Overseas Security

State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies Gao ID: GAO-05-642 May 9, 2005

U.S. government officials working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked--23 fatally--by terrorists outside the embassy. As the State Department continues to improve security at U.S. embassies, terrorist groups are likely to focus on "soft" targets--such as homes, schools, and places of worship. GAO was asked to determine whether State has a strategy for soft target protection; assess State's efforts to protect U.S. officials and their families while traveling to and from work; assess State's efforts overseas to improve security at schools attended by the children of U.S. officials; and describe issues related to protection at their residences.

State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. They also indicated that they have recently initiated an effort to develop a soft targets strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. Three State initiated investigations into terrorist attacks against U.S. officials outside of embassies found that the officials lacked the necessary hands-on training to help counter the attack. The investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. After each of these investigations, State reported to Congress that it planned to implement the recommendations, yet we found that State's hands-on training course is not required, the accountability procedures have not been effectively implemented, and key embassy officials are not trained to implement State's counterterrorism procedures. State instituted a program in 2003 to improve security at schools, but its scope has not yet been fully determined. In fiscal years 2003 and 2004, Congress earmarked $29.8 million for State to address security vulnerabilities against soft targets, particularly at overseas schools. The multiphase program provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities from terrorist threats. However, during our visits to posts, regional security officers were unclear about which schools could qualify for security assistance under phase three of the program. State's program to protect U.S. officials and their families at their residences is primarily designed to deter crime, not terrorism. The Residential Security program includes basic security hardware and local guards, which State officials said provide effective deterrence against crime, though only limited deterrence against a terrorist attack. To minimize the risk and consequences of a residential terrorist attack, some posts we visited limited the number of U.S. officials living in specific apartment buildings. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in residential areas.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone:


GAO-05-642, Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies This is the accessible text file for GAO report number GAO-05-642 entitled 'Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies' which was released on May 10, 2005. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: May 2005: Overseas Security: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies: [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-642]: GAO Highlights: Highlights of GAO-05-642, a report to the Chairman, Subcommittee on National Security, Emerging Threats, and International Relations, Committee on Government Reform, House of Representatives: Why GAO Did This Study: U.S. government officials working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked”23 fatally”by terrorists outside the embassy. As the State Department continues to improve security at U.S. embassies, terrorist groups are likely to focus on ’soft“ targets”such as homes, schools, and places of worship. GAO was asked to determine whether State has a strategy for soft target protection; assess State‘s efforts to protect U.S. officials and their families while traveling to and from work; assess State‘s efforts overseas to improve security at schools attended by the children of U.S. officials; and describe issues related to protection at their residences. What GAO Found: State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. They also indicated that they have recently initiated an effort to develop a soft targets strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. Three State initiated investigations into terrorist attacks against U.S. officials outside of embassies found that the officials lacked the necessary hands-on training to help counter the attack. The investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. After each of these investigations, State reported to Congress that it planned to implement the recommendations, yet we found that State‘s hands-on training course is not required, the accountability procedures have not been effectively implemented, and key embassy officials are not trained to implement State‘s counterterrorism procedures. State instituted a program in 2003 to improve security at schools, but its scope has not yet been fully determined. In fiscal years 2003 and 2004, Congress earmarked $29.8 million for State to address security vulnerabilities against soft targets, particularly at overseas schools. The multiphase program provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities from terrorist threats. However, during our visits to posts, regional security officers were unclear about which schools could qualify for security assistance under phase three of the program. State‘s program to protect U.S. officials and their families at their residences is primarily designed to deter crime, not terrorism. The Residential Security program includes basic security hardware and local guards, which State officials said provide effective deterrence against crime, though only limited deterrence against a terrorist attack. To minimize the risk and consequences of a residential terrorist attack, some posts we visited limited the number of U.S. officials living in specific apartment buildings. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in residential areas. What GAO Recommends: We are recommending that the Secretary of State develop a soft targets strategy; develop counterterrorism training for officials; and fully implement its personal security accountability system for embassy officials. State generally agreed with our recommendations. www.gao.gov/cgi-bin/getrpt?GAO-05-642. To view the full product, including the scope and methodology, click on the link above. For more information, contact Jess T. Ford at (202) 512- 4128 or fordj@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: State Has Not Developed a Strategy to Cover Soft Target Areas; Key Issues Need to Be Resolved: State Has Not Fully Implemented ARB Training and Accountability Recommendations to Improve Security for Embassy Personnel: State Develops Soft Targets Program for Schools but Scope Is Not Yet Fully Defined: Issues Related to the Protection of U.S. Officials and Their Families at Residences against Terrorist Threats: Conclusion: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendixes: Appendix I: Scope and Methodology: Appendix II: Comments from the Department of State: GAO Comments: Appendix III: GAO Contacts and Staff Acknowledgments: Figures: Figure 1: Number of U.S. Officials Killed by Terrorist Attacks Outside Embassies, 1968-2003: Figure 2: Approximate Percentage of Posts by Terrorism Threat Levels: Figure 3: Terrorist Attacks by Location Assessed by the Accountability Review Boards, 1986-2004: Figure 4: Security Courses Available to U.S. Officials and Family Members: Figure 5: New Public Address System Funded by the Soft Targets Program: Figure 6: School Fence to Be Replaced under the Soft Targets Program: Figure 7: Local Guard at Embassy Housing: Abbreviations: AFSA: American Foreign Service Association: ARB: Accountability Review Board: COM: chief of mission: DCM: deputy chief of mission: DS: Bureau of Diplomatic Security: DSAC: Diplomatic Security Antiterrorism Course: FAH: Foreign Affairs Handbook: FAM: Foreign Affairs Manual: OBO: Overseas Buildings Operations: OSPB: Overseas Security Policy Board: RSO: regional security officer: SAFE: Serving Abroad for Families and Employees: Letter May 9, 2005: The Honorable Christopher Shays: Chairman: Subcommittee on National Security, Emerging Threats, and International Relations: Committee on Government Reform: House of Representatives: Dear Mr. Chairman: U.S. government officials and their families living and working overseas are at risk from terrorist threats. Since 1968, 32 embassy officials have been attacked--23 fatally--by terrorists outside the embassy (see fig. 1). As the State Department continues to improve security at U.S. embassies, concerns are growing that terrorist groups are likely to focus on "soft" targets--such as homes, schools, and places of worship.[Footnote 1] Recent terrorist attacks against housing complexes in Saudi Arabia, a school in Russia, and places of worship in Turkey illustrate this growing threat. State-initiated security assessments have further documented this growing concern and recommended that State develop better measures to protect U.S. officials and their families in soft target areas.[Footnote 2] Figure 1: Number of U.S. Officials Killed by Terrorist Attacks Outside Embassies, 1968-2003: [See PDF for image] [End of figure] Because of the large number of U.S. officials and their families living abroad that are potentially at risk, you requested that we evaluate State's programs and efforts to protect them from terrorist attacks while outside the embassy. You specifically asked us to determine whether State has a strategy for soft target protection; assess State's efforts to protect U.S. officials and their families against terrorist attacks while traveling to and from work; assess State's efforts overseas to improve security at schools attended by the children of U.S. officials;[Footnote 3] and describe issues related to protection at their residences. To determine how the State Department protects U.S. officials and their families while outside the embassy, we reviewed State documents, interviewed State officials in Washington, D.C., and attended security training and briefings available to State officials. In addition, we interviewed several members of the Overseas Security Policy Board (OSPB), an interagency consultative body that considers, develops, coordinates, and promotes security policies, standards, and agreements on overseas security programs that affect U.S. personnel at missions. We also reviewed documents, conducted interviews, and held roundtable discussions with State and other agency officials, including family members, at five posts in four countries. Post selection was based on a number of factors, including variety in post size and post terrorism threat levels. For the purpose of this report, our focus on soft target protection primarily pertains to U.S. government officials and their families and other post personnel who fall under chief of mission authority. To limit the scope of our review, we did not look at post evacuations, or security advice or assistance provided through the Overseas Security Advisory Council, the Antiterrorism Assistance Program, and the consular warden system. Appendix I provides more information on our scope and methodology. We conducted our evaluation from March 2004 through February 2005 in accordance with generally accepted government auditing standards. Results in Brief: State has a number of programs and activities designed to protect U.S. officials and their families outside the embassy, including security briefings, protection at schools and residences, and surveillance detection (these programs are discussed in more detail later in this report).[Footnote 4] However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families abroad from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. According to State officials, they have recently initiated an effort to develop a soft target strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. State has not fully implemented one of the most important safeguards against terrorist attacks while traveling to and from work-- counterterrorism training. Three State-initiated investigations into terrorist attacks against U.S. officials found that, among other things, the officials lacked the necessary hands-on training to help counter the attack. In response, the investigations recommended that State provide hands-on counterterrorism training and implement accountability measures to ensure compliance with personal security procedures. However, State has not fully implemented these recommendations. It does not require counterterrorism training for U.S. officials and their families at high-or critical-threat posts. In addition, State has not fully implemented accountability procedures for monitoring and promoting security procedures. According to State, training has been hindered by limitations in funding and training capacities. Further, State has asserted that implementing new accountability procedures globally is a long-term process. Moreover, State has not been training its ambassadors, deputy chiefs of mission, and regional security officers on ways to effectively promote the use of the personal security procedures. State instituted a program in 2003 to improve security at schools, but the scope has not yet been fully determined. In fiscal years 2003 and 2004, Congress earmarked $29.8 million for State to address security vulnerabilities against soft targets, particularly at overseas schools. To respond to this congressional concern, State developed a multiphase program that provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities overseas from terrorist threats.[Footnote 5] However, during our visits to five posts, regional security officers were unclear about which schools qualified for security assistance under phase three of the program, with some regional security officers considering whether to fund schools in which just a few American children were enrolled. State's program to protect U.S. officials and their families at their residences is designed primarily for crime, not terrorism. The Residential Security program includes basic security hardware, such as alarms, shatter-resistant window film, limited access control measures, and local guards. As the crime threat increases, hardware and guard services can be correspondingly increased at the residences. State officials said that while the Residential Security program provides effective deterrence against crime, it could provide only limited deterrence against a terrorist attack. To minimize the risk and consequences of a residential terrorist attack, some posts we visited limited the number of U.S. officials living in specific apartment buildings. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in the residential areas. We are recommending that the Secretary of State, working with the Overseas Security Policy Board, develop a comprehensive soft targets strategy with OSPB standards that takes funding limitations, training, and accountability into consideration; develop stronger counterterrorism training requirements for officials going to high-and critical-threat posts; and fully implement a personal security accountability system for all embassy officials, including developing related personal security standards for the Foreign Affairs Manual. Background: With the changing security environment and the emergence of terrorist coalitions that operate across international borders, the threat of terrorism against U.S. interests and personnel abroad has grown. Over the past decades, and in particular in response to the 1998 embassy bombings in Africa, the State Department has been hardening its official facilities to protect its embassies, consulates, and personnel abroad. However, as State hardened embassies, the American Foreign Service Association (AFSA) raised concerns about the vulnerability of soft targets.[Footnote 6] Soft Targets, Size, and Scope of American Overseas Diplomatic Presence Defined: According to a State Department travel warning, State considers soft targets to be places, including but not limited to, where Americans and other westerners live, congregate, shop, or visit. This can include hotels, clubs, restaurants, shopping centers, housing compounds, places of worship, schools, or public recreation events. Travel routes of U.S. government employees are also considered soft targets, based on their vulnerability to terrorist attacks. The State Department is responsible for protecting more than 60,000 government employees who work in embassies and consulates abroad in 180 countries. These government officials at approximately 260 posts represent a number of agencies besides State--including the Departments of Agriculture, Defense, Homeland Security, Justice, and the Treasury, the Internal Revenue Service, and the United States Agency for International Development-- and all fall under chief of mission authority. State officials indicated that only about one-third of officials at all posts are from the State Department. Entities Responsible for Protection of U.S. Officials and Their Families Abroad: The responsibilities for the protection of U.S. officials and their families are defined in federal legislation and policies. Under the Omnibus Diplomatic Security and Antiterrorism Act of 1986, the Department of State is given responsibility for the protection of U.S. officials and their families overseas.[Footnote 7] The act directs the Secretary of State to develop and implement policies and programs, including funding levels and standards, to provide for the security of U.S. government operations of a diplomatic nature and establishes within State the Bureau of Diplomatic Security (DS). The mission of DS is to provide a safe and secure environment for the conduct of U.S. foreign policy. Within DS, there are a number of offices that address and implement security policies and practices to protect facilities and personnel at posts.[Footnote 8] At posts abroad, the chiefs of mission are responsible for the protection of personnel and accompanying family members at the missions.[Footnote 9] Additionally, regional security officers (RSOs) administer all aspects of security programs at posts. The RSOs' responsibilities include providing post officials and their families with security briefings upon their arrival; designing and implementing residential security and local guard programs; liaising and coordinating with the host country law enforcement and U.S. private sector communities to discuss threat issues; and offering security advice and briefings to schools attended by dependents of U.S. government officials. The host nation is responsible for providing protection to diplomatic personnel and missions, as established by the 1961 Vienna Convention on Diplomatic Relations.[Footnote 10] The convention states the host country should take appropriate steps to protect missions, personnel, and their families, including protecting the consular premises against any intrusion, damage, or disturbances. The Overseas Security Policy Board, which includes representatives from 19 U.S. intelligence, foreign affairs, and other agencies, is responsible for considering, developing, coordinating, and promoting security policies, standards, and agreements on overseas operations, programs, and projects that affect U.S. government agencies under the authority of the chief of mission. This responsibility includes reviewing and issuing uniform guidance for residential security and local guard programs based on threat levels. The Security Environment Threat List, published semiannually by State, reflects the level of threat at all posts in six threat categories, including crime, political violence, and terrorism.[Footnote 11] Over 50 percent of all posts fall under the terrorism threat ratings of critical or high (see fig. 2).[Footnote 12] State, in consultation with representatives of the board, develops security standards, based on threat levels, for U.S. missions overseas.[Footnote 13] Figure 2: Approximate Percentage of Posts by Terrorism Threat Levels: [See PDF for image] Note: Calculations are based on 260 posts abroad. Threat levels indicated are for transnational terrorism. [End of figure] When a security-related incident occurs that involves serious injury or loss of life or significant destruction of property at a U.S. government mission abroad, State is required to convene an Accountability Review Board (ARB). ARBs are composed of five individuals, four appointed by the Secretary of State and one by the Director of the Central Intelligence Agency. Members investigate the security incident and issue a report with recommendations to promote and encourage improved security programs and practices. State is required to report to Congress on actions it has taken in response to ARB recommendations. As of March 2005, there have been 11 Accountability Review Boards convened since the board's establishment in 1986. Appropriations Subcommittee Urges State to Develop a Soft Target Strategy: The Senate Appropriations Subcommittee on Commerce, Justice, State and the Judiciary, in its 2002 and subsequent reports, urged State to formulate a strategy for addressing, in the short and long term, threats to locales abroad that are frequented by U.S. officials and their families. This included providing security enhancements for locations that are affiliated with the United States by virtue of the activities and the individuals they accommodate and therefore might be soft targets. In a number of subsequent reports, the subcommittee has focused its concern about soft targets on schools, residences, places of worship, and other popular gathering places. In fiscal year 2003, a total of $15 million was earmarked for soft target protection, particularly to address security vulnerabilities at overseas schools.[Footnote 14] Moreover, in fiscal year 2004, Congress earmarked an additional $15 million for soft targets.[Footnote 15] More recently, the fiscal year 2005 Senate Appropriations Subcommittee report and the subsequent House Conference Report on fiscal year 2005 appropriations further stressed the need to protect these areas.[Footnote 16] The language in the Senate appropriations report directs State to develop a comprehensive, sustained strategy for addressing the threats posed to soft targets. Specifically, the report language specifies that a strategy should be submitted to the committee no later than June 1, 2005. For fiscal year 2005, Congress earmarked $15 million to secure and protect soft targets, of which $10 million is for security at overseas schools attended by dependents of U.S. government employees. State Has Not Developed a Strategy to Cover Soft Target Areas; Key Issues Need to Be Resolved: State has a number of programs and activities designed to protect U.S. officials and their families outside of the embassy, including security briefings, protection at schools and residences, and surveillance detection (these programs are discussed in more detail later in this report). Despite these efforts, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials and their families from terrorist threats outside the embassy. State officials raised a number of challenges related to developing and implementing such a strategy. They indicated they have recently initiated an effort to develop a soft target strategy. As part of this effort, State officials said they will need to address and resolve a number of legal and financial issues. State Cites Limitations in Developing a Soft Target Strategy: State has not developed a comprehensive soft target strategy to protect U.S. officials and their families from terrorist threats outside the embassy. A comprehensive strategy would focus on protection of U.S. officials and thief families in areas where they congregate, such as schools, residences, places of worship, and other popular gathering spots. However, in a number of meetings, State officials cited several complex issues involved with protecting soft targets and raised concerns about the broader implications of developing such a strategy. DS officials told us that the mission and responsibilities of DS continue to grow and become more complex, and they questioned how far State's protection of soft targets should extend. They said that providing U.S. government funds to protect U.S. officials and their families at private sector locations or to places of worship was unprecedented and raised a number of legal and financial challenges, including sovereignty and separation of church and state, that have not been resolved by the department. They also told us that specific authorization language would be needed to move beyond a State program that currently focuses on providing security upgrades to schools and off-compound employee association facilities abroad. State officials also indicated they have not yet fully defined the universe of soft targets--including taking an inventory of potentially vulnerable facilities and areas where U.S. officials and their families congregate--that would be necessary to complete a strategy. Although State has not developed a comprehensive soft target strategy, some State officials told us that several existing programs could help protect soft targets. However, they agreed that these existing programs are not tied together in an overall strategy. State officials agreed that they should undertake a formal evaluation of how existing programs can be more effectively integrated as part of a soft target strategy, and whether new programs might be needed to fill any potential gaps. A senior DS official told us that in January 2005, DS formed a working group to discuss and develop a comprehensive soft targets strategy to address the appropriate level of protection of U.S. officials and their families at schools, residences, and other areas outside the embassy. According to the DS official, the strategy should be completed and provided to the Senate Appropriations Committee by June 1, 2005. State Has Not Fully Implemented ARB Training and Accountability Recommendations to Improve Security for Embassy Personnel: Investigations into terrorist attacks against U.S. officials found that, among other things, the officials lacked the necessary hands-on training to help counter the attacks. The ARBs recommended that State provide hands-on counterterrorism training to help post officials identify terrorist surveillance and quickly respond to an impending attack. They also recommended State implement an accountability system to reduce complacency about following these procedures. After each investigation, State told Congress it would implement these recommendations, yet we found that State's hands-on training course is still not mandatory for all personnel going to posts, and procedures to monitor compliance with security requirements have not been fully implemented. According to State, training has been hindered by limitations in funding and training capacities, and implementing new accountability procedures globally is a long-term process. We also found that ambassadors, deputy chiefs of mission, and RSOs were not trained in how to implement embassy procedures intended to protect U.S. officials outside the embassies. Investigations Identify Key Vulnerability, Recommend Training and Accountability Safeguards: Five of the 11 ARB investigations have focused on attacks of U.S. officials on their way to work (see fig. 3): (1) the June 1988 assassination of a post official in Greece, (2) the April 1989 assassination of a post official in the Philippines, (3) the March 1995 assassination of two post officials in Pakistan, (4) the October 2002 assassination of a post official in Jordan, and (5) the October 2003 assassination in Gaza of three post contractors from Israel.[Footnote 17] Figure 3: Terrorist Attacks by Location Assessed by the Accountability Review Boards, 1986-2004: [See PDF for image] Note: Percentages do not add up to 100 due to rounding. [End of figure] Several of these ARBs recommended that State provide better training, indicating that security briefings were not sufficient to identify preoperational surveillance by terrorists, or to escape the attack once under way. In addition, several ARBs found that State lacked monitoring or accountability mechanisms to ensure that U.S. officials complied with personal security measures. For example, a recent ARB recommended that supervisors at all levels monitor their subordinates' implementation of these countermeasures. State Agreed to Implement ARB Recommendations in Reports to Congress, but Implementation Is Incomplete: Although State agreed with the ARB's recommendations and reported to Congress that it planned to implement them, many have yet to be fully implemented.[Footnote 18] For example, State's hands-on training course, which teaches surveillance detection and counterterrorism driving skills, is still not required and has been taken by relatively few State Department officials and their families. State provided posts with some additional guidance to improve accountability, such as making personal security mandatory and holding managers responsible for the "reasonable" oversight of their staff's personal security practices, but we found implementation in the field to be incomplete. Furthermore, there are no monitoring mechanisms to determine if post officials are following the new security procedures. Despite State Agreement that Counterterrorism Training Is Needed, It Is Still Not Required: State reported to Congress that it agreed with the ARB recommendations to provide counterterrorism training. Specifically, in 1988, it reported that it "agreed with the general thrust of the recommendations" to provide hands-on training and refresher courses. In 1995, State reported that it "re-established the Diplomatic Security Antiterrorism Course (DSAC) for those going to critical-threat posts to teach surveillance detection and avoidance, and defensive and evasive driving techniques." In 2003, State reported it agreed with the recommendations that employees from all agencies should receive security briefings and indicated that it would use the OSPB to review the adequacy of its training and other personal security measures.[Footnote 19] State implemented the board's recommendation to require security briefings for all staff. In December 2003, the OSPB members agreed that predeparture security briefings should be mandatory for all officials planning to work at posts abroad. On March 23, 2004, State notified posts worldwide that, starting June 1, 2004, personal security briefings would be required for all U.S. personnel working at posts. State has required that its officials attend predeparture security briefings, such as Serving Abroad for Families and Employees, since 1987.[Footnote 20] The briefing covers a variety of post-related issues, including alcoholism, fires, crime, sexual assaults, and terrorist surveillance. Once officials arrive at their posts, they receive country-specific security briefings by the RSO. In addition, RSOs can provide threat-specific security briefings on a case-by-case basis. Family members are strongly encouraged to attend both predeparture and post security briefings. Figure 4 provides additional information on security briefing and training available to U.S. officials and their families. Figure 4: Security Courses Available to U.S. Officials and Family Members: [See PDF for image] [End of figure] However, few officials or family members working at embassies have taken DSAC. State offers DSAC as an elective to post officials and spouses going to high-and critical-threat posts. State does not track the number of officials who have taken DSAC; thus it is not clear how many officials have received this training. State officials estimate that 10 percent to 15 percent of department officials have taken the course, and this appears consistent with our findings at the five posts we visited. DSAC consists of 2 days of surveillance detection training, 2 days of counterterrorism driving, and 1 day of emergency medical training. During our visits to five posts, we found significant disparities in the levels of security briefings and training of post personnel. We held a variety of round-table discussions at each of the five posts we visited, including with senior and junior State Department officials, non-State officials, and officials from the law enforcement, intelligence, and defense communities. We found that post officials from law enforcement, intelligence, and defense communities had generally received rigorous hands-on training in areas such as surveillance detection, counterterrorism driving, emergency medical procedures, and weapons handling. Officials who had completed DSAC-type training agreed that hands-on training was needed to give people the skills and confidence to identify and respond to terrorist threats. In contrast, relatively few other officials, including those from State, had received DSAC-type counterterrorism training. For example, we found that roughly 10 percent of State Department officials indicated they had taken hands-on training; the figure was even smaller for other employees. Officials gave several reasons for not attending DSAC: they were not aware the course was offered, did not believe they were eligible, or were under pressure to quickly transfer to their new posts. They also told us that the course often conflicted with other training offered by State. Senior DS officials said they recognize that security briefings, like Serving Abroad for Families and Employees, are no longer adequate to protect against current terrorist threats. In response, DS developed a proposal in June 2004 to make DSAC training mandatory. The proposal would provide training, at an estimated cost of about $3.6 million, to about 775 officials, including 95 eligible family members, from all agencies working at critical-threat posts. DS officials said that DSAC training should also be required for all officials, but that issues related to costs, adequacy of training facilities, and the ability to obtain Overseas Security Policy Board agreement were constraining factors. As of April 18, 2005, the proposal had not been approved. Accountability Mechanism Still Not in Place to Promote Compliance with Personal Security Guidelines: Although State has agreed on the need to implement an accountability system to promote compliance with personal security procedures since 1988, there is still no system in place to ensure that post-related personnel are following personal security practices. Despite ARB recommendations to implement accountability mechanisms for personal security, it remains State's position that security outside the post is primarily a personal responsibility. As a result, there is no way to determine if post officials are following prescribed security guidelines. Beginning in 2003, State has tried to incorporate some limited accountability to promote compliance. However, based on our work at five posts, we found that post officials are not following many of these new procedures. In response to the 2003 ARB, State took a number of steps to improve compliance with State's personal security procedures for officials outside the embassy, including the following: * In June 2003, State revised its annual assessment criteria, known as the core precepts, so that rating and reviewing officials could take personal security into account when preparing performance appraisals. Posts were notified of this new requirement on July 30, 2003. * On December 23, 2003, State made a number of revisions to its Foreign Affairs Manual (FAM), such as stating that employees should implement personal security practices. * On May 28, 2004, State notified posts worldwide on use of a Personal Security Self-Assessment Checklist. However, none of the posts we visited were even aware of these key policy changes. For example, none of the officials we met with, including ambassadors, DCMs, RSOs, or staff, were aware that the annual ratings process now includes an assessment of whether staff are following the personal security measures or that managers are now responsible for the reasonable oversight of subordinates' personal security activities. Furthermore, none of the supervisors were aware of the checklist, and we found no one was using the checklists to improve their personal security practices. Furthermore, State's original plan, to use the checklist as an accountability mechanism, was dropped before it was implemented. In its June 2003 report to Congress on implementation of the 2003 ARB recommendations, State stipulated that staff would be required to use the checklist periodically and that managers would review the checklists to ensure compliance. However, State never implemented this accountability mechanism. According to State officials, they dropped the accountability features out of concern that the review would be too time consuming. We found that State had not issued any guidance on how these new policies and practices should be implemented or monitored. For example, the Foreign Affairs Manual does not specify how managers are to provide for the "reasonable" oversight of their staff's personal security practices or how to provide for compliance and oversight. As a result, post staff were not sure how these new policies should be implemented. In addition, RSOs lacked guidance on how to promote these new policies. RSOs and supervisors stated that they have no responsibility or authority to monitor post employees for compliance with the new security policies, and the officials we spoke with at five posts said they did not have, and did not want, this responsibility. In discussing our preliminary findings with DS officials, they noted a range of challenges associated with improving security for officials outside the post. State's primary focus has been, and will continue to be, protecting U.S. officials inside the post since posts are considered higher value targets symbolically and because of the potential for mass casualties. In explaining why posts were not aware of the new personal security regulations, DS officials noted that posts were often overwhelmed by work and may have simply missed the cables and changes in the Foreign Affairs Manual. They also noted that changes like this take time to be implemented globally. Nonetheless, improving security outside the embassy is critical and, according to a number of State officials, improvements in this area must start with the ambassador and the deputy chief of mission. Yet we noted that they, along with the RSOs, were not trained in how best to provide such security before going to post. For example, based on our observations at the training courses and a review of the course material, the ambassador, deputy chief of mission, and RSO training courses did not address how State's personal security guidelines can be best promoted. The instructors and DS officials agreed that this critical component should be added to their training curriculum. State Develops Soft Targets Program for Schools but Scope Is Not Yet Fully Defined: In response to congressional direction and funding, State, in 2003, began developing a multiphase Soft Targets program that provides basic security hardware to protect U.S. officials and their families at schools and some off-compound employee association facilities.[Footnote 21] However, we found that the scope of the program is not yet fully defined, including the criteria for school selection. State Initiates Multiphase Program to Primarily Protect Schools: In response to direction in both the House Conference report and Senate Appropriations Subcommittee report, State addressed the issue of providing security enhancements to overseas schools attended by dependents of U.S. officials and American citizens. In 2003, State began developing a plan, known as the Soft Targets program, to expand security for overseas schools to protect against terrorism. Specifically, State's Office of Overseas Schools, Overseas Buildings Operations, and DS have been working together on the program. The program has four proposed phases. The first two phases focused on department-sponsored schools that have previously received grant funding from the State Department.[Footnote 22] In phase one of the program, department-sponsored schools were offered funding for basic security hardware such as shatter-resistant window film, two-way radios for communication between the school and the embassy or consulate, and public address systems (see fig. 7). As of November 19, 2004, 189 department-sponsored schools had received $10.5 million in funding for security equipment in phase one of the program. Figure 5: New Public Address System Funded by the Soft Targets Program: [See PDF for image] [End of figure] The second phase of the program addresses any additional security enhancements that department-sponsored schools could benefit from and takes into consideration the local threat level, the nature of the vulnerability and measures required to correct the deficiency, and the percentage of U.S. government dependent students in the school. Schools have requested funding for security enhancements such as perimeter fencing, walls, lighting, gates, and guard booths (see fig. 8). As of November, 2004, State has obligated over $15 million in funding for department-sponsored schools for phase two security upgrades. Figure 6: School Fence to Be Replaced under the Soft Targets Program: [See PDF for image] [End of figure] Phase three of the program plans to address security enhancement needs of nondepartment-sponsored schools overseas attended by dependents of U.S. government officials or U.S. citizens. This phase provides funding for phase one enhancements such as the shatter-resistant window film, radios, and public address systems. State plans to implement the fourth phase of the Soft Targets program to include phase two enhancements for nondepartment-sponsored schools overseas that qualify. Within the Soft Targets program, State also has focused on enhancing the security for embassy and consulate employee associations that have facilities off-compound, such as recreation centers. The Bureau of Overseas Buildings Operations has been collecting data on the security needs of these facilities to determine the type of security equipment or upgrades that would be most beneficial. The facilities, working with the RSO at post, have been asked to identify physical security vulnerabilities that could be exploited by terrorists. As of September 2004, 24 of the 34 posts with off-compound employee association facilities had requested a total of $1.3 million in security upgrades, which includes funding for perimeter walls and shatter-resistant window film. In fiscal year 2004, almost $1 million was obligated by State for security enhancements at off-compound employee association facilities. Full Scope of School Program Not Yet Determined: RSOs said that identifying and providing funding for security enhancements at department-sponsored schools for phase one and phase two security enhancements were straightforward because of the pre- existing relationship with these schools. However, they said it has been difficult to identify nondepartment-sponsored schools for phase three of the program. Some RSOs told us they were not sure about the criteria for approaching nondepartment-sponsored schools in phase three and were seeking guidance from headquarters on this issue. For example, some RSOs were not sure what the minimum number of American students attending a school needed to be for the school to be eligible to receive grant money for security upgrades. Some RSOs at the posts we visited were considering offering funding to schools with as few as one to five American students. Moreover, one RSO was seeking guidance on what constitutes a school and questioned whether informal facilities attended by children of U.S. missionaries could qualify for the program. State officials told us they sent cables to posts in the summer of 2004 with more detailed information on school selection. They explained that they have asked RSOs to gather data on nondepartment-sponsored schools attended by American students, particularly U.S. government dependents. State officials from DS and the Bureau of Overseas Buildings Operations (OBO) acknowledged that the process of gathering data has been difficult since there are hundreds of such schools worldwide. According to an OBO official, as of December 2004, only about 81 out of the more than 250 posts have provided responses regarding such schools. OBO officials stated they will use the data to develop criteria for which schools might be eligible for funding under phase three and, eventually, phase four of the program. In anticipation of any future phases of the Soft Targets program, OBO officials further explained they have also asked RSOs to identify other facilities and areas that Americans frequent, beyond schools and off-compound employee association facilities, that may be vulnerable against a terrorist attack. Issues Related to the Protection of U.S. Officials and Their Families at Residences against Terrorist Threats: State's primary program in place to protect U.S. officials and their families at their residences, the Residential Security program, is principally designed to deter crime, not terrorism. The program includes basic security hardware and guard service; as the threat increases, the hardware and guard services can be correspondingly increased at the residences. State officials said that while the Residential Security program, augmented by the local guard program, provides effective deterrence against crime, it could provide limited or no deterrence against a terrorist attack. To provide greater protection against terrorist attacks, some posts we visited used surveillance detection teams in residential areas, despite guidance that limits their use primarily to the embassy. Residential Security and Local Guard Programs Tied to Crime Levels: State has a responsibility for providing a secure housing environment for U.S. officials and their families overseas. Housing options could include single-family dwellings, apartments, and compound and clustered housing.[Footnote 23] Each post is responsible for designing and implementing its Residential Security program based on factors that include host country law enforcement capabilities, the post-specific threat environment, and available funding. The Residential Security program includes basic security hardware, such as alarms, shatter- resistant window film, access control measures, and local guards. As the threat increases, hardware and guard services can be correspondingly increased at the residences. The standards used to determine the minimum acceptable level of residential security protection are guided by threat ratings established in the Security Environment Threat List. For the Residential Security program, DS uses the standards for the threat rating categories of political violence and crime, though not for terrorism. Standards for residential security also differ depending on the types of residences. Security at the residences can be augmented by the use of local guards. Local guard functions vary by threat ratings for crime and political violence and by the type of residence protected. The local guard program for residential security may include mobile patrols, quick reaction forces, and stationary guards. Figure 9 provides an illustration of a stationary guard at a residence. The mobile patrols are assigned responsibility for visiting residences periodically, and respond to alarms at residences or when emergencies arise. All posts we visited utilized local guards for some aspect of residential security; some posts, due to the higher threat levels, had more comprehensive local guard coverage than others. For example, all posts we visited had mobile patrols for residential neighborhoods, while only two posts had stationary guards at residential housing. Moreover, some posts with mostly apartment housing had a guard or doorman stationed at the entrance of the building to provide a first line of security, primarily against crime. Figure 7: Local Guard at Embassy Housing: [See PDF for image] [End of figure] Post officials, including RSOs, told us that the Residential Security program provides effective deterrence against crime and could provide some deterrence against a terrorist attack, though State officials felt it could provide little or no deterrence against a terrorist attack. State and post officials indicated that the biggest concern at residences, when considering the type of security to implement, has been the threat from crime. However, as the threat environment has changed and terrorists have changed tactics from kidnapping to detonating car bombs outside of residences, some posts have changed their housing profile. Some posts we visited limited the number of U.S. officials living in specific apartments or neighborhoods to minimize the risk and consequences of a residential terrorist attack. For example, post management at two of the posts we visited have decided to limit the number of Americans in apartment housing to 25 percent of the entire building population to minimize the impact of a car bomb detonated outside residential housing. Some senior DS officials told us that the best residential scenario for posts is to have a variety of housing options, including apartments and single-family homes. By having a mix of housing options, post officials are dispersed, reducing the number of potential targets. Use of Surveillance Detection Program at Residences: To provide greater protection against terrorist attacks, most posts we visited used surveillance detection teams in the residential areas. The Surveillance Detection program was implemented in response to the U.S. Embassy bombings in Nairobi, Kenya, and Dar es Salaam, Tanzania. The mission of the program is to enhance the ability of all posts to detect preoperational terrorist surveillance directed against primary diplomatic facilities, such as the embassy. According to State's Surveillance Detection Operations Field Guide and the Foreign Affairs Handbook, surveillance detection units can be used to cover other facilities, such as off-compound employee association facilities and residences, only if there is a specific threat directed against such areas.[Footnote 24] In addition, surveillance detection can be used to cover large official functions. At many of the posts we visited, the RSOs were routinely utilizing surveillance detection units to cover areas outside key embassy facilities, such as residences, school bus stops and routes, and schools where U.S. embassy dependents attend. RSOs told us that the Surveillance Detection program is instrumental in providing deterrence against potential terrorist attacks. Furthermore, some RSOs told us that the use of surveillance detection at school bus stops and outside schools provides a sense of comfort for post officials and their spouses who have dependents in international or American schools. During our post visits, some RSOs argued that the current program guidelines are too restrictive and that State should allow flexibility in using surveillance detection for areas outside the embassy deemed appropriate by the RSO.[Footnote 25] Senior State officials told us, while the use of the surveillance detection in soft target areas could be beneficial, the program is labor intensive and expensive and any expansion of the program could require significant funding. Conclusion: The State Department is responsible for protecting more then 60,000 employees and their families who work overseas. Recent terrorist attacks and threats have heightened demands that State provide adequate safety and security outside embassy compounds. We found that State has not yet developed a strategy addressing the appropriate level of protection needed for schools, places of worship, and private sector recreation facilities where employees and families tend to congregate. State officials are concerned about the feasibility and costs associated with providing protection for these "soft targets." Prior investigations into attacks against U.S. officials have resulted in recommendations that State implement improvements to protect U.S. officials against terrorist attacks. However, our analysis indicated that State has not fully implemented several of these recommendations related to training and accountability mechanisms designed to improve personal safety. Overall, we believe State should develop a strategy to protect U.S. officials and their families, and as part of this effort, undertake an assessment of the level of protection to be afforded to officials and their families while commuting, and at residences, schools, and other community-based facilities. We also believe that State should provide adequate counterterrorism training and fully implement its accountability mechanisms to afford greater awareness and implementation of security safeguards for U.S. officials and their family members while outside the embassy compounds. Recommendations for Executive Action: We recommend that the Secretary of State, working with the Overseas Security Policy Board, take the following 11 actions: * Include in the current development of a comprehensive soft target strategy information that (1) determines the extent of State's responsibilities for providing security to U.S. officials and their families outside the embassy; (2) addresses the legal and financial ramifications of funding security improvements to schools, places of worship, and the private sector; (3) develops programs and activities with FAM standards and guidelines to provide protection for those areas for which State is deemed responsible for; and (4) integrates into the embassy emergency action plan elements of the soft targets program. * Mandate counterterrorism training and prioritize which posts, officials, and family members should receive counterterrorism training first; track attendance to determine compliance with this new training requirement; and add a "soft target protection" training module to the ambassadorial, deputy chief of mission, and RSO training to promote the security of U.S. officials and their families outside the embassy. * Fully implement the personal security accountability system that State agreed to implement in response to the 2003 ARB for all embassy officials, and develop related accountability standards for the Foreign Affairs Manual that can be used to monitor compliance. Agency Comments and Our Evaluation: The Department of State provided written comments on a draft of this report (see app. II). State generally agreed with most of our report recommendations and said it would examine the others. Specifically, State agreed to incorporate a soft target training module into RSO training, and stated that the department would ensure that similar training be developed and added to the ambassadorial and deputy chief of mission training to promote the security of U.S. officials and their families outside the embassy. The department also agreed to track attendance with the counterterrorism training course if it becomes a requirement, and noted that, as of March 2005, all diplomatic security courses are now tracked for enrollment and attendance. With regard to the recommendation to fully implement the personal security accountability system, State agreed to reiterate, through additional notifications and guidance, the accountability requirements and other tools available to improve personal security. Regarding our recommendation that State develop a comprehensive strategy, State indicated that it was prepared to examine, in conjunction with the OSBP, the contents and recommendations of the report as they relate to their security programs, but did not indicate whether they would incorporate any of the specific elements of the recommendations into its new soft targets security strategy. State expressed concern that our draft report mischaracterized the department's responsibility to protect Americans living abroad, and implied that State was responsible for providing these Americans a similar level of protection provided to diplomats and their families. We have clarified the scope and methodology and text of the report to focus on State's roles and responsibilities to protect U.S. diplomats and their families, and have deleted references to how State provides safety and security support to U.S. citizens abroad. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 1 day from the report date. At that time, we will send copies of this report to interested congressional committees and to the Secretary of State. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at [Hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512-4268 or at [Hyperlink, fordj@gao.gov]. Another contact and staff acknowledgments are listed in appendix III. Sincerely yours, Signed by: Jess T. Ford: Director, International Affairs and Trade: [End of section] Appendixes: Appendix I: Scope and Methodology: To determine how the State Department protects U.S. officials and their families while outside the embassy, we reviewed State documents and conducted interviews with State officials in Washington, D.C. In addition, we reviewed documents, conducted interviews, and held roundtable discussions with State and other agency officials at four U.S. embassies and one consulate overseas. In Washington, D.C., we reviewed the Diplomatic Security sections of State's Foreign Affairs Manual and Foreign Affairs Handbook and read numerous State cables pertaining to personal security and other security practices. In addition, we reviewed eight Accountability Review Board (ARB) reports and State's responses to Congress based on these ARBs, and met with the Chairman of the Amman, Jordan ARB. We interviewed officials from a number of State bureaus and offices. We met with officials from State's Bureau of Diplomatic Security (DS), including officials from the Office of International Programs, Office of Facility Protection Operations, Office of Physical Security Programs, Office of Intelligence and Threat Analysis, Office of Regional Directors, Office of Countermeasures, and DS Training. We also met with officials from State's Bureau of Overseas Buildings Operations, Office of Management Policy, Office of Overseas Schools, Office of Commissary and Recreation Affairs, Foreign Service Institute, and Office of the Inspector General. Moreover, we met with representatives of the Overseas Security Policy Board. To better understand the support for the Soft Targets program, we met with executive members of the American Foreign Service Association and also reviewed a number of congressional reports that mention the protection of soft targets. To obtain firsthand experience of security and antiterrorism training available to State and non-State personnel, we attended a number of training courses and briefings. We attended the 2-day Security Overseas Seminar, the 5-day Diplomatic Security Antiterrorism Course, and Regional Security Officer security in-briefings at posts we visited. We also attended sections of the Ambassadorial Seminar and the Regional Security Officer Training to better understand how the issue of protecting U.S. officials and their families outside the embassy was addressed. We conducted fieldwork at five posts--four embassies and one consulate- -in four countries.[Footnote 26] We chose the posts based on a number of factors, including variety in post size and post terrorism threat levels. At each of the posts, we generally met with the Ambassador, the Deputy Chief of Mission, DS and other State officials, and post officials representing other U.S. government agencies, including personnel from the law enforcement, intelligence, and defense communities. We also held roundtables, at all posts, with State and non- State officials as well as spouses of post officials, to obtain information on their security awareness and training. At most of the posts we visited, we met with representatives of the post's Emergency Action Committee and the host nation police. In addition, we met with representatives of the Overseas Security Advisory Council at some posts. To better understand the Soft Targets program, we met with school officials at American or international schools in each country. Finally, we observed residential security measures at post housing at each post we visited. To assess the reliability of the funding data for the Soft Targets Program, we asked State officials to respond to a standard set of data reliability questions. Based on their responses and follow up discussions, we determined that the data used in the report for Soft Targets funding is sufficiently reliable for the purposes of this report. Our focus on soft target protection pertains primarily to U.S. government officials and their families and other post personnel who fall under chief of mission authority and not to the entire American community abroad. To limit the scope of our review, we did not assess the security advice or assistance provided through the Overseas Security Advisory Council, the Antiterrorism Assistance Program, the consular warden system, or evacuations. We also did not undertake a comprehensive review of residential housing to determine which residential option provides the most effective deterrent against terrorist attacks. We conducted our work from March 2004 through February 2005 in accordance with generally accepted government auditing standards. [End of section] Appendix II: Comments from the Department of State: United States Department of State: Assistant Secretary and Chief Financial Officer: Washington, D.C. 20520: Ms. Jacquelyn Williams-Bridgers: Managing Director: International Affairs and Trade: Government Accountability Office: 441 G Street, N.W. Washington, D.C. 20548-0001: Dear Ms. Williams-Bridgers: We appreciate the opportunity to review your draft report, "OVERSEAS SECURITY: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies," GAO Job Code 320214. The enclosed Department of State comments are provided for incorporation with this letter as an appendix to the final report. If you have any questions concerning this response, please contact Lisa Goodale, Program Analyst, Bureau of Diplomatic Security, at (571) 345- 2742. Sincerely, Signed by: Eric Hembree (Acting): cc: GAO-Diana Glod; DS-Greg Starr; State/OIG-Mark Duda: Department of State Comments on the Government Accountability Office Draft Report OVERSEAS SECURITY: State Department Has Not Fully Implemented Key Measures to Protect U.S. Officials from Terrorist Attacks Outside of Embassies (GAO-05-386, GAO Code 320214): The Department of State (DOS) thanks the Government Accountability Office (GAO) for the opportunity to respond to their draft report, resulting from the January 23, 2004 notification to review our programs to protect U.S. officials outside embassy compounds. We are concerned that the report rests on fundamental misconceptions about the Department's authorities and responsibilities insofar as it defines "soft targets", and refers to protection of "other Americans". The inclusion of "other Americans" in the report language is not within the stated scope of GAO's review, nor is the problem of safety of U.S. citizens abroad in any way a similar problem. By law, DOS is responsible for the protection of all United States Government personnel on official duty abroad (other than Voice of America Correspondents on official assignment and those personnel under the command of the United States area military commander) and their accompanying dependents. The report fails to recognize that the Department has no authority or capacity similarly to protect private U.S. citizens traveling or residing in foreign sovereign countries. Such a mandate, moreover, would neither be feasible nor appropriate. The protection of U.S. officials in dangerous environments relies fundamentally on restriction of such personnel-specifying where they live, where they work, how and where they travel, and ultimately whether they remain in country at all. It would be wholly inappropriate to impose similar restrictions on U.S. citizens abroad. Protection of facilities, moreover, similarly involves not only considerable expense but also significant restrictions on the location and construction of such facilities, as well as detailed technical specifications, which could not be similarly imposed on private facilities, even if the USG were able. to fund the massive expense involved. This is not to say that the Department of State is not concerned with the safety and well- being of U.S. citizens abroad-to the contrary, this is a major focus of attention. However, it is simply not possible to analogize the two situations in approaching the problem of "soft targets". An assessment of "soft targets" strategy and approach cannot use the Department's programs for U.S. facilities and personnel security as a model or point of departure. The report says the "State Department defines soft targets to include places where Americans and other Westerners live, congregate, shop or visit, including hotels, clubs, restaurants, shopping centers, identifiable Western businesses, housing compounds, transportation systems, places of worship, schools, or public recreation events." The Department has not established a definition for soft targets at this time. The report's scope is built around this presumed definition and it is on this basis that conclusions are made that the Department has no comprehensive strategy. A narrower definition of soft targets currently being addressed by the Department could dramatically change that conclusion. If the report is relying on. the Appropriations Subcommittee's direction on soft. targets, it should be made clear. The Department is mindful of Congressional views on soft targets, and will take these into consideration during continued development of a comprehensive strategy for addressing the problem of soft targets, due to the Senate Appropriations Committee in June. The Department has, and long had, a security strategy for the protection of U.S. Officials under the authority of the Chief of Mission and their families outside embassy compounds. This includes a number of robust and layered counterterrorism and physical and technical security programs to address the threat of terrorist attacks. The term "soft target" itself may be new to the lexicon of the Department, but the meaning and programs designed to deter this threat is not. We have long recognized that the threat of terrorist attacks is much broader than the targeting of our embassies and consulates. A soft target policy, however, must be flexible and evolving to meet the unpredictability of global threats. The vast majority of the Department's global security mission originated from the Omnibus Diplomatic Security and Antiterrorism Act of 1986, as amended following the East Africa bombing in 1998. Numerous Department programs for security upgrades to our diplomatic facilities worldwide were established and funded, in large part due to this legislation. Historically, most actual attacks and threats trend significantly toward our official facilities. A 1 Queda and its associated splinter groups have favored soft targets when other hardened assets have proven to be unattainable. Well before this terrorist threat, we designed programs overseas to protect, inform, and educate U.S. officials, their family members, and private American citizens. These programs cut across many Department elements and continue to be refined to address today's global threat against U.S. interests. They are inclusive of all foreign affairs agencies under the authority of the Chief of Mission and include our threat information sharing partnership with the intelligence community. The terror threat against our people and facilities remains high. Our Government has rolled out a robust strategy to root out terror and the sources of terror wherever it has taken hold. Our diplomats are in the front lines of this fight, and the Department, our overseas missions and the intelligence community continuously evaluate threat information --to include threats against soft targets. In our report to the Senate Appropriations Committee, we will outline the Department's ongoing strategy for protecting U.S. officials and their families against soft targets, as well as our broader efforts with respect to American citizens abroad. * Comments by Page number: Page 1, paragraph 1: "State has a number of programs and activities designed to protect U.S. officials and their families outside of the embassy, including security briefings, protection at schools and residences, and surveillance detection. However, State has not developed a comprehensive strategy that clearly identifies safety, and security requirements and resources needed to protect U.S. official, their families, or other Americans abroad from terrorist threats outside the embassy." * As written, this paragraph is incorrect. The exclusion of "under the authority of the Chief of Mission" and inclusion of "other Americans" here and throughout the draft report (pages 4, 10, 11, 31 and 32) is inconsistent with Appendix 1: Scope and Methodology which states: "Our focus on soft target protection pertains only to U.S. government officials and their families and other post personnel who fall under Chief of Mission authority and not to the entire American community abroad. To limit the scope of our review, we did not look at security advice or assistance provided through the Overseas Security Advisory Council, the Antiterrorism Assistance Program, the consular warden system, or evacuations. We also did not undertake a comprehensive review of residential housing to determine which residential option provides the most effective deterrent against terrorist attacks." The GAO review expressly does not include Department programs such as the Overseas Security Advisory Council which advises the American' private sector on security issues abroad; the Antiterrorism Assistance Program which provides training and equipment to foreign law enforcement and civilian security organizations to enhance antiterrorism skills and abilities; consular efforts such as warnings and advisories and the consular warden system which assists U.S. citizens residing or traveling overseas; or evacuations. Page 1, paragraph 3: "However, during our visits to posts, regional security officers were unclear about which schools could qualify for security assistance." * This sentence incorrect as written. Phases I and II of the overseas schools program offered grants for security enhancements to the 189 schools that had a pre-existing grant relationship with the Department. Phase III is for schools enrolling U.S. citizens but which do not have a pre-existing grant relationship with the Department. Participation by grant and non-grant schools is voluntary. The Department's Soft Targets Working Group (STWG) has not yet drawn precise lines for which schools qualify under Phase III. The STWG asked posts for information about non-grant schools to understand the universe of potential recipients and determine priorities on the basis of good data, not intuition. Without data, the STWG cannot thoughtfully answer the question of who should receive funding. Regional Security Officers (RSO) were asked to provide comprehensive security vulnerability data for off-compound facilities, not just data on schools they think should be eligible. Page 2, Letter to Chairman Shays: This paragraph does not clearly state the findings of the Inman Report and the 1999 Overseas Presence Advisory Panel (OPAP) Report. With regard to overseas security, these reports focused on the security of overseas personnel (one of the primary target areas of the GAO study), and the need for enhanced physical security at U.S. embassy and consulate facilities. The reports also discussed residential security for USG employees, and the human report briefly discussed security of U.S. citizens abroad, making no recommendations. Because schools and places of worship are mentioned in this paragraph as soft targets, a reader might think that the Inman and OPAP Reports discussed security at schools and churches, which they did not. This issue ties into the definition of soft targets that has been provided in Appropriations Subcommittee report language, and not by the Department. Page 2, Footnote 1: "State Department defines soft targets to include places where Americans and other Westerners live, congregate, shop or visit, including hotels, clubs, restaurants, shopping centers, identifiable Western businesses, housing compounds, transportation systems, places of worship, schools, or public recreation events." * The Department has not established a definition for soft targets at this time. Page 3: "You specifically asked us to determine whether State has a strategy for soft target protection; assess State's efforts to protect U.S. officials and their families against terrorist attacks while traveling to and from work; assess State's efforts overseas to improve security at schools attended by Americans; and describe issues related to protection at their residences." * We believe this sentence misstates the request from the Honorable Christopher Shays, Chairman, Subcommittee on National Security, Emerging Threats, and International Relations in his December 12, 2003 letter to the Honorable David M. Walker, Comptroller General which stated, "Specifically, we ask that you address the following questions: 1. What are the Department of States' responsibilities and plans for protecting U.S. officials living and traveling abroad? 2. How is State meeting these security requirements? 3. What improvements, if any, are needed to enhance the security of U.S. officials living and traveling abroad?" Page 4: "However, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials, and their families, or other Americans abroad from terrorist threats outside the embassy." * The inclusion of other Americans is not within the stated scope of GAO's review. Page 7: "State has defined soft targets as places, including but not limited to, where Americans and other Westerners live, congregate, shop, or visit. This can include hotels, clubs, restaurants, shopping centers, housing compounds, places of worship, schools, or public recreation events." * The Department has not established a definition for soft targets at this time. Page 10: "Despite these efforts, State has not developed a comprehensive strategy that clearly identifies safety and security requirements and resources needed to protect U.S. officials, and their families, or other Americans abroad from terrorist threats outside the embassy." * The inclusion of other Americans is not within the stated scope of GAO's review. Page 11: "Specifically, the report language specifies that a strategy should be submitted to the Committee no later than June 1, 2005." * The entire discussion, pages 10-12, of the Senate Appropriations Subcommittee report language (S. Rpt. No. 108-344) and protection of non-official Americans abroad is not the subject of this GAO review. Moreover, this report language is misleading insofar as it suggests that the Department of State has either the mandate or even the authority to engage in the wide-ranging functions that seem to be implied. The language was not included in the Conference Report's Joint Explanatory Statement and therefore cannot be said to represent the views of the Congress. In general, it is inappropriate for the GAO to judge the Department's performance against nonbinding report language from a single subcommittee of Congress in the manner reflected in this discussion, particularly when such assessment is outside the scope of the review at hand. While the request for a strategy was not incorporated into the Conference Report (H. Rpt. No. 108-792), the Department plans to produce a strategy by the date specified. "State has not developed a comprehensive soft target strategy to protect U.S. officials, and their families, or other Americans abroad from terrorist threats outside the embassy, as directed by a number of appropriations committee reports." * The inclusion of other Americans is not within the stated scope of GAO's review. Page 13: "Five of the 11 ARB investigations have focused on attacks of U.S. officials on their way to work (see fig. 3). These have been the (1) June 1988 assassination of a post official in Greece, (2) April 1989 assassination of a post official in the Philippines, (3) March 1995 assassination of two post officials in Pakistan, (4) October 2002 assassination of a post official in Jordan, and (5) October 2003 assassination in Gaza of three post contractors from Israel." * In example (5) GAO states that the Gaza motorcade was attacked on their way to work. The occupants of the motorcade were traveling into Gaza from Tel Aviv during the workday to conduct interviews of Fulbright scholar candidates, so although not in a "hardened facility" it is inaccurate to say they were on their way to work. Page 31: "Overall, we believe State should develop a strategy to protect U.S. officials, their families, and other Americans abroad, and as part of this effort, undertake an assessment of the level of protection to be afforded to officials and their families while commuting, at residences, schools, and other community-based facilities, and to assess the level of protection State should provide other Americans living abroad." * The inclusion of other Americans is not within the stated scope of GAO's review. Page 32, Recommendations: "1) Include in the current development of a comprehensive soft target strategy information that (1) determines the extent of State's responsibilities for providing security to U.S. officials, their families, and other Americans outside the embassy; (2) addresses the legal and financial ramifications of funding security improvements to schools, places of worship, and the private sector; (3) develops programs and activities with FAM standards and guidelines to provide protection for those areas State is deemed responsible for; and (4) integrates elements of the soft targets program into the embassy emergency action plan." * The Department will examine the contents and recommendations of the report as they relate to our layered security strategy of awareness, training, information sharing, and physical and technical programs. "2) Mandate counterterrorism training and prioritize which posts, officials, and family members should receive counter-terrorism training first; track attendance to determine compliance with this new training requirement; and add a "soft target protection" training module to the Ambassadorial, Deputy Chief of Mission, and RSO training to promote the security of U.S. officials and their families outside the embassy." * Any decision to mandate counterterrorism training, such as the DS Antiterrorism Course (DSAC), will require considerable funding and the recruitment, hiring and training of additional instructor/support staff. DSAC is heavily dependent upon the use of private training facilities that are already severely limited in their availability and training capacity. The Foreign Service Institute (FSI), the Department's primary training provider, and the Bureau of Diplomatic Security (DS) are prepared to work with the Overseas Security Policy Board (OSPB) in reviewing the Department's existing personal security training and the requirements for mandatory hands-on counterterrorism training for State and other agency personnel and their dependents assigned overseas under Chief of Mission authority. A "soft target protection" module has been incorporated into DS' RSO training and the Department will ensure that similar training developed and added to FSI's Ambassadorial and Deputy Chief of Mission training to promote the security of U.S. officials and their families outside the embassy. With regard to "track attendance to determine compliance with this new training requirement [on counter-terrorism training]", enrollment and attendance in all mandatory FSI training is tracked by the Department's Student Training Management System (STMS). The Diplomatic Security Training Center (DSTC) started to use the STMS to record training effective March 2005. "3) Fully implement the personal security accountability system that State agreed to implement in response to the 2003 ARB for all embassy officials, and develop related accountability standards for the Foreign Affairs Manual that can be used to monitor compliance." * The Department will reiterate, via Department Notice and ALDAC, all personal security tools available that have originated from the past two ARBs. The Office of Management Policy (M/P) will take the lead in drafting such an ALDAC and Notice reminding U.S. officials of their personal responsibility for their security and the security of their family members. M/P will clear the material throughout the Department and include references to the Foreign Affairs Manual; prior ALDACs issued that instructs post management, RSO's, and others at post where to find security tools (to include DSWeb) to better improve personal security; vary routes and times to and from work and, remind them of the changes to the promotion precepts which were negotiated with American Foreign Service Association. The following are GAO's comments on State's letter dated April 18, 2005. GAO Comments: 1. We agree that State does not have an official definition of soft targets and modified the text, where appropriate, to make this clear. Given this absence, we relied upon a State Department travel warning that included the specific language used in the draft report. 2. State indicated that, had we used a narrower definition of soft targets, it could have dramatically changed the conclusions of our work. We disagree. Our report focuses on State Department efforts to protect U.S. officials and their families from terrorist threats, at their homes, recreation centers, schools, commuting, and living outside the embassy compounds. 3. Although State, in its comments, indicated that it has long had a "security strategy" to protect U.S. officials and their families outside the embassy, it was never able to produce such a document. In addition, while State has a number of programs and activities designed to protect U.S. officials and their families at soft target areas, senior DS officials agreed that these programs are not tied together in an overall strategy. In January 2005, State agreed that it should develop a comprehensive soft target strategy, and as part of that effort, undertake a formal evaluation of how existing programs can be more effectively integrated and whether new programs might be needed to fill any potential gaps. State said it planned to complete the strategy by June 1, 2005. 4. We have taken out reference to "other Americans" throughout the report, except in reference to the Soft Targets Program, which covers U.S. children and teachers who have no affiliation with the U.S. government. We have also modified the scope and methodology to show that our focus is "primarily" on the protection of U.S. government officials and their families. 5. We have clarified the sentence by indicating that RSOs were unclear about which schools could qualify for security assistance under phase three of the Soft Targets Program. Phase three, because it can encompass all schools in a country with one or more Americans, can potentially include vastly more schools than in phase one or two of the program. We recognize that the department's Soft Targets Working Group is currently defining parameters for which schools could qualify under phase three, in addition to identifying other vulnerable off-compound facilities. We believe that a soft target strategy could help identify which schools most urgently need security improvements. 6. We clarified the report to stipulate that these reports focused on the security of U.S. officials. 7. See GAO comment 1. We have also changed the word "defines" to "considers". 8. It is not uncommon for GAO to clarify, add specificity and thus make adjustments or changes to a requested engagement, provided that these adjustments and changes are discussed and agreed upon by the requester. We informed State of these changes. 9. See GAO comment 4. 10. See GAO comment 1. 11. See GAO comment 4. 12. The appropriations subcommittee report language is within the scope of the GAO review because it covers U.S. officials and their dependents, which is the primary focus of our review. Moreover, this language was based on testimony provided by AFSA out of concern that the department was not providing adequate security for U.S. diplomats and their families while they are outside of the embassy compound. GAO agrees that the subcommittee report language is not binding and we are not judging the department's performance against this language. However, we agree with the subcommittee, as State has, that State should develop a comprehensive soft targets strategy. 13. In our draft, we noted that the officials were attacked on their way to work, either in their driveway or as they drove to a work site. The Gaza attack occurred while the officials were on their way to the work site. 14. See GAO comment 4. We have incorporated technical comments in the report where appropriate. [End of section] Appendix III: GAO Contacts and Staff Acknowledgments: GAO Contacts: Jess T. Ford, (202) 512-4128; Diana Glod, (202) 512-8945: Staff Acknowledgments: In addition to the above named individuals, Edward George and Andrea Miller made key contributions to this report. Joe Carney, Martin De Alteriis, Etana Finkler, Ernie Jackson, Elizabeth Singer, and Michael Derr provided technical contributions. (320348): FOOTNOTES [1] State, in commenting on our draft, stated it had not defined what constituted a soft target. As a result, we used State Department language contained in travel warnings concerning potential terrorist attacks. We further confirmed this description based on similar language contained in other State documents and discussions with numerous State security experts. According to the State travel warnings, the State Department considers soft targets to include places where Americans and other westerners live, congregate, shop or visit, including hotels, clubs, restaurants, shopping centers, identifiable Western businesses, housing compounds, transportation systems, places of worship, schools, or public recreation events. [2] These reviews include (1) the 1985 Report of the Secretary of State's Advisory Panel on Overseas Security (The Inman Report); (2) Accountability Review Board reports that followed assassinations of U.S. officials in 1988, 1989, 1995, 2002, and 2003; and (3) the 1999 Report by the Overseas Presence Advisory Panel (The Crowe Commission). [3] Other places could include places of worship, restaurants, and shopping centers. [4] In instances of imminent threat, State can provide a variety of measures, including armored vehicles for commuting purposes, protective details, travel advisories for specific areas, or evacuations of family members and U.S. officials. [5] The schools include American and international schools attended by dependents of U.S. government officials and American citizens. Some schools are State Department-sponsored schools, which receive direct educational grants from State's Office of Overseas Schools. [6] AFSA is the professional representative and labor union of the 23,000 active and retired Foreign Service personnel serving in the Department of State, U.S. Agency for International Development, Foreign Commercial Service, Foreign Agriculture Service, and the International Broadcasting Bureau. AFSA first raised the issue of soft targets during its testimony before the Senate Appropriations Committee, Subcommittee on Commerce, Justice, State, and the Judiciary, in May 2002. AFSA stated that as security at posts and missions increases, terrorists could shift their strategy to include soft targets outside embassy walls. [7] Public Law 99-399, codified at 22 U.S.C. 4801 et seq. The act also establishes the security functions of the Secretary of State, as delegated to the Assistant Secretary for Diplomatic Security. [8] These include the Office of Facility Protection Operations, Office of Intelligence and Threat Analysis, Office of Physical Security Programs, and the Office of Training. [9] The chief of mission is generally the ambassador, who is also responsible for the safe and efficient evacuation of U.S. citizens when their lives are endangered. In the absence of an ambassador at post, the deputy chief of mission (DCM) assumes this responsibility. [10] Vienna Convention on Diplomatic Relations, 1961. A subsequent 1963 convention reinforces the host country protection of diplomatic officials. See Vienna Convention on Consular Relations and Optional Protocol, 1963. [11] The threat rating in each category can be designated as low, medium, high, or critical. [12] The figure is an approximation since the total number of posts open abroad fluctuates. [13] The OSPB standards for State programs appear in State's Foreign Affairs Manual (FAM) and Foreign Affairs Handbook (FAH). [14] For fiscal year 2003, Congress earmarked "up to" $15 million in the Overseas Buildings Operations appropriations to address security vulnerabilities of soft targets, particularly overseas schools. State set aside $5 million to undertake a review of the security of all overseas schools attended by children of nonmilitary U.S. government employees. Additionally, under the Emergency Wartime Supplemental Appropriations Act, 2003, $10 million in new funding was provided for soft target protection in fiscal year 2003. We discuss State's review of overseas schools protection, including funding allocation, in a later section of this report. [15] The final amount was $14.8 million after a rescission. [16] S. Rpt. No. 108-344, 108TH Cong., 2ND Sess. 154 (2004); H. Rpt. No. 108-792, 108TH Cong., 2ND Sess. 828 (2004). [17] The remaining six ARBs include the April 1988 attack on U.S. facilities in Honduras, the 1990 attack on a U.S. facility in Bolivia, the 1992 attack on the Ambassador's residence in Peru, the 1995 attack on a U.S. facility in Saudi Arabia, and the 1998 bombings of U.S embassies in Kenya and Tanzania. The ARB reports were completed the same year as the assassinations, except for the Jordan and Gaza ARBs, which were completed the year following the assassinations. [18] The reports are provided to the Chairman of the Committee on Foreign Relations of the Senate and the Speaker of the House of Representatives. [19] The Overseas Security Policy Board is responsible for developing, coordinating, and promoting uniform policies and standards on security programs and projects that affect U.S. government civilian agencies abroad, including diplomatic missions. [20] Before Serving Abroad for Families and Employees, State officials were required to take the Security Overseas Seminar, a 2-day briefing course that covered a wide variety of security issues. The Security Overseas Seminar was combined with another course, Working in an Embassy, to create Serving Abroad for Families and Employees in early 2004. [21] The schools include American and international schools attended by dependents of U.S. government officials and American citizens. Some schools are State Department-sponsored schools, which receive direct educational grants from State's Office of Overseas Schools. [22] Department-sponsored schools receive direct financial grants from State's Office of Overseas Schools. There are over 185 department- sponsored schools worldwide. [23] According to State's Foreign Affairs Handbook, 12 FAH-8 H-146, each type of housing has its advantages and disadvantages. We did not undertake a comprehensive review to determine the most effective housing option to deter terrorism. [24] Department of State, Surveillance Detection Management and Operations Field Guide Version 2.0, FY 2002 and 12 FAH-7 H-530. [25] The guidelines allow posts to use surveillance detection to observe other areas besides the embassy and key residences, but only if there are specific threats present at these locations. [26] For sensitivity reasons, we have not identified the posts we visited. GAO's Mission: The Government Accountability Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO's Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as "Today's Reports," on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select "Subscribe to e-mail alerts" under the "Order GAO Products" heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548:

The Justia Government Accountability Office site republishes public reports retrieved from the U.S. GAO These reports should not be considered official, and do not necessarily reflect the views of Justia.