In November 2002, the Homeland Security Act was enacted into law, creating DHS. This act defined the department’s missions to include preventing terrorist attacks within the United States; reducing U.S. vulnerability to terrorism; and minimizing the damages, and assisting in the recovery from, attacks that occur within the United States. The act also specified major responsibilities for the department, including to analyze information and coordinate the protection of critical infrastructure; coordinate efforts to develop countermeasures against chemical, biological, radiological, nuclear, and other emerging terrorist threats; secure U.S. borders and transportation systems; and manage the federal government’s response to terrorist attacks and major disasters. Various laws have been enacted and presidential directives have been issued that, among other things, expand, modify, or clarify DHS’s missions and responsibilities. For example, these laws and directives have reorganized departmental offices and functions; clarified DHS’s roles and responsibilities, such as for emergency preparedness and response; and directed DHS to complete various strategic documents or implement specific programs within certain time frames. For example, the Aviation and Transportation Security Act, enacted in November 2001, established the Transportation Security Administration (TSA) and, among other things, included requirements for deploying a federal screening workforce at airports and screening all checked baggage transported on passenger aircraft using explosive detection systems. The Maritime Transportation Security Act of 2002 and the Security and Accountability For Every Port Act of 2006 (SAFE Port Act), among other things, established and modified a maritime security framework to include U.S. vessel and port facility security requirements, an international port security assessment program, and programs for scanning cargo containers. The Intelligence Reform and Terrorism Prevention Act of 2004 included provisions related to intelligence, immigration enforcement, border security, and aviation security, such as those calling for an increase in the number of Border Patrol agents and full-time investigators for violations of immigration law, subject to the availability of appropriations, and requiring DHS to develop a national strategy for transportation security. The Post-Katrina Emergency Management Reform Act of 2006 required changes to the Federal Emergency Management Agency’s (FEMA) organizational and management structure, and addressed other emergency management areas, such as emergency communications, and national planning and preparedness. The Implementing Recommendations of the 9/11 Commission Act of 2007 includes provisions related to critical infrastructure protection, transportation security, and chemical, biological, radiological, and nuclear threats, among other areas. The law references the recommendations made by the National Commission on Terrorist Attacks Upon the United States (known as the 9/11 Commission). DHS began operations in March 2003, and its establishment represented a fusion of 22 federal agencies to coordinate and centralize the leadership of many homeland security activities under a single department. The department’s total budget authority has increased from about $39 billion in fiscal year 2004 to about $55 billion in fiscal year 2011. The department’s fiscal year 2012 budget request is about $57 billion in total funding. Table 1 provides information on DHS’s budget authority for each fiscal year from 2004 though 2011, as reported by DHS. A variety of factors have affected DHS’s efforts to implement its mission functions since its establishment, including several departmental reorganizations. Most notably, in 2005 DHS announced the outcome of its Second Stage Review, a systematic evaluation of DHS’s operations, policies, and structures. As a result of this review, the department realigned existing directorates. The Post-Katrina Emergency Management Reform Act provided for the further reorganization of functions within the department by, in particular, realigning DHS’s emergency preparedness and response responsibilities. Further, as a result of the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS reorganized its intelligence-related operations. In addition to these reorganizations, domestic and international events have affected DHS’s implementation efforts. For example, Hurricanes Katrina and Rita, the 2009 H1N1 pandemic, the attempted airline attack on December 25, 2009, and the 2010 Gulf oil spill required rapid responses from the department and impacted DHS’s plans and operations for mitigating vulnerabilities and addressing threats, and its progress in implementing its missions. Figure 1 provides a timeline of selected events that have affected DHS’s implementation efforts. Since DHS began operations in March 2003, it has developed and implemented key policies, programs, and activities for implementing its homeland security missions and functions that have created and strengthened a foundation to achieve its potential as it continues to mature. However, the department’s efforts have been hindered by challenges faced in leading and coordinating the homeland security enterprise; implementing and integrating its management functions for results; and strategically managing risk and assessing, and adjusting as necessary, its homeland security efforts. DHS has made progress in these three areas, but needs to take additional action, moving forward, to help it achieve its full potential. DHS has made important progress in implementing and strengthening its mission functions over the past 8 years. DHS implemented key homeland security operations and achieved important goals and milestones in many areas. The department’s accomplishments include developing strategic and operational plans across its range of missions; hiring, deploying and training workforces; establishing new, or expanding existing, offices and programs; and developing and issuing policies, procedures, and regulations to govern its homeland security operations. Specifically:  DHS issued strategic and operational plans to guide its homeland security efforts, such as the QHSR, which provided a strategic framework for homeland security, and the National Response Framework, which is built upon coordinating structures to align key roles and responsibilities across the nation, linking all levels of government, nongovernmental organizations, and the private sector.  DHS successfully hired, trained, and deployed workforces, such as a federal screening workforce at airports nationwide. DHS also has about 20,000 agents to patrol the U.S. land borders and about 20,600 officers to conduct screening at air, land, and sea ports of entry.  DHS created new programs and offices, or expanded existing ones, to implement key homeland security responsibilities, such as establishing the U.S. Computer Emergency Readiness Team to, among other things, coordinate the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. DHS also expanded programs for identifying and removing aliens subject to removal from the United States and for preventing unauthorized aliens from entering the country.  DHS issued policies and procedures addressing, among other things, the screening of passengers at airport checkpoints, inspecting travelers seeking entry into the United States, and assessing immigration benefit applications and processes for detecting possible fraud. Establishing these elements and others are important accomplishments and have been critical for the department to position and equip itself for fulfilling its homeland security missions and functions. However, our work has shown that more work remains for DHS to address weaknesses in its current operational and implementation efforts and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. For example, we have reported that many DHS programs and investments have experienced cost overruns, schedule delays, and performance problems, including, for instance, DHS’s recently canceled technology program for securing U.S. borders, known as the Secure Border Initiative Network, and some technologies for screening passengers at airport checkpoints. DHS also has not yet fully implemented its roles and responsibilities for developing and implementing key homeland security programs and initiatives. For example, FEMA has not yet developed a set of target capabilities for disaster preparedness or established metrics for assessing those capabilities to provide a framework for evaluating preparedness, as required by the Post-Katrina Emergency Management Reform Act of 2006. Further, DHS has not yet fully deployed technologies to meet key missions for border, aviation, and maritime security. Our work has also shown that DHS should take additional action to improve the efficiency and effectiveness of a number of its programs and activities by, for example, improving program management and oversight, and better assessing homeland security requirements, needs, costs, and benefits, such as for key acquisition and technology programs. Table 2 provides additional information on key progress and work remaining in each of DHS’s functional mission areas, as identified by our work and supplemented by that of the DHS IG, with an emphasis on work completed since 2008. We have made approximately 1,500 recommendations to DHS to help address these issues, and DHS has addressed about half of them and has actions underway to address others. Appendixes III through XII provide more detailed information on our assessment of progress made and work remaining in each functional, including recommendations we have made and the department’s efforts to implement them. Impacting the department’s ability to efficiently and effectively satisfy its missions are: the need to integrate and strengthen its management functions; the need for increased utilization of performance assessments; the need for an enhanced use of risk information to inform planning, programming, and investment decision-making; limitations in effective sharing and use of terrorism-related information;  partnerships that are not sustained or fully leveraged; and  limitations in developing and deploying technologies to meet mission needs. DHS made progress in addressing these areas, but more work is needed, going forward, to further mitigate these challenges and their impact on DHS’s mission implementation. As we have previously reported, while it is important that DHS continue to work to strengthen each of its functional areas, it is equally important that these areas be addressed from a comprehensive, departmentwide perspective to help mitigate longstanding issues that have impacted the department’s progress. Table 3 provides examples of crosscutting issues that have impacted the department’s progress, as identified by our work. Appendixes XIII through XVIII provide more detailed information on our assessment of progress made and work remaining in each crosscutting area, including recommendations we have made and DHS’s efforts to implement them. Our work on the functional mission areas and crosscutting issues discussed in this report has identified several key themes—leading and coordinating the homeland security enterprise, implementing and integrating management functions for results, and strategically managing risks and assessing homeland security efforts—that have impacted the department’s progress since it began operations. These themes provide insights that can inform DHS’s efforts, moving forward, as it works to implement its missions within a dynamic and evolving homeland security environment, one in which a broad range of threats face the nation—from terrorists’ possible use of a chemical or biological agent to carry out an attack to cyber threats and intrusions to natural disasters and infectious diseases. DHS made progress and had successes in all of these areas, but our work found that these themes have been at the foundation of DHS’s implementation challenges, and need to be addressed from a departmentwide perspective to position DHS for the future and enable it to satisfy the expectations set for it by the Congress, the administration, and the country. Leading and coordinating the homeland security enterprise. While DHS is one of a number of entities with a role in securing the homeland, it has significant leadership and coordination responsibilities for managing efforts across the homeland security enterprise. To satisfy these responsibilities, it is critically important that DHS develop, maintain and leverage effective partnerships with its stakeholders, while at the same time addressing DHS-specific responsibilities in satisfying its missions. Before DHS began operations, we reported that the quality and continuity of the new department’s leadership would be critical to building and sustaining the long-term effectiveness of DHS and achieving homeland security goals and objectives. In particular, we reported that top leadership involvement and clear lines of accountability for making improvements would be critical to marshalling the needed resources and building and maintaining organizationwide commitment to new ways of doing business. We further reported that to secure the nation, DHS must form effective and sustained partnerships between components and also with a range of other entities, including federal agencies; state, local, and tribal governments; the private and nonprofit sectors; and international partners. Critical aspects of DHS’s success depend on well-functioning relationships with third parties, and DHS needs to continue to create and maintain a structure that can leverage partnerships to effectively implement homeland security efforts. Eight years after its establishment, DHS has made important strides in providing leadership and coordinating efforts across the enterprise as it continues to work to implement and strengthen its effectiveness across its range of missions. For example, DHS strengthened its partnerships and collaboration with foreign governments to coordinate and standardize security practices for aviation security. It has also improved coordination and clarified roles and responsibilities with state, local, and tribal governments for emergency management. In addition, DHS operates the Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists to local communities to help foster effective information sharing with the private sector and local communities. However, our work has found that DHS made limited progress in forging effective partnerships and sharing information throughout the enterprise early in its existence and as it matured, and although DHS continues to make improvements in this area, it faces challenges in building and leveraging these partnerships and information. These challenges have impeded the department’s progress, affecting its ability to effectively and efficiently satisfy its missions. For example, we found that DHS has not effectively overseen key interagency forums its components have established with other federal, state, local, tribal, and foreign law enforcement agencies to secure the border, raising the risk of duplication, overlap, and an inefficient use of resources. In 2005 we designated information sharing for homeland security, for which DHS has key responsibilities, as high risk because the federal government faced serious challenges in analyzing information and sharing it among partners in a timely, accurate, and useful way to protect against terrorist threats. We reported that DHS must effectively share terrorism-related information with state and local law enforcement agencies because they depend on it to maintain awareness of emerging threats and to allocate homeland security resources, among other things. Further, gaps in sharing, such as agencies' failure to link information about the individual who attempted to conduct the December 25, 2009, airline bombing, prevented the individual from being included on the federal government’s consolidated terrorist watchlist, a tool used by DHS to screen for persons who pose a security risk. The federal government and DHS have made progress in this area, but more work remains to strengthen and streamline existing information sharing mechanisms and better address partners’ information needs. These gaps have contributed to, among other things, DHS not realizing the full potential and contributions that its partners can provide, and not maximizing its effectiveness in achieving its missions. For example, with regard to cybersecurity, private sector stakeholders reported that they expect their federal partners, including DHS, to provide usable, timely, and actionable cyber threat information and alerts and a secure mechanism for sharing information, among other things. However, according to private sector stakeholders, federal partners are not consistently meeting these expectations. Without improvements in meeting private and public sector expectations for sharing cyber threat information, private-public partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information and mechanisms needed to thwart sophisticated cyber attacks that could have catastrophic effects on our nation’s cyber-reliant critical infrastructure. Moreover, we have identified the potential for overlap between various mechanisms DHS uses for sharing security- related information with public transit agencies. DHS needs to continue to streamline its mechanisms for sharing information with public transit agencies to reduce the volume of similar information these agencies receive from DHS, making it easier for them to discern relevant information and take appropriate actions to enhance security. Moving forward, it will be important that DHS continue to enhance its focus and efforts to strengthen and leverage the broader homeland security enterprise, and build off the important progress that it has made thus far. In addressing ever changing and complex threats, and with the vast array of partners with which DHS must coordinate, continued leadership and stewardship will be critical in achieving this end. Implementing and integrating management functions for results. Following its establishment, the department focused its efforts primarily on implementing its various missions to meet pressing homeland security needs and threats, and less on creating and integrating a fully and effectively functioning department from 22 disparate agencies. This initial focus on mission implementation was understandable given the critical homeland security needs facing the nation after the department’s establishment, and the enormous challenge posed by creating, integrating, and transforming a department as large and complex as DHS. As the department matured, it has put into place management policies and processes and made a range of other enhancements to its management functions—acquisition, information technology, financial, and human capital management. However, the department has not effectively executed these processes in a number of instances, across the range of its management functions, and has not fully integrated these functions across components and among departmental missions. These issues have contributed to performance problems in programs aimed at delivering important mission capabilities. For example, DHS did not sufficiently define what capabilities and benefits would be delivered, by when, and at what cost for US-VISIT—which is to verify the identities of foreign visitors entering and exiting the United States by storing and processing biometric and biographic information—and has not yet reached a decision on deploying an exit capability. Not defining these capabilities and benefits contributed to development and deployment delays. In another example, with respect to the cargo advanced automated radiography system to detect certain nuclear materials in vehicles and containers at ports, DHS pursued the acquisition and deployment of the system without fully understanding that it would not fit within existing inspection lanes at ports of entry. DHS subsequently canceled this program. In 2003, GAO designated the transformation and implementation of DHS as high risk because the department had to transform 22 agencies— several with major management challenges—into one department, and failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. Eight years later, DHS remains on our high-risk list. DHS has made important strides in working to strengthen its management functions, has established plans to strengthen and integrate these functions, and in recent years has demonstrated strong leadership support to address these long-standing issues. In particular, DHS developed various management policies, directives, and governance structures, such as acquisition and information technology management policies and controls, to provide enhanced guidance on investment decision-making. DHS also reduced its financial management material weaknesses in internal control over financial reporting and developed strategies to strengthen human capital management, such as its Workforce Strategy for Fiscal Years 2011-2016. However, more work remains to position these management areas for success. For example, DHS does not yet have enough skilled personnel to carry out activities in some key programmatic and management areas, such as for acquisition management, and was ranked 28 out of 32 agencies in the 2010 Partnership for Public Service’s Best Places to Work in the Federal Government rankings. DHS also has not yet implemented an integrated financial management system, impeding its ability to have ready access to information to inform decision-making, and has been unable to obtain a clean audit opinion on the audit of its consolidated financial statements since its establishment. Moving forward, addressing these management challenges will be critical for DHS’s success, as will the integration of these functions across the department to achieve efficiencies and effectiveness. Strategically managing risks and assessing homeland security efforts. Forming a new department while working to implement statutorily mandated and department-initiated programs and initiatives, and responding to adapting adversaries and evolving threats was and is a significant challenge facing DHS. Key threats and incidents that have emerged, both domestically and internationally, such as the anthrax attacks, Hurricanes Katrina and Rita, and a number of attempted attacks against the aviation sector, have impacted and altered the department’s approaches and investments. For example, DHS made key changes to its processes and technology investments for screening passengers and baggage at airports in part as a result of threats facing commercial aviation. DHS also changed its processes and clarified roles and responsibilities for emergency management in the aftermath of Hurricanes Katrina and Rita. It is understandable that these events and threats had to be addressed as they arose. However, our work has shown, throughout the department, that limited strategic and program planning, as well as assessment and evaluation to inform approaches and investment decisions, have contributed to programs not meeting strategic needs or doing so effectively and efficiently. For example, as we reported in July 2011, the Coast Guard’s planned acquisitions through its Deepwater Program, which began before DHS’s creation and includes efforts to build or modernize ships and aircraft and supporting capabilities that are critical to meeting the Coast Guard’s core missions in the future, is unachievable due to cost growth, schedule delays, and affordability issues. In addition, because FEMA has not yet developed a set of target disaster preparedness capabilities and a systematic means of assessing those capabilities, as required by the Post-Katrina Emergency Management Reform Act of 2006 and Presidential Policy Directive 8: National Preparedness, it cannot effectively evaluate and identify key capability gaps and target limited resources to fill those gaps. We have also reported that while DHS has made important progress in assessing and analyzing risk across sectors, it has more work to do in using this information to inform planning and resource allocation decisions. Risk management has been widely supported by Congress and DHS as a management approach for homeland security, enhancing the department’s ability to make informed decisions and prioritize resource investments. Since DHS does not have unlimited resources and cannot protect the nation from every conceivable threat, it must make risk- informed decisions regarding its homeland security approaches and strategies. Moreover, we have reported on the need for enhanced performance assessment, that is, evaluating existing programs and operations to determine whether they are operating as intended or are in need of change, across DHS’s missions. Information on the performance of programs is critical for helping the department, the Congress, and other stakeholders more systematically assess strengths and weaknesses and inform decision-making. In recent years, DHS has placed an increased emphasis on strengthening its mechanisms for assessing the performance and effectiveness of its homeland security programs. For example, DHS established new performance measures, and modified existing ones, to better assess many of its programs and efforts. Enhanced assessment of programs’ performance and the use of that information to inform decisions will provide the department with important insights in determining the extent to which programs and operations are meeting intended goals and results and at what cost. However, our work has found that DHS continues to miss opportunities to optimize performance across its missions because of a lack of reliable performance information or assessment of existing information; evaluation of feasible alternatives; and, as appropriate, adjustment of programs or operations that are not meeting mission needs. For example, TSA’s program for research, development, and deployment of passenger checkpoint screening technologies lacked a risk-based plan and performance measures to assess the extent to which checkpoint screening technologies were achieving the program’s security goals, and thereby reducing or mitigating the risk of terrorist attacks. As a result, TSA had limited assurance that its strategy targeted the most critical risks and that it was investing in the most cost-effective new technologies or other protective measures. Further, with regard to border security efforts, CBP established performance measures for its checkpoints to indicate checkpoint contributions toward apprehending removable aliens and seizing illegal drugs, but the lack of information on those passing through checkpoints undetected continued to challenge CBP’s ability to measure checkpoint effectiveness and provide public accountability. As the department further matures and seeks to optimize its operations, DHS will need to look beyond immediate requirements; assess programs’ sustainability across the long term, particularly in light of constrained budgets; and evaluate tradeoffs within and among programs across the homeland security enterprise. Doing so should better equip DHS to adapt and respond to new threats in a sustainable manner as it works to address existing ones. Given DHS’s role and leadership responsibilities in securing the homeland, it is critical that the department’s programs and activities are operating as efficiently and effectively as possible, that these programs are sustainable, and that they continue to mature, evolve, and adapt to address pressing security needs. DHS has made significant progress throughout its missions since its creation, but more work is needed to further transform the department into a more integrated and effective organization. Specifically, DHS has taken many actions to (1) develop strategic and operational plans across its range of missions; (2) hire, deploy and train workforces; (3) establish new, or expand existing, offices and programs; and (4) develop and issue policies, procedures, and regulations to govern its homeland security operations. DHS has also made important progress in strengthening partnerships with stakeholders, improving its management processes and sharing of information, and enhancing its risk management and performance measurement efforts. These accomplishments are especially noteworthy given that the department has had to work to transform itself into a fully functioning cabinet department while implementing its missions—a difficult undertaking for any organization and one that can take years to achieve even under less daunting circumstances. Impacting the department’s efforts have been a variety of factors and events, such as attempted terrorist attacks and natural disasters, as well as new responsibilities and authorities provided by Congress and the administration. These events collectively have forced DHS to continually reassess its priorities and reallocate resources as needed, and have impacted its continued integration and transformation. Given the nature of DHS’s mission, the need to remain nimble and adaptable to respond to evolving threats, as well as to work to anticipate new ones, will not change and may become even more complex and challenging as domestic and world events unfold, particularly in light of reduced budgets and constrained resources. To better position itself to address these challenges, our work has shown that DHS should place an increased emphasis and take additional action in supporting and leveraging the homeland security enterprise, managing its operations to achieve needed results, and strategically planning for the future while assessing and adjusting, as needed, what exists today. Addressing these issues will be critically important for the department to strengthen its homeland security programs and operations. We have made about 1,500 recommendations to DHS to address these issues, which the department has or is working to implement, but more work remains. Eight years after its establishment and 10 years after the September 11, 2001, terrorist attacks, DHS has indeed made significant strides in protecting the nation, but has yet to reach its full potential. We provided a draft of this report to DHS for its review and comment. We received written comments on the draft report from DHS, which are reproduced in full in appendix XIX. DHS also provided technical comments, which we incorporated as appropriate. DHS acknowledged our work to assess the progress the department has made in enhancing the nation’s security and the challenges that still exist. The department discussed its views of its accomplishments since 2001. For example, the department noted its creation and management of the Visa Security Program, which is operational at 19 posts in 15 countries; the increase in the number of deployed Border Patrol agents since 2001; the establishment of fusion centers to serve as focal points for the analysis and sharing of threat and vulnerability-related information; passenger screening and prescreening efforts; and support to state, local, tribal and territorial partners’ efforts to enhance emergency communications capabilities, among other things. DHS further noted its issuance of the Quadrennial Homeland Security Review in February 2010, which outlined a strategic framework for homeland security. We recognize the department's progress in these and other areas in the report, as well as discuss existing challenges that will be important for DHS to address moving forward. The department also stated that the report does not address all of DHS’s homeland security-related activities and efforts, and that assessments in each area are not comprehensive because we and the DHS IG have completed varying levels of work in each area. The report notes that the results are based on our work on DHS since it began operations, supplemented with work completed by the DHS IG, with an emphasis on work completed since 2008. We also examined updated information and documentation provided by the department in July and August 2011. As identified in the report, we highlighted our work on key DHS programs and efforts, but neither addressed all products that we and the DHS IG issued related to DHS, nor addressed all of DHS’s homeland security- related activities and efforts. In addition, each mission area appendix provides examples of other DHS programs and efforts on which we and the DHS IG have not reported or have completed limited work. Thus, this report was not intended to cover all of DHS’s homeland security-related activities and efforts. Further, as discussed in the report, because we and the DHS IG have completed varying degrees of work (in terms of the amount and scope of reviews completed) for each functional area, and because different DHS components and offices provided us with different amounts and types of information, our assessments of DHS’s progress in each area reflect the information available for our review and analysis and are not necessarily equally comprehensive across all 10 areas. In addition, DHS provided examples of activities and programs that it stated are not reflected in our report that demonstrate progress DHS made in preparing the nation to respond to threats. These programs include the Western Hemisphere Travel Initiative and increased coordination across the federal government to analyze travel-related data, such as through watchlist centers that provide information regarding potential terrorist travel—the Federal Bureau of Investigation’s Terrorist Screening Center, the National Counterterrorism Center, the National Targeting Center, and the Human Smuggling and Trafficking Center. This report discusses progress made and work remaining related to the Western Hemisphere Travel Initiative within the border security area. With regard to the various centers, this report acknowledges the activities of the National Targeting Center, but we did not include it in our assessments of progress because we and the DHS IG have completed limited work on it. The other three centers identified by DHS are not managed by the department. Because this report is focused on DHS- specific programs and efforts on which we have previously reported, supplemented by the work of the DHS IG, this report does not discuss these centers. This report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-3404, or berrickc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors are listed in appendix XX. Table 4 presents the performance expectations and sub-areas we identified for each Department of Homeland Security (DHS) functional mission area. This report addresses the following question: What progress has the Department of Homeland Security (DHS) made in implementing its mission functions since it began operations; what work, if any, remains; and what crosscutting and management issues have affected DHS’s implementation efforts? This report is based primarily on work that we have completed since DHS began its operations in March 2003, with an emphasis on reports issued since 2008 to reflect our most recent work, supplemented by DHS Office of Inspector General (IG) reports and updated information and documentation provided by the department in July and August 2011. It is also based on our ongoing work on key DHS programs for various congressional committees, as noted throughout the report. For this ongoing work, we examined program documentation and interviewed agency officials, among other things. To determine what progress DHS has made in implementing its mission functions and what work, if any, remains, we identified 10 DHS functional areas within its missions, which we define as categories or areas of DHS’s homeland security responsibilities. These functional areas are based on those areas we identified for DHS in our August 2007 report on DHS’s progress in implementing its mission and management functions, and our analysis of DHS’s Quadrennial Homeland Security Review (QHSR) and budget documents, such as its congressional budget justifications. We discussed these functional areas with our subject matter experts and DHS officials and incorporated their feedback as appropriate. These areas include: (1) aviation security; (2) chemical, biological, radiological, and nuclear (CBRN) threats; (3) critical infrastructure protection—physical assets; (4) surface transportation security; (5) border security; (6) maritime security; (7) immigration enforcement; (8) immigration services; (9) critical infrastructure protection—cyber assets; and (10) emergency preparedness and response. Within these functional areas, we identified performance expectations, which we define as composites of the responsibilities or functions that the department is to achieve or satisfy based on requirements, responsibilities, and goals set for the department by Congress, the administration, and DHS and its components. In particular, we used expectations identified in our August 2007 report as a baseline, and updated, or added to, these expectations by analyzing:  Homeland security-related laws enacted since September 2006 to identify legislative requirements for each DHS functional area. Examples of such laws include the Implementing Recommendations of the 9/11 Commission Act of 2007, the Security and Accountability For Every Port Act of 2006 (SAFE Port Act), and the Post-Katrina Emergency Management Reform Act of 2006.  DHS appropriation acts and accompanying conference reports for fiscal years 2006 through 2011 to identify requirements established and guidance provided to DHS for each functional area.  Presidential directives and executive orders that have been issued since September 2006 to identify expectations set for DHS by the administration for each functional area. Examples of such directives include Homeland Security Presidential Directive 25: Arctic Region Policy, and Presidential Policy Directive 8: National Preparedness.  Homeland security-related national strategies that have been issued since September 2006 to identify expectations set for DHS by the administration for each functional area. Examples of such strategies include the 2010 National Security Strategy and 2007 National Strategy for Homeland Security.  Strategic plans and documents that have been issued since September 2006 by DHS and its component agencies to identify goals and measures established by the department for each functional area. Examples of such strategic plans and documents include the QHSR and Bottom-Up Review (BUR) reports, as well as component level strategic plans, such as the U.S. Immigration and Customs Enforcement (ICE) Strategic Plan (Fiscal Year 2010-2014). We then grouped the expectations we identified within each functional area into broader sub-areas. Table 5 provides an example of performance expectations and sub-areas for the border security functional area. Appendix I provides the complete list of functional areas, sub-areas, and performance expectations. To identify the performance expectations and sub-areas, one analyst independently reviewed the source documents to identify expectations and sub-areas for a functional area. A second analyst then independently reviewed and verified each analysis. We also obtained and incorporated feedback from our subject matter experts on the expectations and sub- areas. In addition, we obtained feedback from DHS and component officials on the expectations and sub-areas we identified, and incorporated their feedback as appropriate. Further, we then aligned our functional areas to the five Quadrennial Homeland Security Review (QHSR) missions based on our review of the QHSR and BUR reports and DHS’s fiscal year 2012 budget documents (see table 6). Within these documents, DHS identified how its initiatives, programs, and activities align or support each QHSR mission, with some supporting more than one mission. For example, U.S. Customs and Border Protection (CBP) identified that its efforts related to inspections at ports of entry and facilitation of trade primarily support QHSR Mission 2: Securing and Managing Our Borders, but also, to a lesser extent, support QHSR Mission 1: Preventing Terrorism and Enhancing Security and Mission 3: Enforcing and Administering Our Immigration Laws. On the basis of DHS’s alignment of its initiatives, programs, and activities to QHSR missions, we grouped the 10 functional areas under DHS’s QHSR missions. In doing so, we recognized that our functional areas, as well as those key sub-areas that comprise the functional areas, may pertain to more than one QHSR mission area. For example, under our functional area of immigration enforcement, our work addressing the sub-area investigations of immigration offenses addresses DHS programs and activities that relate to more than one QHSR mission—primarily Mission 3: Enforcing and Administering Our Immigration Laws, and also Mission 2: Securing and Managing Our Borders and Mission 1: Preventing Terrorism and Enhancing Security. In those cases when a functional area aligned to more than one QHSR mission, we categorized it under the QHSR mission that it primarily supported on the basis of our review of DHS’s QHSR and budget-related documents. In cases when sub-areas within a functional area supported more than one QHSR mission, we kept the sub-area with its functional area (e.g., aviation security) and noted to which other QHSR missions it aligned. We provided DHS with our alignment of the functional areas to the QHSR missions, and incorporated the department’s feedback, as appropriate. To identify key areas of progress and work that remains in the DHS functional areas, we examined our and the DHS IG’s past reports on DHS missions, programs, and operations, including recommendations we and the DHS IG have made, and actions DHS has taken or has underway to address them. We also identified preliminary observations from our ongoing work in some key areas. In doing so, we identified factors that have affected DHS progress in the functional areas. Our work and the work of the DHS IG have covered many of DHS’s key programs, operations, and activities. In this report, we highlight our key work in these areas, but do not address all products we or the DHS IG have issued related to DHS, nor did we address all of the sub-areas or DHS’s homeland security-related activities and efforts. We selected, in consultation with our subject matter experts, key work we and the DHS IG have completed related to the functional areas and sub-areas. We examined the methodologies used by the DHS IG in its reports, including reviewing the scope, methodological steps, and limitations. We determined that the DHS IG reports were sufficiently reliable for the purposes of our report to provide examples, and to supplement our work, of DHS’s progress and work remaining. In addition, we obtained data from DHS on its budget authority for fiscal years 2004 through 2011, and funding and staffing levels related to the functional areas, and assessed the reliability of that data by available documentation. We determined that the data were sufficiently reliable for the purposes of our report. We obtained and incorporated feedback on our assessments within the sub-areas and functional areas from our subject matter experts. In addition, we provided DHS with drafts of our assessments of DHS progress and work remaining in each functional area and obtained and analyzed updated information provided by DHS on these areas. In some cases, DHS provided us with updated data on its efforts, such as statistics on technology deployments or program activities. We assessed the reliability of these data by reviewing available documentation from DHS. We determined that the data were sufficiently reliable for the purposes of our report. We included updated information in our assessments of each sub-area and functional area, based on our review of this information and our prior work. In some cases, we could not make an assessment of the updated information DHS provided because we did not have prior work upon which to base an assessment, or DHS’s reported actions were in the early stages of implementation, and thus it was too early to assess the results of these efforts. We noted these instances in our report. To identify crosscutting and management issues that have affected DHS’s implementation efforts, we analyzed the assessments of progress and work that remains in each functional area. We also examined our and the DHS IG’s past reports on crosscutting issues, related recommendations, and actions taken by DHS or that are underway to address the recommendations. We obtained and incorporated feedback on the crosscutting issues we identified from our subject matter experts. In addition, we obtained and incorporated feedback from DHS on our assessment of crosscutting issues that have affected the department’s mission implementation efforts, including updated information from DHS pertaining to these crosscutting issues. We incorporated updated information into our assessments based on our review of this information and our prior work. In some cases, we could not make an assessment of the updated information DHS provided because we did not have prior work upon which to base an assessment. We noted these instances in our report. Our assessments of the progress made by DHS in the functional areas and sub-areas, as well as our analyses of crosscutting issues, are based primarly on our issued reports, and supplemented by DHS IG reports. As such, the assessments of progress do not reflect, nor are they intended to reflect, the extent to which DHS’s actions have made the nation more secure in each area. Additionally, we do not intend to imply that our discussion of progress and work remaining in the functional areas and sub-areas, considered separately or together, reflect DHS’s progress in implementing all of its missions. We also did not assign a qualitative rating of progress for each area. DHS developed other performance measures against which to gauge its progress in fiscal year 2011, but has not yet reported on these measures. As such, the department did not have data available across a consistent baseline against which to assess its progress from fiscal years 2004 through 2011. Therefore, we were not able to assess DHS’s progress against a baseline for each functional area and sub-area, and we did not apply a weight to the expectations or sub-areas. We also did not consider DHS component agencies’ funding levels or the extent to which funding levels have affected the department’s ability to carry out its missions as this was not included in the scope of our prior reviews. Further, we did not consider the extent to which competing priorities; external and internal events, such as departmental reorganizations; and resource demands have affected DHS’s progress in each area relative to other areas, although competing priorities, events, and resource demands have affected DHS’s progress in specific areas. In addition, because we and the DHS IG have completed varying degrees of work (in terms of the amount and scope of reviews completed) for each functional area and because different DHS components and offices provided us with different amounts and types of information, our assessments of DHS’s progress in each area reflect the information available for our review and analysis and are not necessarily equally comprehensive across all 10 areas. Further, for some sub-areas, we were unable to make an assessment of DHS’s progress because we and the DHS IG have not conducted recent work in that area or have conducted limited work. More detailed information on those sub-areas for which we did not make an assessment is included in appendices III through XII. We conducted this performance audit from April 2011 through September 2011, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Transportation Security Administration (TSA), within the Department of Homeland Security (DHS), is the lead federal agency responsible for securing all modes of transportation, including aviation. As part of these responsibilities, TSA performs or oversees the performance of security operations at the nation’s more than 460 commercial airports.Key elements that comprise aviation security include: the aviation security workforce, including hiring, training, and deploying a screening workforce;  passenger prescreening—comparing passenger information to the Selectee and No Fly lists;  passenger checkpoint screening, including using staff, policies and procedures, and technology to address potential vulnerabilities;  checked baggage screening, including deploying explosives detection systems and other technologies to screen baggage for explosives;  air cargo screening, which involves using staff, policies and procedures, and technology to screen domestic and high-risk international inbound air cargo transported on passenger aircraft; and  security of airports, including airport perimeter security and access controls. For fiscal year 2011, TSA had about 54,800 personnel and its budget authority was about $7.7 billion. Aviation security falls primarily within the Quadrennial Homeland Security Review Mission 1: Preventing Terrorism and Enhancing Security. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS's responsibilities related to aviation security also include aviation security strategic planning and coordination, we are not reporting on this area. TSA also relies upon additional programs to deter, detect, and disrupt persons or threats posing a potential risk to aviation security, such as travel document checkers, who examine tickets and forms of identification; random employee screening; intelligence gathering and analysis; random canine team searches at airports; federal air marshals, who provide federal law enforcement presence on selected flights; and reinforced cockpit doors; as well as other measures both visible and invisible to the public. Further, TSA has additional plans and programs related to aviation security, such as TSA’s plans to conduct a pilot program on expedited checkpoint screening for low-risk travelers, and TSA’s Transportation Systems Integration Facility which supports the development and deployment of new technologies. We have not completed work on these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by the work of the DHS IG, has shown that over the past 10 years, TSA has enhanced aviation security in key areas related to the aviation security workforce, passenger prescreening, passenger checkpoint screening, checked baggage screening, air cargo security, and security of airports. For example, TSA hired, trained, and deployed a federal screening workforce. Additionally, after initial difficulty in fielding the program, TSA developed and implemented Secure Flight, a passenger prescreening program through which the federal government now screens all passengers on all domestic and international commercial flights to, from, and within the United States. DHS also developed new programs and is utilizing new technologies to screen passengers and checked baggage, and enhanced the security of domestic and in-bound air cargo. TSA also strengthened security at U.S. airports by assessing risks to airport perimeters and access controls. However, our work has shown that more work remains in these areas. For example, a risk-based strategy and a cost-benefit analysis of airport checkpoint technologies would improve passenger checkpoint screening. Further, TSA does not yet have a procurement plan and schedule for checked baggage screening technologies that would better position TSA to meet recently enhanced explosive detection requirements. Additionally, TSA does not yet have a mechanism to verify the accuracy of domestic and inbound air cargo screening data. Finally, the security of airports would be strengthened by establishing an evaluation plan for pilot tests to screen workers. Table 7 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Steve Lord at (202) 512-4379 or lords@gao.gov. The Department of Homeland Security (DHS) leads federal interagency coordination and planning for emergency response to catastrophic events such as chemical, biological, radiological, and nuclear (CBRN) incidents in the United States, and is responsible for assessing the risks posed by various CBRN agents. These efforts include (1) assessing risks, and (2) developing and deploying capabilities to detect and mitigate CBRN threats. Within DHS, the Science and Technology Directorate (S&T) is responsible for developing, in consultation with other appropriate executive agencies, a national policy and strategic plan for identifying priorities, goals, objectives and policies for, and coordinating the federal government’s civilian efforts to identify and develop countermeasures to chemical and biological threats. The Domestic Nuclear Detection Office (DNDO) is responsible for developing, acquiring, and supporting the deployment of a system to detect and report on attempts to develop, transport, or use unauthorized nuclear explosive, fissile, or radiological materials or explosives in the United States. The Office of Health Affairs provides health and medical expertise in support of the DHS mission to prepare for, respond to, and recover from all threats, and leads and coordinates the department’s biological and chemical defense activities. For fiscal year 2011, S&T had about 450 personnel and budget authority of about $830 million. For fiscal year 2011, DNDO had about 130 personnel and budget authority of approximately $340 million. For fiscal year 2011, the Office of Health Affairs had about 95 personnel and budget authority of approximately $140 million. Chemical, biological, radiological, and nuclear threats assessment, detection, and mitigation primarily falls within the Quadrennial Homeland Security Review Mission 1: Preventing Terrorism and Enhancing Security. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. DHS has developed and implemented other efforts related to CBRN assessments and detection and mitigation capabilities on which we are not reporting. For example, DHS has initiated efforts related to incidents involving contaminated debris, biodefense exercises and notification procedures for biological attacks. Further, in August 2011 DHS reported to us that it had (1) developed a strategic plan and issued guidance for biological threat prevention and response; (2) established a steering committee for anthrax preparedness and response; and (3) established a program that is developing best practices guidance and decision support tools for federal, state, and local stakeholders for preparedness and response to high consequence chemical incidents. DHS also reported launching a National Nuclear Forensics Expertise Development Program in fiscal year 2008 to enhance academic programs and expertise development opportunities in nuclear forensics. Moreover, DHS reported that it was leading development of a national strategic plan for improving nuclear forensics capabilities in the United States. We have not completed work on these areas upon which to make an assessment of DHS’s progress. Our work has shown that DHS made progress in assessing risks posed by CBRN threats, developing CBRN detection capabilities, planning for nuclear detection, and conducting radiation detection. However, important efforts related to these areas have not been completed. For example, DHS conducted risk assessments for CBRN agents, but should better coordinate with the Department of Health and Human Services by developing written policies and procedures governing development of the assessments. DHS also developed the BioWatch program, which provides early detection of biological threats. However, the next generation of the system, which is to have additional detection capability, has not yet been operationally deployed. Further, DHS established the National Biosurveillance Integration Center, but the center lacks resources necessary for operations, such as data and personnel from its partner agencies. In August 2011, DHS reported that, among other actions, its Office of Health Affairs had begun to develop a new strategy for the Center. DNDO coordinated the development of a strategic plan for the global nuclear detection architecture—a multidepartment effort to protect against terrorist attacks using nuclear and radiological materials through coordinated activities—and DHS made progress in deploying radiation detection equipment. However, work remains in implementing the global nuclear detection strategy, and DHS faced difficulties in developing new technologies to detect radiological and nuclear materials. For example, DHS’s strategic plan for the global nuclear detection architecture addressed some key components of what we previously recommended be included in a strategic plan, such as identifying the roles and responsibilities for meeting strategic objectives. However, the plan did not identify funding needed to achieve the strategic plan’s objectives, or employed monitoring mechanisms for determining programmatic progress and identifying needed improvements. Table 8 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact William O. Jenkins, Jr. at (202) 512-8757 or jenkinswo@gao.gov, or Gene Aloise at 202-512- 6870 or aloisee@gao.gov. Under the Homeland Security Act of 2002, the Department of Homeland Security (DHS) has wide-ranging responsibility to lead and coordinate the nation’s efforts to secure critical infrastructure. DHS’s key responsibilities and efforts include (1) risk assessment and planning; (2) protection and resiliency; and (3) partnerships and coordination mechanisms. DHS leads and coordinates the nation’s efforts to enhance protection and resiliency for 18 critical infrastructure sectors. Within DHS, three components are charged with lead responsibility over 11 of the 18 sectors. Specifically, within DHS’s National Protection and Programs Directorate (NPPD), the Office of Infrastructure Protection is responsible for the chemical; commercial facilities; critical manufacturing; dams; emergency services; and nuclear reactors, materials, and waste sectors. Also within NPPD, the Office of Cybersecurity and Communications is responsible for the communications and information technology sectors, and the Federal Protective Service (FPS) is responsible for the government facilities sector. The Transportation Security Administration (TSA) is responsible for the postal and shipping sector and in turn shares responsibility with the U.S. Coast Guard for the transportation systems sector. As the primary component responsible for critical infrastructure protection via its Office of Infrastructure Protection, for fiscal year 2011 NPPD had about 2,800 personnel and its budget authority was about $2.3 billion. Critical infrastructure protection of physical assets primarily falls within the Quadrennial Homeland Security Review Mission 1: Preventing Terrorism and Enhancing Security. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. DHS has developed and implemented other efforts related to critical infrastructure protection on which we are not reporting. For example, according to DHS, it is currently developing measures for critical infrastructure protection and resiliency as part of its efforts to develop the National Preparedness Goal and National Preparedness System directed by Presidential Policy Directive 8: National Preparedness. DHS stated that as part of this effort, it is examining the extent to which these measures incorporate crosscutting considerations such as sustainability, durability, and energy efficiency. As these efforts relate to critical infrastructure protection, we have not completed work on them upon which to make an assessment of DHS’s progress. Our work, supplemented by the DHS IG’s work, has shown that DHS expanded its efforts to conduct risk assessments and planning, provide for protection and resiliency, and implement partnerships and coordination mechanisms for physical critical assets. DHS updated the National Infrastructure Protection Plan to include an emphasis on resiliency (the capacity to resist, absorb, or successfully adapt, respond to, or recover from disasters), and an enhanced discussion about DHS risk management. Also, in the National Infrastructure Protection Plan, DHS expanded the discussion of its program to prioritize assets and systems for each of the 18 sectors according to their importance, nationally or regionally. Further, DHS took steps to coordinate with critical infrastructure protection stakeholders through information sharing mechanisms such as council meetings. However, our work and that of the DHS IG has shown that key challenges remain in these areas. For example, DHS’s state and local partners who are to provide data for the development of annual lists of critical infrastructure assets and systems noted that time and resource constraints can adversely affect the process. Furthermore, DHS has not fully implemented an approach to measure its effectiveness in working with critical asset owners and operators in their efforts to adopt measures to mitigate resiliency gaps identified during various vulnerability assessments. Moreover, the scope of some risk assessments has been limited and assessment results have not been consistently incorporated into planning efforts. In addition, DHS should take additional action to address barriers faced in sharing information about resiliency strategies with critical infrastructure partners. Table 9 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Stephen L. Caldwell at (202) 512-9610 or caldwells@gao.gov for overall critical infrastructure protection, or Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov for government facilities. The Transportation Security Administration (TSA), within the Department of Homeland Security (DHS), is the lead federal agency responsible for overseeing security of all surface transportation modes, which include passenger and freight rail; mass transit; highways, including commercial vehicles; and pipelines. Although TSA has primary responsibility for overseeing surface transportation security, this responsibility is shared with federal, state, and local governments and the private sector. For example, public and private operators are responsible for securing their transportation systems. Key areas within surface transportation security include: (1) risk assessment and planning; (2) standards, inspections, and training; (3) grants; and (4) information sharing. As the primary component responsible for surface transportation security, for fiscal year 2011, TSA had about 54,800 personnel and its budget authority was about $7.7 billion for fiscal year 2011, most of which is devoted to aviation security functions. Surface transportation security falls primarily within the Quadrennial Homeland Security Review Mission 1: Preventing Terrorism and Enhancing Security. For the purposes of this report, we are generally focusing on key areas on which we or the DHS Office of Inspector General (IG) have recently reported, and not on areas in which our two agencies have not reported or have conducted limited audit work. DHS developed and implemented additional efforts related to surface transportation security on which we are not reporting. These include, among other things, the Surface Transportation Security Priority Assessment—a public-private study which identified recommendations to enhance surface transportation security; the National Explosives Detection Canine Program; the Baseline Assessment for Security Enhancement—a security assessment program designed to evaluate 17 security and emergency management action items for mass transit and passenger rail networks; a training program in Pueblo, Colorado for highway surface transportation inspectors; the Intermodal Security Training and Exercise Program, which is a training and exercise program for the transportation industry developed by TSA, in collaboration with other federal agencies and commercial security vendors; and standard processes for law enforcement to identify and report suspicious incidents or activities throughout the Amtrak rail system and share that information nationally so it can be analyzed to identify broader trends. We have not completed work in these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by the work of the DHS IG, has shown that DHS, particularly TSA, expanded its efforts in key areas on which we have reported, such as risk assessments and strategic planning; surface transportation inspector workforce; grants administration; and information sharing. For example, in 2009 we reported that TSA had begun conducting threat and vulnerability assessments of the commercial vehicle industry and that TSA and other DHS agencies conducted threat, vulnerability, and consequence assessments of highway infrastructure, freight rail, and mass transit. TSA also developed a transportation sector security risk assessment that assessed risk within and across the various transportation modes. In addition, since 2008, TSA more than doubled its surface transportation inspector workforce and reported that, as of July 2011, its surface inspectors conducted over 1,300 site visits to mass transit and passenger rail stations to complete station profiles, among other things. Moreover, we reported in June 2009 that DHS used a risk analysis model to allocate Transit Security Grant Program funding and award grants to higher-risk transit agencies. Further, TSA expanded its sharing of surface transportation security information by establishing information networks. However, we have identified work remaining in these areas. For example, TSA has strengthened its risk assessments for surface transportation modes, but efforts to further improve elements of these assessments are in the early stages of implementation. Further, TSA has not yet completed an analysis of its surface inspector workforce to direct current and future program needs. Moreover, TSA has not issued regulations for security training programs for mass transit, rail, and bus employees, as required by the Implementing Recommendations of the 9/11 Commission Act of 2007. Additionally, we found that TSA should strengthen the management of its program for providing grant funds to transit agencies, and that its information sharing efforts would benefit from improved streamlining and coordination. Table 10 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Steve Lord at (202) 512-4379 or lords@gao.gov. Within the Department of Homeland Security (DHS), U.S. Customs and Border Protection (CBP) is the lead agency responsible for implementing the department’s border security mission. Key areas include inspecting travelers at ports of entry; inspecting cargo and goods at ports of entry while facilitating commerce; securing the border between ports of entry, for example, to reduce illegal immigration through the use of fencing and technology; enhancing visa adjudication security and preventing travel document collaborating with other stakeholders on border security efforts. As the primary component responsible for border security, for fiscal year 2011, CBP had approximately 61,000 personnel and its budget authority was about $11.3 billion. Border security primarily falls within the Quadrennial Homeland Security Review Mission 2: Securing and Managing our Borders. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS's responsibilities related to border security also include managing border security resources, such as facilities, assets and human capital, we are not reporting on DHS's progress and work remaining in these areas. DHS also has other border security efforts underway on which we are not reporting. For example, CBP developed and implemented a number of border security programs and efforts to, among other things, address threats posed by the illicit narcotics trade, and acquire or develop new technologies for the southern and northern borders—such as detection sensors to detect illicit tunnels at the southern border. CBP also developed new border security strategies with Canada and Mexico. Other specific programs implemented by CBP include the Immigration Advisory Program, in which CBP officers are posted at foreign airports and work with host countries’ border security agencies and airlines to identify potentially inadmissible aliens, including those who may have ties to terrorism, prior to boarding commercial aircraft to the United States; and the National Targeting Center and the Automated Targeting System for identifying high-risk travelers and cargo. We have not completed recent work on these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by the work of the DHS IG, has shown that DHS has expanded its efforts in key border security areas, such as inspection of travelers, cargo, and goods at ports of entry; security of the border between ports of entry; visa adjudication and travel document security; and collaboration with other border security stakeholders. For example, our work has shown that DHS has undertaken efforts to keep terrorists and other dangerous people from entering the country, and from October 1, 2010, through June 30, 2011, CBP reported encountering over 164,000 individuals at ports of entry who were found to be inadmissible into the United States. In addition, checkpoints generally located 25 to 100 miles from the border have contributed to DHS’s ability to seize illegal drugs, apprehend removable aliens, and encounter known or suspected terrorists. According to Border Patrol data, checkpoint operations accounted for over one-third of the Border Patrol’s total drug seizures. However, our work and that of the IG have shown that key challenges remain in these efforts. For example, addressing weaknesses in port of entry traveler inspection procedures and infrastructure would increase assurance that dangerous people and illegal goods would be interdicted at the border. DHS has also not yet decided how to implement a biometric system for recording foreign nationals’ exit from the United States. Further, DHS experienced schedule delays and performance problems with its information technology program for securing the border between ports of entry—the Secure Border Initiative Network (SBInet)—which DHS canceled. Because of the program’s decreased scope, uncertain timing, unclear costs, and limited life cycle management, it was unclear whether DHS’s pursuit of the program was cost-effective. DHS is transitioning to a new approach for border technology, which we are assessing. DHS also should establish performance measures or management controls for key border security programs. Table 11 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Richard M. Stana at (202) 512-8816 or stanar@gao.gov. Within the Department of Homeland Security (DHS), the U.S. Coast Guard has primary responsibility for maritime security, while various component agencies also contribute to maritime security efforts, including U.S. Customs and Border Protection (CBP), the Transportation Security Administration (TSA), and the Domestic Nuclear Detection Office (DNDO). Key areas within maritime security include (1) port facility and vessel security; (2) maritime domain awareness and information sharing; and (3) international supply chain security. The Coast Guard is responsible for ensuring the safety and security of U.S. maritime interests and leading homeland security efforts in the maritime domain. In this capacity, among other things, it conducts port facility inspections, leads the coordination of maritime information sharing efforts, and promotes domain awareness in the maritime environment. CBP is responsible for the maritime screening of incoming commercial cargo for the presence of contraband, such as explosives, while facilitating the flow of legitimate trade, cargo, and passengers. TSA and the Coast Guard have responsibility for the implementation and enforcement, respectively, of the Transportation Worker Identification Credential program to manage the access of maritime workers to regulated maritime facilities. DNDO is responsible for acquiring and supporting the deployment of radiation detection equipment, including portal monitors. As one of the primary components responsible for maritime security protection, for fiscal year 2011 the Coast Guard had about 50,000 personnel, including civilian and military, and its budget authority was about $10.2 billion. Maritime security primarily falls within the Quadrennial Homeland Security Review Mission 2: Securing and Managing our Borders. For the purposes of this report, we are generally focusing on key areas on which we and the DHS Office of Inspector General (IG) have recently reported, and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS's responsibilities related to maritime security also include maritime security national planning, we are not discussing DHS's progress and work remaining in this area. DHS has developed and implemented other efforts related to maritime security. For example, according to the Coast Guard, its maritime security programs are part of a layered strategy that begins far from our ports. Coast Guard officials noted that their security regime includes close coordination with international and regional organizations (such as the International Maritime Organization and the European Union), and individual country's coast guard equivalent agencies; security inspections of, and technical assistance to, foreign ports; and maintaining a multi-mission fleet of cutters patrolling our coastal approaches. The Coast Guard also noted that some of its other missions—those not directly part of its ports, waterways, and coastal security mission—can contribute to homeland security. Further, in July 2011, the Coast Guard reported that it had specific initiatives underway to enhance maritime security planning at the port level, on which we have not previously reported. Specifically, Coast Guard reported that it had updated 43 port-level Area Maritime Security Plans that covered prevention, protection, security response, and short- term recovery, and that these plans were approved by Coast Guard district and area commanders. The Coast Guard further reported that it was working closely with maritime committees and stakeholders to maintain and annually exercise these port-level plans. We have not completed work on these areas upon which to make an assessment. Our work, supplemented by the work of the DHS IG, has shown that DHS’s components, particularly the Coast Guard and CBP, have expanded their efforts in key areas, such as port facility and vessel security; maritime domain awareness and information sharing; and international supply chain security. The Coast Guard strengthened risk management through the development of a risk assessment model, and developed a strategy and programs intended to address risks to maritime facilities and passenger and commodity vessels. In addition, the Coast Guard increased maritime domain awareness through interagency operational centers, implementing a vessel tracking system, and identifying awareness gaps in the Arctic. For example, in July 2011, DHS reported that it had completed an interagency review of maritime domain awareness requirements resulting in the publication of a document that included key strategic capabilities, objectives, resources, and evaluative methods needed to maintain maritime domain awareness. Further, in July 2011 DHS reported that CBP developed the Small Vessel Reporting System to allow for better tracking of small boats arriving from foreign locations, and deployed this system to eight of CBP’s field locations. DHS also developed a layered security strategy for cargo container security, including deploying screening technologies and partnering with foreign governments. However, our work and that of the DHS IG has shown that more work remains. For example, DHS components’ efforts to assess the effectiveness of programs to secure maritime facilities should be improved. We found that because of a lack of technology capability, DHS does not electronically verify identity and immigration status of foreign seafarers as part of its admissibility inspection process, thus limiting the assurance that fraud could be identified among documents presented by them. DHS also had not assessed the risks of not having this capability, which is not expected to be available for several years. Further, DHS and its partners should enhance efforts to improve maritime domain awareness by, for example, further strengthening tracking of small vessels. In addition, although DHS developed the Transportation Worker Identification Credential program, we found that the program’s controls were not designed to provide reasonable assurance that only qualified applicants acquire credentials. For example, during covert tests of the Transportation Worker Identification Credential at several selected ports, our investigators were successful in accessing ports using counterfeit credentials and authentic credentials acquired through fraudulent means. Table 12 provides more detailed information on our assessment of DHS’s progress and work remaining in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Stephen L. Caldwell at (202) 512-9610 or caldwells@gao.gov. The Department of Homeland Security (DHS) is responsible for enforcing U.S. immigration and customs laws, and within DHS, U.S. Immigration and Customs Enforcement (ICE) is primarily responsible for immigration and customs enforcement efforts. ICE’s key responsibilities and efforts within immigration enforcement include (1) investigating and taking action to address individuals who have committed immigration and customs offenses, such as overstays; addressing immigration law violations at the workplace; investigating human trafficking and smuggling operations; and combating illicit smuggling of firearms, narcotics, and illicit proceeds; and (2) identifying, detaining, and removing aliens subject to removal. As the primary component responsible for immigration and customs enforcement, for fiscal year 2011 ICE had about 20,000 personnel, and its budget authority was about $5.8 billion. Immigration enforcement falls primarily within the Quadrennial Homeland Security Review Mission 3: Enforcing and Administering Our Immigration Laws. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported, and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS's responsibilities related to immigration enforcement also include the management and training of immigration enforcement human capital, we are not reporting on DHS's progress in this area. Additionally, ICE’s customs enforcement efforts include investigations of such offenses as money laundering and other financial crimes. Specifically, ICE reports efforts to address money laundering, including coordinating with federal, state, local, and foreign law enforcement to conduct multi-jurisdictional criminal investigations targeting organizations involved in the movement and smuggling of illicit proceeds. ICE also reported developing, in collaboration with Mexico, a study of the processes and methods used by transnational criminal organizations to move illicit money from the United States into other countries. We have not completed work on these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by the work of the DHS IG, has shown that DHS, particularly ICE, expanded its immigration and customs enforcement programs and activities in key areas on which we have reported, such as overstay enforcement, compliance with workplace immigration laws, alien smuggling, and firearms trafficking. For example, ICE increased its resources for investigating overstays and alien smuggling operations, and deployed border enforcement task forces to investigate illicit smuggling of people and goods, including firearms. In addition, DHS took action to improve the E-Verify program, which provides employers a voluntary tool for verifying an employee’s authorization to work in the United States. Specifically, in April 2011 we reported that DHS increased the E-Verify program’s accuracy by expanding the number of databases it can query, took actions to safeguard the privacy of personal information for employees who are processed through E-Verify, and implemented steps to prepare for possible mandatory implementation of E-Verify for all employers nationwide. ICE also expanded its programs for identifying and removing aliens from the United States to include, for example, entering into agreements with state and local jurisdictions to assist in identifying aliens subject to removal. However, our work has shown that work remains in these areas. For example, ICE took action to address a small portion of the estimated overstay population in the United States, and lacks measures for assessing its progress in addressing overstays. Moreover, ICE should better leverage opportunities to strengthen its alien smuggling enforcement efforts by assessing the possible use of various investigative techniques, and CBP should better assess progress made in achieving its alien smuggling-related program objectives. We have also reported on weaknesses with the E-Verify program, including challenges in accurately estimating E-Verify costs that put DHS at an increased risk of not making informed investment decisions and developing justifiable budget requests for future E-Verify use and potential mandatory implementation of it. Table 13 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Richard M. Stana at (202) 512-8816 or stanar@gao.gov. Within the Department of Homeland Security (DHS), U.S. Citizenship and Immigration Services (USCIS) is the agency primarily responsible for providing immigration services in the United States and internationally at U.S. embassies, consulates and refugee centers. USCIS’s key responsibilities and efforts within immigration services include:  administering immigration benefits, such as processing millions of applications and petitions received each year for about 50 types of immigration benefits for persons seeking to study, work, visit, or live in the United States, and to become U.S. citizens; and  detecting and resolving suspicious information about and reviewing evidence provided by benefits applicants and petitioners and referring them for fraud investigation and possible sanctioning by other DHS components or external agencies, as appropriate. As the primary component responsible for immigration services, for fiscal year 2011 USCIS had about 12,000 personnel, and its budget authority was about $2.6 billion. Immigration enforcement falls primarily within the Quadrennial Homeland Security Review Mission 3: Enforcing and Administering Our Immigration Laws. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS's responsibilities related to immigration services also include immigrant integration, we have not reported on DHS's progress and work remaining in this area. According to USCIS documentation provided to us in July 2011, the agency has undertaken initiatives to support immigrant integration, particularly related to citizenship, including, among other things, outreach, grants for education programs, and improved tools and resources on the citizenship and naturalization process. We currently have work underway for the House Committee on Homeland Security assessing USCIS’s immigrant integration efforts, and plan to report on the results of our work later this year. Our work, supplemented by the work of the DHS IG, has shown that DHS, particularly USCIS, improved the quality and efficiency of the immigration benefit administration process, and strengthened its immigration fraud detection and deterrence efforts. For example, USCIS initiated efforts to modernize its immigration benefit administration infrastructure; improve the efficiency and timeliness of its application intake process; and ensure quality in its benefit adjudication processes. In September 2008 we reported that the USCIS Asylum Division designed training programs and quality reviews to help ensure the integrity of asylum adjudications. In addition, in 2004 DHS established the Office of Fraud Detection and National Security, now a directorate, to lead immigration fraud detection and deterrence efforts, and this directorate has since developed and implemented strategies for this purpose. Further, in July 2011, USCIS reported that it completed the development of a database for analyzing fraud—the Fraud Detection and National Security Data System—which it uses to collect data on fraud and national security concerns. In addition, among other things, USCIS implemented the Administrative Site Visit and Verification Program, through which it conducts pre-and post-adjudication site visit inspections to verify information contained in certain visa petitions. However, our work and that of the DHS IG have shown that work remains in these areas. For example, USCIS’s program for transforming its immigration benefit processing infrastructure and business practices from paper-based to digital systems missed its planned milestones by more than 2 years, and has been hampered by management challenges, such as insufficient planning and not preparing key DHS acquisition planning documents before selecting a contractor to obtain the capabilities needed to transition to an electronic adjudication process. USCIS should also take additional action to address vulnerabilities identified in its assessments intended to determine the extent and nature of fraud in certain applications. Further, in September 2008 we reported that, despite mechanisms USCIS had designed to help asylum officers assess the authenticity of asylum claims, such as identity and security checks and fraud prevention teams, asylum officers cited challenges in identifying fraud as a key factor affecting their adjudications. Table 14 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. For additional information about this area, contact Richard M. Stana at (202) 512-8816 or stanar@gao.gov. The Department of Homeland Security (DHS) has overall responsibility for coordinating critical infrastructure protection efforts for 18 critical infrastructure sectors—such as energy, water, and communications. Within DHS, the National Protection and Programs Directorate’s (NPPD) Office of Cybersecurity and Communications (CS&C) is charged with enhancing the security, resiliency, and reliability of the nation's cyber and communications infrastructure. CS&C’s key responsibilities and efforts related to cybersecurity include (1) risk assessment and planning; (2) protection and resiliency; and (3) partnerships and coordination mechanisms. As the primary DHS component responsible for safeguarding physical and cyber assets, in fiscal year 2011 NPPD, which includes CS&C, had about 2,800 personnel and its budget authority was about $2.3 billion. Critical infrastructure protection of cyber assets primarily falls within the Quadrennial Homeland Security Review Mission 4: Safeguarding and Securing Cyberspace. but in the February 2011 high-risk update we identified several areas of responsibility that required further attention, such as advancing cyber analysis and warning capabilities, acquiring sufficient analytical and technical capabilities, and strengthening the effectiveness of the public- private sector partnerships in securing cyber critical infrastructure. In January 2011, DHS provided us with a corrective action plan for this high- risk area. We provided DHS with feedback on this plan noting, for example, that the plan included objectives, milestones, and planned accomplishments related to DHS’s cybersecurity responsibilities. However, we identified aspects of the plan that should be strengthened, such as clarifying whether DHS’s 2010 goals and objectives for its corrective actions were met, and identifying resources needed and planned milestones for 2011 activities. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. DHS has other ongoing efforts related to cyber critical infrastructure protection, such as the assessment of cybersecurity measures implemented at high-risk chemical facilities as part of its Chemical Facility Anti-Terrorism Standards program, on which we have not reported. DHS also established the National Cybersecurity and Communications Integration Center in October 2009 to serve as a national cyber and communications operations center to fuse information from federal civilian agencies, law enforcement, intelligence, state and local government, and the private sector. Further, DHS signed a memorandum of agreement with the Department of Defense to improve cyber coordination. In addition, according to DHS officials, NPPD’s Office of Infrastructure Protection and the National Cyber Security Division collaborated to integrate cybersecurity elements into the Office of Infrastructure Protection’s facility security and vulnerability assessments. The National Cyber Security Division also conducts cyber assessments in support of the Office of Infrastructure Protection’s Regional Resiliency Assessment Program and major national events, according to DHS. We have not completed work on these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by the work of the DHS IG, has shown that DHS expanded its efforts to conduct cybersecurity risk assessments and planning, provide for the protection and resilience of cyber assets, and implement cybersecurity partnerships and coordination mechanisms. For example, DHS updated the National Infrastructure Protection Plan to include an emphasis on cybersecurity issues by listing progress made and new initiatives related to cybersecurity. In addition, DHS took steps to secure external network connections in use by the federal government by establishing the National Cybersecurity Protection System, operationally known as Einstein, to analyze computer network traffic information to and from agencies. Additionally, the agency made progress in enhancing its cyber analysis and incident warning capabilities through the establishment of the U.S. Computer Emergency Readiness Team, which, among other things, coordinates the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. DHS is also working to improve cyber-related partnerships with public and private stakeholders by developing new information-sharing arrangements and addressing corrective actions based on a cybersecurity exercise. In September 2008, we reported that since conducting a major cyber attack exercise, called Cyber Storm, DHS demonstrated progress in addressing lessons it had learned from these efforts to strengthen public and private incident response capabilities. However, our work and that of the DHS IG has also shown that key challenges remain in these efforts. For example, to expand its protection and resiliency efforts, DHS needs to lead a concerted effort to consolidate and better secure Internet connections at federal agencies. DHS also faces challenges in fully establishing a comprehensive national cyber analysis and warning capability. For example, in July 2008, we reported that the U.S. Computer Emergency Readiness Team did not fully address 15 key attributes of cyber analysis and warning capabilities. Moreover, the DHS IG reported that DHS needs to establish a consolidated, multiple classification level portal that can be accessed by federal partners with real-time incident response related information and reports. Additionally, expectations of private sector stakeholders are not being met by their federal partners in areas related to sharing information about cyber-based threats to critical infrastructure. We also reported that public sector stakeholders believed that improvements could be made by improving private sector sharing of sensitive information. Table 15 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. DHS took steps to secure external network connections in use by the federal government, and to coordinate the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. However, to expand protection and resiliency efforts, concerted effort is needed to consolidate and secure Internet connections at federal agencies. DHS also faces challenges in establishing a comprehensive national cyber analysis and warning capability. Summary of key progress and work remaining We recommended that DHS (1) assess whether existing sector-specific planning processes should continue to be the nation’s approach to securing cyber and other critical infrastructure, and consider whether other options would provide more effective results; and (2) collaborate with the sectors to develop plans that fully address cybersecurity requirements. DHS concurred and reported, for example, that it worked with sector officials to update sector plans with the goal of fully addressing cyber-related requirements. In 2010, the sectors issued 18 updated plans to be reviewed by federal agencies, such as the Office of Management and Budget and DHS. As of August 2011, DHS officials stated that 17 plans were finalized and 1 was in the process of being reviewed. DHS officials were not able to provide milestones for when the remaining plan would be finalized, as it is under federal interagency review. We have not yet reviewed these plans to determine the extent to which they address specified security requirements. Having plans with complete updates that address cybersecurity requirements will be important in providing the nation with information on where we are in implementing associated protective measures designed to secure and protect the nation’s cyber and other critical infrastructure. Summary of key progress and work remaining What remains to be done: Although we found that agencies reported benefits from the Trusted Internet Connection Initiative, none of the 23 agencies we reviewed met all of the requirements of the Trusted Internet Connections Initiative, as of September 2009. Summary of key progress and work remaining In addition, DHS officials stated that the department piloted Einstein 3 (the Comprehensive National Cybersecurity Initiative 3), which is intended to be an intrusion prevention system that is to automatically detect and respond appropriately to cyber threats before harm is done. According to DHS officials, once fully deployed, Einstein 2 and 3 will provide cyber protection capabilities to more than 110 federal civilian executive branch departments and agencies. As of July 2011, DHS reported that Einstein 2 was deployed at 16 of 19 access provider agencies and active at 15 of them, and that it is fully deployed and active at each of the 4 private telecommunications service providers through which non-access provider agencies seek Managed Trusted Internet Protocol Services. Taking steps to expand cyber protection capabilities to additional federal departments and agencies should help to improve the nation’s cyber infrastructure if those capabilities are implemented effectively. However, we have not yet assessed the effectiveness of these efforts as DHS is in the process of deploying Einstein 2 and 3. With the establishment of the U.S. Computer Emergency Readiness Team, DHS took steps to coordinate the nation’s efforts to prepare for, prevent, and respond to cyber threats to systems and communications networks. However, DHS faces challenges in establishing a comprehensive national cyber analysis and warning capability. Key progress: When incidents such as data loss or theft, computer intrusions, and privacy breaches occur, agencies are to notify the U.S. Computer Emergency Readiness Team. Over the past 5 years, the number of incidents reported by federal agencies to the U.S. Computer Emergency Readiness Team has increased; from 5,503 incidents in fiscal year 2006 to 41,776 incidents in fiscal year 2010, an increase of over 650 percent. We currently have work underway assessing the adequacy and effectiveness of agency information security policies and practices, and agencies' implementation of the Federal Information Security Management Act of 2002 requirements, and plan to report on our results later this year. What remains to be done: In July 2008, we reported that the U.S. Computer Emergency Readiness Team did not fully address 15 key attributes of cyber analysis and warning capabilities. These attributes are related to (1) monitoring network activity to detect anomalies, (2) analyzing information and investigating anomalies to determine whether they are threats, (3) warning appropriate officials with timely and actionable threat and mitigation information, and (4) responding to the threat. For example, the U.S. Computer Emergency Readiness Team provided warnings by developing and distributing a wide array of notifications; however, these notifications were not consistently actionable or timely. We recommended that the department address shortfalls associated with the 15 attributes in order to fully establish a national cyber analysis and warning capability. DHS generally concurred and stated that it is taking steps to implement them, such as opening two 24-hour centers to increase communication channels and organize cyber response efforts.We are currently working with DHS officials to more fully determine the status of their efforts to address these recommendations. Federal partners, including DHS, developed new information- sharing arrangements, and DHS completed corrective actions based on a cybersecurity exercise. However, efforts to meet the expectations of private sector stakeholders in areas related to sharing information about cyber-based threats to critical infrastructure should be improved. Summary of key progress and work remaining The DHS IG also identified challenges with the U.S. Computer Emergency Readiness Team analysis and warning program, which DHS took steps to address. In June 2010 the DHS IG reported that the U.S. Computer Emergency Readiness Team made progress in implementing a cybersecurity program to assist federal agencies in protecting their information technology systems against cyber threats. However, the IG reported that the team could further improve its analysis and warning program. For example, the IG reported that the team could improve its management oversight by developing a strategic plan and establishing performance measures. Additionally, the IG reported that the team should improve its information sharing and communications coordination efforts with the public. Several factors have hampered DHS’s ability to share information with its partners, including that threat information from intelligence agencies is classified. The DHS IG recommended, among other things, that DHS establish a consolidated, multiple classification level portal that can be accessed by federal partners that includes real-time incident response related information and reports. In addition, the DHS IG recommended the establishment of specific outcome-based performance measures and a strategic plan to ensure that the team can achieve its mission, objectives, and milestones. DHS concurred with these recommendations, and took action to implement them. For example, DHS reported that it established performance measures and a strategic plan, concept of operations, and standard operating procedures for the U.S. Computer Emergency Readiness Team. In July 2011 DHS also reported that it was taking steps to establish a multiple classification level portal. DHS developed new information-sharing arrangements and completed corrective actions based on a cybersecurity exercise. However, additional action is needed to better ensure that expectations of private sector stakeholders are met by their federal partners in areas related to sharing information about cyber-based threats to critical infrastructure. Key progress: DHS completed corrective actions based on lessons learned from a cybersecurity exercise. In September 2008, we reported that since conducting a major cyber attack exercise, called Cyber Storm, DHS demonstrated progress in addressing 8 lessons it had learned from this exercise to strengthen public and private incident response capabilities. In the months following its first exercise, DHS identified 66 activities that address one or more of the lessons, including hosting meetings with key cyber response officials from foreign, federal, and state governments and private industry, and refining their operating procedures. We reported in September 2008 that DHS’s actions to address the lessons had not been fully implemented, and consequently recommended that DHS schedule and complete all of the corrective activities identified to strengthen coordination between public and private sector participants in response to significant cyber incidents. As of September 2010, DHS demonstrated that it had completed all 66 of the corrective actions addressing lessons learned from the exercise. Summary of key progress and work remaining What remains to be done: Federal policy, including DHS’s National Infrastructure Protection Plan, calls for a partnership model that includes public and private councils to coordinate policy and information sharing and analysis centers to gather and disseminate information on threats to physical and cyber-related infrastructure.In July 2010, we reported that while federal partners, such as DHS, were developing new information-sharing arrangements, they were not meeting the key expectations of the private sector. We also reported that public sector stakeholders believed that improvements could be made to the partnership, including improving private sector sharing of sensitive information. We recommended, among other things, that DHS use our findings to focus its information-sharing efforts on the most desired services, including access to sensitive or classified information and a secure mechanism for sharing information. DHS concurred with our recommendations and stated that it took steps to implement them, such as initiating pilot programs to enable the mutual sharing of cybersecurity information at various classification levels. However, as DHS is initiating these pilot programs, it is too early to assess the extent to which they address the challenges we identified. For additional information about this area, contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. The Federal Emergency Management Agency (FEMA), within the Department of Homeland Security (DHS), is the federal agency primarily responsible for emergency preparedness and response efforts. FEMA’s key responsibilities and efforts include national emergency preparedness and response planning, such as developing the National Response Framework and a national preparedness goal; providing emergency assistance and services, such as temporary housing assistance after a disaster; and supporting the federal government’s state, local, and tribal partners’ efforts to enhance their emergency management and homeland security capabilities, such as emergency communications, through grants and technical assistance. As the primary component responsible for emergency preparedness and response, in fiscal year 2011 FEMA had approximately 7,300 personnel, and its budget authority was about $10.5 billion. Emergency preparedness and response falls within the Quadrennial Homeland Security Review Mission 5: Ensuring Resilience to Disasters. For the purposes of this report, we are focusing generally on key areas on which we or the DHS Office of Inspector General (IG) have recently reported and not on areas in which our two agencies have not reported or have conducted limited audit work. For example, while DHS’s responsibilities related to emergency preparedness and response also include areas such as human capital management and training and exercise programs, we are not reporting on DHS’s progress and work remaining in these areas. With regard to human capital, FEMA reported to us in July 2011 that it planned to increase its staffing levels to enhance FEMA’s investigative operations and fraud awareness training initiatives by 50 percent in fiscal year 2011, and by another 50 percent in fiscal year 2012. We have not completed recent work on these areas upon which to make an assessment of DHS’s progress. Our work, supplemented by that of the DHS IG, has shown that FEMA expanded its efforts to improve national emergency preparedness and response planning; improved its emergency assistance services; supported state, local, and tribal partners’ disaster preparedness and response capabilities; and enhanced emergency communications. For example, FEMA developed various plans for disaster preparedness and response. In particular, FEMA issued the National Response Framework, which outlines the guiding principles and major roles and responsibilities of government, nongovernmental organizations, and private sector entities for disaster response. It is also finalizing a National Disaster Recovery Framework, intended to provide a model to identify and address challenges that arise during the disaster recovery process. Moreover, DHS issued the National Emergency Communications Plan— the first strategic document for improving emergency communications nationwide. We also reported that FEMA awards certain preparedness grants based on a reasonable risk methodology. However, more work remains in FEMA’s efforts to assess capabilities for all-hazards preparedness, provide long-term disaster recovery assistance, and strengthen alert systems. For example, FEMA has faced difficulties in collecting reliable and consistent data and developing measurable target capabilities for national preparedness. Further, with regard to long-term disaster recovery assistance, FEMA’s criteria for when to provide the assistance were vague, and, in some cases, FEMA provided assistance before state and local governments had the capacity to work effectively with FEMA. Further, FEMA has faced technical challenges in implementing the Integrated Public Alert and Warning System related to systems integration and alerts for individuals with disabilities, among other things. Additionally, FEMA should improve the efficacy of the grant application and review process by mitigating duplication or redundancy within the agency’s various preparedness grant programs. Table 16 provides more detailed information on our assessment of DHS’s progress and remaining work in key areas on which we have reported, with an emphasis on work completed since 2008. Summary of key progress and work remaining What remains to be done: In April 2009 we reported that FEMA had not yet completed about two-thirds of the plans to operationalize the policies it had established to define emergency preparedness and response roles and responsibilities. As a result, the roles and responsibilities of key officials involved in responding to a catastrophe had not been fully defined and, thus, could not be tested in exercises. We recommended that FEMA establish a program management plan to ensure that the plans that were called for as part of the national preparedness system were developed in a timely and integrated fashion. FEMA generally concurred and has actions underway to address it. For example, FEMA told us that since we last reported, it has revised or completed six concept plans and approximately 28 hazard-specific regional plans. FEMA also reported working to implement elements of Presidential Policy Directive 8: National Preparedness. This directive instructs the Secretary of Homeland Security to develop a national preparedness goal and national preparedness system to meet that goal through an integrated set of guidance, programs, and processes. Specifically, FEMA reported in August 2011 that in response to Presidential Policy Directive 8, FEMA is leading the development of a Federal Interagency All-Hazards Response Plan, to include scenario-specific annexes that integrate prior earthquake, hurricane, and catastrophic planning efforts. To implement Presidential Policy Directive 8, FEMA will need to review its current and pending policies to ensure that they are consistent with the goals and requirements of the Directive, and make any adjustments that may be needed. Despite ongoing efforts to measure preparedness and assess capabilities, FEMA faced difficulties in collecting reliable and consistent data, and developing measurable target capabilities. Key progress: DHS, particularly FEMA, implemented efforts to measure preparedness by assessing capabilities and addressing related challenges. In September 2007, DHS issued the National Preparedness Guidelines that describe a national framework for capabilities-based preparedness as a systematic effort that includes sequential steps to first determine capability requirements and then assess current capability levels. As a companion to the Guidelines, FEMA issued a Target Capabilities List, designed to provide a national-level generic model of capabilities defining all-hazards preparedness. FEMA also made progress in developing a system for assessing national preparedness capabilities by, among other things, establishing reporting guidance for state preparedness and issuing a federal preparedness report. Presidential Policy Directive 8, issued in March 2011, requires the development of a national preparedness goal, system, and report. The implementation plan for the directive calls for the development of the national preparedness goal by September 25, 2011, and the development of other documents by September 25, 2012. Summary of key progress and work remaining What remains to be done: The success of FEMA’s efforts to measure preparedness has been limited due to, among other things, missing quantifiable metrics to measure capabilities. In April 2009, we reported that establishing quantifiable metrics for target capabilities was a prerequisite to developing assessment data that can be compared across all levels of government. At the time of our review, FEMA was in the process of refining the target capabilities to make them more measurable and planned to develop quantifiable metrics for each of the capabilities. We reported in October 2010 that FEMA had not yet developed national preparedness capability requirements based on established metrics to provide a framework for assessing preparedness. FEMA officials told us that evaluation efforts that they used to collect data on national preparedness capabilities were useful for their respective purposes, but that the data collected were limited by data reliability and measurement issues related to the lack of standardization. Until a framework for assessing preparedness is in place, we reported that FEMA would not have a basis on which to operationalize and implement its conceptual approach for assessing local, state, and federal preparedness capabilities against capability requirements and identify capability gaps for prioritizing investments in national preparedness. In our April 2009 report, we recommended that FEMA improve national preparedness by enhancing its project management plan for assessing capabilities to include reporting on the progress of preparedness assessments and developing quantifiable metrics for capabilities. DHS concurred, and in July 2011 FEMA reported that it took steps to establish a preparedness baseline and the accompanying foundation for assessing preparedness, including determining how effective grants are in improving preparedness. FEMA also reported that it was working with its emergency response partners to identify end-states, capabilities, and performance objectives for each emergency preparedness mission area as part of its development of the National Preparedness Goal. FEMA further will provide a summary of the progress being made towards developing and maintaining performance objectives required to deliver the capabilities described in the goal. In August 2011, FEMA reported that it had established a Program Executive Office to ensure that the target dates for implementation of Presidential Policy Directive 8 are met and stakeholders are engaged in the process. As these efforts are recent, we have not conducted work to assess their effectiveness in measuring preparedness. However, in the past FEMA has had difficulty meeting target dates, thus it will be important for FEMA to effectively consult with and incorporate the input of its many stakeholders to support meeting this schedule. FEMA improved emergency assistance services and oversight of disaster-related emergency assistance, but should further strengthen its management of emergency response and recovery assistance programs. Summary of key progress and work remaining DHS and FEMA have strengthened nationwide recovery planning efforts, but efforts are in the early stages. Key progress: In February 2010, FEMA released a draft National Disaster Recovery Framework, which is intended to provide a model to collectively identify and address challenges that arise during the disaster recovery process. This Framework is designed to help the emergency management community work better together to support individuals, households, and communities as they rebuild and restore their ways of life following a disaster. FEMA later reported that since March 2010, it has received hundreds of comments and recommendations from federal agencies and departments on the proposed Framework. In March 2010, we reported that FEMA assisted local communities with developing long-term disaster recovery plans as part of its post-disaster assistance. For example, one way FEMA assisted Iowa City’s recovery from major floods in 2008 by, among other things, identifying possible federal funding sources for specific projects in the city’s recovery plan and advising the city on how to prepare effective project proposals. Local officials credited this assistance with helping the city to be able to secure federal funding. What remains to be done: We have identified areas where FEMA’s recovery assistance to local communities should be improved. For example, state and local officials in Texas recovering from Hurricane Ike in 2008 said that FEMA’s process of ranking projects in the City of Galveston’s recovery plan had the effect of fostering unrealistic expectations among the public about what projects would be funded. We recommended that FEMA more clearly communicate the objectives and processes it uses when assessing the value of specific recovery projects to help prevent unrealistic expectations about the implementation of such projects among members of the affected community. DHS agreed and stated that it would further examine the tools it used to communicate with impacted communities as part of the implementation of the National Disaster Recovery Framework. With regard to Framework, in July 2011, FEMA reported that the revised draft of the Framework was in the final stages of interagency review and interagency teams had been working to develop draft annexes for the six core functional areas of the Framework. Since FEMA has not yet finalized this framework, it is too early to assess its results. FEMA improved the provision and oversight of emergency assistance and services, but work remains in its management and operation of emergency response and recovery assistance programs. Key progress: FEMA has provided and coordinated the provision of assistance to state and local governments, non-profit organizations, and individuals after disasters—-including helping communities develop long- term recovery plans. In June 2011, the DHS IG reported that it had identified 128 programs that provide disaster assistance and that DHS administers 69, or approximately 54 percent, of these programs. For example, FEMA operates the Public Assistance program, which provides grants to state, local, and tribal governments and certain non-profit organizations. Summary of key progress and work remaining FEMA also took steps to improve its disaster assistance program oversight. In December 2008, we identified challenges in the Public Assistance program related to project development, information sharing and tracking the status of projects, project approvals and appeals, and human capital. For example, disagreements between applicants and FEMA, as well as changes to project scope decisions, contributed to slowing down project development. We reported that DHS had addressed these challenges, including finalizing a public assistance catastrophic disaster recovery concept plan that recognized the need to more easily tailor projects to meet post-disaster conditions; developing new management information systems to better track and manage projects and increase the transparency of public assistance funding; and creating a credentialing program for employees. Further, in July 2011, FEMA reported that it had established two Public Assistance review panels within the Public Assistance appeals process for the purpose of expediting final eligibility decisions for disputed projects. With respect to employee credentialing, FEMA reported in July 2011 that its newly created FEMA Qualification System is intended to build upon previous efforts to credential FEMA’s disaster response personnel. According to FEMA, the system is expected to improve workforce qualification and certification of FEMA personnel deployed for incident management and support operations. We are conducting ongoing work related to FEMA’s disaster assistance workforce and plan to report on our results in 2012. What remains to be done: In March 2010, we identified two broad challenges related to FEMA’s long-term disaster recovery assistance efforts. First, the criteria for when FEMA was to provide long-term recovery assistance in a specific disaster were vague, which resulted in uncertainty among other federal agencies and state recovery officials. Second, in some cases, FEMA assistance began before state and local governments had the capacity to effectively work with FEMA and ended before critical long-term recovery coordination and planning needs were fully addressed. We recommended, among other things, that DHS develop clear and consistent criteria that identify factors that determine whether and how the entity responsible for coordinating long-term recovery will become involved in a specific disaster. We also recommended that DHS establish a long- term recovery structure that more effectively aligns the timing and level of involvement of the entity responsible for coordinating long-term community recovery assistance with both the capacity of state and local governments to work with them and the need for coordination assistance. DHS concurred and reported in July 2011 that it had developed an assessment tool to assist a coordinating officer or state when attempting to determine if activating the long term recovery mission is appropriate. These are positive steps that should help strengthen FEMA’s efforts to address timing issues with its disaster recovery, but they are still in the early stages of implementation. DHS and FEMA made strategic progress in enhancing emergency and interoperable communications. However, specific alert systems, such as the Integrated Public Alert and Warning System, have technical challenges, such as message delivery limitations. Summary of key progress and work remaining Additionally, FEMA reported in July 2011 that it sought to increase its disaster reservist cadre with professionals in areas of community planning, city management, and economic recovery to also provide an enhanced technical resource to local governments early in recovery efforts to assist in launching recovery planning. These are positive steps that should assist FEMA in its recovery efforts. However, because of the long-term nature of disaster recovery, it will take time to determine the impact of these efforts in enhancing recovery from such recent disasters as the tornados that devastated areas of Alabama and Missouri. DHS and FEMA released key emergency communications strategic documents and made grants available for interoperability, but have made limited progress to enhance emergency alert systems. Key progress: Continuity of communications, capacity, and interoperability are primary areas of vulnerability in emergency communications. Emergency communications breakdowns undermined response efforts during terrorist attacks in 2001 and Hurricane Katrina in 2005. In response, federal agencies, including DHS, increased efforts to enhance emergency communications. In June 2009, we reported that DHS and other federal agencies took steps to enhance emergency communications by issuing key documents such as the National Emergency Communications Plan— the first strategic document for improving emergency communications nationwide. Further, DHS and other federal agencies made numerous grants for interoperable communications available and increasingly aligned them with national and state plans. In addition, we reported that federal agencies, including DHS, took strategic steps to assist first responders. In March 2010, we reported that the Emergency Communications Preparedness Center had been established. At that time, the members were developing a working definition of the scope of emergency communications to define the scope of their mission and the types of information that should be included in an emergency communications clearinghouse. As of July 2011, DHS reported that the membership of the Preparedness Center expanded to 14 federal agencies, and the members had developed strategic objectives and an action plan to implement these objectives. FEMA also reported that it established and implemented working groups and a Disaster Emergency Communications Division to support emergency and interoperable communications. Summary of key progress and work remaining Further, in September 2009, we reported on the Emergency Alert System, the primary national-level public warning system, and FEMA’s Integrated Public Alert and Warning System, which is intended to integrate new and existing alert capabilities, including the Emergency Alert System, into a “system of systems” to become the country’s comprehensive public alert system. We reported that FEMA faced coordination issues in developing and implementing the system. For example, many stakeholders we contacted during our work knew little about the Integrated Public Alert and Warning System and expressed the need for better coordination with FEMA. Among other things, we recommended that FEMA develop strategic goals and processes for deployment of the Integrated Public Alert and Warning System and report periodically on program progress to the Congress and to the Secretary of Homeland Security in order to improve program transparency and accountability. DHS concurred and published an Integrated Public Alert and Warning System Strategic Plan in June 2010 that identified the vision, mission, goals and objectives of the program. What remains to be done: In September 2009, we reported that FEMA faced technical challenges in implementing the Integrated Public Alert and Warning System related to systems integration, standards development, the development of geo-targeted and multilingual alerts, and alerts for individuals with disabilities. For example, FEMA’s standard intended to facilitate integration of alert systems was under development and not widely used. As a result, we reported that integration with state and local systems would likely be a significant challenge due to potential incompatibility, and FEMA did not yet have logistical plans to integrate these systems. Further, we reported that to demonstrate the integration and expansion of new alerting technologies, and to work toward the functionality described in the executive order, FEMA had implemented pilot projects, but they ended inconclusively, with few documented lessons learned. We recommended, among other things, that FEMA establish and implement a plan to verify the dependability and effectiveness of systems used to disseminate alerts. FEMA concurred and, in July 2011, reported that it had engaged with a range of agencies, organizations, and private sector entities to promote Integrated Public Alert and Warning System capabilities and opportunities for the integration of alert and warning technologies for people with access and functional needs. FEMA reported that it had partnered with organizations to demonstrate products that incorporate technologies for alerting persons with access and functional needs. Further, FEMA reported that it was developing an infrastructure of alert and warning capabilities that expands on the traditional Emergency Alert System by, for example, allowing individuals with enabled mobile devices to receive text-like messages alerting them of imminent threats in their geographic area. FEMA reported that in March 2011 it deployed the Integrated Public Alert and Warning System-Open Platform for Emergency Networks, a set of securely hosted Web services that enable the routing of alerts and warnings between various third-party systems, networks, and devices. As DHS has recently implemented this system and its pilot products have not yet been deployed, it is too early to assess the effectiveness of these efforts. Overall assessment FEMA made progress in allocating homeland security grants using a reasonable risk assessment methodology. However, challenges remain regarding the coordination of grant programs. Summary of key progress and work remaining FEMA used a reasonable risk assessment methodology to allocate the Urban Areas Security Initiative and State Homeland Security grants, but FEMA should coordinate the application and review process for its preparedness grants. Key progress: Within FEMA, the Grant Programs Directorate is responsible for business operations, training, policy, oversight of all FEMA grants, and the program management of preparedness grants. FEMA’s grant programs vary from enhancing capabilities that focus on counterterrorism and catastrophic events, to specific first-responder disciplines that strengthen capabilities for addressing hazards of all types. For example, the State Homeland Security Program provides funding in an effort to address the identified planning, organization, equipment, training, and exercise needs at the state and local levels to prevent, protect against, respond to, and recover from acts of terrorism and other catastrophic events. The Urban Areas Security Initiative program provides funding to address the unique planning, organization, equipment, training, and exercise needs of high-threat, high-density urban areas, and assists them in building an enhanced and sustainable capacity to prevent, protect against, respond to, and recover from acts of terrorism. In June 2008, we reported that DHS had constructed a reasonable methodology to assess risk and allocate the Urban Area Security Initiative and State Homeland Security grants, but that this methodology did not account for vulnerability differences among jurisdictions. In July 2011, DHS reported that it modified its methodology for fiscal year 2011 to address the measurement of vulnerability in its risk-based grant allocation model. Specifically, FEMA reported creating a separate vulnerability assessment that accounts for 20 percent of the overall risk assessment for states, and territories, and the top 100 metropolitan areas for use in the State Homeland Grant Program and the Urban Areas Security Initiative grant program. We have ongoing work assessing these homeland security grant programs, and plan to report on the results later this year. Summary of key progress and work remaining The IG recommended, among other things, that FEMA identify grant programs that may overlap or duplicate with other programs. FEMA concurred and reported it planned to take action to address them. For example, FEMA reported in July 2011 that it was working with DHS and other federal departments to consolidate existing preparedness grant programs and entering into a memorandum of understanding with the Departments of Health and Human Services and Transportation to clarify roles among the departments regarding their emergency preparedness- related grants. These are positive steps and should help strengthen FEMA’s grant management. However, our work and that of the DHS IG has shown that FEMA should further benefit from examining its grant programs and coordinating its application process to eliminate or reduce redundancy among grant recipients and program purposes. Appendix XII: Emergency Preparedness and Response We are conducting this work for the House Committee on Homeland Security; the Senate Committee on Homeland Security and Governmental Affairs; and the Senate Committee on Commerce, Science, and Transportation. For additional information about this area, contact William O. Jenkins, Jr. at (202) 512-8757 or jenkinswo@gao.gov. In 2003, we designated implementing and transforming the Department of Homeland Security (DHS) as high risk because DHS had to transform 22 agencies—several with major management challenges—into one department, and failure to effectively address DHS’s management and mission risks could have serious consequences for U.S. national and economic security. This high-risk area includes challenges in strengthening DHS’s management functions, the impact of those challenges on DHS’s mission implementation, and challenges in integrating management functions within and across the department and its components. For the purposes of this report, we are highlighting examples of DHS transformation and implementation efforts in key areas on which we have recently reported, and not on areas on which we have not reported or have conducted limited audit work. DHS has other transformation and implementation efforts underway at the department and component levels. We have not completed work on these areas upon which to base an assessment of DHS’s progress. workforce goals, objectives, and performance measures for human capital management. However, DHS continues to face significant weaknesses in these areas that hinder the department’s transformation efforts and its ability to meet its missions. For example, because of acquisition and information technology management weaknesses, major programs have not met capability, benefit, cost, and schedule expectations. Further, we reported that financial management internal control weaknesses have impeded DHS from providing reliable and timely financial data to support daily operational decision making. Moreover, human capital challenges have affected departmental and component efforts to implement their missions. As DHS continues to mature as an organization, it will be critical that the department continue to work to strengthen its management functions and their implementation, since the effectiveness of these functions and their implementation directly affects its ability to fulfill its homeland security and other missions. DHS has developed and begun to implement its strategy to address the high-risk area, but has not yet demonstrated sustainable, measurable progress in its implementation efforts. In our 2011 high- risk update, we reported that DHS has taken action to implement, transform, and strengthen its management functions. The Secretary and Deputy Secretary of Homeland Security, and other senior officials, have demonstrated commitment and top leadership support to address the department’s management challenges. In January 2011, DHS provided us with its Integrated Strategy for High Risk Management, which summarized the department’s preliminary plans for addressing the high- risk area, and DHS updated this strategy in June 2011. We provided DHS with feedback on the January 2011 strategy and have worked with the department to monitor implementation efforts. For example, we noted that the January 2011 strategy was generally responsive to actions and outcomes we identified for the department to address the high-risk area. However, we noted that, in most cases, the strategy did not identify the specific resources needed to implement planned corrective actions, making it difficult to assess the extent to which DHS has the capacity to implement these actions. Additionally, we noted that the strategy did not provide information on the underlying metrics or factors DHS used to rate its progress, making it difficult for us to assess DHS’s overall characterizations of progress. In the June 2011 update, DHS provided ratings of its progress in implementing corrective actions related to each management function. We are assessing DHS’s ratings and the June 2011 update, and plan to provide the department with our feedback later this year. Going forward, to address the long-standing problems in its management functions and in the integration of those functions, DHS needs to implement its Integrated Strategy for High Risk Management; continue its efforts to identify and acquire resources needed to achieve key actions and outcomes; implement a program to monitor and validate its corrective actions; and show measurable, sustainable progress in implementing corrective actions and achieving key outcomes. DHS developed processes and policies for managing its acquisitions, but faces significant challenges in ensuring proper implementation. DHS has taken steps to strengthen acquisition oversight processes, but it continues to face obstacles in managing its acquisitions and ensuring proper implementation and departmentwide coordination. We previously reported that DHS faced challenges related to acquisition oversight, cost growth, and schedule delays. In August 2007, DHS established the Acquisition Program Management Division under the Office of the Chief Procurement Officer to help strengthen acquisition management within the department. Further, in June 2010, we reported that DHS continued to develop its acquisition oversight function and had begun to implement a revised acquisition management directive that includes more detailed guidance for programs to use when informing component and departmental decision making. We also reported that the senior-level Acquisition Review Board had met more frequently and provided programs decision memorandums with action items to improve performance. However, while the Acquisition Review Board reviewed 24 major acquisition programs in fiscal years 2008 and 2009, more than 40 major acquisition programs had not been reviewed, and programs had not consistently implemented action items identified as part of the review by established deadlines. In July 2011, DHS reported that the Acquisition Program Management Division in 2009 started conducting annual portfolio program reviews with components with the goal of ensuring that major programs receive at least one review on an annual basis, and that DHS had conducted reviews of additional programs through the Acquisition Review Board in fiscal years 2010 and 2011. Our work has also shown that departmental concerns exist about the accuracy of cost estimates for some of DHS’s major programs. In addition, over half of the programs we reviewed for our June 2010 report awarded contracts to initiate acquisition activities without component or department approval of documents essential to planning acquisitions, such as mission need statements outlining the specific functional capabilities required to accomplish DHS’s mission and objectives; operational requirements; and acquisition program baselines. Additionally, in November 2010, leveraging our work, the DHS Office of Inspector General (IG) identified acquisition management as a major challenge facing the department. We have made a number of recommendations to DHS to strengthen its acquisition management functions, such as establishing a departmental joint requirements oversight board to review and approve acquisition requirements, and ensuring major investments comply with established component and departmental review policy standards. DHS generally agreed and is working to address them by, among other things, establishing an Investment Review Board to help oversee the status of all acquisition investments; expanding its Acquisition Corps to provide trained procurement and program management professionals to manage DHS’s most critical acquisition programs; developing a tool to track programs’ cost, schedule, and performance indicators; and evaluating the effectiveness of award fees and performance incentives. These are positive actions that should better position DHS to meet its acquisition needs. However, moving forward, DHS will need to continue to demonstrate sustainable progress in implementing these actions and delivering programs that meet cost, schedule, and performance expectations. interrelated management controls and capabilities. For example, DHS continued to issue annual updates to its enterprise architecture that added previously missing scope and depth, and further improvements were planned to incorporate the level of content, referred to as segment architectures, needed to effectively introduce new systems and modify existing ones. In addition, in July 2011, DHS reported that the department had begun tracking implementation of our Enterprise Architecture Management Maturity Framework and had developed plans to improve enterprise architecture maturity within each component and departmentwide. We further reported that DHS redefined its information technology acquisition and investment management policies, practices, and structures, including establishing a system life cycle management methodology, and increased its information technology acquisition workforce. In addition, in August 2011, DHS reported that it had efforts underway to establish an information technology program manager certification track intended to assist in managing information technology program management challenges. Nevertheless, challenges remain relative to, for example, fully defining key system investment and acquisition management policies and procedures for information technology. Moreover, the extent to which DHS implemented these investment and acquisition management policies and practices on major information technology programs has been inconsistent. For example, our work showed that major information technology acquisition programs were not subjected to executive-level acquisition and investment management reviews. As a result, major programs aimed at delivering important mission capabilities had not lived up to their capability, benefit, cost, and schedule expectations. those for configuring desktop computers and wireless communication devices. Additionally, in November 2010, the DHS IG identified information technology management as a major challenge facing the department. For example, the DHS IG reported that the department faces challenges as it attempts to create a unified information technology infrastructure for effective integration and agencywide management of information technology assets and programs. We made recommendations to strengthen DHS information technology management, such as establishing procedures for implementing project- specific investment management policies, and policies and procedures for portfolio-based investment management. DHS is working to strengthen these areas by, for example, developing a process for information technology acquisition management to help ensure that each investment begins with a successful plan and road map for its life cycle and by establishing executive steering committees to monitor the cost and schedule performance of all high-risk information technology investments. While these are positive steps that should better position the department in managing its information technology investments moving forward, DHS will need to continue to make measurable progress in implementing these actions and successfully developing and deploying information technology programs. consolidate its disparate systems. In addition, DHS has not been able to obtain an unqualified audit opinion on its consolidated financial statements (i.e., prepare a set of financial statements that are considered reliable). For fiscal year 2010, the independent auditor issued a disclaimer on DHS’s consolidated financial statements and identified deficiencies in DHS’s internal control over financial reporting. Until these weaknesses are resolved, DHS will not be in position to provide reliable, timely, and useful financial data to support day-to-day decision making. In addition, as a result of these weaknesses, in November 2010 the DHS IG assessed financial management as one of the major management challenges facing the department. DHS has taken steps to prepare and implement corrective action plans for its internal control weaknesses through its Internal Control Playbook, DHS’s annual plan to design and implement departmentwide internal controls. Further, in fiscal year 2010 DHS committed to the goal of receiving a qualified audit opinion on its consolidated balance sheet in fiscal year 2011, and the department is working toward that goal by, for example, focusing on strengthening budgetary resource processes and payment management, and remediating financial management issues at the U.S. Coast Guard. These are positive first steps toward achieving a successful full scope audit of the department’s consolidated financial statements and, if implemented effectively, should help DHS strengthen its financial management functions. objectives, and performance measures for human capital management. These strategies are promising, but DHS has faced challenges in implementing its human capital functions, including hiring people with the needed skills and abilities in areas such as acquisition management, for example. Further, our prior work suggests that successful organizations empower and involve their employees to gain insights about operations from a frontline perspective, increase their understanding and acceptance of organizational goals and objectives, and improve motivation and morale. However, DHS’s scores on the Partnership for Public Service’s 2010 rankings of the Best Places to Work in the Federal Government improved from prior years, but in 2010, it was ranked 28 out of 32 agencies in the Best Places to Work ranking on overall scores for employee satisfaction and commitment. steering committee to provide oversight of the department’s language requirements. DHS reported that it is also working to address its human capital management challenges by, among other things, developing component operational plans for the Workforce Strategy, tracking those plans against a common set of performance measures, and implementing comprehensive workforce planning to link the department’s strategic goals, mission critical occupations, and workforce capacity and capabilities. These are positive actions that should better position DHS in assessing and meeting its human capital needs, but more work remains. on DHS’s updated plan for management integration and will monitor implementation efforts. For additional information about this area, contact David Maurer at (202) 512-9627 or maurerd@gao.gov for transformation, human capital management, and management integration; John Hutton at (202) 512- 4841 or huttonj@gao.gov for acquisition management; David A. Powner at (202) 512-9286 or pownerd@gao.gov for information technology management; or Paula Rascona at (202) 512-9816 or rasconap@gao.gov for financial management. Performance measurement underpins federal efforts to assess and report on progress in strengthening programs and operations. We reported on the importance of the development of outcome-based performance goals and measures as part of results management efforts across government. Performance goals and measures are intended to provide Congress and agency management with information to systematically assess a program’s strengths, weaknesses, and performance. A performance goal is the target level of performance expressed as a tangible, measurable objective against which actual achievement will be compared. A performance measure can be defined as an indicator, statistic, or metric used to gauge program performance. Outcome-oriented measures show results or outcomes related to an initiative or program in terms of its effectiveness, efficiency, or impact. For the purposes of this report, we are generally highlighting examples of Department of Homeland Security (DHS) performance measurement efforts in key areas on which we have recently reported, and not on areas on which we have not reported or have conducted limited audit work. DHS has other performance measurement efforts underway at the department and component levels. We have not completed work on these areas upon which to base an assessment of DHS’s progress. department’s performance goals and measures to help strengthen DHS’s efforts in this area. Our feedback was based on our work on and subject matter knowledge of the programs, activities, and areas being measured, as well as our work on effective practices for performance measurement. This feedback ranged from pointing out components’ limited use of outcome-oriented performance measures to assess the results or effectiveness of programs, to raising questions about the steps DHS or its components took to ensure the reliability and verification of performance data. DHS also implemented internal efforts to strengthen its performance measures. For example, as part of our ongoing review of the QHSR, we found that DHS worked to align its performance measures to the QHSR missions and goals. The department also provided components with guidance that outlines how to assess QHSR missions and related training, and formed working groups to discuss implementing specific performance measure concepts. Further, DHS reported that after the QHSR was issued, DHS senior leaders held meetings to discuss how to revise existing performance measures, and components worked to develop improved performance measures. In response to its internal efforts and our feedback, DHS developed and revised its performance goals and measures for some areas to strengthen its ability to assess its outcomes and progress. For fiscal year 2011, DHS identified 85 strategic measures for assessing its progress in achieving its QHSR missions and goals. In addition to these strategic measures, the department has 132 management measures, which DHS uses for assessing programmatic performance and for resource allocation and other internal decision making purposes, such as program evaluation. In addition, in July 2011, DHS reported that the department has identified 24 areas for focused efforts to develop enhanced measures, based on guidance from DHS leadership and the Office of Management and Budget. These areas address gaps in both strategic and management measures for specific mission areas. DHS also plans to continue its annual process for reviewing and working to strengthen its performance measures. of programs lack outcome goals and measures, which may hinder the department’s ability to effectively assess results or fully assess whether the department is using resources effectively and efficiently. We have recognized that DHS faces some inherent difficulties in developing performance goals and measures to address its unique mission and programs, such as in developing measures for the effectiveness of its efforts to prevent and deter terrorist attacks. In such instances, proxy measures—or indirect indicators—should be designed to assess the effectiveness of program functions. Outcome measures are helpful to departmental decision makers and managers, as they describe the products and services delivered by a program over a period of time. However, we have reported that many of DHS’s components have not developed adequate proxy or outcome-based performance measures or mechanisms to monitor, assess, and evaluate the effectiveness of their plans and performance. Such measures, along with output and process measures, would help DHS track progress being made toward specific goals and provide managers with important information upon which to base their decisions. improve the measurement and reporting of checkpoint effectiveness. CBP agreed and reported plans to develop and better use data on checkpoint effectiveness. Further, we reported that U.S. Immigration and Customs Enforcement (ICE) and CBP did not have measures for assessing the performance of key immigration enforcement programs. For example, in April 2011 we reported that ICE did not have measures for its overstay enforcement efforts, and in July 2010 that CBP did not have measures for its alien smuggling investigative efforts, making it difficult for these agencies to determine progress made in these areas and evaluate possible improvements. We recommended that ICE and CBP develop performance measures for these two areas. They generally agreed and reported actions underway to develop these measures. In addition, in July 2011, DHS stated that CBP was leading a multiyear effort to develop measures for border security to position the department to be able to assess the impact of security measures, such as tactical infrastructure, on border security. DHS also reported that it has measures for assessing its border security and immigration enforcement efforts, such as measures related to detaining and removing criminal aliens while maintaining compliance with detention standards. However, our work has shown that within key border security and immigration enforcement programs, DHS and its components can strengthen its measures for assessing program results. units and was unable to control the distribution of the Ready Campaign messages or measure whether the messages were changing the behavior of individuals. We noted that by examining the feasibility of approaches to verify data on its community preparedness programs, FEMA would be better positioned to begin to explore why programs that no longer exist were disbanded and develop possible strategies for reconstituting local programs or developing new ones. Among other things, we recommended that FEMA examine the feasibility of developing various approaches for ensuring the accuracy of program data. In July 2011, FEMA reported taking additional action to strengthen its performance measures by, for example, implementing a priority goal focusing on ensuring resilience to disasters by strengthening disaster preparedness and response capabilities, and beginning in fiscal year 2010, requiring its offices to develop and report on activity-level (or operational level) performance measures to align to each of FEMA’s budget activity lines. These steps should help FEMA strengthen its performance measurement efforts. However, FEMA should continue to work toward implementing a comprehensive set of measures for assessing national preparedness capabilities. For additional information about this area, contact David Maurer at (202) 512-9627 or maurerd@gao.gov. Risk management has been widely supported by the President and Congress as a management approach for homeland security. According to the Department of Homeland Security (DHS), risk information is usually one of many factors—and typically not the sole factor—that departmental decision makers consider when deciding which strategy to pursue. We have previously reported that defining an acceptable, achievable (within constrained budgets) level of risk is imperative to address current and future threats, and on the need to make risk-informed decisions related to homeland security. Many have pointed out, as did the Gilmore and 9/11 Commissions, that the nation will never be completely safe and total security is an unachievable goal. Within its sphere of responsibility, DHS cannot afford to protect everything against all possible threats. As a result, DHS must make choices about how to allocate its scarce resources to most effectively manage risk, and a risk management approach can help inform these decisions. To provide guidance to agency decision makers, we developed a risk management framework which is intended to be a starting point for applying risk-informed principles. Our risk management framework, shown in figure 2, entails a continuous process of managing risk through a series of actions, including setting strategic goals and objectives, assessing risk, evaluating alternatives, selecting initiatives to undertake, and implementing and monitoring those initiatives. within and across the various aviation and surface transportation modes, such as freight rail, passenger rail, and pipelines. In addition, our work shows that DHS and its components conducted risk assessments across a number of areas, but should strengthen these assessments. For example, with regard to surface transportation securit in February 2009 we reported that DHS had conducted threat assessments of the commercial vehicle sector and was in the early stages of conducting vulnerability assessments for this sector. However, we reported that TSA’s commercial vehicle threat assessments generally did not identify the likelihood of specific threats, as directed by the National Infrastructure Protection Plan, and that TSA had not yet determined the scope, method, and time frame for completing vulnerability assessments. We also noted that TSA had not yet conducte consequence assessments, and a approach for securing the commercial vehicle sector addressed the highest priority security needs. Moreover, in January 2009 we reported that federal entities, including DHS, had efforts underway to assess threat, vulnerability, and consequence for highway infrastructure, but these efforts were not systematically coordinated among key federal partners and the results were not routinely shared. In August 2010, we s a result, could not be sure that its further reported that TSA developed a pipeline risk assessment model that combined threat, vulnerability, and consequence to create a risk score for each system. However, we reported that DHS should improve the model’s consequence component to take account of additional impacts from a possible pipeline attack, such as public health and safety, as called for in the National Infrastructure Protection Plan. of 2007, such as those for the trucking and school bus industries; and developed assessments for highway infrastructure, bus, commercial truck, and port interfaces that were incorporated into the Transportation Sector Security Risk Assessment. Moreover, in July 2011 TSA repo rted that it added data columns for consequence and vulnerability components in its pipeline risk ranking tool to address pipelines in highly populated and high consequence areas. These are important actions that should strengthen TSA’s risk assessment efforts across the transportation modes. We have not yet assessed these efforts, and thus cannot an assessment of TSA’s efforts. In addition, with regard to maritime security, the Coast Gua risk assessment model, the Maritime Security Risk Analysis Model, to assess risk across ports. In April 2010, we reported that the Coast Guard had assessed the risks to cruise ships and facilities using this model. However, our work has shown that the Coast Guard has used the model to assess offshore energy facilities, but faces challenges in doing assessments because of difficulties in determining the types of attack scenarios that could cause significant consequences, and in calcula secondary economic effects. In July 2011, the Coast Guard reported that it is working to improve the accuracy, utility, and standardization of its model, as the modeling, simulation, and analysis of terror attack scenarios improves. We are currently conducting work examining the Maritime Security Risk Analysis Model as well as the extent to which DHS is allocating port security resources based on risk.We plan to report the results from this work later this year. the department’s risk management capability, to strengthen DHS’s mission performance, improve departmental management, and increase accountability. In our ongoing review of DHS’s QHSR, we found that DHS considered various factors in identifying high priority BUR initiatives for implementation in fiscal year 2012, but did not include risk information as one of these factors. Consideration of risk information could help strengthen DHS’s prioritization of mechanisms for implementing the QHSR, including determining which BUR initiatives could be implemented in the short or longer term, and the resources required for implementation. We plan to report on the final results of this work later this year. Also, with regard to transportation security, DHS has not fully utilized risk information in its strategic planning and prioritization efforts. For example, in March 2009 we reported that TSA had developed an approach to prioritization of its security activities based primarily on intelligence instead of comprehensive risk assessments. We reported that DHS had not reviewed or validated the methodology for this approach; thus, TSA lacked assurance that its approach provided the information needed to guide investment decisions to ensure resources were allocated to the highest risks. Further, with regard to planning efforts, in October 2009, we reported that TSA’s strategic plan to guide research, development, and deployment of passenger checkpoint screening technologies was not risk- based. We noted that lacking such information, DHS could not provide reasonable assurance that its strategy was effectively addressing security gaps, prioritizing investments based on risk, and targeting resources toward security measures that would have the greatest impact. Among other things, we recommended that DHS conduct a complete risk assessment related to TSA’s passenger screening program and incorporate the results into the program’s strategy. DHS generally concurred and reported actions underway to address them. For example, in July 2011, TSA reported beginning to use a risk management analysis process to analyze the effectiveness and efficiency of potential countermeasures and impact on the commercial aviation system. While these are positive steps, it is too early to assess the extent to which they will improve DHS’s use of risk information in strategic planning and investment decision making. For additional information about this area, contact Cathleen A. Berrick at (202) 512-3404 or berrickc@gao.gov. Since September 11, 2001, terrorist threats and attempted attacks have emphasized the importance of developing a national information sharing capability to efficiently and expeditiously gather, analyze, and disseminate terrorism-related information, such as law enforcement, homeland security, and public safety information. The Department of Homeland Security (DHS) has responsibility for sharing terrorism-related information as appropriate with its state and local partners. In 2005, we designated information sharing for homeland security as high risk because the government faced serious challenges in analyzing information and sharing it among federal, state, local, and other security partners in a timely, accurate, and useful way to protect against terrorist threats. We have further reported that DHS must effectively share terrorism-related information with state and local law enforcement because they depend on it to maintain awareness of emerging threats and to allocate homeland security resources, among other things. Further, gaps in sharing, such as agencies' failure to link information about the individual who attempted the December 25, 2009, airline bombing, prevented him from being included on the federal government’s terrorist watchlist, a tool used by DHS to screen for persons who pose a security risk. For the purposes of this report, we are generally highlighting examples of key DHS areas related to information sharing on which we have recently reported and not on areas on which we have not reported or conducted limited audit work. Our work has focused primarily on the sharing of terrorism-related information to identify threats and help prevent terrorist incidents. DHS has other ongoing efforts related to information sharing on which we are not reporting, such as information sharing with the government of Canada for emergency management purposes. We have not completed work on these areas upon which to make an assessment of DHS’s progress. functioning environment, and the Program Manager and agencies have not yet identified the incremental costs necessary to implement it or addressed our 2008 recommendation to develop procedures for determining what work remains. DHS is one of the five federal agencies with responsibility for implementing the Environment, and has the lead for sharing information with state, local, tribal, territorial, and private sector partners. Related to this responsibility, DHS has been implementing its information sharing policy and governance structure to improve how it collects, analyzes, and shares homeland security information across the department and with these state and local partners. DHS expanded and enhanced its sharing of information, but should improve its assistance and services to state and local homeland security partners and streamline some of its information sharing mechanisms. In January 2011, DHS issued a plan for addressing the areas for which it has responsibility under the terrorism-related information sharing high-risk area. DHS identified strategies and initiatives it had planned or underway to address our high-risk criteria and outcomes we identified as important to successfully managing risks that exist due to gaps in information sharing. For example, the plan discussed steps for developing a governance structure for information sharing and beginning efforts to develop a set of metrics for measuring information sharing performance and results. We provided DHS with feedback on this plan. Among other things, we noted the department needs to move toward a system where it accounts for information sharing initiatives against a baseline set of defined capabilities—such as information sharing mechanisms, personnel, and technology—that are needed, to help decision makers weigh progress achieved and remaining to inform investments. Subsequent to our feedback, in July 2011, DHS reported that it had established performance measures for assessing its information sharing efforts. These measures include, for example, the percent of intelligence reports customers rated as “satisfactory” in enabling customers to anticipate emergency threats. DHS plans to report on these metrics beginning in fiscal year 2012. While these are positive steps, our work has shown that developing outcome-based performance measures that gauge information sharing efforts and results would strengthen accountability for these efforts. Specific to its mission to share information with state and local partners, in December 2010 we reported that DHS’s Office of Intelligence and Analysis had initiatives underway to identify these partners’ information needs and obtain feedback on intelligence products. The office determined information needs—which are owned and controlled by the states—for 9 of the 50 states and was working with the remaining states to identify their needs. However, we reported that the Office of Intelligence and Analysis had not established mutually agreed upon milestones for completing this effort. We also reported that in addition to intelligence products, the office provided a number of other services to its state and local partners—primarily through these partners’ fusion centers where homeland security, terrorism, and intelligence information is shared—that had generally been well received by the center officials we contacted. For example, the Office of Intelligence and Analysis deployed more than 60 intelligence officers to fusion centers nationwide to assist state and local partners in areas such as obtaining relevant intelligence products and leveraging DHS capabilities to support their homeland security missions. However, the office had not yet defined how it planned to meet its state and local information-sharing mission by identifying and documenting the specific programs and activities that are most important for executing this mission. Moreover, its performance measures did not allow the office to demonstrate the expected outcomes and effectiveness of programs and activities that support state and local partners. gaps, and collection requirements. According to DHS, this guidebook will help fusion centers identify and document a more accurate and actionable set of information needs and gaps. These actions should help DHS better assess the performance of its information sharing activities. However, it is too early to assess possible results, since they have only recently been, or are in the process of being, implemented. Moreover, in September 2010 we reported that since 2001, all 50 states and some major urban areas established fusion centers—totaling 72 centers as of July 2011, according to DHS. These centers have cited DHS grant funding as critical to achieving baseline capabilities—the standards the government and fusion centers have defined as necessary for centers to be considered capable of performing basic functions. To provide data about the baseline capabilities of fusion centers nationwide, DHS and other agencies are conducting an ongoing systematic assessment of fusion centers’ capabilities. According to DHS senior officials and fusion center representatives, the results of the assessment are intended to provide centers with the information needed to develop more accurate and specific investment justifications. However, DHS had not set standard performance measures for the centers. We recommended that DHS define the steps it will take to design and implement such a set of measures and commit to a target timeframe for completing them. DHS concurred and stated that it has started to develop a framework to demonstrate the value and impact of the national network of fusion centers, and is using nationwide assessment data to support the development of specific performance measures. These efforts should help DHS strengthen its assessment of fusion centers’ performance, but it is too soon to assess results as DHS is in the process of implementing these efforts. As we have reported, if centers are to receive continued federal financial support, it is important that they are also able to demonstrate their impact and value added to the nation’s information sharing goals. sector, there are sites for different transportation modes, such as public transit. We found in September 2010 that 75 percent of the public transit agencies we surveyed reported being generally satisfied with the security- related information they received. However, we have identified several challenges to DHS’s information sharing efforts for surface transportation security. For example, some public transit agencies cited the need to streamline the information they received, and we identified the potential for overlap between the Public Transportation Information Sharing and Analysis Center, the Public Transit Portal of DHS’s Homeland Security Information Network, and the Transportation Security Information Sharing and Analysis Center, which all communicate similar unclassified and security-related information to public transit agencies. Also, preliminary observations from interviews and open-ended responses to a survey as part of our ongoing work indicate that some freight rail stakeholders would prefer to receive more analysis or actionable information from TSA, such as trend analysis of incidents or suggestions for improving security arrangements, that could help predict how certain events may affect rail systems. In addition, DHS and TSA have not developed performance goals and outcome-oriented measures to gauge the effectiveness of their information-sharing networks. intelligence and security information that had been disseminated by multiple sources. Further, in July 2011 TSA reported that it and key industry groups were engaged in an ongoing process to develop, improve, and refine its information sharing mechanisms. In addition, TSA reported that it continues to work with its stakeholders to determine how available intelligence and other security incident data can be leveraged to provide stakeholders with meaningful information to help guide actions in the field. We are continuing to assess TSA’s efforts related to sharing security information with stakeholders in the aviation, rail, and highway modes and will report the final results later this year. For additional information about this area, contact Eileen Larence at (202) 512-6510 or larencee@gao.gov. The Department of Homeland Security (DHS) provides federal leadership for homeland security, but also plays a large role in coordinating the homeland security activities of other federal, state, local, private sector, and international stakeholders. We reported that successful partnering and coordination involves collaborating and consulting with stakeholders to develop and agree on goals, strategies, and roles to achieve a common purpose; identify resource needs; establish a means to operate across agency boundaries, such as compatible procedures, measures, data, and systems; and agree upon and document mechanisms to monitor, evaluate, and report to the public on the results of joint efforts. If these entities do not effectively coordinate their implementation activities, they may waste resources by creating ineffective and incompatible pieces of a larger security program. For example, because the private sector owns or operates a majority of the nation’s critical infrastructure, DHS must partner with individual companies and sector organizations to protect vital national infrastructure, such as the nation’s water supply, transportation systems, and chemical facilities. For the purposes of this report, we are generally highlighting examples of key DHS areas related to partnerships and coordination on which we have recently reported. We are generally not addressing areas on which we have not reported or have conducted limited audit work. For example, DHS has ongoing efforts related to coordinating with homeland security partners within and across its various mission areas and programs, such as for combating nuclear terrorism and conducting biological research to support the nation’s biodefense preparedness. We have not completed work on these areas upon which to make an assessment of DHS’s progress. coordination of standards and practices, use of enhanced technology, and assessments of foreign airports. We also reported that DHS and TSA coordinated with foreign governments to harmonize air cargo security practices to address the statutory mandate to screen 100 percent of air cargo transported on U.S.-bound passenger aircraft. In July 2011, TSA reported that it had requested air carrier feedback on their ability to accomplish 100 percent of screening on international inbound air cargo by December 2011, and is evaluating industry comments to finalize its strategy and establish a feasible timeline for implementing the screening requirement. With regard to critical infrastructure protection, in September 2010 we reported that DHS’s National Protection and Programs Directorate (NPPD) operates the Protective Security Advisor Program, which deploys critical infrastructure protection and security specialists, called Protective Security Advisors, to local communities throughout the country. These advisors lead NPPD’s efforts in these locations and act as a link between state, local, tribal, and territorial organizations and DHS infrastructure mission partners. DHS also reported that these advisors work to maintain relationships with the private sector and local communities to help foster effective information sharing and disseminate information to the private sector during times of increased threat. July 2011 that it was taking additional action by, for example, establishing cybersecurity working groups, interagency coordination groups, and a performance measure for fiscal year 2012 to seek public and private sector feedback on the extent to which DHS cybersecurity products are actionable and timely. However, as DHS is in the processing of implementing these efforts, it is too early to assess their effectiveness. With regard to border security, in December 2010 we reported that federal, state, local, tribal, and Canadian law enforcement partners reported improved DHS coordination to secure the northern border. For example, interagency forums helped establish a common understanding of border security threats, while joint operations helped to achieve an integrated and effective law enforcement response. However, challenges remained in sharing information and resources useful for operations along the northern border. For example, partners in all four sectors we visited cited ongoing challenges in sharing information and resources for daily border security-related to operations and investigations, and we reported that oversight by management at the component and local level had not ensured consistent compliance with provisions of interagency agreements, such as those related to information sharing. In November 2010, we reported that information sharing and communication among the Departments of Agriculture, Homeland Security, and Interior for securing federal and tribal lands along the border had increased, but that critical gaps remained. For example, these agencies had established forums and liaisons to exchange information; however, in one sector they did not coordinate to ensure that federal land law enforcement officials maintained access to threat information and compatible secure radio communications for daily operations. Coordination in these areas could better ensure officer safety and an efficient law enforcement response to illegal activity. and border management programs or its approaches relative to addressing outcomes shared by those programs. As a result, we concluded that the department risked suboptimizing how its programs collectively supported its immigration and border management goals and objectives. We have made recommendations to DHS to strengthen its border security coordination efforts. For example, we recommended that DHS provide oversight to ensure efficient use of border security interagency forums and compliance with interagency agreements; take necessary action to ensure that personnel conduct early and continued consultations to coordinate on, among other things, threat information for federal lands that is timely and actionable; and fully define relationships between the US-VISIT program and other programs. DHS concurred and reported, for example, that it plans to review the inventory of interagency forums through its strategic and operational planning efforts to assess efficiency and identify challenges. Further, in July 2011, the US-VISIT program office reported taking action to coordinate with other immigration and border security programs. For example, it reported that it had established a governance board to enhance border security solutions to meet congressional mandates, and supported the expansion of immigration enforcement related programs, such as Secure Communities through which U.S. Immigration and Customs Enforcement works with state and local law enforcement agencies to identify and remove immigration violators. While these are positive steps, DHS needs to demonstrate that these efforts have helped the department to fully define relationships between the US-VISIT program and other programs. and continuity beyond the tenure of any given official or individual office, and recommended that the departments develop these practices. DHS concurred with our recommendation. For additional information about this area, contact Cathleen A. Berrick at (202) 512-3404 or berrickc@gao.gov. Since beginning operations in 2003, the Department of Homeland Security (DHS) has spent billions of dollars on research and development of technologies and other countermeasures to address threats and conduct its missions. DHS programs represent hundreds of billions of dollars in life-cycle costs and support a wide range of missions and investments, including border surveillance and screening equipment, nuclear detection equipment, information systems that help detect and interdict the planning of terrorist acts, and technologies used to screen airline passengers and baggage for explosives. Within DHS, the Science and Technology Directorate (S&T) has the authority to coordinate overall research and development efforts to improve homeland security. Among other things, S&T works with DHS components to provide assistance in researching and developing technologies to meet their specific missions, while the components themselves are responsible for developing, testing, and acquiring these technologies. For instance, the Transportation Security Administration (TSA) works with S&T to research, develop, and deploy technologies to, for example, screen airline passengers and their baggage. DHS’s Domestic Nuclear Detection Office (DNDO) is responsible for developing, acquiring, and supporting the deployment of programs and systems to detect and report on attempts to develop, transport, or use unauthorized nuclear explosive, fissile, or radiological materials or explosives in the United States. For the purposes of this report, we are generally highlighting examples of DHS efforts related to developing and deploying new technologies on which we have recently reported, and are generally not addressing areas on which we have not reported or have conducted limited audit work. While this section addresses examples on which we have reported, which focus on DHS’s efforts related to technologies for border, transportation, and maritime security, DHS has other efforts related to developing and deploying new technologies, such as technologies for intelligence. DHS also reported that it has taken steps intended to formalize requirements definition and technology development. We have not completed work on these areas upon which to make an assessment of DHS’s progress. DHS took action to develop and deploy new technologies to help meet its homeland security missions. However, in some instances DHS pursued acquisitions without ensuring that the technologies met defined requirements and faced challenges in conducting and documenting testing and evaluation and performing cost-benefit analyses. DHS developed and deployed various technologies within its functional areas, including maritime and transportation security. For example, in September 2010, we reported that DHS made progress in researching and developing container security technologies. Specifically, we reported that since fiscal year 2004 DHS conducted research and development for four container security technology projects to monitor cargo tampering and, according to DHS, provide a global communication system to securely transmit information to DHS components responsible for port security. Moreover, in June 2010 we reported that DHS made significant progress in deploying radiation detection equipment to scan cargo and conveyances entering the United States through fixed land and sea ports of entry for nuclear and radiological materials. Specifically, we reported that DHS deployed more than 1,400 radiation portal monitors to ports of entry. Further, TSA continues to deploy technologies to screen checked baggage. As of July 2011, TSA reported that it had about 2,300 explosives detection systems in its fleet, about 1,900 of which were deployed at airports in the United States. At airports and terminals that do not use these systems, explosives trace detection machines are used for primary checked-baggage screening, typically at smaller airports. As of July 2011, TSA estimated that there were about 5,000 explosives trace detection machines used for the primary or secondary screening of checked baggage at U.S. commercial airports. In addition, in June 2010 we reported that DHS, the United States Postal Service, and the Department of Defense developed and implemented technologies to sample the air and test for specific biological agents. In particular, DHS’s BioWatch program had been implemented in more than 30 metropolitan areas and tests for the presence of multiple biological agents. However, our work has shown that DHS made acquisition decisions without ensuring that the systems met program and performance requirements. In September 2010, we reported that DNDO was simultaneously engaged in the research and development phase while planning for the acquisition phase of its cargo advanced automated radiography system to detect certain nuclear materials in vehicles and containers at ports. DNDO pursued the acquisition and deployment of the cargo advanced automated radiography system without fully understanding that it would not fit within existing inspection lanes at ports of entry. This occurred because, during the first year or more of the program, DNDO and U.S. Customs and Border Protection (CBP) had few discussions about operating requirements for primary inspection lanes at ports of entry. DHS announced the termination of the program in 2010. In July 2011, we reported that TSA revised its explosives detection system requirements to better address current threats in screening checked baggage, and plans to implement these requirements in a phased approach. However, we reported that some number of systems in TSA’s fleet was configured to detect explosives at the levels established in the 2005 requirements and that the remaining systems were configured to detect explosives at 1998 levels. When TSA established the 2005 requirements, it did not have a plan with time frames to deploy the explosives detection systems to meet the new requirements. We recommended that TSA develop a plan to deploy and operate explosives detection systems to meet the most recent requirements. TSA concurred and, in July 2011, reported that it intends to finalize a plan by the fourth quarter of fiscal year 2012. proceed to the next acquisition phase. However, the office did not consistently document its review and approval of components’ test agents—a government entity or independent contractor carrying out independent operational testing for a major acquisition. In addition, the office did not document its review of other component acquisition documents, such as those establishing programs’ operational requirements. In March 2011, we reported that the independent testing and evaluation of the Secure Border Initiative Network’s virtual fence Block 1 capability to determine its operational effectiveness and suitability was not complete at the time DHS reached its decision regarding the future of the Secure Border Initiative Network, or requested fiscal year 2012 funding to deploy the new Alternative (Southwest) Border Technology.We reported that because the new Alternative (Southwest) Border Technology incorporates a mix of technology that includes an Integrated Fixed Tower surveillance system similar to that currently used in the Secure Border Initiative Network, such testing and evaluation could have informed DHS’s decision about moving forward with the new technology deployment. In September 2010, we reported that S&T’s master plans for conducting operational testing of container security technologies did not reflect all of the operational scenarios that CBP was considering for implementation. For example, S&T did not include certain scenarios necessary to test how a cargo container would be transported throughout the maritime supply chain. Until the container security technologies are tested and evaluated consistent with all of the operational scenarios, S&T cannot provide reasonable assurance that the technologies will function as intended. process. Further, in July 2011, S&T and CBP reported starting a joint pilot program to implement a new supply chain security technology on selected rail and truck cargo routes from Mexico and Canada into the United States to evaluate land cargo security devices intended to monitor unauthorized door openings or anomalies and to provide encrypted in- transit tracking. In addition, DHS has not consistently included cost-benefit analyses in its acquisition decision making. Our prior work shows that cost-benefit analyses help decision makers assess and prioritize resource investments and consider potentially more cost-effective alternatives. For example, in 2006, we recommended that DHS’s decision to deploy next- generation radiation-detection equipment, or advanced spectroscopic portals, used to detect smuggled nuclear or radiological materials, be based on an analysis of both the benefits and costs and a determination of whether any additional detection capability provided by the portals was worth their additional cost.DHS subsequently issued a cost-benefit analysis, but we reported that this analysis did not provide a sound analytical basis for DHS’s decision to deploy the portals. In June 2009, we also reported that an updated cost-benefit analysis might show that DNDO’s plan to replace existing equipment with advanced spectroscopic portals was not justified, particularly given the marginal improvement in detection of certain nuclear materials required of advanced spectroscopic portals and the potential to improve the current-generation portal monitors’ sensitivity to nuclear materials, most likely at a lower cost. At that time, DNDO officials stated that they planned to update the cost- benefit analysis. In July 2011, DHS announced that DNDO and CBP would end the advanced spectroscopic portal project as originally conceived given the challenges the program faced. DHS reported that it plans to deploy the existing units to field locations to gather operational data to support future planning efforts. investment life cycle and participate in new councils and boards DHS is planning to create to help ensure that test and evaluation methods are appropriately considered as part of DHS’s overall research and development investment strategies. In addition, DHS reported that the new councils and boards it is planning to establish would be responsible for, among other things, making decisions on research and development initiatives based on factors such as viability and affordability, and overseeing key acquisition decisions for major programs using baseline and actual data. According to DHS, S&T will help ensure that new technologies are properly scoped, developed, and tested before being implemented. In July 2011, S&T reported that it established a new group to work with DHS components to, among other things, help ensure that operational requirements are completely specified and validated and that comprehensive cost-benefit analyses are performed to identify the best alternative for meeting identified mission needs. However, as DHS has recently established this group, it is too soon to assess its effectiveness. DHS also reports that it is working with components to improve the quality and accuracy of cost estimates and increased its staff during fiscal year 2011 to develop independent cost estimates, a best practice, to ensure the accuracy and credibility of program costs. DHS reports that four cost estimates for level 1 programs have been validated to date. The actions DHS reported taking or underway to address the management of its acquisitions and the development of new technologies are positive steps and, if implemented effectively, could help the department address a number of these challenges. For additional information about this area, contact David Maurer at (202) 512-9627 or maurerd@gao.gov. In addition to the person named above, Rebecca Gambler, Assistant Director; Taylor Matheson, Analyst-in-Charge; Melissa Bogar; Susan Czachor; Lorraine Ettaro; Sarah Kaczmarek; Tracey King; Dawn Locke; Jan Montgomery; Jessica Orr; and Meghan Squires made key contributions to this report. Other contributors to this report included Joel Aldape; David Alexander; Gene Aloise; Rodell Anderson; Aditi Archer; Sarah Arnett; Neil Asaba; Ben Atwater; Jonathan Bachman; Charles Bausell; Claudia Becker; Scott Behen; Carolyn Blocker; David Bruno; Carissa Bryant; Rochelle Burns; Alicia Cackley; Stephen Caldwell; Lisa Canini; Caitlin Carlberg; Tammy Conquest; Christopher Currie; Ryan Consaul; Frances Cook; Joseph Cruz; Anthony DeFrank; Davi D'Agostino; Kay Daly; Deborah Davis; Katherine Davis; Vanessa Dillard; Michael Dino; Rick Eiserman; Eric Erdman; Jeanette Espinola; Alana Finley; Edward George; Robin Ghertner; Michael Gilmore; Kathryn Godfrey; Robert Goldenkoff; Mark Goldstein; Barbara Guffy; Geoffrey Hamilton; Christopher Hatscher; Brent Helt; David Hinchman; Richard Hung; John Hutton; William O. Jenkins, Jr.; Amanda Jones; Yvonne Jones; Valerie Kasindi; Christopher Keisling; Anjalique Lawrence; Michael Lenington; Eileen Larence; Marya Link; Thomas Lombardi; Stephen Lord; Robert Lowthian; Jessica Lucas Judy; David Lysy; Gary Malavenda; Kush Malhotra; David Maurer; Linda Miller; Lara Miklozek; Anthony Moran; Steve Morris; John Mortin; Gary Mountjoy; Suzanne Murphy; Robin Nye; Jean Orland; Sabine Paul; David Powner; Paula Rascona; Janay Sam; Debra Sebastian; Richard M. Stana; Kevin Tarmann; Nathan Tranquilli; Katherine Trimble; Meg Ullengren; Sarah Veale; Gregory Wilshusen; Michelle Woods; and Edwin Woodward. GAO. Aviation Security: TSA Has Taken Actions to Improve Security, but Additional Efforts Remain. GAO-11-807T. Washington, D.C.: July 13, 2011. GAO. Aviation Security: TSA Has Enhanced Its Explosives Detection Requirements for Checked Baggage, but Additional Screening Actions Are Needed. GAO-11-740. Washington, D.C.: July 11, 2011. GAO. Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives. GAO-11-657. Washington, D.C.: May 10, 2011. GAO. Aviation Security: Progress Made, but Challenges Persist in Meeting the Screening Mandate for Air Cargo. GAO-11-413T. Washington, D.C.: March 9, 2011. GAO. Aviation Security: TSA’s Revised Cost Comparison Provides a More Reasonable Basis for Comparing the Costs of Private-Sector and TSA Screeners. GAO-11-375R. Washington, D.C.: March 4, 2011. GAO. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. GAO. Aviation Security: TSA Has Made Progress but Faces Challenges in Meeting the Statutory Mandate for Screening Air Cargo on Passenger Aircraft. GAO-10-446. Washington, D.C.: June 28, 2010. GAO. Aviation Security: Efforts to Validate TSA’s Passenger Screening Behavior Detection Program Underway, but Opportunities Exist to Strengthen Validation and Address Operational Challenges. GAO-10-763. Washington, D.C.: May 20, 2010. GAO. GAO Review of the Department of Homeland Security’s Certification of the Secure Flight Program—Cost and Schedule Estimates. GAO-10-535R. Washington, D.C.: April 5, 2010. GAO. Aviation Security: TSA Is Increasing Procurement and Deployment of the Advanced Imaging Technology, but Challenges to This Effort and Other Areas of Aviation Security Remain. GAO-10-484T. Washington, D.C.: March 17, 2010. GAO. Transportation Worker Identification Credential: Progress Made in Enrolling Workers and Activating Credentials but Evaluation Plan Needed to Help Inform the Implementation of Card Readers. GAO-10-43. Washington, D.C.: November 18, 2009. GAO. Aviation Security: DHS and TSA Have Researched, Developed, and Begun Deploying Passenger Checkpoint Screening Technologies, but Continue to Face Challenges. GAO-10-128. Washington, D.C.: October 7, 2009. GAO. Aviation Security: A National Strategy and Other Actions Would Strengthen TSA's Efforts to Secure Commercial Airport Perimeters and Access Controls. GAO-09-399. Washington, D.C.: September 30, 2009. GAO. Transportation Security: Comprehensive Risk Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource Allocation. GAO-09-492. Washington, D.C.: March 27, 2009. GAO. Aviation Security: Federal Air Marshal Service Has Taken Actions to Fulfill Its Core Mission and Address Workforce Issues, but Additional Actions Are Needed to Improve Workforce Survey. GAO-09-273. Washington, D.C.: January 14, 2009. GAO. Aviation Security: TSA’s Cost and Performance Study of Private- Sector Airport Screening. GAO-09-27R. Washington, D.C.: January 9, 2009. GAO. Aviation Security: Transportation Security Administration Has Strengthened Planning to Guide Investments in Key Aviation Security Programs, but More Work Remains. GAO-08-1024T. Washington, D.C.: July 24, 2008. GAO. Transportation Security: Efforts to Strengthen Aviation and Surface Transportation Security Continue to Progress, but More Work Remains. GAO-08-651T. Washington, D.C.: April 15, 2008. GAO. Aviation Security: Transportation Security Administration Has Strengthened Planning to Guide Investments in Key Aviation Security Programs, but More Work Remains. GAO-08-456T. Washington, D.C.: February 28, 2008. GAO. Aviation Security: Risk, Experience, and Customer Concerns Drive Changes to Airline Passenger Screening Procedures, but Evaluation and Documentation of Proposed Changes Could Be Improved. GAO-07-634. Washington, D.C.: April 16, 2007. GAO. Aviation Security: Systematic Planning Needed to Optimize the Deployment of Checked Baggage Screening Systems. GAO-05-365. Washington, D.C.: March 15, 2005. Department of Homeland Security Office of Inspector General. Transportation Security Administration’s Management of Its Screening Workforce Training Program Can Be Improved, OIG-11-05. Washington, D.C.: October 26, 2010. Department of Homeland Security Office of Inspector General. Transportation Security Administration’s Controls over SIDA Badges, Uniforms, and Identification Cards, OIG-08-92. Washington, D.C.: September 12, 2008. GAO. Combating Nuclear Smuggling: DHS has Developed a Strategic Plan for its Global Nuclear Detection Architecture, but Gaps Remain. GAO-11-869T. Washington, D.C.: July 26, 2011. GAO. National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments. GAO-11-606. Washington, D.C.: June 21, 2011. GAO. DHS Science and Technology: Additional Steps Needed to Ensure Test and Evaluation Requirements are Met. GAO-11-596. Washington, D.C.: June 15, 2011. GAO. Combating Nuclear Smuggling: DHS Has Made Some Progress but Not Yet Completed a Strategic Plan for Its Global Nuclear Detection Efforts or Closed Identified Gaps. GAO-10-883T. Washington, D.C.: June 30, 2010. GAO. Biosurveillance: Efforts to Develop a National Biosurveillance Capability Need a National Strategy and a Designated Leader. GAO-10-645. Washington, D.C.: June 30, 2010. GAO. Biosurveillance: Developing a Collaboration Strategy Is Essential to Fostering Interagency Data and Resource Sharing. GAO-10-171. Washington, D.C.: December 18, 2009. GAO. Combating Nuclear Smuggling: DHS Improved Testing of Advanced Radiation Detection Portal Monitors, but Preliminary Results Show Limits of the New Technology, GAO-09-655. Washington, D.C.: May 21, 2009. GAO. Nuclear Detection: Domestic Nuclear Detection Office Should Improve Planning to Better Address Gaps and Vulnerabilities. GAO-09-257. Washington, D.C.: January 29, 2009. GAO. Combating Nuclear Smuggling: Lessons Learned from DHS Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T. Washington, D.C.: June 25, 2009. GAO, Combating Nuclear Smuggling: DHS’s Phase 3 Test Report on Advanced Portal Monitors Does Not Fully Disclose the Limitations of the Test Results, GAO-09-979. Washington, D.C.: September 30, 2008. GAO. Rail Security: TSA Improved Risk Assessment but Could Further Improve Training and Information Sharing. GAO-11-688T. Washington, D.C.: June 14, 2011. GAO. Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010. GAO. Homeland Security: Preliminary Observations on the Federal Protective Service’s Workforce Analysis and Planning Efforts. GAO-10-802R. Washington, D.C.: June 14, 2010. GAO. Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010. GAO. Emergency Communications: Vulnerabilities Remain and Limited Collaboration and Monitoring Hamper Federal Efforts. GAO-09-604. Washington, D.C.: June 26, 2009. GAO. Freight Rail Security: Actions Have Been Taken to Enhance Security, but the Federal Strategy Can Be Strengthened and Security Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009. GAO. Transportation Security: Comprehensive Risk Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource Allocation. GAO-09-492. Washington, D.C.: March 27, 2009. GAO. Highway Infrastructure: Federal Efforts to Strengthen Security Should Be Better Coordinated and Targeted on the Nation’s Most Critical Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009. Department of Homeland Security Office of Inspector General, Efforts to Identify Critical Infrastructure Assets and Systems, OIG-09-86. Washington, D.C.: June 30, 2009. GAO. Rail Security: TSA Improved Risk Assessment but Could Further Improve Training and Information Sharing. GAO-11-688T. Washington, D.C.: June 14, 2011. GAO. Public Transit Security Information Sharing: DHS Could Improve Information Sharing through Streamlining and Increased Outreach. GAO-10-895. Washington, D.C.: September 22, 2010. GAO. Pipeline Security: TSA Has Taken Actions to Help Strengthen Security, but Could Improve Priority-Setting and Assessment Processes. GAO-10-867. Washington, D.C.: August 4, 2010. GAO. Surface Transportation Security: TSA Has Taken Actions to Manage Risk, Improve Coordination, and Measure Performance, but Additional Actions Would Enhance Its Efforts. GAO-10-650T. Washington, D.C.: April 21, 2010. GAO. Transportation Security: Key Actions Have Been Taken to Enhance Mass Transit and Passenger Rail Security, but Opportunities Exist to Strengthen Federal Strategy and Programs. GAO-09-678. Washington, D.C.: June 24, 2009. GAO. Transit Security Grant Program: DHS Allocates Grants Based on Risk, but Its Risk Methodology, Management Controls, and Grant Oversight Can Be Strengthened. GAO-09-491. Washington, D.C.: June 8, 2009. GAO. Freight Rail Security: Actions Have Been Taken to Enhance Security, but the Federal Strategy Can Be Strengthened and Security Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009. GAO, Transportation Security: Comprehensive Risk Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource Allocation. GAO-09-492. Washington, D.C.: March 2009. GAO. Commercial Vehicle Security: Risk-Based Approach Needed to Secure the Commercial Vehicle Sector. GAO-09-85. Washington, D.C.: February 27, 2009. GAO. Highway Infrastructure: Federal Efforts to Strengthen Security Should Be Better Coordinated and Targeted on the Nation’s Most Critical Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009. GAO. TSA’s Explosives Detection Canine Program: Status of Increasing Number of Explosives Detection Canine Teams. GAO-08-933R. Washington, D.C.: July 31, 2008. GAO. Department of Homeland Security Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. Department of Homeland Security Office of Inspector General, DHS Grants Used for Mitigating Risks to Amtrak Rail Stations. OIG-11-93. Washington, D.C.: June 27, 2011. Department of Homeland Security Office of Inspector General, Use of American Recovery and Reinvestment Act Funds by the Federal Emergency Management Agency for the Transit Security Grant Program. OIG-11-18. Washington, D.C.: December 9, 2010. GAO. Border Security: DHS Progress and Challenges in Securing the U.S. Southwest and Northern Borders. GAO-11-508T. Washington, D.C.: March 30, 2011. GAO. Border Security: Preliminary Observations on the Status of Key Southwest Border Technology Programs. GAO-11-448T. Washington, D.C.: March 15, 2011. GAO. Visa Waiver Program: DHS Has Implemented the Electronic System for Travel Authorization, but Further Steps Needed to Address Potential Program Risks. GAO-11-335. Washington, D.C.: May 5, 2011. GAO. Border Security: DHS's Visa Security Program Needs to Improve Performance Evaluation and Better Address Visa Risk Worldwide. GAO-11-315. Washington, D.C.: March 31, 2011. GAO. Border Security: Enhanced DHS Oversight and Assessment of Interagency Coordination Is Needed for the Northern Border. GAO-11-97. Washington, D.C.: December 17, 2010. GAO. Secure Border Initiative: DHS Needs to Strengthen Management and Oversight of Its Prime Contractor. GAO-11-6. Washington, D.C.: October 18, 2010. GAO. Homeland Security: US-VISIT Pilot Evaluations Offer Limited Understanding of Air Exit Options. GAO-10-860. Washington, D.C.: August 10, 2010. GAO. Border Security: CBP Lacks the Data Needed to Assess the FAST Program at U.S. Northern Border Ports. GAO-10-694. Washington, D.C.: July 19, 2010. GAO. Secure Border Initiative: DHS Needs to Reconsider Its Proposed Investment in Key Technology Program. GAO-10-340. Washington, D.C.: May 5, 2010. GAO. Secure Border Initiative: DHS Has Faced Challenges Deploying Technology and Fencing Along the Southwest Border. GAO-10-651T. Washington, D.C.: May 4, 2010. GAO. Secure Border Initiative: DHS Needs to Address Testing and Performance Limitations That Place Key Technology Program at Risk. GAO-10-158. Washington, D.C.: January 29, 2010. GAO. Homeland Security: Key US-VISIT Components at Varying Stages of Completion, but Integrated and Reliable Schedule Needed. GAO-10-13. Washington, D.C.: November 19, 2009. GAO. Secure Border Initiative: Technology Deployment Delays Persist and the Impact of Border Fencing Has Not Been Assessed. GAO-09-896. Washington, D.C.: September 9, 2009. GAO. Border Patrol: Checkpoints Contribute to Border Patrol’s Mission, but More Consistent Data Collection and Performance Measurement Could Improve Effectiveness. GAO-09-824. Washington, D.C.: August 31, 2009. GAO. Border Security: Despite Progress, Weaknesses in Traveler Inspections Exist at Our Nation’s Ports of Entry. GAO-08-219. Washington, D.C.: November 5, 2007. Department of Homeland Security Office of Inspector General. CBP’s Efficacy of Controls Over Drug Seizures. OIG-11-57. Washington, D.C.: March 17, 2011. Department of Homeland Security Office of Inspector General. Customs and Border Protection Needs to Improve Its Inspection Procedures for the Western Hemisphere Travel Initiative. OIG-11-43. Washington, D.C.: February 11, 2011. GAO. Maritime Security: Progress Made but Further Actions Needed to Secure the Maritime Energy Supply. GAO-11-883T. Washington, D.C.: August 24, 2011. GAO. Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security. GAO-11-657. Washington, D.C.: May 10, 2011. GAO. Maritime Security: Federal Agencies Have Taken Actions to Address Risks Posed by Seafarers, but Efforts Can be Strengthened. GAO-11-195. Washington, D.C.: January 14, 2011. GAO. Maritime Security: Ferry Security Measures Have Been Implemented, but Evaluating Existing Studies Could Further Enhance Security. GAO-11-207. Washington, D.C.: December 3, 2010. GAO. Combating Nuclear Smuggling: Inadequate Communication and Oversight Hampered DHS Efforts to Develop an Advanced Radiography System to Detect Nuclear Materials. GAO-10-1041T. Washington, D.C.: September 15, 2010 GAO. Maritime Security: DHS Progress and Challenges in Key Areas of Port Security. GAO-10-940T. Washington, D.C.: July 21, 2010. GAO. Supply Chain Security: DHS Should Test and Evaluate Container Security Technologies Consistent with All Identified Operational Scenarios to Ensure the Technologies Will Function as Intended. GAO-10-887. Washington, D.C.: September 29, 2010. GAO. Coast Guard: Efforts to Identify Arctic Requirements Are Ongoing, but More Communication about Agency Planning Efforts Would Be Beneficial. GAO-10-870. Washington, D.C.: September 15, 2010. GAO. Maritime Security: Varied Actions Taken to Enhance Cruise Ship Security, but Some Concerns Remain. GAO-10-400. Washington, D.C.: April 9, 2010. GAO. Combating Nuclear Smuggling: Recent Testing Raises Issues About the Potential Effectiveness of Advanced Radiation Detection Portal Monitors. GAO-10-252T. Washington, D.C.: November 17, 2009. GAO. Supply Chain Security: Feasibility and Cost-Benefit Analysis Would Assist DHS and Congress in Assessing and Implementing the Requirement to Scan 100 Percent of U.S.-Bound Containers. GAO-10-12. Washington, D.C.: October 30, 2009. GAO. Combating Nuclear Smuggling: Lessons Learned from DHS Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T. Washington, D.C.: June 25, 2009. GAO. Combating Nuclear Smuggling: DHS Improved Testing of Advanced Radiation Detection Portal Monitors, but Preliminary Results Show Limits of the New Technology. GAO-09-655. Washington, D.C.: May 21, 2009. GAO. Maritime Security: Vessel Tracking Systems Provide Key Information, but the Need for Duplicate Data Should Be Reviewed. GAO-09-337. Washington, D.C.: March 17, 2009. GAO. Maritime Security: Coast Guard Inspections Identify and Correct Facility Deficiencies, but More Analysis Needed of Program's Staffing, Practices, and Data. GAO-08-12. Washington, D.C.: February 14, 2008. GAO. Maritime Security: The SAFE Port Act: Status and Implementation One Year Later. GAO-08-126T. Washington, D.C.: October 30, 2006. Department of Homeland Security Office of Inspector General. Customs and Border Protection’s Importer Self-Assessment Program. OIG-10-113. Washington, D.C.: August 30, 2010. Department of Homeland Security Office of Inspector General. CBP's Container Security Initiative Has Proactive Management and Oversight but Future Direction Is Uncertain. OIG-10-52. Washington, D.C.: February 3, 2010. Department of Homeland Security Office of Inspector General. Cargo Targeting and Examinations. OIG-10-34. Washington, D.C.: January 6, 2010. Department of Homeland Security Office of Inspector General. CBP's Ability to Detect Biological and Chemical Threats in Maritime Cargo Containers. OIG-10-01. Washington, D.C.: October 7, 2009. Immigration Enforcement GAO. Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs. GAO-11-411. Washington, D.C.: April 15, 2011. GAO. Employment Verification: Agencies Have Improved E-Verify, but Significant Challenges Remain. GAO-11-522T. Washington, D.C.: April 14, 2011. GAO. Employment Verification: Federal Agencies Have Taken Steps to Improve E-Verify, but Significant Challenges Remain. GAO-11-146. Washington, D.C.: December 17, 2010. GAO. Moving Illegal Proceeds: Challenges Exist in the Federal Government’s Effort to Stem Cross-Border Currency Smuggling, GAO-11-73, Washington, D.C.: October 25, 2010. GAO. Alien Smuggling: DHS Needs to Better Leverage Investigative Resources and Measure Program Performance along the Southwest Border. GAO-10-328. Washington, D.C.: May 24, 2010. GAO. Firearms Trafficking: U.S. Efforts to Combat Arms Trafficking to Mexico Face Planning and Coordination Challenges. GAO-09-709. Washington, D.C.: June 18, 2009. GAO. Immigration Enforcement: Better Controls Needed over Program Authorizing State and Local Enforcement of Federal Immigration Laws. GAO-09-109. Washington, D.C.: January 30, 2009. Department of Homeland Security Office of Inspector General. U.S. Immigration and Customs Enforcement Identification of Criminal Aliens in Federal and State Custody Eligible for Removal from the United States. OIG-11-26. Washington, D.C.: January 10, 2011. Department of Homeland Security Office of Inspector General. The Performance of the 287(g) Agreements Report Update. OIG-10-124. Washington, D.C.: September 30, 2010. Department of Homeland Security Office of Inspector General. The Performance of 287(g) Agreements. OIG-10-63. Washington, D.C.: March 4, 2010. GAO. Immigration Benefits: Actions Needed to Address Vulnerabilities in Process for Granting Permanent Residency. GAO-09-55. Washington, D.C.: December 5, 2008. GAO. U.S. Asylum System: Agencies Have Taken Actions to Help Ensure Quality in the Asylum Adjudication Process, but Challenges Remain. GAO-08-935. Washington, D.C.: September 25, 2008. GAO. Immigration Benefits: Internal Controls for Adjudicating Humanitarian Parole Cases Are Generally Effective, but Some Can Be Strengthened. GAO-08-282. Washington, D.C.: February 6, 2008. GAO. USCIS Transformation: Improvements to Performance, Human Capital and Information Technology Management Needed as Modernization Proceeds. GAO-07-1013R. Washington, D.C.: July 17, 2007. Department of Homeland Security Office of Inspector General. U.S. Citizenship and Immigration Services' Progress in Modernizing Information Technology. OIG-09-90. Washington, D.C.: July 13, 2009. Department of Homeland Security Office of Inspector General. Management Oversight of Immigration Benefit Application Intake Processes, OIG-09-37. Washington, D.C.: March 5, 2009. Department of Homeland Security Office of Inspector General. Review of the USCIS Benefit Fraud Referral Process, OIG-08-09. Washington, D.C.: April 29, 2008. GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure. GAO-11-865T. Washington, D.C.: July, 26, 2011. GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure and Federal Information Systems. GAO-11-463T. Washington, D.C.: March 16, 2011. GAO. Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed. GAO-10-628. Washington, D.C.: July 15, 2010. GAO. Cybersecurity: Continued Attention Is Needed to Protect Federal Information Systems from Evolving Threats. GAO-10-834T. Washington, D.C.: June 16, 2010. GAO. Information Security: Concerted Effort Needed to Consolidate and Secure Internet Connections at Federal Agencies. GAO-10-237. Washington, D.C.: March 12, 2010. GAO. Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010. GAO. Critical Infrastructure Protection: Current Cyber Sector-Specific Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.: September 24, 2009. GAO. High-Risk Series: An Update. GAO-09-271. Washington, D.C.: January 2009. GAO. Critical Infrastructure Protection: DHS Needs To Fully Address Lessons Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington, D.C.: September 9, 2008. GAO. Cyber Analysis and Warning: DHS Faces Challenges in Establishing a Comprehensive National Capability. GAO-08-588. Washington, D.C.: July 31, 2008. Department of Homeland Security Office of Inspector General. U.S. Computer Emergency Readiness Team Makes Progress in Securing Cyberspace, but Challenges Remain. OIG-10-94. Washington, D.C.: June 7, 2010. GAO. Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011 GAO. Measuring Disaster Preparedness: FEMA Has Made Limited Progress in Assessing National Capabilities. GAO-11-260T. Washington, D.C.: March 17, 2011. GAO. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. GAO. FEMA Has Made Limited Progress in Efforts to Develop and Implement a System to Assess National Preparedness Capabilities. GAO-11-51R. Washington, D.C.: October 29, 2010. GAO. Recovery Act: FEMA Could Take Steps to Protect Sensitive Port Security Grant Details and Improve Recipient Reporting Instructions. GAO-11-88. Washington, D.C.: October 15, 2010. GAO. Disaster Recovery: FEMA's Long-term Assistance Was Helpful to State and Local Governments but Had Some Limitations. GAO-10-404. Washington, D.C.: March 30, 2010. GAO. Emergency Communications: Establishment of the Emergency Communications Preparedness Center and Related Interagency Coordination Challenges. GAO-10-463R. Washington, D.C.: March 3, 2010. GAO. Combating Nuclear Terrorism: Actions Needed to Better Prepare to Recover from Possible Attacks Using Radiological or Nuclear Materials. GAO-10-204. Washington, D.C.: January 29, 2010 GAO. Combating Nuclear Terrorism: Preliminary Observations on Preparedness to Recovery from Possible Attacks Using Radiological or Nuclear Materials. GAO-09-996T. Washington, D.C.: September 14, 2009 GAO. Emergency Preparedness: Improved Planning and Coordination Necessary for Modernization and Integration of Public Alert and Warning System. GAO-09-834. Washington, D.C.: September 9, 2009. GAO. Hurricanes Gustav and Ike Disaster Assistance: FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement. GAO-09-671. Washington, D.C.: June 19, 2009. GAO. Emergency Communications: Vulnerabilities Remain and Limited Collaboration and Monitoring Hamper Federal Efforts. GAO-09-604. Washington, D.C.: June 19, 2009. GAO. National Preparedness: FEMA Has Made Progress, but Needs to Complete and Integrate Planning, Exercise, and Assessment Efforts. GAO-09-369. Washington, D.C.: April 30, 2009. GAO. Disaster Recovery: FEMA's Public Assistance Grant Program Experienced Challenges with Gulf Coast Rebuilding. GAO-09-129. Washington, D.C.: December 18, 2008. GAO. Homeland Security: DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's Measure of Vulnerability is Limited. GAO-08-852. Washington, D.C.: June 27, 2008. GAO. National Flood Insurance Program: Financial Challenges Underscore Need for Improved Oversight of Mitigation Programs and Key Contracts. GAO-08-437. Washington, D.C.: June 16, 2008. GAO. National Response Framework: FEMA Needs Policies and Procedures to Better Integrate Non-Federal Stakeholders in the Revision Process. GAO-08-768. Washington, D.C.: June 11, 2008. Department of Homeland Security Office of Inspector General. Efficacy of DHS Grants Programs. OIG-10-69. Washington, D.C.: March 22, 2010. GAO. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. GAO. Information Security: Federal Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk. GAO-11-43. Washington, D.C.: November 30, 2010. GAO. Department of Homeland Security: Assessments of Selected Complex Acquisitions. GAO-10-588SP. Washington, D.C.: June 30, 2010. GAO. Department of Homeland Security: DHS Needs to Comprehensively Assess Its Foreign Language Needs and Capabilities and Identify Shortfalls. GAO-10-714. Washington, D.C.: June 22, 2010. GAO. Information Security: Agencies Need to Implement Federal Desktop Core Configuration Requirements. GAO-10-202. Washington, D.C.: March 12, 2010. GAO. Financial Management Systems: DHS Faces Challenges to Successfully Consolidating Its Existing Disparate Systems. GAO-10-76. Washington, D.C.: December 4, 2009. GAO. Department of Homeland Security: Actions Taken Toward Management Integration, but a Comprehensive Strategy Is Still Needed. GAO-10-131. Washington, D.C.: November 20, 2009. GAO. Homeland Security: Despite Progress, DHS Continues to Be Challenged in Managing Its Multi-Billion Dollar Annual Investment in Large-Scale Information Technology Systems. GAO-09-1002T. Washington, D.C.: September 15, 2009. GAO. Equal Employment Opportunity: DHS Has Opportunities to Better Identify and Address Barriers to EEO in Its Workforce. GAO-09-639 Washington, D.C.: August 31, 2009. GAO. Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight. GAO-09-29. Washington, D.C.: November 18, 2008. GAO. Department of Homeland Security: Better Planning and Assessment Needed to Improve Outcomes for Complex Service Acquisitions. GAO-08-263. Washington, D.C.: April 22, 2008. GAO. Homeland Security: Departmentwide Integrated Financial Management Systems Remain a Challenge. GAO-07-536. Washington, D.C.: June 21, 2007. GAO. Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, version 1.1. GAO-04-394G. Washington, D.C.: March 2004. GAO. High-Risk Series: Strategic Human Capital Management. GAO-03-120. Washington, D.C.: January 2003. GAO. Determining Performance and Accountability Challenges and High Risks. GAO-01-159SP. Washington, D.C.: November 2000. Department of Homeland Security Office of Inspector General. Major Management Challenges Facing the Department of Homeland Security. OIG-11-11. Washington, D.C.: November 10, 2010. Performance Measurement GAO. Overstay Enforcement: Additional Mechanisms for Collecting, Assessing, and Sharing Data Could Strengthen DHS’s Efforts but Would Have Costs. GAO-11-411. Washington, D.C.: April 15, 2011. GAO. Measuring Disaster Preparedness: FEMA Has Made Limited Progress in Assessing National Capabilities. GAO-11-260T. Washington, D.C.: March 17, 2011. GAO. Department of Homeland Security: Progress Made in Implementation and Transformation of Management Functions, but More Work Remains. GAO-10-911T. Washington, D.C.: September 30, 2010. GAO. Alien Smuggling: DHS Needs to Better Leverage Investigative Resources to Measure Program Performance along the Southwest Border. GAO-10-328. Washington, D.C.: May 24, 2010. GAO. Emergency Preparedness: FEMA Faces Challenges Integrating Community Preparedness Programs into Its Strategic Approach. GAO-10-193. Washington, D.C.: January 29, 2010. GAO. Secure Border Initiative: Technology Deployment Delays Persist and the Impact of Border Fencing Has Not Been Assessed. GAO-09-1013T. Washington, D.C.: September 17, 2009. GAO. Border Patrol: Checkpoints Contribute to Border Patrol’s Mission, but More Consistent Data Collection and Performance Measurement Could Improve Effectiveness. GAO-09-824. Washington, D.C.: August 31, 2009. GAO. Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. GAO. National Preparedness: DHS and HHS Can Further Strengthen Coordination for Chemical, Biological, Radiological, and Nuclear Risk Assessments. GAO-11-606. Washington, D.C.: June 21, 2011. GAO. Pipeline Security: TSA Has Taken Actions to Help Strengthen Security, but Could Improve Priority-Setting and Assessment Processes. GAO-10-867. Washington, D.C.: August 4, 2010. GAO. Aviation Security: DHS and TSA Have Researched, Developed, and Begun Deploying Passenger Checkpoint Screening Technologies, but Continue to Face Challenges. GAO-10-128. Washington, D.C.: October 7, 2009. GAO. Freight Rail Security: Actions Have Been Taken to Enhance Security, but the Federal Strategy Can Be Strengthened and Security Efforts Better Monitored. GAO-09-243. Washington, D.C.: April 21, 2009. GAO. Transportation Security: Comprehensive Risk Assessments and Stronger Internal Controls Needed to Help Inform TSA Resource Allocation. GAO-09-492. Washington, D.C.: March 27, 2009. GAO. Commercial Vehicle Security: Risk-Based Approach Needed to Secure the Commercial Vehicle Sector. GAO-09-85. Washington, D.C.: February 27, 2009. GAO. Highway Infrastructure: Federal Efforts to Strengthen Security Should Be Better Coordinated and Targeted on the Nation’s Most Critical Highway Infrastructure. GAO-09-57. Washington, D.C.: January 30, 2009. GAO. Homeland Security: DHS Risk-Based Grant Methodology Is Reasonable, But Current Version’s Measure of Vulnerability Is Limited. GAO-08-852. Washington, D.C.: June 27, 2008. GAO. Risk Management: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. GAO. Department of Homeland Security: Further Refinements Needed to Assess Risks and Prioritize Protective Measures at Ports and Other Critical Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005. GAO. Information Sharing Environment: Better Road Map Needed to Guide Implementation and Investments. GAO-11-455. Washington, D.C.: July 21, 2011. GAO. Rail Security: TSA Improved Risk Assessment but Could Further Improve Training and Information Sharing. GAO-11-688T. Washington, D.C.: June 14, 2011. GAO. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. GAO. Information Sharing: DHS Could Better Define How It Plans to Meet Its State and Local Mission and Improve Performance Accountability. GAO-11-223. Washington, D.C.: December 16, 2010. GAO. Information Sharing: Federal Agencies Are Helping Fusion Centers Build and Sustain Capabilities and Protect Privacy, But Could Better Measure Results. GAO-10-972. Washington, D.C.: September 29, 2010. GAO. Public Transit Security Information Sharing: DHS Could Improve Information Sharing through Streamlining and Increased Outreach. GAO-10-895. Washington, D.C.: September 22, 2010. GAO. Surface Transportation Security: TSA Has Taken Actions to Manage Risk, Improve Coordination, and Measure Performance, but Additional Actions Would Enhance Its Efforts. GAO-10-650T. Washington, D.C.: April 21, 2010. GAO. Border Security: Enhanced DHS Oversight and Assessment of Interagency Coordination Is Needed for the Northern Border. GAO-11-97. Washington, D.C.: December 17, 2010. GAO. Aviation Security: DHS Has Taken Steps to Enhance International Aviation Security and Facilitate Compliance with International Standards, but Challenges Remain. GAO-11-238T. Washington, D.C.: December 2, 2010. GAO. Border Security: Additional Actions Needed to Better Ensure a Coordinated Federal Response to Illegal Activity on Federal Lands. GAO-11-177. Washington, D.C.: November 18, 2010. GAO. Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010. GAO. Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed. GAO-10-628. Washington, D.C.: July 15, 2010. GAO. Emergency Preparedness: Improved Planning and Coordination Necessary for Modernization and Integration of Public Alert and Warning System. GAO-09-834. Washington, D.C.: September 9, 2009. GAO, National Response Framework: FEMA Needs Policies and Procedures to Better Integrate Non-Federal Stakeholders in the Revision Process. GAO-08-768. Washington, D.C.: June 11, 2008. GAO. Homeland Security: Strategic Solution for US-VISIT Program Needs to Be Better Defined, Justified, and Coordinated. GAO-08-361. Washington, D.C.: February 29, 2008. GAO. Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions. GAO-07-454. Washington, D.C.: August 17, 2007. GAO. Homeland Security: DHS Could Strengthen Acquisitions and Development of New Technologies. GAO-11-829T. Washington, D.C.: July 15, 2011. GAO. Aviation Security: TSA Has Enhanced Its Explosives Detection Requirements for Checked Baggage, but Additional Screening Actions Are Needed. GAO-11-740. Washington, D.C.: July 11, 2011. GAO. DHS Science and Technology: Additional Steps Needed to Ensure Test and Evaluation Requirements Are Met. GAO-11-596. Washington, D.C.: June 15, 2011. GAO. Border Security: Preliminary Observations on the Status of Key Southwest Border Technology Programs. GAO-11-448T. Washington D.C.: March 15, 2011. GAO. Supply Chain Security: DHS Should Test and Evaluate Container Security Technologies Consistent with All Identified Operational Scenarios to Ensure the Technologies Will Function as Intended. GAO-10-887. Washington D.C.: September 29, 2010. GAO. Combating Nuclear Smuggling: Inadequate Communication and Oversight Hampered DHS Efforts to Develop an Advanced Radiography System to Detect Nuclear Materials. GAO-10-1041T. Washington D.C.: September 15, 2010. GAO. Combating Nuclear Smuggling: DHS Has Made Some Progress but Not Yet Completed a Strategic Plan for Its Global Nuclear Detection Efforts or Closed Identified Gaps. GAO-10-883T. Washington, D.C.: June 30, 2010. GAO. Biosurveillance: Efforts to Develop a National Biosurveillance Capability Need A National Strategy and a Designated Leader. GAO-10-645. Washington, D.C.: June 30, 2010. GAO. Combating Nuclear Smuggling: Recent Testing Raises Issues About the Potential Effectiveness of Advanced Radiation Detection Portal Monitors. GAO-10-252T. Washington, D.C.: November 17, 2009. GAO. Combating Nuclear Smuggling: Lessons Learned from DHS Testing of Advanced Radiation Detection Portal Monitors. GAO-09-804T. Washington, D.C.: June 25, 2009. GAO. Combating Nuclear Smuggling: DHS’s Program to Procure and Deploy Advanced Radiation Detection Portal Monitors Is Likely to Exceed the Department’s Previous Cost Estimates. GAO-08-1108R. Washington, D.C.: September 22, 2008.

Summary: The events of September 11, 2001, led to profound changes in government policies and structures to confront homeland security threats. Most notably, the Department of Homeland Security (DHS) began operations in 2003 with key missions that included preventing terrorist attacks from occurring in the United States, and minimizing the damages from any attacks that may occur. DHS is now the third-largest federal department, with more than 200,000 employees and an annual budget of more than $50 billion. Since 2003, GAO has issued over 1,000 products on DHS's operations in such areas as border and transportation security and emergency management, among others. As requested, this report addresses DHS's progress in implementing its homeland security missions since it began operations, work remaining, and issues affecting implementation efforts. This report is based on GAO's past and ongoing work, supplemented with DHS Office of Inspector General reports, with an emphasis on reports issued since 2008. GAO also analyzed information provided by DHS in July and August 2011 on recent actions taken in response to prior work. Since it began operations in 2003, DHS has implemented key homeland security operations and achieved important goals and milestones in many areas to create and strengthen a foundation to reach its potential. As it continues to mature, however, more work remains for DHS to address gaps and weaknesses in its current operational and implementation efforts, and to strengthen the efficiency and effectiveness of those efforts to achieve its full potential. DHS's accomplishments include developing strategic and operational plans; deploying workforces; and establishing new, or expanding existing, offices and programs. For example, DHS (1) issued plans to guide its efforts, such as the Quadrennial Homeland Security Review, which provides a framework for homeland security, and the National Response Framework, which outlines disaster response guiding principles; (2) successfully hired, trained, and deployed workforces, such as a federal screening workforce to assume security screening responsibilities at airports nationwide; and (3) created new programs and offices to implement its homeland security responsibilities, such as establishing the U.S. Computer Emergency Readiness Team to help coordinate efforts to address cybersecurity threats. Such accomplishments are noteworthy given that DHS has had to work to transform itself into a fully functioning department while implementing its missions--a difficult undertaking that can take years to achieve. While DHS has made progress, its transformation remains high risk due to its management challenges. Examples of progress made and work remaining include: Border security. DHS implemented the U.S. Visitor and Immigrant Status Indicator Technology program to verify the identities of foreign visitors entering and exiting the country by processing biometric and biographic information. However, DHS has not yet determined how to implement a biometric exit capability and has taken action to address a small portion of the estimated overstay population in the United States (individuals who legally entered the country but then overstayed their authorized periods of admission). Aviation security. DHS developed and implemented Secure Flight, a program for screening airline passengers against terrorist watchlist records. DHS also developed new programs and technologies to screen passengers, checked baggage, and air cargo. However, DHS does not yet have a plan for deploying checked baggage screening technologies to meet recently enhanced explosive detection requirements, a mechanism to verify the accuracy of data to help ensure that air cargo screening is being conducted at reported levels, or approved technology to screen cargo once it is loaded onto a pallet or container. Emergency preparedness and response. DHS issued the National Preparedness Guidelines that describe a national framework for capabilities-based preparedness, and a Target Capabilities List to provide a national-level generic model of capabilities defining all-hazards preparedness. DHS is also finalizing a National Disaster Recovery Framework, and awards preparedness grants based on a reasonable risk methodology. However, DHS needs to strengthen its efforts to assess capabilities for all-hazards preparedness, and develop a long-term recovery structure to better align timing and involvement with state and local governments' capacity. Chemical, biological, radiological and nuclear (CBRN) threats. DHS assessed risks posed by CBRN threats and deployed capabilities to detect CBRN threats. However, DHS should work to improve its coordination of CBRN risk assessments, and identify monitoring mechanisms for determining progress made in implementing the global nuclear detection strategy. GAO's work identified three themes at the foundation of DHS's challenges. This report contains no new recommendations.