Following is the summary of testimony GAO presented at a recent Senate hearing following an investigation of security in federal buildings.
We are pleased to be here to discuss the preliminary results of our review of the Federal Protective Service’s (FPS) contract security guard (guard) program. There has not been a large-scale attack on a domestic federal facility since the terrorist attacks of September 11, 2001 and the 1995 bombing of the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma. Nevertheless, the recent shooting death of a guard at the U.S. Holocaust Memorial Museum–though not a federal facility-demonstrates the continued vulnerability of public buildings to domestic terrorist attack. Thus, one of FPS’s most critical responsibilities is to effectively manage its guard program so that the over one million government employees, as well as members of the public who work in and visit the 9,000 federal facilities each year are protected.[Footnote 1] To accomplish its mission of protecting federal facilities, FPS currently has a budget[Footnote 2] of about $1 billion, about 1,200 full time employees, and about 13,000 guards deployed at approximately 2,300 of the 9,000 federal facilities across the country.[Footnote 3] While FPS does not use guards at the remaining 6,700 facilities under its protection, it frequently uses other security countermeasures such as cameras and perimeter lighting to help protect these facilities. In our June 2008 report, we found that FPS faced significant challenges in ensuring the quality and timeliness of its building security assessments and in maintaining complete crime statistics. We also reported that its risk assessment process was partially flawed.
[Footnote 4] FPS used these tools to help determine how to protect federal facilities.
As of June 2009, FPS’s guard program has cost about $613 million and represents the single largest item in its budget. It is the most visible component of FPS’s operations as well as the first public contact when entering a federal facility. FPS relies heavily on its guards and considers them to be the agency’s "eyes and ears" while performing their duties. Guards are primarily responsible for controlling access to federal facilities by (1) checking the identification of government employees as well as members of the public who work in and visit federal facilities, and (2) operating security equipment, such as x-ray machines and magnetometers to screen for prohibited materials, such as firearms, knives, explosives, or items intended to be used to fabricate an explosive or incendiary device.
Guards do not have arrest authority but can detain individuals who are being disruptive or pose a danger to public safety.
In June 2008, we reported that FPS faced several funding and operational challenges, including oversight of its guard program, that hamper its ability to accomplish its mission of protecting federal facilities and ensuring the safety of the occupants. We recommended, among other things, that the Secretary of the Department of Homeland Security (DHS) direct the Director of FPS to develop and implement a strategic approach to better manage its staffing resources, evaluate current and alternative funding mechanisms, and develop appropriate measures to assess performance. While DHS concurred with our recommendations, FPS has not fully implemented these recommendations.
This testimony is based on preliminary findings of ongoing work and addresses (1) the extent to which FPS ensures that its guards have the required training and certifications before being deployed to a federal facility, (2) the extent to which FPS ensures that its guards comply with post orders[Footnote 5] once they are deployed at federal facilities, and (3) security vulnerabilities we identified related to FPS’s guard program and recent related FPS actions taken in response.
To determine the extent to which FPS ensures that its guards have the required training and certifications prior to being deployed to a federal facility and are complying with post orders once deployed to a federal facility, we conducted site visits at 6 of FPS’s 11 regions.
These regions have responsibilities for almost 63 percent of FPS’s 13,000 guards and 52 percent of the 2,360 facilities that have guards.
To select the regions, we considered the number of federal facilities in each region, geographic dispersion across the United States, and the number of FPS employees in each region. At these locations, we interviewed FPS’s Contract Guard Program Managers and their support staff; law enforcement security officers (also referred to as inspectors) who are responsible for conducting guard inspections, regional managers, as well as guards and the contractors about FPS’s efforts to manage its guard program. We also interviewed officials at FPS and GSA headquarters as well as GSA’s regional security officials.
We reviewed and analyzed FPS’s guard training and certification requirements, Security Guard Information Manual, and guard contracts.
To determine how FPS tracks the status of whether its guards have met the training and certifications requirements, in the 6 regions we visited we randomly selected 663 guard files that were maintained in FPS’s Contract Guard Employment Requirements Tracking System (CERTS).
Because CERTS was not fully reliable we also used information maintained in some of FPS’s regional databases or at the contractor’s office. The 663 guard files we reviewed in the six regions we visited are not generalizable. To determine how FPS ensures that its guards are complying with post orders, we reviewed FPS’s guard inspection process and observed numerous guard inspections at federal facilities in each of the 6 regions we visited. To identify potential security vulnerabilities in FPS’s guard program, we conducted covert testing at 10 judgmentally selected level IV facilities. The facilities were selected from FPS’s most current listing of federal facilities by security level.[Footnote 6] The results of our covert testing at the 10 level IV facilities are not generalizable. Because of the sensitivity of some of the information in our report, we cannot provide information about the specific locations of incidents discussed. We conducted this performance audit from July 2008 to July 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
In Summary: FPS does not fully ensure that its guards have the training and certifications required to stand post at federal facilities. While FPS requires that all prospective guards complete about 128 hours of training, including 8 hours of x-ray and magnetometer training, it was not providing some of its guards with all of the required training in the six regions we visited. For example, in one region, FPS has not provided the required 8 hours of x-ray or magnetometer training to its 1,500 guards since 2004. X-ray training is critical because the majority of guards are primarily responsible for using this equipment to monitor and control access points at federal facilities.
Insufficient x-ray and magnetometer training may have contributed to several incidents in federal facilities where guards were negligent in carrying out their responsibilities. For example, at a level IV facility in a major city, an infant in a carrier was sent through an x- ray machine, which is considered hazardous,[Footnote 7] due to the guard’s negligence. We also found that some guards had not been provided building-specific training, which may have contributed to several guards at one federal facility not following evacuation procedures and leaving access points unattended and vulnerable. FPS’s primary system–CERTS–for monitoring and verifying whether guards have the training and certifications required to stand post at federal facilities is not fully reliable. We reviewed training and certification data for 663 randomly selected guards in 6 of FPS’s 11 regions maintained in CERTS, which is the agency’s primary system for tracking guard training and certifications. Because CERTS was not fully reliable we also used databases maintained by some of FPS’s regions or information provided by the contractor. We found that 62 percent, or 411 of the 663 guards who were deployed to a federal facility had at least one expired firearm qualification, background investigation, domestic violence declaration[Footnote 8], or CPR/First Aid training certification. More specifically, according to the most recent information from one contractor, we found that over 75 percent of the 354 guards at a level IV facility had expired certifications or the contractor had no record of the training. Based on the contractor information for another contract, we also found that almost 40 percent of the 191 guards at another level IV facility had expired domestic violence declarations. Without domestic violence declarations in place, guards are not permitted to carry a firearm. FPS requires its guards to carry weapons. In addition, one of FPS’s contractors allegedly falsified training records for its guards–an incident that is currently being litigated. FPS became aware of this alleged violation from an employee of the contractor and not from its internal control procedures. Moreover, we found that FPS officials in the 6 regions we visited are generally relying on the contractor to self-report that training and certification requirements are met because CERTS is not fully reliable.
FPS has limited assurance that its guards are complying with post orders once they are deployed to a federal facility. FPS does not have specific national guidance on when and how guard inspections should be performed. The frequency with which FPS inspects these posts also varied across the regions. For example, one region we visited required its inspectors to complete 5 guard inspections each month while another region did not have any inspection requirements. We also found that in the 6 regions we visited that guard inspections are typically completed by FPS during routine business hours and in metropolitan cities where FPS has a field office, and seldom at nights or on weekends. However, on the few occasions when FPS has conducted post inspections at night, it has found instances of guards not complying with post orders. For example, at a level IV facility, an armed guard was found asleep at his post after taking the pain killer prescription drug Percocet.
Similarly, FPS has also found other incidents at level IV facilities where guards were not in compliance with post orders. For example, while a guard should have been standing post, the guard was caught using government computers to manage a private for-profit adult website. At another facility, a guard either failed to recognize or did not properly x-ray a box containing semi-automatic handguns at the loading dock at one federal facility we visited. FPS became aware of the situation because the handguns were delivered to it.
Our investigators identified substantial security vulnerabilities related to FPS’s guard program. With the components for an improvised explosive device (IED) concealed on their persons, our investigators passed undetected through access points controlled by FPS guards at 10 level IV facilities in four major cities where we conducted covert tests. Our investigators used publicly available information to identify a type of device that a terrorist could use to cause damage to a federal facility and threaten the safety of federal workers and the general public. The IED was made up of two parts–a liquid explosive and a low-yield detonator–and included a variety of materials not typically brought into a federal facility by an employee or the public.
Of the 10 Level IV facilities we penetrated, 8 were government-owned, 2 were leased, and included offices of a U.S. Senator and U.S.
Representative, as well as agencies such as the Departments of Homeland Security, State, and Justice. Once our investigators passed the access control point, they assembled the IED and walked freely around several floors of the facilities and into various executive and legislative branch offices with the IED in a briefcase. In response to the security vulnerabilities we identified during our covert testing, FPS has recently taken steps to improve oversight of the guard program.
Specifically, according to FPS officials, it has authorized overtime to conduct guard post inspections during non-routine business hours and is conducting its own penetration tests to identify weaknesses at access control points. In March 2009, FPS also issued a policy directive intended to standardize inspection requirements across all FPS regions.
Implementing the new requirements may be challenging, according to FPS management and some regional staff. We will be reporting more fully on our findings, with potential recommendations, in September 2009.