In managing the costs of constructing, leasing, and operating federal buildings, GSA has faced pressures in a number of areas in recent years. Many factors driving costs, such as security requirements, have tended to increase costs for construction, leasing, and operations. In addition, budget scorekeeping requirements have resulted in pressure to lease rather than construct, when in many cases leasing is more expensive over the long term. Another factor—implementing a federal mandate encouraging environmentally sound construction and renovation techniques—may result in higher initial construction costs but lead to lower operating costs. As a result of the Oklahoma City bombing in 1995, President Clinton directed the Department of Justice to assess the vulnerability of federal office buildings to attack, which resulted in a 1995 report entitled Vulnerability Assessments of Federal Facilities. The study designated five levels of security needs into which federal office buildings could be categorized, depending on the number of federal employees housed in the facility and the responsibilities of the agency; identified minimum standards for each of the five security levels; and recommended the establishment of the Interagency Security Committee (ISC) to provide a permanent body to address continuing governmentwide security concerns. In May 2001, ISC issued security design criteria for new federal office buildings and major modernization projects, and in 2002 issued draft security standards for leased space. Both of these take into consideration the five levels of security needs, recognizing that some federal facilities need more protection than others. Overall, ISC’s security design criteria and leasing security standards are designed to strengthen the ability of buildings to sustain a bomb blast or chemical attack as well as reduce the likelihood of such attacks through measures to better control access to parking and work areas. Construction measures in ISC’s design criteria include items such as providing glazing protection for windows, establishing distances that buildings should be set back from the street, controlling vehicular access to the buildings, and locating air intakes. ISC’s draft security standards for leased space require that GSA incorporate security operating standards into all future leases and in existing locations on a case-by case basis, and include similar measures as its construction standards, where relevant, such as controlling vehicular access to the building. We have not reviewed the implementation of the ISC security design criteria. Although we have not comprehensively evaluated how these changes in security requirements have affected GSA’s costs, we have gathered some examples of rising security costs in recent years. For example, according to a GSA official, security costs for courthouses have risen from about $8 a square foot to about $24 a square foot. Security requirements also have led GSA to look for larger sites for courthouses. According to a GSA official, in some cases, GSA is obtaining two separate but collocated urban sites on which to construct a courthouse and may need to close a street between the two sites to construct the building. In these circumstances, GSA may need to pay to move utilities that are in the street between the two sites. Both the increased size of the site and moving utilities located in the street will add to construction costs. A GSA official also stated that the estimate to renovate GSA’s headquarters has risen from about $80 million to $120 million, mostly due to meeting security needs. Similarly, in August 2001, we reported that the additional cost of security features for the Security and Exchange Commission’s (SEC) new building currently under construction in Washington, D.C., is expected to be $19 million. Enhancing blast protection for the Department of Transportation building in Washington, D.C., was estimated at about $8 million in 2001. Regarding the effects of ISC security leasing standards on costs, at one of four security roundtables that was held by an ISC team to discuss ISC’s proposed security leasing standards with the private sector, the potential cost of security improvements was estimated at $1.50 to $2.50 per square foot, excluding heating, ventilating, and air conditioning. In extreme cases in which there are an unusually high number of entrances to protect, it could be as high as $9 a square foot. Using the estimate of $1.50 per square foot and the estimated 155 million square feet of leased space GSA had as of fiscal year 2002, GSA leasing costs could increase by a minimum of $232 million dollars a year because of security requirements, assuming none of the improvements have already been made. Building operations costs have also risen due to security requirements. GSA’s building operations obligations have increased by 31.3 percent in 2002 constant dollars since fiscal year 1995. Forty-five percent of this increase is due to the increase in security obligations, which have risen by 231 percent in 2002 constant dollars since fiscal year 1995 to about $397 million in fiscal year 2002. One concern for which improving security is likely to affect construction, leasing, and operating costs is upgrading existing mailrooms in federal buildings. ISC guidelines addressing mailroom security were written prior to anthrax being sent through the mail to several federal buildings in the fall of 2001 and focused on securing mailrooms from bomb blasts rather than contamination. However, in the wake of the anthrax incidents, some agencies have begun screening and testing their incoming mail for hazardous material. Agencies have initiated a variety of efforts in this area, including, among other things, retrofitting existing mailrooms with air handling and ventilation systems that are independent of the systems supporting the rest of the facility; moving mailroom operations off-site; contracting with private companies to screen, test, and process incoming mail; training mailroom employees on the proper procedures for handling potentially hazardous mail and providing these employees with protective clothing and gear; purchasing equipment to screen and test mail for hazardous material; and modifying existing security contracts to require that security personnel X-ray incoming mail. These and other measures to safeguard the mail are adding to the cost of security for federal agencies in the Washington, D.C., metropolitan area. In addition, GSA issued mail management guidelines in June 2002, which brought into question whether some of the actions taken by federal agencies to safeguard their mail were necessary, particularly in light of the U.S. Postal Service’s efforts in this regard, which include irradiating certain mail destined for federal agencies located in the Washington metropolitan area. Because of the cost associated with safeguarding the mail and the uncertainty over the need for some of these safeguards, at the request of the Senate Committee on Governmental Affairs, we have initiated a review of agencies’ mail security efforts and associated costs. In October 2002, we issued a report that identified security-related costs being incurred by various agencies. While this information gives a picture of the security costs, we did not determine what types of costs are included. Some examples of recent security costs that agencies reported to us include the following: The Federal Protective Service (FPS) obligated approximately $1.3 billion for security for fiscal years 1996 through 2001. Its fiscal year 2002 budget was $362.1 million, of which about $207 million was for contract guard services. Additionally, in fiscal year 2002, GSA was slated to spend over $300 million more from its reimbursable program for contract guard services, according to a FPS official. This total of over $500 million for contract guard services was to fund approximately 7,300 contract guards. In fiscal years 1999 through 2001, the Federal Judiciary paid $71.6 million for security through its rent payments to GSA. The Federal Judiciary and the U.S. Marshals Service (USMS) also obligated about $577.1 million from the Court Security Appropriation. For fiscal year 2002, the Federal Judiciary expected to pay $36.7 million for security through its rent payments to GSA. Also, in fiscal year 2002, the Federal Judiciary received an appropriation and emergency supplemental for court security officers, court security inspectors, and security systems and equipment and transferred $280.5 million to USMS to administer the Judicial Security Facilities Program. Through its own appropriation, USMS also received $24.1 million in funding for construction; security, including guard contracts and security equipment; and furniture to handle serious security deficiencies in federal courthouses related to prisoner handling and the protection of judges, judicial employees, the public, and the Marshals. For fiscal years 1996 through 2001, the Department of Education paid GSA approximately $7.7 million in security-related expenses. In fiscal year 2002, it expected to spend approximately $2.0 million in security-related expenses, of which about $1.9 million was for guard costs. The ISC security design criteria recommend that in order to control costs, security budgets should be the result of a project-specific risk assessment on which a budget can be based. ISC reasoned that if cost is not considered early on, mitigation of one security risk might consume a disproportionate amount of the budget while other security risks might remain insufficiently or not addressed. We also have supported the concept of risk assessment as a way to determine how best to use limited funds in the context of enhancing security. Specifically, we reported in a study focusing on homeland security and information systems security that applying risk management principles can provide a sound foundation for effective security whether the assets are information, operations, people, or federal facilities. We identified the following five basic steps as being part of a risk management process to determine security priorities and implement appropriate solutions: (1) identify assets, (2) determine threats, (3) analyze vulnerabilities, (4) assess risks, and (5) apply countermeasures. According to GSA, the agency uses a risk management approach when considering security needs for its owned and leased properties. Our work has shown that budget scorekeeping requirements affect the government’s cost of acquiring space in two ways—by favoring operating leases over construction and by encouraging agencies to lease space for shorter time periods.