Since DHS began operations in March 2003, it has developed and implemented key policies, programs, and activities for implementing its homeland security missions and functions that have created and strengthened a foundation for achieving its potential as it continues to mature. We reported in our assessment of DHS’s progress and challenges 10 years after the September 11 attacks, as well as in our more recent work, that the department has implemented key homeland security operations and achieved important goals in many areas. These included developing strategic and operational plans across its range of missions; hiring, deploying, and training workforces; establishing new, or expanding existing, offices and programs; and developing and issuing policies, procedures, and regulations to govern its homeland security operations. For example: DHS successfully hired, trained, and deployed workforces, including the federal screening workforce to assume screening responsibilities at airports nationwide, and about 20,000 agents to patrol U.S. land borders. DHS also created new programs and offices, or expanded existing ones, to implement key homeland security responsibilities, such as establishing the National Cybersecurity and Communications Integration Center to, among other things, coordinate the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. DHS issued policies and procedures addressing, among other things, the screening of passengers at airport checkpoints, inspecting travelers seeking entry into the United States, and assessing immigration benefit applications and processes for detecting possible fraud. DHS issued the National Response Framework, which outlines disaster response guiding principles, including major roles and responsibilities of government, nongovernmental organizations, and private sector entities for response to disasters of all sizes and causes. After initial difficulty in fielding the program, DHS developed and implemented Secure Flight, a passenger prescreening program through which the federal government now screens all passengers on all commercial flights to, from, and within the United States. In fiscal year 2011, DHS reported data indicating it had met its interim goal to secure the land border with a decrease in apprehensions. Our data analysis showed that apprehensions decreased within each southwest border sector and by 68 percent in the Tucson sector from fiscal years 2006 through 2011. Border Patrol officials attributed this decrease in part to changes in the U.S. economy and achievement of Border Patrol strategic objectives. We reported in September 2012 that DHS, through its component agencies, particularly the Coast Guard and U.S. Customs and Border Protection (CBP), has made substantial progress in implementing various programs that, collectively, have improved maritime security. For example, in November 2011, we reported that the Coast Guard’s risk assessment model generally met DHS criteria for being complete, reproducible, documented, and defensible. Coast Guard units throughout the country use this risk model to improve maritime domain awareness and better assess security risks to key maritime infrastructure. DHS has taken important actions to conduct voluntary critical infrastructure and key resources (CIKR) security surveys and vulnerability assessments, provide information to CIKR stakeholders, and assess the effectiveness of security surveys and vulnerability assessments. GAO, Aviation Security: Efforts to Validate TSA’s Passenger Screening Behavior Detection Program Underway, but Opportunities Exist to Strengthen Validation and Address Operational Challenges, GAO-10-763 (Washington, D.C.: May 20, 2010). of $1.5 billion. To develop the Plan, DHS conducted an analysis of alternatives and outreach to potential vendors, and took other steps to test the viability of the current system. However, DHS has not documented the analysis justifying the specific types, quantities, and deployment locations of border surveillance technologies proposed in the Plan, or defined the mission benefits or developed performance metrics to assess its implementation of the Plan. We are reviewing DHS’s efforts to implement the Plan, and we expect to report on the results of our work later this year. DHS spent more than $200 million on advanced spectroscopic portals, used to detect smuggled nuclear or radiological materials, without issuing an accurate analysis of both the benefits and the costs—which we later estimated at over $2 billion—and a determination of whether additional detection capabilities were worth the additional costs. DHS subsequently canceled the advanced spectroscopic portals program as originally conceived. Each year DHS processes millions of applications and petitions for more than 50 types of immigrant- and nonimmigrant-related benefits for persons seeking to study, work, visit, or live in the United States, and for persons seeking to become U.S. citizens. DHS embarked on a major initiative in 2005 to transform its current paper-based system into an electronic account–based system that is to use electronic adjudication and account- based case management tools, including tools that are to allow applicants to apply online for benefits. However, DHS did not consistently follow the acquisition management approach outlined in its management directives in developing and managing the program. The lack of defined requirements, acquisition strategy, and associated cost parameters contributed to program deployment delays of over 2 years. In addition, DHS estimates that through fiscal year 2011, it spent about $703 million, about $292 million more than the original program baseline estimate. We found that DHS could reduce the costs to the federal government related to major disasters declared by the President by updating the principal indicator on which disaster funding decisions are based and better measuring a state’s capacity to respond without federal assistance. From fiscal years 2004 through 2011, the President approved 539 major disaster declarations at a cost of $78.7 billion. Our work on DHS’s mission functions and crosscutting issues has identified three key themes—leading and coordinating the homeland security enterprise, implementing and integrating management functions for results, and strategically managing risks and assessing homeland security efforts—that have impacted the department’s progress since it began operations. As these themes have contributed to challenges in the department’s management and operations, addressing them can result in increased efficiencies and effectiveness. For example, DHS can help reduce cost overruns and performance shortfalls by strengthening the management of its acquisitions, and reduce inefficiencies and costs for homeland security by improving its research and development (R&D) management. These themes provide insights that can inform DHS’s efforts as it works to implement its missions within a dynamic and evolving homeland security environment. DHS made progress and has had successes in all of these areas, but our work found that these themes have been at the foundation of DHS’s implementation challenges, and need to be addressed from a department-wide perspective to effectively and efficiently position the department for the future. DHS is one of a number of entities with a role in securing the homeland and has significant leadership and coordination responsibilities for managing efforts across the homeland security enterprise. To satisfy these responsibilities, it is critically important that DHS develop, maintain, and leverage effective partnerships with its stakeholders while at the same time addressing DHS-specific responsibilities in satisfying its missions. DHS has made important strides in providing leadership and coordinating efforts across the homeland security enterprise, but needs to take additional actions to forge effective partnerships and strengthen the sharing and utilization of information. For example, DHS has improved coordination and clarified roles with state and local governments for emergency management. DHS also strengthened its partnerships and collaboration with foreign governments to coordinate and standardize security practices for aviation security. The department has further demonstrated leadership by establishing a governance board to serve as the decision-making body for DHS information-sharing issues. The board has enhanced collaboration among DHS components and identified a list of key information-sharing initiatives. Although DHS has made important progress, more work remains. We designated terrorism-related information sharing as high risk in 2005 because the government faces significant challenges in analyzing and disseminating this information in a timely, accurate, and useful manner. In our most recent high-risk update, we reported that the federal government’s leadership structure is committed to enhancing the sharing and management of terrorism-related information and has made significant progress defining a governance structure to implement the Information Sharing Environment—an approach that is intended to serve as an overarching solution to strengthening sharing. However, we also reported that the key departments and agencies responsible for information-sharing activities, including DHS, need to continue their efforts to share and manage terrorism-related information by, among other things, identifying technological capabilities and services that can be shared across departments and developing metrics that measure the performance of, and results achieved by, projects and activities. DHS officials explained that its information-sharing initiatives are integral to its mission activities and are funded through its components’ respective budgets. However, in September 2012 we reported that five of DHS’s top eight priority information-sharing initiatives faced funding shortfalls, and DHS had to delay or scale back at least four of them. Following its establishment, DHS focused its efforts primarily on implementing its various missions to meet pressing homeland security needs and threats, and less on creating and integrating a fully and effectively functioning department. As the department matured, it has put into place management policies and processes and made a range of other enhancements to its management functions, which include acquisition, information technology, financial, and human capital management. However, DHS has not always effectively executed or integrated these functions. While challenges remain for DHS to address across its range of missions, the department has made considerable progress in transforming its original component agencies into a single cabinet-level department and positioning itself to achieve its full potential. Important strides have also been made in strengthening the department’s management functions and in integrating those functions across the department, particularly in recent years. However, continued progress is needed in order to mitigate the risks that management weaknesses pose to mission accomplishment and the efficient and effective use of the department’s resources. In particular, the department needs to demonstrate continued progress in implementing and strengthening key management initiatives and addressing corrective actions and outcomes that GAO identified, and DHS committed to taking actions address this high-risk area. For example: Acquisition management: Although DHS has made progress in strengthening its acquisition function, most of the department’s major acquisition programs continue to cost more than expected, take longer to deploy than planned, or deliver less capability than promised. We identified 42 programs that experienced cost growth, schedule slips, or both, with 16 of the programs’ costs increasing from a total of $19.7 billion in 2008 to $52.2 billion in 2011—an aggregate increase of 166 percent. We reported in September 2012 that DHS leadership has authorized and continued to invest in major acquisition programs even though the vast majority of those programs lack foundational documents demonstrating the knowledge needed to help manage risks and measure performance. We recommended that DHS modify acquisition policy to better reflect key program and portfolio management practices and ensure acquisition programs fully comply with DHS acquisition policy. DHS concurred with our recommendations and reported taking actions to address some of them. Information technology management: DHS has defined and begun to implement a vision for a tiered governance structure intended to improve information technology (IT) program and portfolio management, which is generally consistent with best practices. However, the governance structure covers less than 20 percent (about 16 of 80) of DHS’s major IT investments and 3 of its 13 portfolios, and the department has not yet finalized the policies and procedures associated with this structure. In July 2012, we recommended that DHS finalize the policies and procedures and continue to implement the structure. DHS agreed with these recommendations and estimated it would address them by September 2013. Financial management: DHS has, among other things, received a qualified audit opinion on its fiscal year 2012 financial statements. DHS is working to resolve the audit qualification to obtain an unqualified opinion for fiscal year 2013. However, DHS components are currently in the early planning stages of their financial systems modernization efforts, and until these efforts are complete, their current systems will continue to inadequately support effective financial management, in part because of their lack of substantial compliance with key federal financial management requirements. Without sound controls and systems, DHS faces challenges in obtaining and sustaining audit opinions on its financial statement and internal controls over financial reporting, as well as ensuring its financial management systems generate reliable, useful, and timely information for day-to-day decision making. Human capital management: In December 2012, we identified several factors that have hampered DHS’s strategic workforce planning efforts and recommended, among other things, that DHS identify and document additional performance measures to assess workforce planning efforts. DHS agreed with these recommendations and stated that it plans to take actions to address them. In addition, DHS has made efforts to improve employee morale, such as taking actions to determine the root causes of morale problems. Despite these efforts, however, federal surveys have consistently found that DHS employees are less satisfied with their jobs than the government-wide average. In September 2012, we recommended, among other things, that DHS improve its root cause analysis efforts of morale issues. DHS agreed with these recommendations and noted actions it plans to take to address them. Forming a new department while working to implement statutorily mandated and department-initiated programs and responding to evolving threats, was, and is, a significant challenge facing DHS. Key threats, such as attempted attacks against the aviation sector, have impacted and altered DHS’s approaches and investments, such as changes DHS made to its processes and technology investments for screening passengers and baggage at airports. It is understandable that these threats had to be addressed immediately as they arose. However, limited strategic and program planning by DHS, as well as assessment to inform approaches and investment decisions, has contributed to programs not meeting strategic needs or not doing so in an efficient manner. Further, DHS has made important progress in analyzing risk across sectors, but it has more work to do in using this information to inform planning and resource-allocation decisions. Risk management has been widely supported by Congress and DHS as a management approach for homeland security, enhancing the department’s ability to make informed decisions and prioritize resource investments. Since DHS does not have unlimited resources and cannot protect the nation from every conceivable threat, it must make risk-informed decisions regarding its homeland security approaches and strategies. We reported in September 2011 that using existing risk assessment tools could assist DHS in prioritizing its Quadrennial Homeland Security Review (QHSR) implementation mechanisms. For example, examining the extent to which risk information could be used to help prioritize implementation mechanisms for the next QHSR could help DHS determine how to incorporate and use such information to strengthen prioritization and resource allocation decisions. DHS officials plan to implement a national risk assessment in advance of the next QHSR, which DHS anticipates conducting in fiscal year 2013. Our work has also found that DHS continues to miss opportunities to optimize performance across its missions due to a lack of reliable performance information or assessment of existing information; evaluation among possible alternatives; and, as appropriate, adjustment of programs or operations that are not meeting mission needs. For example, we reported in February 2013 that the government’s strategy documents related to Information Systems and the Nation’s Cyber Critical Infrastructure Protection included few milestones or performance measures, making it difficult to track progress in accomplishing stated goals and objectives. In addition, in September 2012, we reported that DHS had approved a third generation of BioWatch technology—to further enhance detection of certain pathogens in the air—without fully evaluating viable alternatives based on risk, costs, and benefits. As the department further matures and seeks to optimize its operations, DHS will need to look beyond immediate requirements; assess programs’ sustainability across the long term, particularly in light of constrained budgets; and evaluate trade-offs within and among programs across the homeland security enterprise. Doing so should better equip DHS to adapt and respond to new threats in a sustainable manner as it works to address existing ones. Given DHS’s role and leadership responsibilities in securing the homeland, it is critical that the department’s programs and activities are operating as efficiently and effectively as possible; are sustainable; and continue to mature, evolve, and adapt to address pressing security needs. Since it began operations in 2003, DHS has implemented key homeland security operations and achieved important goals and milestones in many areas. DHS has also made important progress in strengthening partnerships with stakeholders, improving its management processes and sharing of information, and enhancing its risk management and performance measurement efforts. Important strides have also been made in strengthening the department’s management functions and in integrating those functions across the department, particularly in recent years. Senior leaders at the department have also continued to demonstrate strong commitment to addressing the department’s management challenges across the management functions. These accomplishments are especially noteworthy given that the department has had to work to transform itself into a fully functioning cabinet department while implementing its missions—a difficult undertaking for any organization and one that can take years to achieve even under less daunting circumstances. Impacting the department’s efforts have been a variety of factors and events, such as attempted terrorist attacks and natural disasters, as well as new responsibilities and authorities provided by Congress and the administration. These events collectively have forced DHS to continually reassess its priorities and reallocate resources as needed, and have impacted its continued integration and transformation. Given the nature of DHS’s mission, the need to remain nimble and adaptable to respond to evolving threats, as well as to work to anticipate new ones, will not change and may become even more complex and challenging as domestic and world events unfold, particularly in light of reduced budgets and constrained resources. Our work has shown that to better position itself to address these challenges, DHS should place an increased emphasis on and take additional action in supporting and leveraging the homeland security enterprise; managing its operations to achieve needed results; and strategically planning for the future while assessing and adjusting, as needed, what exists today. DHS also needs to continue its efforts to address the associated high-risk areas that we have identified which have affected its implementation efforts. Addressing these issues will be critically important for the department to strengthen its homeland security programs and operations. DHS has indeed made significant strides in protecting the homeland, but has yet to reach its full potential. Chairman Duncan, Ranking Member Barber, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions you may have at this time. For further information regarding this testimony, please contact Cathleen A. Berrick at (202) 512-3404 or berrickc@gao.gov. In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony are Scott Behen, Adam Hoffman, and David Maurer. Key contributors for the previous work that this testimony is based on are listed within each individual product. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Since the Department of Homeland Security (DHS) began operations in 2003, it has implemented key homeland security operations and achieved important goals and milestones in many areas to create and strengthen a foundation to reach its potential. As it continues to mature, however, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts. In its assessment of DHS's progress and challenges 10 years after the terrorist attacks of September 11, 2001, as well as its more recent work, GAO reported that DHS had, among other things, developed strategic and operational plans across its range of missions; established new, or expanded existing, offices and programs; and developed and issued policies, procedures, and regulations to govern its homeland security operations. However, GAO also identified that challenges remained for DHS to address across its missions. Examples of progress made and work remaining include the following: Aviation security. DHS developed and implemented Secure Flight, a program through which the federal government now prescreens all passengers on all commercial flights to, from, and within the United States. However, DHS did not validate the science supporting its behavior detection program before deploying behavior detection officers at airports, including determining whether such techniques could be successfully used to detect threats. Border security/immigration enforcement. DHS reported data indicating it had met its goal to secure the land border because of a decrease in apprehensions, attributed in part to changes in the U.S. economy and achievement of DHS strategic objectives. However, DHS has not developed a process to identify and analyze program risks, such as a process to evaluate prior and suspected cases of fraud, in its Student and Exchange Visitor Program, a program intended to, among other things, ensure that foreign students studying in the United States comply with the terms of their admission into the country. Emergency preparedness and response. DHS issued the National Response Framework, which outlines disaster response guiding principles. However, GAO reported that DHS could reduce the costs to the federal government related to major disasters declared by the President by updating the principal indicator on which disaster funding decisions are based and better measuring a state's capacity to respond without federal assistance. GAO has identified three key themes--leading and coordinating the homeland security enterprise, implementing and integrating management functions for results, and strategically managing risks and assessing homeland security efforts--that DHS needs to address from a departmentwide perspective to effectively and efficiently position the department for the future. DHS has made progress in all three areas by, among other things, providing leadership and coordination. However, DHS has continued to face challenges in all of these areas. For example, GAO reported that improving research and development could help DHS reduce, among other things, cost overruns and performance shortfalls by reducing inefficiencies and costs for homeland security. While this testimony contains no new recommendations, GAO has previously made about 1,800 recommendations to DHS designed to strengthen its programs and operations. DHS has addressed more than 60 percent of them, has efforts underway to address others, and has taken additional action to strengthen the department.