Defense Infrastructure
Full Costs and Security Implications of Cheyenne Mountain Realignment Have Not Been Determined Gao ID: GAO-07-803R May 21, 2007The Department of Defense (DOD) built the Cheyenne Mountain Operations Center located near Colorado Springs, Colorado, in the early 1960s to withstand a multimegaton-yield-weapon strike and to provide protection against chemical and biological warfare. The mission of the Cheyenne Mountain Directorate is to monitor, process, and interpret air, missile, and space events that could threaten North America or have operational effects on U.S. forces or capabilities. This mission is conducted at five major centers--the Command Center, Air Warning, Missile Correlation, Operations Intelligence Watch, and Space Control--all currently located within Cheyenne Mountain. Elements of United States Strategic Command (USSTRATCOM) and Air Force Space Command are also located in Cheyenne Mountain. The Air Force's modernization of the attack warning systems within Cheyenne Mountain will cost more than $700 million from fiscal years 2000 through 2006. DOD officials have stated that they no longer need to continue operating in this hardened facility considering that the threat of an intercontinental ballistic missile strike in today's environment is low. In July 2006, the former Commander of NORAD and USNORTHCOM announced plans to move certain functions from Cheyenne Mountain and create an integrated command center at Peterson Air Force Base, which he projected at that time would save between $150 million and $200 million per year. Additionally, USSTRATCOM announced plans to relocate its missile warning mission from Cheyenne Mountain to Schriever Air Force Base, Colorado, and Air Force Space Command is in the process of moving the Space Control Center from Cheyenne Mountain to Vandenberg Air Force Base, California. North American Aerospace Defense Command (NORAD) and USNORTHCOM officials told us that after these functions have been moved, Cheyenne Mountain will be used as an alternate command center, a continuity of operations relocation facility, and a training center. You asked us to determine (1) the estimated costs, savings, and benefits associated with moving functions from Cheyenne Mountain to other locations; and (2) how DOD evaluated the security implications associated with moving the functions, and what these implications are.
NORAD and USNORTHCOM could not provide documentation to support the $150 million to $200 million savings projected by the former Commander from moving functions from Cheyenne Mountain to Peterson Air Force Base. As of April 2007, NORAD and USNORTHCOM officials have identified at least $41.7 million in onetime costs and $5.5 million in recurring costs related to the move; however, the full costs will not be determined until the completion of ongoing security assessments. In fiscal years 2006 and 2007, NORAD and USNORTHCOM allocated $26.7 million for conducting studies, purchasing needed equipment related to the relocation, and renovating the command center at Peterson Air Force Base. Renovation of the command center is scheduled to begin in June 2007 and be completed in December 2007. NORAD and USNORTHCOM officials are planning to allocate $15 million in fiscal year 2008 to purchase the remaining equipment for the integrated command center and program management support. Additional costs will likely be incurred based on the results of ongoing studies related to security requirements. According to NORAD and USNORTHCOM officials, it could take up to 24 months to obtain the resources needed to meet the designated protection level requirements. If requirements for the designated protection level cannot be met because of funding and resource constraints, waivers will be needed to begin operations or specific systems may remain in Cheyenne Mountain.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-07-803R, Defense Infrastructure: Full Costs and Security Implications of Cheyenne Mountain Realignment Have Not Been Determined
This is the accessible text file for GAO report number GAO-07-803R
entitled 'Defense Infrastructure: Full Costs and Security Implications
of Cheyenne Mountain Realignment Have Not Been Determined' which was
released on May 21, 2007.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
May 21, 2007:
The Honorable Solomon P. Ortiz:
Chairman:
The Honorable Jo Ann Davis:
Ranking Member:
Subcommittee on Readiness:
Committee on Armed Services:
House of Representatives:
Subject: Defense Infrastructure: Full Costs and Security Implications
of Cheyenne Mountain Realignment Have Not Been Determined:
The Department of Defense (DOD) built the Cheyenne Mountain Operations
Center[Footnote 1] located near Colorado Springs, Colorado, in the
early 1960s to withstand a multimegaton-yield-weapon strike and to
provide protection against chemical and biological warfare. The mission
of the Cheyenne Mountain Directorate is to monitor, process, and
interpret air, missile, and space events that could threaten North
America or have operational effects on U.S. forces or capabilities.
This mission is conducted at five major centers--the Command Center,
Air Warning, Missile Correlation, Operations Intelligence Watch, and
Space Control--all currently located within Cheyenne Mountain. Elements
of United States Strategic Command (USSTRATCOM)[Footnote 2] and Air
Force Space Command[Footnote 3] are also located in Cheyenne Mountain.
The Air Force's modernization of the attack warning systems within
Cheyenne Mountain will cost more than $700 million from fiscal years
2000 through 2006.[Footnote 4]
Peterson Air Force Base, also located in Colorado Springs, Colorado, is
the headquarters of United States Northern Command (USNORTHCOM) and the
North American Aerospace Defense Command (NORAD). NORAD is a binational
U.S. and Canadian organization staffed by both U.S. and Canadian
personnel. The Commander of USNORTHCOM is also the Commander of NORAD
and he currently has command of two fixed command centers.[Footnote 5]
The NORAD and USNORTHCOM Command Center is located at Peterson Air
Force Base and conducts air, land, maritime, and homeland defense
operations, as well as defense support of civil authorities. The
command center in Cheyenne Mountain is a NORAD and USNORTHCOM command
center that provides air, missile, and space warning, characterization,
and assessment for NORAD, USNORTHCOM, and USSTRATCOM as well as command
and control for the ground-based mid-course missile defense program.
DOD officials have stated that they no longer need to continue
operating in this hardened facility considering that the threat of an
intercontinental ballistic missile strike in today's environment is
low. In July 2006, the former Commander of NORAD and
USNORTHCOM[Footnote 6] announced plans to move certain functions from
Cheyenne Mountain and create an integrated command center at Peterson
Air Force Base, which he projected at that time would save between $150
million and $200 million per year. Additionally, USSTRATCOM announced
plans to relocate its missile warning mission from Cheyenne Mountain to
Schriever Air Force Base, Colorado, and Air Force Space Command is in
the process of moving the Space Control Center from Cheyenne Mountain
to Vandenberg Air Force Base, California. NORAD and USNORTHCOM
officials told us that after these functions have been moved, Cheyenne
Mountain will be used as an alternate command center, a continuity of
operations relocation facility, and a training center.
You asked us to determine (1) the estimated costs, savings, and
benefits associated with moving functions from Cheyenne Mountain to
other locations; and (2) how DOD evaluated the security implications
associated with moving the functions, and what these implications are.
On March 13, 2007, we provided your office with a briefing on our
preliminary observations regarding the proposed relocation. This report
summarizes the results of that briefing and provides updated
information as a result of additional work we have performed since that
time.
To determine the costs, savings, and benefits associated with the
proposed relocation of functions from Cheyenne Mountain, we reviewed
and analyzed reports and studies conducted by NORAD and USNORTHCOM,
Sandia National Laboratorie[Footnote 7]s and Lockheed Mart[Footnote
8]in on the costs and implications of relocating functions from
Cheyenne Mountain, and we interviewed NORAD and USNORTHCOM officials to
identify the expected benefits of the relocation. We also interviewed
USSTRATCOM and Air Force Space Command officials to identify the costs,
savings, and benefits associated with the relocation of their functions
from Cheyenne Mountain. We also interviewed USNORTHCOM and Air Force
budget analysts to determine how the cost estimates were developed and
validated. Based on these interviews, we believe that the cost data are
sufficiently reliable for our purposes. To determine the security
implications of the relocation and how they were evaluated by DOD, we
reviewed vulnerability assessments and risk assessments conducted by
USNORTHCOM and a security analysis conducted by Sandia National
Laboratories for the proposed relocation of NORAD and USNORTHCOM
functions, and we discussed these assessments and others that are
ongoing and their potential effect on operations with NORAD,
USNORTHCOM, and Air Force Space Command officials, and the Joint Staff.
We conducted our review from January 2007 through May 2007 in
accordance with generally accepted government auditing standards.
Summary:
NORAD and USNORTHCOM could not provide documentation to support the
$150 million to $200 million savings projected by the former Commander
from moving functions from Cheyenne Mountain to Peterson Air Force
Base. As of April 2007, NORAD and USNORTHCOM officials have identified
at least $41.7 million in onetime costs and $5.5 million in recurring
costs related to the move; however, the full costs will not be
determined until the completion of ongoing security assessments. NORAD
and USNORTHCOM officials stated that they expect increased unity of
effort and operational efficiencies as a result of the integration.
Although there is no requirement for it, NORAD and USNORTHCOM have not
done an analysis of the operational effects--both positive and
negative--of the move. In fiscal years 2006 and 2007, NORAD and
USNORTHCOM allocated $26.7 million for conducting studies, purchasing
needed equipment related to the relocation, and renovating the command
center at Peterson Air Force Base. Renovation of the command center is
scheduled to begin in June 2007 and be completed in December 2007.
NORAD and USNORTHCOM officials are planning to allocate $15 million in
fiscal year 2008 to purchase the remaining equipment for the integrated
command center and program management support. Additional costs will
likely be incurred based on the results of ongoing studies related to
security requirements. Moreover, Air Force Space Command officials
estimate that it will cost about $13 million to move their functions to
Vandenberg Air Force Base, but USSTRATCOM has not yet developed a cost
estimate for relocating their functions from Cheyenne Mountain to
Schriever Air Force Base.
The Commander of NORAD and USNORTHCOM decided to accept the risk of
integrating the command centers based on initial risk and vulnerability
assessments, but the full security implications will not be known until
ongoing security assessments are completed and a protection level is
designated for the integrated command center.[Footnote 9] While initial
security assessments provided information on vulnerabilities based on
current and projected threats, further assessments were needed to
evaluate the cost of hardening computer terminals against
electromagnetic pulse and to evaluate the physical security
requirements of protecting the integrated command center. Before the
Air Force can designate a protection level for the new command center,
the Commander of NORAD and USNORTHCOM must decide whether key computer
terminals will move to Peterson Air Force Base or remain in Cheyenne
Mountain. According to NORAD and USNORTHCOM officials, this decision
will be made after a study on electromagnetic pulse hardening
requirements is completed in late May 2007. Moreover, a System
Effectiveness Assessment, scheduled for completion in September 2007,
will provide information on the physical security needed to protect the
Cheyenne Mountain systems that may be replicated at Peterson Air Force
Base. According to NORAD and USNORTHCOM officials, it could take up to
24 months to obtain the resources needed to meet the designated
protection level requirements. If requirements for the designated
protection level cannot be met because of funding and resource
constraints, waivers will be needed to begin operations or specific
systems may remain in Cheyenne Mountain.
We believe Congress should consider restricting DOD's authority to use
funds to renovate all proposed locations to accept functions designated
to move out of Cheyenne Mountain until such time as all security
analyses are complete, the full costs of the move are determined, and
DOD provides Congress with an analysis of the operational effects of
the proposed realignments.
Background:
Currently, there is a NORAD and USNORTHCOM command center located at
Peterson Air Force Base and a NORAD and USNORTHCOM command center
located inside Cheyenne Mountain. Command staff are presently located
in each of the separate command centers. Cheyenne Mountain's mission is
to monitor, process, and interpret air, missile, and space events that
could threaten North America or have operational effects on U.S. forces
or capabilities, using air, ground, and space-based sensors that link
to the complex's computer systems located more than 2,000 feet under
ground. This mission is conducted at five major centers within Cheyenne
Mountain--the Command Center, Air Warning, Missile Correlation,
Operations Intelligence Watch, and Space Control--by approximately 658
people, including support personnel. These personnel belong to NORAD,
USNORTHCOM, USSTRATCOM, and Air Force Space Command, as shown in table
1.
Table 1: Realignment of U.S. Military and Civilian Personnel in
Cheyenne Mountain:
Command: NORAD[A];
Number of personnel: Currently in mountain: 112;
Number of personnel: Remaining in mountain: TBD;
Number of personnel: Moving to Peterson Air Force Base: TBD;
Number of personnel: Moving to other Air Force Bases: 0;
Positions eliminated: 0.
Command: Northern Command; (USNORTHCOM)[B];
Number of personnel: Currently in mountain: 42;
Number of personnel: Remaining in mountain: 24;
Number of personnel: Moving to Peterson Air Force Base: 18;
Number of personnel: Moving to other Air Force Bases: 0;
Positions eliminated: 0.
Command: Strategic Command; (USSTRATCOM)[C];
Number of personnel: Currently in mountain: 81;
Number of personnel: Remaining in mountain: TBD;
Number of personnel: Moving to Peterson Air Force Base: 17;
Number of personnel: Moving to other Air Force Bases: TBD;
Positions eliminated: TBD.
Command: Air Force Space Command;
Number of personnel: Currently in mountain: 160;
Number of personnel: Remaining in mountain: 0;
Number of personnel: Moving to Peterson Air Force Base: 12;
Number of personnel: Moving to other Air Force Bases: 138;
Positions eliminated: 10.
Command: Air Force Space Command support personnel;
Number of personnel: Currently in mountain: 263;
Number of personnel: Remaining in mountain: 263;
Number of personnel: Moving to Peterson Air Force Base: 0;
Number of personnel: Moving to other Air Force Bases: 0;
Positions eliminated: 0.
Total[D];
Number of personnel: Currently in mountain: 658;
Number of personnel: Remaining in mountain: TBD;
Number of personnel: Moving to Peterson Air Force Base: TBD;
Number of personnel: Moving to other Air Force Bases: TBD;
Positions eliminated: TBD.
Source: USNORTHCOM, NORAD, USSTRATCOM, Air Force, and GAO calculation.
Notes: TBD = to be determined.
[A] NORAD has not yet determined the number of personnel that are
remaining in the mountain and those moving to Peterson Air Force Base.
[B] USNORTHCOM positions remaining in Cheyenne Mountain are for Nuclear
Command and Control.
[C] NORAD and USNORTHCOM have formally requested that USSTRATCOM
transfer 17 positions to Peterson to support NORAD's correlation of
potential missile and space threats to North America.
[D] Contractor personnel are not included in the table. There are also
28 Canadian personnel currently working in Cheyenne Mountain.
[End of table]
No final decisions have been made as to how many personnel will remain
in the mountain, move to Peterson Air Force Base, or move to other
locations. There are also approximately 500 contractors in Cheyenne
Mountain providing support to each of the major centers. It has not
been determined how many of these contractors will be retained in the
mountain after the relocation.
During a series of major exercises conducted in 2005, the Commander of
NORAD and USNORTHCOM attempted to direct planning, operations, and
command and control from two separate command centers. In the course of
the exercises, the Commander identified shortcomings in unity of effort
due to the geographic separation of the command centers and negatively
affecting critical, time-sensitive decisions. As a result, in late
2005, the Commander of NORAD and USNORTHCOM directed a senior command
official to analyze options for correcting these shortcomings and to
determine the limitations and costs of duplicating Cheyenne Mountain
capabilities within the NORAD and USNORTHCOM Command Center at Peterson
Air Force Base. This analysis concluded that it would be cost-
prohibitive to duplicate Cheyenne Mountain capabilities at Peterson Air
Force Base. The Commander then tasked the official to analyze options
to "replicate," rather than duplicate, capabilities of the two command
centers in a single location.[Footnote 10] This analysis considered the
following four options: a single command center at Peterson, a single
command center at Cheyenne Mountain, a Net-centric battle cab, or two
separate command centers. The analysis concluded that a single command
center at Peterson Air Force Base was the only option that provided the
physical space required and strengthened unity of effort between the
commands.
In February 2006, the NORAD and USNORTHCOM Commander ordered a study to
determine how best to establish a NORAD and USNORTHCOM Command Center
at Peterson Air Force Base and place the Cheyenne Mountain Directorate
in "warm standby" status. The completed study[Footnote 11] outlined a
plan to move the air warning, missile correlation, and command center
functions out of Cheyenne Mountain but to leave the core computer
systems there, from which they would transmit their data to Peterson
Air Force Base. The Air Force must designate a protection level for the
functions moving into the integrated command center. The protection
level system identifies specific requirements for each security level
and recognizes that the users must accept varying degrees of risk. If
resources are not available to meet the assigned protection level
requirements, the Commander must request waivers from the security
requirements until corrections can be made.[Footnote 12] Renovation of
the integrated command center at Peterson is scheduled to begin in June
2007 and be completed in December 2007. Full operational capability is
planned for May 2008.
Once the functions and their associated personnel are moved, NORAD and
USNORTHCOM officials told us that they plan to use Cheyenne Mountain as
an alternate command center that could become fully functional within
approximately 1 hour, with adequate warning, if a threat situation so
dictated. Additionally, the nuclear command and control function for
USNORTHCOM will remain in the mountain and the computer systems
remaining will be used to train and certify personnel.
According to Joint Staff officials, the Commander of NORAD and
USNORTHCOM has the authority under Title 10 of the United States Code
to make decisions affecting his command--including changing the
location of command and control--as long as he performs his mission as
described in the Unified Command Plan. Our review of Title 10 confirms
that a commander of a combatant command, unless otherwise directed by
the President or the Secretary of Defense, has the authority to perform
such command functions as organizing commands and forces within that
command as he considers necessary to carry out the missions assigned to
the command.[Footnote 13] According to USNORTHCOM officials, the
Commander of NORAD and USNORTHCOM consulted with the Chairman of the
Joint Chiefs of Staff, the Secretary of Defense, and the Canadian Chief
of Defence Staff about his plan to move certain functions out of
Cheyenne Mountain, and he received their verbal concurrence. Moreover,
the Secretary of Defense stated in a February 2006 memo to the
Commander of NORAD and USNORTHCOM that he liked the Commander's
approach to place the mountain in "warm standby" and achieve a range of
cost savings.
USSTRATCOM and Air Force Space Command also have functions in Cheyenne
Mountain that are moving to other locations. USSTRATCOM has about 81
people in Cheyenne Mountain for its missile warning mission. Of these
81 people, NORAD and USNORTHCOM have formally requested that USSTRATCOM
transfer 17 positions to Peterson to provide some missile warning
continuity, while an undetermined number of personnel will move to
Schriever Air Force Base in early 2008. Likewise, Air Force Space
Command officials told us that they are in the process of moving about
138 people in the space control center and unified space vault to
Vandenberg Air Force Base. This move is scheduled to be completed by
October 2007.
No Savings Result from Proposed Relocation and Estimated Costs Have Not
Been Fully Determined:
NORAD and USNORTHCOM could not provide documentation to support the
$150 million to $200 million savings projected by the previous
Commander by moving functions from Cheyenne Mountain to Peterson Air
Force Base. As of April 2007, NORAD and USNORTHCOM officials have
identified $41.7 million in onetime and $5.5 million in recurring costs
related to the move so far; however, the full costs will not be
determined until the completion of ongoing security assessments. NORAD
and USNORTHCOM officials stated that they expect the relocation to
result in increased unity of effort and, consequently, improved
operational efficiencies. Although there is no requirement for it,
NORAD and USNORTHCOM have not done an analysis of the operational
effects--both positive and negative--of the move. While Air Force Space
Command has identified approximately $13 million in costs to move its
mission to Vandenberg Air Force Base, USSTRATCOM has not yet determined
the costs to move its mission to Schriever Air Force Base.
NORAD and USNORTHCOM Relocation:
NORAD and USNORTHCOM do not know the full costs of moving functions
from Cheyenne Mountain to Peterson Air Force Base because two security
assessments that will determine the recommended security upgrades are
still underway. As of April 2007, NORAD and USNORTHCOM have identified
about $41.7 million in onetime costs needed to integrate the two
command centers at Peterson Air Force Base, comprising:
² $8.1 million in fiscal year 2006 for various studies related to the
relocation and for purchasing equipment needed to replicate some
computer systems;
² $18.6 million in fiscal year 2007 for renovating the existing command
center at Peterson Air Force Base to accommodate the functions being
relocated from Cheyenne Mountain, for additional study costs, and for
completing computer purchases; and:
² $15 million for fiscal year 2008 to complete communications and
systems equipment purchases and program management support.
In addition, NORAD and USNORTHCOM officials estimate that approximately
$5.5 million will be needed annually to operate and maintain the
computer systems and to provide help desk support once the integrated
command center is operational.
There are no short-term cost savings from relocating functions from
Cheyenne Mountain. However, NORAD and USNORTHCOM officials stated that
certain transformational benefits, such as increased unity of effort
and improved operational efficiencies and effectiveness, are the main
reasons for integrating the command centers. Specifically, officials
stated that having one unified command center will increase the
situational awareness across all NORAD and USNORTHCOM missions and will
provide a single voice to decision makers. However, officials noted
that they have not done an analysis of the operational effects--both
positive and negative--of the move. Furthermore, the officials stated
that they have not thus far effectively communicated and documented the
anticipated benefits and plan to improve communications both within the
command and with outside entities.
Air Force Space Command Relocation:
The projected cost for relocating the Space Control Center and the
Unified Space Vault from Cheyenne Mountain to the Joint Space
Operations Center at Vandenberg Air Force Base, California, is
approximately $13 million. Of this amount, $4.5 million was allocated
in fiscal year 2006 for studies, renovation of facilities, and
relocation of equipment to Vandenberg, and $5.4 million was allocated
in fiscal year 2007 for training, temporary duty to Vandenberg, and
relocation of equipment. An additional $2.9 million has been requested
to complete the move, but at the time of our review, Air Force Space
Command officials did not know from which fiscal year these additional
funds would be allocated. Moreover, costs for any needed security
upgrades at Vandenberg have not yet been determined, pending a security
assessment that is scheduled to be completed in August 2007. According
to Air Force Space Command officials, the first phase of the equipment
move has been completed, and the equipment is operating at Vandenberg.
The remaining equipment is scheduled to be moved by October 2007. Air
Force Space Command officials expect that the relocation will enable
them to reduce future costs for systems modernization and maintenance
and for contractor operations. Moreover, these officials stated that
the space mission does not require "hardening" from nuclear attack and
does not have to be located in Cheyenne Mountain.
U.S. Strategic Command Relocation:
The costs to relocate the missile warning mission from Cheyenne
Mountain to Schriever Air Force Base, Colorado, have not yet been
developed. According to USSTRATCOM officials, an ongoing site survey
scheduled for completion in late May 2007 will determine the security
requirements, and a subsequent engineering study will develop the
estimated costs of the planned relocation. USSTRATCOM decided to move
its missile warning mission to get away from the mountain's legacy
computer systems and acquire a more modern net-centric system using
distributed nodes.
Security Implications and Associated Risks of the Proposed Relocation
Have Not Been Fully Determined:
After reviewing initial risk and vulnerability assessments conducted by
USNORTHCOM in early 2006, the Commander accepted the risk of
integrating the two command centers, but the full security implications
and the associated risks of the proposed relocation will not be known
until at least September 2007, following the completion of ongoing
security assessments and the designation of a protection level for the
new command center. An electromagnetic pulse hardening assessment, a
physical security assessment of the NORAD and USNORTHCOM headquarters
building, and the designation of a protection level for the new command
center are in progress. If the protection level designation
requirements cannot be met for replicating the desired systems due to
resource or funding constraints, waivers will be needed to proceed with
the planned integration or specific systems may remain in Cheyenne
Mountain.
Initial Security Assessments:
In January 2006, USNORTHCOM conducted a classified risk
assessment[Footnote 14] on the NORAD and USNORTHCOM headquarters
building at Peterson Air Force Base. As a result of this risk analysis,
NORAD and USNORTHCOM have taken some steps to mitigate known
vulnerabilities to the headquarters building from potential threats,
which exist regardless of the command center integration. For example,
NORAD and USNORTHCOM have limited the access to backup generators and
the garage of the headquarters building. Additionally, in March 2006,
USNORTHCOM conducted a classified risk assessment[Footnote 15] that
compared the vulnerability of the Cheyenne Mountain Operations Center
to the NORAD and USNORTHCOM headquarters building. After seeing these
initial security assessments based on current and projected threats,
the NORAD and USNORTHCOM Commander deemed that the risk incurred by
integrating the two command centers was acceptable.
USNORTHCOM also contracted with Sandia National Laboratories to
determine the security implications of moving assigned missions to
Peterson Air Force Base. Sandia's December 2006 classified
report[Footnote 16] analyzed four different options for moving the
missions. Sandia's report recommended replicating some of the computer
systems in Cheyenne Mountain because this solution would require a
lower protection level than moving all computer systems and would cost
less. However, a USNORTHCOM official told us that the Commander is
still considering other options and additional security assessments are
ongoing.
Ongoing Security Assessments:
Two security assessments related to moving functions from Cheyenne
Mountain to Peterson Air Force Base are underway. First, Sandia
National Laboratories is assessing the cost associated with hardening
computer terminals used to track air, missile, and space events, and
examining the methods needed to protect those terminals against man-
made and natural threats. The results of this assessment, which is
scheduled to be completed in May 2007, will enable the NORAD and
USNORTHCOM Commander to assess the feasibility of moving these
terminals. Second, according to an Air Force Space Command official,
the Air Force is conducting a Systems Effectiveness Assessment that
will determine the effectiveness of the security system at NORAD and
USNORTHCOM headquarters to detect, delay, deny, and neutralize a
threat; however, the assessment will not specifically examine
procedures for protecting against a chemical/biological attack. After
the completion of this assessment, the leadership will be able to
develop an actionable plan with cost estimates to build a system to
protect the building at those levels through the conceptual design
process. USNORTHCOM officials expect the results of this assessment in
September 2007.
According to a USNORTHCOM official, a complete protection level study
has never been conducted on the NORAD and USNORTHCOM headquarters
building. USNORTHCOM is in the process of completing a Protection Level
Designation Matrix that includes information on the threat to the
headquarters building and its significance to the United States'
warfighting capability. This tool will help the Department of the Air
Force determine a protection level for the building. An Air Force Space
Command official said that if NORAD and USNORTHCOM cannot meet the
protection level requirements for the integrated command center due to
resource or funding constraints, they will have to request waivers and
develop a mitigation strategy. He added that it could take up to 24
months to get the completed security system in place if it was fully
funded.
According to the Deputy Director of Operations of the NORAD and
USNORTHCOM Command Center, the renovation of the command center is not
dependent upon the decision regarding the appropriate protection level.
This official stated the protection level requirements are focused on
external vulnerabilities and address issues such as cameras, bollards
for stand-off distances, and additional security forces personnel.
Nonetheless, one component of the renovation will depend on the results
of the ongoing electromagnetic pulse hardening assessment, but this
will affect only two of the many systems in the command centers. The
Deputy Director of Operations stated that he does not anticipate having
to delay the renovation to await any report results but will
incorporate all accepted recommendations into the renovation of the
integrated command center. He said that the contractor has been given
the authority to proceed with renovation on June 11, 2007. It is
scheduled for completion in December 2007.
Conclusions:
The proposed realignment of functions from Cheyenne Mountain represents
a major transformation for NORAD and USNORTHCOM. Without benefit of an
analysis of operational effects of the proposed moves, the completed
security assessments, and final protection level designation to inform
him, it is unclear what level of risk the Commander is accepting in
integrating the two command centers. Furthermore, the costs associated
with any needed security upgrades are not known and it is unclear
whether resources and funding are available to meet the protection
level requirements. Without knowing the complete security effects and
cost to replicate the functions, neither DOD nor Congress has adequate
information to assess the risks in relation to the costs of moving
functions from Cheyenne Mountain.
Matters for Congressional Consideration:
GAO is not making any recommendations for executive action. However,
Congress should consider restricting DOD's authority to use funds to
renovate new locations to accept functions designated to move out of
Cheyenne Mountain until such time as all security analyses are
complete, the full costs of the move are determined, and DOD provides
Congress with an analysis of the operational effects of the proposed
realignments.
Agency Comments:
We received technical comments from DOD, which we incorporated as
appropriate. In their technical comments, NORAD and USNORTHCOM noted
that the new commander clarified that the relocation was initiated by
mission inefficiencies, not cost savings, and is required to increase
unity of effort and operational effectiveness. Further, USNORTHCOM
noted that the synergies gained through consolidation of missions into
a single command center are essential for an effective response to the
full spectrum of threats to the United States. Nevertheless, our review
showed that NORAD and USNORTHCOM did not fully analyze the costs and
operational effects of the proposed move, and, therefore, we are
including a matter for congressional consideration.
We are sending copies of this report to the Secretary of Defense; the
Chairman, Joint Chiefs of Staff; the Secretary of the Air Force; and
the Commanders of NORAD and USNORTHCOM and USSTRATCOM. We will make
copies available to others upon request. This report will be available
at no charge on GAO's Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please
contact me at (202) 512-5431 or dagostinod@gao.gov. Contact points for
our Office of Congressional Relations and Public Affairs may be found
on the last page of this report. Key contributors to this report were
Mike Kennedy, Assistant Director; Amy Higgins; Keith Rhodes; Enemencio
Sanchez; Kimberly Seay; Brian Shiels; Karen Thornton; and Cheryl
Weissman.
Signed by:
Davi M. D'Agostino:
Director, Defense Capabilities and Management:
(350965):
FOOTNOTES
[1] The Cheyenne Mountain Operations Center is now known as the
Cheyenne Mountain Directorate. It is one of several tenants that
compose the Cheyenne Mountain Air Force Station near Colorado Springs,
Colorado.
[2] USSTRATCOM conducts the missile warning mission for North America.
[3] Air Force Space Command conducts the space control mission for
North America.
[4] GAO, Defense Acquisitions: Further Management and Oversight Changes
Needed for Efforts to Modernize Cheyenne Mountain Attack Warning
Systems, GAO-06-666 (Washington, D.C.: July 6, 2006).
[5] The Commander also has a mobile consolidated command center based
at F.E. Warren Air Force Base, Wyoming.
[6] The new NORAD and USNORTHCOM Commander was sworn in on March 23,
2007.
[7] Sandia National Laboratories, a federally funded research center,
was tasked to study the security implications of four options for
moving missions from Cheyenne Mountain to Peterson Air Force Base.
[8] Lockheed Martin conducted this study under contract with the
Electronic Systems Center. The Electronic Systems Center, a component
of Air Force Materiel Command, manages the development and acquisition
of electronic command and control systems for the Air Force.
[9] The Air Force must designate a protection level for the functions
moving into the integrated command center pursuant to Air Force
Instruction 31-101, The Air Force Installation Security Program (Mar.
1, 2003).
[10] USNORTHCOM officials told us that in this context, replicating
capabilities means leaving computer servers, equipment, and
infrastructure in the mountain and digitally sending the information to
the NORAD and USNORTHCOM Command Center at Peterson. Duplicating
capabilities would involve moving the servers, equipment, and
infrastructure.
[11] U.S. Northern Command, The NORAD-USNORTHCOM Transformation
Analysis Report (Colorado Springs, Colo.: July 2006).
[12] Air Force Instruction 31-101, The Air Force Installation Security
Program, §6.3.2 (Mar. 1, 2003).
[13] 10 U.S.C. §164.
[14] U.S. Northern Command, Risk Assessment Report (Peterson Air Force
Base, Colo.: January 2006).
[15] U.S. Northern Command, Cheyenne Mountain Operations Center/
Building 2 Vulnerability Assessment against Terrorist Attacks (Peterson
Air Force Base, Colo.: March 2006).
[16] Sandia National Laboratories, Phase 2: Security Assessment Results
and Conceptual Security Designs for North American Aerospace Defense
Command and United States Northern Command, (Albuquerque, N.Mex.:
December 2006).
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts
newly released reports, testimony, and correspondence on its Web site.
To have GAO e-mail you a list of newly posted products every afternoon,
go to www.gao.gov and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548:
Public Affairs:
Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548:
