[House Hearing, 107 Congress]
[From the U.S. Government Publishing Office]
EXAMINING SECURITY AT FEDERAL FACILITIES: ARE ATLANTA'S FEDERAL
EMPLOYEES AT RISK?
=======================================================================
HEARING
before the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SEVENTH CONGRESS
SECOND SESSION
__________
APRIL 30, 2002
__________
Serial No. 107-82
Printed for the use of the Committee on Government Reform
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
__________
U. S. GOVERNMENT PRINTING OFFICE
80-883 WASHINGTON : 2002
___________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512-1800
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001
COMMITTEE ON GOVERNMENT REFORM
DAN BURTON, Indiana, Chairman
BENJAMIN A. GILMAN, New York HENRY A. WAXMAN, California
CONSTANCE A. MORELLA, Maryland TOM LANTOS, California
CHRISTOPHER SHAYS, Connecticut MAJOR R. OWENS, New York
ILEANA ROS-LEHTINEN, Florida EDOLPHUS TOWNS, New York
JOHN M. McHUGH, New York PAUL E. KANJORSKI, Pennsylvania
STEPHEN HORN, California PATSY T. MINK, Hawaii
JOHN L. MICA, Florida CAROLYN B. MALONEY, New York
THOMAS M. DAVIS, Virginia ELEANOR HOLMES NORTON, Washington,
MARK E. SOUDER, Indiana DC
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
BOB BARR, Georgia DENNIS J. KUCINICH, Ohio
DAN MILLER, Florida ROD R. BLAGOJEVICH, Illinois
DOUG OSE, California DANNY K. DAVIS, Illinois
RON LEWIS, Kentucky JOHN F. TIERNEY, Massachusetts
JO ANN DAVIS, Virginia JIM TURNER, Texas
TODD RUSSELL PLATTS, Pennsylvania THOMAS H. ALLEN, Maine
DAVE WELDON, Florida JANICE D. SCHAKOWSKY, Illinois
CHRIS CANNON, Utah WM. LACY CLAY, Missouri
ADAM H. PUTNAM, Florida DIANE E. WATSON, California
C.L. ``BUTCH'' OTTER, Idaho STEPHEN F. LYNCH, Massachusetts
EDWARD L. SCHROCK, Virginia ------
JOHN J. DUNCAN, Jr., Tennessee BERNARD SANDERS, Vermont
JOHN SULLIVAN, Oklahoma (Independent)
Kevin Binger, Staff Director
Daniel R. Moll, Deputy Staff Director
James C. Wilson, Chief Counsel
Robert A. Briggs, Chief Clerk
Phil Schiliro, Minority Staff Director
C O N T E N T S
----------
Page
Hearing held on April 30, 2002................................... 1
Statement of:
Malfi, Ronald, Acting Managing Director, Office of Special
Investigation, General Accounting Office; John Cooney,
Special Agent, Office of Special Investigations, General
Accounting Office; Patrick F. Sullivan, Assistant Director,
Office of Special Investigations, General Accounting
Office; Wendell C. Shingler, Assistant Commissioner, Office
of Federal Protective Service, General Services
Administration; and Sabina Sims, Director, Office of
Federal Protective Service, GSA Region 4................... 12
Letters, statements, etc., submitted for the record by:
Barr, Hon. Bob, a Representative in Congress from the State
of Georgia, prepared statement of.......................... 5
Malfi, Ronald, Acting Managing Director, Office of Special
Investigation, General Accounting Office, prepared
statement of............................................... 17
Shingler, Wendell C., Assistant Commissioner, Office of
Federal Protective Service, General Services
Administration, prepared statement of...................... 23
EXAMINING SECURITY AT FEDERAL FACILITIES: ARE ATLANTA'S FEDERAL
EMPLOYEES AT RISK?
----------
TUESDAY, APRIL 30, 2002
House of Representatives,
Committee on Government Reform,
Atlanta, GA.
The subcommittee met, pursuant to notice, at 10:30 a.m., in
the Summit Building, 401 West Peachtree Street, Atlanta, GA,
Hon. Bob Barr (vice chairman of the committee) presiding.
Present: Representatives Barr and LaTourette.
Staff present: Daniel R. Moll, deputy staff director;
Robert A. Briggs, chief clerk; Susan Mosychuk, counsel; and
David Rapallo, minority counsel.
Mr. Barr. I hereby convene this hearing of the Committee on
Government Reform of the U.S. House of Representatives open.
The focus of the hearing will be to examine security at Federal
facilities, are Atlanta's Federal employees at risk.
The events of September 11, 2001 have focused our attention
on a frightening reality. Even our most sacred institutions are
vulnerable to attack. Terrorists do not engage in conventional
warfare.
While terrorists may attack or threaten our military, the
most tempting terrorist targets of choice are innocent and
unsuspecting civilians. They use fear as a weapon, and will go
to whatever extreme to heighten the shock effect.
Terrorists also seek to exploit environments that are a
normal part of our daily routine. They aim to take out large
numbers of victims to generate high media attention, and
engender mass panic and public anxiety. What better targets
than high profile landmarks and government institutions.
Government buildings are among the most visible
institutions in our society by design, and selecting them for
attack serves a very distinct purpose. When they attack these
institutions the terrorists not only kill, maim, and destroy,
but also instill fear that our government is unable to protect
us. When terrorists attack, they are always trying to catch
their victims in situations where they would otherwise feel
safe. How safe are we in our Federal buildings?
The September 11th terrorist attacks in New York and at the
Pentagon prompted immediate security crackdowns in Washington,
DC, including the closing of streets, bolstering the security
presence at Federal buildings, and curtailing visitor access to
government compounds and buildings. Securing Federal buildings
in the Nation's Capitol is clearly of vital importance.
However, we must not overlook the quality and effectiveness of
security in all buildings and facilities occupied by Federal
employees and visitors in every major city and across the
Nation.
Congress and the Federal Government had the opportunity to
lead by example working with the District of Columbia, local
business leaders, and concerned citizens to meet security needs
without necessarily impeding the city's or the government's
ability to go about its daily business in the Capitol.
Despite the workable security measures deployed at Federal
facilities in Washington, DC, many local Federal agencies have
not addressed, or remain unable to address security needs in
the aftermath of last year's terrorist attacks. Many media
outlets reported that security procedures at Federal agencies
varied tremendously in both process and effect throughout the
country. Inconsistent and vague security procedures at our
Federal facilities leave thousands of Federal employees,
visitors, and constituents highly vulnerable and at risk. The
extent to which our government buildings are vulnerable to
attack should concern not only the Federal employees of these
buildings, but every family member of these employees, any
member of the general public visiting these buildings, and any
individual or company that conducts business with an agency
housed in one of these buildings. In other words, this concerns
every member of our community.
Building security is not just about securing the physical
structure itself; it is about protecting the lives and
livelihood of everyone and everything in these buildings.
Consider for a moment the repercussions of a terrorist
attack at the IRS service center here in Atlanta. The building
which you can see a picture of here houses 3,000 occupants and
is the main processing center for the entire Southeast Region
of the United States. The human toll would be staggering, and
the financial impact devastating.
Or consider the repercussions of a terrorist attack at the
Sam Nunn Federal Building. Look at the sheer numbers of
employees and the variety and importance of the government
agencies that would be directly affected.
Today representatives from the General Accounting Office,
Office of Special Investigations [OSI], will provide testimony
on the results of a recently completed investigation. At the
request of this committee the investigators tested security
measures at five Federal office buildings in the Atlanta area,
which has one of the largest Federal presences outside of
Washington, DC.
Acting in an undercover capacity investigators were able to
gain unauthorized access to every secured government building
they attempted to penetrate. Not only were the investigators
able to gain unauthorized access to these buildings, they
gained access which allowed them unfettered admission to any
areas of the buildings day or night.
The ease whereby the investigators were successful is
shocking. A simple pretext was concocted and easily carried
out, allowing agents to obtain building passes. In fact, they
were able to obtain passes which denote the bearer as being
authorized to carry firearms. This building pass allowed them
to move freely about, and extensively bypassing magnetometers
and x-ray machines. They even obtained an after-hours access
code allowing them to enter the facilities after security
personnel had gone home.
By employing a few simple tactics and off-the-shelf
technology investigators thwarted the security in such a manner
that weapons, explosives, nuclear, chemical, or biological
agents, listening devices, and other life-threatening or
hazardous materials could have easily been carried into and
left throughout these Federal buildings. They were given in
effect the keys to the kingdom. In the words of the
investigators, they owned those buildings.
At a time when Federal facilities are operating under the
highest level of security, these undercover investigators were
able to freely enter the buildings without proper
identification or authority carrying packages which had not
been scanned or inspected.
The problem is not isolated to the Atlanta area alone. The
Department of State in Washington, DC, recently had to overhaul
its security operations following a string of serious breaches
compromising classified information.
It had been an open secret that security was lax at State.
In fact, in late 1998 an unidentified man in a brown tweed
jacket entered then Secretary of State Albright's executive
suite and carried out unchallenged a pile of classified
documents. He was never seen again.
We no longer live in an environment in which we can afford
such a casual attitude toward security and safety. All
principal personnel must stress the importance of security, and
combat perceived weaknesses in the security culture, and proper
measures must be demanded and enforced.
Beyond that, there are specific areas in which we can focus
with regard to security personnel, training, and equipment.
Following numerous security reviews, inspections, and reports
one major area for reform at the State Department was
tightening controls of the State Department building passes. At
the time there were 33,000 State Department passes with 2,000
per year completely lost. Diplomats kept their passes even when
stationed overseas, making those passes prime targets for theft
or misuse.
Given the potential threat, State Department began a
process of redoing all building passes, deactivating those of
former employees, and making the process of obtaining them much
tougher.
Implementing security procedures with the aim of thwarting
any and every conceivable infiltration would be impractical. To
do that would make daily operations of our government agencies
impossible. However, we can, and should, and must make
buildings both safe and accessible by consistently following
guidelines, deploying appropriate technology, and employing
basic common sense.
We must take a rational approach to security to ensure
safety concerns are addressed in a manner that does not make
things worse. We cannot allow terrorism to destroy our sense of
community or the ability of the institutions that run our
government to serve us.
Understanding the nature of terrorist attacks and how
terrorists organizations operate helps us prepare and prevent
future attacks. We can regain control and eliminate fear by
taking proactive steps to avoid falling victim.
I thank the witnesses that will be appearing here today,
and look forward to working with them and others on a
subsequent legislative remedy to provide an oversight remedy to
provide security procedures at our Federal installations.
While the results of this current investigation are
frightening, we hope the steps taken in response will be
reassuring in both effect and perception.
[The prepared statement of Hon. Bob Barr follows:]
[GRAPHIC] [TIFF OMITTED] 80883.001
[GRAPHIC] [TIFF OMITTED] 80883.002
[GRAPHIC] [TIFF OMITTED] 80883.003
[GRAPHIC] [TIFF OMITTED] 80883.004
[GRAPHIC] [TIFF OMITTED] 80883.005
Mr. Barr. I would like to now turn to my colleague from the
State of Ohio, a senior member of our Government Reform
Committee, Steve LaTourette.
Mr. LaTourette. Thank you very much, Chairman Barr. And
first of all thank you for inviting me to Atlanta. And second I
want to commend Congressman Barr for the leadership that you
and the chairman of our full committee, Dan Burton of Indiana,
have demonstrated in dealing with the security of the Federal
buildings, this particular issue, and you in particular because
of your concern for the men and women that work in the
buildings in Atlanta, Ga.
As you correctly point out in your opening remarks the
security of the Federal work force and those who visit the
Federal buildings in the United States is of vital concern to
the government. In 1995 one of the shocking revelations that
came to our attention after the bombing of the Murrah Federal
Building in Oklahoma City was that there was one contract guard
assigned to three different buildings on that occasion, and
clearly security was not where we needed to be in 1995. I think
many of us hoped that in the years between 1995 and certainly
2002 improvements have been made.
The report that we are here to talk about today is
disturbing. Although the agents that we will hear from are
certainly skilled at what they do, the ability to completely
breach the buildings in Atlanta, GA I think is incomprehensible
in the wake of September 11th.
Hopefully this hearing and other hearings like it will help
assist not only the agencies in charge of the security, but
also the Congress and the administration reach some conclusions
that can make these buildings safer.
One of the other happy tasks that I have in the Congress is
chairing the Public Buildings, Economic Development, and
Emergency Management Subcommittee of Transportation and
Infrastructure that has concurrent jurisdiction over some of
the issues that we are going to be talking about today, and the
good news is that legislation relative to the Federal
Protective Service is in fact moving through that committee,
and one of the alarming notes I would say is that we appear to
be going backward. When we talked to Steve Perry, the
administrator of the General Services Administration, the goal
was to beef up the Federal Protective Service work force from
600 full-time employees to 900, and what we have seen instead
according to Mr. Perry is that they have gone down to 450, and
the reason being--and we must bear some of that
responsibility--is that there is about a $10,000 starting
salary differential between what someone for FPS can make and
what someone can make working for the Capitol Hill police
department. So that is an example of some of the things that we
are going to have to take a look at in the Congress.
The other thing that the hearings revealed on this
particular issue is that the training received by the contract
guard authorities utilized by GSA do not receive equivalent
training to those who are employed as police officers in my
home State of Ohio or here in the State of Georgia, and
training is something that we also have to emphasize.
And last, I am not a big believer in gotcha anything, but I
did read the report, I read the recommendations following the
briefing of the GAO officers, and one of the recommendations
was that there be at least three people stationed by the
magnetometers, and during our break I went outside to engage in
one of the few vices I am allowed, and that is to have a
cigarette, and I came back in through the building and there
were only two stationed at the magnetometer that I entered, and
I am also today in possession of two visitors passes permitting
me access to this building, and it seems to me that we can
address that during the hearing as well to determine how that
could be.
I thank you very much.
Mr. Barr. Is that in case you lose one?
Mr. LaTourette. I do not know if it is in case I lose one,
or in case I have another visitor I want to bring with me.
I appreciate very much the opportunity to be here today,
and I thank you again for your leadership.
Mr. Barr. Thank you very much.
For those unfamiliar with hearings conducted by the
Government Reform Committee, basically what we will do now is
we will swear in the five witnesses, and we will hear from each
one of them if in fact each one of them wishes to make an
opening statement for the record. If there is any additional
material that any of our witnesses seeks to be made a part of
the record either in more extensive opening statement or
additional material that might come to light, or be relevant
based on subsequent questions, the record will remain open for
10 days for the submission of any additional material.
Following the opening statements of witnesses, Mr.
LaTourette and I will ask questions. If counsel has any
additional questions, she will ask questions as well. And then
we will conclude the hearing.
At this time if the five witnesses would stand, please, to
be sworn. If you would raise your right hands.
[Witnesses sworn.]
Mr. Barr. Let the record reflect that all witnesses
responded in the affirmative. Thank you, and please be seated.
We have five very distinguished witnesses here today, all
of whom have the same goal in mind that we on this committee
do, and that is to provide the very best security for not just
the Federal buildings and Federal employees and their families,
but all who visit, come in contact with, or have an interest in
our Federal Government, and we appreciate each one of them
being with us today to assist us in our oversight
responsibilities to ensure this vital function of our Federal
Government is carried out, and to hear from them not only with
regard to what steps they have and believe ought to be taken,
but ways in which we in the Congress might help. As Mr.
LaTourette mentioned, we in the Congress have a responsibility
to make sure that the laws reflect the needs of our Federal
agencies and our Federal officials, and also that the funds
necessary to carry out those functions are made available. So
this is very much a team effort, and we appreciate again the
witnesses being with us today.
The witnesses that we will hear from today--I believe there
is a witness list available in the back of the room--we will
hear from in the following order.
Mr. Ronald Malfi, the Acting Managing Director, Office of
Special Investigations, General Accounting Office. He has
extensive background which he is certainly free to go into to
establish his bona fides in the Secret Service.
Also then testifying second will be Mr. Patrick Sullivan,
the Assistant Director, Office of Special Investigations for
the General Accounting Office, also with extensive background
in law enforcement and particularly with the Secret Service;
and finally testifying on behalf of GAO will be Mr. John
Cooney, Special Agent, Office of Special Investigations,
General Accounting Office, with a similar and very extensive
and distinguished background in Federal law enforcement.
We will then hear from Mr. Wendell Shingler, the Assistant
Commissioner of the Office of Federal Protective Service [FPS],
of the General Services Administration. The General Services
Administration is generally known as the government's landlord.
It is the responsibility of GSA to maintain thousands of
Federal buildings all across the country, including many of
those here in the Atlanta area.
And finally testifying will be Ms. Sabina Sims, the
Director of the Office of Federal Protective Service for GSA
Region 4 which includes as its center Atlanta, GA.
With that introduction, Mr. Malfi, the floor is yours to
make an opening statement, and if you would basically lay out
the parameters of why your agency got involved in this
investigation and how you carried it out.
STATEMENTS OF RONALD MALFI, ACTING MANAGING DIRECTOR, OFFICE OF
SPECIAL INVESTIGATION, GENERAL ACCOUNTING OFFICE; JOHN COONEY,
SPECIAL AGENT, OFFICE OF SPECIAL INVESTIGATIONS, GENERAL
ACCOUNTING OFFICE; PATRICK F. SULLIVAN, ASSISTANT DIRECTOR,
OFFICE OF SPECIAL INVESTIGATIONS, GENERAL ACCOUNTING OFFICE;
WENDELL C. SHINGLER, ASSISTANT COMMISSIONER, OFFICE OF FEDERAL
PROTECTIVE SERVICE, GENERAL SERVICES ADMINISTRATION; AND SABINA
SIMS, DIRECTOR, OFFICE OF FEDERAL PROTECTIVE SERVICE, GSA
REGION 4
Mr. Malfi. Thank you. Mr. Chairman, members of the
committee. We are here today to discuss the results of our
tests of security measures at Federal office buildings in the
Atlanta, GA area. Specifically you asked that special agents of
the Office of Special Investigations acting in an undercover
capacity attempt to gain unauthorized access to secure
facilities in such a manner that weapons, explosives, chemical/
biological agents, listening devices, or that hazardous
materials could have been brought into these facilities.
During February and March 2002 our agents breached the
security at four of the Federal office buildings that we tested
in the Atlanta area by entering these buildings without proper
authority, carrying a briefcase or package, and bypassing the
magnetometers and x-ray machines. They were able to move freely
and extensively throughout these facilities during both day and
evening hours, and were not challenged by anyone. Our
undercover agents could have carried in weapons, listening
devices, explosives, chemical/biological agents, or other such
items.
All buildings required screening of visitors and valises,
for example briefcases and baggage, which included the use of
magnetometers and x-ray machines at security checkpoints.
The buildings required the wearing of either a blue pass or
a yellow pass for identification of employees working in these
buildings, which allowed them to bypass the magnetometers and
x-ray machines.
The blue pass could also have an additional feature added
to it that would denote the bearer as being authorized to carry
a firearm. All passes included photo identification, and had
holograms on them, but were worn inside plastic pockets that
could partially obscure the hologram as well as the bearer's
photograph.
Mr. Barr. Excuse me, Mr. Malfi. Do you have a couple of
those badges we could look at while you are testifying?
Mr. Malfi. Yes, I do.
One of the badges that you are going to be getting, sir, is
the genuine, and one is the counterfeit badge. The genuine
badge has the holograms that are easily seen when they are
reflected off the light.
Mr. Barr. This one?
Mr. Malfi. That is correct. The other is a counterfeit
badge.
Mr. Barr. And they were put in these plastic pouches?
Mr. Malfi. That is how they were handed out. When the
building passes were given out, these plastic pouches came with
the passes. And you will note one side of the plastic is clear,
the other side is opaque, and we put the photograph, the
building pass with the photograph and the hologram in the
opaque side to obscure it.
Mr. Barr. Without going into--and I do not want you to
disclose particularly sensitive investigative techniques here--
would you describe what a pretext is?
Mr. Malfi. Basically a pretext is a ruse that we concocted
in order to allow ourselves to get into the building and to
meet with GSA people who were issuing the passes.
Mr. Barr. A story?
Mr. Malfi. It is a story, a fabricated story to give the
people a reason as to why we needed these passes.
Mr. Barr. Was there anything particularly complex about
that story? Could anybody have made something up?
Mr. Malfi. That is correct. We used one ruse; we could have
used one of many ruses to get into the building in order to
obtain a building pass.
Mr. Barr. Thank you.
Mr. Malfi. You are welcome.
I am going to go into how we exactly breached the security
of these buildings.
In early March using a pretext for gaining access, an agent
who had no building pass entered one of the buildings carrying
a briefcase, bypassing the magnetometer and the x-ray machines.
He met with the General Services Administration employee
responsible for issuing building passes, and obtained a yellow
building pass and an after-hours access code for that building.
The next day the same agent entered another building
carrying a briefcase. He showed his yellow pass and stated that
he wanted to obtain a blue pass for that building, and bypassed
the magnetometers and the x-ray machines based on the strength
of the yellow pass.
Mr. Barr. Do you have that yellow pass, please?
Mr. Malfi. Yes.
He then met with the GSA contract employee responsible for
issuing building passes, and based solely on the strength of
having a yellow pass obtained a blue building pass and an
after-hours access code to two of the subject buildings.
In addition, this agent was able to obtain a second feature
on the blue building pass that identified him as a law
enforcement officer and permitted him to carry a firearm in
those buildings.
Finally, through the use of another pretext the same agent
obtained----
Mr. Barr. Excuse me. There is a specific designation on the
badge that the folks at the building would know authorized the
bearer to carry a firearm in the building?
Mr. Malfi. That is correct. It is a little round insignia
that would notify the marshals basically that the bearer had
the right to carry a firearm.
Finally, through the use of another pretext the same agent
obtained the security guard's after-hours access code for one
of the buildings.
Mr. Barr. This would be a security code that was designated
specifically to that particular person?
Mr. Malfi. That is correct.
Mr. Barr. And he gave it to the undercover agent, yourself,
or one of your colleagues----
Mr. Malfi. That is correct.
Mr. Barr [continuing]. So that they could get into the
building after hours?
Mr. Malfi. Based again on some social engineering we had an
access code that allowed us entry to the building at night.
Mr. Barr. What do you mean social engineering?
Mr. Malfi. Basically conning the security guard into having
him reveal his access code. The importance to that would have
been that if anything would have occurred we could have used
that access code to gain entry into the buildings after hours.
If something--we could have put explosives in the building, and
basically if they would have went back and checked who entered
in they never would have even been able to check it to our
false identification. They would have wound up going back to
the guard as one of the people that gained entry into that
building that night.
Then after we received the original passes we counterfeited
both the yellow and blue building passes using commercially
available software, inserting in them the fictitious names used
by our undercover agents and their photographs in preparation
for an attempt as a group to breach the security of these
facilities.
Mr. Barr. Excuse me. In other words, the software that was
used to create the false badges is available to anybody on the
open market? It was not something that was uniquely available
to yourselves as law enforcement officials and investigators?
Mr. Malfi. That is correct. Everything that we did and we
used was available to the public. We did not use any of our
inside technology in order to enhance this operation. We wanted
to make it that anyone basically without being involved in the
law enforcement community could have accomplished what we did.
The counterfeit passes contained printed holograms on them,
not actual holograms. Had anyone made a physical inspection of
the counterfeit passes they should have been able to detect
them as being bogus.
Mr. Barr. In other words, the hologram that is available if
you look at it?
Mr. Malfi. That is correct. On the counterfeit ones we just
printed a duplicate of the hologram which did not perform the
function that a hologram does. It does not change shades when
it is exposed to the light or moved; it is flat.
Mr. Barr. And that is obvious to us, and it would have been
obvious had one of the guards checked it, just physically
looked at it for a moment?
Mr. Malfi. That is correct.
Mr. Barr. But that did not happen?
Mr. Malfi. That is correct.
Later in March other agents using the counterfeit yellow
and blue building passes entered three of the buildings
bypassing the magnetometers and x-ray machines. One of these
agents carried a briefcase. The same agents also successfully
entered these same buildings in the evening utilizing the
access codes that they previously acquired.
An agent using a counterfeit yellow building pass met with
the GSA contract employee responsible for issuing building
passes for the two buildings. Based on the strength of the
counterfeit yellow pass and a fictitious request form the agent
was issued a genuine blue building pass and an access code for
the evening entry after security check points were closed.
Additionally, one agent wore another agent's legitimate
blue pass into one of the buildings, crossed over into another
building through a tunnel, and was never challenged.
Mr. Barr. Is there a physical similarity between the person
who utilized that badge and the picture on the badge?
Mr. Malfi. Actually I used Agent Cooney's picture
identification to gain access into the buildings.
Mr. Barr. I will not ask which one of you was insulted, but
in other words you used the badge of somebody that does not
look very much like you at all, and you were not challenged?
Mr. Malfi. That is correct.
Two agents then drove to another Federal facility, and
based on the strength of a legitimate yellow pass and a
counterfeit yellow pass and a pretext gained admittance to that
building bypassing the magnetometer and x-ray machines.
Finally, after we completed our test of the security for
these buildings we met with officials from the U.S. attorney's
office, the U.S. Marshal Service, GSA, and the Federal
Protective Service, and briefed them on the results of the
security tests, identifying the weaknesses we found.
Mr. Barr. This was immediately following the conclusion of
your investigation?
Mr. Malfi. That is correct. Actually the day that I wore
the pass was the day of the meeting, so we were finished. As
soon as we finished the actual last function of the operation
we immediately had a meeting with these individuals and advised
them of the weaknesses that we found.
Subsequently, the Federal Protective Service issued a
security bulletin which addressed weaknesses we identified.
In closing, I would like to add that last week GAO's chief
technologist testified at a hearing before the Subcommittee on
Technology and Procurement Policy, House Committee on
Government Reform, concerning security technologies to protect
Federal facilities. As part of that testimony it was
acknowledged that effective security also entails having a
well-trained staff that follows and enforces policies and
procedures. It was noted that breaches in security resulting
from human error are more likely to occur if personnel do not
understand the risks and the policies that are put in place to
mitigate them. Good training is essential to successfully
implementing policies by ensuring that personnel exercise good
judgment following security procedures.
Cited as an example was our previous work where we breached
the security at 19 Federal agencies and two airports. This case
further exemplifies this point. Further, the Federal Protective
Service bulletin reinforces this point.
Mr. Chairman, that completes my prepared statement. We
would be happy to respond to any questions you have, or members
of the committee. Thank you.
[The prepared statement of Mr. Malfi follows:]
[GRAPHIC] [TIFF OMITTED] 80883.006
[GRAPHIC] [TIFF OMITTED] 80883.007
[GRAPHIC] [TIFF OMITTED] 80883.008
[GRAPHIC] [TIFF OMITTED] 80883.009
Mr. Barr. Thank you, Mr. Malfi.
Mr. Sullivan, do you have an opening statement?
Mr. Sullivan. No, sir, I do not have an opening statement.
Mr. Barr. Mr. Cooney?
Mr. Cooney. Also I have none.
Mr. Barr. You are both available to answer any questions?
Mr. Cooney. Yes, sir.
Mr. Sullivan. Yes, sir.
Mr. Barr. Mr. Shingler.
Mr. Shingler. Good morning, Mr. Chairman, members of the
committee.
I am Wendell Shingler, Assistant Commissioner of the
Federal Protective Service, General Services Administration
[GSA]. Although I am relatively new to this position, I have 30
years of security experience in progressively more demanding
positions within the Federal Government, most recently with the
U.S. Marshal Service.
I look forward to the challenges that we face, as well as
working with other Federal agencies in meeting their needs. I
am pleased to appear before you today and provide information
on the GSA's program to secure Federal buildings that it owns
or leases, and the methodology that we use to assess potential
vulnerabilities to these facilities.
GSA's Federal Protective Service [FPS] provides law
enforcement and security to over 8,000 owned and leased
buildings, and approximately 1 million Federal employees and
visitors to these facilities on a daily basis.
We are comprised of police officers, criminal
investigators, physical security specialists, and rely on the
use of nearly 7,000 contract guards to supplement our needs.
With the terrorist attacks of September 11th there is one
clear message: that there is no security silver bullet.
Security is a dynamic and ever-changing discipline. GSA's
Federal Protective Service strives to provide the safest
environment for the Federal agencies we house and the American
public that visit these Federal buildings. The threat and our
response to it changes daily.
The dedicated men and women of the Federal Protective
Service welcome that challenge, and are constantly striving to
improve our services and reduce potential threats to our
buildings. Our primary goal is to make everyone feel safe when
entering GSA-controlled buildings.
Since there is no one-size-fits all in security to achieve
this goal, each of our facilities receives an individual
building security assessment. The building security assessment
program is designed to determine the specific security measures
needed to eliminate or reduce threats directly associated with
each individual building. Tailored security measures,
countermeasures are then recommended based on reducing or
eliminating determined vulnerabilities and threats at
buildings.
In addition, we are now working with the FBI, CIA, State
and local law enforcement agencies in sharing of intelligence
information that enables us to better assess the credibility of
those threats.
In addition to physical countermeasures such as guards,
physical barriers, alarms, cameras, x-ray machines, and
magnetometers we also provide law enforcement services. These
services include responding to calls, arrests, and when
necessary conducting investigations.
On a national level we accomplish this challenging and very
important job of protecting GSA-controlled facilities with a
small but dedicated uniformed staff. To augment our Civil
Service force, we rely on 7,000 contract guards nationwide.
Here in GSA's Southeast Sunbelt Region we have 1,327
buildings of which 143 are Level 4, our highest security level.
To protect these facilities we supplement our law enforcement
personnel with 960 armed contract guards.
The only acceptable minimum security level for all of these
facilities nationwide is that which provides a safe and secure
environment for GSA co-workers, customers, and visitors. This
is the driving force behind our FPS mission, to permit Federal
agencies and members of the public to conduct their business
without fear of violence, crime, or disorder.
I know I face many challenges in my new position, and I am
certain that the Federal Protective Service and I are ready to
take them on.
This concludes my prepared statement, Mr. Chairman, and we
are prepared to answer any of your questions.
[The prepared statement of Mr. Shingler follows:]
[GRAPHIC] [TIFF OMITTED] 80883.010
[GRAPHIC] [TIFF OMITTED] 80883.011
[GRAPHIC] [TIFF OMITTED] 80883.012
Mr. Barr. Thank you, Mr. Shingler.
Ms. Sims, please.
Ms. Sims. I have nothing further to add, but I would be
more than happy to answer any specific questions that you have
for me.
Mr. Barr. OK. Maybe you could briefly for the benefit of
the audience and the listening public who are very concerned
about this just very briefly describe the FPS or the Federal
Protective Service and its function, and how it interfaces with
GSA.
Ms. Sims. The Federal Protective Service is the law
enforcement and security arm of the U.S. General Services
Administration. I am 1 of 11 FPS regional directors around this
country, and I am the Director of the Southeast Sunbelt Region.
I have approximately 1,300 facilities around eight States in
this region.
Mr. Barr. OK. Thank you.
I have a couple of preliminary questions, and then I would
like to turn to my colleague Mr. LaTourette, then I may have
some more, and he may as well.
Back in 1993 the World Trade Center was bombed in the
garage. Two years later the Murrah Federal Building in Oklahoma
City was bombed and crumbled with tremendous loss of life, and
of course on September 11th of last year our Nation suffered
the most serious terrorist attacks ever perpetrated against us
in our homeland or anywhere.
After each one of those I would presume that our government
took a look at security procedures, not just at Federal
buildings, but particularly at Federal buildings, and took
steps to address those, yet obviously we still have some
problems.
I know also, Mr. Malfi, that your office conducted an
investigation I think 2 years ago was it. If you could, briefly
describe that investigation.
Mr. Malfi. We were requested to test the security at
various government buildings and airports. We undertook an
operation, undercover operation where we used false police
credentials in an effort to obtain access into these buildings
and bypassing the magnetometers and x-ray machines, carrying in
briefcases to simulate the fact that we could have brought in
weapons, explosives into these buildings.
We attempted 19 entries in the Washington area, and were
successful in all 19 entries. We attempted two airports, and
obtained entry into both airports, circumventing the
magnetometers and x-ray machines in all the instances where we
went out.
Mr. Barr. Were steps taken subsequent to that investigation
to correct the deficiencies that investigation uncovered?
Mr. Malfi. After we completed the investigation we had
again a debriefing with the agencies that were involved, and
they instituted immediate steps to try and correct the measures
that made it allowable for us to circumvent their security. So
there was much concern about it, and the agencies reacted to
this and put in certain policy changes to effectively enhance
their security measures.
Mr. Barr. I want to make sure that Mr. LaTourette and the
public and we understand exactly the scope of what you were
able to do here, but also to indicate as I would like you to
whether or not there were in fact areas of these Federal
buildings--and we see pictures of the Federal buildings with
many, many agencies housed therein, and many thousands of
Federal employees--it is my understanding that you were able to
gain access to each one of the I think actually four buildings
that you sought to penetrate; is that correct?
Mr. Malfi. That is correct.
Mr. Barr. And the identification cards that you were able
to secure based on pretexts, that is false stories which
apparently were not checked out; is that correct?
Mr. Malfi. That is correct. No due diligence was done in
regards to the story that we used for the reasons we needed a
building pass. We were able to obtain--Agent Cooney was able to
obtain two legitimate building passes. From those legitimate
building passes we counterfeited building passes for our other
agents to gain infiltration into these buildings as a group,
and then we went and on the strength of some counterfeit
passes, building passes, we were able to obtain a legitimate
building pass. So in turn through a ruse we got genuine
building passes, counterfeited them, were able to get entry
into the buildings using the counterfeited building passes, get
access to the buildings when they were closed and after hours,
and based on the strength of a counterfeit building pass we
were able to obtain genuine building pass. So we would have
eventually turned all of the counterfeit credentials,
counterfeit building passes we had into legitimate passes.
Mr. Barr. Of course if one of our law enforcement agencies
were conducting a true undercover operation, or an intelligence
operation, you are familiar with the concept of backstopping;
correct? In other words, if you are going to send an agent out
in an undercover capacity you will backstop so that steps are
taken down the line so that if his story is checked out it
appears to be legitimate.
Mr. Malfi. Absolutely.
Mr. Barr. Their undercover operations are backstopped. You
did not do that in this case; is that correct?
Mr. Malfi. Actually there was no need for us to do that in
this investigation because nobody checked, pulled back the
first layer. We had a system set up that in case we needed some
verification for the fictitious stories that we laid out that
we would have been able to provide that. But it was not
necessary in this case.
Mr. Barr. In other words, there was not one call or effort
made to check out the veracity of what you told the individuals
in order to secure the passes or the codes?
Mr. Malfi. That is correct.
Mr. Barr. Thank you. Mr. LaTourette.
Mr. LaTourette. Thank you very much. Mr. Chairman.
Mr. Malfi, did you or your team actually carry explosives
or firearms into these buildings?
Mr. Malfi. No, we did not.
Mr. LaTourette. And Mr. Barr asked one of the questions,
but all of you have extensive law enforcement experience, each
over 20 years if I heard you correctly earlier. Some missions
that you are assigned to I assume are very, very difficult,
some are very, very easy, and like the three bears some are in
the middle I guess. How would you characterize the difficulty
that you had in accomplishing what you did here in Atlanta?
Mr. Malfi. I would say we did not have much difficulty
accomplishing this assignment. Even though there were some
technical things that we had to do, we had to counterfeit the
passes, but we used basic computerized software to do this, and
it was not really that difficult.
Mr. LaTourette. And again basic computer software, is there
anything extraordinary, any lengths that you had to go to, to
recreate the passes that you have shown us here today?
Anything--could Mr. Barr and I do this if we knew how to work a
computer?
Mr. Malfi. I believe so. I mean the original pass was
scanned, which is a common technology now that is used for
computer printing. It was scanned in, it was worked on a little
bit to get the colors as close as possible, and basically it
was printed out.
The holograms which is a security feature, which is a good
security feature, that appeared on the genuine passes. We did
not duplicate--I mean we could have went through a more high
scale type of technology and could have gotten holograms
produced. I mean you can replicate that type of technology, but
we did not go that far. We strictly produced a flat hologram
that had the appearance if you just looked at it one way that
it looked like there was something there, but it did not do the
effect that an actual hologram does, which is when it hits the
light reflects different colors to it.
Mr. LaTourette. In our earlier discussions with Ms. Sims
and Mr. Shingler it came up that each building has a committee
I guess set up to determine what security is maintained, it is
a security committee; is that correct?
Mr. Shingler. Yes, sir. One of the recommendations from the
original Department of Justice vulnerability assessment that
Congressman Barr referenced was the establishment of building
security committees. Those committees are made up of the
tenants of the building, and they are each represented, each
member is represented.
Mr. LaTourette. Is the adoption of security committees for
each building something again that came out of this DOJ report?
Mr. Shingler. Yes, sir.
Mr. LaTourette. Is it required?
Mr. Shingler. It is required, yes, sir.
Mr. LaTourette. Let me ask you this. Could the General
Services Administration mandate through rule or regulation what
level of security is in each building?
Mr. Shingler. Could we, sir?
Mr. LaTourette. Yes.
Mr. Shingler. Yes, sir.
Mr. LaTourette. Are you aware of any--Ms. Sims, let me ask
you this for the buildings that you are in charge of--are you
aware of any security committee that has adopted a
recommendation that everyone that enters the building go
through the magnetometer?
Ms. Sims. I am not aware of that recommendation.
Mr. LaTourette. Let me ask you, Mr. Malfi, I indicated
before where Mr. Barr and I work everybody goes through the
machines, and the reason is that we have former staffers that
are no longer working on the Hill that do not turn in their
credentials and can gain access to the building, and for
security purposes we ask everybody to go through the machines,
and people understand that I think.
Is there any reason that--well, let me ask you this: If
that had been the policy at these buildings you obviously could
not have carried in briefcases and valises and other things
without going through the magnetometers.
Mr. Malfi. That is correct. The whole purpose of us getting
the building pass was after we did the surveillance on the
buildings we realized that people that had the building passes
were not subject to go through the magnetometers or to have
their belongings x-rayed. So our purpose was to obtain a means
in which we could bypass the magnetometers and x-ray so we
could if we wanted to bring in weapons and explosives into the
building.
Mr. LaTourette. And you talked about the fact that you had
been here before, before you engaged in the attempt to get
passes, and I guess I would ask you the same question. Did you
spend an unusually long amount of time for a law enforcement
operation casing the joint before you reached the conclusions
you did necessary to breach the security of these buildings?
Mr. Malfi. No. We did this fairly quickly. I think it was
two visits that it took us here. Manpower-wise it took about 3
days before we were ready to come back and actually do the
operation.
Mr. LaTourette. Mr. Shingler, Steve Perry who is the
Administrator of GSA has made some observations relative to the
Federal Protective Service which is under your care and
direction. One of the things that he has noted at least to me
in another capacity that I have is that there is a pay
differential that is hard the make up for the Federal
Protective Service, and the one example that he cited was that
there is a $10-an-hour difference between what someone can make
working for the Capitol Hill police force as opposed to the
starting wage in your salary. Is that an accurate observation?
Mr. Shingler. Yes, sir, very accurate.
Mr. LaTourette. Does that create a turnover problem for
you?
Mr. Shingler. Yes, sir, constantly.
Mr. LaTourette. And likewise it is my understanding that
you started, if not this year, a little while ago with 600
FTEs, full time FPS workers, and now you are down to the
neighborhood of 450?
Mr. Shingler. Yes, sir. Turnover is tremendous.
Mr. LaTourette. Has the GSA put together, worked with the
administration in a way to develop legislation to help correct
some of the deficiencies relative to first pay scale, and
second training?
Mr. Shingler. Yes, sir, we have.
Mr. LaTourette. And can we anticipate that in the near
future?
Mr. Shingler. I would say yes, sir.
Mr. LaTourette. And the other deficiency that came up in
some of the hearings, and this was principally brought to our
attention by the officers within the Federal Protective Service
is that there is a variation in the training that some of the
contract guards are subject to in order to be under contract.
Is that an accurate observation?
Mr. Shingler. Yes, sir. As a matter of fact, we have an
active effort to bring some balance to that training effort,
including a drastic increase to that training in what we are
going to call our building security guards, yes, sir.
Mr. LaTourette. And, Mr. Malfi, back to you. It is my
understanding that the equipment was in place at all of these
buildings, and people were in place in all of these buildings,
and the breakdown I guess would be two, and I would like your
comment, one is that when you have a policy that as long as you
have one of these you can bring anything into the building that
you want without having it checked, I would consider that to be
a deficiency, and second of all the deficiency appears to be
human error, that you were permitted to get through with
credentials that were phony, and in one instance where you had
even switched pictures with the other fellow.
Mr. Malfi. Exactly. Basically Congressman Barr brought this
out earlier in his opening statements, that common sense and
diligence is really the key to security, and as long as you
have people that are watching but not paying attention, or
looking and not seeing these type of vulnerabilities will
continue to be a problem.
Mr. LaTourette. And last Mr. Shingler and Ms. Sims, it is
not appropriate to talk about the recommendations that are
attached in the confidential report that followed the briefing
that you received, but I think that the fellow that issued is
named Constable which is a good name I think for someone
involved in law enforcement, but have you reviewed each of you
all of the recommendations contained in that?
Mr. Shingler. Yes, sir, we have.
Ms. Sims. Yes, sir.
Mr. LaTourette. OK. And I would just indicate, and again I
do not think that we should try and surprise people, but I
would just indicate that upon my entrance to this building, re-
entrance that I found that the recommendations contained in Mr.
Constable's report are not being followed, and I am sure that
you will take that to heart and do what is necessary to fix it.
Mr. Shingler. By all means, sir.
Mr. LaTourette. Thank you very much. Thank you, Mr.
Chairman.
Mr. Barr. Thank you, Mr. LaTourette.
It is my understanding that currently FPS, or the Federal
Protective Service is under the control of the Public Building
Service, and does not function as a truly independent security
advocate for Federal facilities. Has the GSA ever considered
moving the FPS out from under the Public Building Service to
allow it to function truly as a law enforcement agency?
Mr. Shingler. We actually are very close to that as of this
moment. The GSA did realign all of the regional offices, much
as this one is, reporting to headquarters. In days past they
used to report to the region itself. Now the Federal Protective
Service is controlled out of the central office headquarters in
Washington. Although we are part of the Public Building
Service, we are a fairly integral part of that effort because a
lot of what we do requires funding, and it is funded out of the
Federal building fund. The Federal building fund is controlled
by the Public Building Service. So we are a totally dedicated
service as of this moment, and we do rely on the funding
mechanisms of the Federal building fund which are controlled by
the Public Building Service.
Mr. Barr. The funding is very important, and as both Mr.
LaTourette and I mentioned earlier, the Congress certainly has
the responsibility there to make sure that all of these
functions are funded properly.
I am not so much interested in the funding mechanism as
separating FPS out so that it truly can function as a law
enforcement agency.
Mr. Shingler. We have complete authority as of this moment,
sir, to do that. I have never had--in the 2-months that I have
been here already we have not had any interference whatsoever
to try to do exactly as you said, to be a full-fledged at-the-
table law enforcement agency.
Mr. Barr. Mr. Malfi, in your experience both in law
enforcement and in these type of investigations involving
Federal facilities do you see that it would help at all--and
this is something we are looking at from a legislative
standpoint as well I suppose--to separate FPS out and give it
more autonomy as a law enforcement agency, as a separate
entity?
Mr. Malfi. Actually I have not thought about or looked into
that aspect of it, and I know GAO has not looked at that, but
based on my experience if you have people that are involved in
law enforcement that are involved in security and they are
answering to people of the same culture with a law enforcement
background things normally seem to run better for that arena
based on the culture and the experience level that you have.
Mr. Barr. With regard to the meeting that you had
immediately following the conclusion of the undercover phase of
your investigation, have steps been taken, Mr. Shingler and Ms.
Sims, since that time, just I guess a little over a month ago--
actually when was that meeting, Mr. Malfi?
Ms. Sims. March 20th.
Mr. Malfi. March 20th.
Mr. Barr. So just about a month ago. And, by the way, let
me say we appreciate your doing that, even more important than
getting your information, or even physically getting back up to
Washington you sat down with the agencies here because you
perceived that there was a very serious problem, something of
which they should be made aware of immediately, and I think
that is very appropriate and commendable.
In followup to that, Mr. Shingler and Ms. Sims, could you
again without revealing any sensitive law enforcement
techniques, tell us some of the steps that have already been
taken to address the deficiencies that GAO discovered.
Ms. Sims. Let me just say that during that March 20th
meeting one of the first things that Agent Malfi said to us is
that there has never been a facility that he has set his sights
on that he has been unable to penetrate, and that is evidenced
by his testimony in which he said that he has been able to
penetrate 19 Federal facilities and two airports.
We at the U.S. General Services Administration take no
consolation in being lumped into that group. We do not make an
excuse by being lumped into that group now.
But what I will say is that within hours of that March 20th
meeting we took immediate, decisive, and what we believed to be
effective steps, probably a dozen steps to further improve
security postures in the Federal facilities, and we are
currently working on at least a dozen more. And that is in
addition to what we have always done prior to September 11th,
prior to the penetrations by the U.S. General Accounting
Office.
Some of those that we have been doing would include
security surveys, would include occupant emergency planning,
would include building security committee meetings, would
include daily contact with the tenants and visitors, and
implementing the feedback that they give us each and every day.
Mr. Barr. Two of the items that Mr. Malfi discussed and
that his colleagues have mentioned also, though, would seem to
be of the sort that would not require a serious problem like
this in order to be directive.
Both prior to and after this investigation will all of
those folks under GSA's or FPS's authority actually look at a
badge physically to determine that it is in fact, or that at
least it appears to be in fact a valid identification pass?
Ms. Sims. Yes, sir. We employ a three-step process by which
we look at the badge, we look at the face of the individual,
and we look again at the badge, and we are confident that those
strategies are currently being employed.
Mr. Barr. That was not the case, though, obviously prior to
the undercover investigation, that three-step process obviously
was not used.
Ms. Sims. I believe that it was used in most cases.
Security is a very unforgiving discipline, and it requires
daily iterative followup, and that includes meeting one-on-one
with contract security guards and the contractor to reiterate
what the ongoing policies and procedures are.
Mr. Barr. With the particular badges that you have
described, if somebody, Mr. Malfi, had simply looked at it even
cursorily and seen that it did not have the proper hologram on
it for example, how many times were collectively you all able
to secure access to Federal buildings based on those badges?
Mr. Malfi. I believe if they would have looked at the
badges first of all they would have definitely caught the fact
that I was using John's building pass because his photograph
appeared on it, not mine.
If they also looked at the passes, all of the counterfeit
building passes should have been detected and those people
should not have been not allowed entry, and a followup
investigation should have occurred. So in all instances----
Mr. Barr. But about how many times did that occur?
Mr. Malfi. On almost all of the entries that we made.
Mr. Barr. I mean a number of times?
Mr. Malfi. We infiltrated the buildings I think on two
occasions. We went back twice. I mean because once we got
through then we wanted to go through at night time with the
crew, you know, with the group, and we saw no need to
continually, you know, for 3 weeks straight go in and out of
these buildings. Once we penetrated it, we got inside, you
know, that operation was over as far as we were concerned.
So I believe there was like two penetrations for most of
the buildings, and one penetration for another.
Mr. Barr. By each one of you?
Mr. Malfi. That is correct.
Mr. Barr. So that would mean at least six penetrations?
Mr. Malfi. Six, and then we had two other undercover agents
that also went into the buildings.
Mr. Barr. And in not one of those instances was the badge
physically inspected?
Mr. Malfi. That is correct.
Mr. Barr. This is the problem that we have, Mr. Shingler.
It may be your belief or your wish that in most instances that
simple step occurs, but apparently in none of these instances--
I mean it is not as if they were stopped most of the time and
looked; it was never looked at. Is that a concern?
Mr. Shingler. It is deeply a concern. Policies are one
thing, all the equipment in the world are another just as Mr.
Malfi said. And I was at the hearing the other day that his
counterpart was at. All the technology in the world is not
going to do you any good if your staff is not there and trained
to identify it and do something with it. We feel that is a key
for us, and training and getting the proper staff is definitely
going to be one of our major efforts. I have already spoken to
Mr. Malfi about--the Federal Protective Service faces a lot of
challenges. This effort has helped us focus and set priorities
for addressing those challenges, and that is what we are
attempting to do, sir.
Mr. Barr. When an initial approach is made as Mr. Malfi and
his colleagues did in order to secure an initial pass, building
pass, and a story is told that obviously is not true, is there
a process now in place that obviously was not in place before
so that in every instance that story is checked out at least
one level?
Mr. Shingler. Yes, sir, that practice is in place now. I
think for the most part most policies were in place, although
we have issued further policy guidance. It was the actual doing
the work, and it is great to talk the talk, but walking the
walk is the thing, and we just were not totally walking the
walk at that point, and I think we are now, sir.
Mr. Barr. As a result of the briefing on March 20th and
this operation generally, have you all been able to identify
particular individuals that committed serious breaches of
security and allowed this to happen, allowed these penetrations
to occur and these false badges to be used?
Mr. Shingler. I misunderstood the question, sir.
Mr. Barr. Have you been able to identify particular
individuals who fell short of the standard that you all
maintain?
Mr. Shingler. Employee-wise, or contractor-wise?
Mr. Barr. Yes.
Ms. Sims. Yes, sir, we have.
Mr. Barr. And has action been taken to correct those
situations?
Ms. Sims. Yes, sir, it has been.
Mr. Barr. Have persons been terminated?
Ms. Sims. No, sir.
Mr. Barr. Have any contract personnel been removed from
those responsibilities?
Ms. Sims. Yes, sir.
Mr. LaTourette. Mr. Barr was talking about the new
technology, and let me just ask if you are based upon your
experience aware of any additional security technologies
including smart cards or biometric devices that you think could
be used to help eliminate some of the human error that was
discovered in this operation, Ms. Sims, and then you, Mr.
Shingler? Are any of those currently under discussion or
consideration by the GSA relative to building security?
Ms. Sims. Yes, sir. GSA in several regions across the
country is currently employing pilot projects which utilize
smart card technology. Certainly if we had our druthers the
Nation would move toward that.
Mr. LaTourette. And just for the benefit of those that do
not know what a smart card is, maybe you could just explain
what it is that those pilot projects are doing.
Ms. Sims. Well, there are variations on it. Up in New York
several buildings utilize smart card technology in which the
individual's--I am sorry. Wendell, would you like to----
Mr. Shingler. Absolutely.
Basically what it is is it is an identification card with a
computer chip inside, and within that computer chip could be a
variety of pieces of information, the person's name, Social
Security number, and a physical picture so that when it comes
up on a computer screen and it is accessed through a reader you
could doubly verify that it is the person on that card and in
person in front of you. So there is a wide variety of checks
within those pieces of equipment.
Biometrics is another issue that we are looking at. Again
as I said in my opening statement I do not know that there is a
silver bullet, but it is definitely one of those items that we
intend to work with the Interagency Security Committee which is
also from the vulnerability assessment that is a government
sharing of information, and that is where we will address a lot
of those areas, especially with the Defense Department who has
done a lot of research into those areas.
Mr. LaTourette. I do not want to get too far afield from
the subject of this hearing in terms of an internal
penetration, but both what happened in Oklahoma City and at the
World Trade Center had to do with things happening externally
to buildings. Has GSA engaged in a study of the properties
under its control relative to external security? Say the
building we are sitting in today?
Mr. Shingler. Yes, sir. We are actively doing that in two
methods. One, the new buildings that the Hill authorizes for
new courthouses and the like, we are looking at new
technologies and old technologies. We are putting seismic
things, designing them into the building that probably were not
used in years past in other than the seismic regions such as
the West Coast. So we are looking at those things.
We have done a lot of research in glass. As you may be
aware, in Oklahoma a lot of people were hurt or injured or
killed because of flying glass, so we have done a lot in the
scientific look-sees at glass.
We are also using a lot to address the existing buildings.
We are looking at set-backs, how we can increase set-backs
using street closures or lane changes, or even just changes to
the surfaces of the buildings. So we are actively looking at
all of those areas.
Mr. LaTourette. And actually one of the not-often-enough-
told stories is one of the women who lost a child in the day
care center in the Murrah Building and started a foundation
called People First, and it has specifically dedicated itself
to the development and research of shatterproof glass for not
only Federal buildings but for also other facilities, and she
is doing wonderful work.
And last, Mr. Malfi, maybe to impress, and I want to
indicate that I guess what concerns me about the answer to Mr.
Barr's question, again when I went outside the building not
only did I get a second visitor's pass, but someone with a
yellow pass just blew right past the guards and the
magnetometer, no one touched the pass, nobody examined the
pass, nobody matched up the picture, and so I know that you are
in here and you have contracted with people to engage in
security, but it appears to me that we are still not quite
there, even in the fact that I assume most of the people in the
building know what we are doing here if they watch television,
so I would think that they would take it a little more
seriously.
And maybe to give the matter some seriousness, Mr. Malfi,
what was the biggest container that you or your agents brought
in in terms of a suitcase that you could put in an overhead
bin, or a briefcase?
Mr. Malfi. We took in a travel bag, a valise-type bag that
could have been used to bring in certain equipment, certain
explosives, anything basically we wanted to bring into the
building.
Mr. LaTourette. And did any of you during the 20-plus years
that each of you had with the Secret Service, do you have
experience with explosives training?
Mr. Malfi. Enough to know to get away from them. That is
about it.
Mr. LaTourette. Are you able to estimate or guesstimate
based upon the size of the valise that you brought in what sort
of damage you could have done to this building if it had been
packed for instance with C4 explosives?
Mr. Malfi. Well, basically depending on where we would have
placed those, how much we would have brought in. It depends. I
mean once you have access to a building and free reign on the
building then you can sort of accomplish basically anything you
want to.
I do not think anybody would have stopped us if we all
walked in carrying two large duffel bags each. I mean we had
the building passes that allowed us to bypass the magnetometers
and the x-rays. The main thing is that technology is not a
cure-all for security, money is not a cure-all for security.
The bottom line is that due diligence is really the most vital
factor in regards to any type of security that you have set up.
People have to be diligent in what they are hired to do,
they have to adhere to the policies and understand why those
policies are in effect so that it makes sense to them so that
they could prevent things like this from going on.
Mr. LaTourette. And part of that is not only going over
things, but it is training, and it is also compensating
somebody at a rate that motivates them to do their job I would
assume.
Mr. Malfi. That is correct.
Mr. LaTourette. Thank you very much.
Mr. Barr. Going back, Mr. Malfi, to the one aspect of the
badges, you say there was the designation on the badges that
allowed the person, or indicated that the person possessing the
badge could carry firearms into the building. What was done in
order to secure that additional authority?
Mr. Malfi. Basically Agent Cooney just did a little social
engineering in regards to having that person put that extra
feature on that badge.
Mr. Barr. In other words, he just gave them a story that he
needed to carry a firearm?
Mr. Malfi. In the conversation it came up that he may need
this, and he says, yeah, he says I definitely could use this,
and they put it on. So it was volunteered, right, John?
Mr. Cooney. Correct. I did not have to explain in detail
what the need for a firearm was. I just said I would be coming
in with firearms at some time, and they said ``Well, then you
need this feature on it,'' and I said ``Yes, I would like to
have that.'' They were very willing.
Mr. Barr. What steps have been taken to correct that
particular deficiency in the wake of this investigation? Ms.
Sims.
Ms. Sims. Would you elaborate on the question, please?
Mr. Barr. Not really on the question, but what steps have
been taken to address that particular deficiency? In other
words, the ease with which the undercover officer was able to
get the designation on the badge that allowed them to bring
firearms in without having to explain or provide any sort of
documentation at all.
Ms. Sims. Without getting too detailed on our security
protocols, there are at least a half dozen steps that we have
taken specifically to that element of building entry. One would
include tightening up the policies and procedures associated
with the issuance of the badge. The actual badge issuance
procedure has changed in terms of who issues the badge, the
actual application for the badge has changed, and the
validation process by which we issue the badge has changed and
tightened up.
Mr. Barr. We have been talking generally today very
specifically about the facilities here in Atlanta in Region 4.
Are the measures that we have been talking about here today
being implemented across the country in all regions of the
country, in all facilities under the jurisdiction and control
and responsibility of GSA and FPS?
Mr. Shingler. The specific ones that are being done here
may not necessarily be, but the intent is each of Sabina's
counterparts, the regional directors in the balance of the
country are specifically addressing similar types of issues.
Some of the ID card issuance procedures are different from
location to location, but the ultimate intent of tightening up
our security of getting in and out of buildings is definitely
being addressed nationally, sir.
Mr. Barr. I mean it would seem to me that what we are
talking about here is just so basic, namely not just giving
somebody a designation to carry a firearm into a Federal
building without asking any questions or checking anything out,
but the issue of simply checking to see whether the person that
they say they are coming to see actually needs to see them,
physically looking at a badge, and these are all so basic I am
somewhat at a loss to understand why we cannot have the
assurance today that they are in fact being implemented in all
GSA regions for all Federal buildings.
Mr. Shingler. No. Absolutely, sir. I misunderstood what you
were asking. Yes, sir, that is happening. They have tightened
up security nationally. I misunderstood what you were talking
about, the holograms and one thing or another.
Mr. Barr. So as we sit here today can you assure us in the
Congress and the American people that at least these specific
steps that we have identified here today as being deficiencies
in Federal building security are being addressed, have been
addressed, and will continue to be addressed properly?
Mr. Shingler. Yes, sir.
Mr. Barr. Ms. Sims.
Ms. Sims. Absolutely.
Mr. Barr. We talked earlier about the different levels of
security for the Federal buildings, and we have pictures of the
different Federal buildings, at least five of them here in the
Atlanta area. What is the level of security for each one of
these buildings?
Mr. Shingler. They are all Level 4 facilities.
Mr. Barr. And if you could just explain briefly what Level
4 means.
Mr. Shingler. The vulnerability assessment, the DOJ
vulnerability assessment categorized virtually all Federal
buildings in one of five levels. Primarily the first four, 1
through 4, are the ones that we deal with. The fifth level are
those agencies such as the Pentagon, or the CIA headquarters
where they may employ their own security requirements. But the
1 through 4 levels are based on a variety of things, primarily
how many people are in them, the size of the building, the type
of mission that goes on within the building, the threat
assessments that could happen, from the shopping center type of
recruiting office all the way to a building of this magnitude
here in Atlanta. So that is where they range between the 1
through 4 levels.
Mr. Barr. The buildings earlier, in your earlier
investigation 2 years ago, Mr. Malfi, were they all Level 4
facilities?
Mr. Malfi. I believe a lot of those buildings were Level 5.
Mr. Barr. In other words, even a higher level of security
and vulnerability associated with them?
Mr. Malfi. That is correct.
Mr. LaTourette. Mr. Shingler, if I could just have one more
sort of housekeeping question, Mr. Barr was talking about where
the money comes for the Federal Protective Service, and it does
come from the Public Building side of GSA, and it is my
understanding that the tenants, for instance if the Internal
Revenue Service is in a GSA-operated building that they pay you
so much per square foot or whatever to provide security. Am I
right about that?
Mr. Shingler. Yes, sir. For the most part there is an
across-the-board charge, and each square foot of rent an X
percent goes to security. And then there are building-specific
charges that are added onto that which in some cases there are
multiple entrances that they may want to have guards at, or
anything that is above what the basic security charge covers.
Mr. LaTourette. And GSA could by regulation--we have
already I think said this--but GSA by regulation could require
everybody that comes into this building to go through the
magnetometer, but you have chosen not to do that, you have
chosen to leave it up to the security committees.
Mr. Shingler. Yes, sir.
Mr. LaTourette. I think I would ask you to chat with Mr.
Perry and see if that could be reevaluated. But likewise are
there lease arrangements because not every building that you
operate is a government-owned building, there are also leased
buildings that you lease on behalf of the government. Are there
restrictions by landlords, or are there lease restrictions that
somehow impede your ability to protect the men and women of the
Federal work force and the people that visit them?
Mr. Shingler. Balancing security with openness is a primary
issue that we are constantly addressing. One of our biggest
challenges right now are leased facilities, but we are working
closely with the Interagency Security Committee to come up with
a minimal standard to implement security in leased locations.
We are also working with organizations such as BOMA,
Building Owners and Managers Association, to come up with
standards that not only they can live with, but meet our needs
of protecting our government employees. So we are actively
addressing those issues, sir.
Mr. LaTourette. Are any of the buildings that we are
talking about today in Atlanta leased, or does the Federal
Government own them all?
Ms. Sims. We own them all.
Mr. LaTourette. You own them all.
Ms. Sims. Yes, sir.
Mr. LaTourette. Thank you very much.
Ms. Sims. Excuse me, let me correct. The Sam Nunn Atlanta
Federal Center is a complex lease-to-own financial deal. At the
end of a period of time we will own that facility.
Mr. LaTourette. But do you currently on behalf of the
Federal agencies that are located there, do you lease it from
someone at the moment?
Ms. Sims. Yes, sir.
Mr. LaTourette. OK. Are there any restrictions--I guess
that is what I want to get to--are there any restrictions in
the lease that prevent you or hinder you from engaging in the
security that you engage in in a wholly owned Federal building?
Ms. Sims. At that facility no. That facility is operated as
if it were ours from a security stance.
Mr. LaTourette. Thank you very much.
Ms. Sims. Sure.
Mr. Barr. The investigation, the undercover investigation
that took place in early March, and we have identified what I
presume we would all agree are serious security problems, the
failure to look at a badge, the ease with which somebody gets
the badge based on a false pretense that was not checked out,
the additional volunteering of the designation to be able to
carry firearms in, agents giving an access code to these
undercover agents without checking them out properly, would
everybody here agree that those things should not have
occurred?
Ms. Sims. Yes, sir.
Mr. Barr. What specific steps--and were those problems,
were those errors made by both contract personnel and FPS
employees?
Ms. Sims. Employee singular, and contract employee
singular. Yes, sir.
Mr. Barr. And are there any limitations under which GSA or
FPS now operates that would prevent effective disciplinary
action being taken against either employees or contract
personnel for identified security lapses such as these?
Ms. Sims. The contract employee referenced in the scenarios
no longer provides the service to the U.S. General Services
Administration.
With respect to the GSA employee, that employee has been
reprimanded.
Mr. Barr. Is that sufficient in your view? Are there--I
guess I am asking a more general question. Are there any
limitations under which you all have to operate now that would
prevent you in any way from taking what you believe is
effective disciplinary action against an employee that commits
a serious error in security? Do you have sufficient authority?
Ms. Sims. Yes, sir, we do.
Mr. Barr. Does that include termination of an employee?
Ms. Sims. If it were deemed appropriate, yes, sir, it most
definitely would include up to termination.
Mr. Barr. OK. And you do have the ability to terminate the
services of a contractor similarly, and you have plenty of
authority to do that?
Ms. Sims. Unilaterally and very quickly.
Mr. Barr. Thank you.
Do any of you all have anything additional that you would
like to add for the record today that we might not have gone
over, or to supplement anything that we have touched on today?
Mr. Shingler. We appreciate the opportunity to be here.
Mr. Barr. Thank you.
As I indicated--do you have anything else, Mr. LaTourette?
Mr. LaTourette. I do not. Thank you.
Mr. Barr. Counsel?
As I indicated, the record will be kept open for 10 days so
that if there are any additional materials that you would like
to submit.
And let me ask just one final question I forgot. With
regard to followup measures, is this an ongoing process, Mr.
Shingler or Ms. Sims?
Mr. Shingler. We will constantly be following up, because
weapons and terrorist activities have changed drastically.
Hopefully we will never be able to sit here and say we have
done everything we could do, because we will constantly adjust
to that.
Mr. Barr. Now, we have purposely not gone into in this
public setting all of the details of the security breaches,
which is good both from the standpoint that we have not
indicated a specific road map or game plan that somebody could
use, and I think people would be shocked even at some of the
details that we did not go into here, the ease with which the
security breaches were effectuated, but knowing, Mr. Shingler
and Ms. Sims, as you do the full details of this undercover
investigation here, can you assure us that if that same
operation were carried out tomorrow it would very clearly not
succeed?
Mr. Shingler. Yes, sir, I can say that.
Mr. Barr. Ms. Sims.
Ms. Sims. I am confident that we have taken the steps that
we need to take, and that we are continuing to take the daily
iterative steps that we need to protect the people and the
properties, and the daily visitors who frequent our facilities.
Mr. Barr. I mean this is not a trick question at all. I am
just wondering if as you sit here today you feel confident that
if this same type of operation were carried out tomorrow that
it would not succeed. Do you feel confident in that?
Ms. Sims. As I said, I am confident in the fact that we
have done everything, and we continue to do everything to
protect the people and the properties.
What is a little bit frustrating is that with the state of
technology today is it difficult to discern fake
identification.
Mr. Barr. No, it is not. I mean that is the whole point of
this hearing. I mean it is not. This is one that has the proper
hologram, this is one that is not. It is not difficult to tell
that one does not have the proper hologram and that one does.
Yes, there certainly other aspects of falsification of
identification that are much more difficult to discern, you are
absolutely correct, but the undercover operation that was
effected here is something that a high school student--I mean
no insult to these gentlemen, but they especially and
consciously dumbed down their operation. Is that correct, Mr.
Malfi, that you sort of dumbed it down, you used the lowest
level of technology to thwart the security measures; right?
Mr. Malfi. Correct. To duplicate the building passes, like
I said, we did not use anything that was sophisticated. We used
something that was accessible to the general public.
I mean we could have--with the technology that is available
to us we could have duplicated these things very, very close to
the originals. That was not our intent. Our intent was to give
basically a fighting chance to show that if somebody paid
attention to these things it would have been detected.
Mr. Barr. And that is sort of my point, Ms. Sims, and I
come back to it again. I am not talking about the more
sophisticated measures that somebody might come up with and
that we have to be continually on guard against, just with
regard to these most elementary measures that thwarted security
measures at Federal buildings here in Atlanta, can you give us
your assurance that at least this level of threat has been
taken care of and if this type of operation, not a more
sophisticated one, and we hope the answer would be the same for
that, but just for this level of security breach are there
measures in place today so that if the same type of operation
were attempted tomorrow you feel confident that it would not
succeed?
Ms. Sims. Yes, sir, I am confident that the scenarios
employed would not meet with the success before, yes, sir.
Mr. Barr. OK. We appreciate very much the time and effort
that our witnesses from GAO put in in traveling down here, and
we also appreciate very much the swift response and continuing
effort by Mr. Shingler, Ms. Sims, and their colleagues and the
other Federal agencies in addressing these problems.
And with that I would like to thank Mr. LaTourette for
traveling here from the great State of Ohio today and being
with us. I appreciate counsel and the committee staff for all
of the preparatory work here, and I hereby declare this hearing
of the Government Reform Committee closed.
[Whereupon at 11:55 a.m., the committee was concluded.]
[Additional information submitted for the hearing record
follows:]
[GRAPHIC] [TIFF OMITTED] 80883.013
[GRAPHIC] [TIFF OMITTED] 80883.014
[GRAPHIC] [TIFF OMITTED] 80883.015
[GRAPHIC] [TIFF OMITTED] 80883.016
[GRAPHIC] [TIFF OMITTED] 80883.017
[GRAPHIC] [TIFF OMITTED] 80883.018
[GRAPHIC] [TIFF OMITTED] 80883.019
[GRAPHIC] [TIFF OMITTED] 80883.020
[GRAPHIC] [TIFF OMITTED] 80883.021
[GRAPHIC] [TIFF OMITTED] 80883.022
[GRAPHIC] [TIFF OMITTED] 80883.023
[GRAPHIC] [TIFF OMITTED] 80883.024
[GRAPHIC] [TIFF OMITTED] 80883.025
[GRAPHIC] [TIFF OMITTED] 80883.026
[GRAPHIC] [TIFF OMITTED] 80883.027
[GRAPHIC] [TIFF OMITTED] 80883.028
[GRAPHIC] [TIFF OMITTED] 80883.029
[GRAPHIC] [TIFF OMITTED] 80883.030
[GRAPHIC] [TIFF OMITTED] 80883.031
[GRAPHIC] [TIFF OMITTED] 80883.032
[GRAPHIC] [TIFF OMITTED] 80883.033
[GRAPHIC] [TIFF OMITTED] 80883.034
[GRAPHIC] [TIFF OMITTED] 80883.035
[GRAPHIC] [TIFF OMITTED] 80883.036
[GRAPHIC] [TIFF OMITTED] 80883.037
[GRAPHIC] [TIFF OMITTED] 80883.038
[GRAPHIC] [TIFF OMITTED] 80883.039
[GRAPHIC] [TIFF OMITTED] 80883.040
[GRAPHIC] [TIFF OMITTED] 80883.041
[GRAPHIC] [TIFF OMITTED] 80883.042
[GRAPHIC] [TIFF OMITTED] 80883.043
[GRAPHIC] [TIFF OMITTED] 80883.044
[GRAPHIC] [TIFF OMITTED] 80883.045
[GRAPHIC] [TIFF OMITTED] 80883.046
[GRAPHIC] [TIFF OMITTED] 80883.047
[GRAPHIC] [TIFF OMITTED] 80883.048
[GRAPHIC] [TIFF OMITTED] 80883.049
[GRAPHIC] [TIFF OMITTED] 80883.050
[GRAPHIC] [TIFF OMITTED] 80883.051
[GRAPHIC] [TIFF OMITTED] 80883.052
[GRAPHIC] [TIFF OMITTED] 80883.053
[GRAPHIC] [TIFF OMITTED] 80883.054
-