DOD defines category I items as those that are highly explosive, extremely lethal, portable, and a potential threat if they were to be used by unauthorized individuals or groups. Category I missiles and rockets are nonnuclear and handheld. The missiles are the Stinger, Dragon, and Javelin; the rockets are the light antitank weapon (LAW) and the AT4. The Stinger can destroy aircraft in flight, and the Dragon and Javelin missiles and the LAW and AT4 rockets can pierce armor. Category II munitions and explosives are hand or rifle grenades, antitank or antipersonnel mines, C-4 explosives, TNT, and dynamite. See appendix I for pictures of the category I missiles and rockets. In September 1994, we reported that many serious discrepancies in the quantities, locations, and serial numbers of handheld category I missiles indicated inadequate management oversight for these lethal weapons. Further, we reported that the services did not know how many handheld missiles they had in their possession because they did not have systems to track by serial numbers the missiles produced, fired, destroyed, sold, and transferred. At that time, we could not determine the extent to which any missiles were missing from inventory. We also stated that security measures were not uniformly applied at all locations where missiles were stored. Our report contained several recommendations to the Secretary of Defense to correct these problems. In addition, the Army Inspector General conducted two follow-up studies and found similar problems. DOD has taken actions to correct the deficiencies cited in our September 1994 report. In that report, we recommended that DOD conduct independent worldwide inventories of category I missiles to establish a new baseline number. DOD established the new baseline number as of December 31, 1994, as shown in table 1. The Army, the Navy, and the Marine Corps are the primary purchasers of category I missiles; consequently, our review and the prior report focused on their inventories. Our prior report also recommended that DOD establish procedures to track, document, and report additions to and deletions from the new inventory baseline. Since that time, the Army has begun modifying its automated system—the Standard Army Ammunition System—to report changes to the inventories of Stinger, Dragon, and Javelin missiles by serial number. The modification to the system is designed to provide item managers at all Army commands with 24- to 72-hour notification of changes to the inventory. In the interim, the Army has implemented manual reporting procedures to track handheld missiles on a monthly basis. This temporary system has a 30- to 45-day time lag in reporting changes to the missile inventory. The Navy and the Marine Corps have also implemented automated systems to track category I missiles. The Navy’s automated system is intended to provide information within 24 to 48 hours on where a given missile is located, and the Marine Corps’ system is intended to provide such information within 24 hours. In addition, our prior report recommended that DOD establish procedures to include a random sampling of missile containers during inventories to ensure that they contain missiles. The services have since established procedures to verify the presence of missiles inside their containers during maintenance checks. Finally, our report recommended that DOD reemphasize security procedures and reexamine the current security policy. In response, the services reemphasized physical security regulations for all category I munitions. Although the services established a baseline inventory count of category I missiles as of December 31, 1994, updates to the baseline continue to be made as additional missiles are located or errors are discovered. Discrepancies existed at some sites between records of the number of category I missiles in their inventories and our physical count, but we were able to reconcile the discrepancies manually. Even though missile containers are being opened and serial numbers are being verified, random checks are not being performed because the services stated that they would be too costly. Also, DOD has not fully complied with physical security regulations at all of its sites. Army officials stated that, because of prior reporting, weaknesses involving the handheld missile inventory, they cannot fully assure that the category I missile baseline is completely accurate. The baseline had to be updated several times since its establishment because additional missiles were located. In February 1996, the Army discovered it had not counted 3,949 missiles during the initial inventory, which increased its baseline by almost 7 percent. Some of the missiles had been in transit and were not counted by either the shipping or receiving parties. Other missiles were being used by the Signal Communications Electronics Command in Fort Monmouth, New Jersey, for test purposes but were not included in the initial baseline inventory. A Stinger missile had been at a storage facility in Kuwait since September 1992. Pakistanis discovered the missile during post-Desert Storm cleanup operations, and Kuwait did not return it to the United States until April 1996. However, the Army had previously reported that 6,373 Stinger missiles were shipped to and subsequently sent back from the Persian Gulf. Thus, the Army did not realize that this missile had been missing from inventory until after it was discovered. Also, errors in the initial inventory count have affected the baseline. For example, two missiles on the Army item manager’s contractor database actually belonged to another country through the Foreign Military Sales program. These missiles, which were included in the baseline number, were at the contractor’s facility for repair. At the time of our visit, one of the missiles was still at the facility, and the other had been fixed and returned. The item manager stated that the contractor was not reporting to her the number of missiles received, completed, and returned. However, as a result of our finding, the contract has been modified to provide the item manager a monthly report of the missiles received at the contractor’s facility and the missiles transferred from the contractor’s facility to a DOD facility. In our September 1994 report, we noted that records of the number of category I missiles in some sites’ inventories did not match our physical count. This problem still exists at the Army and Marine Corps sites we visited, but we were able to reconcile the discrepancies manually. At a Navy storage site, we found no discrepancies between the item manager’s records and our physical count. At the Army military storage location we visited, we found discrepancies between the item manager’s records and the missiles we counted at the storage facility. All of the missiles that were on the item manager’s records, but not at the storage location, had been issued to units for training. We used the Army’s monthly interim reports to reconcile the discrepancies. We verified that these missiles had in fact been expended during training exercises. The item manager still had the missiles on the records because of the lag time in receiving the interim reports. We also found five discrepancies with our missile count at a Marine Corps site that we visited. All of the discrepancies involved the serial numbers. One missile was not on the item manager’s records because the wrong serial number was keyed into the system. Two missiles were upgraded and their serial numbers changed; the new serial numbers, however, were not yet changed on the database that we used to conduct our reconciliation. Two of the six digits in one missile’s serial number were apparently transposed on the container. Finally, one missile’s correct serial number was in both the depot’s and item manager’s systems, but the wrong number was apparently stenciled on the container. We also found discrepancies at two contractor facilities where both the Stinger and Dragon were being upgraded or modified. Most of the discrepancies were due to the lag between the time we received the database and the time we performed our physical count. Many missiles on the item manager’s records had already been sent to the DOD storage sites by the time we conducted our inventory count. We verified that the DOD storage sites had received the missiles. However, we found four additional missiles at one of the contractor facilities that were not on the item manager’s records. The item manager had recorded that one of the missiles, still at the contractor’s facility, was made non-lethal (demilitarized). Eight additional missiles were also listed as being at that contractor’s facility, but six were actually at another location, and two belonged to other countries, as stated previously, under the Foreign Military Sales program. Finally, we noted a practice during this review, in addition to those that have been previously mentioned, that complicates serial number tracking: giving new serial numbers to missiles that have been upgraded. Stinger missiles that are undergoing a technical upgrade will be given new serial numbers once the upgrade has been completed. According to a Production Assurance and Test Division official, U.S. Army Missile Command, the justification for changing the serial numbers was that the missiles would, in effect, become new missiles, since they would be broken down into major component parts and reassembled with different components. Both the old and new serial numbers would then be cross-referenced. However, a Quality Assurance official, U.S. Army Missile Command, stated that he had opposed changing the serial numbers because it would be harder to track the life cycle of the missiles and that cross-referencing old and new serial numbers would create additional bookkeeping and the potential for transposition and other errors. Instead of changing the serial numbers, the upgraded missiles could be distinguished by adding a suffix to the serial number. Even though the services have established procedures to verify the presence of missiles inside their containers, a representative sample is not always being selected, according to the services, because it would be too costly. For example, an Army official said that during maintenance checks only the missiles that are easy to access in a storage facility are selected to be opened. This methodology does not provide complete assurance that missiles are not being stolen because it may not deter insider theft. Moreover, opening a representative sample of missile containers helps to obtain assurance that all reported missiles do exist, are held by the services, and are owned by DOD. This check improves the accuracy of the missile inventory reports for item managers as well as DOD’s financial statements required by the CFO Act. We opened 108 missile containers to verify the presence of the correct missile in each container. Figures 1 and 2 show opened Stinger and Dragon missile containers. All containers had a missile, but the serial number on one container did not match the one on the missile. Neither the item manger nor the site officials could determine the reason for the mismatch. In another instance, a contractor official discovered that a missile going through an upgrade did not have the same serial number as its container. The correct container was at the storage depot, and the missile inside belonged in the container located at the contractor’s facility. Also, according to an Army policy notice, the sample size and the results of missile container checks are to be reported to the item managers. However, we found that Army item managers were not receiving this information. As a result of our finding, the Chief of Staff, Army Materiel Command, issued a memorandum reemphasizing the reporting requirement. Some of the sites we visited were not in full compliance with service or DOD security regulations. Personnel at one Army location were not inspecting all vehicles leaving the storage area. The Army Inspector General’s 1996 report also noted that not all sites were fully enforcing physical security regulations. The Army Inspector General included the National Guard in its follow-up review of handheld missiles. In its report, the Inspector General noted that National Guard sites were storing category I Dragon missiles in violation of DOD and Army physical security policies. Both of these policies permit the National Guard to use the missiles for training purposes only and store them temporarily at Guard installations. However, the Inspector General found that some sites had the Dragon missile in storage for many years. As a result of the Inspector General’s report, the Army National Guard was directed to return the Dragon missiles to the storage sites. Since that time, all missiles have either been returned or used for training. The National Guard requested approval to permanently store Dragon missiles at selected sites. The Army denied this request because some storage sites were not in compliance with its physical security regulations. For example, armed guards were not used to prevent unauthorized access of the storage structures when intrusion detection systems were inoperable. However, if a site can meet physical security regulations, the Army stated it would reconsider a request only to temporarily store Dragon missiles at selected sites. Contractors are required to follow DOD Manual 5100.76, Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives, for their security guidelines. These regulations are not as stringent as the Army’s physical security regulations. For example, Army regulations require that storage sites be secured with two locks and keys and that no one person have possession of both keys at the same time. DOD regulations permit one lock and key, which allows single individuals access to storage sites. We noted the following conditions, among others, at one of the contractor facilities we visited: The entrance to the storage area was not locked. No guard was available to check vehicles entering or exiting the storage area. There was no clear zone outside the security fence. (This area was cleared, however, after our visit.) One employee had keys to operate the locks to the storage site, security fence gate, and gate to a perimeter road that led to the main road. This employee also had the code for calling in to security to deactivate the intrusion detection system. We observed this employee leave the storage site in a truck, proceed to unlock the perimeter gate, and exit. We believe that allowing one person such access leaves the missiles more vulnerable to theft. After bringing this concern to the attention of the Commander, Army Materiel Command, a memorandum was issued requiring that the security requirements of Army Regulation 190-11 and the Army Materiel Command supplement requiring that storage sites be secured with two locks and keys, among other things, be included in contracts for activities involving category I munitions. The services have different procedures and requirements for maintaining oversight of AT4 and LAW rockets. The Army and the Navy manage AT4 and LAW rockets by production lot and quantity. The Marine Corps maintains oversight and visibility of AT4 rockets (it does not have any LAW rockets) by serial numbers. Although we found no missing rockets in our physical count, three AT4 rockets that were sent to the Persian Gulf for Operation Desert Storm are missing from the Marine Corps’ inventory. The investigations were closed on these three missing rockets, but no conclusions were reached by the Naval Criminal Investigative Service on whether the rockets were missing, lost, or stolen. The Marine Corps adjusted their physical inventory to reflect the decrease of the three AT4 rockets. However, the serial numbers will remain within its accounting and reporting system should these rockets be recovered. The Army manages AT4 and LAW rockets by production lot and quantity. However, the Army item manager’s oversight of the AT4 rocket extends only to the quantities that are issued to the various major commands. Each major command then redistributes AT4 rockets to the installations within that command, and oversight for installation inventories is maintained by the major command. The item manager, therefore, does not know the quantities of AT4 rockets at the installation level. The Army is developing a system, called Unique Item Tracking, for all of its category I munitions, including the AT4. This system is intended to provide weekly reports showing the serial number of each munition by location. The purpose of the system is to identify the last accountable location of a weapon in the event that it is lost or stolen and recovered by law enforcement or other organizations. However, the system will not include the LAW rocket, since it is being phased out of the inventory, and most LAWs do not have serial numbers. The Navy also manages AT4 and LAW rockets by production lot and quantity. The Navy item manager does not oversee the rockets by serial number because it is not a requirement. This situation could be problematic if a rocket is missing because the Navy does not have a system in place to identify the missing rocket by serial number. However, some storage locations report AT4 rockets by serial numbers in addition to production lot and quantity. We conducted a physical count of AT4 and LAW rockets at Army, Navy, and Marine Corps storage sites and were able to match the physical count with the item managers’ records. We also opened 89 containers to verify the presence and correct serial number of each rocket. We did not note any violations in the physical security regulations at the sites we visited. Another issue related to accountability over sensitive defense material relates to the financial management system. In accordance with the CFO Act of 1990, each agency is to establish an integrated financial management system. Establishing an integrated, general ledger controller system, which ties together DOD’s accounting systems with its logistics and other key management systems, is critical if DOD is to effectively ensure oversight and control over its sensitive materials. For example, an integrated accounting and logistics system will automatically update both sets of records when missiles or other sensitive inventory items are purchased and received. In addition, carrying out rudimentary controls, such as periodically reconciling DOD’s accounting and logistics records, will help oversee and identify any unaccounted for in-transit items. Audit reports have repeatedly pointed out, however, that DOD’s existing accounting and related systems, including its logistics systems, are not integrated and lack a general ledger. As part of DOD’s efforts to reform its financial operations, the DOD Chief Financial Officer has stated that DOD will develop property accountability systems that will meet the federal government’s system requirements. If properly designed and implemented as part of a DOD-wide integrated financial management systems structure called for under the CFO Act, these systems will be integral to ensuring effective accountability over DOD’s sensitive inventories of missiles and rockets and other sensitive material. We did not find any documentation that terrorists or other extremists had stolen category I handheld missiles or rockets or category II grenades, mines, and explosives from DOD arsenals. Intelligence and DOD officials said that it is more likely that terrorists would seek handheld surface-to-air missiles or other munitions from sources other than DOD arsenals. International terrorist groups receive financial aid and other forms of assistance from several nations. The Secretary of State has determined that these countries have repeatedly provided support for acts of international terrorism by supplying, training, supporting, or providing safehaven to known terrorists. Intelligence officials told us that there are a variety of places around the world for terrorists to obtain weapons. For example, several countries besides the United States, including Bulgaria, China, Egypt, France, Japan, Czech Republic, Pakistan, Poland, Romania, Sweden, and the United Kingdom produce handheld surface-to-air missiles. Terrorists tend to favor small conventional weapons—handguns, rifles, grenades, machine guns, or explosives—because they can be easily transported and hidden from view. C-4 plastic explosives can be purchased from several countries. In addition, law enforcement officials told us that extremist groups have made their own C-4. Terrorists have used plastic explosives. For example, less than one pound of Semtex, similar to C-4, was used to bring down Pan Am Flight 103 over Lockerbie, Scotland, in 1988. There have been thefts of category II munitions and explosives by uniformed and DOD civilian employees that involved quantities of items such as grenades, C-4 explosives, and TNT. We previously reported that military inventories remain more vulnerable to employee theft than outside intrusion. Table 2 shows the types and quantities of category II items reported missing, lost, or stolen from 1993 to 1996. Some of the weapons were recovered. According to a law enforcement official, DOD could not determine whether any of the unrecovered stolen DOD weapons were in the hands of terrorists or other extremists. We recognize that DOD has made significant strides in gaining visibility and accountability over its handheld missile inventory. DOD has implemented several recommendations from our prior work and has already taken action to correct some of the problems we cite in this report. We believe, however, that DOD can take some additional actions to further improve physical security and ensure accurate reporting of its inventory of missiles and rockets. Therefore, we recommend that the Secretary of Defense direct the Secretaries of the Army, the Navy, and the Air Force and the Commandant of the Marine Corps to develop a cost-effective procedure for periodically revalidating the category I inventory baseline by, for example, matching item managers’ records with site records annually at a representative sample of storage sites; develop a cost-effective procedure for opening containers of missiles and rockets, for example, by selecting a representative sample of pallets, rather than individual missiles and rockets, to inspect; manage category I rockets by serial number so that the item managers will have total visibility over the numbers and locations of rockets; establish procedures for ensuring that serial numbers are not changed during upgrades and modifications of category I missiles and rockets; and continue to emphasize compliance with physical security requirements. In commenting on a draft of this report, DOD concurred with all of our recommendations (see app. II). DOD noted that it had already begun taking action to address several of the recommendations. For example, the services have developed or are developing procedures for revalidating the category I baseline. DOD also plans to issue guidance to manage category I rockets by serial numbers, develop procedures to ensure that serial numbers are not changed during upgrades and modifications of category I missiles and rockets, and continue to emphasize compliance with physical security requirements. DOD concurred with our recommendation to develop a cost-effective procedure to open containers of missiles and rockets. DOD’s response also cited various existing regulations, which require that samples selected for inspection be representative of the entire lot under evaluation. We discussed the comments with an official from the Office of the Secretary of Defense and pointed out that during our review we found that this was not always being done. For example, an Army official told us that some inspectors only select and inspect the missiles that are easy to access in a storage facility. The Office of the Secretary of Defense officials agreed to issue guidance reinforcing the need to follow these procedures. We met with officials from the Office of the Secretary of Defense, the Army, the Navy, the Marine Corps, and the National Guard regarding the oversight and physical security of category I missiles and rockets and the physical security of category II weapons. We discussed the actions taken to correct problems cited in our 1994 report. We also met with officials from the intelligence and law enforcement agencies to discuss the vulnerability of category I missiles and rockets to theft by terrorists and other extremists and obtain information on category I and category II weapons that are missing, lost, or stolen. We excluded the Air Force because of the limited number of missiles and rockets in its possession and because that service was not included in our prior report. Based on initial discussions on the scope of our work, the Army Inspector General added the National Guard to its follow-up review of handheld missiles. Because the Inspector General went to the same sites that we planned to visit, we did not visit any National Guard sites. To determine whether changes made to the oversight of category I missiles have improved the services’ visibility over these missiles, we physically counted about 15,000 Stinger, Dragon, and Javelin missiles by serial number at selected Army, Navy, and Marine Corps storage sites and two contractor facilities. We selected sites that had a comparatively high incidence of problems found during our first review. We opened 108 missile containers to ensure that a missile was in the container. To inventory the missiles, we used the item managers’ automated database. We then entered this information into a notebook computer. On site, as we physically inventoried, we entered into the computer the serial number of each of the missiles at that location. This information was automatically compared against the database from the item managers. Missiles that were not in the database or at the storage location were reconciled with site and item manager information. We also counted 6,637 AT4 and LAW rockets at randomly selected Army, Navy, and Marine Corps storage sites. At these locations, we opened 89 containers (which contained different quantities of rockets depending on the type) and physically verified the presence of 403 AT4s and 261 LAWs. We used the same procedures as the missiles to inventory the rockets at the Marine Corps storage site. At the Navy and the Army rocket storage sites, an automated database of serial numbers was not available from the item managers. At these two locations, we matched the inventory count against the item manager’s or major command’s records. We tested the reliability of the systems’ data by physically counting the missiles and rockets and matching the count to the item managers’ records; however, we did not test whether the information was provided to the item managers within 24 to 48 hours. We conducted our review from September 1996 to July 1997 in accordance with generally accepted government auditing standards. Unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its issue date. At that time, we will send copies to the Secretaries of Defense, the Army, the Navy, and the Air Force; the Commandant of the Marine Corps; the Director, Office of Management and Budget; and other interested congressional committees. Copies will also be made available to others upon request. Please contact me on (202) 512-8412 if you or your staff have any questions concerning this report. Major contributors to this report are listed in appendix III. Sandra D. Epps Tracy W. Banks The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the actions taken by the Department of Defense (DOD) to correct weaknesses cited in GAO's September 1994 report on the military services' most sensitive category I missiles and to determine if problems still remained. GAO also reviewed DOD's oversight of category I rockets and the vulnerability of category I missiles and rockets and category II grenades, mines, and explosives to theft from U.S. military arsenals by terrorists or extremists. GAO noted that: (1) DOD has taken actions to improve the oversight of category I handheld missiles; (2) it conducted a worldwide inventory of handheld missiles; established a new baseline inventory count as of December 31, 1994; and implemented procedures to track changes to the baseline; (3) DOD also established procedures to check containers to ensure that each had a missile and verify serial numbers; (4) DOD reemphasized physical security procedures to be followed at its facilities; (5) despite DOD's progress toward better oversight of handheld missiles, some weaknesses remain; (6) adjustments continue to be made to the baseline as additional missiles are located and errors are discovered; (7) discrepancies still exist between records of the number of missiles and GAO's physical count; (8) the missiles may be vulnerable to insider theft because DOD is not always selecting a representative sample of containers to be opened during maintenance checks; (9) some facilities are not fully complying with DOD physical security requirements; (10) although GAO was able to match the physical count of AT4 and light antitank weapon (LAW) rockets at each site visited with the item manager's records, GAO also found oversight weaknesses with the category I rockets; (11) the Marine Corps reported three AT4 rockets missing from shipments returning from the Persian Gulf after Operation Desert Storm; (12) the Naval Criminal Investigative Service reached no conclusions on whether the rockets were missing, lost, or stolen, and the investigations were closed; (13) the services have different procedures and requirements for maintaining oversight of the rockets; (14) DOD's accounting and related systems, including its logistics systems, are not integrated; (15) in accordance with the Chief Financial Officer's (CFO) Act of 1990, each agency is to establish an integrated financial management system; (16) establishing an integrated, general ledger controller system, which ties together DOD's accounting systems with its logistics and other key management systems, is critical if DOD is to effectively ensure oversight and control over its sensitive material; (17) GAO did not find any documentation that terrorists or other extremists had stolen any category I handheld missiles or rockets or category II munitions or explosives from DOD arsenals; (18) some weapons continue to be vulnerable to insider theft as quantities of various category II items have been stolen by uniformed or DOD civilians; and (19) DOD and intelligence sources did not have any indication that the stolen items were intended for terrorists.