The United States, along with its coalition partners and various international organizations and donors, has continued to support efforts to rebuild Iraq in the aftermath of the war that replaced Iraq’s previous regime. From April 2003 to June 28, 2004, the CPA served as Iraq’s interim government and was responsible for overseeing, directing, coordinating, and approving rebuilding efforts. With the establishment of Iraq’s interim government, the CPA ceased to exist and its responsibilities were transferred to the Iraqi government or to other U.S. agencies. The Department of State is now responsible for overseeing U.S. efforts to rebuild Iraq. DOD’s Project and Contracting Office (PCO) and the U.S. Army Corps of Engineers have played a significant role in awarding and managing reconstruction contracts. USAID has been responsible for various reconstruction and developmental assistance efforts, including those related to capital construction projects, local governance, economic development, education, and public health. As figure 1 demonstrates, the battle space in Iraq can best be described as complex. A complex battle space is one where military forces, civilian U.S. government agencies, international organizations, contractors, nongovernmental organizations, and the local population share the same geographical area. Included on the complex battle space are private security providers. While there is no mechanism in place to track the number of private security providers doing business in Iraq or the number of people working as private security employees, DOD estimates that there are at least 60 private security providers working in Iraq with perhaps as many as 25,000 employees. The providers may be U.S. or foreign companies and their staffs are likely to be drawn from various countries, including the United States, the United Kingdom, South Africa, Nepal, Sri Lanka, or Fiji, and may include Kurds and Arabs from Iraq. Generally, private security providers provide the following services: Static security – security for housing areas and work sites. Personal security details – security for high-ranking U.S. officials. Security escorts – security for government employees, contractor employees, or others as they move through Iraq. Convoy security – security for vehicles and their occupants as they make their way into Iraq or within Iraq. Security advice and planning. The CPA issued a number of orders or memoranda to regulate private security providers and their employees working in Iraq. Among these are CPA Order number 3, (Revised)(Amended) which described the types of weapons that can be used by private security providers; CPA Order number 17 (Revised), which stated that contractors (including private security providers) will generally be immune from the Iraqi legal process for acts performed in accordance with the terms and conditions of their contracts; and CPA memorandum number 17, which stated that private security providers and their employees must be registered and licensed by the government of Iraq. According to security industry representatives we contacted, there are no established U.S. or international standards that identify security provider qualifications in such areas as training and experience requirements, weapons qualifications, and similar skills that are applicable for the type of security needed in Iraq. Some security industry associations and companies have discussed the need for and desirability of establishing standards, but as of March 2005 such efforts are only in the preliminary stages of development. U.S. civilian government agencies and reconstruction contractors have had to contract with private security providers because it is not part of the U.S. military’s stated mission to provide security to these organizations. U.S. forces in Iraq provide security to contractors and DOD civilians who support military operations. The Ambassador is charged with generally ensuring the security of most executive branch employees in Iraq. Government agencies have contracted with a number of private security providers to provide personnel, escort, and site security. Reconstruction contractors are generally responsible for providing for their own security according to the terms of their contracts, and they have generally done so by contracting with private security providers. The contractors’ efforts to obtain suitable security providers have met with mixed results. More than half of the contractors awarded contracts in 2003 replaced their security providers. Contractor officials attributed this turnover to various factors, including the contractors’ need to acquire security services quickly, their lack of knowledge of the security market and potential security providers available to provide the type of security services required in Iraq, and the absence of useful agency guidance. Finally, while the U.S. military is not responsible for providing security for civilian agencies and reconstruction contractors, it does provide some services, such as emergency medical support, to U.S. government-funded contractors. The stated mission of U.S. military forces in Iraq is to establish and maintain a secure environment, allow the continuance of relief and reconstruction efforts, and improve the training and capabilities of the Iraq Security Forces. As part of this mission, U.S. forces in Iraq provide security for DOD civilians who deploy with the force, non-DOD U.S. government employees who are embedded with the combat forces and contractors who deploy with the combat force. Among the contractors who deploy with the force are those that provide maintenance for weapon systems, those who provide linguistic and intelligence support to combat forces, and those who provide logistics support. Contractors who deploy with the force generally live with and directly support U.S. military forces and receive government- furnished support similar to that provided to DOD civilians. According to CENTCOM officials, the military uses soldiers rather than private security providers to provide security to contractors, civilians, facilities, or convoys which support combat operations because of concerns regarding the status of security personnel under the law of international armed conflict. This body of law considers contractors who deploy with the force generally to be noncombatant civilians accompanying the force who may not take a direct part in hostilities. CENTCOM is concerned that using armed private security employees to protect clearly military activities would risk a change in status for these contractors from noncombatants to illegal combatants. Thus, the private security employees could lose the protections otherwise granted contractors accompanying the force under international law. At the time we published our report, DOD was in the process of establishing its first departmentwide policy on the military’s security responsibilities for contractor personnel. The draft directive and instruction specify that the military shall develop a security plan for protection of contractor personnel and the contracting officer shall include in the contract the level of protection to be provided to contractor personnel. In appropriate cases, the combatant commander shall provide security through military means, commensurate with security provided DOD civilians. In May 2005, DOD also issued a new standard contract clause in the Defense Federal Acquisition Regulation Supplement (DFARS), to be included in all DOD contracts involving support to deployed forces stating that the Combatant Commander (for example, the CENTCOM Commander) will develop a security plan to provide protection, through military means, of contractor personnel engaged in the theater of operations unless the terms of the contract place the responsibility with another party. Prior to the issuance of the new contract clause, the Army’s policy expressly required Army commanders to provide security for deployed contractors, while the Air Force’s policy gave the Air Force the option of whether or not to provide force protection to Air Force contractors. It is important to note, however, that the proposed DOD departmentwide policy, procedures and standard contract clause do not cover non-DOD government contractors who may be in a military theater of operations. As discussed in the following, these contractors are responsible for providing their own security. The State Department is responsible for the security of most of the executive-branch U.S. Government employees located in Iraq. According to the President’s Letter of Instruction, the U.S. Ambassador, as Chief of Mission, is tasked by the President with full responsibility for the safety of all United States government personnel on official duty abroad except those under the security protection of a combatant commander or on the staff of an international organization. The embassy’s Regional Security Officer is the Chief of Mission’s focal point for security issues and as such establishes specific security policies and procedures for all executive branch personnel who fall under the Chief of Mission’s security responsibility. In June 2004, representatives from the Department of State and DOD signed two memoranda of agreement to clarify each department’s security responsibilities in Iraq. Among other things the agreements specify that In general, the Chief of Mission is responsible for the physical security, equipment, and personnel protective services for U.S. Mission Iraq; The Commander, CENTCOM is responsible for providing for the security of the International Zone as well as regional embassy branch offices throughout Iraq; Military capabilities may be requested by the Chief of Mission to provide physical security, equipment, and personal protective services only when security requirements exceed available Marine Security Guard Detachment, Department of State Diplomatic Security Service, and Department of State contracted security support capabilities; U.S. forces will provide force protection and Quick Reaction Force support outside the International Zone, to the extent possible, for Embassy personnel and activities; and The Ambassador has security responsibility for DOD personnel under the authority of the Chief of Mission. This includes the Marine Security Detachment and personnel working for the PCO. In Iraq, the State Department, USAID, the U.S. Army Corps of Engineers, and the CPA contracted with commercial firms to provide security. Our review of six agency-awarded security contracts, awarded between August 2003 and May 2004, showed that as of December 31, 2004, the agencies had obligated nearly $456 million on these contracts. In turn, the private security providers had billed the agencies about $315 million by that date for providing various services, including personal security details; security guards; communications; and security management. The companies providing security for U.S. government agencies may be U.S. or foreign. For example, while USAID contracted with a U.S. firm, the U.S. Army Corps of Engineers and the PCO are using British companies to meet their security requirements.