Homeland Security Presidential Directive 3 (HSPD-3) established the Homeland Security Advisory System in March 2002. Through the creation of the Homeland Security Advisory System, HSPD-3 sought to produce a common vocabulary, context, and structure for an ongoing discussion about the nature of threats that confront the nation and the appropriate measures that should be taken in response to those threats. Additionally, HSPD-3 established the Homeland Security Advisory System as a mechanism to inform and facilitate decisions related to securing the homeland among various levels of government, the private sector, and American citizens. The Homeland Security Advisory System is comprised of five color-coded threat conditions as described below, which represent levels of risk related to potential terror attack. Code-red or severe alert—severe risk of terrorist attacks. Code-orange or high alert—high risk of terrorist attacks. Code-yellow or elevated alert—significant risk of terrorist attacks. Code-blue or guarded alert—general risk of terrorist attacks. Code-green or low alert—low risk of terrorist attacks. As defined in HSPD-3, risk includes both the probability of an attack occurring and its potential gravity. Since its establishment in March 2002, the Homeland Security Advisory System national threat level has remained at elevated alert—code-yellow— except for five periods during which the administration raised it to high alert—code-orange. The periods of code-orange alert follow: September 10 to 24, 2002; February 7 to 27, 2003; March 17 to April 16, 2003; May 20 to 30, 2003; and December 21, 2003, to January 9, 2004. The Homeland Security Advisory System is binding on the executive branch. HSPD-3 directs all federal departments, agencies, and offices, other than military facilities, to conform their existing threat advisory systems to the Homeland Security Advisory System. These agencies are responsible for ensuring their systems are consistently implemented in accordance with national threat levels as defined by the Homeland Security Advisory System. Additionally, federal departments and agency heads are responsible for developing protective measures and other antiterrorism or self-protection and continuity plans in response to the various threat levels and operating and maintaining these plans. While HSPD-3 encourages other levels of government and the private sector to conform to the system, their compliance is voluntary. When HSPD-3 first established the Homeland Security Advisory System, it provided the Attorney General with responsibility for administering the Homeland Security Advisory System, including assigning threat conditions in consultation with members of the Homeland Security Council, except in exigent circumstances. As such, the Attorney General could assign threat levels for the entire nation, for particular geographic areas, or for specific industrial sectors. Upon its issuance, HSPD-3 also assigned responsibility to the Attorney General for establishing a process and a system for conveying relevant threat information expeditiously to federal, state, and local government officials, law enforcement authorities, and the private sector. In November 2002, Congress passed the Homeland Security Act of 2002, P.L. 107-296, which established the Department of Homeland Security. Under the Homeland Security Act of 2002, the DHS Under Secretary for Information Analysis and Infrastructure Protection (IAIP) is responsible for administering the Homeland Security Advisory System. As such, the Under Secretary for IAIP is primarily responsible for issuing public threat advisories and providing specific warning information to state and local governments and to the private sector. The act also charges the Under Secretary for IAIP with providing advice about appropriate protective actions and countermeasures. In February 2003, in accordance with the Homeland Security Act, the administration issued Homeland Security Presidential Directive 5 (HSPD- 5), which amended HSPD-3 by transferring authority for assigning threat conditions and conveying relevant information from the Attorney General to the Secretary of Homeland Security. HSPD-5 directs the Secretary of Homeland Security to consult with the Attorney General and other federal agency heads the Secretary deems appropriate, including other members of the Homeland Security Council, when determining the threat level, except in exigent circumstances. In implementing the Homeland Security Advisory System, DHS assigns national threat levels and assesses the threat condition of specific geographic locations and industrial sectors. While the national threat level has been raised and lowered for five periods, DHS officials told us that the department has not yet assigned a threat level for an industrial sector or geographic location. However, DHS officials said that the department has encouraged specific sectors and regions to operate at heightened levels of security. According to DHS officials, decisions to change the national threat level and to encourage specific sectors and regions to operate at heightened levels of security involve both analysis and sharing of threat information, as well as an assessment of the vulnerability of national critical infrastructure assets that are potential targets of terrorist threats. DHS officials told us they use the criteria in HSPD-3 in determining whether to raise the national threat level or whether to suggest that certain regions or sectors operate at heightened security levels. These criteria include: the credibility of threat information; whether threat information is corroborated; the degree to which the threat is specific and/or imminent; and the gravity of the potential consequences of the threat. In determining whether these criteria are met and whether to raise the national threat level, DHS considers intelligence information and the vulnerability of potential targets, among other things. DHS officials told us that they use a flexible, “all relevant factors” approach to decide whether to raise or lower the national threat level or whether to suggest that certain regions or sectors operate at heightened security levels. They said that analysis of available threat information and determination of national threat levels and regional and sector threat conditions are specific for each time period and situation. According to these officials, given the nature of the data available for analysis, the process and analyses used to determine whether to raise or lower the national threat level or suggest that specific regions or sectors heighten their protective measures are inherently judgmental and subjective. DHS officials said that the intelligence community continuously gathers and analyzes information regarding potential terrorist activity. This includes information from such agencies as DHS, the Central Intelligence Agency, the Federal Bureau of Investigation (FBI), and the Terrorist Threat Integration Center, as well as from state and local law enforcement officials. DHS officials also noted that analyses from these and other agencies are shared with DHS’s IAIP, which is engaged in constant communication with intelligence agencies to assess potential homeland security threats. DHS also considers the vulnerability of potential targets when determining the national threat level. For example, DHS officials explained that they hold discussions with state and local officials to determine whether potential targets specified by threat information require additional security to prevent a terrorist attack or minimize the potential gravity of an attack. According to these officials, if the target is determined to be vulnerable, then DHS will consider raising the threat level. Last, DHS determines whether there is a nationwide threat of terrorist attack or if the threat is limited to a specific geographic location or a specific industrial sector. DHS officials said that, in general, upon assessment of the above criteria, if there appears to be a threat of terrorist attack nationwide, then IAIP recommends to the Secretary of Homeland Security that the national threat level should be raised. The Secretary of Homeland Security then consults with the other members of the Homeland Security Council on whether the national threat level should be changed. DHS officials told us that if the Homeland Security Council members could not agree on whether to change the national threat level, the President would make the decision. DHS officials also told us that when deciding whether to lower the national threat level, they consider whether the time period in which the potential threat was to occur has passed and whether protective measures in place for the code-orange alerts have been effective in mitigating the threats. DHS officials told us that if a credible threat against specific industrial sectors or geographic locations exists, DHS may suggest that these sectors or locations operate at a heightened level of security, rather than raising the national threat level. For example, for the third code-orange alert period in our review from December 31, 2003, to January 9, 2004, threat information raised concerns of potential terrorist activity for specific industrial sectors and geographic locations. In response, DHS officials said that they encouraged those responsible for securing chemical and nuclear power plants, transit systems, and aircraft, as well as certain cities, to maintain a heightened level of security, even after the national threat level was lowered to code-yellow. However, DHS officials noted that they did not assign a threat level to these sectors and regions at that time. DHS officials further indicated that these sectors and locations were not operating at code-orange alert levels. Rather, they operated at heightened levels of security. According to DHS officials, when encouraging specific sectors or regions to continue to operate at heightened levels of security, DHS may suggest that these sectors or regions (1) implement security measures that are in addition to those implemented during a code-orange alert period, (2) continue the measures implemented during the code-orange alert period, or (3) continue selected measures implemented during a code-orange alert period. DHS officials told us that not all threats to specific regions or sectors are communicated to the public or to officials in all regions or sectors. Rather, if intelligence information suggests a targeted threat to specific regions or industrial sectors, DHS officials said that they inform officials in the specific regions or sectors that are responsible for implementing protective measures to mitigate the terrorist threat. To inform these officials, DHS issues threat advisories or information bulletins. The threat advisories we reviewed contained actionable information about threats targeting critical national networks, infrastructures, or key assets such as transit systems. These products may suggest a change in readiness posture, protective actions, or response that should be implemented in a timely manner. If the threat is less urgent, DHS may issue information bulletins, which communicate risk and vulnerabilities of potential targets. In a February 2004 testimony, the Deputy Secretary of Homeland Security said that because threat advisories and information bulletins are derived from intelligence, they are generally communicated on a need-to-know basis to a targeted audience.