Senior military commanders and defense officials we met with emphasized that they can reduce, but not eliminate, vulnerabilities and that further terrorist attacks against U.S. forces should be expected. They observed that efforts to defend against the terrorist threat are complicated by a number of factors, including the ability of terrorists to decide where and when to attack and to choose from a wide selection of targets. Moreover, DOD relies heavily on the host nations for many of its security needs. Because of this reliance, efforts to reduce vulnerabilities often require extensive host nation support. In addition, many DOD personnel overseas may not be protected adequately because it is unclear who is responsible for their security. During our March and April visits, we found that deployed U.S. forces were better protected from terrorist attacks like the one that occurred last year at Khobar Towers in Saudi Arabia than they were prior to that terrorist incident. Security improvements were most evident where the risk of terrorism was greatest, such as in the Middle East and Turkey. DOD placed less emphasis on addressing vulnerabilities in countries considered a lower terrorist threat. However, DOD officials said that even in high-threat countries vulnerabilities exist and that new vulnerabilities could emerge as terrorist tactics respond to the measures DOD has taken. In addition to the improvements made at individual sites, DOD initiated a number of changes aimed at enhancing its overall antiterrorism program. However, we found these initiatives did not represent a comprehensive and consistent DOD approach to antiterrorism. We made a number of recommendations for improving the situation. DOD concurred with all of our recommendations except for the one calling for prescriptive DOD-wide physical security standards. DOD believes that commanders, who are responsible for force protection, need flexibility and should not be told how to provide physical security for their personnel. However, the commanders we spoke with believe that such standards would help them carry out this responsibility as well as provide an objective basis for determining whether antiterrorism measures are sufficient. With this overview, let me talk about the security environment for U.S. forces overseas. DOD faces a number of obstacles in defending against future terrorist attacks. First, DOD has a large presence in many countries around the world, offering a plethora of potential targets. Second, predictive intelligence on terrorist attacks is difficult to obtain. Commanders, therefore, may not be in a position to prevent an attack from occurring; they can only prepare to minimize the consequences from an attack. Third, DOD installations are often located on host nation installations and as a result there are limitations on the security measures DOD can undertake. Political and cultural considerations outside the control of local commanders also influence decisions that affect security. During our visits, military officials told us that the question is not whether additional terrorist attacks will occur, but when, where, and how. They emphasized that vulnerabilities to attacks can be reduced, but a zero defects approach to fighting terrorism is not possible. According to DOD officials, terrorism is a pervasive phenomenon, whose specific threats are difficult to predict. It is worldwide in scope, with some terrorist organizations state supported and some only loosely affiliated, in support of multiple causes. It is a transnational phenomenon, acting across geographic and political boundaries. Areas considered safe and benign one day, such as Saudi Arabia prior to the bombings, can quickly become high threat the next. Terrorists’ tactics have not been to challenge U.S. military power directly, but to weaken U.S. resolve through isolated attacks with high publicity value. DOD designates the terrorist threat level faced by personnel in each country. A five-step scale is used to describe the severity of threat. These steps, from highest to lowest, are critical, high, medium, low, and negligible. Threat levels may be raised or lowered on the basis of new information or analysis. As of October 1, 1997, DOD had designated 14 countries as having a high threat level. The list included Egypt, Jordan, Bahrain, Kuwait, Saudi Arabia, Greece, and Turkey. No countries were assessed as having a critical terrorist threat. According to a report issued by the Secretary of Defense following the Khobar Towers bombing, U.S. forces are constantly exposed to the terrorist threat because executing the national security strategy requires their physical presence in many nations. U.S. commanders in the past have agreed to operate out of facilities and locations that now present serious security challenges in today’s terrorist environment. The Khobar Towers complex, for example, was paid for by the Saudis and convenient to U.S. military work areas but was difficult to defend. In most of the countries we visited, we found that many U.S. forces were located in urban areas, closely surrounded by easily accessible buildings or roads. Terrorists can alter their mode of attack. For instance, some commanders in the Middle East are concerned that terrorists will switch to weapons that can be fired over perimeter defenses from hidden locations. One U.S. commander was concerned that terrorists could fire weapons from different sectors of the surrounding city. Such attacks are difficult to defend against because these weapons can be set up, fired, and moved in a very short period of time. In many cases, overseas U.S. forces work at facilities that are owned by the host nation, and the host nation is responsible for their security. As a result, DOD relies on the host nation for important security functions, such as controlling entry onto bases. U.S. commanders in some cases are prevented from taking actions that would make their forces more secure. U.S. forces in the countries we visited are usually prevented from patrolling outside the fencing of their own perimeter. At one location we visited, entry to the base is controlled by host nation security forces with no U.S. military role. The U.S. military does not have its own perimeter within this base and may not approach the base perimeter without escort from host nation personnel. U.S. security officials at this base said because the base perimeter is easily penetrated, they believe themselves to be more vulnerable to small suitcase sized bombs than to truck bombs. Although the responsibility for ensuring force protection for most DOD personnel has been assigned to the geographic combatant commanders, a large group of DOD personnel deployed abroad do not fall under the authority of these commanders. Some of these personnel, such as those assigned to the Defense Attache Office and Marine embassy guards, fall under the authority of a chief of mission, who is responsible for their security. Others, however, while legally the responsibility of a chief of mission, fall into a gray area between the force protection responsibility of the chief of mission and the geographic combatant commander. Many of these personnel were receiving little or no security support from the embassy. Such support can include security guards, physical security assessments of housing and work places, and threat information. In Turkey, for example, the U.S. embassy and local U.S. military representatives identified about 1,500 people whose security falls into this gray area. These include several hundred assigned to the North Atlantic Treaty Organization (NATO) as well as others assigned to the Office of Defense Cooperation, the Army’s Training and Doctrine Command, the Army Corps of Engineers, and Military Traffic Management Command. Embassy officials in Turkey said that antiterrorism responsibility for these people must be clarified. Either DOD must take responsibility for these people, they said, or the embassy must have explicit authority over them to enforce the State Department’s security regulations. The officials added that State will need a concomitant increase in resources to carry out any added responsibilities. Following the bombing in Saudi Arabia, DOD and State signed a memorandum of understanding clarifying security responsibilities for all DOD personnel in the region. In our July report, we recommended that the Secretary of Defense take the necessary steps to expedite approval of a similar memorandum of understanding with the Secretary of State that would clarify the antiterrorism responsibilities for all DOD personnel stationed overseas who do not fall under the command of a geographic combatant commander. DOD concurred with this recommendation. During our review, we found the U.S. Central Command and its service component commands had taken a number of steps to improve the protection of U.S. forces from terrorist attacks. The U.S. Central Command’s area of responsibility includes the Middle East, the region with the most high-threat countries. The special emphasis at U.S. Central Command was not unexpected given that its forces were the most recent targets of terrorist attacks. Among the actions taken, the command had determined the range of specific terrorist threats it needed to counteract in its area of responsibility, including a 20,000-pound truck bomb—the estimated approximate size of the bomb that struck Khobar Towers; devised threat-based standards, such as stand-off, to guide the design and construction of new facilities and modifications to existing structures; established an office that coordinates antiterrorist activities in the region and reports directly to the Deputy Commander in Chief, U.S. Central Command; and identified a need for and filled hundreds of additional security positions. During our visits to overseas bases, we found that significant efforts had been taken in Turkey and the Middle East to increase the protection of U.S. forces from vehicle bombs. In these countries, sites had been fortified in various ways for protection against a possible terrorist attack, particularly against a truck bomb like the one that struck Khobar Towers. Commanders were attempting to extend the stand-off distance around their facilities. Where sufficient stand-off was not available, they were using other measures, such as concrete barriers, to mitigate against the impact of a truck bomb. Saudi Arabia had seen the most profound changes, as thousands of DOD personnel were moved to remote facilities in the desert and restricted from leaving base throughout their entire tour. Most military dependents were returned to the United States to reduce exposure to the terrorist threat. Many dependents also were being withdrawn from Kuwait and Bahrain. In Turkey, an off-base apartment building dedicated solely to U.S. military personnel was closed because it was considered too vulnerable to a truck bomb attack. The personnel living in this building were relocated to on-base housing or dispersed to other off-base housing facilities. The base also had installed concrete barriers to make on-base residential areas and headquarters buildings less vulnerable and had begun to repair holes in the perimeter fence. Despite these improvements, commanders and security officials acknowledged that vulnerabilities remained. We discuss these vulnerabilities in our classified statement. Some U.S. officials expressed concern that efforts to isolate and fortify DOD facilities could have the effect of making other targets more vulnerable. For instance, terrorists could decide to target small military offices or vehicles outside the main installations. Moreover, they could target housing areas because in Turkey and some Middle East countries, many U.S. military personnel were living in off-base housing complexes or in individual quarters dispersed among the civilian population. At the time of our review, DOD had initiated a number of changes in its overall antiterrorism program in response to the Khobar Towers bombing. Some of the major initiatives were as follows: The Secretary of Defense assigned the Chairman, Joint Chiefs of Staff, to be his principal advisor on antiterrorism. To support this added responsibility, the Chairman created a new office in the Joint Staff—the Deputy Directorate for Combating Terrorism. The Secretary of Defense directed that the five geographic combatant commanders take on increased antiterrorism responsibilities. Prior to this, the combatant commanders did not have explicit responsibility for ensuring the force protection of all DOD activities in their area of responsibility. Under the direction of the Chairman, Joint Chiefs of Staff, the Defense Special Weapons Agency began to conduct vulnerability assessments at installations. The assessments, which supplement those done by other DOD components, are intended to help commanders understand their vulnerabilities to terrorist attack and to give them options for enhancing security and mitigating weapon effects. DOD mandated more robust antiterrorism training for personnel deploying to medium- and high-threat countries. The training is intended to increase awareness of the threat and provide information on individual protective measures. Additional training is to be provided to (1) personnel designated as unit antiterrorism instructors and advisors, (2) officers attending pre-command courses, and (3) executive-level officials with antiterrorism responsibilities. The Secretary of Defense established a centrally controlled fund to support emergency high-priority antiterrorism requirements not funded by the services. The fund is managed by the Joint Staff. In fiscal year 1998, DOD requested $15 million for this fund. The services also had planned or instituted changes in their approach to antiterrorism. Most notably, the Air Force created a Force Protection Group that would be among the first to deploy in a contingency and would be responsible for establishing the security infrastructure at the deployment site. Nevertheless, Mr. Chairman, our work raised concerns that DOD’s initiatives were falling short of establishing a comprehensive and consistent approach to antiterrorism. This was the vision set forth by the Downing Assessment Task Force, appointed by the former Secretary of Defense to investigate the Khobar Towers bombing and make recommendations on how to prevent or minimize the damage of future attacks. The Secretary on the whole concurred with the task force’s report. The report identified key principles for managing and improving the antiterrorism program, and we used these principles as the primary criteria for our review. The Downing task force found, and our review confirmed, that commanders at all levels lacked definitive guidance on implementing an antiterrorism program. Such guidance—in the form of prescriptive, measurable standards—is one of the tools commanders need to fulfill their responsibilities for protecting the force. In the absence of definitive guidance, commanders lack an objective basis for determining whether their antiterrorism measures are sufficient. They must rely instead on their own knowledge and experience and that of their staff. I should note here that U.S. Central Command was much further along than the other combatant commands or DOD as a whole in providing definitive guidance to commanders in its area of responsibility. In our July report, we made a number of recommendations to the Secretary of Defense. Specifically, we recommended that the Secretary direct the Chairman, Joint Chiefs of Staff, to develop the following common standards and procedures: standardized vulnerability assessments to ensure a consistent level of quality and to provide a capability to compare the results from different sites, DOD-wide physical security standards that are measurable yet provide a means for deviations when required by local circumstances, and procedures to maintain greater consistency among commands in their implementation of threat condition security measures. DOD concurred with two of our recommendations but did not agree on the need for DOD-wide physical security standards Mr. Chairman, it is important to note that in its investigation of the Khobar Towers bombing, the Downing task force found that DOD had not established physical security standards, including standards governing the design and construction of new buildings or the modifications of existing structures against the terrorist threat. The Downing task force recommended that DOD adopt prescriptive physical security standards. We found that DOD had not implemented this recommendation and had no plans to do so. The Downing task force held up the State Department’s physical security standards as an example for DOD to follow in developing its own standards. The task force characterized State’s standards as detailed and descriptive. Most importantly, the task force said that State had adopted the standards as requirements, not as guidance. State’s standards, developed in coordination with the Overseas Security Policy Board, apply to all U.S. missions abroad under the authority of a chief of mission. The standards were created primarily for U.S. diplomatic offices and residential facilities. They are based on the assessed threat level in the country, with the result that facilities in higher threat countries must meet more stringent requirements. For high-threat areas, the standards address such physical security concerns as the height of perimeter walls, entry control, stand-off distance, and the location of parking areas. “Commanders at all levels shall develop and implement a physical security plan, as part of the program, that incorporates facilities, equipment, trained personnel, and procedures into a comprehensive effort designed to provide maximum antiterrorism protection to personnel and assets.” More specific guidance to implement these performance standards is provided in a DOD handbook, but the handbook guidance is advisory only. DOD officials told us they had no plans to issue DOD-wide physical security standards. They believe that the variability in threat and vulnerabilities among geographic areas and individual sites precludes such standards. However, we noted that diplomatic missions also face different threats and vulnerabilities yet are required to meet State’s physical security standards. The DOD officials also said commanders responsible for antiterrorism may establish specific standards if they choose. Of the five geographic combatant commands, only U.S. Central Command had developed prescriptive design standards. Central Command officials said that since DOD declined to issue standards for protecting facilities against a bomb blast, they developed their own. Officials at the other geographic combatant commands had various opinions regarding the need for DOD-wide physical security standards. For instance, U.S. European Command officials stated that DOD should establish minimum physical security standards for each threat level and then require the services to publish more specific guidance. Such an approach would allow for differences among the services. U.S. Pacific Command officials believe that measurable DOD-wide physical security standards are a good idea if they provide flexibility to allow for variability in the threat and local circumstances. U.S. Navy Europe stated that there is a need for a DOD-wide standard that is tough enough to force all activities to a minimum level of compliance but flexible enough to allow an activity to adjust for impediments that might prevent them from complying with the requirements. In its official comments on our report, DOD stated that commanders should not be told how to accomplish the task of providing physical security for their personnel. DOD believes that its new program standards, supplemented by existing physical security guidance, will be sufficient to assist commanders. DOD also stated that it would be a mistake to have a central office in Washington, D.C., issue standards because such an office could not react quickly enough to changes in terrorists tactics. Furthermore, DOD stated that establishing standards would require a bureaucratic waiver process for facilities that do not meet the standards. We continue to believe that common DOD standards would aid commanders by providing them with a more objective basis for determining whether their forces are adequately protected from terrorist threats. Many of the commanders and antiterrorism officials we spoke with specifically noted the need for, and the importance of, DOD-wide standards. We agree with DOD that any physical security standards must be flexible to accommodate unique security situations and recognized this need for flexibility in our recommendation. The common DOD standards could be supplemented as warranted by the geographic combatant commands and their service component commands. Similarly, if a waiver process is required, it could be implemented by these commands rather than by a central office in Washington, D.C. Moreover, in our view and in the view of several commanders we spoke with, a waiver process is likely to add a measure of accountability to the program and assures that senior-level officials are aware of potential problems. Mr. Chairman, that concludes our prepared statement. We would be pleased to answer any questions you or Members of the Subcommittee may have. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO discussed the Department of Defense's (DOD) efforts to protect overseas forces from terrorist attack, focusing on Turkey and the Middle East and on: (1) the environment U.S. forces overseas are facing , including the terrorist threat and the relationship with the host nation governments; (2) the measures DOD has taken to enhance the security of personnel in the countries GAO visited; and (3) DOD initiatives to improve its overall force protection program. GAO noted that: (1) DOD has a large presence in many countries around the world, offering a plethora of potential targets; (2) predictive intelligence on terrorist attacks is difficult to obtain, and commanders may not be in a position to prevent an attack from occurring and can only prepare to minimize the consequences from an attack; (3) DOD installations are often located on host nation installations and, as a result, there are limitations on the security measures DOD can undertake; (4) the U.S. Central Command and its service component commands had taken a number of steps to improve the protection of U.S. forces from terrorist attacks, including: (a) determining the range of specific terrorist threats it needed to counteract in its area of responsibility, including a 20,000-pound truck bomb, the estimated approximate size of the bomb that struck Khobar Towers in Saudi Arabia; (b) devising threat-based standards, such as stand-off, to guide the design and construction of new facilities and modifications to existing structures; (c) establishing an office that coordinates antiterrorist activities in the region and reports directly to the Deputy Commander in Chief, U.S. Central Command; and (d) identifying a need for and filling hundreds of additional security positions; (5) DOD had initiated a number of changes in its overall antiterrorism program in response to the Khobar Towers bombing, including: (a) the assignment of the Chairman of the Joint Chiefs of Staff to be the Secretary of Defense's principal advisor on antiterrorism; (b) the direction of the five geographic combatant commanders to take on increased antiterrorism responsibilities; (c) vulnerability assessments at installations by the Defense Special Weapons Agency; (d) mandated, more robust antiterrorism training for personnel deployed to medium- and high-threat countries; (e) the establishment of a centrally controlled fund to support emergency high-priority antiterrorism requirements not funded by the services; and (f) changes in the services' approach to antiterrorism; and (6) despite these changes, GAO's work raised concerns that DOD's initiatives were falling short of establishing a comprehensive and consistent approach to antiterrorism.