Homeland Security

Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security Gao ID: GAO-05-33 January 14, 2005

The National Strategy for Homeland Security sets forth a plan to improve homeland security through the cooperation of federal, state, local, and private sector organizations on an array of functions. These functions are organized into the six distinct "critical mission areas" of (1) intelligence and warning, (2) border and transportation security, (3) domestic counterterrorism, (4) protecting critical infrastructures and key assets, (5) defending against catastrophic threats, and (6) emergency preparedness and response. Within each of these mission areas, the strategy identifies "major initiatives" to be addressed. In all, the strategy cites 43 initiatives across the six mission areas. GAO reviewed the strategy's implementation to (1) determine whether its initiatives are being addressed by key departments' strategic planning and implementation activities, whether the initiatives have lead agencies identified for their implementation, and whether the initiatives were being implemented in fiscal year 2004 by such agencies and (2) identify ongoing homeland security challenges that have been reflected in GAO products since September 11, 2001, by both mission area and issues that cut across mission areas.

Key federal departments--Defense (DOD), Energy (DOE), Health and Human Services (HHS), Homeland Security (DHS), Justice (DOJ), and State--have addressed the strategy's 43 initiatives to some extent in their strategic planning and implementation activities. All 43 of the initiatives were included in some of the planning or implementation activities of at least one of these six departments. Most of the initiatives (42 of the 43) also had departments identified as the lead agencies for their implementation, which helps to ensure accountability for implementation. However, many of these 42 initiatives had multiple lead agencies, indicating that interagency coordination of roles and activities will be important, particularly on those initiatives involving domestic counterterrorism and critical infrastructure protection. All of the initiatives were being implemented in fiscal year 2004 by at least one department. While GAO determined that implementation was occurring, it did not assess the status or quality of the various departments' implementation of the initiatives. While departments have incorporated these initiatives into their planning and implementation activity, the United States faces significant challenges in fully implementing the strategy in a coordinated and integrated manner. Some of the most difficult challenges being confronted are those that cut across the various critical mission areas, such as balancing homeland security funding needs with other national requirements, improving risk management methods for resource allocation and investments, developing adequate homeland security performance measures, developing a national enterprise architecture for homeland security, and clarifying the roles and responsibilities among the levels of government and the private sector. GAO has also identified a large diversity of other challenges in each of the six critical mission areas since September 11.



GAO-05-33, Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security This is the accessible text file for GAO report number GAO-05-33 entitled 'Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security' which was released on February 14, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: United States Government Accountability Office: GAO: January 2005: Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security: GAO-05-33: GAO Highlights: Highlights of GAO-05-33, a report to the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: Why GAO Did This Study: The National Strategy for Homeland Security sets forth a plan to improve homeland security through the cooperation of federal, state, local, and private sector organizations on an array of functions. These functions are organized into the six distinct ’critical mission areas“ of (1) intelligence and warning, (2) border and transportation security, (3) domestic counterterrorism, (4) protecting critical infrastructures and key assets, (5) defending against catastrophic threats, and (6) emergency preparedness and response. Within each of these mission areas, the strategy identifies ’major initiatives“ to be addressed. In all, the strategy cites 43 initiatives across the six mission areas. GAO reviewed the strategy‘s implementation to: * determine whether its initiatives are being addressed by key departments‘ strategic planning and implementation activities, whether the initiatives have lead agencies identified for their implementation, and whether the initiatives were being implemented in fiscal year 2004 by such agencies and * identify ongoing homeland security challenges that have been reflected in GAO products since September 11, 2001, by both mission area and issues that cut across mission areas. What GAO Found: Key federal departments”Defense (DOD), Energy (DOE), Health and Human Services (HHS), Homeland Security (DHS), Justice (DOJ), and State”have addressed the strategy‘s 43 initiatives to some extent in their strategic planning and implementation activities. All 43 of the initiatives were included in some of the planning or implementation activities of at least one of these six departments. Most of the initiatives (42 of the 43) also had departments identified as the lead agencies for their implementation, which helps to ensure accountability for implementation. However, many of these 42 initiatives had multiple lead agencies, indicating that interagency coordination of roles and activities will be important, particularly on those initiatives involving domestic counterterrorism and critical infrastructure protection. All of the initiatives were being implemented in fiscal year 2004 by at least one department. While GAO determined that implementation was occurring, it did not assess the status or quality of the various departments‘ implementation of the initiatives. While departments have incorporated these initiatives into their planning and implementation activity, the United States faces significant challenges in fully implementing the strategy in a coordinated and integrated manner. Some of the most difficult challenges being confronted are those that cut across the various critical mission areas, such as balancing homeland security funding needs with other national requirements, improving risk management methods for resource allocation and investments, developing adequate homeland security performance measures, developing a national enterprise architecture for homeland security, and clarifying the roles and responsibilities among the levels of government and the private sector. GAO has also identified a large diversity of other challenges in each of the six critical mission areas since September 11. Proposed Fiscal Year 2005 Homeland Security Funding by Agency (budget authority in millions of dollars): [See PDF for image] [End of figure] www.gao.gov/cgi-bin/getrpt?GAO-05-33. To view the full product, including the scope and methodology, click on the link above. For more information, contact Norman J. Rabkin (202) 512-3610 or rabkinn@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Scope and Methodology: Agency Plans, Implementation, and Challenges: Concluding Observations: Agency Comments and Our Evaluation: Appendix I: Objectives, Scope, and Methodology: Appendix II: Intelligence and Warning: Definition and Major Initiatives: Agencies with Major Roles in Intelligence and Warning: Alignment of Department Activities with the Major Initiatives: Challenges in Intelligence and Warning: Appendix III: Border and Transportation Security: Definition and Major Initiatives: Agencies with Major Roles in Border and Transportation Security: Alignment of Department Activities with the Major Initiatives: Challenges in Border and Transportation Security: Border Security: Transportation Security: Appendix IV: Domestic Counterterrorism: Definition and Major Initiatives: Agencies with Major Roles in Domestic Counterterrorism: Alignment of Department Activities with the Major Initiatives: Challenges in Domestic Counterterrorism: Appendix V: Protecting Critical Infrastructures and Key Assets: Definition and Major Initiatives: Agencies with Major Roles in Critical Infrastructure Protection: Alignment of Department Activities with the Major Initiatives: Challenges in Critical Infrastructure Protection: Appendix VI: Defending Against Catastrophic Threats: Definition and Major Initiatives: Agencies with Major Roles in Defending against Catastrophic Threats: Alignment of Department Activities with the Major Initiatives: Challenges in Defending Against Catastrophic Threats: Appendix VII: Emergency Preparedness and Response: Definition and Major Initiatives: Agencies with Major Roles in Emergency Preparedness and Response: Alignment of Department Activities with the Major Initiatives: Challenges in Emergency Preparedness and Response: Appendix VIII: Crosscutting Issues: Crosscutting Challenges: Appendix IX: Department Summary Across Critical Mission Areas: Appendix X: Homeland Security Presidential Directives: Appendix XI: Comments from the Department of Defense: GAO Comment: Appendix XII: Comments From the Department of Health and Human Services: GAO Comment: Appendix XIII: Comments From the Department of Homeland Security: GAO Comment: Appendix XIV: Comments From the Department of Justice: GAO Comments: Appendix XV: GAO Contacts and Staff Acknowledgments: GAO Contacts: Staff Acknowledgments: Related GAO Products: Tables: Table 1: Department Leadership, Planning, or Implementation Activity in the Intelligence and Warning Mission Area's Five Initiatives: Table 2: Department Leadership, Planning, or Implementation Activity in the Border and Transportation Security Mission Area's Six Initiatives: Table 3: Department Leadership, Planning, or Implementation Activity in the Domestic Counterterrorism Mission Area's Six Initiatives: Table 4: Department Leadership, Planning, or Implementation Activity in the Critical Infrastructure Protection Mission Area's Eight Initiatives: Table 5. Department Leadership, Planning, or Implementation Activity in the Defending Against Catastrophic Threats Mission Area's Six Initiatives: Table 6: Department Leadership, Planning, or Implementation Activity in the Emergency Preparedness and Response Mission Area's Twelve Initiatives: Table 7: Detailed Department Leadership and Planning/Implementation Activities in the Intelligence and Warning Mission Area's Five Initiatives: Table 8: Detailed Department Leadership and Planning/Implementation Activities in the Border and Transportation Mission Area's Six Initiatives: Table 9: Detailed Department Leadership and Planning/Implementation Activities in the Domestic Counterterrorism Mission Area's Six Initiatives: Table 10: Detailed Department Planning/Implementation Activities in the Protecting Critical Infrastructures and Key Assets Critical Mission Area's Eight Initiatives: Table 11: Detailed Department Planning/Implementation Activities in the Defending Against Catastrophic Threats Mission Area's Six Initiatives: Table 12: Detailed Department Planning/Implementation Activities in the Emergency Preparedness and Response Mission Area's Twelve Initiatives: Table 13: Summary of Department Leads, Planning, and Implementation across the Six Critical Mission Areas of the National Strategy for Homeland Security: Figures: Figure 1: Proposed Fiscal Year 2005 Homeland Security Funding by Critical Mission Area: Figure 2: Proposed Fiscal Year 2005 Homeland Security Funding by Department: Figure 3: The Five Threat Levels of the Homeland Security Advisory System: Figure 4: Proposed Fiscal Year 2005 Homeland Security Funding for Intelligence and Warning: Figure 5: U.S. Customs and Border Patrol Marine Officers on the Waters of the Rio Grande, along the United States and Mexico Border: Figure 6: Proposed Fiscal Year 2005 Homeland Security Funding for Border & Transportation Security: Figure 7: An FBI Evidence Response Team in Action at the Scene of a Terrorism-Related Exercise: Figure 8: Proposed Fiscal Year 2005 Homeland Security Funding for Domestic Counterterrorism: Figure 9: A U.S. Immigration and Customs Enforcement Helicopter Patrols the Skies over the Nation's Capital: Figure 10: Proposed Fiscal Year 2005 Homeland Security Funding for Critical Infrastructure Protection: Figure 11: First Responders Practice Emergency Decontamination: Figure 12: Proposed Fiscal Year 2005 Homeland Security Funding for Defending Against Catastrophic Threats: Figure 13: Hazardous Materials Response Unit in Action at an Exercise: Figure 14: Proposed Fiscal Year 2005 Homeland Security Funding for Emergency Preparedness: Abbreviations: APHIS: Animal and Plant Health Inspection Service: ATSA: Aviation and Transportation Security Act: CAPPS: Computer-Assisted Passenger Prescreening Program: CBP: Customs and Border Patrol: CBRN: chemical, biological, radiological, or nuclear: CIA: Central Intelligence Agency: CIP: Critical Infrastructure Protection: CSI: container security initiative: C-TPAT: Customs-Trade Partnership against Terrorism: CWC: Chemical Weapons Convention: DBT: design basis threat: DHS: Department of Homeland Security: DIA: Defense Intelligence Agency: DOD: Department of Defense: DOE: Department of Energy: DOJ: Department of Justice: EPA: Environmental Protection Agency: FBI: Federal Bureau of Investigation: FPS: Federal Protective Service: GAO: Government Accountability Office: GPRA: Government Performance and Results Act: GSA: General Services Administration: HHS: Department of Health and Human Services: HSAS: Homeland Security Advisory System: HSC: Homeland Security Council: HSPD: Homeland Security Presidential Directive: IAIP: Information Analysis and Infrastructure Protection: ICE: Immigration and Customs Enforcement: IT: information technology: MANPADS: Man-Portable Air Defense System: MTSA: Maritime Transportation Security Act: NIH: National Institutes of Health: NCR: National Capital Region: NMLS: National Money Laundering Strategy: NNSA: National Nuclear Security Administration: NRC: Nuclear Regulatory Commission: NSPD: National Security Presidential Directive: ODP: Office of Domestic Preparedness: OJP: Office of Justice Programs: OMB: Office of Management and Budget: PDD: Presidential Decision Directive: PSV: post-shipment verification: UAV: unmanned aerial vehicle: USDA: United States Department of Agriculture: USPS: United States Postal Service: US-VISIT: United States Visitor and Immigrant Status Indicator: VA: Veterans Administration: WMD: weapons of mass destruction: SSN: Social Security Number: TSA: Transportation Security Act: TTIC: Terrorist Threat Integration Center: United States Government Accountability Office: Washington, DC 20548: January 14, 2005: The Honorable Christopher Shays: Chairman, Subcommittee on National Security, Emerging Threats, and International Relations: Committee on Government Reform: House of Representatives: Dear Mr. Chairman: In an effort to increase homeland security following the September 11, 2001, terrorist attacks on the United States, President Bush issued the National Strategy for Homeland Security in July 2002 and signed legislation creating the Department of Homeland Security (DHS) in November 2002.[Footnote 1] The strategy sets forth overall objectives to prevent terrorist attacks within the United States, reduce America's vulnerability to terrorism, and minimize the damage and assist in the recovery from attacks that may occur. To accomplish these overall objectives, the strategy describes six critical mission areas and 43 initiatives. Since the strategy was issued, the President has also issued additional documents--known as Homeland Security Presidential Directives (or HSPDs)--that provide more detailed guidance on the mission areas and initiatives. The creation of DHS, which began operations in March 2003, represents a fusion of 22 federal agencies to coordinate and centralize the leadership of many homeland security activities under a single department. In addition to DHS, the Departments of Defense (DOD), Energy (DOE), Health and Human Services (HHS), Justice (DOJ), and State play an important role in implementing the strategy. These six key departments represent 94 percent of proposed federal spending for homeland security in fiscal year 2005. With the strategy now more than 2 years old, and DHS more than a year old, you asked that we review the implementation of the strategy and organize our work by critical mission area. In response, we have: * determined whether the initiatives in the strategy were being addressed by the key department's strategic planning and related activities; whether the initiatives had "lead" agencies identified for their implementation, and whether multiple departments were implementing the initiatives in fiscal year 2004; and: * identified homeland security challenges as reflected in our products since September 11, 2001, by both mission area and issues that cut across mission areas. This report establishes one framework from which to assess federal department implementation of the National Strategy for Homeland Security. Since agency homeland security activities are ongoing, this report is intended to identify a baseline from which to assess progress toward meeting homeland security objectives. In this report, we first provide the proposed fiscal year 2005 homeland security-related budget by mission area and department. Then, we discuss the homeland security planning and implementation activities of the six departments under review, as well as remaining homeland security challenges, by mission area. The appendixes that follow provide more detailed assessments of each of these sections and are also arranged by mission area. (See app. I for more information on the scope and methodology.) Further, this report should be considered in the context of several companion efforts to provide baseline information. In February 2004, we testified on the desired characteristics of national strategies and whether various strategies--including the National Strategy for Homeland Security-- contained those desired characteristics.[Footnote 2] In March, we summarized strategic homeland security recommendations made by congressionally chartered commissions and us.[Footnote 3] We organized this analysis by critical mission area, as defined in the strategy. In July, we reported on our recommendations to DHS and the department's progress in implementing such recommendations.[Footnote 4] We organized this analysis by DHS directorate or division. In September, we compared 9/11 Commission recommendations with those of the National Strategy for Homeland Security and the National Strategy to Combat Terrorism. We also provided a preliminary analysis of department planning and implementation activities with respect to the six mission areas.[Footnote 5] Together, these baseline efforts are intended to aid congressional oversight of federal homeland security activities. Results in Brief: Key federal departments have addressed the strategy's initiatives in their strategic planning and implementation activities. All 43 initiatives indicated in the strategy were included in the activities of at least one of the six departments we reviewed. For most of the initiatives (42 of 43), the strategy or HSPDs identified lead agencies, thereby helping to ensure accountability for implementation. All 43 initiatives were being implemented in fiscal year 2004 by at least one department. Thirty-three of the 43 initiatives (77 percent) were being planned or implemented by 3 or more departments. While we determined that implementation was occurring, we did not assess the status or quality of the various departments' implementation of the initiatives. While departments have incorporated these initiatives into their planning and implementation activity, the United States still faces significant challenges in implementing the strategy in a well coordinated and integrated manner. A review of our products since September 11, 2001, shows that some of the most difficult challenges being confronted are those that cut across the various critical mission areas. These challenges include: * balancing homeland security needs with other national requirements, * improving risk management methods for resource allocation and investments, * developing adequate homeland security performance measures, * clarifying the roles and responsibilities among the levels of government and the private sector, and: * developing a national blueprint--called an enterprise architecture-- to help integrate different organization's efforts to improve homeland security. In addition to these and other crosscutting challenges, we have identified a large diversity of challenges related specifically to each of the six mission areas described in the strategy and provide details on them in the remainder of the report. We provided a draft of this report to DHS, DOD, DOE, DOJ, HHS, State, and the Homeland Security Council for comment. All except State and the Homeland Security Council provided comments, which generally consisted of technical comments that we incorporated as appropriate. None of the departments disagreed with the substance of the report. Background: The National Strategy for Homeland Security sets out a plan to improve homeland security through the cooperation and partnering of federal, state, local, and private sector organizations on an array of functions.[Footnote 6] The strategy organizes these functions into six critical mission areas:[Footnote 7] * Intelligence and Warning involves the identification, collection, analysis, and distribution of intelligence information appropriate for preempting or preventing a terrorist attack. * Border and Transportation Security emphasizes the efficient and reliable flow of people, goods, and material across borders while deterring terrorist activity. * Domestic Counterterrorism focuses on law enforcement efforts to identify, halt, prevent, and prosecute terrorists in the United States. * Protecting Critical Infrastructure and Key Assets stresses securing the nation's interconnecting sectors and important facilities, sites, and structures. * Defending Against Catastrophic Threats emphasizes the detection, deterrence, and mitigation of terrorist use of weapons of mass destruction. * Emergency Preparedness and Response highlights damage minimization and recovery from terrorist attacks. Since the strategy was issued in July 2002, the President has also issued 12 HSPDs that provide additional guidance related to these mission areas. For example, HSPD-4 focuses on defending against catastrophic threats and HSPD-7 focuses on protecting critical infrastructure. These HSPDs provided some of the details that were not in the strategy, particularly with respect to agency roles and milestones. See appendix X for a complete list and description of these HSPDs. The strategy also identifies the major initiatives to be addressed within each of these six mission areas. For example, within the Intelligence and Warning mission area, 5 initiatives are indicated: (1) enhancing the analytic capabilities of the FBI; (2) building new capabilities through the Information Analysis and Infrastructure Protection Directorate of DHS; (3) implementing the Homeland Security Advisory System; (4) utilizing dual-use analysis to prevent attacks; and (5) employing "red team" techniques.[Footnote 8] Within the Border and Transportation Security mission area, 6 initiatives are cited: (1) ensuring accountability in border and transportation security, (2) creating "smart borders", (3) increasing the security of international shipping containers, (4) implementing the Aviation and Transportation Security Act of 2001, (5) recapitalizing the U.S. Coast Guard, and (6) reforming immigration services. In all, the strategy cites 43 initiatives across the six mission areas. See appendix IX for a complete list of all the initiatives by mission area. The latest available funding data from the Office of Management and Budget (OMB) for the six mission areas is illustrated in figure 1. Figure 1: Proposed Fiscal Year 2005 Homeland Security Funding by Critical Mission Area: [See PDF for image] Note: Budget authority in millions of dollars. [End of figure] The National Strategy for Homeland Security specifies a number of federal departments, as well as nonfederal organizations, that have important roles in implementing the mission areas and related initiatives. In terms of federal departments, DHS is intended to have a prominent role in implementing all of the mission areas. Other key federal departments specified in the strategy include, in alphabetical order, the Department of Defense, the Department of Energy, the Department of Health and Human Services, the Department of Justice, and the Department of State (State). These departments have their own strategic plans, which indicate how they will implement their homeland security programs (as well as other programs unrelated to homeland security). Together, DHS and these other five departments constitute 94 percent of the proposed $47.4 billion budget for homeland security- related activities in fiscal year 2005. OMB did not report funding for the Central Intelligence Agency (CIA) although it has activities related to the Intelligence and Warning mission area. As explained further in appendix II, we did not include the CIA in our analysis because of the lack of funding data and because the strategy provides little discussion of the agency. Figure 2 shows the proposed fiscal year 2005 funding for these departments as well as the proposed homeland security funding for all other agencies. Figure 2: Proposed Fiscal Year 2005 Homeland Security Funding by Department: [See PDF for image] Notes: Budget authority in millions of dollars. [End of figure] Other agencies includes the Departments of Agriculture ($651 million), Veterans Affairs ($297 million), Transportation ($243 million), Commerce ($150 million), and Treasury ($87 million), as well as the National Science Foundation ($344 million), National Aeronautics and Space Administration ($207 million), Social Security Administration ($155 million), Environmental Protection Agency ($97 million), U.S. Army Corps of Engineers ($84 million), General Services Administration ($80 million), and several smaller agencies. Additionally, OMB reported the Intelligence Community figure in aggregate; it did not break it out by individual departments (e.g., Central Intelligence Agency). The National Strategy for Homeland Security and the related HSPDs typically identify a specific federal department as being a "lead" agency for specific initiatives. However, the language varies in precision. In some cases, the documents use clear language to identify which department will lead efforts across the government. In other cases, the lead is more implied than stated. Sometimes, more than one department is identified as a lead agency--which can occur because some of the initiatives in the strategy are large in scope, and different departments lead different parts of the initiatives. The identification of lead agency is important in order to specify which agencies are accountable for the implementation of the initiatives, particularly if implementation requires the efforts of several different agencies exercising different statutory authorities. By clearly identifying the lead agency, the strategies and the HSPDs enable the federal, state, local, and private stakeholders to determine who is responsible and accountable for the implementation, and thus more effectively direct their inquiries and integrate their own actions, particularly where multiagency coordination is required. See appendix IX for a complete list of the initiatives and the departments identified as lead agencies. Congress, because of concerns about terrorism in recent years, chartered four commissions to examine terrorist threats and the government's response to such threats, as well as to make recommendations to federal, state, local, and private organizations. These national commissions included the following: * The Bremer Commission: the National Commission on Terrorism, chaired by Ambassador Paul Bremer, which issued its report in June 2000. * The Gilmore Commission: the Advisory Panel to Assess Domestic Response Capabilities for Terrorism Involving Weapons of Mass Destruction, chaired by Governor James S. Gilmore, III, which issued its final report in December 2003. * The Hart-Rudman Commission: the U.S. Commission on National Security/ 21st Century, chaired by Senators Gary Hart and Warren B. Rudman, which issued its final report in February 2001. * The 9/11 Commission: the National Commission on Terrorist Attacks upon the United States, chaired by Governor Thomas H. Kean, which issued its final report in July 2004. Scope and Methodology: To determine whether the key federal departments addressed strategy initiatives in their planning and implementation activity, we identified the 43 major initiatives and the six key federal departments for review. We evaluated each department's high-level strategic planning documents related to homeland security to determine if they had planning or implementation activities related to each initiative. To satisfy the planning and implementation criteria, we generally required departments to provide documentary support for one such activity, per initiative. Where classified or undocumented activities were involved, we worked with department officials to verify the activity. We provided the results of our analyses to planning officials from the various departments for their verification. Additionally, we reviewed the language in the strategy and HSPDs to determine which departments had been identified as lead agencies in implementing the initiatives. In some cases, the leadership language was clear; in other cases, it was less precise or implied. We were then able to determine whether departments demonstrated planning or implementation activities in both lead and nonlead initiatives. Our analysis is necessarily a snapshot of activity as of particular points in time. The agencies reviewed provided us with information as to their planning and implementation as of various dates, including fiscal year 2004. We recognize that the agencies continue to plan and implement their strategies and programs and have and may continue to progress beyond the status portrayed in this analysis. Finally, our work did not assess the status or quality of the work being planned or implemented. To determine homeland security challenges facing the nation, we reviewed our reports issued since September 11. This included over 250 products cutting across the gamut of homeland security activities. We summarized and categorized the challenges by critical mission area and subtopic where appropriate (e.g., the Border and Transportation Security mission area was subdivided into border security and transportation security). While our summary is limited to challenges we identified, we have noted in the text where the congressionally chartered commissions have raised similar issues. We recognize that these commissions, Congress, the executive branch, and other organizations have identified additional challenges in each of the mission areas. We conducted our work between February and November 2004 in accordance with generally accepted government auditing standards. For more details on our objectives, scope, and methodology, see appendix I. Agency Plans, Implementation, and Challenges: The following sections provide summaries of each mission area, as well as issues that cut across all six mission areas. These summaries include an analysis of federal departments' strategic planning and implementation activities and the challenges faced by these departments and the nation as a whole. Intelligence and Warning: The strategy identifies five initiatives under the Intelligence and Warning mission area. All of the initiatives are covered by at least two departments planning or implementation activities (see table 1). Examples include DOJ and DOE activities to enhance the analytic capabilities of the Federal Bureau of Investigation (FBI); DHS, State, and DOE activities to utilize dual-use analysis to prevent attacks; and DHS, DOD, and DOE activities to employ red-team techniques. Four of the five initiatives have a department identified as a lead agency. Neither the strategy nor the HSPDs identified a lead agency on the fifth initiative, which relates to the employment of red-team techniques. According to DHS strategic planning officials, it is important that a number of agencies conduct red-team techniques to test their own specific programs, so no agency would necessarily have the overall lead. See appendix II for a more detailed discussion on the implications of not having an overall lead agency identified for red- team techniques. For this mission area, the lead agency specifications are clear (rather than implied), and there are no multiple leads on any of the initiatives. All five initiatives were being implemented in fiscal year 2004 as reported by two or more departments (see table 7). DHS and DOJ cited 2004 implementation activity for each of the initiatives for which they were identified as lead agencies. Table 1: Department Leadership, Planning, or Implementation Activity in the Intelligence and Warning Mission Area's Five Initiatives: [See PDF for image] [End of table] Refer to appendix II for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. As explained further in appendix II, we did not include CIA in our analysis because of the lack of funding data and because the strategy provides little discussion of the agency. Our work in the Intelligence and Warning mission area since 2001 has highlighted a number of challenges that need to be addressed. Many of these challenges are directly related to initiatives in this mission area. These challenges include: * improving analysis capabilities at the FBI through better strategic information management, * developing productive information-sharing relationships among the federal government and state and local governments and the private sector, * overcoming the limitations in the sharing of classified national security information across sectors, * ensuring that the private sector receives better information on potential threats, * consolidating watch lists to promote better information and sharing, and: * maintaining a viable and relevant homeland security advisory system. These challenges are discussed in greater detail in appendix II. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Border and Transportation Security: There are six initiatives under the Border and Transportation Security mission area. All of the initiatives are covered by at least two departments' planning or implementation activities (see table 2). Examples include DHS, DOD, HHS, State, and DOE activities to ensure accountability in border and transportation security; DHS, DOD, State, and DOE activities to increase the security of international shipping containers; and DHS, DOJ, and State activities to reform immigration services. All six initiatives have a department identified as a lead agency. One initiative (i.e., creating smart borders) has multiple lead agencies identified in the strategy and HSPDs. DHS is a lead on the most initiatives: a clear lead on two initiatives and an implied lead on four other initiatives. All six initiatives were being implemented in fiscal year 2004 as reported by one or more departments (see table 8). DHS and State cited 2004 implementation activity in each of the initiatives for which they were identified as leads. DOJ had been identified as a lead agency with respect to creating smart borders and reforming immigration services, but with the transfer of the Immigration and Naturalization Service to DHS, DOJ officials indicated that the department was no longer serving as a lead on that initiative. Table 2: Department Leadership, Planning, or Implementation Activity in the Border and Transportation Security Mission Area's Six Initiatives: [See PDF for image] [End of table] Refer to appendix III for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. Border and Transportation Security is another mission area where our work has indicated there are challenges to be addressed. Again, many of these challenges are directly related to initiatives in this mission area. These challenges include: * striking an acceptable balance between security and the flow of commercial activity, travel, and tourism; * processing people at our nation's land ports of entry and determining the proper role of biometric technologies for security applications; * deploying the best available technologies for detecting radioactive and nuclear materials at U.S. ports of entry; * developing a clear and comprehensive policy on the use of visas as an antiterrorism tool and improving the management and oversight of programs to track visitors; * implementing an effective system to prescreen passengers prior to their arrival at the airport, as well as achieving and sustaining improvements in airline passenger and baggage screening; and: * strengthening perimeter security at airports and countering the threat of hand-held missiles to commercial aviation. These and other challenges are discussed in greater detail in appendix III. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Domestic Counterterrorism: The Domestic Counterterrorism mission area has six initiatives. All of the initiatives are covered by at least one department's planning or implementation activities (see table 3). Examples include DHS, DOJ, DOD, HHS, and DOE activities to improve intergovernmental law enforcement coordination; DHS, DOJ, DOD, and State activities to facilitate apprehension of potential terrorists; and DHS, DOJ, and State activities to target and attack terrorist financing. Each of the six initiatives has a department that is identified as a lead agency. All indicated leads from the strategy and HSPDs are clear leads. For three of the six initiatives, multiple departments have been identified as leads. All 6 initiatives were being implemented in fiscal year 2004 as reported by one or more departments (see table 9). DOJ cited 2004 implementation activity on each of the six initiatives for which it was identified as a lead. DHS and State also cited implementation activity on all initiatives for which they were identified as lead agencies. Table 3: Department Leadership, Planning, or Implementation Activity in the Domestic Counterterrorism Mission Area's Six Initiatives: [See PDF for image] [End of table] Refer to appendix IV for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. Domestic Counterterrorism is another mission area where our recent work has highlighted continuing challenges. These challenges threaten to undermine law enforcement agencies' ability to aggressively detect, deter, prevent, eradicate, and adjudicate terrorist activity. These challenges include: * transforming the FBI from an investigative organization into a proactive entity focused on detecting and preventing terrorist activity, * modifying the FBI's related workforce and business practices to focus on counterterrorism and intelligence-related priorities, * improving interagency coordination to leverage existing law enforcement resources to investigate money laundering and terrorist financing, * monitoring the use of alternate financing mechanisms by terrorists, * identifying and apprehending terrorists already present in the United States, and: * recognizing counterfeit documentation and the use of identity fraud at U.S. borders and other security checkpoints. These challenges are discussed in greater detail in appendix IV. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Protecting Critical Infrastructures and Key Assets: The strategy identifies eight initiatives under the Protecting Critical Infrastructures and Key Assets--commonly referred to as Critical Infrastructure Protection (CIP)--mission area. All of the initiatives are covered by at least four departments' planning or implementation activities (see table 4). Examples include DHS, DOJ, DOD, HHS, and DOE activities to unify America's infrastructure protection effort in DHS; DHS, DOD, HHS, and DOE activities to develop a national infrastructure protection plan and, all six departments' activities to secure cyberspace. Each of the eight initiatives has a department identified as a lead agency. In the case of five of the eight initiatives, the leads are clear; only in the case of three initiatives (i.e., enabling effective partnership with state and local governments and the private sector, securing cyberspace, and partnering with the international community to protect our transnational infrastructure) are there implied leads. For three of the eight initiatives, multiple lead agencies have been identified. For example, DOD, HHS, and DOE are all sector leads on the same initiative--building and maintaining a complete and accurate assessment of America's critical infrastructure and key assets. These departments have the sector leads as follows, DOD for defense industrial base, HHS for public health, and DOE for the energy sector. All eight initiatives were being implemented in fiscal year 2004 as reported by two or more departments (see table 10). DHS, DOD, HHS, State, and DOE cited implementation activity on all initiatives for which they were identified as lead agencies. Table 4: Department Leadership, Planning, or Implementation Activity in the Critical Infrastructure Protection Mission Area's Eight Initiatives: [See PDF for image] [End of table] Refer to appendix V for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. Our work related to CIP has identified several challenges. Overcoming the challenges presented in this mission area is made even more difficult because increasing the security of one type of target, such as aircraft or federal buildings, increases the possibility that terrorists may choose another type of target, such as trains or ports. The challenges include: * refining the federal government's role in managing CIP; * developing a comprehensive and coordinated national CIP plan that delineates the roles, defines interims objectives and milestones, sets time frames, and establishes performance measures; * developing productive information-sharing relationships within the federal government and among federal, state, and local governments and the private sector; * improving the federal government's capabilities to analyze incident, threat, and vulnerability information related to critical infrastructures and key assets; * improving the security of government facilities through a variety of methods, including better training and procedures to detect counterfeit documents and identity fraud; and: * analyzing the strengths, interdependencies, and vulnerabilities of several specific industries, including the financial services sector, the shipping and postal system, drinking water, agriculture, the chemical industry, nuclear power plants, and nuclear weapons sites. These challenges are discussed in greater detail in appendix V. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Defending Against Catastrophic Threats: There are six initiatives under the Defending against Catastrophic Threats mission area. All of the initiatives are covered by at least two departments' planning or implementation activities (see table 5). Examples include DHS, DOD, State, and DOE activities to prevent terrorist use of nuclear weapons through better sensors and procedures; DHS, DOD, HHS, and DOE activities to detect chemical and biological materials and attacks; and DHS, DOD, HHS, State, and DOE activities to harness the scientific knowledge and tools to counter terrorism. Each of the six initiatives has a department identified as a lead agency. On half the initiatives, multiple departments have been identified as leads. In the case of three initiatives, the leads are clear; in the case of the remaining three initiatives, several leads are implied. All six initiatives were being implemented in fiscal year 2004 as reported by one or more departments (see Table 11). DHS cited implementation activity in five of the six initiatives for which it was identified as a lead. It is not yet implementing the Select Agent Program. DOD, HHS, State, and DOE cited implementation activity on all the initiatives for which they were identified as the lead agency. Table 5: Department Leadership, Planning, or Implementation Activity in the Defending Against Catastrophic Threats Mission Area's Six Initiatives: [See PDF for image] [End of table] Refer to appendix VI for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. The challenges the nation faces in defending itself against catastrophic threats--such as the terrorist use of chemical, biological, radiological, or nuclear (CBRN) weapons--are quite broad and could have devastating consequences if not effectively addressed. Our recent work in this mission area has highlighted challenges that include: * strengthening efforts to keep weapons of mass destruction (WMD) and dual-use items (items having both commercial and military applications) out of the hands of terrorists, * controlling the sale of excess items that can be used to produce and deliver biological agents, and: * designating lead agencies for setting priorities for information systems related to terrorism. These challenges are discussed in greater detail in appendix VI. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Emergency Preparedness and Response: For the Emergency Preparedness and Response mission area, the strategy identifies 12 initiatives. All of the initiatives are covered by at least two departments' planning or implementation activities (see table 6). Examples include DHS, DOD, HHS, and DOE activities to create a national incident management system; DHS and HHS activities to enable seamless communications among all responders; and, DHS, DOD, HHS, and DOE activities to augment America's pharmaceutical and vaccine stockpiles. Each of the 12 initiatives has a department identified as a lead agency. For 3 of the 12 initiatives, multiple lead agencies have been identified. All leads, with three exceptions, are clear leads. All 12 initiatives were being implemented in fiscal year 2004 by two or more departments (see table 12). DHS, DOD and HHS cited implementation activity in 2004 for all initiatives for which they were identified as lead agencies. Table 6: Department Leadership, Planning, or Implementation Activity in the Emergency Preparedness and Response Mission Area's Twelve Initiatives: [See PDF for image] [End of table] Refer to appendix VII for more specific details regarding department planning and implementation activities, including a discussion of fiscal year 2004 implementation. Our recent work has shown that there are many challenges in the Emergency Preparedness and Response mission area regarding efforts to effectively minimize the damage and successfully recover from terrorist attacks. We identified the following challenges: * adopting an "all hazards" approach to emergency preparedness and response; * providing better governmental planning and coordination with regard to first responder issues; * preparing first responders for incidents involving catastrophic terrorism; * restructuring the federal grant system for first responders; * strengthening public health in a variety of areas, including better information sharing, preparations for catastrophic terrorism such as bioterrorism, and more hospital equipment; * improving regional response planning involving multiple municipalities, states, and countries; * establishing and implementing preparedness standards and measures; * ensuring adequate communications among first responders and with the public; and: * defining the roles and responsibilities of DOD in defending the homeland and providing military support to civil authorities. These challenges are discussed in greater detail in appendix VII. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. Crosscutting Issues: Our recent work has also identified homeland security challenges that cut across the various mission areas. While it is important that the major mission challenges be individually addressed, it is equally important that these challenges be addressed from a comprehensive national homeland security perspective (i.e., some mission areas overlap, some challenges are common across mission areas, some corrective actions have ramifications, and there are both positive and negative challenges across mission area boundaries). Coordinated actions may substantially enhance multiple mission performance. The National Strategy for Homeland Security and the corresponding strategic plans of the agencies accountable for achieving the national strategy's objectives must address and resolve the sometimes competing issues among homeland security mission areas and between homeland security and other important national priorities and objectives. These crosscutting issues are often the most difficult to address. Some of these challenges that we have identified are governmentwide in nature--they cut across the federal, state, and local governments, and sometimes private sectors. Such governmentwide challenges that we have identified include: * balancing homeland security needs with other national requirements by formulating realistic budget and resource plans that support the implementation of an efficient and effective homeland security program; * providing timely and transparent homeland security funding information that sets forth detailed information concerning the obligation of the funding provided; * improving risk management methods for resource allocation and investments by developing a commonly accepted framework and supporting tools to guide agency analysts in providing information to management; * establishing baseline performance goals and measures upon which to assess and improve prevention efforts, evaluate vulnerability reduction, and gauge responsiveness to damage and recovery needs at all levels of government; * clarifying the roles and responsibilities within and between the levels of government and the private sector through the development and implementation of an overarching framework and criteria to guide the process; * developing a national blueprint--called an enterprise architecture-- to help integrate different organizations' efforts to improve homeland security; and: * improving governmentwide information technology management through the consistent application of effective strategic planning and performance measurement practices. These challenges are discussed in greater detail in appendix VIII. Many of these challenges were also discussed by one or more of the Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions. In addition to the challenges discussed earlier, DHS--as the department most responsible for Homeland Security--faces a number of challenges. Because of this, in January 2003, we designated the overall implementation and transformation of DHS as high-risk.[Footnote 9] We gave it this designation for three reasons. First, the size and complexity of the effort make the challenge especially daunting, requiring sustained attention and time to achieve the department's mission in an effective and efficient manner. Second, the components being merged into DHS already face a wide array of existing challenges that must be addressed. Finally, if DHS cannot effectively carry out its mission, it exposes the nation to potentially very serious consequences. We are currently in the process of reviewing the challenges faced by DHS and the progress it has made to address these challenges. The results of this review will be published in a forthcoming GAO report. Concluding Observations: All 43 initiatives of the National Strategy for Homeland Security were included in plans and implementation activities in fiscal year 2004 by at least one of the six key departments we reviewed. Further, 33 of the 43 initiatives (77 percent) were being planned or implemented by at least three of the six departments. Additionally, we found that the strategy and HSPDs identified lead agencies for 42 of the 43 initiatives. For these 42 initiatives where a lead had been identified, 13 initiatives had leads that were implied rather than clear. While DHS was identified as the lead for the most initiatives (37), there were multiple leads for 12 of these 42 initiatives. Given the large number of initiatives being implemented by multiple agencies, the fact that some of the leads were implied rather than clear, and the fact that about a third of the initiatives had multiple leads, coordination across federal departments will be a key factor required for the successful implementation of the strategy. Such coordination would ensure that federal departments are working to support the lead agency, are complementing one anothers' leadership when there are multiple lead agencies, and are not unnecessarily duplicating one anothers' programs when there are multiple departments implementing the same initiatives. When implementing the strategy's initiatives, these federal departments face a number of challenges that cut across all the mission areas. In terms of resources, the nation must find the appropriate balance between homeland security and other priorities. Finding this balance will require an improved risk management framework for resource allocation and investments. It will also require an improved set of performance and results measures to gauge our progress. Further, finding that balance must take into consideration nonfederal resources, but the strategy and HSPDs have not in many cases defined the roles and responsibilities of the state, local, and private sectors. Finally, an enterprise architecture would help coordinate the larger effort across the myriad of organizations involved in implementing the strategy. One of the key challenges for the Congress is to provide oversight to ensure that federal departments are coordinating their activities as they attempt to implement the National Strategy for Homeland Security. Agency Comments and Our Evaluation: We provided a draft of this report to DOD, DOE, DOJ, HHS, DHS, the State Department, and the Homeland Security Council for comment. We received written comments from DOD, HHS, DHS, and DOJ, which appear in appendixes XI -XIV respectively. In addition to providing their written comments, these departments and DOE provided technical comments, which we incorporated as appropriate. State and the Homeland Security Council declined to provide any comments on this report. DOD stated that the report was "a thorough and accurate report." DHS indicated our summation of the strategic planning, implementation, and leads of the six departments to be "particularly useful." DOE, DOJ, and HHS neither concurred nor disagreed with the report. In addition, agencies provided comments on the many GAO reports that cumulatively describe the range of implementation challenges featured in this capping report. These comments can be found in the appropriate reports, as cited in our footnotes and listed in the Related GAO Products section. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will provide copies of this report to appropriate departments and interested congressional committees. We will also make copies available to others upon request. In addition, the report will be available at no charge on GAO's Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me on 512-6787. Other contacts and staff acknowledgments are listed in appendix XV. Sincerely yours, Signed by: Norman J. Rabkin, Managing Director: Homeland Security and Justice Issues: [End of section] Appendix I: Objectives, Scope, and Methodology: The first objective focuses on the extent to which key federal departments with homeland security responsibilities address the 43 initiatives of the National Strategy for Homeland Security in their planning and implementation activities. We selected departments based on a review of their fiscal year 2005 budget requests for homeland security-related issues. The six departments with the largest budget requests were selected--together they account for 94 percent of the fiscal year 2005 budget requests for homeland security. The six departments are the Departments of Defense (DOD), Energy (DOE), Health and Human Services (HHS), Homeland Security (DHS), Justice (DOJ), and State. We defined three time-oriented indicators to distinguish the timing of the departments' strategic planning or implementation activities with respect to each of the 43 initiatives of the six mission areas. * "Prior implementation" was defined as a departmental program or activity that occurred prior to fiscal year 2004. * "Recent planning" was defined as either (1) a program or activity specifically indicated by the participating department as being developed in its latest high-level planning documents (which include the department's strategic plan, annual plan, or performance plan) or (2) a program or activity, not listed in these planning documents, but indicated by department officials as being under development since July 2002 (when the strategy was issued). * "2004 implementation," in turn, was defined as a departmental program or activity that occurred during all, or part, of fiscal year 2004. A department could satisfy (a) neither of these indicators (demonstrating no strategic planning and implementation activities on a given initiative, within the prescribed time periods) or (b) combinations of one through three of these indicators, for each initiative (e.g., one department may have engaged in prior implementation that was carried over into fiscal year 2004 implementation; a second department may have engaged in recent planning, followed by 2004 implementation; and a third department may have only engaged in prior implementation, as its activity was completed or terminated.) We obtained and reviewed each department's latest strategic planning documents (i.e., their strategic plan, annual plan, and performance plan) to determine whether these documents provided specific information about the department's prior implementation and recent planning activities, with respect to each mission area initiative. We scored a department as engaging in prior implementation activity or recent planning if these documents demonstrated at least one such activity with respect to each initiative. We also reviewed the documents to determine if any programs or activities had been transferred to another department or agency. In some cases, this may account for prior implementation activity but no further planning or implementation activity. Since the latest departmental strategic documents do not sufficiently address fiscal year 2004 implementation activities, we contacted strategic planning officials at each the six departments and asked them to provide evidentiary support for their 2004 implementation activities, with respect to each relevant initiative. We scored a department as implementing activities on a given initiative if the department could demonstrate at least one such activity occurring during fiscal year 2004 with respect to that initiative. We also requested department strategic planning officials to review our findings regarding planning and implementation and to make any modifications or additions necessary. Evidentiary support was requested for any such change. Very few changes were provided across all six departments. Departments provided the data during fiscal year 2004. We did not verify the accuracy of the data or the progress of particular activities. In addition to identifying departmental engagement in planning and implementation activities, we also sought to determine departmental leadership responsibility on each initiative. To satisfy the leadership role, departments had to satisfy at least one of the following two indicators: * leadership of the entire critical mission area initiative or: * leadership in specific functional area(s) encompassed within that initiative. We identified departmental leadership roles on specific initiatives, based on a review of the provisions in the strategy and Homeland Security Presidential Directives (HSPD) one through 12. In only a few instances did a department indicate to us that subsequent legislation, regulation, or transfer of activities absolved them of their leadership roles. Because the language of the strategies and HSPDs was not always precise, we identified departments as either (a) "clear" (explicit) leads, (b) "implied" leads, or (c) no leads for each initiative. In the mission area tables, in both the letter and appendixes, departments with a clear lead on a given initiative are indicated by a hard-line box; departments with an implied lead on a given initiative are indicated by a broken-line box; departments not having any lead on a given initiative have no box designations. Drafts of this section of the report were submitted to the departments for their review. The second objective focuses on identifying the challenges the nation faces in homeland security implementation. This work is based exclusively on a review of challenges identified in GAO products issued since September 11, 2001. During this time period, we were able to identify over 250 relevant GAO products related to homeland security. These, and others, can be found in our Related Products section at the end of the report. The challenges identified are arrayed throughout the report by mission area and subtopical area. We conducted our work between February and November 2004 in accordance with generally accepted government auditing standards. [End of section] Appendix II: Intelligence and Warning: This appendix sets forth the definition and major initiatives of the Intelligence and Warning mission area and discusses the agencies with major roles, their funding, and the alignment of their strategic plans and implementation activities with the initiatives, and a summary of the key challenges faced by the nation. This appendix presents baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Intelligence and Warning mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six critical mission areas, the first of which is Intelligence and Warning. This mission area includes intelligence programs and warning systems that can detect terrorist activity before it manifests itself in an attack so that proper preemptive, preventive, and protective action can be taken. Specifically, this mission area is made up of efforts to identify, collect, analyze, and distribute source intelligence information or the resultant warnings from intelligence analysis. Activities in this mission area often dovetail into the mission areas of domestic counterterrorism and, in some cases, critical infrastructure protection, as agencies move to take immediate action or develop long-term protective measures based on threat or vulnerability information.[Footnote 10] Figure 3 is an example of one of the initiatives found in the Intelligence and Warning mission area. The strategy identifies the following initiatives in the Intelligence and Warning mission area: * enhancing the analytic capabilities of the FBI, * building new capabilities through the Information Analysis and Infrastructure protection Division of the Department of Homeland Security, * implementing the Homeland Security Advisory System, * utilizing dual-use analysis to prevent attacks, and: * employing red team techniques. Figure 3: The Five Threat Levels of the Homeland Security Advisory System: [See PDF for image] [End of figure] Agencies with Major Roles in Intelligence and Warning: Of the six departments under review, the Department of Homeland Security and the Department of Justice have major roles in the Intelligence and Warning mission area. Within DHS, the Information Analysis and Infrastructure Protection Directorate (IAIP) analyzes terrorism-related threat information relevant to homeland security, associates threat analysis with infrastructures and people, and provides warnings and advisories to agencies, state and local governments, and select critical infrastructure owners and operators. The U.S. Secret Service, also a component of DHS, provides intelligence and advanced analysis for protective operations. The Department of Justice has two components involved in Intelligence and Warning activities--the Federal Bureau of Investigation (FBI) shares intelligence with other federal agencies, as well as with state and local authorities; while the Office of Justice Programs (OJP) funds counterterrorism training for senior law enforcement personnel at the state and local level. The Office of Management and Budget (OMB) reported that the total fiscal year 2005 funding request for the Intelligence and Warning mission area is $474 million, with the bulk of this funding going to DHS (61 percent), primarily for IAIP and the U.S. Secret Service. Other agencies with significant funding in this mission area include DOJ (19 percent), primarily for the FBI, and the Intelligence Community (15 percent) for the Terrorist Threat Integration Center (TTIC).[Footnote 11] Figure 4 summarizes the fiscal year 2005 budget request for the Intelligence and Warning mission area by agency. Figure 4: Proposed Fiscal Year 2005 Homeland Security Funding for Intelligence and Warning: [See PDF for image] Notes: Budget authority in millions of dollars. [End of figure] "All other agencies" includes the Departments of Agriculture ($20 million) and Treasury ($.6 million), as well as the Intelligence Community Management Account ($72 million). OMB reported the Intelligence Community figure in aggregate; it did not break it out by individual agencies (e.g., Central Intelligence Agency). OMB's reported data does not include funding for three departments that have activities under way in this mission area. These departments-- Defense, State, and Energy--have either planning or implementation activity on specific initiatives, as discussed in the next section of this appendix. On the basis of our previous work, we have noted several qualifications to OMB's figures to explain this discrepancy.[Footnote 12] According to OMB officials, there is not always a clear distinction between homeland security activities and other related activities. The OMB staff must make judgment calls about how to characterize funding by mission areas. For example, some homeland security activities have multiple purposes, so funding for these activities can be allocated among several accounts covering multiple mission areas. Moreover, some of the departments' activities, such as planning, coordination, or providing advice may support Intelligence and Warning activities, but are not included in the amounts shown. This appendix does not have any discussion of the Central Intelligence Agency (CIA) or the Intelligence Community as a whole, although they have activities related to the Intelligence and Warning mission area. There are two reasons for this omission. First, OMB's reported data do not include funding for the CIA. Second, the strategy itself is relatively silent on the CIA in terms of specific initiatives in this mission area. For example, the strategy only mentions the CIA once in the Intelligence and Warning mission area--the CIA was to provide intelligence analysts to assist the FBI enhance its analytic capabilities. Most of the initiatives in the strategy, as discussed in the next section, are led by DHS or DOJ. Similarly, there is little information on the Intelligence Community. While OMB reported data include $72 million in spending by the Intelligence Community Management Account, it does not break this amount out by specific departments or agencies. While the strategy mentions the Intelligence Community with respect to this mission area, it does not identify specific departments or agencies with specific initiatives. One potential reason for relatively little discussion of CIA and the Intelligence Community is the unclassified nature of the cost data and the strategy. Alignment of Department Activities with the Major Initiatives: This section provides more detailed information about the Intelligence and Warning mission area initiatives, and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning and implementation activities, lead agency designation, and implementation activities in fiscal year 2004, with respect to each initiative. The data are summarized in table 7. Table 7: Detailed Department Leadership and Planning/Implementation Activities in the Intelligence and Warning Mission Area's Five Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All five Intelligence and Warning initiatives are being addressed in at least two of the key departments' planning and implementation activities (see table 7). For example, DHS, DOD, and DOE implemented Homeland Security Advisory System initiative activities during fiscal year 2004. More specifically, DHS implemented the system and issued advisories; DOD personnel interacted with DHS; and DOE aligned its security system and condition alert level to meet the Homeland Security Advisory System requirements of DHS. In addition, DHS, DOD, and DOE implemented new intelligence and warning capabilities through the IAIP initiative of DHS during fiscal year 2004. Specifically, DHS conducted assessments of critical infrastructures and key assets using the IAIP system; DOD worked in conjunction with DHS on the IAIP system; and DOE enacted a Safeguard and Security Program (using infrastructure information and analysis to gauge vulnerability assessments) and plays a role in disseminating threat information to energy sector industries. The Department of Health and Human Services (HHS) also has activities related to Intelligence and Warning, but these activities are not directly included under the initiatives as laid out by the strategy. For example HHS operates the Laboratory Response Network, the Epidemic Information Exchange, and the Food and Drug Administration's food inspection activities. In addition, it supports the DHS-managed BioWatch program. While the strategy does not list these as specific initiatives, they provide surveillance of infectious diseases and could provide early warning of a bioterrorism attack. For more on HHS's role, particularly with respect to bioterrorism, see appendix VI, on Defending against Catastrophic Threats. While we have identified department activities related to these initiatives, we did not determine the quality, status, or progress of such activities with respect to stated goals or targets within this mission area. Identification of Lead Agencies on the Initiatives: For four of the five initiatives, a lead agency is identified either in the strategy or Homeland Security Presidential Directives (HSPDs). The one initiative where there was no lead identified was "the employment of red-team techniques." Red team techniques are techniques where the U.S. government would create a team (sometimes known as a red cell) to play the role of terrorists in terms of identifying vulnerabilities and planning attacks. Three departments (DHS, DOD, and DOE) had implemented activities related to this initiative. According to DHS strategic planning officials, it is important that a number of agencies conduct red-team techniques to test their own specific programs, so no agency would necessarily have the overall lead. However, terrorists are opportunistic and may purposefully plan attacks that take advantage of the seams between department programs or jurisdictions. Thus, there is some value in employing red-team techniques that look across federal departments, as well as across the state, local, and private sectors. Without an overall lead agency identified for this initiative, it is unclear which federal department will be accountable for employing red- team techniques at the interagency level against the nation as a whole. As shown in table 7, DHS is the lead on the most initiatives in this critical mission area--three out of the five initiatives (including building new capabilities through the Information Analysis and Infrastructure Protection Division, implementing the Homeland Security Advisory System, and utilizing dual-use analysis to prevent attacks). It is understandable that DHS would be the department with the most initiative leads given that DHS's strategic goals and objectives are to be directed toward preventing terrorist attacks in the United States and reducing America's vulnerability to terrorism--both of which require Intelligence and Warning system information to achieve their aims. The Department of Justice is a lead on one initiative, enhancing the analytic capabilities of the FBI. This, too, is understandable given that the FBI is an agency (or component) of DOJ. The strategy and HSPDs did not identify multiple leads on any of the five Intelligence and Warning initiatives (see table 7). In addition, these strategic documents clearly named all leads. DHS is named as a clear lead on three Intelligence and Warning initiatives; DOJ is identified as a clear lead on one initiative. Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004, implementation activity occurred with respect to each of the five Intelligence and Warning initiatives (see table 7). DHS implemented activity in each of the three initiatives for which it was identified as a lead. DOJ implemented activity in the one initiative for which it was named as the lead (enhancing the analytic capabilities of the FBI). Additionally, several of the departments under review implemented multiple Intelligence and Warning initiative activities for which they were not identified as a lead. During fiscal year 2004, DOE cited implementation activities in four of the five Intelligence and Warning initiatives for which it did not have a lead (prior to fiscal year 2004, it cited implementation activity with respect to three of the five initiatives.) DOD cited fiscal year 2004 implementation activities in 3 of 5 initiatives for which it did not have a lead. DHS cited planning and implementation activities during fiscal year 2004 on the one initiative for which it did not have lead responsibilities; and State cited both prior implementation and 2004 implementation activity on the one initiative for it was not cited as a lead in the strategy or HSPDs. Challenges in Intelligence and Warning: With the element of surprise on their side, terrorists have the potential to do massive damage to an unwitting and unprepared target. It therefore follows that the United States must take appropriate action to develop and implement an effective Intelligence and Warning system that is capable of detecting planned terrorist activity, so that proper preemptive, preventive, and protective action can be taken. Our recent work in the Intelligence and Warning mission area has identified a number of challenges. These challenges include enhancing the analytical capabilities of the FBI, improving the coordination and mechanisms for sharing intelligence information across levels of government and the private sector, consolidating terrorist watch lists, and strengthening the homeland security advisory system. Enhancing the FBI's Analytical Capabilities: The strategy has an initiative to enhance the FBI's analytic capabilities in order to address the agency's top priority--preventing terrorist attacks. The FBI is, therefore, "creating an analytical capability that can combine lawfully obtained domestic information with information lawfully derived from investigations, thus facilitating prompt investigation of possible terrorist activity within the United States." To accomplish this, the FBI has changed its priorities and accelerated modernization of its information technology (IT) systems. However, we reported in September 2003 that the FBI will be facing a number of challenges as it begins this modernization without having yet developed a modernization blueprint, commonly referred to as an enterprise architecture (a plan that defines how an organization operates today, intends to operate tomorrow, and intends to invest in IT systems to transition to this future state).[Footnote 13] Architectures are essential to effectively managing such complex endeavors and are recognized as hallmarks of successful public and private organizations. The challenge for the FBI will be to make architecture development an institutional management priority; until this is accomplished and the architecture is developed and implemented, the FBI faces the challenge of ensuring systems currently being developed and deployed will be consistent with the yet-to-be-developed architecture. Our research and experience at federal agencies has shown that attempting a major modernization effort without a well-defined and enforceable architecture results in systems that are duplicative and not well integrated, are unnecessarily costly to operate and maintain, and do not effectively optimize mission performance. Additional challenges related to the FBI's transformation are contained in appendix IV, on domestic counterterrorism. The Bremer, Hart-Rudman, Gilmore, and 9/11 Commissions all made recommendations related to this challenge. Improving Intelligence Information Sharing: According to the strategy, "homeland security intelligence and information must be fed instantaneously into the Nation's domestic anti-terrorism efforts, and "this effort must be structured to provide all pertinent homeland security intelligence and law enforcement information--from all relevant sectors including state and local law enforcement as well as federal agencies--to those able to take preventive or protective action." Since September 11, federal, state, and local governments have established initiatives to meet the challenge of sharing information to prevent terrorism. DHS has initiatives under way to enhance information sharing (including the development of a homeland security enterprise architecture to integrate sharing among federal, state, and local authorities). In addition, the FBI increased the number of its Joint Terrorism Task Forces, the Defense Intelligence Agency (DIA) entered into an information-sharing partnership with the state of California and the city of New York; and Massachusetts has established an antiterrorism network of state, local, and federal agencies. However, our August 2003 report[Footnote 14] noted that these initiatives, while beneficial for the partners, presented challenges because they (1) were not well coordinated, (2) rsked limiting participants' access to information, and (3) potentially duplicated the efforts of some key agencies at each level of government. We also found that despite various legislation, strategies, and initiatives, federal agencies, states, and cities did not consider the information sharing process to be effective. For example, information on threats, methods, and techniques of terrorists was not routinely shared, and the information that was shared was not perceived as timely, accurate, or relevant. Additionally, federal agencies were challenged by the inability of state or city governments to properly handle classified information and their lack of security clearances. The Gilmore and 9/11 Commissions made recommendations related to this challenge. Better Dissemination of Threat Information to the Private Sector: The strategy discusses the need for threat-vulnerability integration, providing that "mapping terrorist threats and capabilities--both current and future--against specific facility and sectoral vulnerabilities will enable authorities to determine which organizations pose the greatest threat and which facilities are most at risk." However, in a March 2003 report we noted that one of the nation's challenges is to develop and implement methods for effectively sharing information between government and the private sector.[Footnote 15] For example, officials in several commercial industries have said that they need better threat information from law enforcement agencies, as well as better coordination among agencies providing threat information. Specifically, these officials stated that they did not receive sufficient specific threat information, and frequently received threat information from multiple government agencies. Similarly, DOJ observed that chemical facilities need more specific information about potential threats in order to design their security systems and protocols. Threat information also forms the foundations for some of the tools available to industry to assess facility vulnerabilities. Threat information is the foundation for hypothesizing about threat scenarios, which form the basis for determining site vulnerabilities. In reviewing security considerations involving commercial seaports, we found that similar challenges existed. Specifically, on the basis of visits to several of the commercial seaports designated by DOD as critical for use by the military for overseas deployments, we reported in October 2002 that although the organizations responsible for seaport security increased emphasis on security planning since September 11, there remained no single mechanism to analyze, coordinate, and disseminate threat information on a routine basis on the broad range of threats at each port. Most threat information was coordinated on an informal basis, increasing the risk that threats--both traditional and nontraditional ones--may not be recognized or that threat information may not be communicated in a timely manner to all relevant organizations, including private sector organizations, at the ports. The Gilmore and 9/11 Commissions made recommendations related to this challenge. Consolidating Terrorist Watch Lists: The strategy recognizes the need for "fully accessible sources of information related to suspected terrorists" through the establishment of a consolidated terrorism watch list. In April 2003 we reported that changing the federal government's diffused and nonstandard approach to developing and using terrorist watch lists--which are essential tools for performing, among other things, the nation's border security mission--involve addressing key management, technical, and legal challenges.[Footnote 16] One of these challenges involves defining and implementing a new approach that overcomes individual agencies' unique culture and mission requirements. For example, a key reason for the varying extent to which watch list sharing is done involves cultural differences among the government and private sector agencies involved in securing our borders. Another challenge to be overcome involves the tendency of the watch lists to have overlapping but not identical sets of data, which makes their consolidation difficult. Additionally, the extent to which such sharing is accomplished electronically is constrained by fundamental differences in the watch lists' systems architecture (that is, the hardware, software, network, and data characteristics of the systems). Finally, while legal requirements have historically been another challenge to sharing, recent legislation has begun to address this barrier. For example, Congress passed the USA PATRIOT ACT, which has significantly changed the legal framework for information sharing when fully implemented, it should diminish the effect of existing legal barriers. The 9/11 Commission made recommendations related to this challenge. Strengthening the Homeland Security Advisory System: The strategy calls for the implementation of the Homeland Security Advisory System as a means of disseminating information regarding the risk of terrorist acts to federal, state, and local authorities; the private sector; and the American people. Utilizing five color-coded threat levels, the system was established by HSPD-3 in March 2002. However, in a March 2004 testimony, we reported that DHS faces challenges in strengthening the advisory system and keeping it relevant and viable. For example, the system has generated questions concerning the quality and timeliness of the threat information being disseminated.[Footnote 17] Specifically, DHS had not yet officially documented communication protocols for threat information and guidance to federal agencies and states, with the result that some federal agencies and states first learn about changes in the national threat level from the media. An additional challenge relates to the comprehensiveness of information provided with regard to actions to be taken in response to changes in the threat level. For example, public warnings did not include guidance on actions to be taken in response to a specific threat. Moreover, federal agencies responding to our inquiries indicated that an additional challenge involves their inability to determine appropriate protective measures to be implemented because of a lack of specific threat information. For example, federal agencies indicated to us that, particularly, region-, sector-, site-, or event-specific threat information--to the extent that it is available--would be helpful. Since the time of our report, DHS has provided more specific warnings by both sector (e.g., the financial sector) and location (e.g., New York and Washington, D.C.). The Gilmore Commission made recommendations related to this challenge. [End of section] Appendix III: Border and Transportation Security: This appendix sets forth the definition and major initiatives of the Border and Transportation Security mission area and discusses the agencies with major roles, their funding, the alignment of their strategic plans and implementation activities with the major initiatives, and a summary of the key challenges faced by the nation. This appendix presents baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Border and Transportation Security mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six critical mission areas, the second of which is Border and Transportation Security. This mission area includes programs designed to fully integrate homeland security measures into existing domestic transportation systems and focuses on promoting the efficient and reliable flow of people, goods, and services across borders, while preventing terrorists from using transportation conveyances or systems to deliver implements of destruction. Activities in this mission area often dovetail into domestic counterterrorism as agencies take law enforcement action to address potential threats to the homeland that may originate along our borders or in our transportation systems. Also, because transportation is a critical infrastructure sector, this mission area is also closely related to the critical infrastructure protection mission area. For example, homeland security actions at seaports would involve activities in both mission areas.[Footnote 18] Figure 5 shows an example of the type of activities found in the Border and Transportation Security mission area. The strategy identifies the following major initiatives in the border and transportation mission area: * ensuring accountability in border and transportation security, * creating smart borders, * increasing the security of international shipping containers, * implementing the Aviation and Transportation Security Act of 2001, * recapitalizing the U.S. Coast Guard, and: * reforming immigration services. Figure 5: U.S. Customs and Border Patrol Marine Officers on the Waters of the Rio Grande, along the United States and Mexico Border: [See PDF for image] [End of figure] Agencies with Major Roles in Border and Transportation Security: Of the six agencies under review, DHS and State have major roles in Border and Transportation Security. Within DHS, the U.S. Customs and Border Protection (CBP) conducts inspections at ports of entry to detect and prevent people and goods from entering the country illegally, while the Bureau of Immigration and Customs Enforcement (ICE) investigates and enforces laws against the unlawful presence of people and goods in the country; the Transportation Security Administration (TSA) performs some aviation security activities, while overseeing others, and coordinates the development of security measures for nonaviation modes of transportation; and the U.S. Coast Guard leads security activities at the nation's ports. State plays a role in this mission area through its administration of the visa program to ensure against travel into the United States by terrorists or others whose presence may undermine U.S. national security. Although not one of six agencies we reviewed, the Department of Agriculture (USDA) also has a role in border and transportation security. Specifically, USDA's Animal and Plant Health Inspection Service (APHIS) performs agricultural quarantine activities and risk analysis at U.S. ports of entry. OMB reported that the total fiscal year 2005 funding request for border and transportation security is $17 billion, with the majority of this going to DHS (almost $16 billion, or 93 percent), largely for CBP, TSA, and the Coast Guard. Other DHS bureaus, as well as other agencies--such as USDA and State--have significant funding in this mission area as well.[Footnote 19] Figure 6 summarizes the fiscal year 2005 budget request for the border and transportation security mission area by agency. Figure 6: Proposed Fiscal Year 2005 Homeland Security Funding for Border & Transportation Security: [See PDF for image] Notes: Budget authority in millions of dollars. "All other agencies includes USDA ($169 million) and the Department of Transportation ($19 million). [End of figure] OMB's reported data do not include funding for three departments that have activities under way in this mission area. These departments--DOD, HHS, and DOE--have either planning or implementation activity on specific initiatives, as discussed in the next section of this appendix. On the basis of previous work, we have noted several qualifications to OMB's figures to explain this discrepancy.[Footnote 20] According to OMB officials, there is not always a clear distinction between homeland security activities and other related activities. OMB staff must make judgment calls about how to characterize funding by mission areas. For example, some homeland security activities have multiple purposes, and funding for these activities is comingled in accounts that can cover multiple mission areas. In addition, some of the departments' activities, such as planning, coordination, or providing advice may support Border and Transportation Security activities but are not included in the amounts shown. Alignment of Department Activities with the Major Initiatives: This section provides more detailed information about the Border and Transportation Security mission area initiatives and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning and implementation activities, lead agency designations, and implementation activities in fiscal year 2004, with respect to each initiative. The data are summarized in table 8. Table 8: Detailed Department Leadership and Planning/Implementation Activities in the Border and Transportation Mission Area's Six Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All six Border and Transportation Security initiatives are being addressed in at least two of the key departments' planning and implementation activities (see table 8). At least three departments cited activity in four of the six initiatives. For example, DHS, DOD, State, and DOE implemented shipping container security initiative (CSI) activities in fiscal year 2004. DHS deployed Customs and Border Protection officers to Malaysia to conduct CSI activity; DOD provided an intelligence perspective on container and port security vulnerabilities, aiding in the development and deployment of technologies; State engaged in diplomatic efforts with additional countries to conclude further CSI agreements; and DOE worked with Lithuania to install nuclear detection equipment at the Vilnius Airport, as well as other airports and other locations in other foreign countries. Additionally, DHS, HHS, and State demonstrated implementation activities in fiscal year 2004 with respect to creating smart borders. DHS developed, acquired, and deployed biometrically enabled, travel document reader technology, at air, sea, and land ports of entry; the Food and Drug Administration within HHS established guidance requiring the registration of domestic and foreign facilities that manufacture, process or hold food for consumption in the United States; and State deployed biometric collection capability to consular posts worldwide. All six departments have been engaged in Border and Transportation Security initiatives. While we have identified department activities relates to these initiatives, we did not determine the quality, status, or progress of such activities with respect to stated goals or targets within this mission area. Identification of Lead Agencies on the Initiatives: For all six initiatives, a lead agency is identified either in the strategy or HSPDs. As shown in table 8, DHS is the lead on the most initiatives in the mission area--six of six initiatives. It is understandable that DHS would be the department with the most initiative leads, given that the initiatives (a) emphasize DHS's twin goals of preventing terrorist attacks and reducing border vulnerability; and (b) reflect a transfer of the Customs Service, Immigration and Naturalization Service, and Coast Guard to DHS. State is also identified as a lead on the initiative to create smart borders. Given the initiative's emphasis on visa issuance and consular office participation in detecting potential terrorists, it seems appropriate that State would be identified in a leadership capacity. DOJ had been identified as a lead agency with respect to two initiatives, creating smart borders and guarding America's critical infrastructure and key assets against "inside" threats. However, given the transfer of the Immigration and Naturalization Service and the National Infrastructure Protection Center programs to the Department of Homeland Security, DOJ officials indicated the department no longer serves as the lead on these two initiatives. Creating smart borders is the only initiative for which there are multiple leads in the Border and Transportation Security area (see table 8). The two department leads in this initiative are DHS and State. Additionally, departmental documents show that DHS is a clear lead on two initiatives and an implied lead on three initiatives. State is a clear lead on its single initiative. Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004 implementation activity occurred with respect to all six Border and Transportation Security initiatives (see table 8). DHS implemented activity in all five initiatives for which it was identified as a lead. State implemented activity in the one initiative where it was designated a lead. Additionally, several of the departments under review implemented multiple Border and Transportation Security initiatives for which they were not identified as a lead agency in the strategy and HSPD. During fiscal year 2004, DOD cited implementation activities in three initiatives for which it did not have any lead responsibilities (prior to fiscal year 2004, DOD cited planning/implementation activity with respect to four of the six initiatives). State cited fiscal year 2004 and prior year implementation activity on three initiatives, for which it was not identified as the lead; HHS cited 2004 implementation activity on two initiatives without lead responsibilities; and DOE cited both 2004 and prior implementation with respect to one initiative. DOJ has not demonstrated fiscal year implementation activity in any initiative within this critical mission area; a DOJ official indicated that this is due to program transfers. In accordance with the Homeland Security Act of 2002, DOJ transferred its Immigration and Naturalization Service programs to DHS. Challenges in Border and Transportation Security: The strategy calls for ensuring the "efficient and reliable flow of people, goods, and services across borders, while preventing terrorists from using transportation conveyances or systems to deliver implements of destruction." Our recent work in the Border and Transportation Security mission area has identified a number of challenges. Among the challenges faced is striking a balance between increased border security with concerns for facilitating legitimate travel and the flow of goods, the need to address problems associated with processing people at the nation's ports of entry, training border security personnel to detect counterfeit documents and fictitious identities, determining the proper role for biometric technologies for security applications, developing a clear and comprehensive visa process, and improving the management of key programs. The challenges that we have identified in ensuring that our transportation system is secure include implementing an effective system to prescreen airline passengers; achieving and sustaining improvements in airline passenger, baggage, and cargo screening; strengthening perimeter security and access controls at airports; adequately addressing rail and mass transit security issues; and recapitalizing the U.S. Coast Guard. Border Security: Balancing Security Concerns with Economic Needs: The strategy recognizes the long-standing challenge of balancing our nation's security and commercial needs and states that the "efficient flow of people, goods, and conveyances engaged in legitimate economic and social activities" must not be impeded. Primary responsibility for ensuring the balance between security and commercial needs falls on DHS's CBP. In a June 2003 testimony, we reported that CBP faces many challenges in trying to accomplish its mission.[Footnote 21] Concerning the efficient flow of people, challenges include detecting false admissibility documents, unifying and enhancing inspector training, providing timely intelligence to the field, and successfully implementing the new entry-exit system. With respect to cargo, CBP has attempted to select and inspect the highest-risk incoming cargo while enabling legitimate cargo to be cleared in a timely manner. These efforts pose a range of challenges, from the availability of threat assessments and actionable intelligence to the capability of nonintrusive inspection technology to detect potentially harmful contraband. Additional challenges faced by CBP include the need to improve its trade compliance program and to successfully implement its new trade-processing information system. The Gilmore, Hart-Rudman, and 9/11 Commissions made recommendations related to this challenge. Effectively Processing People at Land Ports of Entry: The strategy calls for DHS to "verify and process the entry of people in order to prevent the entrance of contraband, unauthorized aliens, and potential terrorists." However, in a June 2003 testimony and an August 2003 report, we indicated that CBP, the entity within DHS that is responsible for carrying out this task, faces several challenges at land ports of entry related to the determination of traveler admissibility and other vulnerabilities in the inspection process.[Footnote 22] In 2003, we testified that CBP inspectors faced a variety of challenges at the ports, including the need to make quick decisions on whether to immediately admit a traveler into the country or refer the traveler for more intensive inspection. This task is made more challenging because (1) United States and certain Canadian citizens may enter this country without presenting a travel document if they make an oral claim of citizenship that satisfies the inspector and (2) travelers who are required to show an identity document can present a variety of documents, some of which can be easily counterfeited. In fact, in October 2003, we testified about the challenges posed by identity fraud and how counterfeit identification can be easily produced and used to create fraudulent identities. We also identified other challenges for CBP at the borders, including ensuring that inspectors are adequately trained in conducting inspections and detecting fraudulent documents and challenges regarding the collection, analysis, and use of intelligence information in the field. The Gilmore, Hart-Rudman, and 9/11 Commissions made recommendations related to this challenge. Effectively Employing Biometric Technologies: The strategy states that the "United States will require visitors to present travel documentation that includes biometric indicators." However, in a November 2002 report and in March and September 2003 testimonies, we reported that challenges exist in determining the proper role of biometric technologies for security applications.[Footnote 23] The first challenge involves recognizing that the use of biometric technology not a panacea for the border security problem. Instead, it is just a piece of the overall decision support system that helps determine whether or not a person is allowed to enter the United States. For example, while biometrics may be useful in reducing document fraud, it may not have much effect on the ability of people to enter the United States through other than official ports of entry. Another major challenge involves questions regarding the technical and operational effectiveness of biometric technologies in applications as large as border control. Additional challenges to be addressed include determining (1) the system's effect on existing border control procedures and people; (2) the costs and benefits of the system, including secondary costs resulting from changes in processes or personnel to accommodate the biometrics; and (3) the system's effect on privacy, convenience, the economy, and relations with other countries. The 9/11 Commission made recommendations related to this challenge. Deploying Effective Technologies for the Detection of Weapons of Mass Destruction: The strategy states that the nation will "develop and deploy non- intrusive inspection technologies to ensure rapid and more thorough screening of goods and conveyances." We reported in October 2002,[Footnote 24] however, that challenges exist with regard to the acquisition and deployment of radiation detection equipment. In particular, we have concerns that DHS has not yet deployed the best available technologies for detecting radioactive and nuclear materials at U.S. border crossings and ports of entry. Specifically, we have found that CBP's primary radiation detection equipment--radiation pagers--have certain limitations and may be inappropriate for the task. For example, according to U.S. radiation detection vendors and DOE laboratory specialists, pagers are more effectively used in conjunction with other radiation detection equipment, such as portal monitors and radio isotope identifiers. A further challenge is the need for a comprehensive plan for installing and using radiation detection equipment at all U.S. border crossings and ports of entry. A comprehensive plan would address, among other things, vulnerabilities and risks; identify the complement of radiation detection equipment that should be used at each type of border entry point--air, rail, land, and sea--and whether the equipment could be immediately deployed; identify longer-term radiation detection needs; and develop measures to ensure that the equipment is adequately maintained. Finally, there is a challenge that goes beyond simply deploying equipment--personnel must be effectively trained in radiation science, the proper use of the detection equipment, and how to identify and respond to alarms. Using Visas as an Antiterrorism Tool: The strategy calls on DHS to "build an immigration services organization that administers immigration laws in an efficient, expeditious, fair, and humane manner" while ensuring "that foreign visitors comply with entry conditions." In carrying out its goal of reforming our nation's immigration services, DHS faces a number of challenges. The first involves the development of a clear policy on how to balance national security concerns with the desire to facilitate legitimate travel when issuing visas. Specifically, we reported in October 2002 that this process should be strengthened for use as an antiterrorism tool.[Footnote 25] We also identified the need for more coordination and information sharing to realize the full potential of the visa process. In addition, there is a need for more human resources and more training for consular officers. An additional challenge concerns the lack of a governmentwide policy on the interagency visa revocation process. This process is an important tool for preventing potential terrorists from entering the country and identifying potential terrorists who have already entered. However, we testified in June 2003 that weaknesses in the process we first identified in June 2003 have not been eliminated, especially those related to the timely transmission of information among government agencies.[Footnote 26] Our review of visas revoked for terrorism concerns from October through December 2002 showed that delays occurred in screening names of suspected terrorists for visa holders, transmitting recommendations to revoke individuals' visas, revoking visas after receiving recommendations to do so, and posting lookouts. We also found delays in notifying immigration officials of the need to investigate individuals with revoked visas who may be in the country and in initiating field investigations of those individuals. Finally, challenges exist because of unresolved legal and policy issues regarding the removal of individuals from the United States based solely on their visa revocation. For example, there needs to be clear, comprehensive policies governing visa processes and procedures so that all agencies involved agree on the level of security screening for foreign nationals both at our consulates abroad and at ports of entry. A third challenge concerns the Visa Waiver Program. This involves discussing the process established by the Departments of Justice and State for determining whether a country is eligible to participate in the program. For example, one of the laws passed since the terrorist attacks of September 11, requires participating countries to issue passports that contain biometric identifiers, such as fingerprints. However, it is unclear whether these requirements will be fully implemented by the deadlines called for in the law. In our November 2002 report,[Footnote 27] we also pointed out that the national security challenges created by eliminating the Visa Waiver Program are difficult to determine, but that doing so could affect U.S. relations with other countries, U.S. tourism, and State Department resources abroad. For example, if the program were eliminated, we estimated that the department's initial costs to process the additional workload would range between $739 million and $1.28 billion, and annual recurring costs would likely range between $522 million and $810 million. It could take 2 to 4 years or longer to put the necessary people and facilities in place to handle the increased workload, according to State officials. An additional challenge involves reducing the time taken to adjudicate visas for science students and scholars. Specifically, we reported in February 2004[Footnote 28] that the time it takes to adjudicate a visa for a science student or scholar depends largely on whether an applicant must undergo a security check that is designed to protect against sensitive technology transfers. We took a random sample of these security checks for science students and scholars sent from posts abroad between April and June 2003 and found it took an average of 67 days for security checks to be processed and for State to notify the post. Officials from the State Department and FBI acknowledged there have been lengthy waits, but reported having measures under way that they believe will improve the process. However, additional challenges remain, such as interoperability issues between State's and FBI's computer systems. Finally, a challenge exists in balancing national security concerns with the expeditious processing of visa applications. Specifically, we reviewed[Footnote 29] the visa operations at U.S. posts in Canada and provided information on the perceptions of consular staff that adjudicate U.S. visas regarding the importance of national security in the visa process, including impediments that could interfere with efforts to make security a top priority in visa processing. Consular officers and managers at U.S. posts in Canada said that despite rising workloads and increasingly labor-intensive visa-processing requirements, they were placing an emphasis on security in visa operations. Some officers reported that new post-September 11 processing requirements for visas could reduce the time available for face-to-face interviews. While most officers believed that they had enough time to screen applicants carefully for possible security risks, some of the newer officers at posts in Canada expressed concern about their ability to remain vigilant if the workload increased. The Bremer and 9/11 Commissions made recommendations related to the challenges found in this section. Improving the US-VISIT Program: Integral to the effort to reform immigration services and the strategy's call for a "border of the future," is the implementation of the United States Visitor and Immigrant Status Indicator (US-VISIT) program, which is designed to collect, maintain, and share information, including biometric identifiers, on selected nationals who travel to the United States. We testified in March 2004[Footnote 30] that this implementation is challenging because of the type of program it is and the way it is being managed. US-VISIT is to perform a critical, multifaceted mission, its scope is large and complex, it must meet a demanding implementation schedule, and its potential cost is enormous. One critical aspect of the program's mission is to prevent the entry of persons who pose a threat to the United States. DHS estimated that the program would cost $7.2 billion through fiscal year 2014, but this estimate did not include all costs and underestimated some others. In addition, several factors related to the program's management increase the risk of not delivering mission value commensurate with costs or not delivering defined program capabilities on time and within budget. Also, the requirements for interim facilities at high-volume land ports of entry are not only demanding, they are based on assumptions that, if altered, could significantly affect facility plans. Despite these challenges, the first increment was deployed at the beginning of 2004. DHS's fiscal year 2004 US-VISIT expenditure plan and related documentation at least partially satisfies all conditions imposed by Congress. US-VISIT largely met its commitments for implementing an initial operating capability in early January 2004, including the deployment of entry capability to 115 air and 14 seaports of entry. However, challenges remain because DHS has not employed rigorous, disciplined management controls typically associated with successful programs. More specifically, testing of the initial phase of the implemented system was not well managed and was completed after the system became operational. In addition, multiple test plans were developed during testing, and only the final test plan, completed after testing, included all required content. Such controls, while significant for the initial phases of US-VISIT, are even more critical for the later phases, as the size and complexity of the program will only increase. Finally, as we reported in May 2004,[Footnote 31] DHS's plans for future US-VISIT resource needs at the land ports of entry are based on questionable assumptions, making future resource needs uncertain. The 9/11 Commission made recommendations related to this challenge. Transportation Security: Effectively Prescreening Aviation Passengers: Developing an effective system to prescreen passengers before they even arrive at the airport is one of the challenges alluded to in the strategy's discussion of the implementation of the Aviation and Transportation Security Act (ATSA) of 2001. DHS's solution to this challenge was the development of the Computer-Assisted Passenger Prescreening Program (CAPPS II), which was designed to identify passengers requiring additional security attention. As we said in a February 2004 report and in a March 2004 testimony,[Footnote 32] key activities in the development of this program have been delayed or not addressed. We also identified three additional challenges TSA faces that may impede the success of CAPPS II. These challenges are developing the international cooperation needed to obtain passenger data, managing the possible expansion of the program's mission beyond its original purpose, and ensuring that identity theft cannot be used to negate the security benefits of the system. Recently the Transportation Security Administration scrapped the CAPPS II program and created a follow-on program called Secure Flight, which could face many of the same challenges we identified. The 9/11 Commission made recommendations related to this challenge. Improving Airline Passenger and Baggage Screening: Another of the challenges alluded to in the strategy's discussion of ATSA is the effective and efficient screening of passengers and baggage. This has been a long-standing concern, and although significant actions have been taken, we testified in February and March 2004 that challenges in achieving and sustaining improvements remain.[Footnote 33] For example, while TSA met its mandate to establish a federal screener workforce by November 2002, it continues to face challenges in hiring and deploying passenger and baggage screeners. Additionally, while TSA is making progress in measuring the performance of passenger screeners, it has collected limited performance data related to its baggage screening operations. Moreover, testing of screeners has identified weaknesses in their ability to detect threat objects, while essential training is hampered by staffing shortages and a lack of adequate technical capability to access online training programs. Still another challenge involves deploying and leveraging screening equipment and technologies. For example, TSA continues to face operational and funding challenges in its efforts to achieve a mandate to screen all baggage using explosive detection systems. The 9/11 Commission made recommendations related to this challenge. Strengthening Airport Perimeter Security and Access Controls: Another key requirement of ATSA, as discussed in the strategy, is the "protection of critical infrastructure assets," including airports. In June 2004[Footnote 34] we reported that while TSA has begun evaluating the security of airport perimeters and access controls, the agency has not yet determined how the results will be used to address the challenges faced. Specifically, these challenges include addressing concerns with perimeter and access control security that have been raised in compliance inspections and vulnerability assessments; setting priorities for funding airport security needs, developing a plan for implementing new technologies to meet security needs, and implementing certain mandated actions to reduce the security threats posed by airport workers. Countering Threats Posed by Hand-Held Missiles: Another consideration for ensuring the security of our aviation system involves the issue of aircraft protection, specifically countering the threats posed by Man-Portable Air Defense Systems (MANPADS). These hand-held missile systems have been used by terrorists against commercial aircraft. In January 2004, we reported[Footnote 35] that DHS faces significant challenges in adapting a military counter-MANPADS system to commercial aircraft, such as establishing system requirements, developing technology and design to sufficient maturity, and setting reliable cost estimates. Our work on the best practices of product developers in government and industry has found that such challenges can be successfully overcome by using a knowledge-based approach. Additionally, in a May 2004 report,[Footnote 36] we found that further improvements are needed in U.S. efforts to keep MANPADS out of the hands of terrorists. Although the State Department made important progress in 2003 to control the global proliferation of MANPADS, its ability to assess further progress is limited because multilateral forums have no mechanisms to monitor members' implementation of commitments. DOD has sold thousands of Stinger missiles (a U.S. MANPADS) to 17 countries and Taiwan, but DOD agencies responsible for end-use monitoring are not required to maintain records on the number and destination of Stinger sales. In addition, DOD officials overseas use inconsistent practices when inspecting Stinger inventories because DOD lacks procedures for conducting these inspections. For example, DOD has no requirements for DOD organizations responsible for end-use monitoring to keep records on the number and destinations of these Stingers. Effectively Addressing Rail and Mass Transit Security Issues: The strategy recognizes "the importance of security for all forms of transportation." As we testified[Footnote 37] in March and September 2003, certain characteristics of mass transit systems make them inherently vulnerable to terrorist attacks and a challenge to secure. By design, mass transit systems are open (i.e., have multiple access points and, in some case, no barriers) so that they can move large numbers of people quickly. In contrast, the aviation system is housed in closed and controlled locations with few entry points. The openness of mass transit systems can leave them vulnerable because transit officials cannot monitor or control who enters or leaves the systems. In addition, other characteristics of some transit systems--high ridership, expensive infrastructure, economic importance, and location (e.g., large metropolitan areas or tourist destinations)--also make them attractive targets because of the potential for mass casualties and economic damage. Moreover, some of these same characteristics make mass transit systems difficult to secure. For example, the number of riders that pass through a mass transit system--especially during peak hours--makes some security measures, such as metal detectors, impractical. In addition, the multiple access points along extended routes make the costs of securing each location prohibitive. Further complicating transit security is the challenge faced by transit agencies in balancing security concerns with accessibility, convenience, and affordability. Because transit riders often could choose another means of transportation, such as personal automobile, transit agencies must compete for riders. To remain competitive, transit agencies must offer convenient, inexpensive, and high-quality service. Therefore, security measures that limit accessibility, cause delays, increase fares, or otherwise cause inconvenience could push people away from mass transit and back into their cars. The size and diversity of the freight rail system make it a challenge to adequately secure. The freight rail system's extensive infrastructure crisscrosses the nation and extends beyond our borders to move millions of tons of freight each day. There are over 100,000 miles of rail in the United States. The extensiveness of the infrastructure creates an infinite number of targets for terrorists. In addition, protecting freight rail assets from attack is made more difficult because of the tremendous variety of freight hauled by railroads. For example, railroads carry freight as diverse as dry bulk (grain) and hazardous materials.[Footnote 38] The transport of hazardous materials is of particular concern because serious incidents involving these materials have the potential to cause widespread disruption or injury. In 2001, over 83 million tons of hazardous materials were shipped by rail in the United States across the rail network, which extends through every major city as well as thousands of small communities. The 9/11 Commission made recommendations related to this challenge. Effectively Implementing the Maritime Transportation Security Act: The strategy calls for "targeted improvements in the areas of maritime domain awareness, command and control systems, and shore-side facilities." In response to concerns regarding port security, Congress passed the Maritime Transportation Security Act (MTSA), mandating specific security preparations for America's maritime ports. Passed in November 2002, MTSA imposed an ambitious schedule of requirements on a number of federal agencies. MTSA called for a comprehensive security framework--one that included planning, personnel security, and careful monitoring of vessels and cargo. Agencies responsible for implementing the security provisions of MTSA and have made progress in meeting their requirements. However, in a September 2003 testimony, we identified challenges that merit attention and further oversight.[Footnote 39] The main security-related challenge involves the implementation of a vessel identification system. MTSA called for the development of an automatic identification system. Coast Guard implementation calls for a system that would allow port officials and other vessels to determine the identity and position of vessels entering or operating within the harbor area. Such a system would provide an "early warning" of an unidentified vessel or a vessel that was in a location where it should not be. To implement the system effectively, however, requires considerable land-based equipment and other infrastructure that is not currently available in many ports. As a result, for the foreseeable future, the system will be available in less than half of the 25 busiest U.S. ports. Challenges also exist regarding the proposed approach for meeting MTSA's requirement that the Secretary of DHS approve security plans for all vessels operating in U.S. waters. Vessel security plans include taking such steps as responding to assessed vulnerabilities, designating security officers, conducting training and drills, and ensuring that appropriate preventive measures will be taken against security incidents. To implement this MTSA requirement, the Coast Guard has stated, in general, that it is not the Coast Guard's intent to individually approve vessel security plans for foreign vessels. The Coast Guard provides that it will deem a flag-state approval of a vessel security plan to constitute the MTSA-required approval of MTSA vessel security plans. However, MTSA does not mention any role for foreign nations in the required approval of vessel security plans, and some concerns have been raised about the advisability of allowing flag states--some with a history of lax regulation--to ensure the security of vessels traveling to the United States. Another security-related challenge involves the Coast Guard's efforts to address MTSA's security planning requirements through a series of security assessments of individual ports. Security assessments are intended to be in-depth examinations of security threats, vulnerabilities, consequences, and conditions throughout a port, including not just transportation facilities but also factories and other installations that pose potential security risks. The Coast Guard had begun these assessments before MTSA was passed and decided to continue the process, changing it as needed to meet MTSA planning requirements, which include developing area security plans based on the evaluation of specific facilities throughout the port. Issues were found in the scope and quality of the assessments and their usefulness to port stakeholders. The Gilmore Commission made recommendations related to this challenge. Improving Container Cargo Security: The strategy states that "containers are an indispensable but vulnerable link in the chain of global trade" and has an initiative to "increase the security of international shipping containers." As we stated in our July 2003 report,[Footnote 40] CBP has taken steps to address the challenge of terrorist threats to oceangoing cargo containers through a targeting strategy. CBP faces continuing challenges in targeting containers for inspections. CBP needs upon which to target containers for inspection. CBP does not have a national system for reporting and analyzing inspection statistics, and the data are generally not readily available by risk level (e.g., low, medium, high), were not uniformly reported, were difficult to interpret, and were incomplete. Further, we testified in March 2004, space limitations and safety concerns about inspection equipment constrain some ports in their utilization of screening equipment, which has affected the efficiency of examinations.[Footnote 41] The Gilmore Commission made recommendations related to this challenge. Directly related to the challenge of improving cargo container security are the challenges associated with the CBP's implementation of its Container Security Initiative, which allows CBP officials to screen for high-risk containers at key overseas ports, and its Customs-Trade Partnership against Terrorism (C-TPAT), which is designed to improve global supply chain security in the private sector. Both of these programs were launched quickly in an effort to secure ocean containers bound for the United States. However, a number of challenges must be overcome if these programs are going to accomplish the desired outcome and achieve long-term effectiveness. One of the these challenges is the development of human capital plans that clearly describe how CSI and C- TPAT will recruit, train, and retain staff to meet their growing demands as they expand to other countries and implement new program elements. Another challenge involves the expansion of efforts already initiated to develop performance measures for CSI and C-TPAT that include outcome-oriented indicators. Finally, strategic plans must be developed that clearly lay out CSI and C-TPAT goals, objectives, and detailed implementation strategies. Recapitalizing the U.S. Coast Guard: The continued recapitalization of the U.S. Coast Guard is specifically called for in the homeland security strategy. In 2002, the Coast Guard began its largest and most complex recapitalization challenge in its history, the Integrated Deepwater System program. As part of the Deepwater program, the Coast Guard is estimated to spend about $17 billion over 20 years to replace or modernize its fleet of cutters, aircraft, and communications equipment used for missions generally beyond 50 miles from shore. Just 3 years into the program, the Coast Guard has already experienced management challenges. In March 2004,[Footnote 42] we reported that key components needed for the Coast Guard to manage the program and oversee the system integrator's performance have not been effectively implemented. For example, we reported that the Coast Guard's integrated product teams have struggled to effectively collaborate and accomplish their missions, and management has not measured the extent of competition among suppliers or held the system integrator accountable for taking steps to increase competition in order to control future costs. In addition, in June 2004,[Footnote 43] we expressed concern that the Coast Guard had not updated Deepwater's original 2002 acquisition schedule. We noted that maintaining a current acquisition schedule for programs of similar scope--such as those of the Department of Defense--is a fundamental and necessary practice. The Coast Guard's lack of an updated acquisition schedule makes it difficult to determine the degree to which the program is on track with its original schedule, lessens the Coast Guard's ability to monitor the contractor's performance, and may prevent the Department of Homeland Security and Congress from basing budget decisions on accurate information. As the Deepwater program matures, paying increased attention to address these outstanding program management and contractor oversight concerns will help the Coast Guard better meet current and future management challenges. The Gilmore Commission made recommendations related to this challenge. [End of section] Appendix IV: Domestic Counterterrorism: This appendix sets forth the definition and major initiatives of the Domestic Counterterrorism mission area and discusses the federal funding allocated, the agencies with major roles and the alignment of their strategic plans and implementation activities with the major initiatives, and a summary of the challenges faced by the nation. This appendix presents baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Domestic Counterterrorism mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six mission areas, the third of which is Domestic Counterterrorism. This mission area includes the efforts of the nation's law enforcement agencies in identifying, halting, preventing, and prosecuting terrorists in the United States. Included in this mission area is the pursuit of individuals directly involved in terrorist activity, as well as their sources of support--the people and organizations that knowingly fund or provide material support or resources to the terrorists. It should be noted that this mission area is closely related to the Intelligence and Warning mission area in that activities that develop the basis for law enforcement action occur in that mission area and are carried out in this one.[Footnote 44] Figure 7 shows an example of the type of activities carried out in the Domestic Counterterrorism mission area. The strategy identifies the following major initiatives in the domestic counterterrorism mission area: * improving intergovernmental law enforcement coordination, * facilitating apprehension of potential terrorists, * continuing ongoing investigations and prosecutions, * completing FBI restructuring to emphasize prevention of terrorist attacks, * targeting and attacking terrorist financing, and: * tracking foreign terrorists and bring them to justice. Figure 7: An FBI Evidence Response Team in Action at the Scene of a Terrorism-Related Exercise: [See PDF for image] [End of figure] Agencies with Major Roles in Domestic Counterterrorism: Of the six departments under review, DOJ and DHS have major roles in Domestic Counterterrorism. Within DOJ, the FBI works to detect and prevent terrorist acts through analysis and fieldwork to identify terrorists, their supporters, and materials that may be used to perpetrate a terrorist act, to include terrorist financing; tracks foreign terrorists and keeps them from entering the United States; and leads the multi-agency Joint Terrorism Task Forces (JTTF). In addition, DOJ's 94 United States Attorneys lead the Anti-Terrorism Advisory Councils, which enhance cooperation and information sharing among federal, state, and local law enforcement; first responders; industry; academia; and others. Within DHS, ICE, working with other law enforcement agencies, enforces laws related to the illegal presence of people and goods within the United States; detains those suspected of immigration-related violations and removes those convicted of immigration-related violations; and pursues criminal aliens, cases of identity theft or benefit fraud, human trafficking, money laundering, and other violations of such laws. OMB reported that the total fiscal year 2005 funding request for the domestic counterterrorism mission area is just over $3.4 billion. DOJ accounts for $1.9 billion (57 percent) of these funds, primarily for the FBI. DHS accounts for another $1.4 billion (41 percent) of the funding request, mostly for ICE.[Footnote 45] Figure 8 summarizes the fiscal year 2005 budget request for the domestic counterterrorism mission area by agency. Figure 8: Proposed Fiscal Year 2005 Homeland Security Funding for Domestic Counterterrorism: [See PDF for image] Notes: Budget authority in millions of dollars. "All other agencies" includes the Departments of Transportation ($21 million) and Treasury ($46 million), as well as the Social Security Administration ($4 million). [End of figure] OMB's reported data do not include funding for four departments that have activities under way in this mission area. These departments-- Defense, Energy, Health and Human Services, and State--have either planning or implementation activity on specific initiatives, as discussed in the next section of this appendix. On the basis of our previous work, we have noted several qualifications to OMB's figures to explain this discrepancy.[Footnote 46] According to OMB officials, there is not always a clear distinction between homeland security activities and other related activities. The OMB staff must make judgment calls about how to characterize funding by mission areas. For example, some homeland security activities have multiple purposes ,and funding for these activities is allocated to different accounts that can cover multiple mission areas. In addition, some of the departments' activities, such as planning, coordination, or providing advice, may support Domestic Counterterrorism activities but are not included in the amounts shown. Alignment of Department Activities with the Major Initiatives: This section provides more detailed information about the Domestic Counterterrorism critical mission area initiatives, and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning and implementation activities, lead agency designations, and implementation activities in fiscal year 2004, with respect to each initiative. The data are summarized in table 9. Table 9: Detailed Department Leadership and Planning/Implementation Activities in the Domestic Counterterrorism Mission Area's Six Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All six Domestic Counterterrorism initiatives are being addressed in the key departments' planning and implementation activities. As shown in table 9, at least one department cited activity in each of the six initiatives. At least four departments cited activity in three of the six initiative areas. For example, DHS, DOJ, DOD, and State implemented activities in the initiative, facilitating the apprehension of potential terrorists, during fiscal year 2004. DHS's ICE operated the Student and Exchange Visitor Information System computer network to identify and track nonimmigrants, foreign students, and exchange visitors while in the United States; DOJ's FBI continued to make improvements in the Integrated Automated Fingerprint Identification System; DOD expanded maritime interception and intelligence operations; and State bolstered the security of nations at high risk of terrorist transit by developing and installing Terrorist Interdiction Program software at their borders and training immigration officials in its use. Additionally, DHS, DOJ, and State demonstrated implementation activities in fiscal year 2004 related to targeting and attacking terrorist financing. DHS implemented Cornerstone, a comprehensive economic security program, targeting alternative financing mechanisms that terrorists use to earn, move, and store funds. DOJ brought to bear several units and task forces to address terrorist financing and conducted criminal and intelligence investigations and prosecutions with respect to charities and banking; State cited diplomatic efforts to encourage countries to ratify and implement United Nations Security Council Resolution 1373, targeting terrorists' financing. All six departments have been engaged in Domestic Counterterrorism initiatives. In contrast with DHS and DOJ, HHS only addressed a single initiative in this mission area (i.e., improving intergovernmental law enforcement coordination.) This limited initiative participation is understandable, given that the Domestic Counterterrorism mission area is primarily directed toward law enforcement. This is not a primary mission for HHS. While we have identified department activities related to these initiatives, we did not determine the quality, status, or progress of such activities with respect to stated goals or targets within this mission area. Identification of Lead Agencies on the Initiatives: For all six initiatives, a lead agency is identified either in the strategy or the Homeland Security Presidential Directives. As shown in table 9, DOJ is a lead on the most initiatives--all six mission area initiatives. It is understandable for DOJ to have lead roles in each of these six initiatives given that the Domestic Counterterrorism critical mission area is primarily directed toward law enforcement-related initiatives (e.g., improving intergovernmental law enforcement coordination, facilitating the apprehension of potential terrorists, continuing ongoing investigations and prosecutions, and tracking foreign terrorists and bringing them to justice). Additionally, DHS is a lead on three of the six initiatives (i.e., facilitating the apprehension of potential terrorists, continuing ongoing investigations and prosecutions, and tracking foreign terrorists and bringing them to justice); and State is a lead on one of six initiatives (facilitating the apprehension of potential terrorists). Three of the departments under review have not been identified as a lead on any Domestic Counterterrorism initiatives (DOD, HHS, and DOE) by the strategy and HSPDs since their missions are not primarily directed toward law enforcement. The strategy and HSPDs identified multiple leads on three initiatives (see table 9). DHS, DOJ, and State are all leads on the initiative, facilitating the apprehension of potential terrorists; DHS and DOJ are both leads on the remaining two initiatives (continuing ongoing investigations and prosecutions and tracking foreign terrorists and bringing them to justice). In addition, department strategic planning/ implementation documents demonstrated that all identified leads in this mission area are clear leads. Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004 implementation activity occurred with respect to each of the six initiatives (see table 9). DOJ implemented activity in 2004 on all 6 initiatives for which it was the lead; it also engaged in prior implementation in each of these six initiatives. DHS implemented prior and 2004 activity in each of the three initiatives for which it was identified as a lead (see illustrations above); and State cited both prior and fiscal year 2004 activity in the single initiative for which it was identified as a lead. Additionally, several of the departments under review implemented multiple Domestic Counterterrorism initiatives for which they were not identified as a lead agency either in the strategy or in HSPDS. During fiscal year 2004, DOE cited implementation activities in two Counterterrorism initiatives, for which it was not identified as a lead (prior to fiscal year 2004, it conducted implementation activities in these same two initiatives.) DOD cited 2004 implementation activities in two of the six initiatives, without lead identification; and DHS and State both cited fiscal year 2004 implementation activities in two initiatives for which they were not identified as leads. Challenges in Domestic Counterterrorism: The attacks of September 11, and the catastrophic loss of life and property that resulted have redefined the mission of federal, state, and local law enforcement authorities. Accordingly, while organizations like the FBI continue to investigate and prosecute criminal activity, they are now assigning highest priority to preventing and interdicting terror activity within the United States. Our recent work in the Domestic Counter-terrorism mission area has identified a number of challenges. These challenges include the need to transform the workforce and business practices of the FBI in order to focus on counterterrorism and intelligence-related priorities; attaining the level of interagency coordination necessary to leverage existing law enforcement resources for investigating money laundering and terrorist financing; developing databases for the collection and dissemination of alien information; and ensuring that law enforcement and other officials have the necessary training and expertise to detect counterfeit identification documents and identity fraud. Transforming the FBI to Focus on Counterterrorism: The strategy sets forth the nation's highest law enforcement objective as the prevention of terrorist attacks--a significant shift from pre-9/ 11 objectives. In order to focus the mission of the federal law enforcement community on prevention, in March 2004, we reported[Footnote 47] that it is necessary for the federal government to restructure the FBI and other federal law enforcement agencies, reallocating certain resources and energies to the new prevention efforts. While the FBI has made significant progress in its transformation, it continues to face challenges in transforming its workforce and business practices to focus on counterterrorism and intelligence-related priorities. Additional challenges continue in the areas of human capital management and information technology, as well as in the intelligence and language services areas. The 9/11 Commission made recommendations related to this challenge. Effectively Investigating Terrorist Financing: The strategy provides that a "cornerstone" of the nation's domestic "counterterrorism effort involves a concerted interagency effort to target and interdict the financing of terrorist organizations and operations." Although terrorist financing is generally characterized by different motives than money laundering--a process by which the monetary proceeds from criminal activities are transformed into funds and assets that appear to have come from legitimate sources--the techniques used to obscure the origin of funds and their ultimate use are often quite similar. Therefore, Treasury, law enforcement agencies, other federal investigators, prosecutors, and financial regulators often employ similar measures and techniques in trying to detect and prevent both money laundering and terrorist financing. In September 2003,[Footnote 48] we reported that the annual National Money Laundering Strategy (NMLS)--which was required by 1998 federal legislation--has had mixed results in guiding the efforts of law enforcement in the fight against money laundering and, more recently, terrorist financing. For example, although expected to have a central role in coordinating law enforcement efforts, interagency task forces created specifically to address money laundering and related financial crimes generally had not yet been structured and operating as intended and had not reached their expectations for leveraging investigative resources or creating investigative synergies. Also, most of the NMLS initiatives designed to enhance interagency coordination of money laundering investigations had not yet achieved their expectations. While the annual NMLS has fallen short of expectations, federal law enforcement agencies recognize the challenge of developing and using interagency coordination mechanisms to leverage existing resources to investigate money laundering and terrorist financing. Additionally, regarding investigative efforts against sources of terrorist financing, our February 2004[Footnote 49] report noted that a memorandum of agreement signed in May 2003 by the Attorney General and the Secretary of Homeland Security represents a partnering commitment by two of the nation's law enforcement agencies--the FBI and ICE, a component of DHS. Since the agreement was signed, progress has been made in waging a coordinated campaign against sources of terrorist financing. Continued progress will depend largely on the ability of the agencies to overcome the challenges associated with establishing and maintaining effective interagency relationships and meeting various other operational and organizational challenges, such as ensuring that the financial crimes expertise and other investigative competencies of both agencies are appropriately and effectively utilized. The Bremer, Hart-Rudman, and 9/11 Commissions made recommendations related to the challenges presented in this section. Monitoring Alternative Financing Mechanisms: In addition to the challenge presented by interagency coordination issues, challenges exist in the monitoring of terrorists' use of alternative financing mechanisms. As we recommended in November 2003, the FBI, which leads terrorist financing investigations and maintains case data, should systematically collect and analyze data on terrorists' use of alternative financing mechanisms.[Footnote 50] Alternative financing mechanisms are outside the mainstream financial system and include the use of commodities (cigarettes, counterfeit goods, illicit drugs, etc.), bulk cash, charities, and informal banking systems to earn, move, and store assets. Cutting off terrorists' funding is an important means of disrupting their operations. As initial U.S. and foreign government deterrence efforts focused on terrorists' use of the formal banking or mainstream financial systems, terrorists may have been forced to increase their use of various alternative financing mechanisms. When agencies inform the FBI that an investigation has a terrorist component, the FBI opens a terrorism case. However, the FBI's data analysis programs do not designate the source of funding (i.e., specific charity, commodity, etc.) Without such data, the FBI will be challenged to conduct systematic analysis of trends and patterns focusing on alternative financing mechanisms from its case data. Without such an assessment, the FBI does not have analyses that could aid in assessing risk and prioritizing efforts. In response to our recommendation, the FBI conducted a onetime survey of its field offices to gather information about terrorist financing investigations since October 2001. Additionally, the FBI has instructed its field offices to update some of this information when new terrorist financing investigations are initiated. FBI officials told us that information from the surveys was entered into a database, and they believe that this database enables them to track information on alternative methods of terrorist financing and identify emerging trends, patterns, and funding sources. However, we have not evaluated the quality of the information provided. In addition, the FBI has not indicated how it has used this capability to perform an analysis of terrorist financing investigations. The Bremer, Hart-Rudman, and 9/11 Commissions also made recommendations related to this challenge. Detecting Identity Fraud: The strategy has an initiative to "coordinate suggested minimum standards for state driver's licenses." In September and October 2003,[Footnote 51] we testified about the challenges to homeland security posed by identity fraud and how counterfeit identification can be easily produced and used to create fraudulent identities. Specifically, we conducted tests over the past several years that demonstrate how counterfeit identification documents can be used to obtain genuine state driver's licenses. In conducting these tests, we created fictitious identities and counterfeit identification documents using off-the-shelf computer graphic software that is available to any purchaser. These documents were then used to fraudulently obtain genuine driver's licenses in other states. Our work identified three basic challenges: (1) government officials and others generally did not recognize that the documents we presented were counterfeit; (2) many government officials were not alert to the possibility of identity fraud, and some failed to follow security procedures; and (3) identity verification procedures are inadequate. The weaknesses we found during this investigation clearly show that border inspectors need to have the means to verify the identity and authenticity of the documents that are presented to them. In addition, government officials who review identification need additional training in recognizing counterfeit documents. Further, these officials also need to be more vigilant when reviewing identification documents to the possibility of identification fraud. As we reported in October 2003,[Footnote 52] directly related to the issue of detecting counterfeit documents and fictitious identities, is the importance of having sound practices for avoiding the improper issuance of Social Security numbers (SSNs) and ensuring the identity of those who receive them. Although originally created as a means of tracking worker earnings, the SSN has become a national identifier that is central to a range of transactions and services associated with American life, including obtaining a driver's license, opening a bank account, and establishing credit. Accordingly, SSNs are key pieces of information in creating false identities. In prior work we recommended that the Social Security Administration verify the documents of all SSN applicants and reassess its policies for issuing replacement cards, which allowed an individual to obtain up to 52 per year. The recently passed Intelligence Reform and Terrorism Prevention Act of 2004 has specific provisions to address our recommendations. Additionally, the 9/11 Commission made recommendations related to this challenge. [End of section] Appendix V: Protecting Critical Infrastructures and Key Assets: This appendix sets forth the definition and major initiatives of the Protecting Critical Infrastructures and Key Assets mission area and discusses the agencies with major roles, their funding, the alignment of their strategic plans and implementation activities with the major initiatives, and a summary of the challenges faced by the nation. This appendix provides baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Protecting Critical Infrastructures and Key Assets mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six mission areas, the fourth of which is protecting critical infrastructures and key assets. This mission area- -commonly referred to as Critical Infrastructure Protection (CIP)-- includes programs that improve protection of the interconnecting sectors that make up the nation's critical infrastructure. The sectors are agriculture, banking and finance, chemical and hazardous materials, emergency services, defense industrial base, energy, food, government, information technology and telecommunications, postal and shipping, public health and health care, transportation, and drinking water and water treatment systems. Programs associated with the physical or cyber security of federal assets also belong in this mission area. Finally, programs designed to protect the nation's key assets--unique facilities, sites, and structures whose disruption or destruction could have significant consequences--are also included in this mission area.[Footnote 53] In addition to the homeland security strategy, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets and the National Strategy to Secure Cyberspace provide detailed discussions of Critical Infrastructure Protection. Figure 9 shows an example of the type of activities carried out in the Critical Infrastructure Protection mission area. The homeland security strategy identifies the following major initiatives in the critical infrastructure protection mission area: * unifying America's infrastructure protection effort in the Department of Homeland Security, * building and maintaining a complete and accurate assessment of America's critical infrastructure and key assets, * enabling effective partnership with state and local governments and the private sector, * developing a national infrastructure protection plan, * securing cyberspace, * harnessing the best analytic and modeling tools to develop effective protective solutions, * guarding America's critical infrastructure and key assets against "inside" threats, and: * partnering with the international community to protect our transnational infrastructure. Figure 9: A U.S. Immigration and Customs Enforcement Helicopter Patrols the Skies over the Nation's Capital: [See PDF for image] [End of figure] Agencies with Major Roles in Critical Infrastructure Protection: Of the six departments under review, DHS, DOD, DOE, and DOJ have major roles in Critical Infrastructure Protection. DHS has primary responsibility for emergency services, government, information and telecommunications, transportation, chemicals, and postal and shipping sectors. Examples of specific functions performed by DHS include the protection of federally owned or leased properties throughout the country by the Federal Protective Service, the Secret Service's role in coordinating site security plans at designated special security events, and the National Cyber Response Coordination Group's role as a coordinating body for cyber emergencies of national scope. DOD is active in this mission area, primarily in areas of physical security of military and military-related activities, installations, and personnel. DOE's role involves the development and implementation of policies and procedures for safeguarding the nation's power plants, research labs, weapons production facilities, and cleanup sites from terrorists. DOJ, primarily through work done by the FBI and the Computer Crime and Intellectual Property Section of the Criminal Division, is active in this mission area in preventing, where possible, the exploitation of the Internet, computer systems, or networks as the principal instruments or targets of terrorist organizations. OMB reported that the total fiscal year 2005 funding request for the critical infrastructure protection mission area is $14 billion. DOD has the largest share of this funding ($7.6 billion, or 54 percent) for programs focusing on physical security and improving the military's ability to prevent or mitigate the consequences of attacks against its personnel and installations. DHS accounts for $2.6 billion (18 percent) of 2005 funding. A total of 26 other agencies report funding to protect their own assets and to work with states, localities, and the private sector to reduce vulnerabilities in their areas of expertise.[Footnote 54] Figure 10 summarizes the fiscal year 2005 budget request for the CIP mission area by agency. Figure 10: Proposed Fiscal Year 2005 Homeland Security Funding for Critical Infrastructure Protection: [See PDF for image] Notes: Budget authority in millions of dollars. "All other agencies" includes USDA ($166 million) and the Department of Transportation ($189 million), as well as the National Aeronautics and Space Administration ($207 million), the National Science Foundation ($317 million), the Social Security Administration ($151 million), and several others ($866 million). Total does not add up to 100 because of rounding. [End of figure] Alignment of Department Activities with the Major Initiatives: This section provides more detailed information about the CIP mission area initiatives and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning and implementation activities, lead agency designations, and implementation activities in fiscal year 2004, with respect to each initiative. The data are summarized in table 10. Table 10: Detailed Department Planning/Implementation Activities in the Protecting Critical Infrastructures and Key Assets Critical Mission Area's Eight Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All eight CIP initiatives are being addressed by key departments' planning and implementation activities. At least three departments (DHS, DOD, and HHS) cited activity in each of the eight initiatives (see table 10). For example, DHS, HHS, State, and DOE each implemented activities in fiscal year 2004 with respect to guarding America's critical infrastructure and key assets against inside threats. DHS started the Transportation Worker Identification Credential program to enhance access security across the nation's transportation system; the Food and Drug Administration within HHS, issued guidance to the food industry that suggested preventive measures, including employee background checks, which could increase the security of food while under an establishment's control; State developed diplomatic agreements with Mexico and Canada to permit background checks of truck drivers; and DOE conducted selected polygraph examinations and financial disclosures of those working in the energy field. Additionally, DHS, DOJ, DOD, HHS, State, and DOE each demonstrated implementation activities in fiscal year 2004 with respect to securing cyberspace. For example, DHS's Information Analysis and Infrastructure Protection Directorate refined, updated, and monitored the implementation of a national plan to protect physical and cyber critical infrastructures; DOJ operated a Special Technologies and Applications Section within the Cyber Division to support counterterrorism, counterintelligence, and criminal investigations involving computer intrusions; DOD prepared a departmentwide plan for CIP and physical and cyber assets; HHS's Centers for Disease Control and Prevention issued a fiscal year 2004 cyber security plan that includes activities and metrics; State took steps to strengthen the network's intrusion and detection capabilities; and DOE drafted a comprehensive Critical Infrastructure Plan, including plans for securing cyberspace. All six departments have been engaged in CIP initiatives. While we have identified department activities related to these initiatives, we did not determine the quality, status, or progress of such activities with respect to stated goals or targets within this critical mission area. Identification of Lead Agencies on the Initiatives: For all eight initiatives, a lead agency was identified either in the homeland security strategy or HSPDs. As shown in table 10, DHS is a lead on all eight initiatives. It seems appropriate that DHS would be the department with the most initiative leads, given that the "national vision" put forth in the strategy calls for DHS "to work with the federal departments and agencies, state and local governments, and the private sector to implement a comprehensive national plan to protect critical infrastructure and key assets." It also seems appropriate that State would have a lead on matters of international critical infrastructure protection, given its overseas mission (partnering with the international community to protect our transnational infrastructure). The four remaining departments each have a lead on one mission area initiative. DOD, HHS, and DOE are all leads on the same initiative--building and maintaining a complete and accurate assessment of America's critical infrastructure and key assets. These departments have the sector leads as follows: DOD for defense industrial base, HHS for public health, and DOE for the energy sector. DOJ has a leading role in securing cyberspace, owing to its investigative and prosecutorial role in reducing threats in cyberspace. In all, the homeland security strategy and HSPDs identified multiple leads on three of the eight mission area initiatives. The five initiative exceptions that do not have multiple leads are unifying America's infrastructure protection effort in DHS, enabling effective partnership with state and local governments and the private sector, developing a national infrastructure protection plan, harnessing the best analytic and modeling tools to develop effective protective solutions, and guarding America's critical infrastructure and key assets against inside threats. DOD, HHS, and DOE are identified as clear leads on a single initiative; DHS is identified as a clear lead on six of its eight initiative leads; and DOJ and State are implied leads on the single initiatives they lead. DOJ had been identified as a lead agency with respect to enabling effective partnerships with state and local governments and the private sector. However, given the transfer of the National Infrastructure Protection Center programs to the Department of Homeland Security, DOJ officials indicated that the department no longer serves as a lead on that initiative. Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004, implementation activity occurred with respect to all eight initiatives (see table 10). DHS implemented activity in all eight initiatives for which it was identified as a lead; DOJ, DOD, HHS, State, and DOE implemented activity in fiscal year 2004 in each of the initiatives for which they had been identified as a lead. Additionally, several of the departments under review implemented multiple CIP initiatives for which they were not identified as a lead in the strategy and HSPD. During fiscal year 2004, HHS cited implementation activity on six mission area initiatives for which it is was not given a lead role (it cited prior implementation on one of these initiatives); DOE cited 2004 implementation activity on six initiatives for which it is not the lead (with prior implementation on five); DOJ cited 2004 implementation activity on two initiatives for which it was not a lead (with prior implementation on four); and State cited 2004 and prior implementation on two initiatives, for which it was not identified as a lead. Our analysis further indicates that three departments transferred programs, systems, or centers to the newly formed DHS, within this critical mission area. DOJ transferred the Key Asset Identification program, a component of the National Infrastructure Protection Center, to DHS. In accordance with the Homeland Security Act of 2002, DOD transferred the National Communication System. DOE transferred the National Infrastructure Simulation and Analysis Center and some related programs oriented toward protecting key infrastructure facilities and their components. Challenges in Critical Infrastructure Protection: As the National Strategy for Homeland Security points out, "protecting America's critical infrastructures and key assets is a formidable challenge" because "our open and technologically complex society presents an almost infinite array of potential targets, and our critical infrastructure changes as rapidly as the marketplace." In fact, the mission area is so diverse that two additional strategies-- the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets and the National Strategy to Secure Cyberspace--were issued to supplement the homeland security strategy. Our recent work in the CIP mission area has identified a number of challenges. These challenges include those related to the federal government's role in managing CIP. Among these are developing a comprehensive and coordinated national CIP plan that delineates the roles and responsibilities of federal and nonfederal CIP entities, defines interims objectives and milestones, sets time frames for achieving objectives, and establishes performance measures. In addition to identifying the challenges related to the overall management of CIP, our work has identified numerous challenges within specific infrastructure sectors. Included here are improving the security of government facilities; implementing better training and procedures to detect counterfeit documents and identity fraud; analyzing the strengths, interdependencies, and vulnerabilities of the financial services sector and developing strategies for responses to terrorist events; improving the safety and security of the postal system; strengthening security with regard to drinking water utilities; addressing the terrorist threat to agriculture and food; and addressing security issues with regard to chemical plants, nuclear power plants, and nuclear weapons sites. Effectively Managing Critical Infrastructure Protection: The homeland security strategy specifically calls for the development of a "national infrastructure protection plan." The challenges identified in this mission area include those related to the federal government's role in managing CIP. To ensure the coverage of the critical infrastructure sectors identified in the homeland security strategy, HSPD-7[Footnote 55] designated a sector-specific agency for each sector. This agency is responsible for infrastructure protection activities within its assigned area and for coordinating and collaborating with other relevant agencies--as well as state and local governments, and the private sector--to carry out its mission. In addition, DHS's Information Analysis and Infrastructure Protection Directorate (IAIP) has the responsibility to (1) develop a comprehensive national CIP plan consistent with the Homeland Security Act of 2002; (2) recommend CIP measures in coordination with other federal agencies and in cooperation with state and local government agencies and authorities, the private sector, and other entities; and (3) disseminate, as appropriate, information analyzed by the department both within DHS and to other federal agencies and private sector entities. Regarding the national CIP plan, according to HSPD-7, it is to be produced by December 2004 and outline national goals, objectives, milestones, and key initiatives. IAIP is also tasked with coordinating with other federal agencies to administer the Homeland Security Advisory System to provide specific warning information along with advice on appropriate protective measures and countermeasures. Over the last several years, we have reviewed various aspects of federal and private sector CIP efforts and issued numerous related reports. In an April 2004 testimony,[Footnote 56] we made numerous recommendations related to the federal CIP efforts, including issues involving the functions and responsibilities transferred to DHS, that represent challenges to DHS and other federal agencies. Among these challenges are: * developing a comprehensive and coordinated national CIP plan that delineates roles and responsibilities of federal and nonfederal CIP entities, defines interim objectives and milestones, sets time frames for achieving objectives, and establishes performance measures; * developing fully productive information-sharing relationships within the federal government and among the federal government and state and local governments and the private sector; and. * improving the federal government's capabilities to analyze incident, threat, and vulnerability information obtained from numerous sources and share appropriate, timely warnings and other information concerning both cyber and physical threats to federal entities, state and local governments, and the private sector. The Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions all made recommendations related to the challenges presented in this section. Improving Security at Government Facilities: The homeland security strategy identifies government operations as a critical infrastructure sector. In addition, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, which provides guidance in implementing the Homeland Security Strategy, states that the General Services Administration (GSA) is the principal agency responsible for the management of federal government facilities. Additional departments and agencies are similarly involved in the management of federally owned or operated facilities, including DOD and the Department of Veterans Affairs (VA). Furthermore, a challenge identified in the strategy is that most government organizations occupy buildings that are also used by a variety of nongovernmental tenants, such as shops and restaurants where the public is able to move about freely. The strategy also states that private owners of these properties may not want or have the ability to modify their procedures to accommodate the increased or special security countermeasures required by their federal tenants, such as installing surveillance cameras in lobbies, redesigning entry points to restrict the flow of traffic, or setting up x-ray machines and metal detectors at these entrances. To overcome protection challenges associated with government facilities, DHS plans to: * develop a process to screen nonfederal tenants and visitors entering private sector facilities that house federal organizations, * determine the criticality and vulnerability of government facilities, * develop long-term construction standards for facilities requiring specialized security measures, and: * implement new technological security measures at federally occupied facilities. In part because of the challenges associated with protecting government facilities, we designated federal real property as a high-risk area in January 2003.[Footnote 57] As the government's security efforts intensify, the government will be faced with important questions regarding the level of security needed to adequately protect federal facilities and how the security community should proceed. Furthermore, real property managers will have to dedicate significant staff time and other human capital resources to security issues and thus may have less time to manage other problems. Another broader effect is the impact that increased security will have on the public's access to government offices and other assets. Debate arose in the months after September 11, and continues to this day on the challenge of providing the proper balance between public access and security. Finally, as we testified in April 2002 and again in September 2003,[Footnote 58] an additional challenge to ensuring the proper security of federal buildings is the ease with which counterfeit identification or identity fraud can be used to breach security. Our work identified three basic challenges in this regard: (1) government officials and others generally did not recognize that the documents we presented were counterfeit; (2) many government officials were not alert to the possibility of identity fraud, and some failed to follow security procedures; and (3) identity verification procedures are inadequate. The weaknesses we found during these investigations clearly show those government officials who review identification need additional training in recognizing counterfeit documents. Further, these officials also need to be more vigilant when searching for identification fraud. Both the Gilmore and 9/11 Commissions made recommendations related to the challenges discussed above. Addressing Issues Involving the Federal Protective Service: As the agency with primary responsibility for carrying out the protection of thousands of federal facilities, the Federal Protective Service (FPS), which transferred from the GSA to DHS in March 2003, plays a critical role in the federal government's defense against terrorism. However, in July 2004, we reported that FPS faces significant challenges in carrying out its responsibilities.[Footnote 59] One challenge involves the agency's expanding mission and increased responsibility. FPS already has responsibility for securing approximately 8,800 GSA government-occupied facilities and plans to take on additional DHS facilities. It may also seek authority to protect other federal facilities. Additionally, the agency's mission has expanded to include other homeland security functions, such as supporting efforts to apprehend foreign nationals suspected of illegal activity. In light of these changes, however, it does not have a transformation strategy to address its expanding mission as well as the other challenges it is facing. Among these other challenges are resolving issues related to the agency's funding and the transfer of its mission-support functions to DHS. Addressing Vulnerabilities of the Financial Services Sector: As stated in the homeland security strategy, the financial services sector is essential to sustaining the economy of the United States. Accordingly, the entities and networks that constitute the U.S. financial system are among the critical infrastructure that face increasing threats from terrorist and other disruptions. Transactions involving trillions of dollars occur in the U.S. financial markets annually. After the large-scale impact on market participants that resulted from the September 11 attacks, law enforcement and other government organizations reported that key institutions and communications networks that support the financial markets have been specifically identified as targets. As we reported in February 2003, and September 2004, the government entities responsible for key financial market participants have begun to take actions to ensure that financial institutions are taking steps to minimize disruptions from terrorist attacks, but challenges remain.[Footnote 60] For example, although banking and securities regulators have issued standards for the financial market participants that perform key roles in the clearance and settlement process through which the payments and ownership transfers resulting from securities trading are made, these regulators had not conducted a formal analysis of the readiness of financial market participants to better ensure that trading in critical U.S. financial markets could also resume smoothly and in a timely manner after a major disaster.[Footnote 61] Among the challenges that these regulators face is that thousands of entities are active in the financial markets, and they must ensure that sufficient numbers take adequate steps to allow fair and orderly trading to resume. Ensuring sufficient actions are taken by the private sector organizations that participate in the financial markets is also a challenge for securities r, and thus the extent to which they implement business continuity plans that would allow them to resume activities is a business decision. Another challenge facing the financial sector is implementing the strategy--developed by industry representatives under the sponsorship of the U.S. Department of the Treasury--that discusses additional efforts necessary to identify, assess, and respond to sectorwide threats. For example, the sector is expected to analyze its infrastructure's strengths, interdependencies, and vulnerabilities and develop strategies for responses to events. However, we reported in January 2003 that the financial services sector has not developed specific interim objectives;[Footnote 62] detailed tasks, time frames, or responsibilities for implementation; or a process for monitoring progress. Without completing such steps, a greater risk exists that the financial sector's efforts will be less focused, efficient, and effective. Improving Postal and Shipping Security: Another critical infrastructure sector identified in the homeland security strategy is postal and shipping. In our May 2003 testimony,[Footnote 63] we reported that one of the challenges faced in this sector is that it is particularly vulnerable to being used as a means of delivering terrorist attacks. For example, anthrax was sent through the mail in October 2001, resulting in the death of five people, including two postal workers in Washington, D.C., and potentially exposed hundreds more to this lethal substance. Moreover, use of the mail as a vehicle for transmitting anthrax or similar weapons threatens the nation's mail stream and places the American public at risk. To help address this challenge, DHS has a role in mail security as part of its overall homeland security mission, in support of the two agencies that have key roles--the United States Postal Service (USPS) and GSA. Under the Homeland Security Act of 2002, DHS is responsible for, among other things, protecting certain buildings, grounds, and property owned or secured by the federal government and identifying and assessing current and future threats to the homeland. In addition, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets states DHS has a role in determining the criticality and vulnerability of government facilities, including federal mail centers. Following the anthrax attacks, USPS established increased security procedures to protect mail destined for federal agencies in the Washington, D.C., area, including the irradiation of mail. At the same time, federal agencies have taken various steps to increase the security of their mail centers in order to protect federal workers and buildings from possible exposure to anthrax and other types of dangerous material, such as explosives. In our December 2003 review of mail security in the executive branch, we determined that a lack of information from USPS on mail security incidents, as well as on mail security policies and practices, reduced the ability of federal agencies to make well-informed decisions regarding mail practices or their future plans for mail screening. In addition, we found that agencies' fear of cross-contamination influenced their decision to implement practices which were not recommended by the USPS or other government and industry sources of mail-screening information. USPS and GSA have recognized that agencies need more information and have taken steps in the right direction. We recommended that USPS and GSA further work together as appropriate to establish mechanisms for providing federal agencies with USPS mail security policies and procedures, the risks associated with various classes of mail and the rationales behind these assessments, and USPS's future plans in federal mail security, and include DHS as appropriate in addressing these recommendations. Strengthening Drinking Water Security: The homeland security strategy also identifies water as a critical infrastructure sector. Damage or destruction of drinking water systems by terrorists could disrupt not only the availability of safe drinking water, but also the delivery of vital services that depend on these water supplies, such as fire suppression. In our October 2003 report,[Footnote 64] we identified several key physical assets within this sector that are highly vulnerable to terrorist attacks. Specifically, the distribution system, source water supplies, critical information systems, and chemicals stored on-site that are used in the treatment process have been identified as potential targets of terrorism. Additionally, our work has identified vulnerability challenges that may involve multiple system components or even an entire drinking water system. Chief among these challenges are (1) a lack of redundancy in vital systems, which increases the likelihood that an attack could render a system inoperable; and (2) the difficulty many systems face because of a lack of information on the most serious threats to which they are exposed. Additional challenges relate to the criteria for determining how federal funds should be allocated among drinking water systems to improve their security, and the methods for distributing those funds, as well as specific activities the federal government should support to improve drinking water security. With regard to the allocation of federal funds, our work indicates that utilities serving high-density areas deserve at least a high priority for federal funding. Other utilities warranting priority are those serving critical assets, such as military bases, national icons, and key academic institutions. Regarding specific security-enhancing activities most deserving of federal support, we found that challenges that must be overcome include implementing physical and technological upgrades to improve security; researching and developing technologies to prevent, detect, or respond to an attack (particularly near-real-time monitoring technologies); providing education and training to support simulation exercises; conducting specialized training and multidisciplinary consulting teams; and strengthening key relationships between water utilities and other agencies that may have key roles in an emergency response. Addressing Agriculture and Food Supply Security: Another critical infrastructure sector identified in the homeland security strategy is the nation's food supply. While our food supply is generally safe and plentiful, each year tens of millions of Americans become ill and thousands die from eating unsafe food. The current federal food safety system is challenged by its fragmentation, which results in inefficient, inconsistent, and overlapping programs and operations. We have long recommended the establishment of a single food safety agency to administer a uniform, risk-based inspection system. Since the terrorist attacks of September 11, ensuring the security of our food--that is, protecting it from deliberate contamination--has become an added challenge for the federal agencies responsible for protecting the food and agriculture sectors of our economy. As we have reported in numerous reports and testimonies over the last decade,[Footnote 65] our fragmented federal food safety system hampers the efficiency and effectiveness of food safety efforts. Federal agencies have overlapping oversight responsibilities, which result in inefficient use of inspection resources and enforcement. This system is now further challenged by the realization that American farms and food are vulnerable to deliberate contamination. Fundamental changes are needed to improve the effectiveness and efficiency of the federal food safety system and to protect the nation's food supply from acts of deliberate contamination. One challenge involves the fact that bioterrorism attacks could be directed at many different targets in the farm-to-table continuum, including crops, livestock, and food products in the processing and distribution chain. For example, experts believe that terrorists would attack livestock and crops if their primary intent were to cause severe economic dislocation. On the other hand, if their motives were to harm humans, they could decide to contaminate finished food products. While agencies have taken steps to better protect the food supply, for the most part, the nation must still rely on the current food safety system to respond to bioterrorism acts against it.[Footnote 66] An additional challenge relates to the broad authority that agencies have to regulate the safety of the U.S. food supply but not the security of it. As a result, federal agencies are beginning to explore the extent to which food processors are voluntarily implementing security measures to protect against deliberate contamination.[Footnote 67] Finally, a challenge involves protecting against animal diseases that could be accidentally--or deliberately--introduced into the country. Certain animal disease can be devastating to the agricultural economy while others, such as mad cow disease, can be transmitted to humans. Our recent work has raised serious questions about security at DHS's Plum Island Animal Disease Center, which is responsible for developing strategies to protect the nation against animal diseases.[Footnote 68] In particular, we had concerns about the adequacy of the facility's controls of dangerous pathogens.[Footnote 69] The Gilmore Commission made recommendations related to the challenges presented in this section. Addressing Chemical Plant Security: Although the chemical industry is identified in the homeland security strategy as a critical infrastructure sector, we reported in March 2003 that the federal government has not comprehensively assessed the industry's vulnerability to terrorist attacks.[Footnote 70] As a result, federal, state, and local entities are challenged by a lack of comprehensive information on the vulnerabilities faced by the sector. An additional challenge concerns the fact that no federal laws explicitly require all chemical facilities to take security actions to safeguard their facilities against a terrorist attack. Moreover, while federal laws require some facilities to take security precautions, federal requirements do not address security at all facilities that produce, use, or store hazardous chemicals. Although the chemical industry has undertaken a number of voluntary initiatives to address security concerns at chemical facilities, the extent of participation in voluntary initiatives is unclear. The chemical industry faces significant challenges in preparing its facilities against terrorist attack, including ensuring that facilities obtain adequate threat information, determining the appropriate security measures given the level of risk, and ensuring that all facilities that house hazardous chemicals address security concerns. DHS and the Environmental Protection Agency (EPA) have taken steps to identify high-risk facilities, develop appropriate information-sharing mechanisms, and develop a legislative proposal to require chemical facilities to expeditiously assess their vulnerability to terrorist attacks and, where necessary, require these facilities to take corrective action. Legislation is now before Congress that, if enacted, would direct DHS, or DHS and EPA, to require chemical facilities to address these challenges.[Footnote 71] Challenge: Addressing Nuclear Power Plant Security: Another critical infrastructure sector identified in the homeland security strategy is energy. Among the possible terrorist targets within this sector are the nation's nuclear power plants--104 facilities containing radioactive fuel and waste. The Nuclear Regulatory Commission (NRC) oversees security of these facilities through an inspection program designed to verify the plants' compliance with security requirements. However, in September 2003,[Footnote 72] we reported that NRC faces challenges in ensuring that its oversight programs are effective in safeguarding these facilities and the surrounding communities. Specifically, three aspects of its security inspection program reduced NRC's effectiveness in this area. First, NRC's inspectors often used a process that minimized the significance of security problems found in annual inspections by classifying them as "non-cited violations" if the problem had not been identified frequently in the past or if the problem had no direct, immediate, or adverse consequences at the time it was identified. By making extensive use of these non-cited violations for serious problems, NRC may overstate the level of security at a power plant and reduce the likelihood that needed improvements are made. Second, NRC does not have a routine, centralized process for collecting, analyzing, and disseminating security inspections to identify problems that may be common to plants or to provide lessons learned in resolving security problems. Such a mechanism may help plants improve their security. Third, although NRC's force-on-force exercises can demonstrate how well a nuclear power plant might defend itself against a real-life threat, several weaknesses in how NRC conducts these exercises limited their usefulness. Weaknesses included using (1) more personnel to defend the plant during these exercises than would be available on a normal day, (2) attacking forces that are not trained in terrorist tactics, and (3) unrealistic weapons (rubber guns) that do not simulate actual gunfire. We also found that NRC made only limited use of some available improvements that would make force-on-force exercises more realistic and provide a more useful training experience. Finally, even if NRC strengthens its inspection program, commercial nuclear power plants face legal challenges in ensuring plant security. First, federal law generally prohibits guards at these plants from using automatic weapons, even though terrorists are likely to be using them. Second, state laws vary regarding the permissible use of deadly force and the authority to arrest and detain intruders, and we found that guards are unsure about the extent of their authorities and may hesitate or fail to act if the plant is attacked. Effectively Securing Nuclear Weapons Sites: The homeland security strategy identifies the defense industrial base as a critical infrastructure sector. Within this sector, DOE has responsibility for sites containing nuclear weapons or the materials used in making nuclear weapons. A terrorist attack on one of these sites could have devastating consequences for the site and its surrounding communities. In ensuring that these sites are adequately prepared to defend themselves against the higher terrorist threats present in a post-September 11, world, DOE faces significant challenges. Among the challenges identified in our April 2004 report[Footnote 73] are the development of a new design basis threat (DBT), a classified document that identifies, among other things, the potential size and capabilities of terrorist forces. While the May 2003 DBT identified a larger terrorist threat than did the 1999 DBT,[Footnote 74] further analysis by DOE, in response to GAO's April 2004 report, resulted in a 2004 DBT that has been refined and more closely identified with the terrorist parameters reflected in the intelligence community's postulated threat. An additional challenge involves the fact that National Nuclear Security Administration (NNSA) has not been fully effective in managing its safeguards and security program. As a result, NNSA has had difficulty in providing fully effective oversight to ensure that its contractors are properly protecting its critical facilities and materials from individuals seeking to inflict damage.[Footnote 75] Finally, although both DOE and NNSA have made progress in implementing security initiatives, both agencies could benefit from clarifying the roles and authorities of various security offices and developing methods for evaluating program effectiveness and improvement.[Footnote 76] Improving Security at DOD Installations: The homeland security strategy discusses critical infrastructure as "those systems and assets so vital to the United States that their destruction or incapacity would have a debilitating impact on security." As DOD installations are an essential element of the national defense establishment, it follows that their security is equally essential. However, we have found that DOD faces challenges in safeguarding its installations and personnel from terrorist attacks. Specifically, in August 2004,[Footnote 77] we reported that although DOD has taken several steps and committed significant resources to immediately begin installation preparedness improvements, it lacks a comprehensive approach that incorporates results-oriented management principles to guide improvement initiatives in the most efficient and effective manner. A major challenge DOD faces is the lack of a single organization or entity with the responsibility and authority to integrate and manage the installation preparedness improvement efforts of numerous DOD organizations engaged in efforts to improve installation preparedness. Additional challenges to be overcome include DOD's difficulty in developing departmentwide standards and concepts of operations for installation preparedness and in preparing a comprehensive plan for installation preparedness. [End of section] Appendix VI: Defending Against Catastrophic Threats: This appendix sets forth the definition and major initiatives of the Defending Against Catastrophic Threats mission area and discusses the agencies with major roles, their funding, the alignment of their strategic plans and implementation activities with the major initiatives, and a summary of the challenges faced by the nation. This appendix presents baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Defending Against Catastrophic Threats mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six mission areas, the fifth of which is Defending Against Catastrophic Threats. This mission area includes homeland security programs that involve protecting against, detecting, deterring, or mitigating terrorist use of weapons of mass destruction, including understanding terrorists' efforts to gain access to the expertise, technology, and materials needed to build chemical, biological, radiological, and nuclear (CBRN) weapons. In addition, this mission area includes planning and activities related to decontaminating buildings, facilities, or geographic areas after a catastrophic event. This mission area dovetails into Border and Transportation Security, Critical Infrastructure Protection, and Emergency Preparedness and Response as detection technologies are fielded and integrated into broader processes.[Footnote 78] Figure 11 shows an example of the type of activities carried out in the Defending Against Catastrophic Threats mission area. The strategy identifies the following major initiatives in the Defending Against Catastrophic Threats mission area: * preventing terrorist use of nuclear weapons through better sensors and procedures; * detecting chemical and biological materials and attacks; * improving chemical sensors and decontamination techniques; * developing broad-spectrum vaccines, antimicrobials, and antidotes; * harnessing the scientific knowledge and tools to counter terrorism; and: * implementing the Select Agent Program. Figure 11: First Responders Practice Emergency Decontamination: [See PDF for image] [End of figure] Agencies with Major Roles in Defending against Catastrophic Threats: Of the six departments under review, DHS and HHS have major roles in Defending Against Catastrophic Threats. DHS's Science and Technology Directorate develops and tests technologies and systems to detect CBRN materials and high explosives, develops and tests forensic methods to analyze CBRN materials and high explosives, and prioritizes measures to address catastrophic threats through research and modeling. HHS's National Institutes of Health (NIH) conducts basic and applied research related to likely bioterrorism agents; designs and tests diagnostics, therapies, and vaccines; and maintains laboratory capacity and provides expert assistance to address bioterrorism and other threats. Other organizations involved in this mission area include DOD, which performs research and development related to chemical and biological threats; the Department of Commerce, which is working to improve export control of weapons, materials that may be used to construct weapons, and other technologies; and the National Science Foundation, which is working to improve security and control of nuclear fuels. OMB reported that the total 2005 funding request for Defending Against Catastrophic Threats is just over $3.3 billion. The agencies with the most funding are HHS ($1.9 billion, or 57 percent), largely for research at NIH, and in DHS's Directorate of Science and Technology ($886 million, or 26 percent).[Footnote 79] Figure 12 summarizes the fiscal year 2005 budget request for the Defending against Catastrophic Threats mission area by agency. Figure 12: Proposed Fiscal Year 2005 Homeland Security Funding for Defending Against Catastrophic Threats: [See PDF for image] Notes: Budget authority in millions of dollars. "All other agencies" includes USDA ($227 million) and the Department of Commerce ($66 million) as well as the National Science Foundation ($27 million) and the Nuclear Regulatory Commission ($16 million). [End of figure] OMB's reported data do not include funding for two departments that have activities under way in this mission area. These departments--DOE and State--have either planning or implementation activity on specific initiatives, as discussed in the next section of this appendix. On the basis of our previous work, we have noted several qualifications to OMB's figures to explain this discrepancy.[Footnote 80] According to OMB officials, there is not always a clear distinction between homeland security activities and other related activities. OMB staff must make judgment calls about how to characterize funding by mission areas. For example, some homeland security activities have multiple purposes and funding for these activities is allocated to different accounts that can cover multiple mission areas. In addition, some of the departments' activities, such as planning, coordination, or providing advice may support Defending Against Catastrophic Defense activities but are not included in the amounts shown. Alignment of Department Activities with the Major Initiatives: In this section, we provide more detailed information about the Defending Against Catastrophic Threats mission area initiatives and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning/implementation activities, agency leads, and implementation activities during fiscal year 2004, with respect to each initiative. The data are summarized in table 11. Table 11: Detailed Department Planning/Implementation Activities in the Defending Against Catastrophic Threats Mission Area's Six Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All six Defending Against Catastrophic Threats initiatives are being addressed in key departments' planning and implementation activities. As shown in table 11, at least two departments cited activity in each of the six initiatives. At least four departments cited activity in four of the six initiatives. For example, DHS, DOD, State, and DOE implemented activities in fiscal year 2004 to prevent terrorist use of nuclear weapons through better sensors and procedures. DHS's Science and Technology Directorate provided leadership in directing, funding, and coordinating research, development, testing, and evaluation and procurement of technology and systems to prevent the importation of chemical, biological, and radiological nuclear and related weapons; DOD activities addressed the clandestine transportation of weapons of mass destruction, including nuclear devices, via the Container Security and Proliferation Security Initiatives; State pursued diplomatic efforts in fiscal year 2004 to ensure compliance with existing multilateral treaties, strengthening verification and compliance procedures, and strengthening the International Atomic Energy Agency; and DOE worked with DOD to secure Iraqi radiological and nuclear materials, as well as continued research at Los Alamos National Laboratory on radiological and nuclear countermeasures. Additionally, DHS, DOE, and HHS demonstrated fiscal year 2004 implementation activities oriented toward improving chemical sensors and decontamination techniques. With regard to sensors, DHS's Homeland Security Advanced Research Projects Agency approved multiple chemical sensor technology contracts, and HHS continued to increase the number of toxic substances that can be readily measured by Rapid Toxic Screen testing. With regard to decontamination, DOE, through a national laboratory, developed a decontamination countermeasure for biological and chemical agents. The only department that did not have activities related to Defending Against Catastrophic Threats initiatives is DOJ. This is understandable, given that Justice is concerned with identifying, capturing, and prosecuting individuals involved in terrorist activity rather than developing and improving sensors, vaccines, antimicrobials, antidotes, and decontamination techniques and procedures. Identification of Lead Agencies in the Initiatives: For all six initiatives, a lead agency is identified either in the strategy or HSPDs. As shown in table 11, DHS is a lead on all six initiatives. It seems appropriate that DHS would be the department with the most leads, given that the strategy's "national vision" calls for that department to "unify much of the federal government's efforts to develop and implement scientific and technological counter-measures against human, animal, and plant diseases that could be used as terrorist weapons" and "sponsor and establish national priorities for research, development, and testing to develop new vaccines, antidotes, diagnostics, therapies and other technologies against chemical, biological, radiological, or nuclear terrorism." HHS is also a lead on two initiatives, both oriented toward the public health safety of the nation (improving chemical sensors and decontamination techniques and developing broad spectrum vaccines, antimicrobials, and antidotes). More specifically, DOD, State, and DOE are all leads on the same single initiative (preventing terrorist use of nuclear weapons through better sensors and procedures). The strategy and HSPDs identified multiple leads on three of the six Defending Against Catastrophic Threats initiatives (see table 11). DHS, DOD, State, and DOE are all leads on one initiative, preventing terrorist use of weapons through better sensors and procedures; and DHS and HHS are both leads on two initiatives (improving chemical sensors and decontamination techniques and developing broad-spectrum vaccines, antimicrobials, and antidotes.) More specifically, with respect to the latter initiative, DHS identifies needs and coordinates activities rather than actually developing the vaccines, antimicrobials, and antidotes. The initiative is broadly defined to cover each of these areas. In addition, departmental strategic planning and implementation documents show that DHS is a clear lead on four of the six initiatives; and DOD, HHS, State, and DOE are implied leads on all their initiatives. Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004, implementation activity occurred with respect to all six of the Defending Against Catastrophic Threats initiatives (see table 11). DHS implemented activity in five of the six initiatives for which it was identified as a lead by either the strategy or HSPDs. HHS implemented activity in both initiatives for which it was identified as a lead; State, DOD, and DOE each implemented activity in the single initiative for which they are leads. Additionally, several of the departments under review implemented multiple Defending Against Catastrophic Threats initiatives for which they were not identified as a lead in the strategy or HSPDs. During fiscal year 2004, HHS and DOE cited implementation activities (as well as prior implementation activities) in three and four initiatives, respectively, for which they were not a lead; State cited implementation and prior implementation activities in two initiatives for which it was not a lead. DOD conducted prior implementation activities in three initiatives for which it was not a lead. In accordance with the Homeland Security Act of 2002, several departments transferred some of their programs and centers to the newly created DHS. In the case of DOE, the nuclear smuggling programs and activities that had previously been within the proliferation detection program were transferred to DHS; DOE's chemical and biological national security and supporting programs were transferred; activities of the nonproliferation and verification research and development program and nuclear activities associated with assessment, detection, and cooperation regarding international materials and protection were all transferred to DHS. In the case of DOD, functions of the National Bio- Weapons Defense Analysis Center, including related functions of the Secretary of Defense, were also transferred to DHS. Challenges in Defending Against Catastrophic Threats: The expertise, technology, and material needed to build the most deadly weapons known to mankind--including chemical, biological, radiological, and nuclear weapons--are proliferating. The consequences of a terrorist attack using these types of weapons could be far more devastating than those suffered on September 11, in that such an attack could cause a large numbers of casualties, mass psychological disruption, and widespread contamination, and could overwhelm local medical capabilities. Our recent work in the Defending Against Catastrophic Threats mission area has identified a number of challenges. These challenges include the strengthening of efforts involving the nonproliferation of weapons of mass destruction, dangerous weapons systems and materials, and dual-use items; the control of the sale of excess items that can be used to produce and deliver biological agents; and the designation of lead agencies for setting priorities for information systems related to bioterrorism. Strengthening Nonproliferation Efforts: The strategy declares that one of the nation's top priorities is to keep weapons of mass destruction out of the hands of terrorists. We have issued a number of reports concerning U.S. efforts to more effectively control and limit the spread of weapons of mass destruction, dangerous weapons systems and materials, and dual-use items. United States efforts in this regard are designed to prevent sensitive items from reaching persons, entities, or countries involved in terrorism or the proliferation of weapons of mass destruction and the vehicles to deliver them. We testified in March 2004 that the Departments of Commerce (Commerce), State, and Defense need to enhance their programs in this area.[Footnote 81] Specifically, we found that the United States faces a growing threat from the international proliferation of cruise missile and unmanned aerial vehicle (UAV) technology, challenging the tools the U.S. government has traditionally used. Multilateral export control regimes have expanded their lists of controlled items, but key countries of concern are not members. Some of these countries are also on the State Department's list of state sponsors of terrorism. In addition, U.S. efforts to control U.S. exports of dual-use items are hindered by a gap in U.S. export control authority. U.S. companies can sell certain dual-use items to foreign buyers, even if the exporter knows the buyer plans to use the items to build cruise missiles or UAVs. Finally, the United States seldom uses its end-use monitoring program to verify compliance with conditions placed on the use of cruise missiles. With regard to export controls over items that could be employed by terrorists, we found that post-shipment verification (PSV) provides limited assurance that dual-use items are being properly used. Specifically, we reviewed Commerce's efforts to conduct PSV checks to ensure that dual-use items and technologies arrive at their intended destination and are used for the purpose stated in the export license. We reported, in February 2004,[Footnote 82] that Commerce conducted relatively few post-shipment verification checks. For example, PSV checks were completed on only 6 percent of dual-use items exported to countries of potential proliferation concern. We also identified three key challenges in the PSV process itself. First, PSVs do not confirm compliance license conditions because U.S. officials frequently do not check license compliance, they often lack the technical training to assess compliance, and end-users may not be aware of the license conditions they are supposed to be abiding by. Second, some countries of concern limit the U.S. government's access. Third, PSV results have only limited impact on Commerce's future licensing decisions. Commerce generally agreed with our recommendation to address these challenges and indicated it had taken steps to strengthen the PSV process. In March 2004,[Footnote 83] we reported that another area of proliferation raising potential terrorism concerns involves delays in implementing the Chemical Weapons Convention (CWC). CWC bans chemical weapons and requires their destruction by 2007, with possible extension to 2012. CWC has played an important role in reducing the risks posed by chemical weapons. However, CWC's nonproliferation goals have proven more challenging than originally anticipated. First, the destruction of chemical weapons will likely take longer and cost more than originally anticipated. Even with significant international assistance, Russia may not be able to destroy its declared chemical weapons stockpile until 15 years beyond the extended CWC deadline. Second, technical advancements in the chemical industry and the increasing number of dual-use commercial facilities worldwide challenge the CWC's ability to deter and detect proliferation. Third, many CWC member states have not yet adopted national laws to fully implement the CWC or have not submitted complete and accurate declarations of their CWC-related activities. The Bremer, Gilmore, Hart-Rudman, and 9/11 commissions made recommendations related to the challenges presented in this section. Controlling the Sale of Biological Production Equipment: Another challenge related to keeping weapons of mass destruction out of the hands of terrorists involves the ability of terrorists to readily obtain equipment that can be used to make biological agents. We have previously reported[Footnote 84] that many items needed to establish a laboratory for making biological warfare agents were being sold on the Internet to the public from DOD's excess property inventory for pennies on the dollar--making them both easy and economical to obtain. Although production of biological warfare agents requires a high degree of expertise, public sales of these DOD excess items increase the risk that terrorists could obtain and use them to produce and deliver biological agents within the United States. To prove this point, we created a fictitious company and purchased over the Internet key excess DOD biological equipment items and related protective clothing necessary to produce and disseminate biological warfare agents. Additionally, our investigation of several buyers of the biological equipment items found that they exported them to countries, such as the Philippines, Egypt, and the United Arab Emirates, for transshipment to other countries--some of which may be prohibited from receiving exports of similar trade-security-controlled items. Finally, the possibility that anthrax and other biological agents could have fallen into the wrong hands because of poor controls at laboratories handling biological agents calls for an assessment of the challenge to national security posed by public sales of excess biological laboratory equipment and protective clothing. While it should be noted that our work to date has focused on DOD sales, we found that these same types of items are available from other sources, indicating a much broader problem. The Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions made recommendations related to this challenge. Effective Implementation of Emerging Information Technologies: The strategy calls for the development of a national system to detect biological and chemical attacks that will include "a public health surveillance system to monitor public and private databases for indicators of biological or chemical attack." One of the challenges we identified in a May 2003 report[Footnote 85] is that there are six federal agencies with key roles in bioterrorism preparedness and response. Within these six agencies, we identified 72 information systems and supporting technologies, as well as 12 other information technology initiatives, with about 74 percent of these currently operational. Of the 72 information systems identified, 34 are surveillance systems, 18 are supporting technologies, 10 are communication systems, and 10 are detection systems. In planning or operating each of these information systems and IT initiatives, the extent of coordination or interaction among the lead and other related government agencies covered a wide range. There was no one entity or coordinating body to set priorities for information systems, supporting technologies, and other IT initiatives. Within the public health sector, the implementation of emerging information technologies could help to strengthen agencies' technological capabilities to support the nation's ability to prepare for and respond to bioterrorism and other public health emergencies. Agencies identified several activities to research, develop, and implement emerging technologies, and these activities are generally initiated to meet agencies' specific needs. However, challenges exist that may hinder the public health community from benefiting from the implementation of emerging information technologies. These challenges include (1) the likelihood that emerging technologies have not been in use long enough for the developers to identify all areas of standardization, or for the technologies to have evolved to the point that they are interoperable with other existing technologies within public health; (2) the likelihood that the use of emerging technologies may change an organization's existing business model and thereby introduce a significant level of risk by disrupting existing business practices; and (3) the lack of a clearly defined mechanism for continuing research and development for emerging technologies once the results are turned over to the public sector. The Gilmore Commission made recommendations with regard to this challenge. Safeguarding Military Installations: As DOD installations are an essential element of the nation's national defense establishment, it follows that their security is equally essential. However, we reported in August 2004 that DOD faces challenges in safeguarding its installations and personnel in the United States and overseas from terrorist attacks involving chemical, biological, radiological, and nuclear weapons and high explosives.[Footnote 86] Specifically, we found that improving the preparedness of military installations is a challenging and complex task that will require a significant allocation of resources; involve numerous organizations within the department; and necessitate the coordination with other federal agencies, civilian organizations, and foreign host governments. Although DOD has taken several steps and committed significant resources to immediately begin installation preparedness improvements, it faces significant challenges and lacks a comprehensive approach that incorporates results-oriented management principles to guide improvement initiatives in the most efficient and effective manner. One major challenge DOD faces is the lack of a single organization or entity with the responsibility and authority to oversee and integrate the installation preparedness improvement efforts of various DOD organizations. Additional challenges to be overcome include the evolving or unclear responsibilities of key organizations and assignment of responsibility to update DOD's installation preparedness plans. [End of section] Appendix VII: Emergency Preparedness and Response: This appendix sets forth the definition and major initiatives of the Emergency Preparedness and Response mission area and discusses the agencies with major roles, their funding, the alignment of their strategic plans and implementation activities with the major initiatives, and a summary of the challenges faced by the nation. This appendix presents baseline information that can be used by Congress to provide oversight and track accountability for the initiatives in the Emergency Preparedness and Response mission area. Definition and Major Initiatives: The National Strategy for Homeland Security categorizes homeland security activities into six mission areas, the sixth of which is Emergency Preparedness and Response. This mission area includes programs that prepare to minimize the damage and recover from any future terrorist attacks that may occur despite our best efforts at prevention. Included here are programs that help to plan, equip, train, and practice the needed skills of the varied and necessary first responders--including police officers, firefighters, emergency medical providers, public works personnel, and emergency management officials. Finally, this mission area includes activities to consolidate federal response plans and activities to build a national system for incident management in cooperation with state and local government.[Footnote 87] Figure 13 shows an example of the types of activities carried out in the Emergency Preparedness and Response mission area. The strategy identifies the following major initiatives in the Emergency Preparedness and Response mission area: * integrating separate federal response plans into a single all- discipline incident management plan; * creating a national incident management system; * improving tactical counterterrorist capabilities; * enabling seamless communication among all responders; * preparing health care providers for catastrophic terrorism; * augmenting America's pharmaceutical and vaccine stockpiles; * preparing for chemical, biological, radiological, and nuclear decontamination; * planning for military support to civil authorities; * building the Citizen Corps; * implementing the first responder initiative of the fiscal year 2003 budget; * building a national training and evaluation system; and: * enhancing the victim support system. Figure 13: Hazardous Materials Response Unit in Action at an Exercise: [See PDF for image] [End of figure] Agencies with Major Roles in Emergency Preparedness and Response: Of the six departments under review, the Department of Homeland Security and the Department of Health and Human Services have major roles in Emergency Preparedness and Response. DHS's activities include the development and implementation of the National Response Plan and the National Incident Management System, maintaining the National Disaster Medical System and Urban Search and Rescue Teams, and supporting state and local first responders through a wide-range of programs. HHS's activities are centered on preparing the nation's health care providers for catastrophic terrorism by, among other things, maintaining the Strategic National Stockpile and other emergency preparedness and response assets. In addition to DHS and HHS, several other agencies--including the Department of Defense, which maintains weapons of mass destruction (WMD) response teams to support civil authorities; and the Department of Energy, which maintains radiological and nuclear response capabilities--are involved in Emergency Preparedness and Response. The Office of Management and Budget reported that the total fiscal year 2005 funding request for the Emergency Preparedness and Response mission area is just over $8.8 billion. DHS receives the largest share of this funding ($5.9 billion, or 68 percent), mostly for preparedness and grant assistance to state and local first responders and Project Bioshield. HHS also receives a significant amount of this funding ($2.2 billion, or 25 percent) for assisting states and localities in upgrading their public health capacity. A total of 18 other federal agencies receive emergency preparedness and response funding, with a number of these maintaining specialized response assets that may be called upon in select circumstances.[Footnote 88] Examples of these agencies include DOD, which maintains WMD response teams to support civil authorities; DOE, which maintains radiological and nuclear response capabilities; and the Environmental Protection Agency, which maintains chemical, biological, radiological, and nuclear response teams.[Footnote 89] Figure 14 summarizes the fiscal year 2005 budget request for the emergency preparedness and response mission area by agency. Figure 14: Proposed Fiscal Year 2005 Homeland Security Funding for Emergency Preparedness: [See PDF for image] Notes: Budget authority in millions of dollars. All other agencies includes the Departments of Agriculture ($69 million), Veterans Affairs ($33 million), Commerce ($25 million), Treasury ($16 million), Transportation ($14 million), Labor ($10 million), Interior ($4 million) and Education ($1 million), as well as EPA ($30 million), and several others. [End of figure] Alignment of Department Activities with the Major Initiatives: This section provides more detailed information about the Emergency Preparedness and Response mission area initiatives and the departments involved in conducting activities related to these initiatives. This includes a discussion of specific departmental planning/implementation activities, lead agency designations, and department implementation activities in fiscal year 2004, with respect to each initiative. The data are summarized in table 12. Table 12: Detailed Department Planning/Implementation Activities in the Emergency Preparedness and Response Mission Area's Twelve Initiatives: [See PDF for image] [End of table] Summary of Departmental Activities on the Initiatives: All 12 Emergency Preparedness and Response initiatives are being addressed in key departments' planning and implementation activities. As shown in table 12, at least two departments cited activity in each of the 12 initiatives. At least four departments cited activity in 7 of the 12 initiatives. For example, DHS, DOD, HHS, and DOE each cited implementation activities in fiscal year 2004 with respect to creating a national incident management plan. DHS Federal Emergency Management Agency worked on a comprehensive National Incident Management System that incorporates federal, state, tribal, and local government personnel, agencies, and regional authorities; DOD participated in the planning of the National Incident Management System; HHS issued continuing guidance to assist state and local jurisdictions in preparation for joining the National Incident Management System; and DOE implemented an agreement to release departmental emergency response assets to DHS as requested in support of DHS's national incident management role. Additionally, DHS and HHS implemented activities in fiscal year 2004 toward creating seamless communication among all responders. DHS established an office to oversee interoperability efforts, contracts have been awarded to develop interoperability communication technologies, and the DHS Science and Technology Directorate is leading the RAPIDCOM initiative (under SAFECOM, a federal governmentwide program to achieve communication interoperability), and HHS (through its Centers for Disease Control and Prevention) increased the percentage of health departments with interoperable, redundant communication systems and high-speed Internet access, and has raised the number of jurisdictions having access to the Epidemic Information Exchange. All departments have implemented several initiatives in fiscal year 2004 related to the Emergency Preparedness and Response critical mission area, with one exception: State has implemented activity with respect to only one initiative (improving tactical counterterrorist capabilities). Identification of Lead Agencies on the Initiatives: For all 12 initiatives, a lead agency is identified either in the strategy or the Homeland Security Presidential Directives. DHS is the lead on the most initiatives in this mission area--11 of the 12 initiatives, the single exception being the initiative to augment America's pharmaceutical and vaccine stockpiles. It seems appropriate that DHS would be the department with the most leads given that the strategy's "national vision" calls for DHS to "consolidate federal response plans and build a national system for incident management" and "ensure that leaders at all levels of government have complete incident awareness and can communicate with and command all appropriate response personnel." Additionally, HHS is a lead on 3 of the 12 initiatives--augmenting America's pharmaceutical and vaccine stockpiles; preparing for chemical, biological, radiological, and nuclear decontamination; and building a national training and evaluation system. DOD is a lead on 1 of the 12 initiatives within this mission area--planning for military support to civil authorities. Three departments have not been identified as a lead on any initiatives in this mission area: DOJ, State, and DOE. The strategy and HSPDs identified multiple leads on 2 initiatives (see table 12). DHS and DOD are both leads on planning for military support to civil authorities; and DHS and HHS are leads on building a national training and evaluation system. In addition, 10 of the 11 DHS leads are clear, and the single DOD lead is clear. HHS lead is clear with respect to augmenting America's pharmaceutical and vaccine stockpiles and implied with respect to building a normal training and evaluation system and preparing for chemical, biological, radiological, and nuclear decontamination. (We included HHS as an implicit lead on the latter initiative since the department was an implicit lead on the closely related initiative, "improving chemical sensors and decontamination techniques" in the Defending against Catastrophic Threat mission area.) Fiscal Year 2004 Implementation of the Initiatives: In fiscal year 2004 implementation activity occurred with respect to each of the 12 Emergency Preparedness and Response initiatives (see table 12). DHS implemented activity in 2004 on all 11 initiatives for which it was identified as a lead. DOD implemented prior and 2004 activities in the one area where it was the lead (planning for military support to civil authorities), and HHS implemented prior and 2004 activities in its two lead areas (augmenting America's pharmaceutical and vaccine stockpiles and building a national training and evaluation system). Additionally, several of the departments under review implemented multiple Emergency Preparedness and Response initiatives for which they were not identified as a lead in either the strategy or HSPDs. During fiscal year 2004, DHS cited implementation activities in the single initiative for which it was not identified as a lead--augmenting America's pharmaceutical and vaccine stockpiles. HHS cited 2004 implementation activities in 7 initiatives for which it was not a lead. Similarly, DOE cited implementation activities in 6 initiatives for which it was not identified as a lead in the strategies or HSPDs; and DOJ and DOD both cited fiscal year 2004 implementation activities in 3 initiatives for which they were not leads, respectively. DOJ's role in the Emergency Preparedness and Response mission area has been modified because of program transfers. DOJ's Office of Domestic Preparedness (ODP) had provided grant funding to assist state and local emergency response agencies (with respect to law enforcement, fire, hazardous materials, emergency medical services, emergency management, and public health) to enhance their capabilities to respond to threats posed by terrorist use of weapons of mass destruction. This program was transferred to DHS. Challenges in Emergency Preparedness and Response: Our recent work in the Emergency Preparedness and Response mission area has identified a number of challenges that must be overcome if the nation is to effectively minimize the damage and successfully recover from future terrorist attacks that may occur despite its best efforts at preventing them. One challenge involves the adoption of an "all- hazards" approach to emergency preparedness and response. Addressing this challenge would ensure that the nation is better prepared for terrorist events while simultaneously better preparing itself to deal with natural disasters. Another challenge involves providing better governmental planning and coordination with regard to first responder issues. An example of the challenge faced here concerns the National Capital Region (NCR), where there exists no coordinated regionwide plan for first responder priorities. Other challenges with regard to first responders include better preparing them to respond to incidents involving catastrophic terrorism and restructuring the federal grant system. An additional challenge involves improving public health communications and information sharing. An example of this challenge is the lack of a coordinated review process that ensures that communications projects complement one another. Additional challenges include better preparing health care providers to respond to incidents involving bioterrorism; improving regional response planning involving multiple municipalities; ensuring that hospitals have the medical equipment necessary for large influxes of patients; ensuring adequate communications among responders and with the public, and defining the roles and responsibilities of DOD in defending the homeland and providing military support to civil authorities. Adopting an All-hazards Approach: The strategy calls for the creation of "a fully integrated national emergency response system that is adaptable enough to deal with any terrorist attack, no matter how unlikely or catastrophic, as well as all manner of natural disasters." This all-hazards approach to emergency preparedness and response has been embodied in a number of documents, including HSPD-5 and HSPD-8; the National Incident Management System; and the National Response Plan. In our May, June, and July 2004 reports,[Footnote 90] we pointed out that the challenges the nation's emergency responders face in adapting an all-hazards approach include (1) identifying the types of emergencies--e.g., hurricane or truck bomb attack--for which they should be prepared and the requirements--e.g., incident management plans and procedures, equipment, and training--for responding effectively to these different types of emergencies; (2) assessing current capabilities against those requirements; (3) developing and implementing effective, coordinated plans among multiple first responder disciplines and jurisdictions to close the gap between current capabilities and established requirements; and (4) defining the roles and responsibilities of federal, state, and local governments and private entities in defining requirements, assessing capabilities, and developing and implementing coordinated plans to enhance first responder capabilities. The Gilmore and 9/11 commissions made recommendations with regard to this challenge. Improving Intergovernmental Planning and Coordination: The strategy emphasizes a shared national responsibility--involving all levels of government--in responding to a serious emergency, such as a terrorist incident. However, in May 2004 we reported that a major challenge involves a lack of coordination in preparing for, responding to, and recovering from terrorist and other emergency incidents.[Footnote 91] In particular, our work indicates that there has been a lack of regional planning and coordination for developing first responder preparedness, defining preparedness goals, identifying spending priorities, and expending funds. For example, our review of the first responders grants in the National Capital Region (NCR) found that there was no coordinated regionwide plan for establishing first responder performance goals, needs, and priorities and assessing benefits of expenditures to enhance first responder capabilities. As a result, NCR faces several challenges in organizing and implementing efficient and effective regional preparedness programs, including the lack of a coordinated strategic plan for enhancing NCR preparedness, performance standards, a central source of data on funds available and the purposes for which they are spent. We found similar challenges related to regional coordination in our April 2003 bioterrorism work.[Footnote 92] The strategy calls for state and local governments to "sign mutual aid agreements to facilitate cooperation with their neighbors in time of emergency." Such agreements are particularly important because although the response to a terrorist incident (such as a bioterrorism attack) would occur at the local level, it could spread across local, state, and even national boundaries. We found that health care officials were challenged by a lack of regional coordination between the states and with neighboring countries. Specifically, states tend to organize their planning on a regional basis, assigning local areas to particular regions within the state. Additionally, we found that border states varied with regard to the intensity of their coordination efforts with Canada and Mexico. The Gilmore, Hart-Rudman, and 9/11 commissions made recommendations with regard to this challenge. Overcoming Fragmentation of the Federal Grant System: The strategy acknowledges that the federal grant system for first responders is highly fragmented. In September 2003,[Footnote 93] we testified that this fragmentation leads to challenges in the coordination and integration of services, as well as in planning at state and local levels. There are many different grant programs that can be used by first responders to address preparedness activities. However, in April 2003,[Footnote 94] we testified that substantial differences exist in the types of recipients and the allocation methods for grants addressing similar purposes. For example, some grants go directly to local first responders, such as firefighters, while others go to state emergency management agencies or directly to state fire marshals. The allocation methods differ as well--some are formula grants, while others involve discretionary decisions by federal agency officials on a project basis. Grant requirements vary as well. For example, DHS's Assistance to Firefighters Grant has a maintenance of effort requirement, while the State Fire Training Systems Grant has no similar requirement. Several alternatives might be employed to overcome problems fostered by this fragmentation, including consolidating grant programs, establishing performance partnerships between federal agencies and state and local governments, and waiving federal funding restrictions and program requirements. The Gilmore and 9/11 commissions made recommendations with regard to this challenge. Improving Communications and Information Sharing: The strategy has an initiative to enable seamless communications among all first responders and public health entities. However, in our August and November 2003 reports,[Footnote 95] we stated that insufficient collaboration among federal, state, and local governments creates a challenge for sharing public health information and developing interoperable communications for first responders. For example, states and cities implemented many initiatives to improve information sharing, but these initiatives were not well coordinated and risked creating partnerships that limited access to information and created duplicative efforts. Another challenge involves the lack of effective, collaborative, interdisciplinary, and intergovernmental planning for interoperable communications. For instance, the federal and state governments lack a coordinated grant review process to ensure that funds are used for communication projects that complement each other and add to overall statewide and national interoperability capacity. Moreover, we testified in April 2004[Footnote 96] that the Wireless Public Safety Interoperable Communications Program, or SAFECOM, has had very limited progress in achieving communication interoperability among all entities at all levels of government and has not achieved the level of collaboration necessary. Finally, in our October 2002 report[Footnote 97] on public health preparedness, we reported that challenges exist in ensuring communication among responders and with the public. For example, during the anthrax incidents of 2001, local officials identified communication among responders and with the public as a challenge, both in terms of having the necessary communication channels and in terms of making the necessary information available for distribution. The 9/11 Commission made recommendations with regard to this challenge. Better Preparing Health Care Providers for Catastrophic Terrorism: The strategy has an initiative to "prepare health care providers for catastrophic terrorism." However, in April 2003,[Footnote 98] we reported that many local areas and their supporting agencies may not be adequately prepared to respond to such an event. Specifically, while many state and local officials reported varying levels of preparedness to respond to a bioterrorist attack, they reported that challenges existed because of deficiencies in capacity, communication, and coordination elements essential to preparedness and response (such as workforce shortages, inadequacies in disease surveillance and laboratory systems, and a lack of regional coordination and compatible communications systems). Some of these challenges, such as those involving coordination efforts and communication systems, were being addressed more readily, whereas others, such as infrastructure and workforce issues, were more resource-intensive and, therefore, more difficult to address. Generally, we found that cities with more experience in dealing with public health emergencies were generally better prepared for a bioterrorist attack than other cities, although challenges remain in every city. An additional challenge reported to us by state and local officials concerned the lack of adequate guidance from the federal government on what it means to be prepared for bioterrorism. These officials said that they needed specific standards (such as how large an area a response team should be responsible for) to indicate what they should be doing to be adequately prepared. Finally, state officials indicated that a challenge to be overcome involved the lack of sharing of best practices information. These officials stated that while each jurisdiction might need to adapt procedures to its own circumstances, time could be saved and needless duplication of effort avoided if better mechanisms existed for sharing strategies across jurisdictions. The Gilmore, Hart-Rudman, and 9/11 commissions made recommendations with regard to this challenge. Improving Response Capabilities: The strategy recognizes that "a major act of biological terrorism would almost certainly overwhelm existing state, local, and privately owned health care capabilities." In fact, in May 2003 we testified that while the efforts of public health agencies and health care organizations to increase their preparedness for major public health threats has increased, significant challenges remain.[Footnote 99] Specifically, we found that there are gaps in disease surveillance systems and laboratory capacity, and the number of personnel trained for disease detection is insufficient. Additionally, most emergency departments across the country lack the capacity to respond to large-scale infectious disease outbreaks. For example, although most hospitals across the country reported participating in basic planning activities for large-scale infectious disease outbreaks, few have acquired the medical equipment resources--such as ventilators--that would be required in such an event. Further, because most emergency departments already routinely experience some degree of overcrowding, they may not be able to handle the sudden influx of patients that would occur during a large-scale terrorist incident or infectious disease outbreak. The Gilmore Commission made recommendations with regard to this challenge. Adequately Equipping Hospitals for Large Influxes of Patients: The strategy states that DHS, working with HHS and VA, will help hospitals "expand their surge capacity to care for large numbers of patients in a mass-casualty incident." However, in August 2003 we reported[Footnote 100] that a challenge to be overcome involved the fact that the medical equipment available for response to such an incident varies greatly among hospitals. Additionally, many hospitals reported that they did not have the capacity to respond to the large increase in the number of patients that would be likely to result from a bioterrorist incident with mass casualties. For example, if a large number of patients with severe respiratory problems associated with anthrax or botulism were to arrive at a hospital, a comparable number of ventilators would be required to treat them. However, half of the hospitals we reviewed had, per 100 staffed beds, fewer than six ventilators, three or fewer personal protective equipment suites, fewer than four isolation beds, or the ability to handle fewer than six patients per hour through a 5-minute decontamination shower. Overcoming this challenge is particularly difficult because bioterrorism preparedness is expensive, and hospitals are reluctant to create capacity that is not needed on a routine basis and may never be needed at a particular facility. Related to this challenge, HSPD-10 stated that HHS "in coordination with other appropriate federal departments and agencies, is the principal federal agency responsible for coordinating all federal-level assets activated to support and augment the state and local medical and public health response to mass casualty events." The Gilmore Commission made recommendations with regard to this challenge. Establishing Emergency Preparedness Standards: Although the strategy discusses benchmarks, standards, and other performance measures for emergency preparedness, we have found that there is not yet a comprehensive set of preparedness standards for assessing first responder capacities, identifying gaps in those capacities, and measuring progress in achieving performance goals. Additionally, in June 2004, we testified[Footnote 101] that state and local officials were concerned about the lack of specific standards for determining preparedness, and these officials noted that specific benchmarks would help them determine whether they were adequately prepared to respond to a bioterrorism incident. Moreover, in our past work on interoperable communications,[Footnote 102] we discussed the need to establish national interoperability performance goals and standards. Finally, we have reported on the lack of reliable information on existing federal, state, and local capabilities for combating terrorism and the need to develop a comprehensive inventory of existing capabilities. Without standards linked to such capabilities, it will be a challenge to assess preparedness gaps and efforts to address the gaps without information on existing capabilities. The Gilmore Commission made recommendations with regard to this challenge. Defining DOD's Homeland Security Roles and Missions: The strategy called for a review of the authority for military assistance in domestic security. One of the reasons for this review is that federal law places some restrictions on military personnel performing law enforcement functions with the United States--functions that might be needed in a terrorist incident.[Footnote 103] Another reason for this review is that DOD's primary mission is to deter and prevent aggression abroad and fight to win if these measures fail. This is accomplished through military presence and power projection. However, the federal government's view of the defense of U.S. territory has changed since September 11. As a result, DOD has adjusted its strategic and operational focus to encompass not only traditional military concerns posed by hostile states overseas but also asymmetric threats directed at our homeland by both terrorists and hostile states. In a July 2003 report,[Footnote 104] we noted that DOD faces challenges in balancing its domestic and overseas missions with a renewed emphasis on homeland defense. Moreover, current operations both home and abroad are stressing military forces, as shown in personnel tempo data. Complicating the situation is the fact that some units are not well structured for their domestic missions, cannot practice the varied skills needed to maintain combat proficiency while performing domestic missions, and receive little training value from their assigned domestic duties. Therefore military force readiness may erode and future personnel retention problems may develop, if action is not taken to address these challenges. The Gilmore and 9/11 commissions made recommendations with regard to this challenge. [End of section] Appendix VIII: Crosscutting Issues: This appendix describes challenges in implementing the National Strategy for Homeland Security that are crosscutting--they cut across the six critical mission areas. Many of them also cut across the federal, state, local and private sectors. Because this appendix is not based on any critical mission area (as defined in the strategy), it does not include information on major initiatives, agencies with major roles, funding by department, or alignment of department plans with major initiatives. Crosscutting Challenges: Our recent work has identified a number of challenges to ensuring the security of the homeland that are not confined to a specific mission area. These challenges are governmentwide in nature and include balancing homeland security funding needs with other national requirements, providing timely and transparent homeland security funding information, improving risk management methods for resource allocation and investments, expanding agency use of performance measures that link costs to outcomes, establishing baseline performance goals and measures upon which to assess and improve preparedness, developing and implementing national standards, clarifying roles and responsibilities within and between the levels of government and the private sector, developing a national enterprise architecture, and improving information technology management governmentwide. In addition to the challenges discussed above, DHS--as the department most responsible for Homeland Security--faces a number of other challenges. Because of this, in January 2003 we designated the overall implementation and transformation of DHS as high-risk.[Footnote 105] We gave it this designation for three reasons. First, the size and complexity of the effort make the challenge especially daunting, requiring sustained attention and time to achieve the department's mission in an effective and efficient manner. Second, the components being merged into DHS already face a wide array of existing challenges that must be addressed. Finally, if DHS cannot effectively carry out its mission, it exposes the nation to potentially very serious consequences. We are currently in the process of reviewing the challenges faced by DHS, the progress it has made in addressing these challenges, and its continued high-risk designation. The results of this review will be published in a forthcoming GAO report. Balancing Homeland Security with Other National Budget Needs: The strategy notes that "the national effort to enhance homeland security will yield tremendous benefits and entail substantial financial and other costs." In April 2002 and September 2003, we reported that, among other things, the federal government must address the challenge of formulating realistic budget and resource plans that support and will sustain implementation of an efficient and effective homeland security program and that provide sufficient guidance to federal, state, local and private sector entities to create concurrent and compatible strategic plans and investments.[Footnote 106] In this regard, extensive resources that have already been designated for homeland security, along with those resources currently being proposed, clearly reflect a large and rapidly growing federal role involving direct spending and assistance to others. While a robust homeland security program is critical to the nation's protection and prosperity, the challenge will be to develop it in a manner that is targeted to areas of greatest need and avoids wasteful, unfocused, or "hitchhiker" spending. Moreover, the new commitments will compete with and increase the pressure on other important priorities within the budget. As our long-term budget simulation notes, known demographic trends and rising health care costs will place unprecedented pressures on our long-range fiscal position. A fundamental review of existing programs and operations can create much-needed fiscal flexibility by weeding out programs that are outdated, poorly targeted, or inefficiently designed and managed. An additional challenge with regard to balancing homeland security funding with other national requirements involves the role of both the executive and legislative branches of government in ensuring optimum performance and appropriate accountability of our homeland security activities and program expenditures. The 9/11 Commission made recommendations related to this challenge. Providing Timely and Transparent Budget Information: The strategy reflects that "it is important to reprioritize spending to meet our homeland security needs, and not simply to permit unchecked overall growth in federal outlays." To examine homeland security as a crosscutting governmentwide function, Section 889 of the Homeland Security Act of 2002 requires that the President's budget include a funding analysis covering all federal homeland security activities--not just those carried out in DHS. As we reported in November 2002,[Footnote 107] agencies provide information that distinguishes funding for homeland security from combating terrorism and other federal activities at a level of detail that OMB describes as sufficient to analyze government spending on homeland security. OMB has made a number of improvements to its annual Report to Congress on Combating Terrorism.[Footnote 108] For the first time, the annual report issued in September 2003 aggregated funding information by the critical mission areas in the National Strategy for Homeland Security. Additionally, by releasing this year's analysis with the President's fiscal year 2005 budget, OMB has made this crosscutting presentation a timely complement to individual budget proposals and a resource for congressional budget deliberations. Despite these positive changes, congressional decision makers still face challenges in using this information to make sound decisions on appropriations. Specifically, a key element to understanding spending for homeland security is missing- -that is, how much of the funding provided has been obligated. Without obligation information, it is impossible to know (1) whether funds are being used to implement programs (e.g., orders placed, contracts awarded, and services received); (2) how much funding from prior years is still available to potentially offset new needs or priorities; (3) whether the rate of spending for a program is slower than anticipated; or (4) what the level of effort or commitment is in a particular mission area for a given year or over time. Improving Risk Management Methods for Resource Allocation and Investment: The strategy states that "we must carefully weigh the benefit of each homeland security endeavor and only allocate resources where the benefit of reducing risk is worth the amount of additional cost." We have long advocated a risk management approach to guide the allocation of resources and investments for improving homeland security.[Footnote 109] Additionally, OMB has identified various tools it considers useful in planning, such as benefit-cost analysis, capital budgeting, and regulatory decision making.[Footnote 110] Such tools are difficult to apply to homeland security expenditures even when such application is encouraged in the homeland security strategy.[Footnote 111] A challenge to the central management of the budget is to develop and adopt a framework and supporting tools to inform cost allocations in a risk management process. Although OMB asked the public in 2002 for suggestions on how to adjust standard tools to the homeland security setting,[Footnote 112] a vacuum currently exists in which benefits of homeland security investments are often not quantified and are almost never valued in monetary terms.[Footnote 113] As OMB guidance is relatively silent on acceptable treatments of nonquantifiable benefits,[Footnote 114] there is a lack of criteria to guide agency analysts in developing information to inform management. The Gilmore and 9/11 commissions made recommendations on the need for risk management. Establishing Baseline Performance Goals and Measures: While the strategy discusses creating benchmarks and performance measures, it does not provide a baseline set of performance goals and measures upon which to assess and improve preparedness. The Government Performance and Results Act of 1993 (GPRA) required federal agencies to develop strategic plans with long-term, outcome-oriented goals and objectives, annual goals linked to achieving the long-term goals, and annual reports on the results achieved. In July 2002,[Footnote 115] we testified that because of lack of performance goals and measures in the homeland security strategy, the nation does not have a comprehensive set of performance goals and measures upon which to assess and improve prevention efforts, vulnerability reduction, and responsiveness to damage and recovery needs at all levels of government. Thus the nation faces a challenge to establish clear goals and performance measures to ensure both a successful and a fiscally responsible preparedness effort. We identified strategic planning as one of the critical success factors for new organizations. For example, as part of its implementation phase, we noted that DHS should engage in strategic planning through the involvement of stakeholders, assessment of internal and external environments, and an alignment of activities, core processes, and resources to support mission-related outcomes. We are currently reviewing DHS's first strategic plan to, among other things, assess the extent to which it reflects GPRA requirements and supports the strategy. The 9/11 Commission made recommendations related to this challenge. Clarifying Government and Private Sector Roles and Responsibilities: According to the strategy, "the responsibility for providing homeland security is shared between federal, state and local governments, and the private sector." In April 2002,[Footnote 116] we testified, however, that the appropriate roles and responsibilities within and between the levels of governments and with the private sector are evolving and need to be clarified. New threats are prompting a reassessment and shifting of long-standing roles and responsibilities. These shifts have been occurring on a piecemeal and ad hoc basis without the benefit of an overarching framework and criteria to guide the process. The homeland security strategy recognizes the challenge posed by a complex structure of overlapping federal, state, and local governments--our country has more than 87,000 jurisdictions--but its initiatives often do not provide a baseline set of performance goals and measures upon which to assess and improve preparedness. Thus, the nation does not yet have a comprehensive set of performance goals and measures upon which to assess and improve prevention efforts, vulnerability reduction, and responsiveness to damage and recovery needs at all levels of government. Given the need for a highly integrated approach to the homeland security challenge, national performance goals and measures for strategy initiatives that involve both federal and nonfederal actors may best be developed in a collaborative way involving all levels of government and the private sector. Standards are one tool the homeland security strategy emphasizes in areas such as training, equipment, and communications. The 9/11 Commission made recommendations related to this challenge. Developing a National Enterprise Architecture for Homeland Security: The strategy points out that mobilizing and organizing the nation to secure it from terrorist attacks is "an exceedingly complex mission that requires coordinated and focused effort from our entire society." The development of a national enterprise architecture could assist in transforming the various organizations involved in homeland security, as well as their supporting systems, in a way that eliminates duplication, promotes interoperability, reduces costs, and optimizes mission performance. An enterprise architecture is a blueprint that defines, both in logical terms (including interrelated business processes and business rules, integrated functions, applications, systems, users, work locations, and information needs and flows) and in technical terms (including hardware, software, data, communications, and security) how an organization operates today, how it will operate in the future, and a road map for the transition. DHS intends to incrementally develop a national enterprise architecture for homeland security. In August 2004,[Footnote 117] we reported that DHS's initial enterprise architecture provided a partial basis upon which to build future versions that can be made applicable beyond the department itself. However, it was missing most of the content necessary to be considered a well-defined architecture. Moreover, the content in this version was not systematically derived from a DHS or national corporate business strategy; rather, it was more the result of an amalgamation of the existing architectures that several of DHS's predecessor agencies already had, along with their respective portfolios of system investment projects. Such a development approach is not consistent with recognized architecture development best practices. DHS officials agreed with our content assessment of their initial architecture, stating that it is largely a reflection of what could be done without a departmental strategic plan to drive architectural content and with limited resources and time. Since our report was published, DHS has developed the next version or increment of its enterprise architecture, with the intent of developing future versions or increments that extend horizontally to include, for example, state and local government homeland security entities. The 9/ 11 Commission made recommendations related to this challenge. Improving Governmentwide Information Technology Management: The strategy states that "every government official performing every homeland security mission depends upon information and information technology." However, in January 2004,[Footnote 118] we reported that challenges are faced throughout the federal government with regard to information technology management--including the consistent application of IT strategic planning and performance measurement practices. Specifically, we have found that agencies generally have IT strategic plans and goals, but that these goals are not always linked to specific performance measures that are tracked. Additionally, while agencies largely have IT investment management boards, we found no agency had the practices associated with control fully in place. These practices are important ingredients for ensuring effective strategic planning and investment management, and they, in turn, make it more likely that the billions of dollars in government IT investments will be wisely spent. Finally, our experience with federal agencies has shown that attempts to modernize IT environments without blueprints-- models simplifying the complexities of how agencies operate today, how they will operate in the future, and how they will get there--often result in unconstrained investment and systems that are duplicative and ineffective. Enterprise architectures, as described in our report, offer such blueprints. The 9/11 Commission made recommendations related to this challenge. [End of section] Appendix IX: Department Summary Across Critical Mission Areas: This appendix provides a summary analysis across all the six mission areas. It includes information on whether all 43 initiatives are being covered, how frequently departments are cited with lead responsibilities, whether they are implementing programs related to these initiatives in fiscal year 2004, and where such implementation efforts are concentrated. As stated earlier, we used the National Strategy for Homeland Security and Homeland Security Presidential Directives 1 through 12 to determine lead agencies with respect to each initiative. The "clear" and "implied" leads, discussed in the methodology section, are denoted by solid and dashed line boxes, respectively. Table 13: Summary of Department Leads, Planning, and Implementation across the Six Critical Mission Areas of the National Strategy for Homeland Security: [See PDF for image] [End of table] The strategy identifies 43 initiatives across the six mission areas. All 43 initiatives have been addressed through department planning or implementation activities. Each initiative has been addressed by at least two departments under review, with a single exception (Justice is the only department involved in planning/implementing activities to complete the FBI's restructuring process to emphasize the prevention of terrorist attacks). A total of 33 initiatives have been addressed by three or more departments under review; 9 initiatives have been addressed by five or more departments. All initiatives have identified leads, with one exception (the Intelligence and Warning initiative, "employment of red-team techniques"). The strategy and HSPDs intended DHS to be the prominent department on matters related to homeland security. This is reflected in DHS being identified as a lead on 37 of the 43 initiatives, spanning all six critical mission areas. DOJ is identified as a lead department on 8 of the 43 initiatives, including all 6 initiatives cited under the Domestic Counterterrorism mission area--the mission area most specifically related to criminal justice matters. (DOJ had been identified as a lead agency with respect to two initiatives, creating smart borders and guarding America's critical infrastructure and key assets against inside threats. However, given the transfer of the Immigration and Naturalization Service and the National Infrastructure Protection Center programs to the Department of Homeland Security, DOJ officials indicated the department no longer serves as a lead on these 2 initiatives). HHS is identified as a lead on 6 of the 43 initiatives. (HHS has no lead responsibilities with respect to the Intelligence and Warning, Border and Transportation Security, and Domestic Counterterrorism mission areas.) State is cited as a lead on 4 initiatives, spanning all the critical mission areas with the exception of Intelligence and Warning and Emergency Preparedness and Response. DOD has been cited in the homeland security strategy and HSPDs as a lead on 3 initiatives (excluding the Intelligence and Warning, Border and Transportation Security, and Domestic Counterterrorism mission areas). DOE is a lead department on 2 initiatives, encompassing just two critical mission areas: Protecting Critical Infrastructures and Key Assets and Defending against Catastrophic Threats. The six departments under review have implemented activities on several initiatives during fiscal year 2004, for which they have been identified as leads. DHS cited implementation activities in 36 of the 37 initiatives for which it was identified as a lead (the one exception being the Select Agent Program). HHS, DOD, DOE, DOJ, and State cited implementation activities in fiscal year 2004 on each of their lead areas. In total, one or more departments cited implementation activities in fiscal year 2004 on all 43 initiatives. When considering departmental implementation activities during fiscal year 2004, irrespective of lead, we find that DHS documented activities in 40 of the 43 initiatives, spanning all six critical mission areas. DOE documented fiscal year 2004 implementation activities in 25 of the 43 initiatives, also spanning all six critical mission areas. HHS identified 2004 activities in 24 of the 43 initiatives, covering five of the six mission areas (the exception: Intelligence and Warning). DOD cited 2004 implementation activities in 17 of the 43 initiatives, covering all six mission areas. State demonstrated 2004 activities in 15 of the 43 initiatives, spanning all six mission areas; and DOJ identified 2004 activities in 13 of the 43 initiatives, covering four of the six mission areas (the exceptions: Border and Transportation Security and Defending against Catastrophic Threats). [End of section] Appendix X: Homeland Security Presidential Directives: This appendix describes, in chronological order, the presidential directives that, in conjunction with the National Strategy for Homeland Security and certain other national strategies, form the foundation for the federal government's efforts to protect the nation against terrorist attack and ensure the security of the homeland. These documents set forth agencies' roles and responsibilities for responding to potential or actual terrorist threats or incidents as well as the processes and mechanisms by which the federal government mobilizes and deploys resources and coordinates assistance to state and local authorities, the public, and the private sector. Homeland Security Presidential Directive-1: HSPD-1 was issued on October 29, 2001. It established the Homeland Security Council (HSC) and charged it with ensuring that all homeland security-related activities carried out by the executive agencies and departments are properly coordinated and with promoting the effective development and implementation of all homeland security policies. In addition to describing the organization and operation of the HSC, it set forth the composition and duties of the HSC Principals Committee (the senior interagency forum under the HSC for homeland security issues) and the HSC Deputies Committee (the senior sub-Cabinet interagency forum for consideration of policy issues affecting homeland security). It also discussed the formation of the 11 HSC Policy Coordination Committees to serve as the main day-to-day forum for interagency coordination of homeland security policy. Homeland Security Presidential Directive-2: HSPD-2, also issued on October 29, 2001, set forth U.S. national policy for combating terrorism through the application of enhanced immigration policies designed to aggressively prevent the entry into the country of aliens who engage in or support terrorist activity and to identify, locate, detain, prosecute, and deport any such aliens already residing in the United States. This directive established the Foreign Terrorist Tracking Task Force to ensure federal agency coordination and directed the (1) development and implementation of multiyear plans to enhance the investigative and intelligence analysis capabilities of the INS and Customs Service; (2) implementation of measures to end the abuse of student visas and prohibit certain international students from receiving education and training in sensitive areas; (3) initiation of negotiations with Canada and Mexico to ensure maximum possible compatibility of immigration, customs, and visa policies; and (4) study of the use of advanced technologies for data sharing and enforcement efforts. Homeland Security Presidential Directive-3: Issued on March 11, 2002, HSPD-3 established the Homeland Security Advisory System (HSAS) as a comprehensive and effective means for ensuring the rapid dissemination of information regarding the risk of terrorist acts to federal, state, and local authorities and to the general public. It describes the HSAS as a system that provides warnings in the form of a set of graduated threat levels that increase as the risk of an attack rises and goes on to explain that for each threat level there would be a corresponding set of protective measures that would be implemented. According to HSPD-3, the HSAS is intended to create a common vocabulary, context, and structure for an ongoing national dialogue about the nature of the terrorist threat and the actions that can be taken in response to it. Homeland Security Presidential Directive-4: Issued in December 2002, HSPD-4 is the unclassified version of the National Strategy to Combat Weapons of Mass Destruction. This directive promulgates the nation's resolve to combat weapons of mass destruction through the application of new technologies, increased emphasis on intelligence collection and analysis, the strengthening of alliance relationships, and the establishment of new partnerships with former adversaries. Further, HSPD-4 sets forth the three principal pillars upon which the strategy will rest--counterproliferation to combat WMD use; strengthened nonproliferation to combat WMD proliferation; and consequence management to respond to WMD use. The classified version of this HSPD is NSPD-17. Homeland Security Presidential Directive-5: HSPD-5, issued on February 28, 2003, is concerned with the management of domestic terrorist attacks, major disasters, and other emergency incidents. It calls for the establishment of a single, comprehensive national incident management system in order to ensure that all levels of government across the nation have the capability to work together efficiently and effectively, using a national approach to domestic incident management. HSPD-5 further states that with regard to domestic incidents, the federal government will treat crisis management and consequence management as a single, integrated function, rather than as two separate functions. HSPD-5 is considered to be a companion to HSPD- 8, which was issued in December 2003. Homeland Security Presidential Directive-6: Issued on September 16, 2003, HSPD-6 set forth the policy of the United States with regard to the integration and use of screening information. It directed the Attorney General to establish an organization to consolidate the government's approach to terrorism screening and provide for the appropriate and lawful use of terrorist information in screening processes. HSPD-6 further directed that the heads of executive departments and agencies provide--to the extent permitted by law--the Terrorist Threat Integration Center with all appropriate terrorist information in their possession, custody, or control on an ongoing basis. Homeland Security Presidential Directive-7: HSPD-7 was issued on December 17, 2003, and established a national policy for federal departments and agencies to identify and prioritize United States critical infrastructure and key resources and to protect them from terrorist attacks. It set forth the roles and responsibilities of the Secretary of Homeland Security, sector-specific federal agencies, and other departments, agencies, and offices in critical infrastructure protection. It should be noted that HSPD-7 superseded an earlier presidential directive on critical infrastructure protection (PDD 63). Homeland Security Presidential Directive-8: This directive was also issued on December 17, 2003. It established policies to strengthen the nation's preparedness to prevent and respond to potential or actual terrorist attacks, major disasters, and other emergencies by requiring a national domestic all-hazards preparedness goal, establishing mechanisms for improved delivery of federal preparedness assistance to state and local governments, and outlining actions to strengthen the preparedness capabilities of federal, state, and local entities. HSPD-8 is a companion to HSPD-5, which had been issued earlier in the year. Homeland Security Presidential Directive-9: HSPD-9, issued on January 30, 2004, established a national policy to defend the agriculture and food system of the United States against terrorist attacks, major disasters, and other emergencies. It set forth the roles and responsibilities of the Secretaries of Homeland Security, Agriculture, and Health and Human Services and the Administrator of the Environmental Protection Agency in ensuring the safety and security of the nation's food supply. Homeland Security Presidential Directive-10: HSPD-10 was issued on April 28, 2004, under the title "Biodefense for the 21st Century." It set forth a blueprint--based on a comprehensive evaluation of the nation's biological defense capabilities--for the nation's future biodefense program that fully integrates the sustained efforts of the national and homeland security, medical, public health, intelligence, diplomatic, and law enforcement communities. HSPD-10 describes the pillars of the national biodefense program as threat awareness, prevention and protection, surveillance and detection, and response and recovery. Finally, it provided that specific direction to departments and agencies for implementing the biodefense program is contained in a classified version of the HSPD, NSPD-33. Homeland Security Presidential Directive-11: Issued on August 27, 2004, HSPD-11 builds on HSPD-6 in setting forth the nation's policy with regard to comprehensive terrorist-related screening procedures. Specifically, it states that terrorist-related screening will be enhanced through (1) the adoption of comprehensive, coordinated procedures that detect, identify, track, and interdict people, cargo, conveyances, and other entities that pose a threat to homeland security and (2) the implementation of a comprehensive and coordinated approach to terrorist-related screening--in immigration, law enforcement, intelligence, counterintelligence, and protection of the border, transportation systems, and critical infrastructure--that supports homeland security. Homeland Security Presidential Directive-12: HSPD-12, also issued on August 27, 2004, directs the establishment of a common identification standard for federal employees and contractors. Specifically, HSPD-12 states that the policy of the United States is to enhance security, increase government efficiency, reduce identity fraud, and protect personal privacy through the establishment of a mandatory, governmentwide standard for secure and reliable forms of identification issued by the federal government. [End of section] Appendix XI: Comments from the Department of Defense: Note: GAO comments supplementing those in the report text appear at the end of this appendix. ASSISTANT SECRETARY OF DEFENSE: HOMELAND DEFENSE: 2600 DEFENSE PENTAGON: WASHINGTON, DC 20301-2600: 24 NOV 2004: Mr. Norman J. Rabkin, Managing Director: Homeland Security and Justice Issues: U.S. General Accounting Office: Washington, DC 20548: Dear Mr. Rabkin: We appreciate the opportunity to comment on the draft report, "HOMELAND SECURITY: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security." The Department of Defense applauds the efforts of the GAO to ensure that initiatives outlined in the National Strategy for Homeland Security are being addressed. As your report indicates, the Department of Defense is actively pursuing a diverse range of CIP security initiatives. The Department would like to clarify one point with respect to the draft report. In Appendix V, DoD is identified as a lead agency for the initiative to "Build and maintain a complete and accurate assessment of America's critical infrastructure and key assets." More accurately, it should be noted that DoD is the sector-specific lead for the Defense Industrial Base, while the Department of Homeland Security is charged with the overall lead for the initiative. Although Appendix V addresses this issue briefly, this distinction between overall lead and sector- specific lead is not self-evident in the report. Let me take this opportunity to thank you and your staff for producing a thorough and accurate report. Sincerely, Signed by: Paul McHale: GAO Comment: We incorporated the point indicated in the DOD letter and responded to technical comments where appropriate throughout the report. [End of section] Appendix XII: Comments From the Department of Health and Human Services: Note: GAO comments supplementing those in the report text appear at the end of this appendix. DEPARTMENT OF HEALTH & HUMAN SERVICES: Office of the Secretary: Office of the Assistant Secretary for Public Health Emergency Preparedness: Washington, D.C. 20201. DEC 06, 2004: Mr. Norman J. Rabkin, Managing Director: Homeland Security and Justice Issues: U.S. Government Accountability Office: Washington, D.C. 20548: Dear Mr. Rabkin: Thank you for this opportunity to comment on your draft report entitled: "Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security (GAO- 05-33)." The enclosed comments and technical edits represent our department's understanding of the issues described. We highlight the following issues for your attention, decontamination responsibilities and the transfer of the Strategic National Stockpile from Department of Homeland Security (DHS) back to HHS. Once again, we appreciate the opportunity to contribute to this report. Sincerely, Signed by: William F. Raub: Deputy Principal Assistant Secretary: Office for Public Health Emergency Preparedness: Enclosure: Comments of the Department of Health and Human Services to the General Accountability Office's Draft Report, "Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security." (GAO-05-33): General Comments and Technical Edits: The Department of Health and Human Services (HHS) appreciates the opportunity to comment on the Government Accountability Office's (GAO) draft report. We offer the following general comments and technical edits: 1. Letter Report, Page 17 - HHS is listed as "implicitly identified" as lead agency for improving decontamination techniques based on GAO's review of the National Strategy for Homeland Security and Homeland Security Presidential Directives (HSPDs). We note two other provisions that cause some confusion regarding decontamination. First, in Appendix VII, Page 4 of your report (Item 7 in Table VII. 1), you note that the Department of Homeland Security (DHS) is "clearly" identified as the lead for the task "Prepare for chemical, biological, radiological, and nuclear decontamination." Second, HSPD 10 suggests, at least implicitly, that the Environmental Protection Agency has the lead for decontamination in a biological incident: "The Administrator of the Environmental Protection Agency, in coordination with the Attorney General and the Secretaries of Defense, Agriculture, Labor, Health and Human Services, and Homeland Security, is developing specific standards, protocols, and capabilities to address the risks of contamination following a biological weapons attack and developing strategies, guidelines, and plans for decontamination of persons, equipment, and facilities." Finally, the HHS initiative mentioned in Appendix VI, Page 5 relates to chemical sensors (e.g., the Rapid Toxic Screen testing), not decontamination. Separating this item into two (chemical sensors and decontamination) would provide clarity. 2. Appendix 11, Page 5 - HHS is listed as operating the BioWatch program. This is inaccurate. DHS manages this program with support from HHS. Please revise accordingly. 3. Appendix 111, Page 5, 2nd line - "HHS' Food and Drug Service Administration..." should read "The Food and Drug Administration within HHS." 4. Appendix V, Page 4, 3rd line from bottom - "HHS' Food and Drug Service Administration..." should read "The Food and Drug Administration within HHS." 5. Appendix V, Page 4, 2nd and 3rd lines from bottom - For clarity, FDA issued five security guidance documents for different segments of the food industry which suggested conducting background checks. The FDA guidance was not directed at how to conduct the background checks, and was not directed only to the food service industry. Suggested re- phrasing is: "The Food and Drug Administration within HHS issued guidance to the food industry that suggested preventative measures, including employee background checks, which could increase the security of food while under an establishment's control." 6. Appendix V, Page 4, Table 4 - A dot should be included in item 2, "Build and maintain a complete and accurate assessment of America's critical infrastructure and key assets", under the HHS PI column. FDA completed its initial vulnerability assessments of the food industry in 2002, while continuing to re-evaluate its assessments. 7. Appendix V, Page 4, top paragraph, 2nd line from bottom - Insert "food" after "agriculture", thus the phrase would read "addressing the terrorist threat to agriculture and food." 8. Appendix VII, Page 2 - The Project Bioshield 2004 legislation, signed by the President on July 21, 2004, returned the Strategic National Stockpile to HHS from DHS. In addition to the Stockpile, HHS maintains additional emergency preparedness and response assets, which include (but are not limited to) teams from the United States Public Health Service Commissioned Corps, the Centers for Disease Control and Prevention, and the Food and Drug Administration. Please revise accordingly. 9. Appendix VII, Page 10 - The Report notes that "DHS ... will help hospitals `expand their surge capacity to care for large numbers of patients in a mass-casualty incident."' HSPD-10 notes that HHS "in coordination with other appropriate Federal departments and agencies, is the principal Federal agency responsible for coordinating all Federal-level assets activated to support and augment the state and local medical and public health response to mass casualty events." Please note this designation and revise accordingly. 10. Appendix IX, Page 2, Table 4 - A dot should be included in item 2, "Build and maintain a complete and accurate assessment of America's critical infrastructure and key assets", under the HHS PI column. FDA completed its initial vulnerability assessments of the food industry in 2002, while continuing to re-evaluate its assessments. GAO Comment: We incorporated the technical comments where appropriate throughout the report. [End of section] Appendix XIII: Comments From the Department of Homeland Security: Note: GAO comments supplementing those in the report text appear at the end of this appendix. U.S. Department of Homeland Security: Washington, DC 20528: December 9, 2004: Mr. Norman Rabkin: Managing Director, Homeland Security & Justice Issues: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Dear Mr. Rabkin: RE: GAO-05-33, Homeland Security: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security (GAO Job Code 440295): Thank you for the opportunity to review the subject draft report. It acknowledges the work and progress of the Department of Homeland Security (DHS) and the Departments of Justice, Defense, Health and Human Services, State and Energy in addressing the Administration's National Strategy for Homeland Security initiatives and the Homeland Security Presidential Directives (HSPDs) objectives through strategic planning and related activities in Fiscal Year 2004. DHS has a prominent role in implementing all six of the critical mission areas that include Border and Transportation Security, Domestic Counterterrorism, Protecting Critical Infrastructure and Key Assets, and Emergency Preparedness and Response. We generally agree with the tenor of the report. Challenges remain in implementing the strategy in a well coordinated and integrated manner particularly when issues cut across two or more of the six critical mission areas. However, the report notes that all the national strategy's 43 initiatives are included in the activities of at least one of the six departments reviewed. DHS itself had planning and/or implementation activity related to 40 of the 43 initiatives. DHS and the other departments are individually and collectively moving forward to accomplish our respective missions with regard to implementing the National Strategy for Homeland Security. The report identifies a baseline from which to assess progress in meeting homeland security objectives. It does not contain any recommendations. The Department Summary Across Critical Mission Areas (Appendix IX) and related table entitled Summary of Department Leads, Planning, and Implementation Across the Six Critical Mission Areas of the National Strategy for Homeland Security is particularly useful. We have enclosed information that reflects in part the on-going work of DHS in meeting many of the challenges facing America. In addition, we are assuming GAO's incorporation of our technical comments which were provided to your office under separate cover. Sincerely, Signed by: Anna F. Dixon: Director: Departmental GAO/OIG Liaison Office: Enclosure: Appendix II-Intelligence and Warning: Under "Challenge: Enhancing the analytical capabilities of the FBI" (page 7), we believe that the stand up of the US CERT gives DHS, and consequently the FBI through the law enforcement section, a better situational awareness of what is occurring across cyberspace and, in particular, in the government space. The later would be a natural target for terrorists. In addition, DHS' support/administration of the Cybercop Portal serves as vehicle for sharing information (not classified, but important to the recipient) with our state and local partners within the cyber law enforcement community. Furthermore, DHS has acted as a conduit between the intelligence community/law enforcement and the private sector wherein source information has been rendered anonymous. DHS component(s) also have acted as another mechanism for passing cyber information from law enforcement to the intelligence community. Appendix IV-Domestic Counterterrorism: While not specifically directed toward terrorism, the National Cyber Response Coordination Group (NCRCG) and the Cybercop Portal can be used toward that end. Appendix V-Protecting Critical Infrastructures and Key Assets: One of the major initiatives in the critical infrastructure protection mission area is securing cyberspace. We believe that GAO should include or otherwise reference the NCRCG that is mentioned in the National Response Plan's Cyber Annex as a coordinating body for cyber emergencies of national scope. Page 2, paragraph 1 discusses DHS primary responsibilities and provides examples of specific functions performed by DHS. GAO may want to include additional responsibilities mentioned in HSPD-7. This includes responsibility for chemicals, dams, and nuclear reactors, materials and waste. Please consider including information related to Sector-Specific Agencies under Challenges in Critical Infrastructure Protection (Appendix V, pp. 7-16). HSPD-7 required the development of the National Infrastructure Protection Plan (NIPP). HSPD-7 recognizes that infrastructure sectors possess unique characteristics and operating models, and assigns Critical Infrastructure Protection (CIP) responsibilities for those sectors to Sector-Specific Agencies (SSAs), with guidance to be provided by DHS. To implement HSPD-7, SSAs have developed Sector-Specific Plans (SSPs) that provide an informational foundation for the NIPP. SSPs provide a detailed description of the specific processes that are used to identify, assess, prioritize, protect, and measure effectiveness; the plans for implementing these processes; and the status of any efforts being conducted to support this effort to date, including best practices identified, challenges encountered, and products generated. Additionally, these SSPs address many of the challenges documented in this section of Appendix V. GAO notes three challenges related to federal CIP efforts on page 8. Progress meeting the challenges mentioned is imminent. The NIPP is on schedule to be approved this month as planned; the support to the Executive Order 13356 Working Group is developing information sharing relationships; the Interagency Incident Management Group has improved and the fusion cell will further strengthen DHS' ability to analyze threat, incident, and vulnerability information together in a meaningful way. On page 14 of Appendix V, Challenge: Addressing chemical plant security, GAO, referring to a March 2003 report, states that the "federal government has not comprehensively assessed the industry's vulnerability to terrorist attacks" and, "as a result, federal, state, and local entities are challenged by a lack of comprehensive information on vulnerabilities faced by the sector." DHS through it Information Analysis and Infrastructure Protection Directorate has published several Characteristics and Common Vulnerabilities (CCV) and Potential Indicators of Terrorist Activity (PI) reports for the chemical sector, the latest revisions have been prepared in October 2004. Specific reports address chemical facilities, chemical storage, and chemical transportation. Appendix V, Pages 14-15, Challenge: Addressing nuclear power plant security discusses problems reported by GAO in September 2003 with respect to the Nuclear Regulatory Commission (NRC)'s oversight of security at commercial nuclear power plants. GAO should note that an inter-agency (NRC, FBI and the DHS' United States Coast Guard and Emergency Preparedness and Response) team is developing plans to conduct comprehensive vulnerability assessments of commercial nuclear reactors and associated facilities. Each facility will be assessed and protective strategies prepared and implemented. Appendix VI-Defending against Catastrophic Threats: Reference again should be made to the NCRCG. There has been speculation that a cyber attack would be used in conjunction with a physical attack to enhance the amount of damage. The NCRCG is activated in the event of a significant event (cyber or physical effecting cyber), and would be a coordinating body for response and reconstitution efforts. Appendix VIII-Crosscutting Issues: Appendix VIII, Page 3, Challenge: Improving risk management methods for resource allocation and investment comments on the benefits of the risk management approach. DHS is working on a high-level risk-based approach to CIP. This effort is based in part on the methodology described in past GAO reports. GAO Comment: In addition to making the changes indicated in the enclosure, we incorporated the technical comments where appropriate throughout the report. [End of section] Appendix XIV: Comments From the Department of Justice: Note: GAO comments supplementing those in the report text appear at the end of this appendix. U.S. Department of Justice: Washington, D.C. 30530: December 3, 2004: Norman J. Rabkin: Managing Director, Homeland Security and Justice: Government Accountability Office: 441 G Street, NW: Washington, D.C. 20548: RE: GAO Draft Audit Report No. GAO-05-33 (Review No. 440295): Dear Mr. Rabkin: The Department of Justice (Department) reviewed the final draft of the Government Accountability Office's (GAO) report entitled HOMELAND SECURITY: Agency Plans, Implementation, and Challenges Regarding the National Strategy for Homeland Security (GAO-05-33). The Department sent its technical comments, under separate cover to Jared Hermalin, the Analyst-in-Charge at GAO. Below find the Department's formal comments for inclusion in the final report that GAO publishes. APPENDIX IV: DOMESTIC COUNTERTERRORISM: Page 2, Agencies with Major Roles in Domestic Counterterrorism: The first paragraph incorrectly says that the FBI leads the Anti- Terrorism Advisory Councils. In fact, the Executive Office of the United States Attorneys holds that responsibility. The FBI leads the Joint Terrorism Task Forces. In addition, the FBI has responsibility for terrorist financing which was left out of the paragraph completely. Consequently, we suggest the paragraph should read: "Of the six departments under review, the Departments of Justice (DOJ) and Homeland Security (DHS) have major roles in Domestic Counterterrorism. DOJ leads Anti-Terrorism Advisory Councils to increase cooperation between federal, state and local law enforcement. Within DOJ, the Federal Bureau of Investigation (FBI) works to detect and prevent terrorist acts through analysis and fieldwork to identify terrorists, their supporters, and materials that may be used to perpetrate a terrorist act, to include terrorist financing; tracks foreign terrorists and keeps them from entering the U.S.; and leads the multi-agency Joint Terrorism Task Forces (JTTFs). The Department's 94 United States Attorneys lead the Anti-Terrorism Advisory Councils that enhance cooperation and information sharing among federal, state and local law enforcement, first responders, industry, academia, and others." The enclosed Statement of Recent Accomplishments describes some of the efforts to prevent terrorism taken since the GAO stopped collecting data for this report. Specifically, the Statement supplements the GAO report by detailing how the FBI realigned its assets and shifted its priorities to make the prevention of terrorism the Bureau's main priority. The GAO told the Department on October 24, 2004, to provide this data along with the Department's formal comments, and that the material would be included in the GAO final report. The Department appreciates the opportunity to provide its formal comments and supplemental information. For more information, your staff may contact Richard Theis, Acting Director, Audit Liaison Office, on 202-514-0469. Sincerely, Signed by: Paul R. Corts: Assistant Attorney General for Administration: cc: EOUSA - David L. Smith: FBI - Cheryl Johnston: JMD - Walt Wondolowski: Criminal - Julie Wellman: OJP - LeToya Johnson: ODAG - James A. McAtamney: Enclosure: Statement of Recent Accomplishments: Under the leadership of Director Mueller, the FBI has moved forward aggressively to implement a comprehensive plan that has fundamentally transformed the FBI with one goal in mind: establishing the prevention of terrorism as the Bureau's number one priority. While the FBI once concentrated on investigating terrorist crimes after they occurred; the FBI now focuses on disrupting terrorists before they strike. Director Mueller has overhauled the FBI's counterterrorism operations, expanded its intelligence capabilities, modernized its business practices and technology, and improved coordination with its partners. To implement these new priorities, the FBI increased the number of Special Agents assigned to terrorism matters and hired additional intelligence analysts and translators. Also, it established operational units and entities that provide new or improved capabilities to address the terrorist threat. These include the 24/7 Counterterrorism Watch (CT Watch) and the National Joint Terrorism Task Force (NJTTF) to manage and share threat information; the Terrorism Financing Operation Section (TFOS) to centralize efforts to stop terrorist financing; document/ media exploitation squads to exploit material found both domestically and overseas for its intelligence value; deployable "Fly Teams" to lend counterterrorism expertise wherever it is needed; the Terrorist Screening Center (TSC) and Foreign Terrorist Tracking Task Force (FTTTF) to help identify terrorists and keep them out of the United States; the Terrorism Reports and Requirements Section to disseminate FBI terrorism-related intelligence to the Intelligence Community; and the Counterterrorism Analysis Section to merge, compare, and assess indicators of terrorist activity against the United States from a strategic perspective. The FBI centralized management of its Counterterrorism Program at Headquarters to limit "stove-piping" of information, to ensure consistency of counterterrorism priorities and strategies across the organization, to integrate counterterrorism operations here and overseas, to improve coordination with other agencies and governments, and to make senior FBI managers accountable for the overall development and success of its counterterrorism efforts. The FBI is building an enterprise-wide intelligence program that has already improved substantially its ability to strategically direct its intelligence collection and to fuse, analyze, and disseminate its terrorism-related intelligence. The FBI quickly implemented a plan to integrate all its capabilities and better prevent terrorist attacks after passage of the USA PATRIOT Act, issuance of related Attorney General Guidelines, and an issuance of opinion by the Foreign Intelligence Surveillance Court of Review that removed the barrier to sharing information between intelligence and criminal investigations. Director Mueller elevated intelligence to program-level status, putting in place a formal structure and concepts of operations to govern FBI- wide intelligence functions, and establishing Field Intelligence Groups (FIGs) in every Bureau field office. Understanding that the Bureau cannot defeat terrorism without strong partnerships, the FBI has enhanced the level of coordination and information sharing with state and municipal law enforcement personnel. The Bureau expanded the number of Joint Terrorism Task Forces (JTTFs), increased technological connectivity with its partners, and implemented new ways of sharing information through vehicles such as the FBI Intelligence Bulletin, the Alert System, and the Terrorist Screening Center. To improve coordination with other federal agencies and members of the Intelligence Community, the Bureau joined with its federal partners and established the Terrorist Threat Integration Center, exchanged personnel, instituted joint briefings, and started using secure networks to share information. The Bureau improved its relationships with foreign governments by building on the overseas expansion begun under Director Louis Freeh; by offering investigative and forensic support and training, and by working together with those governments on task forces and joint operations. Finally, the FBI expanded outreach to minority communities, and improved coordination with private businesses involved in critical infrastructure and finance. Re-engineering its personnel efforts made the Bureau more efficient and more responsive to operational needs. The Bureau revised its approach to strategic planning, and refocused its recruiting and hiring to attract individuals with the skills critical to counterterrorism and intelligence missions. Also, the FBI developed a more comprehensive training program and instituted new leadership initiatives to keep its workforce flexible. These improvements have produced tangible, measurable results. Since September 11, 2001, the FBI participated in disrupting dozens of terrorist operations by developing actionable intelligence and better coordinating our counterterrorism efforts. The Bureau significantly increased the number of human sources and the amount of surveillance coverage to support its counterterrorism efforts. It developed and refined a process for briefing daily threat information, and considerably increased the number of FBI intelligence reports produced and disseminated. Prior to September 11, 2001, the Bureau had no centralized structure for the national management of its Counterterrorism Program, and terrorism cases were routinely managed out of individual field offices. An al-Qa'ida case, for example, might have been from the New York Field Office; a HAMAS case might have been managed by the Washington Field Office. This arrangement functioned for years, and produced a number of impressive prosecutions. Once counterterrorism became the overriding priority, improving the arrangement offered further benefits. In December 2001, the Director reorganized and expanded the Counterterrorism Division (CTD) and created the position of Executive Assistant Director (EAD) for Counterterrorism and Counterintelligence. (The Assistant Director of CTD reports to the EAD) The change centralized management, a predicate for a truly national program - to coordinate counterterrorism operations and intelligence production domestically and overseas; to conduct liaison with other agencies and governments; and to establish clear lines of accountability for the overall development and success of the FBI's Counterterrorism Program. With this management structure in place, the FBI can affect a fundamental change in operations and can better accomplish its counterterrorism mission. The FBI divided the operations of the Counterterrorism Division into branches, sections, and units, each of which focuses on a different aspect of the current terrorism threat facing the U.S. These components are staffed with intelligence analysts and subject matter experts who work closely with investigators in the field and integrate intelligence across component lines. This integration allows for real-time responses to threat information and quick communication with decision-makers and investigators in the field. The FBI is designed, and has always operated, as both a law enforcement and intelligence agency. It has the dual mission: 1) to investigate and arrest perpetrators of completed crimes and 2) to collect intelligence that will help prevent future crimes and assist policy makers in their decision making. History has shown that the Bureau is most effective in protecting the United States (U.S.) when it performs these missions in tandem. The FBI has long recognized that investigations produce intelligence benefits beyond arrest and prosecution. Starting with the Ku Klux Klan cases in the 1960's and the Mafia cases of the 1970's, FBI agents began to view criminal investigations as both a means of arresting and prosecuting someone for a completed crime, and as a means of obtaining information to prevent future crime. The goal was not simply to arrest individual members of the Klan or the Mafia, but to penetrate and dismantle a whole criminal organization. As this approach was adopted, the FBI developed intelligence tools that have proven critical to predicting and preventing criminal activity. Also, the Bureau learned to think strategically before making arrests, sometimes opting to delay a suspect's arrest to allow more opportunity for surveillance that might disclose conspirators or other criminal plans. This approach was used to great effect in organized crime cases and espionage investigations, and members of the Bureau's Safe Streets Task Forces use it to combat street gangs. This is the approach that, since 9/11, the Bureau has used successfully in terrorism investigations. By definition, investigations of international terrorism are both "intelligence" and "criminal" investigations. They are intelligence investigations because their objective, pursuant to Executive Order 12333, is "the detection and countering of international terrorist activities," and because they employ authorities and investigative tools - such as Foreign Intelligence Surveillance Act warrants - designed for the intelligence mission of protecting the U.S. against attack or other harm by foreign entities. They are criminal investigations because international terrorism against the U.S. constitutes a violation of the federal criminal code. Over the past two decades, court rulings and internal DOJ procedures regarding FISA warrants barred FBI agents and other Intelligence Community personnel working intelligence cases from coordinating and swapping leads with agents working criminal cases. As a result of this legal "wall," intelligence agents and criminal agents working on a single terrorist target had to proceed independently and without knowing what the other may have been doing. The USA PATRIOT Act, enacted on October 26, 2001 eliminated this "wall" and authorized coordination among agents working criminal matters and those working intelligence investigations. On March 6, 2002 the Attorney General issued new Intelligence Sharing Procedures for Foreign Intelligence and Foreign Counterintelligence Investigations Conducted by the FBI (Intelligence Sharing Procedures) to capitalize on this legislative change. The new procedures specifically authorized agents working intelligence cases to disseminate to criminal prosecutors and investigators all relevant foreign intelligence information, including information obtained from FISA, in accordance with applicable minimization standards and other specific restrictions. Likewise, the procedures authorized prosecutors and criminal agents to advise FBI agents working intelligence cases on all aspects of foreign intelligence investigations, including the use of FISA. On November 18, 2002 the Foreign Intelligence Surveillance Court of Review issued an opinion approving the Intelligence Sharing Procedures. The opinion authorized the FBI to share information, including FISA- derived information, with both criminal and intelligence investigators. Today, the FBI can conduct terrorism investigations using criminal and intelligence tools and personnel. To FBI formalized this merger of intelligence and criminal operations by abandoning its practice of classifying cases as either "criminal" or "intelligence" international terrorism investigations; now the FBI classifies all these cases as ones including "international terrorism." This reclassification officially designates an international terrorism investigation as one that can employ intelligence tools as well as criminal processes and procedures. In July 2003, the Bureau formalized this approach in its Model Counterterrorism Investigative Strategy (MCIS), which was issued to all field offices and has been the subject of extensive field training. With the dismantling of the legal "wall" and the integration of criminal and intelligence personnel and operations, the FBI now has the latitude to coordinate its intelligence and criminal investigations and to employ full range of investigative tools against a suspected terrorist. On the intelligence side, it can conduct surveillance on the suspected terrorist to learn about his movements and identify possible confederates; it can obtain FISA authority to monitor his conversations; and/or it can approach and attempt to cultivate him as a source or an operational asset. On the criminal side, the Bureau has the option of incapacitating him through arrest, detention, and prosecution. The course to take is chosen by continuously balancing the opportunity to develop intelligence against the need to apprehend the suspect and prevent him from carrying out his terrorist plans. This integrated approach has guided Bureau operations and enabled it foil terrorist-related operations and disrupt cells from Northern Virginia, to Buffalo, New York, to Portland, Oregon, to Newark, New Jersey. Virginia Jihad Network: As a result of an FBI, Washington Field Office investigation, nine members of a group based in Northern Virginia, now known as the Virginia Jihad Network, were convicted on charges to include: Conspiracy to levy war against the United States (18 USC 2384); Conspiracy to provide material support to Al-Qa'ida (18 USC 2339B); Conspiracy to provide material support to Lashkar-e-Taiba (18 USC 2339A); and supplying services to the Taliban (50 US 1705.): The investigation, which involved both intelligence and criminal aspects, proved that members of the Virginia Jihad Network had intentionally participated in activities in preparation to enter into jihad (Holy War) against enemies of Islam, including the U.S. Specifically, members of the group participated in weekly jihad training sessions consisting of physical training in small-unit para- military tactics using paint-ball as a means of instruction, as well as religious instruction on the topics of jihad, typically through the readings of certain hadiths related to jihad. Lackawanna Six: The FBI investigation known as the "Lackawanna Six," conducted by agents in the Buffalo Field Office, resulted in the convictions of six men, all U.S. citizens of Yemeni descent, for their participation in an Al-Qa'ida military-style training camp with radical Islamists in Afghanistan shortly before the 9/11 terrorist attacks. Five of the men plead guilty to providing material support to Al-Qa'ida and the sixth pled guilty to conducting transactions unlawfully with Al-Qa'ida. The investigation successfully identified and documented the methods Al-Qa'ida members used to communicate with and recruit U.S. citizens of Yemeni descent to travel to Afghanistan for the purpose of military training for jihad. The Portland Seven: The FBI, Portland Field Office, investigation known as the "Portland Seven," resulted in the conviction of seven Muslim men from Portland, in February 2004, for: Conspiracy to levy war against the United States; Conspiracy to Provide Material Support and Resources to Al- Qaida; Conspiracy to Contribute Services to Al-Qa'ida and the Taliban; and for two of the men: Possessing Firearms in Furtherance of Crimes of Violence. The investigation proved that, as part of the conspiracy, members would travel to Afghanistan to join Al-Qa'ida and Taliban forces in the jihad and take up arms against the U.S. and allied military forces. Following the 9/11 terrorist attacks five of the defendants acquired various firearms and engaged in weapons training and physical training for preparation to fight a jihad. In October 2001, six of the men traveled to China, then tried several times to reach Afghanistan to fight for the Taliban. Hemant Lakhani: The FBI investigation into the activities of businessman Hemant Lakhani, a British national born in India, resulted in charges against Lakhani for attempting to sell anti-aircraft missiles to shoot down American airliners. He was charged, also, with plotting to obtain for terrorists a "dirty bomb". Lakhani since pleaded not guilty to the charges of providing material support to terrorists and attempting to sell arms without a license. His trial is set to begin in November, 2004. If convicted, he could be sentenced to 25 years in prison. Two other individuals were arrested and charged with helping in a planned money transfer that was part of the transaction. One of those two individuals arrived in the U.S. to allegedly arrange for a $500,000 down payment from a government cooperating witness for 50 more shoulder-fired missiles. Each individual faces up to five years in prison. Although the FBI is now able to coordinate its intelligence collection and criminal law enforcement operations, it will realize its full potential as a terrorism prevention agency once it develops the intelligence structure, capabilities, and processes to direct those operations. The Department needs an effective intelligence capacity, if it expects to defeat a sophisticated and opportunistic adversary like Al-Qa'ida. For a variety of historical reasons, the Bureau had not developed this intelligence capacity prior to September 11, 2001. Even though the FBI always has been one of the world's best collectors of information, it never completed the infrastructure to exploit that information fully for its intelligence value. Individual FBI agents analyzed the evidence in their particular cases, and used it to guide their investigations. The FBI as an institution, however, had not elevated that analytical process above the individual case or investigation to an overall effort to analyze intelligence and strategically direct intelligence collection against threats across all programs. The attacks of September 11, 2001, highlighted, the need to develop an intelligence process for the Counterterrorism Program. Since then, the Bureau has undertaken to build the capacity to fuse, analyze, and disseminate its terrorism-related intelligence, and to direct investigative activities based on an analysis of gaps in its collection against national intelligence requirements. That effort has proceeded in four stages. The first was to increase the number of analysts working counterterrorism. Immediately after September 11, Director Muller temporarily reassigned analysts from the Criminal Investigative and Counterintelligence Divisions to various units in the Counterterrorism Division. In July 2002, 25 analysts were detailed from the CIA to assist. Many of these analysts provided tactical intelligence analysis; others provided strategic "big picture" analysis. These deployments were temporary, but the progress made, the confidence gained, and the lessons learned during this period started the FBI down the road toward a functioning intelligence analysis operation. Also, the Bureau established the College of Analytical Studies to help train and develop a cadre of FBI specialized analysts. On December 3, 2001, the Director established the Office of Intelligence (01) within the Counterterrorism Division. The 01 was responsible for establishing and executing standards for recruiting, hiring, training, and developing the intelligence analytic workforce, and ensuring that analysts are assigned to operational and field divisions based on intelligence priorities. Recognizing that intelligence and analysis are integral to all of the Bureau's programs, in February 2003, Director Mueller moved the 01 out of the Counterterrorism Division and created a stand-alone 01, headed by an Executive Assistant Director (EAD-1), to provide centralized support and guidance for the Bureau's intelligence functions. The second stage in the Bureau's intelligence integration was to elevate intelligence functions to program-level status, instituting centralized management and implementing a detailed blueprint for the Intelligence Program. The Director articulated a clear mission for the Intelligence Program - to position the FBI to meet current and emerging national security and criminal threats by: 1) aiming investigative work proactively against threats; 2) building and sustaining enterprise-wide intelligence policies and capabilities, and 3) providing useful, appropriate, and timely information and analysis to the national security, homeland security, and law enforcement communities. With the mission defined, the Bureau set out to embed intelligence processes into the day-to-day work of the FBI, from the initiation of a preliminary investigation to the development of FBI-wide strategies. Now that the Intelligence Program is established and evolving, the FBI is moving on to the third stage of transforming the Bureau into an intelligence agency - reformulating personnel and administrative procedures to instill within our workforce an expertise in the processes and objectives of intelligence work. A major element of the Bureau's transformation is its increasing integration and coordination with its partners in the U.S. and international law enforcement and intelligence communities. More than any other type of enforcement mission, counterterrorism requires the participation of every level of local, state, national, and international government. A good example is the case of the Lackawanna terrorist cell outside Buffalo, New York. From the police officers who helped to identify and conduct surveillance on the cell members; to the CIA officers who provided information from their sources overseas; to the diplomatic personnel who coordinated our efforts with foreign governments; to the FBI agents and federal prosecutors who conducted the investigation leading to the arrests and indictments, everyone played a significant role. The FBI recognizes that a prerequisite for any operational coordination is the full and free exchange of information. Without procedures and mechanisms that allow information sharing on a regular and timely basis, the Bureau and its partners cannot expect to align their operational efforts to best accomplish their common mission. Accordingly, the FBI took steps to establish FBI-wide policies for sharing information and intelligence. To ensure a coordinated, enterprise-wide approach, the Director recently designated the EAD-I to serve as the principal FBI official for information and intelligence sharing policy. In this capacity, the EAD-I functions as an advisor to the Director and provides policy direction on information and intelligence sharing within and outside the FBI with the law enforcement and intelligence communities, as well as foreign governments. On February 20, 2004, the Bureau formed an information sharing policy group, comprised of Executive Assistant Directors, Assistant Directors and other senior executive managers. Under the Direction of the EAD-I, this group is establishing FBI information and intelligence sharing policies. Beyond these information sharing initiatives, the Bureau is increasing its operational coordination with its state, federal, and international partners on a number of fronts. The FBI strengthened its working relationships with the CIA and other members of the Intelligence Community. From the Director's daily meetings with the Director of Central Intelligence and CIA briefers, to the regular exchange of personnel among agencies, to the joint efforts in specific investigations and in the Terrorist Threat Integration Center, the Terrorist Screening Center, and other multiagency entities, the FBI and its partners in the Intelligence Community are now integrated at virtually every level of our operations. The Terrorist Threat Integration Center (TTIC) is a good example of the collaborative relationship among the FBI, the CIA, and other federal partners. Established on May 1, 2003, at the direction of President Bush, TTIC coordinates strategic analysis of threats based on intelligence from the FBI, CIA, DHS, and DOD. Analysts from each agency work side-by-side in one location to piece together the big picture of threats to the U.S. and our interests. TTIC analysts synthesize government-wide information regarding current terrorist threats and produce the Presidential Terrorism Threat Report for the President. FBI personnel at TTIC are part of the Office of Intelligence and work closely with analysts at FBI Headquarters in combining domestic and international terrorism developments into a comprehensive analysis of terrorist threats. In addition to the analysis developed by FBI analysts detailed to TTIC, FBI analysts at Headquarters regularly contribute articles to the President's Terrorist Threat Report. The FBI currently has agents and analysts detailed to CIA entities, including the CIA's Counterterrorism Center (CTC). Also, FBI agents and intelligence analysts are detailed to the NSA, the National Security Council, DIA, the Defense Logistics Agency, DOD's Regional Commands, the Department of Energy, and other federal and state agencies. CIA personnel are also working in key positions throughout the Bureau. The Deputy Section Chief of the International Terrorism Operations Section in the Counterterrorism Division is a CIA detailee. CIA officers are detailed to the Security Division, including the Assistant Director, the Chief of the Personnel Security Section, and managers working with the Secret Compartmental Information (SCI) program and the FBI Police. An experienced manager from the CIA's Directorate of Science and Technology now heads the Investigative Technologies Division and a CIA employee on detail serves as the Chief of a Section. This exchange of personnel is taking place in Bureau field offices as well as in the FBI headquarters. In JTTF sites, the CIA has officers co-located with FBI agents, and there are plans to add CIA officers at several others. The NSA detailed analysts to FBI Headquarters, and the Washington, New York, and Baltimore Field Offices. The FBI now uses secure systems to disseminate classified intelligence reports and analytical products to the Intelligence Community and other federal agencies. Improving the compatibility of information technology systems throughout the Intelligence Community will increase the speed and ease of information sharing and collaboration. To that end, an FBI information technology team worked with the Chief Information Officers (CIOs) of DHS and other Intelligence Community agencies as the Bureau upgraded its data systems. DHS plays a critical role in assessing and protecting vulnerabilities in our national infrastructure and at our borders, and in overseeing our response capabilities. The Bureau has worked closely with DHS to ensure that the integration of information sharing between the agencies. The FBI and DHS share database access at TTIC, in the National JTTF at FBI Headquarters, in the FTTTF and the TSC, and in local JTTFs around the country. The FBI and DHS worked together to establish the new Terrorist Screening Center. CTD analysts from the FBI weekly brief their DHS counterparts on terrorism developments. The agencies jointly produce Intelligence Bulletins for state, local, and tribal law enforcement and state and local homeland security officials. They produce joint threat assessments for key events such as the national political party conventions. The Bureau designated an experienced executive from the Transportation Security Administration to run the TSC and detailed a senior DHS executive to the FBI's Office of Intelligence to ensure coordination and transparency between the agencies. On March 4, 2003, the Attorney General, the Secretary of Homeland Security, and the Director of Central Intelligence signed a comprehensive Memorandum of Understanding (MOU) establishing policies and procedures for information sharing, handling, and use. Pursuant to that MOU, information related to terrorist threats and vulnerabilities is provided to DHS automatically. Consistent with the protection of sensitive sources and methods and the protection of privacy rights, we now share as a rule, and withhold by exception. With terrorists traveling, communicating, and planning attacks around the world, coordination with our foreign partners has become more critical than ever before. The FBI has increased its overseas presence and now routinely deploys agents and crime scene experts to assist in the investigation of overseas attacks, such as the May 2003 bombings in Saudi Arabia and Morocco. Their efforts, and the relationships that grew from them, have played a critical role in the successful international operations the Bureau conducted over the past three years. Bureau personnel have participated in numerous investigations of terrorist attacks in foreign countries. The approach taken to those investigations differs from the traditional Bureau approach. Prior to September 11, FBI overseas investigations were primarily focused on building cases for prosecution in the U.S. Today, the focus has broadened. Now, the FBI provides its foreign partners with investigative, forensic, and other types of support that enhance joint efforts to prevent and disrupt terrorist attacks. This approach won the approval of our partners and increased reciprocal cooperation and led to more effective joint investigations. With the recent directives implementing the intelligence agent career track and the administrative reforms related to building an intelligence workforce, the FBI has created a foundation for an intelligence-driven counterterrorism operation. The substantial progress achieved over the past three years, defies precise measurement. However, several accomplishments demonstrate the effectiveness of the Counterterrorism Program. Including: * Developing human assets: * Increasing the number of FISAs: * Increasing the number of intelligence reports generated * Increasing the quality of daily briefings: * Raising the effectiveness of counterterrorism operations: The FBI historically has recognized that human sources often provide the most important information during a criminal investigation. Accordingly, the Bureau has developed expertise in recruiting and using human sources. Further, it uses those skills to great effect across a wide range of investigative programs, including organized crime, drugs, public corruption, and white collar crime. The Bureau has placed a priority on developing human intelligence sources to assist in the identification and apprehension of international terrorists. The Bureau has revised its training programs, its personnel evaluation criteria, and its operational priorities to focus on source development. These efforts already increased the number of human intelligence sources in the Counterterrorism Program. Between August 30, 2001, and September 30, 2003, the number of sources related to international terrorism increased by more than 60 percent, and the number of sources related to domestic terrorism increased by more than 39 percent. FISA coverage increased significantly, reflecting both the Bureau's increased focus on counterterrorism and counterintelligence investigations and its improvement in FISA operations. From 2001 to 2003, the number of FISA applications filed annually with the Foreign Intelligence Surveillance Court increased by 85 percent. The FISA has seen a similar increase in the use of the emergency FISA process that permits the FBI to obtain immediate coverage in emergency situations. In 2002, for example, the Department of Justice obtained a total of 170 emergency FISA authorizations, which is more than three times the number of emergency FISAs obtained in the 23 years between the 1978 enactment of FISA and September 11, 2001. The fourth stage involves improved dissemination of information. In the past year, the FBI produced more than 3,000 intelligence products, including "raw" reports, intelligence memoranda, in-depth strategic analysis assessments, special event threat assessments, and focused Presidential briefings. In addition, it briefed many members of Congress, other government agencies, and law enforcement organization about intelligence matters. Prior to September 11, 2001, the FBI produced very few raw intelligence reports. In fiscal 2004, the FBI produced and disseminated about 2,700 Intelligence Information Reports (IIRs) containing raw intelligence derived from FBI investigations and intelligence collection. The majority contained intelligence related to international terrorism; the next greatest number contained foreign intelligence and counterintelligence information; and the remainder concerned criminal activities and cyber crime. These IIRs were sent to a wide customer set in FBI field offices, the Intelligence Community, Defense Community, other federal law enforcement agencies, and U.S. policy entities. In addition to these raw intelligence reports, the FBI has begun producing analytic assessments on a par with those the Intelligence Community produces. The FBI developed and issued, in January 2003, a classified comprehensive assessment of the terrorist threat to the U.S. This assessment focuses on the threats that may develop over the next two years, based on an analysis of information regarding the motivations, objectives, methods, and capabilities of existing terrorist groups and the potential for the emergence of new terrorist groups. This threat assessment is used as a guide in the allocation of investigative resources, as a compilation of threat information for investigators and intelligence personnel within and without the FBI, and as a resource for decision-makers elsewhere in the government. The 2004 threat assessment was released in April 2004. Also, the Bureau published a comprehensive assessment of the terrorist WBRN threat to the U.S., in December 2003. FBI analysts have produced 137 in-depth analyses in Fiscal Year 2004 and several hundred current intelligence articles. How the FBI used the Al-Qa'ida terrorism handbook provides a good example of the Bureau's improved capacity to exploit evidence for its intelligence value. A terrorism handbook seized from an Al-Qa'ida location overseas in the mid-1990's was declassified and released by DOJ shortly after the events of September 11, 2001. The FBI believed, and subsequent events confirmed, that intelligence gleaned from the handbook could provide useful guidance about Al-Qa'ida's interests and capabilities. Nine Intelligence Bulletins were based in whole or in part on this intelligence. In addition, the Bureau used information from the Al-Qa'ida Handbook to update the Bureau's counterterrorism training, including the Intelligence Analyst Basic Course at the College of Analytical Studies, the Introduction to Counterterrorism Course at the National Academy, and sessions on Terrorism Indicators and Officer Safety in the Bureau's SLATT training. One measure of the Bureau's improved counterterrorism operations is the Bureau's capability to analyze data daily and deliver daily briefing. The development of this capability reflects the maturation of the centralized Counterterrorism Program. Prior to September 11, the FBI lacked the capacity to provide a comprehensive daily terrorism briefing - to assemble the current threat information, to determine what steps were being taken to address each threat, and to present a clear picture of each threat and the Bureau's response to that threat to the Director, senior managers, the Attorney General, and others in the Administration who make operational and policy decisions. Because investigations were run by individual field offices, the Bureau never developed a central repository of treat data. During the past three years, with the assistance of veterans from the Intelligence Community, the FBI has established the infrastructure and the cadre of professionals to produce effective daily briefings and to share briefing materials more widely within the Bureau and with our partners. In 2002, the Bureau established the Presidential Support Group within the Counterterrorism Division to prepare daily briefing materials. In the summer of 2003, this group was renamed the Strategic Analysis Unit and moved to the Office of Intelligence. Beginning in August 2003, the Strategic Analysis Unit began producing the Director's Daily Report (DDR), a daily intelligence briefing that includes information on counterterrorism operations, terrorism threats, and information related to all areas of FBI investigative activity. The DDR is distributed to executives in all FBI operational divisions. The Director uses the DDR to brief the President nearly every weekday morning. The FBI also produces Presidential Intelligence Assessments, finished FBI intelligence products covering topics of particular interest to the President on issues other than terrorism. Director Mueller holds threat briefings twice a day: an intelligence briefing in the morning and a case-oriented briefing later in the day. At them, a briefer and the operational executive managers provide a summary of current threats and associated FBI operations. Because CIA and DHS representatives attend, these meetings facilitate the sharing of threat information. The development of the Bureau's daily briefings provides a tangible measure of progress. The Bureau historically measured its performance, to a large extent, by the number of criminals it arrested. Although useful for traditional law enforcement, a new standard was needed to measure how well the Bureau neutralized terrorist threats. The arrest standard failed to account for terrorist threats neutralized through means other than formal terrorism prosecutions - such as deportation, detention, arrest on non-terrorism charges, seizure of financial assets, and the sharing of information with foreign governments for their use in taking action against terrorists within their borders. The number of disruptions and dismantlement provides a better measure. This measure counts every time the Bureau - either by itself or with its partners in the law enforcement and intelligence communities - conducts an operation which disables, prevents, or interrupts terrorist fund-raising, recruiting, training, or operational planning. Since September 11, 2001, the FBI has participated in dozens of such operations, disrupting a wide variety of domestic and international terrorist undertakings. The FBI has made significant advances over the past three years, as the forgoing shows. GAO Comments: In addition to the letter reprinted in this appendix, we included the enclosure containing the recent accomplishments of the Federal Bureau of Investigation. We did not solicit this type of information from any participating department nor its components, during this engagement. Nor did we conduct the necessary audit to verify the validity of the findings. In addition to providing the letter and enclosure, the department provided technical comments. We incorporated the technical comments where appropriate throughout the report. [End of section] Appendix XV: GAO Contacts and Staff Acknowledgments: GAO Contacts: Intelligence and Warning: FBI Law Enforcement Issues: Laurie E. Ekstrand, (202) 512-2758: FBI Information Technology and Watch List Issues: Randolph C. Hite, (202) 512-6256: DHS Homeland Security Advisory System Issues: William O. Jenkins, Jr., (202) 512-8757: Threat Information Sharing Issues: Henry L. Hinton, (202) 512-6599: Border and Transportation Security: Border, Customs and Immigration Issues: Richard M. Stana, (202) 512-8816: Visa Issues: Jess T. Ford, (202) 512-4268: Travel Document Counterfeiting and Fraud: Robert J. Cramer, (202) 512-7227: Border Radiation Detection Issues: Eugene E. Aloise, (202) 512-6870: Biometrics Technology Issues: Keith A. Rhodes, (202) 512-3938: Border Information Technology Issues: David A. Powner, (202) 512-9286: Aviation Security Issues: Cathleen A. Berrick, (202) 512-3404: Surface Transportation Security Issues: Cathleen A. Berrick, (202) 512-3404: Maritime Security Issues: Margaret T. Wrightson, (415) 904-2200: U.S. Coast Guard Issues: Margaret T. Wrightson, (415) 904-2200: Domestic Counterterrorism: FBI Law Enforcement Issues: Laurie E. Ekstrand, (202) 512-2758: Money Laundering Issues: Richard M. Stana, (202) 512-8816: International Terrorist Financing Issues: Loren Yager, (202) 512-4347: Identification Counterfeiting and Fraud: Robert J. Cramer, (202) 512-7227: Social Security Number Fraud Issues: Barbara D. Bovbjerg, (202) 512-5491: Protecting Critical Infrastructures and Key Assets: National Critical Infrastructure Protection Issues: Robert F. Dacey, (202) 512-3317: Cybersecurity Issues: Robert F. Dacey, (202) 512-3317: Protecting Government Buildings: Mark L. Goldstein, (202) 512-6670: Federal Protective Service Issues: Mark L. Goldstein, (202) 512-6670: Defense Installation Protection Issues: Janet A. St. Laurent, (202) 512- 4402: Financial Services Sector Security Issues: Thomas J. McCool, (202) 512-8678: Postal and Shipping Safety and Security Issues: Katherine A. Siggerud, (202) 512-6570: Nuclear Power and Weapons Security Issues: Robin M. Nazzaro, (202) 512- 6246: Water Utilities Security Issues: Robin M. Nazzaro, (202) 512-6246: Agricultural Sector Security Issues: Larry Dykman, (202) 512-9692: Chemical Plants Security Issues: John B. Stephenson, (202) 512-6225: Defending Against Catastrophic Threats: Nonproliferation Issues: (Department of Energy): Eugene E. Aloise, (202) 512-6870: Nonproliferation Issues: (Department of State): Joseph A. Christoff, (202) 512-8979: Sales of Potentially Harmful Excess DOD Materials: Robert J. Cramer, (202) 512-7227: Bioterrorism Preparedness Issues: Janet Heinrich, (202) 512-7250: Bioterrorism Information Technology Issues: David A. Powner, (202) 512-9286: Defense Role in Weapons of Mass Destruction: Sharon L. Pickup, (202) 512-9619: Research and Development Issues: Eugene E. Aloise, (202) 512-6870: Emergency Preparedness and Response: First Responder Emergency Preparedness Issues: William O. Jenkins, (202) 512-8757: Public Health Preparedness Issues: Janet Heinrich, (202) 512- 7250: Defense Support to Civilian Agencies: Davi M. D'Agostino, (202) 512-5431: Crosscutting Issues: National Strategy Issues: Norman J. Rabkin, (202) 512-8777: Strategic Planning and Results Issues: Bernice Steinhardt, (202) 512-6534: Human Capital Management Issues: Christopher J. Mihm, (202) 512-3236: Budget Issues: Paul L. Posner, (202) 512-9573: Risk Management and Resource Allocation: Scott R. Farrow, (202) 512-6669: Information Technology Issues: Randolph C. Hite, (202) 512-6256: Acquisition Management: Katherine V. Schinasi, (202) 512-4841: Staff Acknowledgments: The following persons made key contributions to this report: Stephen L. Caldwell, Jared A. Hermalin, Wayne A. Ekblad, and Ricardo A. Marquez. In addition, numerous other individuals across GAO made contributions regarding the challenges faced in implementing the National Strategy for Homeland Security. [End of section] Related GAO Products: Intelligence and Warning: Intelligence Reform: Human Capital Considerations Critical to 9/11 Commission's Proposed Reforms. GAO-04-1084T. Washington, D.C.: September 14, 2004. Information Technology: Foundational Steps Being Taken to Make Needed FBI Systems Modernization Management Improvements. GAO-04-842. Washington, D.C.: September 10, 2004. Homeland Security: Communication Protocols and Risk Communication Principles Can Assist in Refining the Advisory System. GAO-04-682. Washington, D.C.: June 25, 2004. FBI Transformation: Human Capital Strategies May Assist the FBI in Its Commitment to Address Its Top Priorities. GAO-04-817T. Washington, D.C.: June 3, 2004. Security Clearances: FBI Has Enhanced Its Process for State and Local Law Enforcement Officials. GAO-04-596. Washington, D.C.: April 30, 2004. FBI Transformation: FBI Continues to Make Progress in Its Efforts to Transform and Address Priorities. GAO-04-578T. Washington, D.C.: March 23, 2004. Homeland Security: Risk Communication Principles May Assist in Refinement of the Homeland Security Advisory System. GAO-04-538T. Washington, D.C.: March 16, 2004. Homeland Security Advisory System: Preliminary Observations Regarding Threat Level Increases from Yellow to Orange. GAO-04-453R. Washington, D.C.: February 26, 2004. Drinking Water: Experts' Views on How Future Federal Funding Can Best Be Spent to Improve Security. GAO-04-29. Washington, D.C.: October 31, 2003. Homeland Security: Efforts to Improve Information Sharing Need to be Strengthened. GAO-03-760. Washington, D.C.: August 27, 2003. Post-Hearing Questions from the May 8, 2003, Hearing on Barriers to Information Sharing at the Department of Homeland Security. GAO-03- 985R. Washington, D.C.: July 7, 2003. Homeland Security: Information Sharing Responsibilities, Challenges, and Key Management Issues. GAO-03-715T. Washington, D.C.: May 8, 2003. Information Technology: Terrorist Watch Lists Should Be Consolidated to Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.: April 15, 2003. Combating Terrorism: Actions Needed to Improve Force Protection for DOD Deployment through Domestic Seaports. GAO-03-15. Washington, D.C.: October 22, 2002: Homeland Security: Information Sharing Activities Face Continued Management Challenges. GAO-02-1122T. Washington, D.C.: September 23, 2002. Border and Transportation Security: Port Security: Planning Needed to Develop and Operate Maritime Worker Identification Card Program. GAO-05-106. Washington, D.C.: December 10, 2004. Aviation Security: Preliminary Observations on TSA's Progress to Allow Airports to Use Private Passenger and Baggage Screening. GAO-05-126. Washington, D.C.: November 19, 2004. General Aviation Security: Increased Federal Oversight Is Needed, but Continued Partnership with the Private Sector is Critical to Long-Term Success. GAO-05-144. Washington, D.C.: November 10, 2004. Homeland Security: Management Challenges Remain in Transforming Immigration Programs. GAO-05-81. Washington, D.C.: October 14, 2004. Immigration Enforcement: DHS Has Incorporated Immigration Enforcement Objectives and Is Addressing Future Planning Requirements. GAO-05-66. Washington, D.C.: October 8, 2004. Maritime Security: Better Planning Needed to Help Ensure an Effective Port Security Assessment Program. GAO-04-1062. Washington, D.C.: September 30, 2004. Transportation Security R&D: TSA and DHS Are Researching and Developing Technologies, but Need to Improve R&D Management. GAO-04-890. Washington, D.C.: September 30, 2004. Social Security Numbers: Use Is Widespread and Protections Vary in Private and Public Sectors. GAO-04-1099T. Washington, D.C.: September 28, 2004. Border Security: Joint, Coordinated Actions by State and DHS Needed to Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington, D.C.: September 9, 2004. Border Security: State Department Rollout of Biometric Visas on Schedule, but Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004. Maritime Security: Partnering Could Reduce Federal Costs and Facilitate Implementation of Automatic Vessel Identification System. GAO-04-868. Washington, D.C.: July 23, 2004. Border Security: Additional Actions Needed to Eliminate Weaknesses in the Visa Revocation Process. GAO-04-795. Washington, D.C.: July 13, 2004. Maritime Security: Substantial Work Remains to Translate New Planning Requirements into Effective Port Security. GAO-04-838. Washington, D.C.: June 30, 2004. Homeland Security: Performance of Information Systems to Monitor Foreign Students and Exchange Visitors Has Improved but Issues Remain. GAO-04-690. Washington, D.C.: June 18, 2004. Border Security: Agencies Need to Better Coordinate Their Strategies and Operations on Federal Lands. GAO-04-590. Washington, D.C.: June 16, 2004. Aviation Security: Further Steps Needed to Strengthen the Security of Commercial Airport Perimeters and Access Controls. GAO-04-728. Washington, D.C.: June 4, 2004. Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 11, 2004. Aviation Security: Private Security Screening Contractors Have Little Flexibility to Implement Innovative Approaches. GAO-04-505T. Washington, D.C.: April 22, 2004. Coast Guard: Key Management and Budget Challenges for Fiscal Year 2005 and Beyond. GAO-04-636T. Washington, D.C.: April 7, 2004. Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31, 2004. Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail Security, but Significant Challenges Remain. GAO-04-598T. Washington, D.C.: March 23, 2004. Border Security: Improvements Needed to Reduce Time Taken to Adjudicate Visas for Science Students and Scholars. GAO-04-371. Washington, D.C.: February 25, 2004. Border Security: Improvements Needed to Reduce Time Taken to Adjudicate Visas for Science Students and Scholars. GAO-04-443T. Washington, D.C.: February 25, 2004. Coast Guard Programs: Relationship between Resources Used and Results Achieved Needs to Be Clearer. GAO-04-432. Washington, D.C.: March 22, 2004. Aviation Security: Computer-Assisted Passenger Prescreening System Faces Significant Implementation Challenges. GAO-04-385. Washington, D.C.: February 12, 2004. The Department of Homeland Security Needs to Fully Adopt a Knowledge- based Approach to Its Counter-MANPADS Development Program. GAO-04-341R. Washington, D.C.: January 30, 2004. Department of Homeland Security, Bureau of Customs and Border Protection: Required Advance Electronic Presentation of Cargo Information. GAO-04-319R. Washington, D.C.: December 18, 2003. Homeland Security: Preliminary Observations on Efforts to Target Security Inspections of Cargo Containers. GAO-04-325T. Washington, D.C.: December 16, 2003. Posthearing Questions Related to Aviation and Port Security. GAO-04- 315R. Washington, D.C.: December 12, 2003. Aviation Security: Efforts to Measure Effectiveness and Strengthen Security Programs. GAO-04-285T. Washington, D.C.: November 20, 2003. Aviation Security: Efforts to Measure Effectiveness and Address Challenges. GAO-04-232T. Washington, D.C.: November 5, 2003. Homeland Security: Overstay Tracking Is a Key Component of a Layered Defense. GAO-04-170T. Washington, D.C.: October 16, 2003. Airport Passenger Screening: Preliminary Observations on Progress Made and Challenges Remaining. GAO-03-1173. Washington, D.C.: September 24, 2003. Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 19, 2003. Maritime Security: Progress Made in Implementing Maritime Transportation Security Act, but Concerns Remain. GAO-03-1155T. Washington, D.C.: September 9, 2003. Land Border Ports of Entry: Vulnerabilities and Inefficiencies in the Inspections Process. GAO-03-1084R. Washington, D.C.: August 18, 2003. Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July 25, 2003. Border Security: New Policies and Increased Interagency Coordination Needed to Improve Visa Process. GAO-03-1013T. Washington, D.C.: July 15, 2003. Border Security: New Policies and Procedures Are Needed to Fill Gaps in the Visa Revocation Process. GAO-03-798. Washington, D.C.: June 18, 2003. Border Security: New Policies and Procedures Are Needed to Fill Gaps in the Visa Revocation Process. GAO-03-908T. Washington, D.C.: June 18, 2003. Homeland Security: Challenges Facing the Department of Homeland Security in Balancing Its Border Security and Trade Facilitation Missions. GAO-03-902T. Washington, D.C.: June 16, 2003. Transportation Security: Federal Action Needed to Address Security Challenges. GAO-03-843. Washington, D.C.: June 30, 2003. Counterfeit Documents Used to Enter the United States from Certain Western Hemisphere Countries Not Detected. GAO-03-713T. Washington, D.C.: May 13, 2003. Transportation Security Research: Coordination Needed in Selecting and Implementing Infrastructure Vulnerability Assessments. GAO-03-502. Washington, D.C.: May 1, 2003. Coast Guard: Challenges during the Transition to the Department of Homeland Security. GAO-03-594T. Washington, D.C.: April 1, 2003. Transportation Security: Post-September 11th Initiatives and Long-Term Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003. Homeland Security: Challenges to Implementing the Immigration Interior Enforcement Strategy. GAO-03-660T. Washington, D.C.: April 10, 2003. Border Security: Challenges in Implementing Border Technology. GAO-03- 546T. Washington, D.C.: March 12, 2003. Coast Guard: Comprehensive Blueprint Needed to Balance and Monitor Resource Use and Measure Performance for All Missions. GAO-03-544T. Washington, D.C.: March 12, 2003. Homeland Security: Challenges Facing the Coast Guard as It Transitions to the New Department. GAO-03-467T. Washington, D.C.: February 12, 2003. Weaknesses in Screening Entrants into the United States. GAO-03-438T. Washington, D.C.: January 30, 2003. Aviation Safety: Undeclared Air Shipments of Dangerous Goods and DOT's Enforcement Approach. GAO-03-22. Washington, D.C.: January 10, 2003. Mass Transit: Federal Action Could Help Transit Agencies Address Security Challenges. GAO-03-263. Washington, D.C.: December 13, 2002. Border Security: Implications for Eliminating the Visa Waiver Program. GAO-03-38. Washington, D.C.: November 22, 2002. Homeland Security: INS Cannot Locate Many Aliens because It Lacks Reliable Address Information. GAO-03-188. Washington, D.C.: November 21, 2002. Technology Assessment: Using Biometrics for Border Security. GAO-03- 174. Washington, D.C.: November 15, 2002. Coast Guard: Strategy Needed for Setting and Monitoring Levels of Effort for All Missions. GAO-03-155. Washington, D.C.: November 12, 2002. Border Security: Visa Process Should Be Strengthened as an Antiterrorism Tool. GAO-03-132NI. Washington, D.C.: October 21, 2002. Customs Service: Acquisition and Deployment of Radiation Detection Equipment. GAO-03-235T. Washington, D.C.: October 17, 2002. Mass Transit: Challenges in Securing Transit Systems. GAO-02-1075T. Washington, D.C.: September 18, 2002. Port Security: Nation Faces Formidable Challenges in Making New Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002. Combating Terrorism: Preliminary Observations on Weaknesses in Force Protection for DOD Deployments through Domestic Seaports. GAO-02- 955TNI. Washington, D.C.: July 23, 2002. Aviation Security: Vulnerabilities in, and Alternatives for, Preboard Screening Security Operations. GAO-01-1171T. Washington, D.C.: September 25, 2001. Aviation Security: Weaknesses in Airport Security and Options for Assigning Screening Responsibilities. GAO-01-1165T. Washington, D.C.: September 21, 2001. Aviation Security: Terrorist Acts Demonstrate Urgent Need to Improve Security at the Nation's Airports. GAO-01-1162T. Washington, D.C.: September 20, 2001. Aviation Security: Terrorist Acts Illustrate Severe Weaknesses in Aviation Security. GAO-01-1166T. Washington, D.C.: September 20, 2001. Domestic Counterterrorism: FBI Transformation: Data Inconclusive on Effects of Shift to Counterterrorism-Related Priorities on Traditional Crime Enforcement. GAO-04-1036. Washington, D.C.: August 31, 2004. Combating Terrorism: Federal Agencies Face Continuing Challenges in Addressing Terrorist Financing and Money Laundering. GAO-04-501T. Washington, D.C.: March 4, 2004. Investigations of Terrorist Financing, Money Laundering, and Other Financial Crimes. GAO-04-464R. Washington, D.C.: February 20, 2004. Terrorist Financing: U.S. Agencies Should Systematically Assess Terrorists' Use of Alternative Financing Mechanisms. GAO-04-163. Washington, D.C.: November 14, 2003. Combating Money Laundering: Opportunities Exist to Improve the National Strategy. GAO-03-813. Washington, D.C.: September 26, 2003. FBI Reorganization: Progress Made in Efforts to Transform, but Major Challenges Continue. GAO-03-759T. Washington, D.C.: June 18, 2003. Information Technology: FBI Needs an Enterprise Architecture to Guide Its Modernization Activities. GAO-03-959. Washington, D.C.: September 25, 2003. FBI Reorganization: Initial Steps Encouraging, but Broad Transformation Needed. GAO-02-865T. Washington, D.C.: June 21, 2002. Foreign Languages: Workforce Planning Could Help Address Staffing and Proficiency Shortfalls. GAO-02-514T. Washington, D.C.: March 12, 2002. Foreign Languages: Human Capital Approach Needed to Correct Staffing and Proficiency Shortfalls. GAO-02-375. Washington, D.C.: January 31, 2002. Homeland Security: Justice Department's Project to Interview Aliens after September 11, 2001. GAO-03-459. Washington, D.C.: April 11, 2003. Critical Infrastructure Protection: Homeland Security: Further Actions Needed to Coordinate Federal Agencies' Facility Protection Efforts and Promote Key Practices. GAO- 05-49. Washington, D.C.: November 30, 2004. U.S. Postal Service: Physical Security Measures Have Increased at Some Core Facilities, but Security Problems Continue. GAO-05-48. Washington, D.C.: November 16, 2004. Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters. GAO-04-984. Washington, D.C.: September 27, 2004. Drinking Water: Experts' Views on How Federal Funding Can Best Be Spent to Improve Security. GAO-04-1098T. Washington, D.C.: September 30, 2004. Nuclear Regulatory Commission: Preliminary Observations on Efforts to Improve Security at Nuclear Power Plants. GAO-04-1064T. Washington, D.C.: September 14, 2004. U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate Response to Anthrax Contamination. GAO-04-239. Washington, D.C.: September 9, 2004. Combating Terrorism: DOD Efforts to Improve Installation Preparedness Can Be Enhanced with Clarified Responsibilities and Comprehensive Planning. GAO-04-855. Washington, D.C.: August 9, 2004. Public Key Infrastructure: Examples of Risk and Internal Control Objectives Associated with Certification Authorities. GAO-04-1023R. Washington, D.C.: August 10, 2004. Homeland Security: Transformation Strategy Needed to Address Challenges Facing the Federal Protective Service. GAO-04-537. Washington, D.C.: July 14, 2004. Information Security: Agencies Need to Implement Consistent Processes in Authorizing Systems for Operation. GAO-04-376. Washington, D.C.: June 28, 2004. Critical Infrastructure Protection: Improving Information Sharing with Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004. National Nuclear Security Administration: Key Management Structure and Workforce Planning Issues Remain as NNSA Conducts Downsizing. GAO-04- 545. Washington, D.C.: June 25, 2004. Nuclear Security: Several Issues Could Impede Ability of DOE's Office of Energy, Science, and Environment to Meet the May 2003 Design Basis Threat. GAO-04-894T. Washington, D.C.: June 22, 2004. Information Security: Information System Controls at the Federal Deposit Insurance Corporation. GAO-04-630. Washington, D.C.: May 28, 2004. Posthearing Questions Related to Fragmentation and Overlap in the Federal Food Safety System. GAO-04-832R. Washington, D.C.: May 26, 2004. Terrorism Insurance: Effects of Terrorism Risk Insurance Act of 2002. GAO-04-720T. Washington, D.C.: April 28, 2004. Nuclear Security: DOE Needs to Resolve Significant Issues before It Fully Meets the New Design Basis Threat. GAO-04-623. Washington, D.C.: April 27, 2004. Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act of 2002. GAO-04-307. Washington, D.C.: April 23, 2004. Critical Infrastructure Protection: Establishing Effective Information Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.: April 21, 2004. Homeland Security: Federal Action Needed to Address Security Challenges at Chemical Facilities. GAO-04-482T. Washington, D.C.: February 23, 2004. Posthearing Questions from the September 17, 2003, Hearing on "Implications of Power Blackouts for the Nation's Cybersecurity and Critical Infrastructure Protection: The Electric Grid, Critical Interdependencies, Vulnerabilities, and Readiness". GAO-04-300R. Washington, D.C.: December 8, 2003. Security: Counterfeit Identification Raises Homeland Security Concerns. GAO-04-133T. Washington, D.C.: October 1, 2003. Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.: September 4, 2003. Nuclear Security: DOE Faces Security Challenges in the Post September 11, 2001, Environment. GAO-03-896TNI. Washington, D.C.: June 24, 2003. Nuclear Security: NNSA Needs to Better Manage Its Safeguards and Security Program. GAO-03-471. Washington, D.C.: May 30, 2003. Homeland Security: EPA's Management of Clean Air Act Chemical Facility Data. GAO-03-509R. Washington, D.C.: March 14, 2003. Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown. GAO-03- 439. Washington, D.C.: March 14, 2003. Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-414. Washington, D.C.: February 12, 2003. Potential Terrorist Attacks: More Actions Needed to Better Prepare Critical Financial Markets. GAO-03-468T. Washington, D.C.: February 12, 2003. Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants. GAO-03-251. Washington, D.C.: February 12, 2003. High-Risk Series: Protecting Information Systems Supporting the Federal Government and the Nation's Critical Infrastructures. GAO-03-121. Washington, D.C.: January 1, 2003. Information Security: Progress Made, but Challenges Remain to Protect Federal Systems and the Nation's Critical Infrastructures. GAO-03-564T. Washington, D.C.: April 8, 2003. Critical Infrastructure Protection: Significant Homeland Security Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9, 2002. Combating Terrorism: Actions Needed to Guide Services' Antiterrorism Efforts at Installations. GAO-03-14. Washington, D.C.: November 1, 2002. Homeland Security: Department of Justice's Response to Its Congressional Mandate to Assess and Report on Chemical Industry Vulnerabilities. GAO-03-24R. Washington, D.C.: October 10, 2002. Building Security: Interagency Security Committee Has Had Limited Success in Fulfilling Its Responsibilities. GAO-02-1004. Washington, D.C.: September 17, 2002. Chemical Safety: Emergency Response Community Views on the Adequacy of Federally Required Chemical Information. GAO-02-799. Washington, D.C.: July 31, 2002. Information Security: Corps of Engineers Making Improvements, but Weaknesses Continue. GAO-02-589. Washington, D.C.: June 10, 2002. Security Breaches at Federal Buildings in Atlanta, Georgia. GAO-02- 668T. Washington, D.C.: April 30, 2002. National Preparedness: Technologies to Secure Federal Buildings. GAO- 02-687T. Washington, D.C.: April 25, 2002. Diffuse Security Threats: Technologies for Mail Sanitation Exist, but Challenges Remain. GAO-02-365. Washington, D.C.: April 23, 2002. Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens Potential Economic Vulnerabilities. GAO-02-472T. Washington, D.C.: February 27, 2002. Critical Infrastructure Protection: Significant Challenges in Safeguarding Government and Privately Controlled Systems from Computer- Based Attacks. GAO-01-1168T. Washington, D.C.: September 26, 2001. Combating Terrorism: Actions Needed to Improve DOD Antiterrorism Program Implementation and Management. GAO-01-909. Washington, D.C.: September 19, 2001. Critical Infrastructure Protection: Significant Challenges in Protecting Federal Systems and Developing Analysis and Warning Capabilities. GAO-01-1132T. Washington, D.C.: September 12, 2001. Defending against Catastrophic Threats: Nuclear Nonproliferation: DOE Needs to Consider Options to Accelerate the Return of Weapons-Usable Uranium from Other Countries to the United States and Russia. GAO-05-57. Washington, D.C.: November 19, 2004. Nuclear Nonproliferation: DOE Needs to Take Action to Further Reduce the Use of Weapons-Usable Uranium in Civilian Nuclear Reactors. GAO-04- 807. Washington, D.C.: July 30, 2004. Department of State: Nonproliferation, Anti-terrorism, Demining, and Related Programs Follow Legal Authority, but Some Activities Need Reassessment. GAO-04-521. Washington, D.C.: April 30, 2004. Nonproliferation: Improvements Needed for Controls on Exports of Cruise Missile and Unmanned Aerial Vehicle Technology. GAO-04-493T. Washington, D.C.: March 9, 2004. Missile Defense: Actions Being Taken to Address Testing Recommendations, but Updated Assessment Needed. GAO-04-254. Washington, D.C.: February 26, 2004. Weapons of Mass Destruction: Defense Threat Reduction Agency Addresses Broad Range of Threats, but Performance Reporting Can Be Improved. GAO- 04-330. Washington, D.C.: February 13, 2004. Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002. Chemical and Biological Defense: DOD Should Clarify Expectations for Medical Readiness. GAO-02-219T. Washington, D.C.: November 7, 2001. Chemical and Biological Defense: DOD Needs to Clarify Expectations in Medical Readiness. GAO-02-38. Washington, D.C.: October 19, 2001. Combating Terrorism: Considerations for Investing Resources in Chemical and Biological Preparedness. GAO-02-162T. Washington, D.C.: October 17, 2001. Bioterrorism: Review of Public Health Preparedness Programs. GAO-02- 149T. Washington, D.C.: October 10, 2001. Bioterrorism: Public Health and Medical Preparedness. GAO-02-141T. Washington, D.C.: October 9, 2001. Bioterrorism: Coordination and Preparedness. GAO-02-129T. Washington, D.C.: October 5, 2001. Bioterrorism: Federal Research and Preparedness Activities. GAO-01- 915. Washington, D.C.: September 28, 2001. Emergency Preparedness and Response: Effective Regional Coordination Can Enhance Emergency Preparedness. GAO-04-1009. Washington, D.C.: September 15, 2004. Infectious Disease Preparedness: Federal Challenges in Responding to Influenza Outbreaks. GAO-04-1100T. Washington, D.C.: September 28, 2004. Homeland Security: Federal Leadership Needed to Facilitate Interoperable Communications between First Responders. GAO-04-1057T. Washington, D.C.: September 8, 2004. September 11: Health Effects in the Aftermath of the World Trade Center Attack. GAO-04-1068T. Washington, D.C.: September 8, 2004. HHS's Efforts to Promote Health Information Technology and Legal Barriers to Its Adoption. GAO-04-991R. Washington, D.C.: August 13, 2004. Health Care: National Strategy Needed to Accelerate the Implementation of Information Technology. GAO-04-947T. Washington, D.C.: July 14, 2004. Homeland Security: Coordinated Planning and Standards Needed to Better Manage First Responder Grants in the National Capital Region. GAO-04- 904T. Washington, D.C.: June 24, 2004. Homeland Security: Management of First Responder Grants in the National Capital Region Reflects the Need for Coordinated Planning and Performance Goals. GAO-04-433. Washington, D.C.: May 28, 2004. Homeland Security: DHS Needs a Strategy to Use DOE's Laboratories for Research on Nuclear, Biological, and Chemical Detection and Response Technologies. GAO-04-653. Washington, D.C.: May 24, 2004. Emergency Preparedness: Federal Funds for First Responders. GAO-04- 788T. Washington, D.C.: May 13, 2004. National Emergency Grants: Labor Is Instituting Changes to Improve Award Process, but Further Actions Are Required to Expedite Grant Awards and Improve Data. GAO-04-496. Washington, D.C.: April 16, 2004. Project SAFECOM: Key Cross-Agency Emergency Communications Effort Requires Stronger Collaboration. GAO-04-494. Washington, D.C.: April 16, 2004. Public Health Preparedness: Response Capacity Improving, but Much Remains to Be Accomplished. GAO-04-458T. Washington, D.C.: February 12, 2004. HHS Bioterrorism Preparedness Programs: States Reported Progress but Fell Short of Program Goals for 2002. GAO-04-360R. Washington, D.C.: February 10, 2004. Smallpox Vaccination: Review of the Implementation of the Military Program. GAO-04-215R. Washington, D.C.: December 1, 2003. Homeland Security: Challenges in Achieving Interoperable Communications for First Responders. GAO-04-231T. Washington, D.C.: November 6, 2003. September 11: Overview of Federal Disaster Assistance to the New York City Area. GAO-04-72. Washington, D.C.: October 31, 2003. U.S. Postal Service: Clear Communication with Employees Needed before Reopening the Brentwood Facility. GAO-04-205T. Washington, D.C.: October 23, 2003. Bioterrorism: Public Health Response to Anthrax Incidents of 2001. GAO- 04-152. Washington, D.C.: October 15, 2003. Infectious Diseases: Gaps Remain in Surveillance Capabilities of State and Local Agencies. GAO-03-1176T. Washington, D.C.: September 24, 2003. Homeland Security: Reforming Federal Grants to Better Meet Outstanding Needs. GAO-03-1146T. Washington, D.C.: September 3, 2003. Hospital Preparedness: Most Urban Hospitals Have Emergency Plans but Lack Certain Capacities for Bioterrorism Response. GAO-03-924. Washington, D.C.: August 6, 2003. Severe Acute Respiratory Syndrome: Established Infectious Disease Control Measures Helped Contain Spread, but a Large-Scale Resurgence May Pose Challenges. GAO-03-1058T. Washington, D.C.: July 30, 2003. Homeland Defense: DOD Needs to Assess the Structure of U.S. Forces for Domestic Military Missions. GAO-03-670. Washington, D.C.: July 11, 2003. U.S. Postal Service: Issues Associated with Anthrax Testing at the Wallingford Facility. GAO-03-787T. Washington, D.C.: May 19, 2003. SARS Outbreak: Improvements to Public Health Capacity Are Needed for Responding to Bioterrorism and Emerging Infectious Diseases. GAO-03- 769T. Washington, D.C.: May 7, 2003. Smallpox Vaccination: Implementation of National Program Faces Challenges. GAO-03-578. Washington, D.C.: April 30, 2003. Homeland Defense: Preliminary Observations on How Overseas and Domestic Missions Impact DOD Forces. GAO-03-677T. Washington, D.C.: April 29, 2003. Infectious Disease Outbreaks: Bioterrorism Preparedness Efforts Have Improved Public Health Response Capacity, but Gaps Remain. GAO-03-654T. Washington, D.C.: April 9, 2003. Bioterrorism: Preparedness Varied across State and Local Jurisdictions. GAO-03-373. Washington, D.C.: April 7, 2003. Homeland Security: CDC's Oversight of the Select Agent Program. GAO-03- 315R. Washington, D.C.: November 22, 2002. Homeland Security: New Department Could Improve Coordination, but Transferring Control of Certain Public Health Programs Raises Concerns. GAO-02-954T. Washington, D.C.: July 16, 2002. Homeland Security: New Department Could Improve Biomedical R&D Coordination but May Disrupt Dual-Purpose Efforts. GAO-02-924T. Washington, D.C.: July 9, 2002. Homeland Security: New Department Could Improve Coordination but May Complicate Public Health Priority Setting. GAO-02-883T. Washington, D.C.: June 25, 2002. Combating Terrorism: Intergovernmental Cooperation in the Development of a National Strategy to Enhance State and Local Preparedness. GAO-02- 550T. Washington, D.C.: April 2, 2002. Combating Terrorism: Enhancing Partnerships through a National Preparedness Strategy. GAO-02-549T. Washington, D.C.: March 28, 2002. Combating Terrorism: Critical Components of a National Strategy to Enhance State and Local Preparedness. GAO-02-548T. Washington, D.C.: March 25, 2002. Combating Terrorism: Intergovernmental Partnership in a National Strategy to Enhance State and Local Preparedness. GAO-02-547T. Washington, D.C.: March 22, 2002. Combating Terrorism: Key Aspects of a National Strategy to Enhance State and Local Preparedness. GAO-02-473T. Washington, D.C.: March 1, 2002. Bioterrorism: The Centers for Disease Control and Prevention's Role in Public Health Protection. GAO-02-235T. Washington, D.C.: November 15, 2001. Homeland Security: A Risk Management Approach Can Guide Preparedness Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001. Anthrax Vaccine: Changes to the Manufacturing Process. GAO-02-181T. Washington, D.C.: October 23, 2001. Homeland Security: Need to Consider VA's Role in Strengthening Federal Preparedness. GAO-02-145T. Washington, D.C.: October 15, 2001. Crosscutting Issues: Homeland Security: Further Action Needed to Promote Successful Use of Special DHS Acquisition Authority. GAO-05-136. Washington, D.C.: December 15, 2004. Information Technology: Major Federal Networks That Support Homeland Security Functions. GAO-04-375. Washington, D.C.: September 17, 2004. Homeland Security: Observations on the National Strategies Related to Terrorism. GAO-04-1075T. Washington, D.C.: September 22, 2004: Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains. GAO-04-777. Washington, D.C.: August 6, 2004. Department of Homeland Security: Formidable Information and Technology Management Challenge Requires Institutional Approach. GAO-04-702. Washington, D.C.: August 27, 2004. 9/11 Commission Report: Reorganization, Transformation, and Information Sharing. GAO-04-1033T. Washington, D.C.: August 3, 2004. Human Capital: Building on the Current Momentum to Transform the Federal Government. GAO-04-976T. Washington, D.C.: July 20, 2004. Financial Management: Department of Homeland Security Faces Significant Financial Management Challenges. GAO-04-774. Washington, D.C.: July 19, 2004. Status of Key Recommendations GAO Has Made to DHS and Its Legacy Agencies. GAO-04-865R. Washington, D.C.: July 2, 2004. Department of Homeland Security: Financial Management Challenges. GAO- 04-945T. Washington, D.C.: July 8, 2004. The Chief Operating Officer Concept and Its Potential Use as a Strategy to Improve Management at the Department of Homeland Security. GAO-04- 876R. Washington, D.C.: June 28, 2004. Human Capital: DHS Faces Challenges in Implementing Its New Personnel System. GAO-04-790. Washington, D.C.: June 18, 2004. Information Technology: Homeland Security Should Better Balance Need for System Integration Strategy with Spending for New and Enhanced Systems. GAO-04-509. Washington, D.C.: May 21, 2004. Additional Posthearing Questions Related to the Proposed Department of Homeland Security Human Capital Regulations. GAO-04-617R. Washington, D.C.: April 30, 2004. Transfer of Budgetary Resources to the Department of Homeland Security. GAO-04-329R. Washington, D.C.: April 30, 2004. Reserve Forces: Observations on Recent National Guard Use in Overseas and Homeland Missions and Future Challenges. GAO-04-670T. Washington, D.C.: April 29, 2004. Human Capital: Opportunities to Improve Federal Continuity Planning Guidance. GAO-04-384. Washington, D.C.: April 20, 2004. Combating Terrorism: Evaluation of Selected Characteristics in National Strategies Related to Terrorism. GAO-04-408T. Washington, D.C.: February 3, 2004. Homeland Security: Information Sharing Responsibilities, Challenges, and Key Management Issues. GAO-03-1165T. Washington, D.C.: September 17, 2003. Department of Homeland Security: Challenges and Steps in Establishing Sound Financial Management. GAO-03-1134T. Washington, D.C.: September 10, 2003. Combating Terrorism: Observations on National Strategies Related to Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003. Major Management Challenges and Program Risks: A Governmentwide Perspective. GAO-03-95. Washington, D.C.: January 1, 2003. Major Management Challenges and Program Risks: Department of Homeland Security. GAO-03-102. Washington, D.C.: January 1, 2003. Major Management Challenges and Program Risks: Department of Justice. GAO-03-105. Washington, D.C.: January 1, 2003. Major Management Challenges and Program Risks: Federal Emergency Management Agency. GAO-03-113. Washington, D.C.: January 1, 2003. Combating Terrorism: Funding Data Reported to Congress Should Be Improved. GAO-03-170. Washington, D.C.: November 26, 2002. Highlights of a GAO Forum on Mergers and Transformation: Lessons Learned for a Department of Homeland Security and Other Federal Agencies. GAO-03-293SP. Washington, D.C.: November 14, 2002. Homeland Security: Management Challenges Facing Federal Leadership. GAO-03-260. Washington, D.C.: December 20, 2002. Homeland Security: Effective Intergovernmental Coordination Is Key to Success. GAO-02-1013T. Washington, D.C.: August 23, 2002. Homeland Security: Effective Intergovernmental Coordination Is Key to Success. GAO-02-1012T. Washington, D.C.: August 22, 2002. Homeland Security: Effective Intergovernmental Coordination Is Key to Success. GAO-02-1011T. Washington, D.C.: August 20, 2002. Homeland Security: Critical Design and Implementation Issues. GAO-02- 957T. Washington, D.C.: July 17, 2002. Homeland Security: Title III of the Homeland Security Act of 2002. GAO- 02-927T. Washington, D.C.: July 9, 2002. Homeland Security: Intergovernmental Coordination and Partnership Will Be Critical to Success. GAO-02-901T. Washington, D.C.: July 3, 2002. Homeland Security: Intergovernmental Coordination and Partnership Will Be Critical to Success. GAO-02-900T. Washington, D.C.: July 2, 2002. Homeland Security: Intergovernmental Coordination and Partnership Will Be Critical to Success. GAO-02-899T. Washington, D.C.: July 1, 2002. Homeland Security: New Department Could Improve Coordination but May Complicate Priority Setting. GAO-02-893T. Washington, D.C.: June 28, 2002. Homeland Security: Proposal for Cabinet Agency Has Merit, but Implementation Will be Pivotal to Success. GAO-02-886T. Washington, D.C.: June 25, 2002. Homeland Security: Key Elements to Unify Efforts Are Underway, but Uncertainty Remains. GAO-02-610. Washington, D.C.: June 7, 2002. National Preparedness: Integrating New and Existing Technology and Information Sharing into an Effective Homeland Security Strategy. GAO- 02-811T. Washington, D.C.: June 7, 2002. Homeland Security: Responsibility and Accountability for Achieving National Goals. GAO-02-627T. Washington, D.C.: April 11, 2002. National Preparedness: Integration of Federal, State, Local, and Private Sector Efforts Is Critical to an Effective National Strategy for Homeland Security. GAO-02-621T. Washington, D.C.: April 11, 2002. Homeland Security: Progress Made; More Direction and Partnership Sought. GAO-02-490T. Washington, D.C.: March 12, 2002. Homeland Security: Challenges and Strategies in Addressing Short-and Long-Term National Needs. GAO-02-160T. Washington, D.C.: November 7, 2001. Homeland Security: Key Elements of a Risk Management Approach. GAO-02- 150T. Washington, D.C.: October 12, 2001. Homeland Security: A Framework for Addressing the Nation's Efforts. GAO-01-1158T. Washington, D.C.: September 21, 2001. Combating Terrorism: Selected Challenges and Related Recommendations. GAO-01-822. Washington, D.C.: September 20, 2001. FOOTNOTES [1] Homeland Security Act of 2002, Pub.L. 107-296 (Nov. 25, 2002). [2] See GAO, Combating Terrorism: Evaluation of Selected Characteristics in National Strategies Related to Terrorism, GAO-04-408T (Washington, D.C.: Feb. 3, 2004). [3] See GAO, Homeland Security: Selected Recommendations from Congressionally Chartered Commissions and GAO, GAO-04-591 (Washington, D.C.: Mar. 31, 2004). [4] See GAO, Status of Key Recommendations GAO Has Made to DHS and Its Legacy Agencies, GAO-04-865R (Washington, D.C.: July 2, 2004). [5] See GAO, Homeland Security: Observations on the National Strategies Related to Terrorism, GAO-04-1075T (Washington, D.C.: Sept. 22, 2004). [6] There were several other related national strategies issued subsequent to the National Strategy for Homeland Security. These include the National Money Laundering Strategy, the National Security Strategy, the National Strategy to Combat Weapons of Mass Destruction, the National Strategy for Combating Terrorism, the National Strategy for the Physical Protection of Critical Infrastructure and Key Assets, and the National Strategy to Secure Cyberspace. For our analysis of all of these strategies, see GAO-04-408T. [7] The strategy also includes a discussion of "foundations," which we did not identify separately in our analysis. The strategy describes these foundations as unique American strengths that cut across all sectors of society, such as law, science and technology, information sharing and systems, and international cooperation. The discussion of these foundations overlaps with the six mission areas. For example, the initiative to improve international shipping security is covered by both the mission area of Border and Transportation Security as well as the foundation of international cooperation. To some extent, our discussion of crosscutting issues also acknowledges issues that cut across all sectors. [8] Red-team techniques are those where the U.S. government would create a team that plays the role of terrorists in terms of identifying vulnerabilities and planning attacks. [9] See GAO, Major Management Challenges and Program Risks, Department of Homeland Security, GAO-03-102 (Washington, D.C.: Jan. 24, 2003). [10] This definition is from the Office of Management and Budget's (OMB) 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [11] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). OMB did not break the Intelligence Community spending down to the level of individual agencies. [12] See GAO, Combating Terrorism: Funding Data Reported to Congress Should Be Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002). [13] See GAO, Information Technology: FBI Needs an Enterprise Architecture to Guide Its Modernization Activities, GAO-03-959 (Washington, D.C.: Sept. 25, 2003). [14] See GAO, Homeland Security: Efforts to Improve Information Sharing Need to Be Strengthened, GAO-03-760 (Washington, D.C.: Aug. 27, 2003). [15] See GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness is Unknown, GAO-03-439 (Washington, D.C.: Mar. 14, 2003); Drinking Water: Experts' Views on How Future Federal Funding Can Best Be Spent to Improve Security, GAO-04-29 (Washington, D.C.: Oct. 31, 2003). [16] See GAO, Information Technology: Terrorist Watch Lists Should Be Consolidated to Promote Better Integration and Sharing, GAO-03-322 (Washington, D.C.: Apr. 15, 2003). [17] See GAO, Homeland Security: Risk Communication Principles May Assist in Refinement of the Homeland Security Advisory System, GAO-04-538T (Washington, D.C.: Mar. 16, 2004). [18] This definition is from OMB's 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [19] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). [20] See GAO-03-170. [21] See GAO, Homeland Security: Challenges Facing the Department of Homeland Security in Balancing its Border Security and Trade Facilitation Missions, GAO-03-902T (Washington, D.C.: June 16, 2003). [22] See GAO, Land Border Points of Entry: Vulnerabilities and Inefficiencies in the Inspections Process, GAO-03-1084R (Washington, D.C.: Aug. 18, 2003); and GAO-03-902T. [23] See GAO, Information Security: Challenges in Using Biometrics, GAO-03-1137T (Washington, D.C.: Sept. 9, 2003); Technology Assessment: Using Biometrics for Border Security, GAO-03-174 (Washington, D.C.: Nov. 15, 2002); and Border Security: Challenges in Implementing Border Technology, GAO-03-546T (Washington, D.C.: Mar. 12, 2003). [24] See GAO, Customs Service: Acquisition and Deployment of Radiation Detection Equipment, GAO-03-235T (Washington, D.C.: Oct. 17, 2002). [25] See GAO, Border Security: Visa Process Should Be Strengthened as an Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002). [26] See GAO, Border Security: New Policies and Procedures Are Needed to Fill Gaps in the Visa Revocation Process, GAO-03-1013T (Washington, D.C.: June 18, 2003). [27] See GAO, Border Security: Implications of Eliminating the Visa Waiver Program, GAO-03-38 (Washington, D.C.: Nov. 22, 2002). [28] See GAO, Border Security: Improvements Needed to Reduce Time Taken to Adjudicate Visas for Science Students and Scholars, GAO-04-371 (Washington, D.C.: Feb. 26, 2004). [29] See GAO, Visa Operations at U.S. Posts in Canada, GAO-04-708R (Washington, D.C.: May 18, 2004). [30] See GAO, Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed, GAO-04-569T (Washington, D.C.: Mar. 18, 2004). [31] See GAO, Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed, GAO-04-586 (Washington, D.C.: May 11, 2004). [32] See GAO, Aviation Security: Challenges Delay Implementation of Computer-Assisted Passenger Prescreening System, GAO-04-504T (Washington, D.C.: Mar. 17, 2004); and Aviation Security: Computer- Assisted Passenger Prescreening System Faces Significant Implementation Challenges, GAO-04-385 (Washington, D.C.: Feb. 12, 2004). [33] GAO, Aviation Security: Challenges Exist in Stabilizing and Enhancing Passenger and Baggage Screening Operations, GAO-04-440T (Washington, D.C.: Feb. 12, 2004); and Aviation Security: Private Screening Contractors Have Little Flexibility to Implement Innovative Approaches, GAO-04-505T (Washington, D.C.: Apr. 22, 2004). [34] See GAO, Aviation Security: Further Steps Needed to Strengthen the Security of Commercial Airport Perimeters and Access Controls, GAO-04-728 (Washington, D.C.: June 4, 2004). [35] See GAO, The Department of Homeland Security Needs to Fully Adopt a Knowledge-based Approach to Its Counter-MANPADS Development Program, GAO-04-341R (Washington, D.C.: Jan. 30, 2004). [36] See GAO, Nonproliferation: Further Improvements Needed in U.S. Efforts to Counter Treats from Man-Portable Air Defense Systems, GAO-04-519 (Washington, D.C.: May 12, 2004). [37] See GAO, Transportation Security: Post-September 11th Initiatives and Long-Term Challenges, GAO-03-616T (Washington, D.C.: Mar. 31, 2003), and Transportation Security: Federal Action Needed to Enhance Security Efforts, GAO-03-1154T (Washington, D.C.: Sept. 9, 2003). [38] Federal hazardous material transportation law defines a hazardous material as a substance or material that the Secretary of Transportation has determined is capable of posing an unreasonable risk to health, safety, and property when transported in commerce (49 U.S.C. 5103). It includes hazardous substances such as ammonia, hazardous wastes from chemical manufacturing processes, and elevated temperature materials such as molten aluminum. [39] See GAO, Maritime Security: Progress Made in Implementing Maritime Transportation Security Act, but Concerns Remain, GAO-03-1155T (Washington, D.C.: Sept. 9, 2003). [40] See GAO, Container Security: Expansion of Key Customs Programs Will Require Greater Attention to Critical Success Factors, GAO-03-770 (Washington, D.C.: July 25, 2003). [41] See GAO, Homeland Security: Summary of Challenges Faced in Targeting Oceangoing Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.: Mar. 31, 2004) [42] See GAO, Contract Management: Coast Guard's Deepwater Program Needs Increased Attention to Management and Contract Oversight, GAO-04-380 (Washington, D.C.: Mar. 9, 2004). [43] See GAO, Coast Guard: Deepwater Program Acquisition Schedule Update Needed, GAO-04-695, (Washington, D.C.: June 9, 2004) [44] This definition is based on that used by OMB in its 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [45] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). [46] See GAO, Combating Terrorism: Funding Data Reported to Congress Should Be Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002). [47] See GAO, FBI Transformation: FBI Continues to Make Progress in Its Efforts to Transform and Address Priorities, GAO-04-578T (Washington, D.C.: Mar. 23, 2004); FBI Reorganization: Progress Made in Efforts to Transform, but Major Challenges Continue, GAO-03-759T (Washington, D.C.: June 18, 2003); Information Technology: FBI Needs an Enterprise Architecture to Guide Its Modernization Activities, GAO-03-959 (Washington, D.C.: Sept. 25, 2003); FBI Reorganization: Initial Steps Encouraging but Broad Transformation Needed, GAO-02-865T (Washington, D.C.: June 21, 2002); Foreign Languages: Workforce Planning Could Help Address Staffing and Proficiency Shortfalls, GAO-02-514T (Washington, D.C.: Mar. 12, 2002); and Foreign Languages: Human Capital Approach Needed to Correct Staffing and Proficiency Shortfalls, GAO-02-375 (Washington, D.C.: Jan. 31, 2002). [48] See GAO, Combating Money Laundering: Opportunities Exist to Improve the National Strategy, GAO-03-813 (Washington, D.C.: Sept. 26, 2003). [49] See GAO, Investigations of Terrorist Financing, Money Laundering, and Other Financial Crimes, GAO-04-464R (Washington, D.C.: Feb. 20, 2004). [50] See GAO, Terrorist Financing: U.S. Agencies Should Systematically Assess Terrorists' Use of Alternative Financing Mechanisms, GAO-04-163 (Washington, D.C.: Nov. 14, 2003). [51] See GAO, Counterfeit Identification Raises Homeland Security Concerns, GAO-04-133T (Washington, D.C.: Oct. 1, 2003); Security Breaches at Federal Buildings in Atlanta, Georgia, GAO-02-668T (Washington, D.C.: Apr. 30, 2002). [52] See GAO, Social Security Administration: Actions Taken to Strengthen Procedures for Issuing Social Security Numbers to Noncitizens, but Some Weaknesses Remain, GAO-04-12 (Washington, D.C.: Oct. 15, 2003). [53] This definition is from OMB's 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [54] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). [55] In December 2003, the President issued HSPD-7, which established a national policy for federal departments and agencies to identify and prioritize critical infrastructure and key resources and to protect them from terrorist attacks. It superseded Presidential Decision Directive 63 and defines responsibilities for DHS, sector-specific agencies (formerly referred to as sector liaisons) and other departments and agencies. [56] See GAO, Critical Infrastructure Protection: Establishing Effective Information Sharing with Infrastructure Sectors, GAO-04-699T (Washington, D.C.: Apr. 21, 2004). [57] See GAO, High-Risk Series: Federal Real Property, GAO-03-122 (Washington, D.C.: Jan. 1, 2003). [58] See GAO-02-668T and Counterfeit Identification and Identification Fraud Raise Security Concerns, GAO-03-1147T (Washington, D.C.: Sept. 9, 2003) [59] See GAO, Homeland Security: Transformation Strategy Needed to Address Challenges Facing the Federal Protective Service, GAO-04-537 (Washington, D.C.: July 14, 2004). [60] See GAO, Financial Market Preparedness: Improvements Made, but More Action Needed to Prepare for Wide-Scale Disasters, GAO-04-984 (Washington, D.C.: Sept. 27, 2004); Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants, GAO-03-251 (Washington, D.C.: Feb. 12, 2003); and Potential Terrorist Attacks: Additional Actions Needed to Better Prepare Critical Financial Market Participants, GAO-03-414 (Washington, D.C.: Feb. 12, 2003). [61] Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System. Board of Governors of the Federal Reserve, Office of the Comptroller of the Currency, and the Securities Exchange Commission (Washington, D.C.: Apr. 8, 2003). [62] See GAO, Critical Infrastructure Protection: Efforts of the Financial Services Sector to Address Cyber Threats, GAO-03-173 (Washington, D.C.: Jan. 30, 2003). [63] GAO, Diffuse Security Threats: USPS Air Filtration Systems Need More Testing and Cost Benefit Analysis before Implementation, GAO-02-838 (Washington, D.C.: Aug. 22, 2002); U.S. Postal Service: Better Guidance Is Needed to Improve Communication Should Anthrax Contamination Occur in the Future, GAO-03-316 (Washington, D.C.: Apr. 7, 2003); U.S. Postal Service: Issues Associated with Anthrax Testing at the Wallingford Facility, GAO-03-787T (Washington, D.C.: May 19, 2003); U.S. Postal Service: Clear Communication with Employees Needed before Reopening the Brentwood Facility. GAO-04-205T (Washington, D.C.: Oct. 23, 2003); and Federal Mail Screening: Better Postal Service Communication with Agencies Needed to Enhance Federal Mail Security in the Washington, D.C., Area, GAO-04-286RNI (Washington, D.C.: Dec. 31, 2003). [64] See GAO, Drinking Water: Experts' Views on How Future Federal Funding Can Best Be Spent to Improve Security, GAO-04-29 (Washington, D.C.: Oct. 31, 2003). [65] See GAO, Federal Food Safety and Security System: Fundamental Restructuring is Needed to Address Fragmentation and Overlap, GAO-04-588T (Washington, D.C.: Mar. 30, 2004). [66] See GAO, Bioterrorism: A Threat to Agriculture and the Food Supply, GAO-04-259T (Washington, D.C.: Nov. 19, 2003). [67] See GAO, Food-Processing Security: Voluntary Efforts Are Under Way, but Federal Agencies Cannot Assess Their Implementation, GAO-03-342 (Washington, D.C.: Feb. 14, 2003). [68] USDA's Plum Island Animal Disease Center was transferred to DHS in June of 2003. Although USDA still administers research and diagnostic programs on the island, DHS and USDA also conduct joint research supporting efforts to reduce the effects of an attack on agriculture. DHS is responsible for the security and management of the facility. Located off the northeast coast of Long Island, New York, the center is the only place in the United States where certain highly infectious foreign animal diseases, such as foot and mouth disease, are studied. [69] See GAO, Combating Bioterrorism: Actions Needed to Improve Security at Plum Island Animal Disease Center, GAO-03-847 (Washington, D.C.: Sept. 19, 2003). [70] See GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of Security Preparedness Is Unknown, GAO-03-439 (Washington, D.C.: Mar. 14, 2003). [71] See GAO, Homeland Security: Federal Action Needed to Address Security Challenges at Chemical Facilities, GAO-04-482T (Washington, D.C.: Feb. 23, 2004). [72] See GAO, Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear Power Plants Needs to Be Strengthened, GAO-03-752 (Washington, D.C.: Sept. 4, 2003). [73] See GAO, Nuclear Security: DOE Needs to Resolve Significant Issues before It Fully Meets the New Design Basis Threat, GAO-04-623 (Washington, D.C.: Apr. 27, 2004). [74] See GAO, Nuclear Security: DOE Must Address Significant Issues to Meet the Requirements of the New Design Basis Threat, GAO-04-701T (Washington, D.C.: Apr. 27, 2004). [75] GAO, Nuclear Security: NNSA Needs to Better Manage Its Safeguards and Security Program, GAO-03-471 (Washington, D.C.: May 30, 2003). [76] GAO, Nuclear Security: Lessons to Be Learned from Implementing NNSA's Security Enhancements, GAO-02-358 (Washington, D.C.: Mar. 29, 2002). [77] GAO, Combating Terrorism: DOD Efforts to Improve Installation Preparedness Can Be Enhanced with Clarified Responsibilities and Comprehensive Planning, GAO-04-855 (Washington, D.C.: Aug. 12, 2004). [78] This definition is from OMB's 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [79] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). [80] See GAO, Combating Terrorism: Funding Data Reported to Congress Should be Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002). [81] See GAO, Nonproliferation: Improvements Needed for Controls on Exports of Cruise Missiles and Unmanned Aerial Vehicles, GAO-04-493T (Washington, D.C.: Mar. 9, 2004). [82] See GAO, Export Controls: Post-Shipment Verification Provides Limited Assurance That Dual-Use Items Are Being Properly Used, GAO-04-357 (Washington, D.C.: Feb. 11, 2004). [83] See GAO, Delays in Implementing the Chemical Weapons Convention Raise Concerns about Proliferation, GAO-04-361 (Washington, D.C.: Mar. 31, 2004). [84] See GAO, DOD Excess Property: Risk Assessment Needed on Public Sales of Equipment That Could Be Used to Make Biological Agents, GAO-04-15NI (Washington, D.C.: Nov. 19, 2003). [85] See GAO, Bioterrorism: Information Technology Strategy Could Strengthen Federal Agencies' Abilities to Respond to Public Health Emergencies, GAO-03-139 (Washington, D.C.: May 30, 2003). [86] See GAO-04-855. [87] This definition is from OMB's 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [88] OMB, Analytical Perspectives, Budget of the United States Government, Fiscal Year 2005 (Washington, D.C.: Feb. 2004). [89] OMB, 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [90] See GAO, Homeland Security: Management of First Responder Grants in the National Capital Region Reflects the Need for Coordinated Planning and Performance Goals, GAO-04-433 (Washington, D.C.: May 28, 2004); Homeland Security: Coordinated Planning and Standards Needed to Better Manage First Responder Grants in the National Capital Region, GAO-04-904T (Washington, D.C.: June 24, 2004); and Homeland Security: Federal Leadership and Intergovernmental Coordination Required to Achieve First Responder Interoperable Communications, GAO-04-740 (Washington, D.C.: July 20, 2004). [91] See GAO-04-433. [92] See GAO, Bioterrorism: Preparedness Varied across State and Local Jurisdictions, GAO-03-373 (Washington, D.C.: Apr. 7, 2003). [93] See GAO, Homeland Security: Reforming Federal Grants to Better Meet Outstanding Needs, GAO-03-1146T (Washington, D.C.: Sept. 3, 2003). [94] See GAO, Federal Assistance: Grant System Continues to Be Highly Fragmented, GAO-03-718T (Washington, D.C.: Apr. 29, 2003). [95] See GAO, Homeland Security: Efforts to Improve Information Sharing Need to Be Strengthened, GAO-03-760, (Washington, D.C.: Aug. 27, 2003); and Homeland Security: Challenges in Achieving Interoperable Communications for First Responders, GAO-04-231 (Washington, D.C.: Nov. 6, 2003). [96] See GAO, Project SAFECOM: Key Cross-Agency Emergency Communications Effort Requires Stronger Collaboration, GAO-04-494 (Washington, D.C.: Apr.16, 2004). [97] See GAO, Bioterrorism: Public Health Response to Anthrax Incidents of 2001, GAO-04-152 (Washington, D.C.: Oct. 15, 2003). [98] See GAO-03-373. [99] See GAO, SARS Outbreak: Improvements to Public Health Capacity Are Needed for Responding to Bioterrorism and Emerging Infectious Diseases, GAO-03-769T (Washington, D.C.: May 7, 2003). [100] See GAO, Hospital Preparedness: Most Urban Hospitals Have Emergency Plans but Lack Certain Capacities for Bioterrorism Response, GAO-03-924 (Washington, D.C.: Aug. 6, 2003). [101] See GAO, Homeland Security: Coordinated Planning and Standards Needed to Better Manage First Responder Grants in the National Capital Region, GAO-04-904T (Washington, D.C.: June 24, 2004). [102] See GAO-04-231T. [103] The 1878 Posse Comitatus Act prohibits the direct use of federal military troops in domestic civilian law enforcement, except where authorized by the Constitution or acts of Congress. Congress has expressly authorized the use of the military in certain situations such as to assist with terrorist incidents involving weapons of mass destruction. [104] See GAO, Homeland Defense: DOD Needs to Assess the Structure of U.S. Forces for Domestic Military Missions, GAO-03-670 (Washington, D.C.: July 11, 2003). [105] See GAO, Major Management Challenges and Program Risks, Department of Homeland Security, GAO-03-102 (Washington, D.C.: Jan. 24, 2003). [106] See GAO, Homeland Security: Responsibility and Accountability for Achieving National Goals, Statement of David M. Walker, Comptroller General of the United States, GAO-02-627T (Washington, D.C.: Apr. 11, 2002); and Truth and Transparency: The Federal Government's Financial Condition and Fiscal Outlook (Washington, D.C.: Sept. 17, 2003). [107] GAO, Combating Terrorism: Funding Data Reported to Congress Should Be Improved, GAO-03-170 (Washington, D.C.: November 26, 2002). [108] Consistent with the requirements of Fiscal Year 1998 National Defense Authorization Act, the annual Report to Congress on Combating Terrorism details governmentwide spending to combat terrorism. Starting with the fiscal year 2005 President's budget, in compliance with the Homeland Security Act of 2002, this information will be transmitted with the President's buget. [109] See GAO, Homeland Security: Key Elements of a Risk Management Approach, GAO-02-150T (Washington, D.C.: Oct. 12, 2001); and Homeland Security: A Risk Management Approach Can Guide Preparedness Efforts, GAO-02-208T (Washington, D.C.: Oct. 31, 2001). [110] OMB Circulars A-11 and A-94. [111] OMB, Office of Information and Regulatory Affairs, Informing Regulatory Decisions: 2003 Report to Congress on the Costs and Benefits of Federal Regulations and Unfunded Mandates on State, Local, and Tribal Entities (Washington, D.C.: Sept. 2003). [112] OMB, 2003 Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003). [113] OMB Circular A-11. [114] OMB Circular A-94. [115] See GAO, Homeland Security: Critical Design and Implementation Issues, GAO-02-957T (Washington, D.C.: July 17, 2002). [116] See GAO, Homeland Security: Responsibility and Accountability for Achieving National Goals, GAO-02-627T (Washington, D.C.: Apr. 11, 2002). [117] See GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6, 2004). [118] See GAO, Information Technology Management: Governmentwide Strategic Planning, Performance Measurement, and Investment Management Can Be Further Improved, GAO-04-49 (Washington, D.C.: Jan. 12, 2004). GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.