Federal law enforcement agencies and state coordinators in our survey— as well as officials we interviewed from federal, state, and local law enforcement agencies—reported various uses of DOD excess controlled property for law enforcement activities. The reported uses included enhancing counterdrug, counterterrorism, and border-security activities. Also, law enforcement agencies reported using DOD’s excess controlled property for other law enforcement activities, such as search and rescue, natural disaster response, surveillance, reaching barricaded suspects, police training, and the serving of warrants. Federal, state, and local agencies cited a number of ways in which they had benefited from LESO program, with several reporting that the transfers of controlled property allowed them to save money. For example, a local law enforcement official in Texas reported that 96 percent of the department budget goes to salaries and that the LESO program helped the department acquire items that it would otherwise not be able to afford, saving the department an estimated $2 million to $3 million. Additionally, agencies provided examples of how property they received through the LESO program have been used. For example, the Bureau of Indian Affairs officials reported they have used vehicles to support their Office of Justice Services’ drug unit during marijuana eradication and border operations by providing transport to agents over inhospitable terrain in mountainous and desert environments. In another example, Texas law enforcement officials reported that the San Marcos and Hays County police departments used their issued Mine Resistant Ambush Protected (MRAP) vehicles to rescue more than 600 stranded people from floodwaters in October 2015. Moreover, the Los Angeles County Sheriff’s Department reported that it used a robot to remove a rifle from an attempted murder suspect who had barricaded himself. DLA has taken some steps to address previously identified weaknesses in its processes for transferring and monitoring its excess controlled property through revisions to its policy and procedures on the management, oversight, and accountability of the LESO program. Such revisions were made, in part, because of recommendations made by the DOD and DLA Offices of Inspector General. The DOD and DLA Offices of Inspector General conducted four audits of the LESO program between 2003 and 2013 that identified more than a dozen recommendations, such as developing and implementing written standard operating procedures for the approval and disapproval of law enforcement agency property requests and issuance, transfer, turn-in and disposal of LESO property. In our July 2017 report, we found the department had taken the following actions to enhance its transfer process through revisions to policy and procedures: transitioned full management responsibility of the LESO Program to DLA Disposition Services in 2009; developed LESO Program Standard Operating Procedures in 2012 and updated them in 2013; transitioned to a new data system in 2013 after identifying that the old system was not capable of post-issue tracking;revised the DLA instruction that provides policy, responsibility, and procedures for DLA’s management responsibilities of the LESO program in 2014 and 2016; and revised LESO program processes in 2016 to incorporate recommendations made by the Federal Interagency Law Enforcement Equipment Working Group, such as defining executive order controlled property or prohibiting schools K-12 from participating in the program. In addition, DLA is in the process of developing additional training on LESO program policies and procedures, and is establishing memorandums of understanding with federal law enforcement agencies on the general terms and conditions of participating in the program, including the restrictions on the transfer and sale of controlled property. We found weaknesses in three areas: (1) verifying and approving applications, (2) transferring property, and (3) the assessment of risk. First, our independent testing of the LESO program’s internal controls identified deficiencies in the processes for verification and approval of federal law enforcement agency applications. Specifically, our investigators posing as authorized federal law enforcement officials of a fictitious agency applied and were granted access to the LESO program in early 2017. In late 2016, we emailed our completed application to the LESO program office. Our application contained fictitious information including agency name, number of employees, point of contact, and physical location. In early 2017, after revising our application at the direction of LESO officials we were notified that our fictitious law enforcement agency was approved to participate in the LESO program. LESO officials also emailed us to request confirmation of our agency’s authorizing statute; in response, our investigators submitted fictitious authorizing provisions as provisions in the U.S. Code. At no point during the application process did LESO officials verbally contact officials at the agency we created—either the main point of contact listed on the application or the designated point of contact at a headquarters’ level—to verify the legitimacy of our application or to discuss establishing a memorandum of understanding with our agency. DLA’s internal controls for verifying and approving federal agency applications and enrollment in the LESO program were not adequate to prevent the approval of a fraudulent application to obtain excess controlled property. Specifically, LESO’s reliance on electronic communications without actual verification does not allow it to properly vet for potentially fraudulent activity. For example, DLA did not require supervisory approval for all federal agency applications, or require confirmation of the application with designated points of contact at the headquarters of participating federal agencies. Additionally, at the time we submitted our application, DLA officials did not visit the location of the applying federal law enforcement agency to help verify the legitimacy of the application. After our briefing of DLA officials in March 2017 on the results of our investigative work, DLA officials stated they took immediate action, and in April 2017 visited 13 participating federal law enforcement agencies. However, at this time DLA has not reviewed and revised the policy or procedures for verifying and approving federal agency applications and enrollment in the LESO program. Second, our independent testing also identified deficiencies in the transfer of controlled property, such as DLA personnel not routinely requesting and verifying identification of individuals picking up controlled property or verifying the quantity of approved items prior to transfer. Our investigators, after being approved to participate in the LESO program, obtained access to the department’s online systems to view and request controlled property. We subsequently submitted requests to obtain controlled property, including non-lethal items and potentially-lethal items if modified with commercially available items. In less than a week after submitting the requests, our fictitious agency was approved for the transfer of over 100 controlled property items with a total estimated value of about $1.2 million. The estimated value of each item ranged from $277 to over $600,000, including items such as night-vision goggles, reflex (also known as reflector) sights, infrared illuminators, simulated pipe bombs, and simulated rifles. Our investigator scheduled appointments and obtained the controlled property items, such as those shown in the photos below. Using fictitious identification and law enforcement credentials, along with the LESO-approved documentation, our investigator was able to pass security checks and enter the DLA Disposition Service warehouse sites. Personnel at two of the three sites did not request or check for valid identification of our investigator picking up the property. According to DLA guidance, direct pickup of allocated property may be made by an individual with valid identification and the appropriate DOD authorization form that is signed by the authorized individual listed in the letter. DLA has not taken steps to reasonably ensure that onsite officials routinely request and verify valid identification of the individual(s) authorized to pick up allocated property from the LESO program, as required by the guidance. DLA officials acknowledged they could take additional steps to ensure compliance with the requirements in the handbook. Furthermore, although we were approved to receive over 100 items and the transfer documentation reflects this amount, we were provided more items than we were approved to receive. The discrepancy involved one type of item—infrared illuminators. We requested 48 infrared illuminators but onsite officials at one Disposition Services site provided us with 51 infrared illuminators in 52 pouches, of which one pouch was empty. Additionally, we found that one DLA Disposition Services site had a checklist as a part of their transfer documentation for their personnel to complete. The checklist required manual completion of several items, including quantity, date, and who fulfilled the order. The other two DLA Disposition Services sites, including the site that transferred the wrong quantity, did not include this checklist with the transfer documentation we received. DLA guidance states that accountability records be maintained in auditable condition to allow property to be traced from receipt to final disposition. We concluded that without guidance that specifically requires DLA Disposition Services’ on-site officials to verify the type and quantity of approved items against the actual items being transferred prior to removal from the sites, DLA will lack reasonable assurance that the approved items transferred are appropriately reflected in their inventory records. Third, while DLA has taken some steps, mostly in early 2017, to address identified deficiencies in the LESO program, DLA lacks a comprehensive framework for instituting fraud prevention and mitigation measures. During the course of our review, DLA revised the LESO program applications by requiring applicants to sign an attestation that the agency that they represent is a legitimate law enforcement agency. Further, DLA officials stated they are more carefully reviewing the legitimacy of some information on the application such as email addresses and physically visiting federal agencies that enter into memorandums of understanding with the LESO program. However, as previously discussed, we identified internal controls weakness in the policy and procedures for verifying and approving federal agency applications and enrollment as well as weakness throughout the process from approval to the actual transfer of the items to the agencies, which indicates that DLA has not examined potential risks for all stages of the process. According to GAO’s Fraud Risk Framework, effective fraud risk managers collect and analyze data on identified fraud schemes, use these lessons learned to improve fraud risk management activities, and plan and conduct fraud risk assessments that are tailored to their programs. The framework states there is no universally accepted approach for conducting fraud risk assessments since circumstances among programs vary. However, per leading practices, assessing fraud risks generally involves five actions: (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and effect of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the program’s fraud risk profile. DLA has begun to examine some fraud risks associated with the LESO program. However, DLA officials acknowledged during our March 2017 meeting that they have not conducted a fraud risk assessment on the LESO program to include the application process, and as such, has not designed or implemented a strategy with specific control activities to mitigate risks to the program. We concluded that conducting such an assessment could have program-wide improvements, including strengthening the controls to verify the legitimacy of applicants. Overall, we concluded in our July 2017 report that DLA’s internal controls did not provide reasonable assurance in preventing fraud. Therefore, we made four recommendations for DLA to: review and revise policy or procedures for verifying and approving federal agency applications and enrollment; ensure compliance that DLA Disposition Services on-site officials transferring controlled property verify that persons picking up items have valid identification and are authorized to pick up allocated property from the LESO program; issue guidance that requires DLA Disposition Services on-site officials to verify the type and quantity of approved items against the actual items being transferred prior to removal from the sites; and conduct a fraud risk assessment to design and implement a strategy with specific internal control activities to mitigate assessed fraud risks. DOD concurred with all of our recommendations and highlighted actions to address each one. Chairman Wilson, Ranking Member Bordallo, and Members of the Subcommittee, this concludes our prepared statement. My colleague, Mr. McElrath, and I would be pleased to respond to any questions that you may have at this time. For questions about this statement, please contact Zina D. Merritt at (202) 512-5257 or merrittz@gao.gov or Wayne A. McElrath at (202) 512-2905 or mcelrathw@gao.gov. In addition, individuals making significant contributions to this statement include: Marilyn Wasleski, Assistant Director; Laura Czohara, Martin de Alteriis, Barbara Lewis, Felicia Lopez, Maria McMullen, George Ogilvie, Richard Powelson, and Samuel Woo. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony summarizes the information contained in GAO's July 2017 report, entitled DOD Excess Property: Enhanced Controls Needed for Access to Excess Controlled Property ( GAO-17-532 ). merrittz@gao.gov or Wayne A. McElrath at (202) 512-2905 or mcelrathw@gao.gov . The Defense Logistics Agency (DLA) has taken some actions and is planning additional actions to address identified weaknesses in its excess controlled property program. However, internal control deficiencies exist for, among other things, ensuring that only eligible applicants are approved to participate in the Law Enforcement Support Office (LESO) program and receive transfers of excess controlled property. DLA is establishing memorandums of understanding with participating federal agencies intended to, among other things, establish general terms and conditions for participation, revise its program application to require additional prospective participant information, and plans to provide additional online training for participating agencies that is expected to begin in late 2017. However, GAO created a fictitious federal agency to conduct independent testing of the LESO program's internal controls and DLA's transfer of controlled property to law enforcement agencies. Through the testing, GAO gained access to the LESO program and obtained over 100 controlled items with an estimated value of $1.2 million, including night-vision goggles, simulated rifles, and simulated pipe bombs, which could be potentially lethal items if modified with commercially available items . GAO's testing identified that DLA has deficiencies in the processes for verification and approval of federal law enforcement agency applications and in the transfer of controlled property, such as DLA personnel not routinely requesting and verifying identification of individuals picking up controlled property or verifying the quantity of approved items prior to transfer. Further, GAO found that DLA has not conducted a fraud risk assessment on the LESO program, including the application process. Without strengthening DLA and LESO program internal controls over the approval and transfer of controlled property to law enforcement agencies, such as reviewing and revising policy or procedures for verifying and approving federal agency applications and enrollment, DLA lacks reasonable assurance that it has the ability to prevent, detect, and respond to potential fraud and minimize associated security risks. Examples of Controlled Property Items Obtained DLA maintains a public Internet site to address statutory requirements to provide information on all property transfers to law enforcement agencies. DLA's public Internet site shows all transferred property, and, as of April 2017, in response to GAO's findings, has included a definition of controlled property to distinguish for the general public what items are considered controlled.