On November 25, 2002, the President signed into law the Homeland Security Act, which created the new federal Department of Homeland Security, and the Maritime Transportation Security Act, which created a consistent security program specifically for the nation’s seaports. Since that time, and in keeping with the provisions of these new laws, the federal government has been developing a variety of new national policies and procedures for improving the nation’s response to domestic emergencies. These policies and procedures are designed to work together to provide a cohesive framework for preparing for, responding to, and recovering from domestic incidents. A key element of this new response framework is the use of exercises to test and evaluate federal agencies’ policies and procedures, response capabilities, and skill levels. The Coast Guard has primary responsibility for such testing and evaluation in the nation’s ports and waterways, and as part of its response, it has added multiagency and multicontingency terrorism exercises to its training program. These exercises vary in size and scope and are designed to test specific aspects of the Coast Guard’s terrorism response plans, such as communicating with state and local responders, raising maritime security levels, or responding to incidents within the port. For each exercise the Coast Guard conducts, an after- action report detailing the objectives, participants, and lessons learned must be produced within 60 days. The framework under which federal agencies would coordinate with state and local entities to manage a port-terrorism incident is still evolving. As directed by Homeland Security Presidential Directive/HSPD-5, issued in February 2003, this framework is designed to address all types of responses to national emergencies, not just port-related events. Key elements of the framework have been released over the past 2 years. For example, the Department of Homeland Security released the Interim National Response Plan in September 2003 and was in the final approval stage for a more comprehensive National Response Plan in November 2004, as our work was drawing to a close. DHS announced the completion of the National Response Plan on January 6, 2005, too late for a substantive review to be included in this report. However, the finalized plan is designed to be the primary operational guidance for incident management and, when fully implemented, will incorporate or supersede existing federal interagency response plans. According to the updated implementation schedule in the National Response Plan, federal agencies will have up to 120 days to bring their existing plans, protocols, and training into accordance with the new plan. In March 2004, the department also put in place a system, called the National Incident Management System, which requires common principles, structures, and terminology for incident management and multiagency coordination. Although the framework that will be brought about by the final plan, the management system, and other actions is still in the implementation phase, some of the protocols and procedures contained in this framework were already evident at the port exercises we observed. However, it is still too early to determine how well the complete framework will function in coordinating an effective response to a port-related threat or incident. Port security exercises have identified relatively few issues related to federal agencies’ legal authority, and none of these issues were statutory problems according to exercise participants and agency officials. Our review of fiscal year 2004 after-action reports and observation of specific exercises showed that exercise participants encountered seven legal issues, but exercise participants and agency officials we interviewed did not recommend statutory changes to address these issues. In three instances, exercise participants made nonstatutory recommendations (such as policy clarifications) to assist agencies in better exercising their authority, but did not question the adequacy of that authority. In the other four instances, no recommendations were made either because statutory authority was deemed sufficient or, in one case, because the issue involved a constitutional restraint (i.e., under the Fourth Amendment, police are prohibited from detaining passengers not suspected of terrorism). While the exercises were conducted to examine a wide range of issues and not specifically to identify gaps in agencies’ legal authority, the results of the exercises are consistent with the information provided by agency officials we interviewed, who indicated that sufficient statutory authority exists to respond to a terrorist attack at a seaport. Moreover, when Department of Homeland Security officials reviewed the issue of statutory authority, as required by Homeland Security Presidential Directive/HSPD- 5, they concluded that federal agencies had sufficient authority to implement the National Response Plan and that any implementation issues could be addressed by nonstatutory means, such as better coordination mechanisms. Most of the issues identified in port security exercises have been operational rather than legal in nature. Such issues appeared in most after- action reports we reviewed and in all four of the exercises we observed. While such issues are indications that improvements are needed, it should be pointed out that the primary purpose of the exercises is to identify matters that need attention and that surfacing problems is therefore a desirable outcome, not an undesirable one. The operational issues can be divided into four main categories, listed in descending order of frequency with which they were reported: Communication—59 percent of the exercises raised communication issues, including problems with interoperable radio communications among first responders, failure to adequately share information across agency lines, and difficulties in accessing classified information when needed. Adequacy or coordination of resources—54 percent of the exercises raised concerns with the adequacy or coordination of resources, including inadequate facilities or equipment, differing response procedures or levels of acceptable risk exposure, and the need for additional training in joint agency response. Ability of participants to coordinate effectively in a command and control environment—41 percent of the exercises raised concerns related to command and control, most notably a lack of knowledge or training in the incident command structure. Lack of knowledge about who has jurisdictional or decision-making authority—28 percent of the exercises raised concerns with participants’ knowledge about who has jurisdiction or decision-making authority. For example, agency personnel were sometimes unclear about who had the proper authority to raise security levels, board vessels, or detain passengers. Our review of the Coast Guard’s fiscal year 2004 after-action reports from port terrorism exercises identified problems with timeliness in completing the reports and limitations in the information they contained. Specifically, Timeliness: Coast Guard guidance states that after-action reports are an extremely important part of the exercise program, and the guidance requires that such reports be submitted to the after-action report database (Contingency Preparedness System) within 60 days of completing the exercise. However, current practice falls short: 61 percent of the 85 after- action reports were not submitted within this 60-day time frame. Late reports were submitted, on average, 61 days past the due date. Exercises with late reports include large full-scale exercises designed to identify major interagency coordination and response capabilities. Not meeting the 60-day requirement can lessen the usefulness of these reports. Coast Guard guidance notes, and officials confirm, that exercise planners should regularly review past after-action reports when planning and designing future exercises, and to the extent that reports are unavailable, such review cannot be done. In previous reviews of exercises conducted by the Coast Guard and others, we found that timely after-action reports were necessary to help ensure that potential lessons can be learned and applied after each counterterrorism exercise. The main problem in producing reports on a more timely basis appeared to be one of competing priorities: Coast Guard field personnel indicated that other workload priorities were an impediment to completing reports, but most of them also said 60 days is a sufficient amount of time to develop and submit an after-action report. Officials cited the development of the Contingency Preparedness System, which is the program for managing exercises and after-action reports, as a step allowing for a renewed emphasis on timeliness. Headquarters planning staff are able to run reports using this system and regularly notify key Coast Guard officials of overdue after-action reports. However, this system was implemented more than 1 year ago, in August 2003, and was, therefore, in place during the period in which we found a majority of after- action reports were late. We did not compare our results with timeliness figures for earlier periods, and we, therefore, do not know the extent to which the system may have helped reduce the number of reports that are submitted late. Even if the new system has produced improvement, however, the overall record is still not in keeping with the Coast Guard’s 60-day requirement. Content and quality: Coast Guard guidance also contains criteria for the information that should be included in an after-action report. These criteria, which are consistent with standards identified in our prior work, include listing each exercise objective and providing an assessment of how well each objective was met. However, 18 percent of the after-action reports we reviewed either did not provide such an objective-by-objective assessment or identified no issues that emerged from the exercise. While the scope of each exercise may contribute to a limited number of issues being raised, our past reviews found that after-action reports need to accurately capture all exercise results and lessons learned; otherwise, agencies may not be benefiting fully from exercises in which they participate. Similarly, officials at the Department of Defense, which like the Coast Guard conducts a variety of exercises as part of its training, said that if their after-action reports lack sufficient fundamental content, they cannot be used effectively to plan exercises and make necessary revisions to programs and protocols. Our review indicated that, in addition to the pressure of other workload demands, two additional factors may be contributing to limitations in report content and quality—current review procedures and a lack of training for planners. Headquarters planning officials noted that local commands have primary responsibility for reviewing after-action reports and that limited criteria exist at headquarters for evaluating the content of reports submitted by these commands. At the field level, many planners with whom we spoke said they were unaware of any written documentation or exercise-planning guidance they could refer to when developing an after-action report. The Coast Guard has cited several planned actions that may allow for improved content and quality in after-action reports.