPS’s inspections of guard posts at federal facilities are inconsistent and the quality and rigor of its inspections varies across regions. At each guard post, FPS maintains a book, referred to as post orders, that describes the duties that guards are to perform while on duty. However, we found that in one region some of the post orders were not current and dated back to 2002 when FPS was part of GSA. In addition, the frequency with which FPS inspects these posts varied. For example, one region we visited required its inspectors to complete 5 guard inspections each month, while another region we visited did not have any inspection requirements. According to the regional staff, there is no requirement that every guard post be inspected each month; rather inspectors are required to complete 5 inspections per month which leads to some guard posts being inspected multiple times per month and some guard posts not being inspected at all. For example, while we were observing guard inspections in this region, one guard told us she had been inspected twice that week. In contrast, according to FPS officials, guards assigned to posts at federal facilities in remote locations or during the night shift are rarely inspected. During our site visits we also found that the quality of FPS’s guard inspections varied. According to FPS’s procedures for conducting guard inspections, FPS should inspect the guard’s uniform and equipment, knowledge of post orders, and ID and certification cards. For example, an inspector in one region performed a more thorough inspection than other inspectors. The inspector included an inspection of guard certifications, knowledge of post orders, uniform and equipment check, inspection of the post station, and timecards. The inspector also asked the guard a number of scenario-based questions and asked the guard if he had any questions or concerns. The results of the inspection were documented immediately following the inspection. Conversely, in a different FPS region we visited, the FPS inspector asked the guard if all his certifications and training were current; but never physically inspected the guard’s certifications or asked any scenario-based questions. During another inspection we observed, an inspector in another region performed a uniform and equipment check but did not ask for any certifications. We also found that in the 6 regions we visited that guard inspections are typically completed by FPS during regular business hours and in cities where FPS has a field office. In most FPS regions, FPS is only on duty during regular business hours and according to FPS, inspectors are not authorized overtime to perform guard inspections during night shifts or on weekends. However, on the few occasions when inspectors complete guard inspections at night or on their own time, FPS has found instances of guards not complying with post orders. For example, as shown in figure 2, at a level IV facility, an armed guard was found asleep at his post after taking the pain killer prescription drug Percocet during the night shift. FPS’s guard manual states that guards are not permitted to sleep or use any drugs (prescription or non-prescription) which may impair the guard’s ability to perform duties. FPS’s post orders also describe a number of items that guards are prohibited from doing while on post. For example, guards are prohibited from sleeping, using government property such as computers, and test firing a weapon unless at a range course. However, FPS has found incidents at level IV facilities where guards were not in compliance with post orders. Some examples follow. A guard was caught using government computers, while he was supposed to be standing post, to further his private for-profit adult website. A guard attached a motion sensor to a pole at the entrance to a federal facility garage to alert him whenever a person was approaching his post. Another law enforcement agency discovered the device and reported it to FPS. A guard, during regular business hours, accidentally fired his firearm in a restroom while practicing drawing his weapon. A guard failed to recognize or did not properly x-ray a box containing semi-automatic handguns at the loading dock at one federal facility we visited. FPS only became aware of the situation because the handguns were delivered to FPS. While the guards were fired or disciplined in each of these incidents, they illustrate that FPS is able to identify some instances where guards are not complying with post orders and the importance of why it should improve the oversight of its guard program. We identified substantial security vulnerabilities related to FPS’s guard program. Each time they tried, in April and May 2009, our investigators successfully passed undetected through security checkpoints monitored by FPS’s guards, with the components for an IED concealed on their persons at 10 level IV facilities in four cities in major metropolitan areas. The specific components for this device, items used to conceal the device components, and the methods of concealment that we used during our covert testing are classified, and thus are not discussed in this testimony. Of the 10 level IV facilities we penetrated, 8 were government owned and 2 were leased facilities. The facilities included field offices of a U.S Senator and U.S. Representative as well as agencies of the Departments of Homeland Security, Transportation, Health and Human Services, Justice, State and others. The two leased facilities did not have any guards at the access control point at the time of our testing. Using publicly available information, our investigators identified a type of device that a terrorist could use to cause damage to a federal facility and threaten the safety of federal workers and the general public. The device was an IED made up of two parts—a liquid explosive and a low-yield detonator—and included a variety of materials not typically brought into a federal facility by employees or the public. Although the detonator itself could function as an IED, investigators determined that it could also be used to set off a liquid explosive and cause significantly more damage. To ensure safety during this testing, we took precautions so that the IED would not explode. For example, we lowered the concentration level of the material. To gain entry into each of the 10 level IV facilities, our investigators showed photo identification (state driver’s license) and walked through the magnetometer machines without incident. The investigators also placed their briefcases with the IED material on the conveyor belt of the x- ray machine, but the guards detected nothing. Furthermore, our investigators did not receive any secondary searches from the guards which might have revealed the IED material that we brought into the facilities. At security checkpoints at 3 of the 10 facilities, our investigators noticed that the guard was not looking at the x-ray screen as some of the IED components passed through the machine. A guard questioned an item in the briefcase at one of the 10 facilities but the materials were subsequently allowed through the x-ray machines. At each facility, once past the guard screening checkpoint, our investigators proceeded to a restroom and assembled the IED. At some of the facilities, the restrooms were locked. Our investigators gained access by asking employees to let them in. With the IED completely assembled in a briefcase, our investigators walked freely around several floors of the facilities and into various executive and legislative branch offices, as described above. Because of the sensitivity of our review, we have already briefed FPS and GSA on the results of our covert testing at 10 level IV facilities and other preliminary findings regarding the guard program. FPS subsequently identified and began taking several actions in response to our findings. According to FPS officials, it recently authorized the use of overtime to monitor guards during non-routine business hours and is requiring penetration tests to identify weaknesses at access control guard posts. FPS has conducted limited intrusion testing in the past and experienced difficulty in executing such tests. For example, in 2008, one FPS region conducted an intrusion test at a level IV facility and successfully brought a “fake bomb” into the building through a loading area. During the test, FPS agents misplaced the box containing the “fake bomb” and it was picked up by a guard who took it to the mail room for processing. It was opened by the guard who panicked. After this incident, the intrusion testing program in that region was cancelled, according to FPS officials in that region. FPS has also accelerated the implementation of a new directive designed to clarify organizational responsibilities for conducting and reporting the results of inspections and evaluations. For example, under the March 2009 directive, at a level IV facility, FPS is planning to inspect 2 guard posts a week. Prior to the new directive, FPS did not have a national requirement for when to conduct inspections at federal facilities and each region we visited had requirements that ranged from no inspection requirements to each inspector having to conduct 5 inspections per month. Meeting these new requirements may be challenging, according to FPS management and regional staff we contacted. FPS management in several regions we visited told us that the new directive appears to be based primarily on what works well from a headquarters or National Capital Region perspective, not a regional perspective that reflects local conditions and limitations in staffing resources. A FPS official in one region also said the region is not adequately staffed to complete all the current mission-essential tasks that are required, and another FPS official in that region does not believe the region will be able to conduct the additional inspections as required in the new policy. Finally, according to the Director of FPS, while having more resources would help address the weaknesses in the guard program, the additional resources would have to be trained and thus could not be deployed immediately. We provided FPS a detailed briefing on June 5, 2009 on our preliminary findings. We also provided FPS with a draft of this testimony. FPS provided no comments on this testimony. We plan to provide this Committee with our complete evaluation and a final report on FPS’s oversight of its guard program in September 2009. This concludes our testimony. We are pleased to answer any questions you might have. For further information on this testimony, please contact Mark Goldstein at 202-512-2834 or by email at goldsteinm@gao.gov. Individuals making key contributions to this testimony include Jonathan Carver, Tammy Conquest, John Cooney, Colin Fallon, Daniel Hoy, George Ogilvie, Susan Michal-Smith, and Ramon Rodriguez. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: To accomplish its mission of protecting about 9,000 federal facilities, the Federal Protective Service (FPS) currently has a budget of about $1 billion, about 1,200 full time employees, and about 13,000 contract security guards. This testimony discusses GAO's preliminary findings on (1) the extent to which FPS ensures that its guards have the required training and certifications before being deployed to a federal facility, (2) the extent to which FPS ensures that its guards comply with their assigned responsibilities (post orders) once they are deployed at federal facilities, and (3) security vulnerabilities GAO recently identified related to FPS's guard program. To address these objectives, GAO conducted site visits at 6 of FPS's 11 regions, interviewed numerous FPS officials, guards, contractors, and analyzed FPS's policies and data. GAO also conducted covert testing at 10 judgmentally selected level IV facilities in four cities. A level IV facility has over 450 employees and a high volume of public contact. FPS does not fully ensure that its contract security guards have the training and certifications required to be deployed to a federal facility. FPS requires that all prospective guards complete about 128 hours of training including 8 hours of x-ray and magnetometer training. However, in one region, FPS has not provided the x-ray or magnetometer training to its 1,500 guards since 2004. Nonetheless, these guards are assigned to posts at federal facilities. X-ray training is critical because guards control access points at facilities. Insufficient x-ray and magnetometer training may have contributed to several incidents where guards were negligent in carrying out their responsibilities. For example, at a level IV facility, an infant in a carrier was sent through an x-ray machine due to a guard's negligence. Moreover, GAO found that FPS does not have a fully reliable system for monitoring and verifying guard training and certification requirements. GAO reviewed 663 randomly selected guard records and found that 62 percent of the guards had at least one expired certification including a declaration that guards have not been convicted of domestic violence, which make them ineligible to carry firearms. FPS has limited assurance that its guards are complying with post orders. FPS does not have specific national guidance on when and how guard inspections should be performed. FPS's inspections of guard posts at federal facilities are inconsistent and the quality varied in the six regions GAO visited. GAO also found that guard inspections are typically completed by FPS during regular business hours and in locations where FPS has a field office; and seldom on nights and on weekends. However, on an occasion when FPS did conduct a post inspection at night it found a guard asleep at his post after taking the pain killer prescription drug Percocet. FPS also found other incidents at level IV facilities where guards neglected or inadequately performed their assigned responsibilities. For example, a guard failed to recognize or did not properly x-ray a box containing handguns at the loading dock at a facility. FPS became aware of the situation because the handguns were delivered to FPS. GAO identified substantial security vulnerabilities related to FPS's guard program. GAO investigators carrying the components for an improvised explosive device successfully passed undetected through security checkpoints monitored by FPS's guards at each of the 10 level IV federal facilities where GAO conducted covert testing. Of the 10 level IV facilities GAO penetrated, 8 were government owned, 2 were leased, and included offices of a U.S. Senator and U.S. Representative, as well as agencies such as the Departments of Homeland Security, State, and Justice. Once GAO investigators passed the control access points, they assembled the explosive device and walked freely around several of floors of these level IV facilities with the device in a briefcase. In response to GAO's briefing on these findings, FPS has recently taken some actions including increasing the frequency of intrusion testing and guard inspections. However, implementing these changes may be challenging, according to FPS.