Since the 1998 embassy bombings in East Africa, State has constructed more than 100 new diplomatic facilities and enhanced security measures at many others. Increased security at these facilities has raised concerns that would-be attackers may shift their focus to more easily accessible “soft targets”—places frequented by Americans and other Westerners, as well as their transportation routes. According to State, U.S. government employees and their families are most at risk on these transportation routes. Many of the worst attacks on U.S. diplomatic personnel—including 10 of the 19 attacks that prompted State to convene ARBs—occurred while victims were in transit. Among these was the 2004 murder of a U.S. diplomat in Iraq, which led the resulting February 2005 ARB to find that the diplomat’s death was almost certainly caused by his failure to follow the post’s security policy. The February 2005 Iraq ARB report consequently recommended several actions intended to increase post personnel’s compliance with security policy and personal security practices, which are discussed in more detail later in this report. Figure 1 shows the locations of the 10 transportation-related attacks that resulted in the formation of ARBs, and figure 2 depicts an August 2008 attack against the Principal Officer at the U.S. consulate general in Peshawar, Pakistan, shortly after she left her residence. According to State, transportation security overseas is a shared responsibility involving various entities. As established by the 1961 Vienna Convention on Diplomatic Relations, the host nation is responsible for providing protection to diplomatic personnel and missions. In addition, as required by the Omnibus Diplomatic Security and Antiterrorism Act of 1986, the Secretary of State, in consultation with the heads of other federal agencies, is responsible for developing and implementing policies and programs to protect U.S. government personnel on official duty abroad, along with their accompanying dependents. At posts abroad, chiefs of mission are responsible for the protection of personnel and accompanying family members at the mission. Further, as the February 2005 Iraq ARB noted, all mission personnel bear “personal responsibility” for their own and others’ security. Lead operational responsibility for transportation security overseas falls on DS, which is responsible for establishing and operating security and protective procedures at posts. For example, one division within DS manages State’s armored vehicle program, while another manages a contract used to provide transportation security in certain high- and critical-threat locations. DS also evaluates the security situation at each overseas post by assessing five types of threats—political violence, terrorism, crime, and two classified categories—and assigning corresponding threat levels for each threat type in the annually updated Security Environment Threat List. The threat levels are as follows: critical: grave impact on U.S. diplomats; high: serious impact on U.S. diplomats; medium: moderate impact on U.S. diplomats; and low: minor impact on U.S. diplomats. At posts, DS agents known as RSOs, including deputy RSOs and assistant RSOs, are responsible for protecting personnel and property. Among other things, RSOs are responsible for issuing transportation security and travel notification policies, providing security briefings to newly arrived personnel, and communicating information about threats to post personnel. According to State officials, RSOs at certain locations are also responsible for managing the post’s fleet of armored vehicles, while at other locations this responsibility is assumed by the general services office as part of its management of the post’s overall vehicle fleet. State’s policies are outlined in the FAM and corresponding FAH. Sections of the FAM and FAH pertinent to transportation security include various subchapters detailing, among other things elements that all security directives, including transportation-related policies, are required to include; State’s armored vehicle program; and personal security practices for employees to follow. See table 1 for further details on selected FAM and FAH policies that are relevant to transportation security. In addition to these policies, State has produced other guidance documents, such as a checklist that outlines criteria for DS reviewers to use when evaluating posts’ security policies and programs, including those related to transportation security, and cables that reiterate the recommendations of the February 2005 Iraq ARB and the importance of good personal security practices. State uses a variety of means to provide transportation security for U.S. personnel posted overseas. These include, but are not limited to, the following: Armored vehicles. In fiscal years 2011 through 2016, State obligated more than $310 million for armored vehicles, such as sport utility vehicles, vans, and sedans. Security contractors and bodyguards. Through the Worldwide Protective Services contract, DS has hired private security contractors to provide transportation security for diplomatic missions in certain high- and critical-threat areas. State obligated more than $2.7 billion for this contract in fiscal years 2011 through 2016. According to DS officials, DS also uses host nation police, local guard force personnel, U.S. government protective agents, or a combination of all three as bodyguards in more than 100 countries worldwide. State obligated more than $150 million for such bodyguards in fiscal years 2011 through 2016. State has established policies related to transportation security for overseas U.S. personnel, but gaps exist in guidance and monitoring. We reviewed 26 posts and found that each had issued a transportation security policy and a travel notification policy. However, the policies at 22 of the 26 posts were missing elements required by State, due in part to fragmented guidance on what such policies should include. State also lacks a clear armored vehicle policy for overseas posts and effective procedures for monitoring whether posts are assessing their armored vehicle needs at least annually, as required by State. These gaps limit State’s ability to ensure that posts develop policies that are clear and consistent with State requirements and that vehicle needs for secure transit are met. Federal internal control standards state that in order to enable personnel to perform key roles in achieving agency objectives and addressing risks, management should develop policies that outline personnel’s responsibilities in a complete, accurate, and clear manner. DS encourages every post to issue a transportation security policy and a travel notification policy. Because DS requires that these policies be issued as security directives, they are subject to criteria that apply to all security directives. Specifically, the February 2005 Iraq ARB recommended that all security directives include six elements intended to emphasize the personal security responsibilities of all personnel under chief-of-mission authority (see table 2). For example, the ARB report recommended that security directives, among other things, identify the consequences of violations and oblige all members of the mission to report any known or suspected violations. After accepting these recommendations, State promulgated them to all posts through multiple cables as well as the FAM. DS requires all security directives to include the six elements recommended by the February 2005 Iraq ARB. According to DS, transportation security and travel notification policies are required to include additional standard elements so that U.S. personnel and their families are aware of the potential transportation-related security risks they may face while at post. Specifically, transportation security policies are required by DS to clarify, among other things, if the use of public transit is permitted and whether any zones are off-limits to U.S. personnel, while travel notification policies are required to ensure that both official and personal travel are appropriately approved and conducted with appropriate vehicles, escort, and notification. Each of the 26 posts we reviewed had issued a transportation security policy and a travel notification policy. We found that 4 posts had issued policies that met all the required criteria while 22 posts had not. Specifically, 20 of 26 were missing one or more of the six elements required by DS in all security directives as recommended by the February 2005 Iraq ARB (see table 2), and 4 of 26 did not include all of the standard transportation-related elements required by DS (see table 3). Compliance with the standard transportation-related elements required was significantly higher (85 percent of the posts we reviewed) than compliance with the six elements required in all security directives as recommended by the February 2005 Iraq ARB (23 percent of the posts we reviewed). Two key factors contribute to these shortcomings in posts' transportation security and travel notification policies. First, no single source of guidance for RSOs on transportation security and travel notification policies lists all of the elements the policies at the posts are required to contain. Specifically, DS has produced multiple sources of guidance on what posts are to include in transportation security and travel notification policies, but each source covers a different set of requirements. For example, before a post security evaluation is conducted, RSOs are given a copy of the checklist used for the evaluation to help guide them in identifying and complying with security program requirements. While the checklist includes the standard transportation-related elements required by DS, such as the use of public transit and restricted zones, it does not list all of the elements required by DS in all security directives as recommended by the February 2005 Iraq ARB—a potential reason why the policies we reviewed were five times more likely to be missing the ARB elements than the standard transportation-related elements. By contrast, the FAM chapter on security directives contains the February 2005 Iraq ARB criteria but does not list any of the standard transportation-related elements required by DS. RSOs at 3 of the 9 posts we visited noted that it would be helpful if DS provided examples of model policies to use as guidance. DS is in the process of developing standard templates for certain security directives, including transportation security and travel notification policies, but this effort is not yet complete. Second, DS’s monitoring of post transportation policies lacks any additional guidance to ensure that reviewers assess policies consistently in order to identify any missing policy elements and suggest corrective action. Specifically, we found that DS reviewers lack a comprehensive set of criteria for evaluating posts’ transportation security and travel notification policies.