The Government Accountability Office (GAO) says the Department of Homeland Security (DHS) can’t be sure that federal buildings and facilities are properly protected.
The Department’s Federal Protective Service (FPS) protects over 9,000 federal facilities with over 1.4 million employees and visitors. To do so, it conducts security assessments and recommends countermeasures to address vulnerabilities at federal facilities.
When conducting assessments, FPS inspectors record details such as the facilities’ location, existing countermeasures, and local crime statistics. Additionally, inspectors record information about the existence of security documents for the facility including written security plans, occupant emergency plans, and active threat plans. The database also contains the previous assessment, including the vulnerabilities and threats that were identified and the recommended countermeasures.
FPS maintains a database with information on its assessments and on agencies’ decisions to approve or reject these recommendations. According to FPS officials, tenant agencies have access to the information in the database for their facilities and can view the status of security recommendations and countermeasures. FPS officials told GAO that agencies can also obtain access to FPS’s information for all of their facilities, enabling them to take a broader portfolio approach to security decisions.
As GAO reported in 2022, FPS data indicate that agencies did not respond to over half of FPS’s recommendations in fiscal years 2017 through 2021. In the discussion groups GAO held with facilities’ representatives for its latest review, participants cited several reasons why agencies might not act on FPS recommendations. Reasons included the cost or feasibility of implementing recommended countermeasures.
Recommended countermeasures can range from no cost to the tenants to over $1 million. For example, a recommendation to improve blast protection on the windows of one facility had an estimated cost of $1.8 million. In two discussion groups, participants stated the committees would often approve and implement recommendations with little to no expense, such as replacing lighting to improve illumination at an entrance or trimming trees that obscure security cameras. According to participants in these groups, the more expensive countermeasures were often not approved.
The Interagency Security Committee (ISC), established by Executive Order 12977, is required to oversee the implementation of appropriate countermeasures in certain federal facilities, among other responsibilities. DHS chairs this organization, which is comprised of 66 federal agencies The ISC requires non-military executive branch agencies to self-report some information on the degree to which they comply with ISC’s federal security standards. For example, these agencies report on the extent to which they documented their acceptance of risk for countermeasures they did not implement. However, GAO found that ISC’s oversight does not verify that these agencies have implemented FPS-recommended countermeasures, or documented the acceptance of risk for those countermeasures they do not implement at their facilities.
Without an oversight mechanism to verify if these federal facilities are implementing the appropriate countermeasures or accepting the risk of not doing so, the federal government lacks reasonable assurance that such facilities are secure. ISC officials told GAO that they plan to conduct a pilot to verify select facilities’ compliance at the end of fiscal year 2023. However, GAO is concerned that the pilot will be limited to five facilities and will not assess the countermeasures implemented at a facility or identify the countermeasures for which the facility accepted the risk of not implementing them.
GAO is recommending that DHS improve its oversight ability to assess countermeasure implementation and identify the acceptance of risk at facilities where recommended countermeasures are not implemented. DHS concurred with GAO’s recommendations and expects to complete work to meet them by April 30, 2024.
