Federal law generally requires the Secretary of State to convene an ARB not later than 60 days after the occurrence of an incident that resulted in serious injury, loss of life, or significant destruction of property at, or related to, a U.S. mission abroad unless the Secretary determines the incident clearly involves only causes unrelated to security. This time period can be extended for an additional 60-day period if the Secretary determines that the additional period is necessary for the convening of the board. Whenever the Secretary convenes an ARB, the Secretary shall promptly inform the Chairman of the Committee on Foreign Relations in the Senate and the Speaker of the House of Representatives. Federal law specifies that an ARB will consist of five members appointed by the Secretary of State and one appointed by the Director of National Intelligence. It also states that the ARB shall submit its findings to the Secretary of State. According to State’s FAM, the ARB is a mechanism to foster more effective security of U.S. missions and personnel abroad by ensuring a thorough and independent review of security-related incidents. Through its investigations and recommendations, the ARB seeks to determine accountability and promote and encourage improved security programs and practices. M/PRI—the central management analysis organization of State’s Under Secretary of State for Management—is responsible for initiating and shepherding the incident vetting process to identify incidents that may warrant an ARB, according to the FAM. The FAM states that M/PRI will begin the ARB incident vetting process once M/PRI becomes aware of an incident abroad that could involve loss of life, injury, or destruction of property. This process includes consultation with the Office of the Legal Adviser (Legal), DS, and other offices as appropriate to evaluate whether the ARB statute criteria apply. If the ARB statute criteria are deemed applicable or if the applicability is questionable, M/PRI is responsible for calling a meeting of State’s ARB Permanent Coordinating Committee. See figure 1 for members of the Permanent Coordinating Committee and other State offices and bureaus involved in responding to the incidents in Cuba. If M/PRI decides the ARB statute criteria are not applicable, M/PRI will notify committee members in writing, providing a summary of the incident and an explanation as to why the criteria do not apply. If any member disagrees, M/PRI will call a Permanent Coordinating Committee meeting. According to the FAM, the committee will review the available facts and recommend to the Secretary of State whether or not to convene an ARB as quickly as possible after an incident occurs. The Secretary of State makes the final decision on whether to convene an ARB. WHA, DS, and MED, among other State entities, support the U.S. Embassy in Havana by providing advice and guidance on policy, security, and other issues. WHA. Reporting to the Under Secretary of State for Political Affairs, WHA oversees the U.S. Embassy in Havana and is responsible for managing and promoting U.S. interests in the region. Embassy officials, including senior leadership, report to WHA and its Office of the Coordinator for Cuban Affairs through diplomatic cables, email, and phone calls. DS. Reporting to the Under Secretary of State for Management, DS oversees security at diplomatic posts and is responsible for providing a safe and secure environment for the conduct of U.S. foreign policy. Embassy Regional Security Officers are required to report security incidents through different systems, including diplomatic cables, SPOT Reports, or the Security Incident Management Analysis System, depending on the type of incident. Regional Security Officers are also in regular contact with DS via phone and email, according to State officials. MED. Reporting to the Under Secretary of State for Management, MED ensures that U.S. government employees and their families who are assigned to diplomatic posts have access to healthcare and advises State management about health issues around the world. The U.S. Embassy in Havana has a medical unit, including U.S. direct-hire and locally hired staff. MED approves requests to medically evacuate U.S. personnel and family members from diplomatic posts. Other State entities. Other State entities provide support to the U.S. embassy in Havana on specific issues. For example, CMS, within State’s Executive Secretariat, gathers, assesses, and disseminates information to State senior management about events that threaten the security of U.S. missions and their personnel. The Office of Foreign Missions, which reports to the Under Secretary of State for Management, seeks fair treatment for U.S. personnel abroad while ensuring that foreign diplomats based in the United States receive the same treatment that their respective governments provide to U.S. personnel abroad in return. Although M/PRI is responsible for initiating and leading State’s ARB incident vetting process, State’s ARB policy does not define how M/PRI should become aware of incidents that may involve injury, loss of life, or destruction of property. Regarding Cuba, the U.S. embassy and several State entities responded to incidents that were later associated with various injuries in early 2017. As of June 2018, State officials remained uncertain of the cause or perpetrator of the incidents and injuries. M/PRI officials said they did not know about the incidents in Cuba until August 2017, when the media began to report on the incidents. Although M/PRI is responsible for initiating and leading the ARB incident vetting process, State’s polices do not define responsibilities for internal communication to M/PRI of incidents that may involve injury, loss of life, or destruction of property. According to the FAM, M/PRI and the Permanent Coordinating Committee are responsible for evaluating whether incidents meet the ARB statute criteria. However, M/PRI can only initiate the process after it is made aware of potentially qualifying incidents, and the FAM does not outline how M/PRI should be notified of these types of incidents or which, if any, State entities are responsible for notifying M/PRI. In contrast, the FAM outlines other specific reporting responsibilities for Regional Security Officers. According to State officials and our analysis, State’s FAM and Foreign Affairs Handbooks do not establish a policy, procedure, or process for internal communication of such incidents to M/PRI. In 2006, the Under Secretary of State for Management issued a cable requiring U.S. diplomatic posts to report potential ARB incidents directly to M/PRI. However, the cable did not identify who at post was responsible for reporting, and instructed posts to report to an individual who is no longer in M/PRI. Moreover, State officials we met with were unaware of the cable. M/PRI officials said that information about potentially qualifying incidents is not directed to them through State’s established reporting mechanisms, such as diplomatic cables. State’s cable system does not have a caption, channel, or tag that would direct information to M/PRI about incidents that may involve injury, loss of life, or damage to property. State’s Office of the Inspector General previously found deficiencies in State’s internal communication of incidents that may meet ARB criteria. Despite the 2006 cable on potential ARB incident reporting, in 2013, State’s Inspector General found that State had no systematic process ensuring immediate notification of security-related incidents to M/PRI, and that DS did not routinely provide security reports to M/PRI. The Inspector General made an informal recommendation that DS should include M/PRI as an addressee on all security-related incident reports. In 2015, the Inspector General noted that DS, in response to the recommendation, said that such a blanket inclusion of M/PRI on all security-related incident reports would result in M/PRI being inundated with a large number of irrelevant reports. Because State has no policy that ensures M/PRI becomes aware of incidents that may involve injury, loss of life, or destruction of property, M/PRI officials said they typically become aware of potentially qualifying incidents—such as explosions at diplomatic facilities—when such incidents are discussed internally and widely publicized. M/PRI officials also told us they occasionally became aware of potentially qualifying incidents through informal communication, such as during senior staff meetings with the Under Secretary of State for Management. If M/PRI officials are not aware of incidents, they cannot initiate State’s ARB incident vetting process. This situation puts State at risk of not meeting statutory time frames for convening an ARB and could result in State being unable to improve security programs and practices at other U.S. diplomatic posts, which could affect the response to similar incidents elsewhere. Standards for Internal Control in the Federal Government call for internal communication to achieve the entity’s objectives and note that management should document responsibilities through policy. The FAM requires internal controls, which includes as an objective that programs are efficiently and effectively carried out in accordance with applicable law and management policy. The FAM also states that the Under Secretary of State for Management is responsible for, among other things, developing and executing management policies; the organization, operations, and assignment of functions within State; and directing and administering worldwide information resources. In January 2017, U.S. embassy and State officials began responding to incidents in Cuba that were later associated with various injuries. In June 2018, the Secretary of State noted that the precise nature of the injuries and the cause had not yet been established. According to congressional testimony by State officials, in late 2016, U.S. personnel in Havana first reported incidents, typically involving sounds and resulting in various medical symptoms, to the embassy’s Regional Security Officer and Chief of Mission. Embassy officials reported the incidents to DS and the National Security Council as a new type of harassment in early January 2017, according to State documents. The embassy’s Medical Officer first evaluated a U.S. official related to the incidents on December 30, 2016, and others in January 2017. Starting in late March 2017, the embassy held several meetings with U.S. personnel to share the limited information it had about the incidents, according to State officials. In April 2017, the embassy held Emergency Action Committee meetings regarding the incidents. CMS communicated with State senior management about the incidents beginning in April 2017. To ensure that State senior management were aware of how the embassy was responding, CMS distributed among various State entities, including M/PRI, one of the embassy’s April 2017 diplomatic cables reporting on an Emergency Action Committee meeting. According to CMS officials, the cable that CMS distributed was unclear about what incidents had occurred and did not include detailed information about the incidents or associated injuries. According to M/PRI officials, M/PRI was on CMS’s distribution list because M/PRI was responsible for monitoring the implementation of a previous ARB recommendation that called for State to review embassy risk management decisions. According to a former M/PRI official, M/PRI did not review these CMS communications for other purposes, including to identify incidents that may meet ARB statute criteria. In addition, in April and May 2017, CMS included multiple cables on the situation in Cuba in its daily Safety Overseas Summary for State senior management. In response to the incidents, U.S. embassy and WHA officials met with Cuban officials to emphasize to the Cuban government its responsibilities to ensure the safety of foreign diplomats in Cuba, according to testimony by State officials. In mid-February 2017, U.S. officials met with Cuban officials in Havana and Washington, D.C., about the incidents, citing the Vienna Convention requirements to provide for the safety and security of diplomats, according to State officials. Following additional incidents reported in March and April 2017, U.S. officials met again with Cuban officials in Havana and Washington, D.C. In May 2017, State expelled two Cuban diplomats from the United States to underscore the Cuban government’s responsibility to protect U.S. personnel in Cuba, according to testimony by State officials. In September 2017, State ordered the departure from Cuba of non-emergency U.S. embassy personnel and, in October, expelled 15 Cuban diplomats from Washington, D.C. to underscore to Cuba its obligations to protect U.S. personnel, according to testimony by State officials. According to State officials, by May 2017, the embassy, WHA, DS, and MED were aware of 16 U.S. personnel and family members in Havana who had been injured, although unable to determine the cause. In January 2018, State’s Medical Director testified to Congress that by May 1, 2017, State had determined that several of those individuals had serious injuries. Between February and May 2017, a specialist at the University of Miami evaluated 80 members of the embassy community. MED arranged for the medical evacuations of about 40 U.S. personnel from Cuba to Miami, Florida, for evaluations with the specialist, and the specialist subsequently conducted additional evaluations at the embassy in Havana. According to State testimony to Congress, the specialist identified 16 individuals who had symptoms and medically verifiable clinical findings similar to mild traumatic brain injury. In June 2018, the Secretary of State noted that the precise nature of the injuries and the cause had not yet been established. M/PRI officials said they became aware of the incidents in Cuba after media reports in August 2017. According to M/PRI officials, a State official—who previously worked in M/PRI—contacted M/PRI in early August after seeing media reports to inquire whether they were aware of the incidents in Cuba. Although several State entities were aware of the incidents, WHA, DS, and MED did not report the incidents to M/PRI and it was unclear whether the incidents met the criteria for convening an ARB, according to officials. However, our analysis shows that State’s policies do not instruct State entities to evaluate whether incidents meet the ARB criteria before reporting such incidents to M/PRI. Instead, State’s FAM requires M/PRI to lead the process for evaluating incidents that may involve injury, loss of life, or destruction of property. According to the FAM, M/PRI will call a Permanent Coordinating Committee meeting if the ARB statute criteria apply or if the applicability is questionable. The committee will, as quickly as possible after an incident occurs, review the available facts and recommend to the Secretary whether to convene an ARB. M/PRI initiated State’s incident vetting process in August 2017, as shown in figure 2 below. As a result of the incidents in Cuba, M/PRI officials told us they realized that they may not be aware of all incidents that may involve injury to U.S. diplomats. In an initial attempt to address this concern, M/PRI officials said they requested that CMS add M/PRI officials to the distribution list for the Safety Overseas Summary to try to increase M/PRI’s awareness of potential incidents. CMS told us that it added M/PRI officials to the distribution list in October 2017. According to M/PRI officials and a timeline provided by M/PRI, once these officials became aware of the incidents in August 2017, the office began the ARB incident vetting process, as described in the FAM. In August 2017, these officials initially consulted with DS and MED about the incidents. In further discussion with Legal, the officials determined that they did not have sufficient information to determine whether the incidents met the ARB statute criteria. Given the uncertainties surrounding the incidents, in mid-September 2017, they decided to call a meeting of the Permanent Coordinating Committee, which included representatives from M/PRI, WHA, DS, MED, Legal, the Bureau of Intelligence and Research, the Bureau of Counterterrorism, and the Intelligence Community. The committee initially met on September 28, 2017, to review the available facts against the ARB statute criteria, and concluded that it needed additional time to determine whether the ARB statute criteria had been met. On November 28, 2017, the committee met again and recommended to the Secretary of State that an ARB be convened. The Secretary of State concurred with the recommendation on December 11, 2017, and convened the ARB on January 12, 2018. The ARB officially began its work in early February 2018. An ARB is intended to result in improved security programs and practices at U.S. missions abroad. While State has directed M/PRI to initiate the incident vetting process—including convening the Permanent Coordinating Committee to evaluate the facts—State’s policies do not define responsibilities for internal communication to M/PRI of incidents that may involve injury, loss of life, or destruction of property at U.S. missions abroad. Although M/PRI officials may receive information through informal channels, this approach does not ensure that M/PRI will be made aware of relevant incidents. With regard to the incidents in Cuba, M/PRI could not begin the incident vetting process for determining whether the ARB statute criteria had been met until it became aware of them in August 2017. When M/PRI is not aware of incidents that may meet the ARB statute criteria, it cannot initiate the incident vetting process for convening ARBs. Until State establishes policies that ensure the appropriate office is promptly aware of potentially relevant incidents—for example, policies that identify formal internal communication procedures and document responsibilities for such communication—State is at risk of failing to comply with the ARB statute. Improving its security programs at U.S. diplomatic posts is all the more imperative given recent reports of similar incidents, such as in Guangzhou, China. To ensure that State’s process allows it to initiate its ARB incident vetting process in a timely manner, the Secretary of State should revise State’s policies to define responsibilities for internal communication to M/PRI of incidents that may involve injury, loss of life, or destruction of property at, or related to, U.S. missions abroad. (Recommendation 1) We provided a draft of this report to State. In its written comments, State concurred with our recommendation. State said it will improve its processes for ensuring effective internal communication. We have reprinted State’s comments in their entirety in appendix I. State also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees and the Secretary of State. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you and your staff have any questions about this report, please contact me at (202) 512-5130 or mazanecb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact named above, Judith McCloskey (Assistant Director), Ashley Alley, Debbie Chung, Thomas Costa, Marcia Crosse, Neil Doherty, Justin Fisher, Christopher Hayes, Brandon Hunt, Joseph Kirschbaum, and George Ogilvie made key contributions to this report.

Summary: U.S. diplomats and their families in Havana, Cuba, were affected by incidents that were associated with injuries, including hearing loss and brain damage. Over State has reported that over 20 U.S. diplomats and family members in Havana have suffered from medical conditions believed to be connected to the incidents, which began in late 2016 and have continued into 2017. By law, State is generally required to convene an ARB within 1260 days of incidents that result in serious injury at, or related to, a U.S. mission abroad, but the Secretary of State can determine that a 60 day extension is necessary. According to State's policy, M/PRI is responsible for initiating and leading State's ARB incident vetting process. This report is part of a broader request to review State's response to the incidents in Cuba. In this report, GAO examines the extent to which State's ARB policy ensures that M/PRI is made aware of incidents that may meet the ARB statute criteria. GAO analyzed relevant federal laws, State policies, and other State documents. GAO also interviewed cognizant State officials. The Department of State's (State) Accountability Review Board (ARB) policy does not ensure that the responsible office—State's Office of Management Policy, Rightsizing, and Innovation (M/PRI)—is made aware of incidents that may meet the ARB statute criteria, such as those that occurred in Cuba and were associated with injuries to U.S. personnel. According to State policy, as soon as M/PRI becomes aware of potentially qualifying incidents, M/PRI will start the process for considering whether the incident warrants an ARB. M/PRI relies on informal communication to identify potentially qualifying incidents to begin the vetting process because State does not have a policy, procedure, or process for internal communication of such incidents to M/PRI, according to State officials and GAO analysis. As illustrated in the figure below, other State entities began responding to the incidents in early 2017, but M/PRI was not made aware of the incidents until mid-August 2017, when a former M/PRI official contacted the office after seeing media reports. If M/PRI is not aware of incidents, it cannot initiate State's ARB incident vetting process. This situation puts State at risk of not meeting statutory time frames for convening an ARB and could result in State being less able to improve security programs and practices at other U.S. diplomatic posts. Standards for Internal Control in the Federal Government call for internal communication to achieve the entity's objectives and note that management should document responsibilities through policy. GAO recommends that State revise its policies to define responsibilities for internal communication to M/PRI of relevant incidents. State concurred with GAO’s recommendation.