Private security contractors are defined as private companies, or personnel, that provide physical security for persons, places, buildings, facilities, supplies, or means of transportation. These contractors provide security services for a variety of U.S. government agencies in Iraq; however, they are principally hired by DOD and State. DOD private security services contracts include a contract to provide security for DOD— controlled facilities in Iraq, known as the Theater Wide Internal Security Services contract. According to DOD officials, four contractors employing more than 8,000 guards, supervisors, and operations personnel are performing task orders issued under their contracts. The State Department’s private security services contracts include a contract to provide security and support, known as the Worldwide Personal Protective Services contract, a contract to provide security for the U.S. Embassy Baghdad, and a security contract managed by State’s Bureau of International Narcotics and Law Enforcement Affairs. In August 2004, the President issued HSPD-12 to require that United States government agencies (including DOD and State) collaborate to develop a federal standard for secure and reliable forms of identification for all U.S. government employees and contractors needing regular physical access to federal facilities. In February 2005, to comply with HSPD-12, the Department of Commerce’s National Institute of Standards and Technology issued implementing guidance; the Federal Information Processing Standards 201-1, which define a governmentwide personal identification verification system. HSPD-12 requires that all U.S. government agencies mandate the use of the standard identification credential for all employees and contractors—U.S. citizens and foreign nationals alike—who need regular physical access to federal facilities, including U.S. military installations abroad. As part of this process, all U.S. government employees and contractors who are issued an approved credential are to undergo a National Agency Check with Written Inquiries (NACI), or, at minimum, an FBI National Criminal History Check (a fingerprint check against a FBI database). We have previously reported on the challenges associated with applying a similar process to foreign nationals, including the limited applicability of U.S.-based databases of the names of criminals to foreign nationals. Federal Information Processing Standard 201-1 applies to foreign nationals working for the U.S. government overseas and requires a process for registration and approval using a State Bureau of Diplomatic Security approved method, except in the case of employees under the command of a U.S. area military commander. However, the standards do not offer any guidance as to what process should be used overseas. In addition to the HSPD-12 requirements, DOD and State have been instructed to comply with other requirements intended to protect the safety of property and personnel. For example, DOD policy makes military commanders responsible for enforcing security measures intended to ensure that property and personnel are protected. Likewise, the Omnibus Diplomatic Security and Antiterrorism Act of 1986 requires the Secretary of State to develop and implement policies and programs, including funding levels and standards, to provide for the security of U.S. government diplomatic operations abroad. Section 862 of the FY2008 NDAA requires that the Secretary of Defense, in coordination with the Secretary of State, prescribe regulations on the selection, training, equipping, and conduct of personnel performing private security functions under a covered contract in an area of combat operations. Section 862 of the FY2008 NDAA states that the regulations shall, at a minimum, establish processes to be used in an area of combat operations for the following: registering, processing, accounting for, and keeping appropriate records of personnel performing private security functions; authorizing and accounting for weapons to be carried by, or available to be used by, personnel performing private security; and registration and identification of armored vehicles, helicopters, and other military vehicles operated by contractors performing private security functions. In addition, the regulations shall establish requirements for qualification, training, screening (including, if practicable, through background checks), and security for personnel performing private security functions in an area of combat operations. Section 862 of the FY2008 NDAA also states that the regulations must establish a process by which to report the following incidents: (1) a weapon is discharged by personnel performing private security functions in an area of combat operations; (2) personnel performing private security functions in an area of combat operations are killed or injured; (3) persons are killed or injured, or property is destroyed, as a result of conduct by contractor personnel; (4) a weapon is discharged against personnel performing private security functions in an area of combat operations; or (5) active, non-lethal countermeasures are employed by the personnel performing private security functions in an area of combat operations in response to a perceived immediate threat to these personnel. In addition, the regulations must establish a process for the independent review and, if practicable, investigation of these incidents and incidents of alleged misconduct by personnel performing private security functions in an area of combat operations. The regulations are also to include guidance to the combatant commanders on the issuance of (1) orders, directives, and instructions to private security contractors regarding, for example, security and equipment; (2) predeployment training requirements; and (3) rules on the use of force. Fragmentary orders also establish guidance and requirements governing private security contractors in Iraq. In December 2007, MNF-I issued Fragmentary Order 07-428 to consolidate what previously had been between 40 and 50 separate fragmentary orders relating to regulations applicable to private security contractors in Iraq. The fragmentary order establishes authorities, responsibilities and coordination requirements for MNC-I to provide oversight for all armed DOD contractors and civilians in Iraq including private security contractors. In March 2009, MNF-I superseded this order by issuing Fragmentary Order 09-109. This Fragmentary Order contains information related to the roles and responsibilities of contract oversight personnel and required contract clauses including clauses related to background screening, training, and weapons accountability. One such clause requires that all contractors working in the Iraq theater of operations shall comply with and shall ensure that their personnel supporting MNF-I forces are familiar with and comply with all applicable orders, directives, and instructions issued by the MNF-I Commander relating to force protection and safety. State has developed a process for conducting background screenings of its private security contractor personnel, U.S. citizens, and foreign and local nationals alike, which, according to State officials, meets the requirements of HSPD-12. Initially, private security contractors submit the resumes of all prospective employees to be reviewed by a State Department contracting officer representative. After this prescreening, the Worldwide Personal Protective Services contract requires firms to screen employees using a screening process approved by State’s Bureau of Diplomatic Security. The process includes examining a prospective employee’s past work history, police records, prior military service, and a credit check. The contractor is responsible for reviewing the results of the initial screening and, based on the results, forwards a list of the candidates to the contracting officer representative. Then, State’s Bureau of Diplomatic Security conducts and adjudicates its own background investigation of prospective employees. All personnel performing work on the contract must possess a security clearance, a determination of eligibility for moderate or high-risk public trust positions, or have had an investigative check conducted by regional security officers of local or foreign nationals equivalent to the public trust determination required for the position. According to State Department officials, the department requires that foreign national private security contractor personnel have a Moderate Risk Public Trust determination, which is equivalent to a Secret clearance, but it does not grant access to classified information. The Moderate Risk Public Trust determination includes checking a prospective contractor employee’s name against both local and national data sources. These data sources include the consular name-check database that is used by U.S. embassies to access information used to approve or deny visa applications. The system contains records provided by numerous U.S. agencies and includes information on persons with visa refusals, immigration violations, criminal histories, and terrorism concerns. In addition, prospective employees are screened by Regional Security Officers in the U.S. embassy in their home countries and if necessary, the Regional Security Officers may interview prospective employees. For example, when State Department officials in Uganda uncovered prospective employees using false documentation, the certificates were not granted to Ugandans until the Regional Security Officer had completed a personal interview. Moreover, in Iraq, prospective Iraqi employees sometimes undergo polygraph examinations. State Department officials told us that this process was HSPD-12-compliant based on their interpretation of an Office of Management and Budget memorandum that states that investigations related to making a public trust determination can be sufficient to meet HSPD-12 requirements. Federal Information Processing Standards 201-1 require that contractor personnel, including private security contractors in Iraq, undergo a National Agency Check with Written Inquiries investigation or its equivalent prior to being issued an access credential. While DOD has established procedures to apply this requirement to private security contractor personnel who are U.S. citizens, it has not, as of June 2009, developed a process and procedures to apply this requirement to foreign and local nationals. According to DOD Instruction 3020.41, the comprehensive policy document on the management of contractors authorized to accompany the Armed Forces, USD-I is responsible for developing and implementing procedures for conducting background screenings of contractor personnel authorized to accompany the U.S. Armed Forces. The instruction, which was issued in October 2005 by the Under Secretary of Defense for Acquisition, Technology, and Logistics (AT&L), also directs USD-I to coordinate with AT&L, to develop these procedures, and to draft appropriate contract clauses. In November 2008, DOD issued a Directive-Type Memorandum to begin the process of bringing DOD policy into alignment with HSPD-12.