Although State has not yet formally defined what constitutes a soft target, State Department travel warnings and security officers generally consider soft targets to be places where Americans and other westerners live, congregate, shop, or visit, such as hotels, clubs, restaurants, shopping centers, housing compounds, places of worship, schools, or public recreation events. Travel routes of U.S. government employees are also considered soft targets, based on their history of terrorist attacks. The State Department is responsible for protecting more than 60,000 government employees, and their family members, who work in embassies and consulates abroad in 180 countries. Although the host nation is responsible for providing protection to diplomatic personnel and missions under the 1961 Vienna Convention, State has a variety of programs and activities to further protect U.S. officials and family members both inside and outside of the embassy. Following a terrorist attack that involves serious injury or loss of life or significant destruction of a U.S. government mission, State is required to convene an Accountability Review Board (ARB). ARBs investigate the attack and issue a report with recommendations to improve security programs and practices. State is required to report to Congress on actions it has taken in response to ARB recommendations. As of March 2005, there have been 11 ARBs convened since the board’s establishment in 1986. Concerned that State was not providing adequate security for U.S. officials and their families outside the embassy, the American Foreign Service Association testified on a number of occasions before the Senate Appropriations Subcommittee on Commerce, Justice, State and the Judiciary on the need for State to expand its security measures. The subcommittee, in its 2002 and subsequent reports, urged State to formulate a strategy for addressing threats to locales abroad that are frequented by U.S. officials and their families. It focused its concern about soft targets on schools, residences, places of worship, and other popular gathering places. In fiscal years 2003, 2004, and 2005, Congress earmarked a total of $15 million for soft target protection each year, particularly to address security vulnerabilities at overseas schools. Moreover, in 2005, the Senate appropriations report directed State to develop a comprehensive strategy for addressing the threats posed to soft targets no later than June 1, 2005. State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. official and their families. State officials cited several complex issues involved with protecting soft targets. As the terrorist threat grows, State is being asked to provide ever greater levels of protection to more people in more dangerous locations, and they questioned how far State’s protection of soft targets should extend. They said that providing U.S. government funds to protect U.S. officials and their families at private sector locations or places of worship was unprecedented and raised a number of legal and financial challenges—including sovereignty and separation of church and state— that have not been resolved by the department. State officials also indicated they have not yet fully defined the universe of soft targets— including taking an inventory of potentially vulnerable facilities and areas where U.S. officials and their families congregate—that would be necessary to complete a strategy. Although State has not developed a comprehensive soft target strategy, some State officials told us that several existing programs could help protect soft targets. However, they agreed that these existing programs are not tied together in an overall strategy. State officials agreed that they should undertake a formal evaluation of how existing programs can be more effectively integrated as part of a soft target strategy, and whether new programs might be needed to fill any potential gaps. A senior official with State’s Bureau of Diplomatic Security (DS) told us that in January 2005, DS formed a working group to develop a comprehensive soft targets strategy to address the appropriate level of protection of U.S. officials and their families at schools, residences, and other areas outside the embassy. According to State, the strategy should be completed by June 1, 2005. To identify vulnerabilities in State’s soft target protection, and determine if State had corrected these vulnerabilities, we reviewed the ARB reports conducted after U.S. officials were assassinated outside the embassy. Of the 11 ARBs conducted since 1986, the majority (5) have focused on soft target attacks, compared with attacks against embassies (2) or other U.S. facilities (4). We found that, 17 years after the first soft target ARB, State has still not addressed the vulnerabilities and recommendations identified in that and more recent reports: specifically, the need for hands-on counterterrorism training and accountability mechanisms to promote compliance with personal security procedures. Despite State’s assurances to Congress that it would implement recommendations aimed at reducing these vulnerabilities, we found that State’s hands-on training course is still not mandatory, and procedures to monitor compliance with security requirements have not been fully implemented. We also found that ambassadors, deputy chiefs of mission, and regional security officers were not trained in how to implement embassy procedures intended to protect U.S. officials outside the embassies. Since 1988, State has reported to Congress that it agreed with ARB recommendations to provide counterterrorism training. For example, in 1995, State reported that it “re-established the Diplomatic Security Antiterrorism Course (DSAC) for those going to critical-threat posts to teach surveillance detection and avoidance, and defensive and evasive driving techniques.” In 2003, State reported it agreed with the recommendations that employees from all agencies should receive security briefings and indicated that it would review the adequacy of its training and other personal security measures. Although State implemented the board’s recommendation to require security briefings for all staff, hands-on counterterrorism training is still not mandatory, and few officials or family members have taken DSAC. Senior DS officials said they recognize that security briefings are no longer adequate to protect against current terrorist threats. In June 2004, DS developed a proposal to make DSAC training mandatory. DS officials said that DSAC training should be required for all officials, but that issues such as costs and adequacy of training facilities were constraining factors. As of April 18, 2005, the proposal had not been approved. Although State has agreed on the need to implement an accountability system to promote compliance with personal security procedures since 1988, there is still no such system in place. Beginning in 2003, State has tried to incorporate some limited accountability to promote compliance. However, based on our work at five posts, we found that post officials are following few, if any, of these new procedures. In response to a 2003 ARB, State took a number of steps to improve compliance with State’s personal security procedures for officials outside the embassy. In June 2003, State revised its annual assessment criteria to take personal security into account when preparing performance appraisals, and in December 2003, State revised its Foreign Affairs Manual to mandate and improve implementation of personal security practices. In May 2004, State notified posts worldwide on use of a Personal Security Self-Assessment Checklist to improve security outside the embassy. However, none of the posts we visited were even aware of these and other key policy changes. For example, none of the officials we met with, including ambassadors, deputy chiefs of mission, regional security officers, or staff, were aware that the annual ratings process now includes an assessment of whether staff are following the personal security measures or that managers are now responsible for the reasonable oversight of subordinates’ personal security activities. Furthermore, none of the supervisors were aware of the checklist, and we found no one was using the checklists to improve their personal security practices. In explaining why posts were not aware of the new personal security regulations, DS officials noted that posts were often overwhelmed by work and may have simply missed the cables and changes in the Foreign Affairs Manual. They also noted that changes like this take time to be implemented globally. Furthermore, State’s original plan, to use the checklist as an accountability mechanism, was dropped before it was implemented. In its June 2003 report to Congress on implementation of the 2003 ARB recommendations, State stipulated that staff would be required to use the checklist periodically and that managers would review the checklists to ensure compliance. However, State never implemented this accountability mechanism out of concern it would consume too much staff time. We also found that key officials receive no training on how to promote personal security outside the embassy. According to a number of State officials, improvements in this area must start with the ambassador and the deputy chief of mission. Yet no ambassadors, deputy chiefs of mission, or regional security officers receive any training in how to maximize soft target protection at embassies. DS officials agreed that this critical component should be added to their training curriculum. In response to several congressional committee reports, State began developing a “Soft Targets” program in 2003 to help protect overseas schools against terrorism. The program has four proposed phases. The first two phases are focused on department-sponsored schools that have previously received grant funding from the State Department, and the third and fourth phases focus on the nondepartment-sponsored schools with American students. In phase one, department-sponsored schools were offered funding for basic security hardware such as shatter-resistant window film, two-way radios for communication between the school and the embassy, and public address systems. As of November 19, 2004, 189 department-sponsored schools had received $10.5 million in funding for security equipment in phase one of the program. The second phase provided additional security enhancements, such as perimeter fencing, walls, lighting, gates, and guard booths. As of November 2004, State has obligated over $15 million for phase two security upgrades. For phases three and four, State plans to provide similar types of security upgrades to eligible nondepartment- sponsored schools.