Since the 1998 embassy bombings in East Africa, State has constructed more than 100 new diplomatic facilities and enhanced security measures at many others. Increased security at these facilities has raised concerns that would-be attackers may shift their focus to more easily accessible “soft targets”—places frequented by Americans and other Westerners, as well as their transportation routes. According to State, U.S. government employees and their families are most at risk on these transportation routes. Many of the worst attacks on U.S. diplomatic personnel—including 10 of the 19 attacks that prompted State to convene ARBs—occurred while victims were in transit. Among these was the 2004 murder of a U.S. diplomat in Iraq, which led the resulting February 2005 ARB to find that the diplomat’s death was almost certainly caused by his failure to follow the post’s security policy. The February 2005 Iraq ARB report consequently recommended several actions intended to increase post personnel’s compliance with security policy and personal security practices, which are discussed in more detail later in this report. Figure 1 shows the locations of the 10 transportation-related attacks that resulted in the formation of ARBs, and figure 2 depicts an August 2008 attack against the Principal Officer at the U.S. consulate general in Peshawar, Pakistan, shortly after she left her residence. According to State, transportation security overseas is a shared responsibility involving various entities. As established by the 1961 Vienna Convention on Diplomatic Relations, the host nation is responsible for providing protection to diplomatic personnel and missions. In addition, as required by the Omnibus Diplomatic Security and Antiterrorism Act of 1986, the Secretary of State, in consultation with the heads of other federal agencies, is responsible for developing and implementing policies and programs to protect U.S. government personnel on official duty abroad, along with their accompanying dependents. At posts abroad, chiefs of mission are responsible for the protection of personnel and accompanying family members at the mission. Further, as the February 2005 Iraq ARB noted, all mission personnel bear “personal responsibility” for their own and others’ security. Lead operational responsibility for transportation security overseas falls on DS, which is responsible for establishing and operating security and protective procedures at posts. For example, one division within DS manages State’s armored vehicle program, while another manages a contract used to provide transportation security in certain high- and critical-threat locations. DS also evaluates the security situation at each overseas post by assessing five types of threats—political violence, terrorism, crime, and two classified categories—and assigning corresponding threat levels for each threat type in the annually updated Security Environment Threat List. The threat levels are as follows: critical: grave impact on U.S. diplomats; high: serious impact on U.S. diplomats; medium: moderate impact on U.S. diplomats; and low: minor impact on U.S. diplomats. At posts, DS agents known as RSOs, including deputy RSOs and assistant RSOs, are responsible for protecting personnel and property. Among other things, RSOs are responsible for issuing transportation security and travel notification policies, providing security briefings to newly arrived personnel, and communicating information about threats to post personnel. According to State officials, RSOs at certain locations are also responsible for managing the post’s fleet of armored vehicles, while at other locations this responsibility is assumed by the general services office as part of its management of the post’s overall vehicle fleet. State’s policies are outlined in the FAM and corresponding FAH. Sections of the FAM and FAH pertinent to transportation security include various subchapters detailing, among other things elements that all security directives, including transportation-related policies, are required to include; State’s armored vehicle program; and personal security practices for employees to follow. See table 1 for further details on selected FAM and FAH policies that are relevant to transportation security. In addition to these policies, State has produced other guidance documents, such as a checklist that outlines criteria for DS reviewers to use when evaluating posts’ security policies and programs, including those related to transportation security, and cables that reiterate the recommendations of the February 2005 Iraq ARB and the importance of good personal security practices. State uses a variety of means to provide transportation security for U.S. personnel posted overseas. These include, but are not limited to, the following: Armored vehicles. In fiscal years 2011 through 2016, State obligated more than $310 million for armored vehicles, such as sport utility vehicles, vans, and sedans. Security contractors and bodyguards. Through the Worldwide Protective Services contract, DS has hired private security contractors to provide transportation security for diplomatic missions in certain high- and critical-threat areas. State obligated more than $2.7 billion for this contract in fiscal years 2011 through 2016. According to DS officials, DS also uses host nation police, local guard force personnel, U.S. government protective agents, or a combination of all three as bodyguards in more than 100 countries worldwide. State obligated more than $150 million for such bodyguards in fiscal years 2011 through 2016. State has established policies related to transportation security for overseas U.S. personnel, but gaps exist in guidance and monitoring. We reviewed 26 posts and found that each had issued a transportation security policy and a travel notification policy. However, the policies at 22 of the 26 posts were missing elements required by State, due in part to fragmented guidance on what such policies should include. State also lacks a clear armored vehicle policy for overseas posts and effective procedures for monitoring whether posts are assessing their armored vehicle needs at least annually, as required by State. These gaps limit State’s ability to ensure that posts develop policies that are clear and consistent with State requirements and that vehicle needs for secure transit are met. Federal internal control standards state that in order to enable personnel to perform key roles in achieving agency objectives and addressing risks, management should develop policies that outline personnel’s responsibilities in a complete, accurate, and clear manner. DS encourages every post to issue a transportation security policy and a travel notification policy. Because DS requires that these policies be issued as security directives, they are subject to criteria that apply to all security directives. Specifically, the February 2005 Iraq ARB recommended that all security directives include six elements intended to emphasize the personal security responsibilities of all personnel under chief-of-mission authority (see table 2). For example, the ARB report recommended that security directives, among other things, identify the consequences of violations and oblige all members of the mission to report any known or suspected violations. After accepting these recommendations, State promulgated them to all posts through multiple cables as well as the FAM. DS requires all security directives to include the six elements recommended by the February 2005 Iraq ARB. According to DS, transportation security and travel notification policies are required to include additional standard elements so that U.S. personnel and their families are aware of the potential transportation-related security risks they may face while at post. Specifically, transportation security policies are required by DS to clarify, among other things, if the use of public transit is permitted and whether any zones are off-limits to U.S. personnel, while travel notification policies are required to ensure that both official and personal travel are appropriately approved and conducted with appropriate vehicles, escort, and notification. Each of the 26 posts we reviewed had issued a transportation security policy and a travel notification policy. We found that 4 posts had issued policies that met all the required criteria while 22 posts had not. Specifically, 20 of 26 were missing one or more of the six elements required by DS in all security directives as recommended by the February 2005 Iraq ARB (see table 2), and 4 of 26 did not include all of the standard transportation-related elements required by DS (see table 3). Compliance with the standard transportation-related elements required was significantly higher (85 percent of the posts we reviewed) than compliance with the six elements required in all security directives as recommended by the February 2005 Iraq ARB (23 percent of the posts we reviewed). Two key factors contribute to these shortcomings in posts' transportation security and travel notification policies. First, no single source of guidance for RSOs on transportation security and travel notification policies lists all of the elements the policies at the posts are required to contain. Specifically, DS has produced multiple sources of guidance on what posts are to include in transportation security and travel notification policies, but each source covers a different set of requirements. For example, before a post security evaluation is conducted, RSOs are given a copy of the checklist used for the evaluation to help guide them in identifying and complying with security program requirements. While the checklist includes the standard transportation-related elements required by DS, such as the use of public transit and restricted zones, it does not list all of the elements required by DS in all security directives as recommended by the February 2005 Iraq ARB—a potential reason why the policies we reviewed were five times more likely to be missing the ARB elements than the standard transportation-related elements. By contrast, the FAM chapter on security directives contains the February 2005 Iraq ARB criteria but does not list any of the standard transportation-related elements required by DS. RSOs at 3 of the 9 posts we visited noted that it would be helpful if DS provided examples of model policies to use as guidance. DS is in the process of developing standard templates for certain security directives, including transportation security and travel notification policies, but this effort is not yet complete. Second, DS’s monitoring of post transportation policies lacks any additional guidance to ensure that reviewers assess policies consistently in order to identify any missing policy elements and suggest corrective action. Specifically, we found that DS reviewers lack a comprehensive set of criteria for evaluating posts’ transportation security and travel notification policies. DS officials told us that DS reviewers are expected to look for the February 2005 Iraq ARB criteria during their evaluations of post security directives, but as noted earlier the checklist that DS reviewers use does not mention the February 2005 Iraq ARB or list its criteria. Further, while DS officials stated that security directives lacking the February 2005 Iraq ARB criteria should receive lower scores, we found that several of the posts’ transportation policies that were lacking these required elements nevertheless received the highest possible score from DS reviewers. In January 2016, DS updated the checklist reviewers use to assess transportation security and travel notification policies by adding a reference to the FAM section that lists the February 2005 Iraq ARB criteria. Although citing the relevant FAM section is helpful, the checklist does not include all the actual requirements. Due to these weaknesses in its guidance and monitoring, State has no assurance that all of its posts are developing transportation-related policies that are comprehensive and consistent with department policy. As noted earlier, federal internal control standards state that agencies should develop policies that outline responsibilities in a complete, accurate, and clear manner to enable personnel to perform key roles in achieving agency objectives and addressing risks. The FAH establishes a minimum requirement for the number of armored vehicles at each post. The FAH also states that post Emergency Action Committees (EAC) must meet at least annually to discuss post armored vehicle programs and requirements. According to the FAM, it is important that EACs provide information on posts’ armored vehicle requirements to ensure there is sufficient time to budget for the costs of such vehicles, including the extra costs associated with armoring them. We found that DS may not be meeting the first of these FAH requirements, and EACs are not meeting the second requirement at every post. With respect to the first requirement, DS officials initially explained that under the FAH, every embassy and consulate is required to have a certain number of armored vehicles, but we found that not every consulate met this requirement as of May 2016. These potential deficiencies exist in part because DS has not instituted effective monitoring procedures to ensure that every embassy or consulate is in compliance with the FAH’s armored vehicle policy. Regarding the second requirement, DS officials in the armored vehicle program office told us that they do not receive annual assessments of post armored vehicle needs from all posts as required. This deficiency exists because DS lacks a mechanism for monitoring whether EACs meet at least annually to discuss their posts’ armored vehicle needs. Furthermore, DS officials in the armored vehicle program office stated that, unlike some other offices within DS and State’s regional bureaus, their office cannot compel post officials to hold EACs because overseas posts do not fall within their office’s chain of command. Without up-to-date information on posts’ armored vehicle needs, State cannot be certain that posts have the vehicles necessary to provide U.S. personnel and their families with secure transportation. DS officials told us that the lack of regular EAC assessment of the armored vehicle needs at each post also creates procurement challenges for armored vehicles aside from those used by chiefs of mission and principal officers, which the program office proactively replaces as needed. For all other armored vehicles, individual posts communicate their armored vehicle needs to the program office throughout the year as these needs arise. As a result, the program office orders vehicles in smaller numbers or waits until multiple orders come in, according to DS officials. This leads to avoidable delays because less urgent needs are not filled until the office receives enough requests to justify processing an order. Urgent vehicle needs are processed immediately, but DS officials told us this is inefficient because processing an order for one or two vehicles requires the same investment of time as a much larger request. While DS is taking steps to address the lack of annual EAC assessment of post armored vehicle needs, it is unclear if the planned steps will fully address the problem. In May 2016, DS released a cable to all posts to reiterate the annual requirement, and DS stated that it plans to work through RSOs at post to ensure that EACs meet at least annually. However, DS has not developed a mechanism to track whether the EACs actually do so. According to DS officials, the program office is also planning to develop a forecasting model to overcome some of the obstacles related to the lack of regular assessment, but the accuracy of this forecasting will ultimately depend on the timely submission of quality information from posts. State provides several types of training related to transportation security, but weaknesses exist in post-specific refresher training and State’s tracking of armored vehicle driver training. RSOs receive required training related to transportation security in special agent courses, and nonsecurity staff reported receiving relevant training before departing for posts and new arrival briefings at posts. Staff at most of the posts we visited either had difficulty remembering certain key details covered in the new arrival briefings or described the one-time briefings as inadequate. State lacks a clear requirement to provide periodic refresher briefings and for post personnel to participate in such briefings, potentially putting them at increased risk. Additionally, we found gaps or errors in State’s tracking of armored vehicle driver training; State is taking steps to address these problems. Federal internal control standards state that appropriate training, aimed at developing employee knowledge, skills, and abilities, is essential to an agency’s operational success. It is vital that U.S. diplomatic personnel— including RSOs as well as nonsecurity staff—receive training on the transportation-related security risks they may face overseas and how best to manage them in order to facilitate mission-related outcomes while protecting lives and property. As table 4 shows, State provides a number of training courses, targeting different audiences, that cover transportation security. For example, RSOs receive training in various tactics related to transportation security in the Basic Special Agent Course, which is required of all DS special agents, as well as in other training courses, such as the High Threat Operations Course (see fig. 3). With respect to non-RSO personnel, one or more participants in most of the focus groups we conducted mentioned that they had taken Foreign Affairs Counter Threat training. According to State, by 2019, all personnel posted overseas under chief-of-mission authority, with certain exceptions, will be required to take this training regardless of where they are posted. Foreign Affairs Counter Threat training covers several topics relevant to transportation security, such as defensive driving, route analysis, and the importance of taking personal responsibility for one’s security and varying routes and times to reduce one’s predictability. Figure 4 shows examples of transportation security-related elements of the Foreign Affairs Counter Threat training. Additionally, focus group participants stated that they had received new arrival briefings from the RSO upon their arrival at post. According to the FAM, new arrival briefings are to be comprehensive and are to acquaint newly arrived personnel with the post’s “total security environment,” including security requirements and procedures that are in effect, such as travel notification requirements. Furthermore, participants are required to affirm that they have received the briefing. However, participants in 10 of 13 focus groups either had difficulty recalling certain security policies and requirements or described the one-time briefings as inadequate. For example, some participants were unaware or unclear about specific aspects of their post transportation security policy or travel notification policy, while others said it can be challenging to remember the content of the new arrival briefings, in part because staff are simultaneously managing the process of moving and adjusting to a new post. Additionally, some participants suggested that the one-time nature of the briefings is not conducive to keeping staff informed of changes to security requirements and procedures, particularly in locations with fluid security environments. State lacks a clear requirement for RSOs to provide periodic refresher briefings and for post personnel to participate in such briefings. In part, this may result from the FAM’s lack of clarity and comprehensiveness on this matter. Specifically, the FAM states that RSOs must conduct refresher briefings “periodically” at “certain posts where personnel live under hostile intelligence or terrorist threats for long periods” but does not define “periodically” or “long periods.” Furthermore, according to DS officials, the FAM requirement does not extend to posts that face high levels of crime or political violence, even though both types of threats can pose risks to personnel in transit. Moreover, while there is a requirement for post personnel to affirm that they have received new arrival briefings, according to DS officials, there is no such requirement for affirming that they have received refresher briefings. RSOs at some of the posts we visited noted that they take steps to make updated briefings available to staff, such as electronically posting updated briefing slides and having regularly scheduled briefings open to all staff—not just new arrivals. However, RSOs at those posts stated that it was not mandatory for staff to view the updated slides or periodically attend the regularly offered briefings. DS headquarters officials commented that they believe most violations of post transportation security and travel notification policies are inadvertently committed by staff who have forgotten the information conveyed in new arrival briefings. Without effective reinforcement of the information that is covered in new arrival briefings, State cannot ensure that staff and their families have the knowledge they need to protect themselves from transportation-related security risks. According to the FAM, RSOs must ensure that locally employed staff assigned to drive armored vehicles for the chief of mission or principal officer attend the DS Training Center’s armored vehicle driver training course. This training covers topics such as emergency driving, attack recognition, and evasive maneuvers, among others. In addition, RSOs must ensure that these drivers take refresher training every 5 years following the initial training. The FAM also requires that State documentation be complete to the extent necessary to facilitate decision making, and federal internal control standards similarly state that managers should use quality information—information that is, among other things, current, complete, and accurate—to make informed decisions. We found two problems in State’s tracking of armored vehicle driver training, each of which State has either addressed or is taking steps to address. First, DS officials who manage the course were unaware of the existence of seven diplomatic and consular posts overseas and consequently lacked information on whether those posts had drivers in need of armored vehicle driver training. After we brought these seven posts to their attention, DS course managers consulted with other colleagues in DS and told us that they determined none of the seven posts had untrained drivers. Second, DS officials verified that some of State’s training records for armored vehicle drivers include inaccurate information about the posts to which the drivers are assigned. For example, DS course managers told us that, according to a database they use to track students of the training course, seven drivers from a particular post received training in fiscal years 2011 through 2015, but State’s official training records show no drivers from that post as having received training in that time period. A cognizant official stated that those seven drivers instead appear in the records as being assigned to a different post in the same country. When we asked about the cause of these inaccuracies, the official explained that they were due to clerical errors and stated that State will be taking steps to identify and correct similar errors in the future. State has a variety of systems for RSOs to communicate threat information to personnel and for personnel to report travel plans to RSOs. However, we found that several factors can inhibit the timely two-way communication of threat information and travel plans between RSOs and personnel. Timely communication is critical for managing transportation security risks, and failure to communicate important transportation-related information and receive such information promptly could leave overseas personnel facing avoidable security risks. According to DS officials, RSOs are responsible for communicating transportation-related threat information to post personnel. In addition, DS officials stated that various other officials may be involved in the process of communicating and receiving threat information at post, including consular officers, information management officers, and senior post officials, as well as post personnel themselves. For instance, according to DS officials, post personnel are responsible for making their mobile phone numbers available to RSOs so that they can receive text-based messages about potential threats, and they are generally also responsible for sharing threat information with their family members. RSOs at the nine posts we visited told us they communicated transportation-related threat information to post personnel through various methods, such as post-issued radios, personal and official e-mail, text messages to work and personal mobile phones, and phone trees. However, we learned of instances at four of the nine posts in which personnel did not receive important threat information in a timely manner. For instance, at one of the posts we visited, the RSO sent a security notice restricting travel along a specific road and warning that recent violent protests in the area had resulted in injuries and even death, but because the notice was sent exclusively to state.gov e-mail addresses, some non-State personnel at the post did not receive it at the e-mail address they regularly used and were unaware of the restriction. The personnel subsequently traveled through the restricted area, resulting in an embassy vehicle being attacked with rocks while on unauthorized travel through the area. While no one was hurt, the vehicle’s front windshield was smashed. The RSO told us that to avoid similar situations in the future, he would add the personnel’s regularly used e-mail addresses to his distribution list for security notices. At another post, focus group participants stated that they did not receive any information from the RSO or other post officials about the security-related closure of a U.S. consulate in the same country and instead learned about the closure from media sources. Participants in focus groups at two other posts stated that threat information is often either obsolete by the time they receive it or may not reach staff in time for them to avoid the potential threats. Several factors can lead to untimely receipt of transportation-related threat information. First, as in the example above, RSOs at three posts told us that they send security notices exclusively to post personnel’s state.gov e-mail addresses. However, officials who manage State’s e-mail system told us that some non-State personnel do not have state.gov e-mail addresses, and others who do may not check them regularly. Second, DS has produced limited guidance for RSOs on how to promote timely communication of threat information. By contrast, consular officers, who are responsible for sharing threat information with the nonofficial U.S. community at overseas posts, have detailed guidance from the Bureau of Consular Affairs on how to do so. Among other things, the guidance for consular officers encourages them to use previously cleared language whenever possible and also includes preapproved templates they can use for security-related messages. No such detailed guidance exists for RSOs, according to DS officials. Third, DS officials told us that staff, including RSOs, at some posts mistakenly believe that in cases where threat information applies to both official and nonofficial U.S. citizens and nationals, the RSO cannot share the threat information with the official U.S. community until consular officials have received approval to share the same information with the nonofficial U.S. community—a clearance process that can take as long as 8 hours. In April 2016, State completed an update to the FAM that, according to DS officials, is intended to clarify that RSOs’ sharing of threat information with the official U.S. community should not be delayed by this clearance process. However, because the update is found in a section of the FAM about consular affairs—not diplomatic security—it is unclear if RSOs will come across it in the course of their day-to-day duties. Acknowledging this potential challenge, DS officials told us that an update to the diplomatic security section of the FAM, which is currently under review, will include a reference to the relevant consular affairs section of the FAM. Federal internal control standards direct agencies to select appropriate methods of communication so that information is readily available to intended recipients when needed; thus, it is critical that post personnel receive timely information on emerging transportation security threats that enables them to take appropriate mitigation steps. Likewise, as noted earlier, RSOs are responsible for protecting personnel and property at posts—a responsibility that includes communicating transportation-related threat information to post personnel, according to DS officials. Without timely communication of transportation-related security risks and timely receipt of such information, post personnel may be less able to respond to changing security environments and comply with the latest post policies and directives, potentially putting them in harm’s way. All nine of the posts we visited had post-specific travel policies requiring personnel to notify the RSO—and in some cases to obtain approval— before traveling to certain locations. In addition to the travel notification requirements specific to these posts, the FAM contains broader travel notification requirements that apply to all personnel under chief of mission authority at overseas posts, and federal internal control standards emphasize the necessity of communication from personnel to management in order to achieve agency objectives. Travel notifications allow RSOs or other post officials to take actions to protect personnel, such as prohibiting potential travel to dangerous or restricted areas, providing appropriate security measures such as armored vehicles or additional security briefings, adjusting residential security activities while the occupant is away, and accounting for all post personnel in the event of an emergency. Personnel at more than half of the nine posts we visited cited difficulty using travel notification systems or were unaware or unsure of their post’s travel notification requirements. While three of the nine posts we visited permit personnel to use e-mail or other means to inform the RSO of their travel plans, the remaining six posts require personnel to complete an official travel notification form that is only accessible through a State information system called OpenNet. However, according to officials responsible for managing State’s information resources, including OpenNet, not all post personnel have OpenNet accounts. Specifically, all State personnel at overseas posts have OpenNet accounts, but some non-State agencies, such as the U.S. Agency for International Development, typically only have a limited number of OpenNet account holders at each post; some smaller agencies, such as the Peace Corps, usually have none. One focus group participant from a non-State agency told us that because she does not have an OpenNet account, her ability to submit travel notifications as required depends on whether or not she is able to find one of the few individuals at the post from her agency that does have an OpenNet account. Similarly, the travel notification policy for another post requires that post personnel use an OpenNet-based travel notification system even though the policy explicitly acknowledges that not all post personnel have OpenNet accounts. Focus group participants at several posts we visited also stated that they were unaware or unsure of their post’s travel notification requirements. For example, one post we visited requires notifications for all overnight travel, whether official or personal; however, at least one focus group participant at the post believed that such notifications were optional. At another post, focus group participants expressed confusion about which destinations within the host country required advance notification to the RSO. The RSO at that post described an incident in which post personnel traveling to a permitted location mistakenly violated post travel policy because their flight made a stop in a restricted area while en route to the nonrestricted destination. Travel notification requirements are covered in the security briefings personnel receive when they arrive at posts, but as discussed earlier participants in many of our focus groups had difficulty recalling certain key information covered in the new arrival briefings or found the one-time briefings to be inadequate. Advance notification of travel plans allows RSOs to act preemptively by assessing the current security situation at a certain location and determining whether to deny travel requests when conditions are particularly dangerous or provide personnel with relevant threat information or additional security resources—such as armored vehicles and armed security teams. Without notifications, RSOs may not be aware of travel plans and therefore may not take appropriate steps to protect post personnel. U.S. diplomatic personnel and their families face threats to their security in numerous locations around the world. As many serious and even fatal attacks over the last few decades have shown, personnel and their dependents are especially vulnerable when traveling outside the relative security of embassies, consulates, or residences. State has taken a number of measures to enhance transportation security for personnel overseas. For example, State provides security officials, post personnel, and their spouses and dependents with various types of training on how to avoid and counter transportation-related security risks. State also plans to expand its Foreign Affairs Counter Threat training to a much broader population over the next 3 years and has taken steps to emphasize that personnel should take responsibility for their own security. However, a variety of weaknesses in State’s implementation of its risk management activities continue to put U.S. personnel at risk. Fragmented guidance, insufficient monitoring of post-level transportation policies, and a lack of clarity in State’s armored vehicle policy for overseas posts make it difficult for State to ensure that measures necessary for protecting key personnel are implemented consistently worldwide, and State has limited insight into armored vehicle needs at some posts. In addition, State lacks an effective means of reinforcing the training personnel receive upon arrival at post, and the two-way sharing of threat and transportation-related information between post security officers and personnel is not always timely. While each of these shortcomings is of concern, in the aggregate, they raise questions about the adequacy of security for U.S. personnel and their families overseas. Until it addresses these issues, State cannot be assured that the deadly threats U.S. personnel and their families may face while in transit overseas are being countered as effectively as possible. To enhance State’s efforts to manage transportation-related security risks overseas, we recommend that the Secretary of State direct DS to take the following eight actions: 1. Create consolidated guidance for RSOs that specifies required elements to include in post travel notification and transportation security policies. For example, as part of its current effort to develop standard templates for certain security directives, DS could develop templates for transportation security and travel notification policies that specify the elements required in all security directives as recommended by the February 2005 Iraq ARB as well as the standard transportation-related elements that DS requires in such policies. 2. Create more comprehensive guidance for DS reviewers to use when evaluating posts’ transportation security and travel notification policies. For example, the checklist DS reviewers currently use could be modified to stipulate that reviewers should check all security directives for DS-required elements recommended by the February 2005 Iraq ARB. The checklist could also provide guidance on how to take the presence or absence of these required elements into account when assigning a score to a given policy. 3. Clarify whether or not the FAH’s armored vehicle policy for overseas posts is that every post must have sufficient armored vehicles, and if DS determines that the policy does not apply to all posts, articulate the conditions under which it does not apply. 4. Develop monitoring procedures to ensure that all posts comply with the FAH’s armored vehicle policy for overseas posts once the policy is clarified. 5. Implement a mechanism, in coordination with other relevant State offices, to ensure that EACs discuss their posts’ armored vehicle needs at least once each year. 6. Clarify existing guidance on refresher training, such as by delineating how often refresher training should be provided at posts facing different types and levels of threats, which personnel should receive refresher training, and how the completion of refresher training should be documented. 7. Improve guidance for RSOs, in coordination with other relevant State offices and non-State agencies as appropriate, on how to promote timely communication of threat information to post personnel and timely receipt of such information by post personnel. 8. Take steps, in coordination with other relevant State offices and non- State agencies as appropriate, to make travel notification systems easily accessible to post personnel who are required to submit such notifications, including both State and non-State personnel. We provided a draft of this report for review and comment to State, the U.S. Agency for International Development, and the Peace Corps. We received written comments from State, which are reprinted in appendix II. State generally concurred with 7 of our 8 recommendations and highlighted a number of actions it is taking or plans to take to address the problems that we identified. State did not concur with our sixth recommendation to clarify guidance on refresher training. In its response, State described a number of efforts that RSOs take to keep post personnel informed, such as sending security messages via e-mails and text messages, and therefore State did not believe additional formal training was necessary. We agree that RSOs have made significant efforts to keep post personnel informed. Nevertheless, participants in 10 of our 13 focus groups either had difficulty recalling certain security policies and requirements or described their security briefings as inadequate. Participants noted that this was, in part, because it can be challenging to remember the content of new arrival security briefings while they are simultaneously managing the process of moving and adjusting to a new post and because of the one-time nature of new arrival briefings. DS headquarters officials stated that most violations of post travel policies are due to personnel forgetting the information conveyed in the new arrival briefings. By clarifying existing guidance that requires refresher briefings, and then providing those briefings, State could potentially remind and update personnel about post security policies and requirements in a more effective setting and on a more regular basis. In addition, RSOs at posts we visited provided security briefings to new arrivals on a regular basis. Thus, allowing staff already at post to attend these regular briefings could involve minimal additional cost or effort. The U.S. Agency for International Development and the Peace Corps did not provide comments on the report. State also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, the Administrator of the U.S. Agency for International Development, and the Director of the Peace Corps. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8980 or courtsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The objectives of this report were to evaluate the extent to which the Department of State (State), with regard to transportation security, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time-sensitive information. For the purposes of this review, we focused on transportation security for U.S. personnel at overseas posts, which we defined as security for such personnel while they are in transit outside of embassy and consulate compounds or their residences at overseas posts. Our scope did not include transportation-related safety threats, such as road conditions or local drivers. We focused primarily on transportation in motor vehicles, but also included travel on foot, public transit, and to the extent that post documents and personnel addressed them, boats and local airlines. We did not focus on transportation-related security issues specific to Iraq and Afghanistan given the unique operating environments in those countries. We focused on U.S. direct hire personnel permanently assigned or on temporary duty under chief-of-mission security responsibility and their family members but excluded locally employed staff. To address the objectives of this report, we reviewed U.S. laws; State’s security policies and procedures as found in the Foreign Affairs Manual, Foreign Affairs Handbooks, and diplomatic cables; Bureau of Diplomatic Security (DS) threat and risk ratings and periodic assessments of post security programs; State budgetary documents and training curricula; classified Accountability Review Board reports concerning transportation- related attacks; and past reports by GAO, State’s Office of Inspector General, and the Congressional Research Service. We assessed DS’s risk management practices against its own policies and federal internal control standards. In addition, we interviewed officials in Washington, D.C., from DS; State’s Bureaus of Administration, Consular Affairs, and Information Resource Management; State’s Offices of Inspector General and Management Policy, Rightsizing, and Innovation; State regional bureaus; the U.S. Agency for International Development; and the Peace Corps. We also attended State’s Foreign Affairs Counter Threat training course to gather firsthand information on the extent to which it covers issues related to transportation security. Additionally, we selected a judgmental sample of 26 posts for which we collected post-level transportation security and travel notification policies, among other documents. For security reasons, we are not naming the specific posts. Our judgmental sample included three to five embassies or consulates from each of State’s six geographic regions. In addition to ensuring geographic coverage, we selected 22 posts that had relatively high DS-established threat ratings, while also choosing 4 posts with lower threat ratings for comparison purposes. We evaluated the extent to which these 26 posts’ policies contained key elements required by DS, including the criteria recommended by the February 2005 Iraq ARB. We then reviewed various related documents, such as the checklist DS uses in its periodic assessments of post security programs, and spoke with cognizant DS officials to identify factors contributing to cases of noncompliance with the required elements. The findings from our judgmental sample of 26 posts are not generalizable to all posts. We also conducted fieldwork at 9 of these 26 posts. Each of the 9 posts was rated by DS as having a high or critical threat level in one or more of the Security Environment Threat List categories of political violence, terrorism, and crime. Additionally, 8 of the 9 posts we selected for fieldwork were within the top 100 posts rated by DS as the highest risk worldwide, 5 were in the top 75, and 3 were in the top 50. At the 9 posts, we met with officials from State and other agencies involved in transportation security—including regional security officers (RSO), general services officers, community liaison officers, Emergency Action Committee members, and other senior post officials—to understand their roles related to transportation security and their perspectives on State’s associated policies and procedures. In addition, to obtain a wide range of firsthand perspectives from personnel at these 9 posts, we conducted 13 focus group discussions with randomly selected U.S. direct hire personnel who had been at post longer than 3 months. We selected focus group participants from multiple agencies at each post and various sections within State. We excluded RSOs and senior post officials from our focus groups in order to encourage participants to provide candid observations on security-related matters. These meetings involved structured, small-group discussions designed to gain more in-depth information about specific issues that cannot easily be obtained from single or serial interviews. Most groups involved 6 to 10 participants. Discussions were structured and guided by a moderator who used the following standardized questions to encourage participants to share their thoughts and experiences. 1. In your opinion, what are the most significant security threats that staff face when traveling in-country at this post? As a reminder, we are interested in security threats posed by other people with intent to harm, not safety threats such as road conditions or local drivers. 2. What guidance or training have you received—whether before or after arriving at this post—on security practices to protect yourself against potential threats or attacks when traveling in-country? This is different from the post’s travel or transportation security policy, which we will ask you about later in the discussion. a. Where did you receive that guidance or training? What were the key takeaways from that guidance or training? 3. How easy or difficult is it to routinely apply those security practices at this post? 4. In your opinion, is post’s travel or transportation security policy appropriately tailored to the types and levels of security threats that staff face when traveling in-country at this post? a. If yes, in what ways is the travel policy appropriately tailored? b. If not, how can the policy be improved? c. What factors, if any, create challenges to following the post’s travel policy? 5. In your opinion, have you received all the guidance or training you need to protect yourself against potential threats or attacks when traveling in-country at this post? If not, what additional guidance or training do you believe is needed? 6. What other suggestions do you have, if any, for how staff posted at diplomatic posts overseas can be better protected against potential security threats or attacks when traveling in-country? As the list indicates, we did not ask about specific security threats, guidance, training, or security practices, but instead asked general questions on each of these topics. For example, we did not specifically ask participants whether they had received certain types of training; rather, we asked a general question about what training they had received and relied on them to volunteer information on the types of training they had taken. However, when appropriate, we did ask more specific follow-up questions during the focus groups. Our overall objective in using a focus group approach was to obtain the views, insights, and beliefs of overseas personnel on issues related to transportation security. While we recorded the audio of each focus group, we assured participants of the anonymity of their responses, promising that their names would not be directly linked to their responses. We also conducted one pretest focus group, after which we asked the participants of the pretest focus group to provide their opinions on whether the questions we asked were comprehensive, clear, unbiased, and appropriate. The participants of the pretest focus group confirmed that our questions were comprehensive, clear, unbiased, and appropriate. To analyze the focus group responses, we reviewed transcripts of the focus group audio recordings and conducted keyword searches to identify key themes related to our reportable objectives. We quantified the frequency of these key themes by counting the number of focus groups (out of 13) in which the themes were raised. As appropriate, we also followed up with RSOs and other officials at the posts we visited to discuss and clarify the issues raised, while preserving the anonymity of the focus group participants. Methodologically, focus groups are not designed to (1) demonstrate the extent of a problem or to generalize results to a larger population, (2) develop a consensus to arrive at an agreed-upon plan or make decisions about what actions to take, or (3) provide statistically representative samples or reliable quantitative estimates. Instead, they are intended to generate in-depth information about the reasons for the focus group participants’ attitudes on specific topics and to offer insights into their concerns about and support for an issue. The generalizability of the information produced by our focus groups is limited because participants were asked questions about their specific experiences related to transportation security, and other personnel who did not participate in our focus groups or were located at different posts may have had different experiences. Because of these limitations, we did not rely entirely on focus groups but rather used several different methodologies to corroborate and support our conclusions. For example, as noted earlier in this appendix, we reviewed a variety of documents and interviewed cognizant officials from multiple agencies and offices. To determine the reliability of the data on funding for transportation security and training records for armored vehicle drivers that we collected, we compared information from multiple sources, checked the data for reasonableness, and interviewed knowledgeable officials regarding the processes they use to collect and track the data. On the basis of these checks, we found the data we collected on funding for transportation security to be sufficiently reliable for the purposes of this engagement. As noted in this report, we found inaccuracies in the training records for armored vehicle drivers. We interviewed cognizant DS officials to understand the causes of the inaccuracies as well as State’s plans to address them. We also collected data on the worldwide distribution of armored vehicles by post. This report is a public version of a sensitive but unclassified report that was issued on September 9, 2016, copies of which are available upon request for official use only by those with the appropriate need to know. This report does not contain certain information that State regarded as sensitive but unclassified and requested that we remove. We provided State a draft copy of this report for sensitivity review, and State agreed that we had appropriately removed all sensitive but unclassified information. We conducted this performance audit from July 2015 to October 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Thomas Costa (Assistant Director), Joshua Akery, Aniruddha Dasgupta, David Dayton, Martin De Alteriis, Neil Doherty, Justin Fisher, Lina Khan, Jill Lacey, Grace Lui, and Oziel Trevino made key contributions to this report. Diplomatic Security: State Should Enhance Management of Transportation-Related Risks to Overseas U.S. Personnel. GAO-16- 615SU. Washington, D.C.: September 9, 2016. Diplomatic Security: Options for Locating a Consolidated Training Facility. GAO-15-808R. Washington, D.C.: September 9, 2015. Diplomatic Security: State Department Should Better Manage Risks to Residences and Other Soft Targets Overseas. GAO-15-700. Washington, D.C.: July 9, 2015. Diplomatic Security: State Department Should Better Manage Risks to Residences and Other Soft Targets Overseas. GAO-15-512SU. Washington, D.C.: June 18, 2015. Combating Terrorism: Steps Taken to Mitigate Threats to Locally Hired Staff, but State Department Could Improve Reporting on Terrorist Threats. GAO-15-458SU. Washington, D.C.: June 17, 2015. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-655. Washington, D.C.: June 25, 2014. Diplomatic Security: Overseas Facilities May Face Greater Risks Due to Gaps in Security-Related Activities, Standards, and Policies. GAO-14-380SU. Washington, D.C.: June 5, 2014. Countering Overseas Threats: Gaps in State Department Management of Security Training May Increase Risk to U.S. Personnel. GAO-14-360. Washington, D.C.: March 10, 2014. State Department: Diplomatic Security Challenges. GAO-13-191T. Washington, D.C.: November 15, 2012. Diplomatic Security: Expanded Missions and Inadequate Facilities Pose Critical Challenges to Training Efforts. GAO-11-460. Washington, D.C.: June 1, 2011. Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies. GAO-05-642. Washington, D.C.: May 9, 2005. Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies. GAO-05-386SU. Washington, D.C.: May 9, 2005.

Summary: U.S. diplomatic personnel posted overseas continue to face threats to their security. According to State, personnel and their families are particularly vulnerable when traveling outside the relative security of diplomatic work facilities or residences. In many serious or fatal attacks on U.S. personnel over the last three decades, victims were targeted while in motorcades, official vehicles, or otherwise in transit. GAO was asked to review how State manages transportation-related security risks to U.S. diplomatic personnel overseas. For this report, GAO evaluated the extent to which State, with regard to transportation security at overseas posts, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time-sensitive information. GAO reviewed agency documents and met with key officials in Washington, D.C. GAO also reviewed policies from a judgmental sample of 26 posts—primarily higher-threat, higher-risk locations—and conducted fieldwork and met with officials at 9 of these posts. This is the public version of a sensitive but unclassified report issued in September 2016. The Department of State (State) has established policies related to transportation security for overseas U.S. personnel, but gaps exist in guidance and monitoring. GAO reviewed 26 posts and found that all 26 had issued transportation security and travel notification policies. However, policies at 22 of the 26 posts lacked elements required by State, due in part to fragmented implementation guidance on what such policies should include. State also lacks a clear armored vehicle policy for overseas posts and procedures for monitoring if posts are assessing their armored vehicle needs at least annually as required by State. These gaps limit State's ability to ensure that posts develop clear policies that are consistent with State's requirements and that vehicle needs for secure transit are met. While State provides several types of training related to overseas transportation security, weaknesses exist in post-specific refresher training. Regional security officers (RSO) receive required training related to transportation security in special agent courses, and nonsecurity staff reported receiving relevant training before departing for posts—including on topics such as defensive driving and the importance of taking personal responsibility for one's security—as well as new arrival briefings at posts. At most of the 9 posts GAO visited, however, staff had difficulty remembering key details covered in new arrival briefings or described the one-time briefings as inadequate. State's requirements for providing refresher briefings are unclear, potentially putting staff at greater risk. State uses various systems at overseas posts to communicate time-sensitive information related to transportation security, but several factors hinder its efforts. RSOs and other post officials are responsible for communicating threat information to post personnel. However, at 4 of the 9 posts it visited, GAO learned of instances in which staff did not receive important threat information in a timely manner for various reasons. In one case, this resulted in an embassy vehicle being attacked with rocks and seriously damaged while traveling through a prohibited area. In addition, while all 9 of the posts GAO visited require that personnel notify the RSO before traveling to certain locations, personnel at more than half of the 9 posts said they were unaware of these requirements or had difficulty accessing required travel notification systems. Timely communication is critical for managing transportation security risks, and failure to communicate important transportation-related information and receive such information promptly could leave overseas personnel facing avoidable security risks. GAO is making eight recommendations in this report to help State improve its management of transportation-related security risks by enhancing associated policies, guidance, and monitoring; clarifying its requirements for refresher briefings; and better communicating time-sensitive information. State agreed to take steps for all but one recommendation—the need to clarify its requirements for refresher briefings. GAO continues to believe this is needed as discussed in the report.