[House Hearing, 113 Congress] [From the U.S. Government Publishing Office] FACILITY PROTECTION: IMPLICATIONS OF THE NAVY YARD SHOOTING ON HOMELAND SECURITY ======================================================================= HEARING before the SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY of the COMMITTEE ON HOMELAND SECURITY HOUSE OF REPRESENTATIVES ONE HUNDRED THIRTEENTH CONGRESS FIRST SESSION __________ OCTOBER 30, 2013 __________ Serial No. 113-40 __________ Printed for the use of the Committee on Homeland Security [GRAPHIC] [TIFF OMITTED] TONGRESS.#13 Available via the World Wide Web: http://www.gpo.gov/fdsys/ __________ U.S. GOVERNMENT PRINTING OFFICE 87-184 WASHINGTON : 2014 ----------------------------------------------------------------------- For sale by the Superintendent of Documents, U.S. Government Printing Office, http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected] COMMITTEE ON HOMELAND SECURITY Michael T. McCaul, Texas, Chairman Lamar Smith, Texas Bennie G. Thompson, Mississippi Peter T. King, New York Loretta Sanchez, California Mike Rogers, Alabama Sheila Jackson Lee, Texas Paul C. Broun, Georgia Yvette D. Clarke, New York Candice S. Miller, Michigan, Vice Brian Higgins, New York Chair Cedric L. Richmond, Louisiana Patrick Meehan, Pennsylvania William R. Keating, Massachusetts Jeff Duncan, South Carolina Ron Barber, Arizona Tom Marino, Pennsylvania Dondald M. Payne, Jr., New Jersey Jason Chaffetz, Utah Beto O'Rourke, Texas Steven M. Palazzo, Mississippi Tulsi Gabbard, Hawaii Lou Barletta, Pennsylvania Filemon Vela, Texas Chris Stewart, Utah Steven A. Horsford, Nevada Richard Hudson, North Carolina Eric Swalwell, California Steve Daines, Montana Susan W. Brooks, Indiana Scott Perry, Pennsylvania Mark Sanford, South Carolina Greg Hill, Chief of Staff Michael Geffroy, Deputy Chief of Staff/Chief Counsel Michael S. Twinchek, Chief Clerk I. Lanier Avant, Minority Staff Director ------ SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY Jeff Duncan, South Carolina, Chairman Paul C. Broun, Georgia Ron Barber, Arizona Lou Barletta, Pennsylvania Donald M. Payne, Jr., New Jersey Richard Hudson, North Carolina Beto O'Rourke, Texas Steve Daines, Montana, Vice Chair Bennie G. Thompson, Mississippi Michael T. McCaul, Texas (Ex (Ex Officio) Officio) Ryan Consaul, Subcommittee Staff Director Deborah Jordan, Subcommittee Clerk Tamla Scott, Minority Subcommittee Staff Director C O N T E N T S ---------- Page Statements The Honorable Jeff Duncan, a Representative in Congress From the State of South Carolina, and Chairman, Subcommittee on Oversight and Management Efficiency: Oral Statement................................................. 1 Prepared Statement............................................. 3 The Honorable Beto O'Rourke, a Representative in Congress From the State of Texas............................................. 4 The Honorable Ron Barber, a Representative in Congress From the State of Arizona, and Ranking Member, Subcommittee on Oversight and Management Efficiency: Prepared Statement............................................. 5 The Honorable Bennie G. Thompson, a Representative in Congress From the State of Mississippi, and Ranking Member, Committee on Homeland Security: Prepared Statement............................................. 6 Witnesses Mr. L. Eric Patterson, Director, Federal Protective Service, U.S. Department of Homeland Security: Oral Statement................................................. 8 Joint Prepared Statement....................................... 10 Mr. Greg Marshall, Chief Security Officer, U.S. Department of Homeland Security: Oral Statement................................................. 16 Prepared Statement............................................. 18 Mr. Caitlin Durkovich, Assistant Secretary, Infrastructure Protection, U.S. Department of Homeland Security, Testifying on Behalf of The Interagency Security Committee: Oral Statement................................................. 20 Joint Prepared Statement....................................... 10 Mr. Mark L. Goldstein, Director, Physical Infrastructure Issues, U.S. Government Accountability Office: Oral Statement................................................. 22 Prepared Statement............................................. 24 Appendix Question From Chairman Jeff Duncan for L. Eric Patterson......... 51 Questions From Ranking Member Ron Barber for L. Eric Patterson... 51 Questions From Chairman Jeff Duncan for Caitlin Durkovich........ 53 Question From Chairman Jeff Duncan for Greg Marshall............. 53 Questions From Ranking Member Ron Barber for Greg Marshall....... 54 Questions From Chairman Jeff Duncan for Mark L. Goldstein........ 55 Questions From Ranking Member Ron Barber for Mark L. Goldstein... 55 FACILITY PROTECTION: IMPLICATIONS OF THE NAVY YARD SHOOTING ON HOMELAND SECURITY ---------- Wednesday, October 30, 2013 U.S. House of Representatives, Subcommittee on Oversight and Management Efficiency, Committee on Homeland Security, Washington, DC. The subcommittee met, pursuant to call, at 9:32 a.m., in Room 210, Cannon House Office Building, Hon. Jeff Duncan [Chairman of the subcommittee] presiding. Present: Representatives Duncan, Hudson, Barber, and O'Rourke. Also present: Representative Jackson Lee. Mr. Duncan. All right. The House Committee on Homeland Security, Subcommittee on Oversight and Management Efficiency will come to order. The purpose of this hearing is to examine what the Department of Homeland Security is currently doing to protect Federal facilities and what steps, if any, need to be taken to improve current layers of security, so that incidents such as the Navy Yard shooting do not occur in the future. Now, this isn't our normal committee room, so we are going to work through some things today, I am sure. But I will now recognize myself for an opening statement. The events that took place on September 16 at the Washington Navy Yard, less than 2 miles from where we are right now, were shocking and tragic. Twelve innocent lives were lost that day, along with several injured. Our thoughts and prayers go out to the families of the victims and those survivors and the folks that work as co-workers in the Navy Yard. While much of the security of this horrific event will rightly focus on how someone in Aaron Alexis' mental state was able to pass a Governmental background investigation and to hold a security clearance, today's hearing will concentrate on the physical preventative security measures that are currently in place for our Federal facilities. How do we control access to these facilities to protect both employees and public visitors? What physical security measures, if any, can be taken to prevent future tragedies? The Federal Protective Service, or FPS, is charged with protection of Federal facilities and safeguarding Federal employees, contractors, and visitors within those facilities. FPS is the primary agency for protecting and securing almost 50 percent of the General Service Administration's, or GSA's, owned or leased properties. That is about 9,600 facilities Nation-wide. As the front-line personnel charged with the daily safety of Federal employees and visitors, it is crucial that this workforce is adequately trained and prepared to respond at moment's notice. I strongly support the public/private partnership model that DHS uses with the contract guard force. Having private guards can increase the accountability for the taxpayer, but DHS cannot be deficient in its management responsibilities and must deploy the right number of guards, based on risk. Unfortunately, according to the Government Accountability Office, or GAO, report that was released today, the Federal Protective Service has many weaknesses with the oversight and management of the guard program. For example, FPS continues to lack effective management controls to ensure that all guards have met their certification and training requirements. GAO has previously urged FPS to develop a management control system to document and verify training in reports submitted to Congress in 2010 and 2012, but FPS has yet to implement this recommendation. Without such a system, how can FPS know and ensure that its guard force is sufficiently trained? It seems common-sense to me that FPS should be able to verify that its guards are trained and certified properly, especially when others trust and rely on FPS guards for their protection. One of the most shocking findings in the most recent GAO report is FPS' inadequate approach to active-shooter scenarios. From the Holocaust Museum shooting in 2009 and the Navy Yard shooting to the most recent Federal courthouse shooting in Wheeling, West Virginia, in October, examples exist of the risk FPS and facility guards must confront from active-shooter scenarios. While FPS does require its guard force to receive training on active-shooter situations, it is unclear how this training is conducted and for what length of time. GAO also noted that not all guards receive this training, and, even for those that have, it is unclear how their contract guards are expected to respond to an active shooter. According to DHS, if an active shooter is not in a guard's line of sight, that guard's actions are then dictated by his or her post orders. So, does that mean that if an active shooter is in the building, killing innocent people, an armed guard is not allowed to assist until Federal or local law enforcement arrive at the scene? If this is the case, then DHS' bureaucratic process is putting lives at risk. The American people need to know how these guards can protect them in life-threatening situations, and I am looking forward to DHS providing clarity on this issue today. As an additional layer of security, Federal employees are required to carry valid identification credentials for admittance into Federal facilities. As a Federal Government contractor, Aaron Alexis had valid identification, which gave him access to the Naval Sea Systems Command headquarters, and that enabled him to pass through security. While some buildings only require an ID to be used as a flash pass or visually inspected, other facilities require verification by use of a credential access control system, or swiping of the card. Although the second scenario may provide higher security against individuals using fraudulent or expired and flagged credentials, it was discouraging to learn from my staff that DHS officials informed them that the department currently is not aware of the type of access control systems in place across DHS facilities. How, after 10 years, does the Department not have a handle on what measures are in place to secure their own employees, let alone the general public, at Federal facilities? I want to know precisely what DHS is doing to obtain this information and when it will have a full and complete grasp of the issue. Considering the heinous events which took place just close by at the Navy Yard, it is important to ensure that the security framework in place at our Federal facilities is strong and effective. The Federal Protective Service and its contract guard force put their lives on the line every day on a daily basis to protect the American people, and I want to thank them for their service and the tremendous amount of heroism that was exhibited in the Navy Yard. I hope this hearing can serve as an opportunity to assess the state of physical security across Federal facilities and what DHS must do to improve the protection of employees and visitors to these facilities and prevent future tragedies as we recently witnessed. [The statement of Chairman Duncan follows:] Statement of Chairman Jeff Duncan October 30, 2013 The events that took place on September 16 at the Washington Navy Yard--less than 2 miles from where we are right now--were shocking and tragic. Twelve innocent lives were lost that day along with several injured. While much of the scrutiny of this horrific event will rightly focus on how someone in Aaron Alexis's mental state was able to pass a Government background investigation and to hold a security clearance, today's hearing will concentrate on the physical preventative security measures that are currently in place at our Federal facilities. How do we control access to these facilities to protect employees and public visitors? What physical security measures, if any, can be taken to prevent future tragedies? The Federal Protective Service (FPS) is charged with the protection of Federal facilities and the safeguarding of Federal employees, contractors, and visitors within those facilities. FPS is the primary agency for protecting and securing almost 50% of the General Services Administration's (GSA) owned or leased properties. That's about 9,600 facilities Nation-wide. As the front-line personnel charged with the daily safety of Federal employees and visitors, it is crucial that this workforce is adequately trained and prepared to respond at a moment's notice. I strongly support the public-private partnership model DHS uses with the contract guard force. Having private guards can increase accountability for the taxpayer but DHS cannot be deficient in its management responsibilities and must deploy the right number of guards based on risk. Unfortunately, according to a Government Accountability Office (GAO) report that was released today, the Federal Protective Service has many weaknesses with the oversight and management of their guard program. For example, FPS continues to lack effective management controls to ensure that all guards have met their certification and training requirements. GAO has previously urged FPS to develop a management control system to document and verify training in reports submitted to Congress in 2010 and 2012, but FPS has yet to implement this recommendation. Without such a system, how can FPS know and ensure that its guard force is sufficiently trained? It seems common-sense to me that FPS should be able to verify that its guards are trained and certified properly-- especially when others trust and rely on FPS guards for their protection. One of the most shocking findings in this most recent GAO report is FPS's inadequate approach to active-shooter scenarios. From the Holocaust Museum shooting in 2009, and the Navy Yard shooting to the most recent Federal courthouse shooting in Wheeling, West Virginia in October, examples exist of the risks FPS and facility guards must confront from active-shooter scenarios. While FPS does require its guard force to receive training on active-shooter situations, it is unclear how this training is conducted and for what length of time. GAO also noted that not all guards received this training, and even for those who have, it is unclear how their contract guards are expected to respond to an active shooter. According to DHS, if an active shooter is not in a guard's line of sight, that guard's actions are then dictated by his or her post orders. So does that mean that if an active shooter is in the building, killing innocent people, an armed guard is not allowed to assist until Federal or local law enforcement arrive at the scene? If this is the case, then DHS's bureaucratic process is putting lives at risk. The American people need to know how these guards can protect them in life- threatening situations. I am looking forward to DHS providing clarity on this issue today. As an additional layer of security, Federal employees are required to carry valid identification credentials for admittance into Federal facilities. As a Federal Government contractor, Aaron Alexis had valid identification which gave him access to the Naval Sea Systems Command headquarters which enabled him to pass through security. While some buildings only require an ID to be used as a ``flash pass'' or visually inspected, other facilities require additional verification by use of a credential access control system, or ``swiping'' of the card. Although the second scenario may provide higher security against individuals using fraudulent or expired and flagged credentials, it was discouraging to learn from my staff that DHS officials informed them that the Department currently is not aware of the type of access control systems in place across DHS facilities. How, after 10 years, does the Department not have a handle on what measures are in place to secure their own employees, let alone the general public at Federal facilities? I want to know precisely what DHS is doing to obtain this information and when it will have a full grasp of this issue. Considering the heinous events which took place at the Navy Yard, it is important to ensure that the security framework in place at our Federal facilities is strong and effective. The Federal Protective Service and its contract guard force put their lives on the line on a daily basis to protect the American people, and I thank them for their service. I hope this hearing can serve as an opportunity to assess the state of physical security across Federal facilities and what DHS must do to improve protection of the employees and visitors to these facilities and prevent future tragedies. Mr. Duncan. The Chairman will now recognize the Ranking Member of the subcommittee, the gentleman from Texas who is sitting in for the Ranking Member, Mr. Barber. But the gentleman from Texas, Mr. O'Rourke, is recognized for an opening statement. Mr. O'Rourke. Thank you. I want to thank Chairman Duncan for calling and organizing today's hearing. I want to thank the witnesses for their testimony, in advance, and I want to thank them in advance for answering our questions. I want to thank the committee staff from both sides for doing all the leg work to get us ready for today. I also want to extend my condolences to the families and survivors from those horrific events last month. I know that any time there is a hearing like this or the issue reappears in the news, that has to open up those memories again, and must cause some additional pain and heartache for those who are involved. So I want to make sure that we use today's hearing to learn what we can from what took place, and to apply those lessons to ensuring or trying to ensure that we don't have a repeat of this event at a Federal facility in the future. I also want to make sure that we are proportionate in our response to what we learn. As the Chairman said, we want to have the right number of guards proportionate to the risk that we understand to take place. These are, after all, public buildings. We want to make sure that we don't so fortify them that we exclude the public, that we create an impression that the public is not welcome, that we make it unduly difficult for people to access Government, to receive the services that they are paying for. They should have the right to expect to access. I also hope that we will be able to explore the true cost of contracting services, using contractors versus dedicated civil servants or professionals who are in those jobs for their careers. There is a balance that we have to strike in terms of cost savings and efficiencies versus some level of dependability and building a culture that might, in fact, ultimately prevent these kinds of activities in the future. I hope that, in closing, and I want to be brief because I want to get to the testimony from our witnesses, I hope that we use what we learn from horrific events like these--and unfortunately there are far too many over the last few years-- to strike that right balance in all of those areas. So I look forward to the testimony, to applying those lessons, to the Chairman's leadership in making sure that we strike that balance. With that, I will conclude and yield back to the Chairman. Mr. Duncan. I thank the gentleman from Texas. Other Members of the subcommittee are reminded that opening statements may be submitted for the record. [The statements of Ranking Members Barber and Thompson follow:] Statement of Ranking Member Ron Barber October 30, 2013 Thank you, Chairman Duncan, for holding this very important hearing to examine how extensively standards for Federal facility security are being followed to ensure the safety of Federal personnel and visitors to these buildings. Across the country, we are experiencing a rise in attempts by individuals to shoot at or otherwise attack Federal facilities, and it is both timely and critical that we hear today from Department officials and other witnesses about the efficacy of the standards put in place by the Interagency Security Committee to protect our people as well Federal facilities. In addition to my own personal experience as the unintended victim of a shooting incident, we seem to get all-too-frequent news reports of attempts by mentally unstable or disgruntled individuals who open fire at Federal facilities. I will be interested to hear today from the witnesses how effective they think the Interagency Security Committee has been to date not only in establishing a set of physical security standards, but also in providing enough guidance to Federal agencies and departments to increase their adoption of these standards. It is not sufficient to issue standards--it is also incumbent upon the Interagency Security Committee and the Federal Protective Service, or FPS, as the implementing agency to make sure that Executive branch agencies understand how the Government's standards for physical security can best be utilized. In the Government Accountability Office or GAO report issued at Ranking Member Thompson's request in January, GAO states that the Interagency Security Committee's standards are frequently the second choice of Federal physical security managers after their own institutional knowledge. This is a troubling finding by GAO, and given the recent uptick in attempted shootings at Federal facilities, it is incumbent upon all of us to assist the Interagency Security Committee in strengthening its outreach and guidance regarding its standards for the safety of all Federal personnel and visitors. In addition, GAO states in their testimony that Federal facility security is further jeopardized by FPS' on-going mismanagement of its contract guard force, and alarmingly, but the agency's failure to ensure that its guards receive the required active-shooter response training that would best prepare them to protect Federal facilities. Further, GAO's testimony indicates that FPS and several other Federal agencies are not currently using an appropriate methodology to assess risk at Federal facilities which only increases the vulnerability of those who work in or visit Federal buildings. I look forward to hear the witnesses address these and other pertinent issues related to Federal facility security. ______ Statement of Ranking Member Bennie G. Thompson The purpose of this hearing is to review the security protocols in place to safeguard Federal facilities and the Federal personnel who work within them, and the visitors to those buildings. I am a long- standing observer of the Federal Protective Service, or FPS, and at the beginning of this Congress, I reintroduced my legislation, H.R. 735, the Federal Protective Service Improvement and Accountability Act of 2013. My legislation seeks to move FPS away from its over-reliance on contract security guards, and to instead build up the agency's internal capacity. Also, at my request, the Government Accountability Office has produced 10 reports related to FPS, the most recent of which pertains to today's topic of Federal facility security protocols and which was released in January of this year. We are all cognizant of the recent shooting at the Navy Yard on September 16, yet incidents of active shooters who breach Federal facilities have become all too commonplace. In my own home district of Jackson, Mississippi, a man was arrested on October 2 for attempting to walk inside the Veterans Affairs regional affairs office with a pistol and was then recommended to undergo a psychiatric evaluation. Some other recent examples of individuals who have attempted to open fire on Federal facilities include a former police officer in Wheeling, West Virginia who fired more than 20 shots at a Federal courthouse located there on October 8 of this year; on February 15, 2012, an ICE agent shot and killed one colleague and wounded another in the Federal building in Long Beach, California; and a bag containing an improvised explosive device, or IED, was left undetected for several weeks inside the Federal building in Detroit, Michigan in February 2011. An FPS contract guard brought the bag inside the building and placed it under a screening console where the IED remained in the bag until it was discovered 21 days later. Clearly, we must ensure that the personnel who oversee physical security programs at our Federal facilities are adhering closely to the uniform set of standards provided by the Interagency Security Committee. In 1995, after the bombing of the Alfred P. Murrah Federal building in Oklahoma City, President Bill Clinton signed Executive Order 12977. As an outcome of Executive Order 12977, the Interagency Security Committee was created to produce a coherent set of physical security standards that can be tailored to meet the diverse needs of Federal agencies and departments. This hearing should allow us to determine how closely Federal agencies and departments are complying with the Interagency Committee's security protocols, and demonstrate what remaining outreach work DHS must undertake to make sure that its physical security protocols are being implemented and adhered to in the interest of National safety. Mr. Duncan. We are pleased to have a distinguished panel of witnesses before us today on this important topic. Let me remind the witnesses that their entire written statement will appear in the record. I will introduce each of you first and then I will recognize you individually for your testimony. Members of the Committee may come and go today. There is a lot going on on the Hill with mark-ups and other committee hearings on a Wednesday morning. So Members may come and go as the committee progresses. So let me start off by introducing the witnesses. The first one is Mr. L. Eric Patterson. Eric was appointed director of the Federal Protective Service, a subcomponent of the National Protection and Programs Directorate of the Department of Homeland Security in September 2010. Mr. Patterson previously served as deputy director of defense, counterintelligence, and HUMINT center at the Defense Intelligence Agency, DIA. Prior to joining DIA, Mr. Patterson served as a principal with Booz Allen Hamilton, where he supported two of the Defense Technical Information Center analysis centers. Mr. Patterson is a retired United States Air Force brigadier general with 30 years of service. Sir, thank you for your service to our great Nation. Mr. Greg Marshall is the chief security officer for the Department of Homeland Security. In this capacity, Mr. Marshall is responsible for security-related issues effecting the Department personnel security, physical security, special security, special access programs, security training and awareness. Mr. Marshall began his Federal career as a police officer with the United States Capitol Police in 1984 and later transferred to the Howard County Maryland Police Department where he retired in 2007. He returned to Federal service when he joined DHS as deputy chief of physical security and was later promoted deputy chief security officer. Ms. Caitlin Durkovich is the assistant secretary for infrastructure protection at the Department for Homeland Security. In this role, she leads the Department's efforts to strengthen public-private partnerships and coordinate programs to protect the Nation's critical infrastructure, assess and mitigate risk, build resilience, and strengthen instant response and recovery. Previously, Ms. Durkovich served as the National Protection and Program Directorate as chief of staff, overseeing day-to- day management of the director and the development of internal policies and strategic planning. She is testifying on behalf of the inter-agency security committee, a committee comprised of 53 representatives of Federal agencies and departments with the mandate to enhance the quality and effectiveness of physical security of Federal buildings in the United States. Last, Mr. Mark Goldstein is the director of physical infrastructure issues at the GAO. Mr. Goldstein is responsible for GAO's work in the areas of Government property, critical infrastructure, and telecommunications. Mr. Goldstein has held other public-sector positions including serving as the deputy executive director and chief of staff to the District of Columbia financial control board, legislative adviser of the commissioner of internal revenue, and a senior staff member of the United States Senate Committee on Homeland Security and Governmental Affairs. Prior to Government service, Mr. Goldstein was an investigative journalist and author. We can see that we have got a great panel here today and I look forward to your testimony. So I want to thank you all for being here. I now recognize Mr. Patterson for his opening statement. STATEMENT OF L. ERIC PATTERSON, DIRECTOR, FEDERAL PROTECTIVE SERVICE, U.S. DEPARTMENT OF HOMELAND SECURITY Mr. Patterson. Good morning, sir. Good morning and thank you, Chairman Duncan and Congressman O'Rourke and the other distinguished Members of the subcommittee. My name is Eric Patterson and I am the director of the Federal Protective Service within the National Protection and Programs Directorate of the Department of Homeland Security. I am honored to testify before this committee today regarding the mission and operations of the Federal Protective Service. In the United States, Government facilities remain a potential target of attacks. FPS's mission is to protect over 9,000 Federal facilities and over 1.4 million occupants and visitors. To accomplish our mission, FPS inspectors and contract protective security officers, referred to as PSOs, work in tandem to attend to daily security needs at Federal facilities and respond to threats directed against the facilities or the Government personnel working within them. PSOs are the eyes and ears of our organization. PSOs are responsible for controlling access to Federal facilities, detecting and reporting criminal acts, and responding to emergency situations. PSOs also ensure prohibited items such as firearms, explosives, knives, and drugs do not enter Federal facilities. In fact, FPS PSOs stop approximately 700,000 prohibited items from entering Federal facilities annually. All PSOs must undergo preliminary background investigation checks to determine their fitness to begin work on behalf of the Federal Government. FPS partners with private-sector guard companies to ensure that the guards have met the certification, training, and qualification requirements specified in the contracts, covering subject areas such as ethics, crime scene protection, actions to take in special situations such as building evacuations, safety in fire prevention, and public relations. To ensure high performance of our contractor PSO force, FPS law enforcement personnel conduct PSO post-inspections and integrate covert test activities to monitor vendor compliance and countermeasure effectiveness. Additionally, vendor files are audited periodically to validate the PSO certifications and training records reflect compliance with contract requirements. In fiscal year 2013 alone, FPS conducted 54,000 post inspections and 17,000 PSO personnel file audits. As Members of the committee may be aware, the GAO has in the past raised some concerns regarding FPS's handling of PSO training and oversight. FPS has taken significant steps to improve oversight of PSO contracts. For example, FPS is currently hiring 39 additional contract officer representatives in order to improve oversight of vendor contract compliance. FPS has also drafted and is vetting an enhanced policy for FPS PSO contract performance monitoring and oversight. Due in part to these actions, FPS has made significant progress toward closing GAO and OIG recommendations pertaining to our oversight. FPS also directly employs 1,000 Federal law enforcement personnel who perform a variety of critical functions, including PSO oversight, facility security assessments, and uniformed police response. To assist our law enforcement personnel in performing oversight of PSO posts, FPS has partnered with DHS Science and Technology to develop a near-term, real-time post-tracking system, also referred to as PTS, which will facilitate the identification of the most effective and efficient solutions for managing our guard force. One of the most important responsibilities of FPS law enforcement personnel is conducting facility security assessments, also referred to as FSAs. FSAs document security- related risk to a facility and provide a record of countermeasure recommendations designed to enable tenant agencies to meet inter-agency security committee standards for Federal facility security. Specifically, FPS conducts multiple interviews and in-depth research to support the accomplishment of facility-specific threat assessments. These assessments are an integral first step in establishing the foundation for the risk framework. FPS collaboration with private sector and Government stakeholders is critical to the successful implementation and characterization of a risk-management framework for each unique facility. Finally, FPS officers respond to tens of thousands of calls for service annually, which entail responding to criminal activity in progress, to protect life and property, and to respond to National security events or to support other law enforcement responding to a critical situation, as was in the case at the Navy Yard on September 16, 2013. With regard to responding to an active-shooting incident, I would like to take this opportunity to note that FPS does administer an active-shooter tenant awareness training program and has provided training to more than 3,300 Federal facility tenants. Additionally, while FPS PSOs are not sworn Federal law enforcement officers and are statutorily limited in the scope of actions that they can take during an active-shooter incident, FPS does provide them instruction regarding actions to take in special situations such as a building fire or report of workplace violence or other emergency situations or evacuations. In closing, I would like to acknowledge and thank our partners, especially members of the law enforcement community, who responded the day of the Navy Yard shooting. The events of September 16 were both a testament to their dedication and training, and a stark reminder of the critical importance of the mission of the Department of Homeland Security and the Federal Protective Service. The Federal Protective Service remains committed to providing safety, security, protection, and a sense of well- being to thousands of Federal employees, citizens, and visitors who work and conduct business in our Federal facilities daily. Thank you again for the opportunity to testify before this committee, and I will be pleased to answer any questions you may have. [The joint prepared statement of Mr. Patterson and Ms. Durkovich follows:] Joint Prepared Statement of Leonard E. Patterson and Caitlin Durkovich October 30, 2013 Thank you Chairman Duncan, Ranking Member Barber, and the distinguished Members of the subcommittee. We are pleased to appear before the committee today to discuss the efforts by the National Protection and Programs Directorate (NPPD) to increase security and resilience at our Nation's Federal facilities. The men and women serving in NPPD have wide-ranging responsibilities, from serving on the front lines of law enforcement to developing standards with stakeholders to conducting training Nation-wide. NPPD works with owners and operators, public safety, and countless others daily to keep the Nation secure. These efforts prepare our partners for steady state and day-to-day activity, but also for large-scale and complex incidents. NPPD builds capabilities among our stakeholders and enhances coordination and planning efforts, so when an incident occurs, our employees and stakeholders are prepared to respond and mitigate future incidents. In addition to working with public and private-sector partners to enhancing security across the sectors, NPPD provides daily protection at Federal facilities through the Federal Protective Service (FPS), protecting more than 1.4 million tenants and visitors in the facilities, on the grounds, and on property owned, occupied, or secured by the Federal Government. Across the country FPS provides law enforcement and security management services, which include operations and oversight of approximately 12,000 contract Protective Security Officers (PSO), and security countermeasure services for more than 9,000 General Services Administration-owned, -leased, or -operated facilities located across the country and other Federal facilities. ENSURING THE SECURITY AND RESILIENCE OF CRITICAL INFRASTRUCTURE Within NPPD, the Office of Infrastructure Protection (IP) works with public and private-sector partners to increase the security and resilience of critical infrastructure and protect the individuals relying on infrastructure. This includes programs to support critical infrastructure owners and operators in enhancing their facilities' security and resilience and coordinating critical infrastructure sectors. IP is responsible for overall coordination of the Nation's critical infrastructure security and resilience efforts, including development and implementation of the National Infrastructure Protection Plan (NIPP). The NIPP establishes the framework for integrating the Nation's various critical infrastructure security and resilience initiatives into a coordinated effort. The NIPP provides the structure through which the Department of Homeland Security (DHS), in partnership with Government and industry, implements programs and activities to protect critical infrastructure, promote National preparedness, and enhance incident response. The NIPP is regularly updated to capture evolution in the critical infrastructure risk environment, and DHS is currently updating the NIPP based on requirements set forth in Presidential Policy Directive (PPD) 21.\1\ --------------------------------------------------------------------------- \1\ In February 2013, President Obama issued Presidential Policy Directive (PPD) 21 on Critical Infrastructure Security and Resilience. PPD-21 advances a National unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure. One of the requirements set forth in the policy was for DHS to update the NIPP. --------------------------------------------------------------------------- IP conducts on-site risk assessments of critical infrastructure and shares risk and threat information with State, local, and private- sector partners. In addition to helping critical infrastructure owners and operators become more aware of the risks, hazards, and mitigation strategies, we're also helping them measure and compare their levels of security and resilience and how they can improve. In the last year, we conducted more than 900 vulnerability assessments and security surveys on critical infrastructure to identify potential gaps and provide the owners and operators with options to mitigate those gaps and strengthen security and resilience. In addition to serving owners and operators and Government officials directly, IP supports the development of standards, reports, guidelines, and best practices for civilian Federal facilities through the Interagency Security Committee (ISC). Interagency Security Committee The mission of the ISC is to safeguard U.S. civilian facilities from all hazards by developing state-of-the-art security standards in collaboration with public and private homeland security partners. The ISC was created following the bombing of the Alfred P. Murrah Federal Building in Oklahoma City on April 19, 1995--the deadliest attack on U.S. soil before September 11, 2001 and the worst domestic-based terrorist attack in U.S. history. Following the attack, Executive Order 12977 created the ISC to address ``continuing Government-wide security'' for Federal facilities in the United States. ISC standards apply to all civilian Federal facilities in the United States. These include facilities that are Government-owned, - leased, or -managed, to be constructed or modernized, or to be purchased, accounting for more than 399,000 Federally-owned and -leased assets and over 3.35 billion square feet Nation-wide.\2\ The ISC is truly an interagency body exhibiting collaboration and communication between 53 Federal agencies and departments.\3\ When agencies cannot solve security-related problems on their own, the ISC brings chief security officers and senior executives together to solve continuing Government-wide security concerns. The ISC is responsible for the creation and implementation of numerous standards, guidelines, and best practices for the protection of over 300,000 nonmilitary Federal facilities across the country. This work is based on real-world, present-day conditions and challenges and allows for cost savings by focusing on specific security needs of the agencies. --------------------------------------------------------------------------- \2\ The Federal Real Property Council's Fiscal Year 2010 Federal Real Property Report, An Overview of the U.S. Federal Government's Real Property Assets. \3\ Additional information on ISC membership is located in the Appendix. --------------------------------------------------------------------------- The ISC is a permanent body with appointed members who often serve multi-year terms. Several have represented their organizations for more than a decade. Leadership of the ISC is provided by the assistant secretary for infrastructure protection, an executive director, as well as 8 standing subcommittees: Steering, Standards, Technology, Convergence, Training, Countermeasures, Design-Basis Threat, and the Chair Roundtable. FPS is an active participant in the work of the ISC, helping shape standards, guidance, and best practices that enable FPS employees to perform their protection mission with consistency and efficiency. FPS sits on the ISC Steering committee, chairs the Training subcommittee, and has representatives on a number of other ISC committees and working groups, including the Design Basis Threat group, the Countermeasures subcommittee, and others. FPS chaired the working group that authored a ``Best Practices for Federal Mobile Workplace Security'' document in 2013 that is currently under review, and is also on the Active Shooter- Prevention and Response as well as the PPD-21 and Compliance working groups that are currently meeting. In recent years, FPS has also co- chaired the working groups that produced the Items Prohibited from Federal Facilities: An ISC Standard and Best Practices for Armed Security Officers in Federal Facilities, 2nd Edition documents. FPS also serves as the Sector-Specific Agency for the Government Facilities Sector. In this role FPS is responsible for working with various partners--including other Federal agencies; State, local, Tribal, and territorial governments as well as other sectors--to develop and implement the Government facilities sector-specific plan. Standards and Best Practices for Secure Facilities The ISC issues standards, reports, guidelines, and best practices to protect approximately 1.2 million Federally-owned buildings, structures, and land parcels more than 2.5 million tenant employees, and millions of visitors each day from harm. The documents developed by the ISC affect all civilian Federal facilities--Government-owned, - leased, to be constructed, modernized, or purchased. Examples of ISC Standards and Guidelines
The Risk Management Process for Federal Facilities Standard.--Issued August 2013, this ISC Standard defines the criteria and processes that those responsible for the security of a facility should use to determine its facility security level and provides an integrated, single source of physical security countermeasures for all non-military Federal facilities. The Standard also provides guidance for customization of the countermeasures for Federal facilities and encompasses the following documents: (1) Facility Security Level Determinations (FSL)--2008; (2) Physical Security Criteria for Federal Facilities--2010; (3) Design Basis Threat--2013; (4) Facility Security Committees--2012; (5) Use of Physical Security Performance Measures--2009; (6) Child-Care Centers--Level of Protection Template--2010. Violence in the Federal Workplace: A Guide for Prevention and Response.--Issued April 2013, these Government-wide procedures for threat assessment, intervention, and response to incidents of workplace violence were developed by the ISC, in conjunction with the Chief Human Capital Officers Council and the National Institutes of Occupational Safety and Health. Occupant Emergency Programs: An ISC Guide.--Issued March 2013, this guidance outlines the components of an Occupant Emergency Program, including those items that comprise an emergency plan, and defines the basic guidelines/procedures to be used for establishing and implementing an effective occupant emergency program. Items Prohibited From Federal Facilities: An ISC Standard.-- Issued February 2013, this standard establishes a guide-line process for detailing control of prohibited items into Federal facilities, and identifies responsibilities for denying entry to those individuals who attempt to enter with such items. Best Practices for Armed Security Officers in Federal Facilities, 2nd Edition.--Issued February 2013, this best practice recommends a set of minimum standards to be applied to all contract armed security officers working in Federal facilities. Security Specialist Competencies: An ISC Guideline.--Issued January 2012, this document provides the range of core competencies Federal Security Specialists should possess to perform their basic duties and responsibilities. Best Practices for Mail Screening and Handling.--Issued September 2011, this joint ISC-Department of Defense Combating Terrorism Technical Support Office/Technical Support Working Group (CTTSO/TSWG) document provides mail center managers, supervisors, and security personnel with a framework for mitigating risks posed by mail and packages. The ISC continues to identify new initiatives based on current and emerging threats as well as revise policies which may become outdated. Currently the ISC is working on several new initiatives: Active Shooter--Prevention and Response.--Streamlining existing Federal guidance and ISC policy on Active Shooter into one cohesive guidance document that agencies housed in non- military Federal facilities can use as a reference to enhance preparedness for an active-shooter incident. Facility Security Plan.--Utilizing the ISC's Risk Management Process to develop guidance agencies can use to develop a Facility Security Plan. Security Office Staffing.--Establishing criteria and policies which will inform agencies' staffing of Security Offices. Resource Management.--Developing guidance to help agencies make the most effective use of resources available for physical security across their portfolio of facilities and examine the use of organizational practices for resource management purposes. Presidential Policy Directive 21 and Compliance.--Developing security criteria for critical infrastructure supporting mission-essential functions to account for PPD-21 requirements and to create a strategy for compliance. Best Practices for Federal Mobile Workplace Security.-- Analyzing the future impact on physical and cybersecurity policy and practices. Threats to our critical infrastructure, including Federal facilities, are wide-ranging. Not only are there terrorist threats, like the bombing at the Boston Marathon this past spring, but threats from weather-related events, such as Hurricane Sandy, as well as threats to our cyber infrastructure which may have a direct impact on the security of our Federal buildings. While it's impossible to anticipate every threat, NPPD is taking a holistic approach to create a more resilient infrastructure environment to better handle these challenges, and the work of the ISC exemplifies these efforts. Ensuring our Federal facilities are secure and resilient is a large challenge, but by providing our partners with standards and best practices, law enforcement agencies serving at Federal facilities every day, like the Federal Protective Service, have the tools and resources necessary to mitigate threats. Active-Shooter Preparedness Recent events have demonstrated the need to identify measures that can be taken to reduce the risk of mass casualty shootings, improve preparedness, and expand and strengthen on-going efforts intended to prevent future incidents. DHS aims to enhance preparedness through a ``whole community'' approach by providing training, products, and resources to a broad range of stakeholders on issues such as active- shooter awareness, incident response, and workplace violence. FPS has developed an Active-Shooter Tenant Awareness training program and has provided this training to more than 3,300 Federal facility tenants so they may be better equipped to analyze a potential situation and work through concerns, actions, and decisions. In addition, more than 1,000 FPS law enforcement officers and agents have been trained in ``Active-Shooter Response Tactics.'' To date, over 9,700 individuals have viewed DHS's active-shooter webinar, over 7,300 attendees have participated in over 100 active-shooter workshops and exercises Nation-wide, and over 263,400 Americans have taken DHS's ``Active Shooter: What You Can Do'' course. Each workshop allows participants to ``live'' an emergency incident and analyze the situation to work through concerns, actions, and decisions. DHS also launched an active-shooter webpage in January 2013, which includes active-shooter training resources for Federal, State, and local partners, as well as the public. Since its launch, the page has been accessed more than 258,000 times. In addition to the training FPS provides to tenants, FPS's PSOs receive instruction regarding actions to take in special situations, such as a building fire, a report of an active shooter or workplace violence, and other emergency situations or evacuations. ENSURING THE SECURITY AND RESILIENCE OF FEDERAL FACILITIES In the United States Government facilities remain a potential target of attacks. The NPPD FPS mission is to protect Federal facilities and their occupants and visitors by providing superior law enforcement and protective security services, leveraging the intelligence and information resources of its network of Federal, State, local, Tribal, territorial, and private-sector partners. To accomplish our mission and help prevent incidents like the Navy Yard tragedy from occurring at FPS-protected Federal facilities, our inspectors and PSOs work in tandem to attend to daily security needs at Federal facilities, assess individual Federal facilities' vulnerabilities to both natural and man-made events, and effectively respond to security-related activities and threats directed against the facilities or the Government personnel working within them. In performing the mission of protecting Federal facilities and persons thereon, we rely on our law enforcement and security authorities found at 40 U.S.C. 1315; our ability to enter into agreements with State, local, and Tribal law enforcement agencies for purposes of protecting Federal property; the enforcement of Federal Management Regulation sections pertinent to conduct on Federal property under 41 C.F.R., Part 102-74 Subpart C; and our responsibility as a recognized ``first responder'' for all crimes and suspicious circumstances occurring at GSA-owned or -leased property. FPS OPERATIONS FPS contracted PSOs are the eyes and ears of our organization. PSOs are responsible for controlling access to Federal facilities, conducting screening at access points to Federal facilities, enforcing property rules and regulations, detecting and reporting criminal acts, and responding to emergency situations involving facility safety and security. PSOs also ensure prohibited items, such as firearms, explosives, knives, and drugs, do not enter Federal facilities. In fact, FPS PSOs stop approximately 700,000 prohibited items from entering Federal facilities annually. Suitability All PSOs must undergo preliminary background investigation checks to determine their fitness to begin work on behalf of the Government. At FPS, preliminary checks consist of a review of the applicant's background investigation questionnaire form as well as automated record checks with the FBI, National Crime Information Center, credit reporting bureaus, and naturalization/citizenship checks, when applicable. If derogatory information cannot be mitigated to allow for a favorable preliminary decision, the background investigation must be completed and favorably adjudicated prior to ``Entry On Duty'' approval. For PSOs serving in Federal facilities requiring a high-level security clearance, DHS uses the Defense Security Service to adjudicate background investigations. Training FPS partners with private-sector guard companies to ensure that PSOs are prepared to accomplish their duties. FPS works with the guard companies to ensure the guards have met the certification, training, and qualification requirements specified in the contracts, covering subject areas such as ethics, crime scene protection, actions to take in special situations such as building evacuations, safety and fire prevention, and public relations. Courses are taught by FPS, by the contract guard company, or by a qualified third party such as the American Red Cross for CPR. PSOs also receive instruction in areas such as X-Ray and magnetometer equipment, firearms training and qualification, baton qualification, and First-Aid certification. PSOs are required to attend refresher training and they must recertify in weapons qualifications in accordance with Federal and State regulations. The FPS training team is working closely with industry and Federal partners in an effort to further standardize the PSO training screening station-related training. For example, our trainers work with the U.S. Marshals Service and Transportation Security Administration trainers to incorporate best practices into the base X-Ray, Magnetometer, and Hand- Held Metal Detector training. Additionally, FPS is working closely with the National Association of Security Companies to develop a National Lesson Plan for PSOs that will establish a basic and National training program for all PSOs; this is important to ensure standards are consistent across the Nation. These efforts will further standardize training PSOs receive and will provide for a great capability to validate training and facilitate rapid adjustments to training to account for changes in threat and technological advancements. Oversight FPS is committed to ensuring high performance of its contracted PSO workforce. FPS Law Enforcement personnel conduct PSO post inspections and integrated covert test activities to monitor vendor compliance and countermeasure effectiveness. Additionally, vendor files are audited periodically to validate that PSO certifications and training records reflect compliance with contract requirements. In fiscal year 2013, FPS conducted 54,830 PSO post inspections and 17,500 PSO personnel file audits. In addition, and in accordance with procurement regulation and policy, contract deficiencies and performance issues are documented in the annual Contractor Performance Assessment Report. FPS Headquarters and regional leadership are provided with regular reports to maintain visibility on the status of these important assessments that are also used by agency source selection officials in the procurement process when awarding new PSO contracts. As Members of the committee may be aware, the GAO has, in the past, raised some concerns regarding FPS's handling of PSO training and oversight. FPS has taken significant steps to improve oversight of PSO contracts. For example, FPS is currently hiring 39 additional Contracting Officer Representatives in order to improve oversight of vendor contract compliance. FPS has also drafted and implemented an enhanced policy for FPS PSO performance monitoring, security force management, and contractor management functions. Among other improvements, this standardizes Nationally the methods and frequencies of PSO post inspections and audits of contractor files. Due in part to these actions, FPS has made significant progress toward closing GAO and OIG recommendations pertaining to oversight. Since 2011, FPS has successfully closed 13 GAO and 4 OIG recommendations and has submitted closure documentation for 9 additional recommendations. Of these, 2 were successfully closed and 7 are pending GAO's internal review for closure. LAW ENFORCEMENT PERSONNEL FPS also directly employs over 1,000 Federal Law Enforcement Personnel who are trained physical security experts. Law Enforcement Personnel perform a variety of critical functions, including conducting comprehensive security assessments of vulnerabilities at facilities, developing and implementing protective countermeasures, and providing uniformed police response and investigative follow-up. As previously noted, Law Enforcement Personnel also conduct PSO guard post inspections on a daily basis as well as Operation Shield activities, which involve deployments of a highly visible array of law enforcement personnel to validate and augment the effectiveness of FPS countermeasures across the protective inventory.\4\ --------------------------------------------------------------------------- \4\ This includes providing highly-visible law enforcement presence to disrupt terrorist/criminal activity, expand patrol and response operations through increased coverage, demonstrate FPS's commitment to employing the highest standards for the security of Federal facilities and the safety of their occupants; and collect and assimilate data to continually assess and improve FPS's ability to achieve its core mission--to secure facilities and safeguard occupants. --------------------------------------------------------------------------- Facility Security Assessments One of the most important responsibilities of FPS Law Enforcement Personnel is conducting Facility Security Assessments (FSAs) at FPS- protected facilities Nation-wide. FSAs document security-related risks to a facility and provide a record of countermeasure recommendations. The process analyzes potential threats toward a facility through a variety of research sources and information. Upon identification of the threats, the process identifies and analyzes vulnerabilities to a particular facility utilizing Protective Measure Indices (PMI). Assessors utilize the Modified Infrastructure Survey Tool (MIST) to document the existing protective posture at a facility and compares how a facility is, or is not, meeting the baseline level of protection for its FSL as set forth in the ISC's Physical Security Criteria for Federal Facilities standard and the ISC's Design Basis Threat report. MIST also compares the disparities identified against the baseline level of protection specified in the ISC standards, thereby operationalizing those standards, and enabling mitigation of the vulnerabilities identified. The FSA report is a historical record and informative report provided to FPS stakeholders to support their decision making in risk mitigation strategies. FSAs require collaboration between FPS private-sector stakeholders and Government stakeholders. Collaboration between these entities is critical to successful implementation of a risk management framework. FPS partners with all of the stakeholders to identify and gather all necessary information for characterizing the risks to each unique facility. FSA is accomplished on a recurring schedule broken down by FSL. Law Enforcement Response FPS officers respond to tens of thousands of calls for service annually, some of which entail responding to criminal activity in progress, others to protect life and property, and still others to respond to National security events or to support other law enforcement responding to a critical situation, as was the case in the Navy Yard complex on September 16, 2013. In this case, FPS responded to the on- scene Navy Yard Unified Command center in a supporting role and deployed six K9 Explosive Detection Dog teams to be staged at the Navy Yard and sweep the Nationals Park parking lot in response to mutual-aid calls from the District of Columbia Metropolitan Police Department and the FBI. Additionally, given the proximity of the FPS-protected U.S. Department of Transportation (DOT) building to the Navy Yard complex, FPS deployed to the DOT building, coordinated a Shelter-in-Place for all occupants, established a secure perimeter around the building, conducted K9 sweeps around the perimeter, and increased uniformed patrol activities at other FPS-protected Federal facilities located within the southeast corridor of the District of Columbia. COMMITMENT TO SECURING FEDERAL FACILITIES In closing, we would like to acknowledge and thank our partners in both the public and private sector, especially members of the law enforcement community who responded the day of the Navy Yard shooting. We are grateful for their continued service. The shooting at the Navy Yard on September 16 provided a reminder of the need to ensure our infrastructure is secure and resilient so we can protect our communities, regardless of the threat. We must maintain our partnerships and continue to seek new opportunities to enhance the security and resiliency of our Nation while providing our first responders with the resources and tools they need. DHS is committed to ensuring our Federal facilities remain safe and secure for employees and visitors. Our employees will continue serving on the front lines at Federal facilities and working behind the scenes to develop standards and supporting law enforcement efforts. Thank you again for the opportunity to testify before this committee. We look forward to answering any questions you may have. Appendix.--Interagency Security Committee Membership Membership in the ISC consists of over 100 senior-level executives from 53 Federal agencies and departments. In accordance with Executive Order 12977, modified by Executive Order 13286, primary members represent 21 Federal agencies. Associate membership is determined at the discretion of the ISC Steering Committee and the ISC Chair. Currently, associate members represent 32 Federal departments. Primary Members (21) (1) Assistant to the President for National Security Affairs (2) Central Intelligence Agency (3) Department of Agriculture (4) Department of Commerce (5) Department of Defense (6) Department of Education (7) Department of Energy (8) Department of Health and Human Services (9) Department of Homeland Security (10) Department of Housing and Urban Development (11) Department of the Interior (12) Department of Justice (13) Department of Labor (14) Department of State (15) Department of Transportation (16) Department of the Treasury (17) Department of Veterans Affairs (18) Environmental Protection Agency (19) General Services Administration (20) Office of Management and Budget (21) U.S. Marshals Service Associate Members (32) (1) Commodity Futures Trading Commission (2) Court Services and Offender Supervision Agency (3) Federal Aviation Administration (4) Federal Bureau of Investigation (5) Federal Communications Commission (6) Federal Deposit Insurance Corporation (7) Federal Emergency Management Agency (8) Federal Protective Service (9) Federal Reserve Board (10) Federal Trade Commission (11) Government Accountability Office (12) Internal Revenue Service (13) National Aeronautics & Space Administration (14) National Archives & Records Administration (15) National Capital Planning Commission (16) National Institute of Building Sciences (17) National Institute of Standards & Technology (18) National Labor Relations Board (19) National Science Foundation (20) Nuclear Regulatory Commission (21) Office of the Director of International Intelligence (22) Office of Personnel Management (23) Office of the U.S. Trade Representative (24) Securities and Exchange Commission (25) Smithsonian Institution (26) Social Security Administration (27) U.S. Army Corps of Engineers (28) U.S. Capitol Police (29) U.S. Coast Guard (30) U.S. Courts (31) U.S. Institute of Peace (32) U.S. Postal Service Mr. Duncan. Thank you. The Chairman will now recognize Mr. Marshall to testify. STATEMENT OF GREG MARSHALL, CHIEF SECURITY OFFICER, U.S. DEPARTMENT OF HOMELAND SECURITY Mr. Marshall. Chairman Duncan, Congressman O'Rourke, Members of the committee, good morning and thank you for the opportunity to provide testimony on access control for Federal facilities. I am Greg Marshall, the chief security officer for the U.S. Department of Homeland Security. I am a career official with nearly 30 years of law enforcement experience. The mission of my office is to safeguard the Department's people, property, and information. Accordingly, I am responsible, often in partnership with my colleagues at the Federal Protective Service, for security-related issues affecting more than 235,000 DHS employees that comprise the Department. The security oversight and guidance authority of my office applies across the Department. However, operational components play a significant role in managing the facilities which they inhabit, including access. The diverse missions and responsibilities of the Department and the facilities used to meet these missions underscore the challenges involved with the physical security and access control disciplines. The tragic events of Monday, September 16 at the Navy Yard have placed the issue of physical security, access control, and personnel vetting front and center in the minds of security professionals across the Federal landscape. I need to make clear, however, that security aims to manage risk, not eliminate it. Our job is to do everything we can to keep our employees safe, and in doing so we have the benefit of policies and procedures and processes and technologies, both proven and emerging, to help guide and improve our security programs. When we consider the security for a Federal facility, including access control, we follow the interagency security community standards. Facilities are assessed for risk and appropriate countermeasures are employed. The outcome of these risk assessments drives the level of protection, to include an appropriate access control posture. A one-size security solution, however, cannot and will not fit all. For employees to qualify for access to facilities, they must undergo a background investigation to establish suitability or fitness for employment. These investigations are for the most part conducted by OPM. Contractors are screened in a similar process to determine fitness for work on a DHS contract and to also have facility access. Background investigations for suitability and fitness examine character and conduct, past conduct. Based upon all available information, we make an adjudicative decision concerning a person's suitability or fitness for employment or access to classified information. It is important to note that any background investigation, no matter how rigorous, is no guarantee that all relevant information is known, available, or has been included in the investigation. Also, a background investigation may not reliably predict future behavior. A background investigation is an exercise in risk management, establishing some basic facts, but cannot guarantee any individual's continuing fitness to carry out their duties or to behave in a lawful or safe manner. Recent improvements in our ability to manage these incidents--these inherent risks and incidents include Homeland Security Presidential Directive 12, which mandated a Government-wide standard for secure and reliable credential to be used when accessing Federal facilities. This credential, also known as a PIV card, represents a marked improvement over legacy identity cards. The background investigation process itself is undergoing major Government-wide reform with phased implementation to begin this fiscal year. The concept of continuous evaluation has been developed to supplement normal reinvestigation reviews with a process that examines conduct between the reinvestigation time frames. Relevant security information, like a recent arrest, would become available in near-real time, helping to ensure that Classified information and/or Federal facilities are appropriately safeguarded. Finally, this administration's recent information sharing and safeguarding initiative, also known as ``insider threat,'' seeks to complement background investigations and continuous evaluation with continuous monitoring. This program will incorporate and analyze data in near-real time from a much broader set of sources. Its focus is the protection of Classified information, but its applicability to suitability and contractor fitness is evident. To conclude, suitability determinations and access control to Federal facilities remains a work in progress, but is evolving toward dramatic improvement. We have made great progress, but managing employee and facility risks will continue to be a challenge. Thank you again for the opportunity to testify today. [The prepared statement of Mr. Marshall follows:] Prepared Statement of Gregory Marshall October 30, 2013 Chairman Duncan, Ranking Member Barber, Members of the committee, good morning and thank you for the opportunity to provide testimony on access control for Federal facilities. I am Greg Marshall, chief security officer of the U.S. Department of Homeland Security (DHS). I lead the dedicated men and women who make up the Office of the Chief Security Officer. My office is an element of the Department's Management Directorate, and I report to the under secretary for management. The mission of our office is to safeguard the Department's people, property, information, and systems. Accordingly, the DHS chief security officer, often in partnership with the Federal Protective Service, is responsible for security-related issues affecting the more than 240,000 DHS employees that compose the Department. I exercise DHS-wide security program authorities in the areas of personnel security, physical security, administrative security, special security, identity management, special access programs, and security training and awareness. I also support the chief information officer in the area of IT security policy and the under secretary for intelligence and analysis in the protection of intelligence sources and methods, and accreditations of Classified facilities. The security oversight and guidance authority of my office applies across the Department. However, Operational components play a significant role in managing the facilities which they inhabit, including access to those facilities. The diverse missions and responsibilities of the Department underscore the challenges involved within the physical security and access control disciplines. The tragic events of Monday, September 16 at the Washington Navy Yard have placed the issue of physical security, access control, and personnel vetting front and center in the minds of security professionals across the Federal landscape. Shortly after the Navy yard incident, I convened a meeting of the Department's Chief Security Officer Council. Each component Chief Security Officer (CSO) acknowledged the significance of the Navy Yard tragedy to access control and the underlying vetting processes and each CSO commented on the complexities of vetting and access, including the costs involved. With this in mind, the Department remains committed to ensuring that only those persons with a legitimate need to access any given facility are allowed to enter, that those persons possess no prohibited items, and that the backgrounds of those persons who do enter have been vetted to an appropriate level of rigor. I would make clear, however, that security involves risk management. Our job is to do everything we can to reduce the risk and keep our employees safe. In pursuit of our mission, please be assured that DHS security leadership and the professionals we manage have the benefit of extensive knowledge, training, and experience. We also have the benefit of comprehensive policies, procedures, processes, and emerging technologies to help guide and improve our key security programs. For example, when we consider the security posture for a Federal facility, including access control, we at DHS follow Interagency Security Committee standards. During this process, facilities are assessed for risk, and appropriate countermeasures are employed to mitigate the risks. Using a decision matrix involving mission criticality, the sensitivity of the activities conducted, threats to the facility, facility population of persons who work and visit there, and other factors, an appropriate Federal Security Level is assigned to each facility. Accordingly, the outcomes of these risk assessments drive the level of protection for each facility, to include an appropriate access control posture. Simply put, a one-size security solution does not and cannot fit all facilities. For our employees to qualify for access to a Federal DHS facility, an employee must undergo a background investigation to establish his or her suitability for employment. These investigations are, for the most part, conducted by OPM on behalf of DHS. Contractors are screened in a process similar to employees in order to determine their fitness to work on a DHS contract and have unescorted access to DHS facilities. Background investigations for suitability and fitness examine character and conduct behaviors, such as criminal history, alcohol and drug use, and employment history, among others. Based upon all available information, a personnel security specialist makes an adjudicative decision concerning a person's suitability or fitness for employment, including access to facilities. It is important to understand that a background investigation for suitability and one for a security clearance processes with multiple levels of investigation dependent upon the access required and level of risk. A security clearance allows access to Classified information, while a favorable suitability or fitness determination allows employment and access to facilities. On its own, a background investigation for suitability does not permit access to Classified information. It is also important to note that a background investigation for either a suitability determination or a security clearance, no matter how rigorous, is no guarantee that every bit of relevant information about the individual is available or has been included. For example, prior criminal convictions and/or arrest information may not be reported in State and/or Federal repositories, often simply due to data entry resource constraints. It is these types of checks that are basic elements of any Federal employment background investigation. Also, it is important to note that a background investigation may not be an indicator of future behavior. Even those who have successfully undergone the most rigorous set of background checks available--even a comprehensive polygraph examination--may someday prove untrustworthy. Ultimately, a Federal background investigation only examines past behavior and is sometimes based on limited available information. A Federal background investigation is an exercise in risk management, establishing some basic facts such as identity, citizenship, criminal history, etc. However, a background investigation cannot be characterized, in and of itself, does not guarantee any single individual's continuing day-to-day fitness to carry out his or her employment responsibilities or to behave in a lawful and safe manner. With these limitations in mind, there have been several recent improvements to the ability of the Government to manage these inherent risks. First, Homeland Security Presidential Directive 12 (HSPD-12) mandated the development and implementation of a Government-wide standard for a secure and reliable Personal Identity Verification (PIV) card for gaining access to Federally-controlled facilities. To date, DHS Headquarters and components have issued over 250,000 PIV cards to Federal employees and contractors. For the first time, this process has effectively linked the completion of a person's background investigation with the issuance to that person of a unique Federal identity credential. The PIV card represents a marked improvement over the various legacy access/identity cards, but is only a part of any solution. As a result, Federal facility access control processes use this PIV card and its various authentication mechanisms to verify the identity of the holder, link the holder to the card, and link the card itself to a database of valid employees and contractors having legitimate business at any given facility. Second, the background investigation process itself is undergoing a major Government-wide reform effort, to include revised Federal investigative standards signed jointly by the director of National Intelligence and the director of the Office of Personnel Management in 2012, and phased implementation to begin this fiscal year. With the Federal investigative standards, the concept of ``continuous evaluation'' is being developed to supplement the normal re- investigation reviews of employees which, under the revised standards, will be in 5-year increments, with a Government-led process that examines a person's conduct within his or her normal re-investigation time frames. As such, relevant security information like a recent arrest or conviction for a crime outside of the Federal system, for example, would become available on a timelier basis to security officials responsible for assessing a person's eligibility for access to Classified information, thereby helping to ensure that Classified information and/or Federal facilities are appropriately safeguarded. ``Continuous evaluation'' represents a significant process improvement over current capabilities and will mitigate some of the limitations in the existing background investigation process discussed above. Finally, this administration's recent Information Sharing and Safeguarding initiative, also known as ``Insider Threat,'' seeks to complement background investigations and continuous evaluation with continuous monitoring. Continuous monitoring will incorporate data in near-real time from a much broader set of data sources, as compared to information that was previously available in the background investigation process. The initiative focuses on monitoring certain IT systems and incorporates analysis and collation software to aid in the identification of behavioral trends that could be indicative of an insider threat problem. Strict referral protocols are in place to investigate abnormalities. The aim is the detection and mitigation of threats to Classified information before any damage can be done. The focus of this program is the protection of Classified information, but its applicability to other behavioral issues, including suitability and contractor fitness, is evident. In conclusion, the suitability determinations of and access control to Federal facilities by Federal employees and contractors remains a work in progress, but is evolving toward dramatic improvement. It is our responsibility as DHS security leaders, with the support of Congress, to ensure a safe and secure workplace. We have made important strides, but assessing and managing employee and facility risks will continue to be a challenge in the future. We will continue to work every day to meet these challenges. Thank you again for the opportunity to testify today. Mr. Duncan. Thank you so much, Mr. Marshall. Ms. Durkovich. If I pronounced that wrong, just tell me-- Durkovich? Ms. Durkovich. You have pronounced it correctly. Thank you, sir. Mr. Duncan. Thank you so much. You are recognized for 5 minutes. STATEMENT OF CAITLIN DURKOVICH, ASSISTANT SECRETARY, INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SECURITY, TESTIFYING ON BEHALF OF THE INTERAGENCY SECURITY COMMITTEE Ms. Durkovich. Thank you very much, Chairman Duncan and Ranking Member O'Rourke and the distinguished Members of the subcommittee. I am honored to appear before you today. As assistant secretary for infrastructure protection, I have the responsibility to lead the overall coordination of the Nation's critical infrastructure security and resilience efforts, including development and implementation of the National Infrastructure Protection Plan, or the NIPP. The NIPP establishes the framework for integrating the Nation's various critical infrastructure security and resilience initiatives into a coordinated effort. One of the most rewarding opportunities I have is to serve as chair of the Interagency Security Committee and oversee the development of standards and guidelines and best practices for civilian Federal facilities through the Interagency Security Committee, or the ISC. The ISC was created by Executive Order following the bombing of the Alfred P. Murrah Federal Building in Oklahoma City on April 19, 1995. The ISC is responsible for the creation and adoption of numerous standards, guidelines, and best practices for the protection of nearly 400,000 non-military Federal facilities across the country. This work is based on real-world present- day conditions and challenges and allows for cost savings by focusing on specific security needs of the agencies. ISC standards provide the Federal community with strategies for identifying physical security measures and support the design and implementation of risk-based security policies. In August, the ISC issued the risk management process for Federal facilities standard, which defines the criteria and processes that those responsible for security should use to determine a facility's security level and provides an integrated single source of physical security countermeasures for all non- military Federal facilities. The standard also provides guidance for customization of countermeasures for Federal facilities and explains that risk can be addressed in various ways, depending on agency mission needs, for example, the presence of child care on-site and historical significance. It is most important to note that the ISC is truly a collaborative interagency body. Fifty-three Federal departments and agencies participate in the ISC and take the lead on bringing ideas to the table and drafting standards and best practices. When agencies cannot solve security-related problems on their own, the ISC is a convening body for chief security officers and senior executives to solve continuing Government- wide security concerns. The ISC membership develops standards and best practices based on real-world threats. Recent events have demonstrated the need to identify measures that can be taken to reduce the risk of mass-casualty shootings, improve preparedness, and expand and strengthen on-going efforts intended to prevent future incidents. DHS aims to enhance preparedness through a whole-of- community approach, by providing resources to a broad range of stakeholders on issues such as active-shooter awareness, incident response, and workplace violence. Working with partners in the private sector, DHS developed training and other awareness materials to assist critical infrastructure owners and operators with better training their staff and coordinating with local law enforcement. We have hosted hundreds of workshops and developed an on- line training tool targeted at preparing those who work in these buildings. These efforts and resources have been well-received and are applicable to Government facilities as well as commercial spaces. Cognizant of this growing threat, the ISC this past spring formed a Federal active-shooter working group. While a number of Federal guidance documents previously existed on active- shooter preparedness and response, including our designed basis threat report, the violence in Federal workplace, a guide for prevention response, and occupant emergency programs, an ISC guide, the working group was formed to streamline existing ISC policies into a single cohesive document. To date, the working group has met four times and has reviewed numerous publications and guidance documents, including training materials developed by the Department for commercial facilities. It will also leverage lessons learned from real-world incidents, including the Navy Yard shooting. It is our intention that the resulting work will serve as a resource for agencies to enhance preparedness for an active- shooter incident in a Federal facility. Threats to our critical infrastructure, including Federal facilities, are wide-ranging. Not only are there terrorist threats, like the bombing at the Boston Marathon this past spring, or the complex shopping mall attack we saw recently overseas, but threats from weather-related events, such as Hurricane Sandy, as well as threats to our cyber infrastructure which may have a direct impact on the security of our Federal buildings. While it is impossible to anticipate every threat, the Department is taking a holistic approach to create a more secure and resilient infrastructure environment to better handle these challenges, and the work of the ISC exemplifies these efforts. Ensuring our Federal facilities are secure and resilient is a large undertaking. But the work of our 53 member departments and agencies to ensure those responsible for Federal facility security have the tools and resources necessary to mitigate these threats is worth noting. In closing, I would like to thank you for the opportunity to appear before you and discuss the important work of the ISC. I look forward to answering any questions you may have. Mr. Duncan. Thank you so much. The Chairman will now recognize Mr. Goldstein for 5 minutes. STATEMENT OF MARK L. GOLDSTEIN, DIRECTOR, PHYSICAL INFRASTRUCTURE ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE Mr. Goldstein. Good morning, Mr. Chairman and Members of the subcommittee. We are pleased to be here today to discuss our latest report on the Federal Protective Service and the protection of Federal facilities. As part of the Department of Homeland Security, the FPS is responsible for protecting Federal employees and visitors in approximately 9,600 Federal facilities. Sadly, recent incidents at Federal facilities demonstrate their continued vulnerability to attacks and other acts of violence. To help accomplish its mission, FPS conducts the facility risk assessments and provides oversight of approximately 13,500 contract security guards deployed to Federal facilities. My testimony today is based on the results of a September 2013 report which is being released by the subcommittee today, previous GAO reports on this topic and the preliminary results of work GAO conducted for a report that we will issue to the Chairman later this year. My testimony today discusses challenges FPS faces in ensuring contract security guards deployed to Federal facilities are properly trained and certified, and the extent to which FPS and select Federal agencies' facility risk assessment methodologies align with standards issued by the ISC. Our findings are as follows: First, the Federal Protective Service faces challenges ensuring that contract guards have been properly trained and certified before being deployed to Federal facilities. In particular, GAO found that providing active-shooter response and screener training is a challenge for FPS. For example, according to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active shooter. Without ensuring that all guards receive this training, FPS has limited assurance that its guards are prepared for such a threat. Similarly, officials from one of FPS' contract guard companies stated that 133, about 38 percent of its approximately 350 guards, had never received screener training. As a result, those guards may be using X-ray and magnetometer equipment at Federal facilities that they are not qualified to use, raising questions about their ability to properly screen access control points at Federal facilities, one of their primary responsibilities. We were unable to determine the extent to which FPS' guards have received active-shooter response and screener training. Second, GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2010 and 2012 recommendations that it develop a comprehensive and reliable system for managing information on guard's training, certifications, and qualifications, it still does not have such a system. Additionally, 23 percent of nearly 300 guard files that GAO examined, maintained by 11 of the 31 contract guard companies we interviewed, lacked required training and certification documents. Examples of missing items include documentation of initial weapons and screener training and firearms qualifications. Finally, GAO's preliminary results on our risk assessment report indicate that several agencies, including FPS, do not use a methodology to assess risk at their facilities that aligns with the ISC's risk assessment standards. Risk assessments help decision makers identify and evaluate security risks and implement protective measures to mitigate risk. ISC's standards state that agencies' facility risk assessment methodologies must, first, consider all of the undesirable events identified by ISC as a possible risk to Federal facilities, and, No. 2, assess the threat vulnerability and consequences of specific undesirable events. Most commonly, FPS and eight agencies' methodologies that we reviewed are inconsistent with ISC standards because they do not assess facilities' vulnerabilities to specific undesirable events. If an agency does not know its facility's potential vulnerabilities to specific scenarios, it cannot set priorities to mitigate these vulnerabilities. In addition, as GAO reported in August 2012, although Federal agencies pay FPS millions of dollars to assess risk at their facilities, FPS' own risk assessment tool is not consistent with ISC's risk assessment standards, because it does not assess consequence, the level, duration, and nature of loss, resulting from undesirable events. As a result, FPS and the agencies we reviewed may not have a complete understanding of the risks facing approximately 57,000 Federal facilities located around the country, including the 9,600 facilities that FPS protects. As mentioned, our final report on this topic will be available later this fall. Mr. Chairman, this completes my statement. I would be happy to respond to any questions. Thank you. [The prepared statement of Mr. Goldstein follows:] Prepared Statement of Mark L. Goldstein October 30, 2013 GAO HIGHLIGHTS Highlights of GAO-14-128T, a testimony before the Subcommittee on Oversight and Management Efficiency, Committee on Homeland Security, House of Representatives. Why GAO Did This Study As part of the Department of Homeland Security (DHS), FPS is responsible for protecting Federal employees and visitors in approximately 9,600 Federal facilities under the control and custody of the General Services Administration (GSA). Recent incidents at Federal facilities demonstrate their continued vulnerability to attacks or other acts of violence. To help accomplish its mission, FPS conducts facility risk assessments and provides oversight of approximately 13,500 contract security guards deployed to Federal facilities. This testimony is based on the results of our September 2013 report (released by the subcommittee today), previous reports, and preliminary results of work GAO conducted for a report that GAO plans to issue to the Chairman later this year. GAO discusses: (1) Challenges FPS faces in ensuring contract security guards deployed to Federal facilities are properly trained and certified, and (2) the extent to which FPS and select Federal agencies' facility risk assessment methodologies align with standards issued by the ISC. To perform this work, GAO reviewed FPS and guard company documentation and interviewed officials about oversight of guards. GAO also reviewed FPS's and 8 Federal agencies' risk assessment documentation and compared it to ISC's standards. These agencies were selected based on their missions and types of facilities. What GAO Recommends DHS and FPS agreed with GAO's recommendations in its September 2013 report. homeland security.--challenges associated with federal protective service's contract guards and risk assessments at federal facilities What GAO Found The Federal Protective Service (FPS) faces challenges ensuring that contract guards have been properly trained and certified before being deployed to Federal facilities around the country. In a September 2013 report, GAO found that providing active-shooter response and screener training is a challenge for FPS. For example, according to officials at five guard companies, their contract guards have not received training on how to respond during incidents involving an active shooter. Without ensuring that all guards receive this training, FPS has limited assurance that its guards are prepared for such a threat. Similarly, officials from one of FPS's contract guard companies stated that 133 (about 38 percent) of its approximately 350 guards have never received screener training. As a result, those guards may be using X-ray and magnetometer equipment at Federal facilities that they are not qualified to use, raising questions about their ability to properly screen access control points at Federal facilities--one of their primary responsibilities. We were unable to determine the extent to which FPS's guards have received active-shooter response and screener training. FPS agreed with GAO's 2013 recommendation that they take steps to identify guards that have not had required training and provide it to them. GAO also found that FPS continues to lack effective management controls to ensure its guards have met its training and certification requirements. For instance, although FPS agreed with GAO's 2010 and 2012 recommendations that it develop a comprehensive and reliable system for managing information on guards' training, certifications, and qualifications, it still does not have such a system. Additionally, 23 percent of the 276 guard files GAO examined (maintained by 11 of the 31 guard companies we interviewed) lacked required training and certification documentation. Examples of missing items include documentation of initial weapons and screener training and firearms qualifications. GAO's preliminary results indicate that several agencies, including FPS, do not use a methodology to assess risk at their facilities that aligns with the Interagency Security Committee's (ISC) risk assessment standards. Risk assessments help decision makers identify and evaluate security risks and implement protective measures to mitigate the risk. ISC's standards state that agencies' facility risk assessment methodologies must: (1) Consider all of the undesirable events identified by ISC as possible risks to Federal facilities, and (2) assess the threat, vulnerability, and consequence of specific undesirable events. Most commonly, agencies' methodologies that GAO reviewed are inconsistent with ISC's standards because they do not assess facilities' vulnerabilities to specific undesirable events. If an agency does not know its facilities' potential vulnerabilities to specific undesirable events, it cannot set priorities to mitigate these vulnerabilities. In addition, as GAO reported in August 2012, although Federal agencies pay FPS millions of dollars to assess risk at their facilities, FPS's risk assessment tool is not consistent with ISC's risk assessment standards because it does not assess consequence (i.e., the level, duration, and nature of loss resulting from undesirable events). As a result, FPS and the other non-compliant agencies GAO reviewed may not have a complete understanding of the risks facing approximately 57,000 Federal facilities located around the country (including the 9,600 protected by FPS). Chairman Duncan, Ranking Member Barber, and Members of the subcommittee: We are pleased to be here to discuss the results of our September 2013 report, which the subcommittee is releasing today, and the efforts of the Department of Homeland Security's (DHS) Federal Protective Service (FPS) to protect the nearly 9,600 Federal facilities that are under the control and custody of the General Services Administration (GSA). The 2012 shooting at the Anderson Federal Building in Long Beach, California, and the results of our 2009 covert testing and FPS's on-going penetration testing demonstrate the continued vulnerability of Federal facilities. Moreover, the challenge of protecting Federal facilities is one of the major reasons why we have designated Federal real property management as a high-risk area.\1\ --------------------------------------------------------------------------- \1\ GAO, High Risk Series: An Update, GAO-13-283 (Washington, DC: Feb. 14, 2013). --------------------------------------------------------------------------- FPS is authorized: (1) To protect the buildings, grounds, and property that are under the control and custody of GSA, as well as the persons on the property; (2) to enforce Federal laws and regulations aimed at protecting such property and persons on the property; and (3) to investigate offenses against these buildings and persons.\2\ FPS conducts its mission by providing security services through two types of activities: (1) Physical security activities--conducting security assessments and recommending countermeasures aimed at preventing incidents--and, (2) law enforcement activities--proactively patrolling facilities, responding to incidents, conducting criminal investigations, and exercising arrest authority. To accomplish its mission, FPS currently has almost 1,200 full-time employees and about 13,500 contract guards deployed at Federal facilities across the country. It expects to receive approximately $1.3 billion in fees for fiscal year 2013.\3\ --------------------------------------------------------------------------- \2\ Section 1315(a) of title 40, United States Code, provides that: ``To the extent provided for by transfers made pursuant to the Homeland Security Act of 2002, the Secretary of Homeland Security . . . shall protect the buildings, grounds, and property that are owned, occupied, or secured by the Federal Government (including any agency, instrumentality, or wholly owned or mixed-ownership corporation thereof) and the persons on the property.'' \3\ To fund its operations, FPS charges fees for its security services to Federal tenant agencies in GSA-controlled facilities. --------------------------------------------------------------------------- Since 2008, we have reported on the challenges FPS faces with carrying out its mission, including overseeing its contract guards and assessing risk at Federal facilities. FPS's contract guard program is the most visible component of the agency's operations, and the agency relies on its guards to be its ``eyes and ears'' while performing their duties. However, we reported in 2010 and again in 2013 that FPS continues to experience difficulty ensuring that its guards have the required training and certifications. Before guards are assigned to a post (an area of responsibility) at a Federal facility, FPS requires that they all undergo employee fitness determinations \4\ and complete approximately 120 hours of training provided by the contractor and FPS, including basic training and firearms training. Among other duties, contract guards are responsible for controlling access to facilities; conducting screening at access points to prevent the introduction of prohibited items, such as weapons and explosives; and responding to emergency situations involving facility safety and security.\5\ FPS also faces challenges assessing risks at the 9,600 facilities under the control and custody of GSA. For instance, in 2012, we reported that FPS's ability to protect and secure Federal facilities has been hampered by the absence of a risk assessment program that is consistent with Federal standards. --------------------------------------------------------------------------- \4\ A contractor employee's fitness determination is based on the employee's suitability for work for or on behalf of the Government based on character and conduct. \5\ In general, guards may only detain, not arrest, individuals at their facility. Some guards may have arrest authority under conditions set forth by the individual States. --------------------------------------------------------------------------- This testimony is based on our September 2013 report, released today,\6\ previous reports,\7\ and preliminary results of work we conducted for a report that we plan to issue to the Chairman later this year.\8\ This testimony discusses: (1) Challenges FPS faces in ensuring contract security guards deployed to Federal facilities are properly trained and certified, and (2) the extent to which FPS and select Federal agencies' facility risk assessment methodologies align with Federal risk assessment standards issued by the Interagency Security Committee (ISC).\9\ To identify challenges associated with ensuring FPS's contract guards are properly trained and certified, we analyzed selected guard services contracts active as of September 2012 and FPS's Security Guard Information Manual. We drew a non-generalizable sample of 31 contracts from FPS's 117 guard services contracts (one contract for every guard company with which FPS has contracted for non-emergency guard services).\10\ A subset (11) of the 31 guard contracts was chosen based on geographic diversity and geographic density of contracts within FPS regions to allow us to conduct file reviews for multiple contracts during each of four site visits that we conducted. For each of these 11 contracts, we reviewed the contracts as well as a random sample of guard files associated with each contract. The remaining 20 guard services contracts we selected were the most recent contract for each of the remaining guard companies that FPS had contracted with as of November 2012. We also interviewed officials from each of the 31 contract guard companies. --------------------------------------------------------------------------- \6\ GAO, Federal Protective Service: Challenges with Oversight of Contract Guard Program Still Exist, and Additional Management Controls Are Needed, GAO-13-694 (Washington, DC: September 2013). \7\ GAO, Federal Protective Service: Actions Needed to Assess Risk and Better Manage Contract Guards at Federal Facilities, GAO-12-739 (Washington, DC: August 2012), GAO, Homeland Security: Federal Protective Service's Contract Guard Program Requires More Oversight and Reassessment of Use of Contract Guards, GAO-10-341 (Washington, DC: April 2010), and GAO, Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities, GAO-08-683 (Washington, DC: June 2008). \8\ That report will contain our final evaluation and recommendations about agencies' risk assessment methodologies. \9\ The Interagency Security Committee (ISC) was created pursuant to Executive Order 12977, 60 Fed. Reg. 54411 (Oct. 19, 1995), as amended by Executive Order 13286, 68 Fed. Reg. 10610 (March 5, 2003). The ISC is a permanent body established to address continuing Government-wide security for Federal facilities and was tasked with, among other things, developing security standards for Federal facilities. The ISC is comprised of primary members from Federal Executive branch agencies designated by the Executive Order as well as associate members from other agencies and departments not designated in the Executive Order. The ISC is to be chaired by the Secretary of DHS or a designee of the Secretary. \10\ When we chose contracts for review, FPS had a total of 117 contracts with 32 guard companies. However, 1 of the 32 companies had a contract with FPS for only emergency guard services. As such, we chose 1 contract for review for each company with which FPS had contracted for non-emergency guard services as of November 2012. --------------------------------------------------------------------------- To determine the extent to which contract guard companies documented compliance with FPS's guard training and certification requirements, we examined documentation related to our non- generalizeable sample of 11 contracts, as previously discussed. From these 11 contracts, we randomly selected 276 guard files to review for compliance with FPS requirements. For each guard file, we compared the file documents to a list of requirements contained in FPS's Administrative Audit and Protective Security Officer File Review Forms, which FPS uses to conduct its monthly guard file reviews. To identify the management controls and processes FPS and the guard companies use to ensure compliance with training, certification, and qualification requirements, we reviewed FPS's procedures for: (1) Conducting monthly guard file reviews; (2) documenting compliance with guard training, certification, and qualification requirements; and (3) monitoring performance. We also visited 4 of FPS's 11 regions to discuss how regional officials ensure that guards are qualified to be deployed to Federal facilities. We selected the 4 regions to provide geographic density of contracts in the region to facilitate reviews of guard files, diversity in the size of guard companies, and geographic diversity. In addition, we interviewed officials from each of FPS's 31 guard companies regarding their policies and procedures for complying with FPS's guard training and certification requirements. While the results of our work are not generalizeable, about 40 percent of the GSA facilities with guards are located in the four regions where we conducted our site visits and our review of guard files involved 11 of FPS's 31 guard companies. To assess the extent to which FPS's monthly guard-file review results identified files with missing documentation of training, certifications, and qualifications, we compared FPS's monthly file review results from the month in which we conducted our file review for each of the 11 contracts to identify guard files that were included in both our review and FPS's monthly review. We identified any discrepancies between the reviews and used FPS's file review forms to examine the discrepancies. To determine the extent to which FPS and select Federal agencies' facility risk assessment methodologies align with ISC's risk assessment standards, we reviewed and analyzed risk assessment documentation and interviewed officials at 9 Federal agencies and compared each agency's methodology to ISC's standards. The nine selected agencies include: Department of Energy, Office of Health, Safety, and Security; Department of Interior; Department of Justice, Justice Protective Service; Department of State, Diplomatic Security; Department of Veterans Affairs; Federal Emergency Management Agency; Federal Protective Service; Nuclear Regulatory Commission; and Office of Personnel Management. These agencies were selected to achieve diversity with respect to the number and types of agencies' facilities, as well as the agencies' missions. We conducted our on-going work from August 2012 to October 2013 in accordance with generally accepted Government auditing standards. Also, our previously-issued reports were done in accordance with these standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. fps faces challenges ensuring contract guards have been properly trained and certified before being deployed to federal facilities Some FPS Contract Guards Have Not Received Required Training on Responding to Active-Shooter Scenarios According to FPS officials, since 2010 the agency has required its guards to receive training on how to respond to an active-shooter scenario. However, as our 2013 report shows,\11\ FPS faces challenges providing active-shooter response training to all of its guards. According to FPS officials, the agency provides guards with information on how they should respond during an active-shooter incident as part of the 8-hour FPS-provided orientation training. FPS officials were not able to specify how much time is devoted to this training, but said that it is a small portion of the 2-hour special situations training.\12\ According to FPS's training documents, this training includes instructions on how to notify law enforcement personnel, secure the guard's area of responsibility, appropriate use of force, and direct building occupants according to emergency plans. --------------------------------------------------------------------------- \11\ GAO-13-694. \12\ This training is provided during a block of training on special situations, which includes information on how guards should respond to situations other than their normal duties, such as reports of missing or abducted children, bomb threats, and active-shooter scenarios. FPS officials stated that guards hired before 2010 should have received this information during guard-company-provided training on the guards' post orders (which outline the guards' duties and responsibilities) as part of basic and refresher training. --------------------------------------------------------------------------- However, when we asked officials from 16 of the 31 contract guard companies we spoke to if their guards had received training on how guards should respond during active-shooter incidents, responses varied.\13\ For example, of the 16 contract guard companies we interviewed about this topic: --------------------------------------------------------------------------- \13\ The remaining 15 guard companies did not respond to this question. --------------------------------------------------------------------------- officials from 8 contract guard companies stated that their guards have received active-shooter scenario training during FPS orientation; officials from 5 guard companies stated that FPS has not provided active-shooter scenario training to their guards during the FPS-provided orientation training; and, officials from 3 guard companies stated that FPS had not provided active-shooter scenario training to their guards during the FPS-provided orientation training, but that the topic was covered at some other time. We were unable to determine the extent to which FPS's guards have received active-shooter response training. Without ensuring that all guards receive training on how to respond to active-shooter incidents, FPS has limited assurance that its guards are prepared for this threat. FPS agreed with our recommendation that they take immediate steps to determine which guards have not received this training and provide it to them. Some FPS Guards Have Not Received Required Screener Training As part of their 120 hours of training, guards must receive 8 hours of screener training from FPS on how to use X-ray and magnetometer equipment. However, in our September 2013 report,\14\ we found that FPS has not provided required screener training to all guards. Screener training is important because many guards control access points at Federal facilities and thus must be able to properly operate X-ray and magnetometer machines and understand their results. In 2009 and 2010, we reported that FPS had not provided screener training to 1,500 contract guards in one FPS region.\15\ In response to our reports, FPS stated that it planned to implement a program to train its inspectors to provide screener training to all of its contract guards. However, 3 years after our 2010 report, guards continue to be deployed to Federal facilities who have never received this training. For example, an official at one contract guard company stated that 133 of its approximately 350 guards (about 38 percent) on three separate FPS contracts (awarded in 2009) have never received their initial X-ray and magnetometer training from FPS. The official stated that some of these guards are working at screening posts. Further, officials at another contract guard company in a different FPS region stated that, according to their records, 78 of 295 (about 26 percent) guards deployed under their contract have never received FPS's X-ray and magnetometer training. These officials stated that FPS's regional officials were informed of the problem, but allowed guards to continue to work under this contract, despite not having completed required training. Because FPS is responsible for this training, according to guard company officials no action was taken against the company. Consequently, some guards deployed to Federal facilities may be using X-ray and magnetometer equipment that they are not qualified to use--thus raising questions about the ability of some guards to execute a primary responsibility to properly screen access control points at Federal facilities. We were unable to determine the extent to which FPS's guards have received screener training. FPS agreed with our recommendation that they take immediate steps to determine which guards have not received screener training and provide it to them. --------------------------------------------------------------------------- \14\ GAO-13-694. \15\ GAO, Homeland Security: Federal Protective Service Has Taken Some Initial Steps to Address Its Challenges, but Vulnerabilities Still Exist, GAO-09-1047T (Washington, DC: Sept. 23, 2009) and GAO-10-341. --------------------------------------------------------------------------- FPS Lacks Effective Management Controls to Ensure Guards Have Met Training and Certification Requirements In our September 2013 report, we found that FPS continues to lack effective management controls to ensure that guards have met training and certification requirements. For example, although FPS agreed with our 2010 and 2012 recommendations to develop a comprehensive and reliable system for contract guard oversight, it still does not have such a system. Without a comprehensive guard management system, FPS has no independent means of ensuring that its contract guard companies have met contract requirements, such as providing qualified guards to Federal facilities. Instead, FPS requires its guard companies to maintain files containing guard-training and certification information and to provide it with a monthly report containing this information. In our September 2013 report, we found that 23 percent of the 276 guard files we reviewed (maintained by 11 of the 31 guard companies we interviewed) lacked required training and certification documentation.\16\ As shown in Table 1, some guard files lacked documentation of basic training, semi-annual firearms qualifications, screener training, the 40-hour refresher training (required every 3 years), and CPR certification. --------------------------------------------------------------------------- \16\ See GAO-13-694. During our non-generalizeable review of 276 randomly-selected guard files, we found that 64 files (23 percent) were missing one or more required documents. TABLE 1.--TOTAL MISSING DOCUMENTS IDENTIFIED IN 64 OF 276 GUARD FILES GAO REVIEWED ------------------------------------------------------------------------ Number of Instances of Requirement Each Missing Document ------------------------------------------------------------------------ Copy of driver's license/State ID....................... 1 Domestic Violence ``Lautenberg'' Form................... 1 Medical certification................................... 1 Verified alien/immigration status....................... 3 Current baton certification............................. 3 Basic training.......................................... 3 Firearms qualifications................................. 3 First-aid certification................................. 5 FPS screener training--8 hours.......................... 5 FPS orientation......................................... 8 Contractor employee fitness determination............... 12 CPR certification....................................... 12 AED certification....................................... 12 Refresher training...................................... 15 Pre-employment drug testing............................. 16 Initial weapons training................................ 17 --------------- Total............................................. \1\ 117 ------------------------------------------------------------------------ Source.--GAO analysis of contract guard company data. Note.--These results are non-generalizeable and based on a review of 276 randomly-selected guard files for 11 of 117 FPS guard contracts. \1\ Some of the files that did not comply with requirements were missing more than one document, for a total of 117 missing documents. FPS has also identified guard files that did not contain required documentation. FPS's primary tool for ensuring that guard companies comply with contractual requirements for guards' training, certifications, and qualifications is to conduct monthly reviews of guard companies' guard files. From March 2012 through March 2013, FPS reviewed more than 23,000 guard files.\17\ It found that a majority of the guard files had the required documentation but more than 800 (about 3 percent) did not. FPS's file reviews for that period showed files missing, for example, documentation of screener training, initial weapons training, CPR certification, and firearms qualifications. However, as our September 2013 report explains, FPS's process for conducting monthly file reviews does not include requirements for reviewing and verifying the results, and we identified instances in which FPS's monthly review results did not accurately reflect the contents of guard files. For instance, FPS's review indicated that required documentation was present for some guard files, but we were not able to find documentation of training and certification, such as initial weapons training, DHS orientation, and pre-employment drug screenings.\18\ As a result of the lack of management controls, FPS is not able to ensure that guards have met training and certification requirements. --------------------------------------------------------------------------- \17\ FPS has approximately 13,500 contract guards, but FPS may review a guard file more than once annually. \18\ For more information on this review and our methodology, see GAO-13-694. --------------------------------------------------------------------------- GAO's Recommendations to Improve the Management and Oversight of FPS's Contract Guard Program In our September 2013 report, we recommended that DHS and FPS take the following actions: take immediate steps to determine which guards have not had screener or active-shooter scenario training and provide it to them and, as part of developing a National curriculum, decide how and how often these trainings will be provided in the future; require that contract guard companies' instructors be certified to teach basic and refresher training courses to guards and evaluate whether a standardized instructor certification process should be implemented; and, develop and implement procedures for monthly guard-file reviews to ensure consistency in selecting files and verifying the results. DHS and FPS agreed with our recommendations. preliminary results indicate that fps and select federal agencies' risk assessment methodologies do not align with isc's risk assessment standards Risk assessments help decision makers identify and evaluate security risks and implement protective measures to mitigate the potential undesirable effects of these risks. ISC's risk assessment standards state that agencies' facility risk assessment methodologies must: Consider all of the undesirable events identified by ISC as possible risks to Federal facilities, and assess the threat, vulnerability, and consequence of specific undesirable events. Preliminary results from our on-going review of 9 Federal agencies' risk assessment methodologies indicate that several agencies, including FPS, do not use a methodology that aligns with ISC's risk assessment standards to assess Federal facilities.\19\ --------------------------------------------------------------------------- \19\ ISC's risk assessment standards define ``Federal facilities'' as Government-leased or -owned facilities in the United States occupied by Federal employees for non-military activities. Aside from intelligence-related exceptions, Executive branch agencies and departments are required to cooperate and comply with ISC's standards, including its risk assessment standards. These standards do not apply to Legislative branch agencies and Federal facilities occupied by military employees. --------------------------------------------------------------------------- Most commonly, agencies' methodologies are not consistent with ISC's standards because agencies do not assess their facilities' vulnerabilities to specific undesirable events. For example, officials from one agency told us that their vulnerability assessments are based on the total number of protective measures in place at a facility, rather than how vulnerable the facility is to specific undesirable events, such as insider attacks or vehicle bombs. Because agencies' risk assessment methodologies are inconsistent with ISC's risk assessment standards, these agencies may not have a complete understanding of the risks facing approximately 57,000 Federal facilities located around the country--including the 9,600 protected by FPS and several agencies' headquarters facilities.\20\ --------------------------------------------------------------------------- \21\ For example, if an agency's methodology does not consider all the undesirable events identified by ISC, and/or it does not assess all three components of risk (threat, vulnerability, and consequence), then the agency would have an incomplete picture of risk at facilities assessed using this methodology. --------------------------------------------------------------------------- Moreover, because risk assessments play a critical role in helping agencies tailor protective measures to reflect their facilities' unique circumstances and risks, these agencies may not allocate security resources effectively, i.e., they may provide too much or too little protection at their facilities. Providing more protection at a facility than is needed may result in an unnecessary expenditure of Government resources, while providing too little protection may leave a facility and its occupants vulnerable to attacks. For example, if an agency does not know its facility's potential vulnerabilities to specific undesirable events, it cannot set priorities to mitigate them. In addition, we reported in 2012 that although Federal agencies pay FPS millions of dollars to assess risk at their facilities, FPS's interim facility assessment tool--the Modified Infrastructure Survey Tool (MIST)--was not consistent with Federal risk assessment standards and had other limitations. Specifically, FPS's risk assessment methodology was inconsistent with ISC's risk assessment standards because it did not assess the consequence of possible undesirable events (i.e., the level, duration, and nature of loss resulting from undesirable events). FPS officials told us that MIST was not designed to assess consequence, and that adding this component would have required additional testing and validation. However, without a risk assessment tool that includes all three components of risk--threat, vulnerability, and consequence--as we have recommended, FPS has limited assurance that facility decision-makers can efficiently and effectively prioritize programs and allocate resources to address existing and potential security risks.\21\ Furthermore, because MIST also was not designed to compare risks across facilities, FPS has limited assurance that it prioritizes and mitigates critical risks within the agency's portfolio of more than 9,600 Federal facilities. --------------------------------------------------------------------------- \21\ FPS agreed with our 2012 recommendation, but has yet to implement it. --------------------------------------------------------------------------- This concludes our testimony. We are pleased to answer any questions you, Ranking Member Barber, and Members of the subcommittee might have. Mr. Duncan. Well, I thank you so much, Mr. Goldstein and all the witnesses for your excellent testimony. Mr. O'Rourke is recognized. Mr. O'Rourke. Mr. Chairman, I ask unanimous consent that the gentlewoman from Texas, Ms. Jackson Lee, be allowed to sit and question the witnesses at the hearing's end. Mr. Duncan. Without objection, so ordered. The Chairman will now recognize himself for 5 minutes. My intent today is, since we do have a small committee, active committee today, is just to allow us to delve into the issue. We are going to try to adhere to the 5-minute rule, but I will allow some leeway, because I do want some questions answered and I want you to have--to feel free to--to really get into the subject, but within reason. So. What I would like to do is I want to go to the Navy Yard shooting, Director Patterson, first, and ask you a question about how a FPS officer actually engages an active shooter or doesn't engage. Then I will back up and start delving into the background checks and what we do to make sure this doesn't happen. I realize that we have a lot of Federal facilities. I also realize that risk assessment is generally looking at keeping someone from breaking into the facility from outside, and this was a unique inside access issue with the Navy Yard shooter. So, now we have had to think about that sort of thing versus a typical risk assessment of a facility, looking at the entries and exits and the guards, the personnel necessary to secure the premises. But now we have got a different scenario to think about. So, according to your response letter to GAO's report, Director Patterson, a protective service officer, or PSO's, actions if unable to visibly see an active shooter, they are dictated by his or her post orders. Although armed, a PSO is not supposed to engage in tactics associated with law enforcement response. So, could you please explain in further detail what steps a PSO is supposed to take in an active-shooting situation? Mr. Patterson. Yes, sir, I sure can. Well, first of all, sir, I just want to let you know that our No. 1 priority is the protection of the people in the Federal facility. That is No. 1. The first--in the event of an active-shooting situation, the first step to be taken by the PSO, because that is our first line of defense, will be to call our megacenter, to allow them to pass that information on to our megacenter. That is where the information is passed that will allow not only that information to be passed to our inspectors, but also to local law enforcement, that there is a situation that is evolving or taking place in that facility. Mr. Duncan. Excuse me, just a second. Will you do that by landline or would that be a radio comm? Mr. Patterson. It will be both, sir. He will do it by landline and then by radio comm. Mr. Duncan. Okay. Mr. Patterson. So that we have a general awareness of what is going on. Then there will be an assessment by that PSO as to what action that he needs to take next. Our PSOs are trained to take action in emergency situations. Because they are not Federal or State law enforcement officials, they are constrained by--the contractor is constrained by State law as to what he or his company can do in these situations. So that is why we don't have what we call active-shooter training, if you will, where our PSOs will go out and actively pursue an active shooter. However, if we come across a situation where that PSO is the only individual in that facility and has no reasonable expectation that law enforcement can respond in a reasonably quick manner, then that individual will more than likely take action to limit the damage of the active shooter. Mr. Duncan. Let me ask this, because as you were talking, I am trying to envision--you have an active shooter in a building like the Navy Yard. The PSO hears the shots, understands lives are possibly threatened, picks up the phone, calls his supervisor to try to get permission or at least let them know what is going on, but then try to get permission on how to act beyond his post orders. Does the same thing with radio comms. Coordination between the PSOs within the facility. While these bureaucratic, seems to me bureaucratic, steps are put in place or being activated, are lives not threatened even further during that? Is there a delay, I guess is what I am asking? Does that put the public safety at risk? Mr. Patterson. Unfortunately, sir, the challenge here is that we don't know what is really happening and neither does the PSO. So he has a responsibility to the people in that area. His responsibility is to ensure that he can get either--keep people from coming into the building or getting people out of the building. So he has got a job to do right there. In this case, we are hoping, we believe that we are going to have a quick response by either Federal law enforcement, our folks, or by the State and local, if they are in the area. If the situation dictates that we believe that we are in a remote area and we don't think that someone is going to be able to come quickly, then he will take action. Mr. Duncan. Right, and I get that. We had a conversation yesterday with staff about that scenario. The PSO actually securing his entry-door exit, but also making sure that an exit is available for personnel within the building to flee the scene and make sure no one--another active shooter doesn't come in as part of a team. So I get all that. Mr. Patterson. Right. Mr. Duncan. I just want to make sure there is not a delay. You have answered that question fairly well. So I want to go to Mr. Marshall and ask, if for any reason an individual is deemed a threat, and I know with the Navy Yard shooter, there was some evidence there, but whether it got to the proper person to make that decision is still being investigated. You know, how we miss those signals. But if an individual is deemed a threat, are you able to deactivate their access credential remotely? Talk me through the process of how their credentials are pulled or their access is denied and limited, if you could. Mr. Marshall. Yes, sir. If derogatory information about an individual reaches us, we will investigate it and we will take the necessary steps to make sure that if that person is deemed a threat after the investigation, we can deactivate their card. Not only their card, but we can also deactivate their access in whatever physical security access system or PACS system that that person has access to. That can be done remotely, yes, sir. Mr. Duncan. That is on a swipe. But let's talk about maybe a flash pass or some credential that they may have on their persons. I guess at this point an actual supervisor would take that, if it was a termination issue. If it was an issue where they were going to restrict their access, would they be issued an additional credential, a different color, a different code on there, which I think is important? How would that be handled? Mr. Marshall. No, sir. If derogatory information reached us, and it was deemed to be good information, we would deactivate their card, both their card and also the access system. We would bring them in and read them out, if they had a security clearance, we would read them out. So they would not only not have access to Classified information any longer, they would also not have access to facilities. An added step that we would take, once we would deactivate their access, we would also do something called a ``do not admit''. That is a couple of different things. We would go into our personnel security system, which is an enterprise system, and make a notation in their record in the personnel security system that they no longer have a clearance or access to facilities. We would also notify the buildings or the locations where that person primarily has a mission responsibility, and we would send a flyer with that individual's picture on it and circumstances surrounding that person's removal of access to that facility. So everybody would be notified. Mr. Duncan. Yes. I think this has some implications with how we deal with TSA and access Air Force training Mr. Hudson may get into. Because I think we are looking at the whole scope of access and whatnot. Just my last question--you told the subcommittee staff at a recent meeting that DHS lacks information on access control systems across the DHS facilities. Headquarters is in the process of compiling this information from its components. But 10 years after the Department's creation, it is unclear to me why DHS headquarters would not know how to access DHS facilities, how that is controlled throughout the Department. So what is going on now? Is there some sort of uniformity, some sort of activity now to--listen, I go to a lot of Federal buildings here in this city and I know that access to every building is different. Whether they are DHS-coordinated or whether GSA handles that. So what is going on? Are we looking for uniformity? Are we looking for changes to those systems? If you could just tell me that. Mr. Marshall. Yes, sir. That is exactly what we are doing, Congressman. We are moving towards a federated system. Obviously, you know DHS is a legacy agency. We are formed of agencies that were already in existence. As a result of that legacy heritage, everybody had their own PACS systems, their own access controls systems, and they are all completely different. So the first order of business when the Homeland Security Presidential Directive 12 was implemented was to issue the PIV cards. Because there is no sense in changing out all the readers unless everybody had the card to use on the reader. So that was a heavy lift. We issued over 250,000 PIV cards with the help of the components. Everybody has a PIV card now. So then the next step, the next phase was to roll out an implementation of these legacy systems and eliminating them altogether. Last fall, I issued a--with the help of my staff-- issued a PACS modernization strategy for DHS, which includes headquarters and the eight components. That directed all the components' chief security officers to develop implementation plans on their strategy for switching out the PACS systems and the readers. They were required to submit implementation plans by early 2013. They all did. Now we are moving towards the roll out, the switching out of the readers. Headquarters, which I have oversight over, direct oversight over, we have 34 facilities. All 34 facilities have been switched out. We now have HSPD-12 compliant readers in all the headquarters facilities. FLETC, which is one of our components, it switched out all their facilities. FEMA, which I am happy to say is leading the effort with this, were the first to switch out all their readers. So we have--we are at various degrees of completion in this whole process. I know ICE has started to switch out their readers. They are at approximately 12 percent of switching out, so they have begun their roll out. I know TSA has begun their roll out. They are approximately at 12 percent. Citizen Immigration Service, they are right behind TSA and ICE, they are at about 9 percent. So mostly the larger agencies like CBP and Coast Guard and the Secret Service, to some degree, they are following close behind. But the important thing to know for this committee is that we have already begun that roll out and a lot of the components are looking for funding streams to accelerate the roll out, but we are well on our way. Mr. Duncan. Yes, well, let me just say that I understand the enormity of the number of Federal buildings across the Nation that you are charged with trying to protect. It is going to take a while. But I am glad to see a task force is looking at that. My final question--you mentioned 3,200 personnel security guards have been trained. Where are they trained? Is that private training and what is the process of certifying that training facility? Or do they go to FLETC? Are they trained by some sort of Governmental agency? Or is it all private? Mr. Marshall. Is that question for me, sir? Mr. Duncan. Yes. Mr. Marshall. Okay. Mr. Duncan. I think you are the one that said 3,200 officers have been trained. Mr. Marshall. That wasn't me, sir. Mr. Duncan. Okay. Was that Director Patterson? Mr. Patterson. I am sorry. What was the context of the question, sir? I am sorry. Mr. Duncan. Well, regardless, how are the contract personnel, the officers, trained? Are they trained at FLETC or are they trained by private contractors? How is that facility certified? I don't care who answers. Mr. Patterson. Yes, sir, I can answer that. Yes. Our 13,000 contracting guards are trained in a couple of ways. One, much of the training is done in-house by the contractor. But second, we also, as FPS, our inspectors also are trained as trainers to go out and provide much of the--some of the training as well. For instance, firearms training is conducted by the contractor, but overseen by a firearms instructor from FPS. So there is some oversight where they are in fact doing the training. So there are a number of training venues where you have the contractor who is providing the training, but FPS is providing oversight for that training. Mr. Duncan. They are looking at the total curriculum, not just firearms training? Mr. Patterson. Yes, sir. That is exactly--yes, we look across the spectrum. Now, there are some things that we just leave to the contractor. It might be CPR. We probably don't need to be involved in that and a few other things, but for the most part, yes, we do have oversight. Mr. Duncan. Thank you. The Chairman will recognize Mr. O'Rourke, the acting Ranking Member, for questions. Mr. O'Rourke. I want to thank the Chairman again for making today's hearing possible. I recognize that the true Ranking Member has just arrived. I am going to keep my questions brief, and then we will yield this chair to him. But on this issue of balance, almost each of you mentioned a risk-based approach and trying to balance the costs and benefits both in dollars and security, and what it is we get out of that. So, for Director Patterson, what kind of metrics do you have or what numbers do you use to know whether or not we have struck that right balance? Then I want to ask a follow-up question on what you are doing to implement some of the recommendations made by the GAO with respect to that. But first, I would like to ask you to respond to that question about balance and how you measure that. Mr. Patterson. Sure. Well, you know, we have over 9,500 Federal facilities that we are responsible for protecting. Of those facilities, there are a large number that are what we call facilities, security level 4, which really are a very high priority. So we have to take a look at how we dedicate resources to those facilities and doing assessments at those facilities over a period of time. So, we have a metric there that we look at those number of facilities and how often we get to take a look at and use a risk-based method, if you will, for how often we do surveys at those facilities. Currently, we are surveying those facilities, doing security facility security assessments approximately every 3 years at our most sensitive and vulnerable, what we feel to be, high-risk facilities. But however, we are applying a risk-based model to look at, you know, what are the real vulnerabilities there; what is the threat; and do we really have to continue to expend really scarce resources on doing it every 3 years, or could we extend that out a little bit? So, we do have a metric there to look at and work with the security council at those facilities to look at what is the right mix of service that we provide relative to the assessment process. Mr. O'Rourke. Let me ask you a question, sorry to interrupt you. Mr. Patterson. Yes. Mr. O'Rourke. You know, on one end of the spectrum, you could pat down every single person who enters a Federal facility; search every square inch of their cars they are driving into a Federal garage. On the other end, you could wave everybody through without taking any precautions. When you have an event like the Navy Yard's shooting, how does that change your assessment? How does that factor into looking at what you are already doing right now? How does that change your procedures and your policies? How does that change what you are willing to spend on it or what you are willing to ask for to be spent on it? Mr. Patterson. Yes, we look at that very carefully. I will tell you, you know, when an individual is given a PIV card, there is a level of trust that the Government says that we are giving to you based upon a background investigation. We still have confidence in that background investigation process until we find out that it is not serving us well. We still think-- believe that it has served us well. So, as far as doing anything that would be beyond, or moving beyond the current process that we utilize to bring people into the building, we are looking at our processes. We are evaluating them, but we think that they still hold true relative to the protection that they provide us based on the background investigation. Mr. O'Rourke. Last question. In terms of GAO findings that we weren't assessing risk at a number of Federal facilities; some of the training issues that the Chairman has brought up, do you agree with those conclusions and findings? Is your plan over the coming year to actively address those based on those conclusions reached in that report? Mr. Patterson. Yes, sir. We have been addressing these since 2010. What we are looking at is a multitude of ways that we can approach the myriad of challenges that we have in this area. We are looking at how we leverage technology. We are looking at how we bring on more folks in specialized areas like contract oversight that will help us to better understand what is going on in our contracts. We are looking at how we refocus the day-to-day efforts of our inspectors to help us better understand how we can move forward in providing a better service to our customers. So yes, sir, we are, but we have been working on this since 2010 and we have still got some ways to go, but I think we are making a lot of progress. Mr. O'Rourke. Thank you. Mr. Chairman, I yield back. Mr. Duncan. I thank the gentleman from Texas, and now recognize the gentleman from North Carolina, the Chairman of the Transportation Security Subcommittee, Mr. Hudson, for 5 minutes. Mr. Hudson. Thank you, Mr. Chairman. I want to thank our panel for being here today. I appreciate your time and expert testimony. Director Patterson, thank you for your service to our country. One of the statements you made was that PSOs are constrained by State law in terms of what they can do in response to an incident. Can you help me understand that, maybe give me an example of a State law that would prevent PSOs from engaging an active shooter? Mr. Patterson. Yes, sir. That would be in the use of firearms. They are regulated--the States regulate the way that they--what they can do and the use of their firearms. So, because they are not Federal law enforcement officers, they don't carry the same statutory authority as we do to go in and take charge of searches in certain situations. So, State laws will dictate whether or not a PSO has the authority to go in and take certain actions that would normally be performed by a law enforcement officer. Mr. Hudson. Has there been any analysis of the impacts of that? I assume, you know, there are certain States that we are all aware of that have more strict gun control laws. Mr. Patterson. Right. As a result of the Navy Yard shooting, we are looking at that and working with our contracting office. We are working with the legal folks, as well as internally within DHS to take a look at, is there something that we can do to maybe move beyond where we are now to actually provide our contracting guards active-shooter training so that it will in fact allow them to go out, pursue, and function as a law enforcement officer would? Mr. Hudson. I appreciate that. I guess the follow-up question would be, as you look at, I guess each State has different ways you can respond. I am still concerned, though, that there is not--seems to be widespread- enough active-shooter training for these guards, even if you can't engage with a firearm. It seems like running through scenarios and having training on how to deal with this type of scenario would still be beneficial. Mr. Patterson. Yes, sir. I totally agree. We are doing that. We are looking at what training--we are working with the security companies now to look at, you know, how we can deliver that training and what training would be beneficial to them. Yes, sir, we are doing that. Mr. Hudson. Great. I think that is important. What role did FPS play in the Navy Yard shooting specifically? Could you maybe give us a little more details, sort-of how that played out and what your role was in that incident? Mr. Patterson. Yes, sir. Well, we didn't play an active role. What we did is when we received a notification that in fact there was an active shooter at the Navy Yard, we did recognize at that point--well, first of all, we were part of the incident command center where the District of Columbia, where the Defense Department and other Federal agencies had a command center to more or less--information would pass back and forth. So we put someone there so that we were in full cognizance of what was going on. We also recognized at that point that we had a Federal facility that was adjacent, the Department of Transportation is adjacent to the Navy Yard. So we immediately contacted and worked with the Federal folks there, and looked at whether or not we needed to shut down the building and control access, and we did. So, from that standpoint, what we did was we ensured that we had complete control of the Federal facilities around the Navy Yard, so that there was no egressor or someone coming in that we--that shouldn't, as well as standing by for any assistance that the folks at the Navy Yard might need. Eventually, they did call us and ask for some canine support that we provided. So we sent over a couple of our bomb dogs to assist with their activities over there, as they were working--going through the buildings to assess whether or not the shooter had left some explosive devices. Mr. Hudson. Thank you. Mr. Marshall, according to several news reports, radios failed law enforcement once they got inside the facility that day. What has been done or is being done to ensure this problem doesn't exist for Federal Protective Service or other Federal partners? Is there a radio interoperability issue that we need to be aware of? Mr. Marshall. Well, let me caveat my answer, Congressman, with, first of all, I haven't been briefed on the Navy Yard incident first-hand, so everything I know about what happened there, is anecdotal. But I--what I can speak on interoperability to some degree: We learned some lessons, obviously, from 9/11, about the inability of the NYPD and FDNY to interoperate during that incident, so much so that it caused a lot of State and local police departments around the United States to address that issue. In my former agency, I was actually in charge of addressing that issue, going to an 800-megahertz radio system so that we could interoperate with our regional partners and our allied law enforcement agencies. Specifically to your question, I did hear, second-hand, that there were some interoperability problems at the Navy Yard. I can speak, first-hand, about what actions I have taken with respect to that issue at DHS headquarters. I am fortunate enough at headquarters to have a cadre of law enforcement officers who are FLETC-trained with full arrest powers. We work in conjunction with the Federal Protective Service and the contract guard force there. We also have a great relationship with the Metropolitan Police Second District that services the facility on the Nebraska Avenue complex. So I asked that question right after the Navy Yard. There are some interoperability issues that we are addressing. The first thing we did was, we have an opportunity to join the regional police mutual aid radio network, also known as PMARS. I first became acquainted with PMARS when I was a U.S. Capitol police officer, back in the 1980s. So the U.S. Capitol Police is a member of that organization. So I have petitioned the Metropolitan Council of Governments to become a member of the PMARS system. I believe our application will be accepted, and hopefully when that is implemented, we will be able to push a button, or somebody will be able to push a button and everybody can go to a single talk group and be able to address any kind of incident that might occur. Mr. Hudson. Appreciate that. Mr. Chairman, I see I am out of time, so I yield back. Mr. Duncan. I thank the gentleman. Now, the Chairman will recognize the Ranking Member, the gentleman from Arizona, Mr. Barber. Welcome to the committee hearing. I know you had a mark-up today. As we mentioned earlier, a lot of Members did. But I am glad you were able to make it, and I recognize you for 5 minutes. Mr. Barber. Thank you, Mr. Chairman. Thanks to the witnesses. I am sorry I wasn't here to hear your testimony in person, but I do have a couple questions. They may have been asked and answered, but I would like to explore them. Let me start, if I could, with Mr. Goldstein. The question, first of all, is: Based upon your review of the security screening processes at Federal facilities, what is your view of a need for a uniform standard, no matter what the facility, where it is? Do you believe that we need to have that imposed across all Federal facilities? Mr. Goldstein. We haven't looked specifically at whether that policy would be beneficial or not. But I can tell you that the variety of systems used throughout the Federal facilities combined with the fact that many officers, contract guard officers have not been fully trained, certainly does not give FPS or the public or workers, Federal employees, assurance that the facilities are well-protected. Those things combined I think do create problems for the Government. Mr. Barber. Well, let me follow up on what you just said about training and the perhaps inadequacy of the training, particularly with the companies under contract to provide security services. Could you give a couple of examples--you may have already done it in your earlier testimony--of what you found in regard to the training, of deficiencies with the security companies that have been under contract with DHS? Mr. Goldstein. Yes, sir. We found in our review, in the report that is being released today, that several contract guard companies that we interviewed did not have any experience with FPS providing them the active-shooter training or the screener training, both of which are required in their contracts. Mr. Barber. Having said that, let me ask Mr. Patterson a follow-up question regarding that. Every contract that the Federal Government lets has expectations, I presume has performance standards. Could you tell us what the expectations and the performance standards are for contractors with regards to training of their personnel? Mr. Patterson. Yes, sir. We have an expectation that every guard who stands post at a magnetometer or X-ray machine will be trained. Period. Now, there are not X-ray machines and magnetometers at every post. So, there could conceivably be, quite frankly, a number of posts, a number of guards, who aren't necessarily trained on X-ray and magnetometer services who are serving on duty because they are not at one of those posts. But our expectation is that if you are standing post at an X-ray or magnetometer, you will be trained in that service. Mr. Barber. Beyond that, I assume the contracts have some specificity regarding other aspects of training the personnel. Mr. Patterson. Yes, sir. There are about 13 certifications that each PSO must have in order to take a position as a contract guard, from firearms to CPR to, in some cases, magnetometer and X-ray machine, safety, and things of that nature. Mr. Barber. So in order to get out in front of a problem that apparently has been identified by the GAO, in other words, finding those companies that have not fully met their commitments under the contract, what can you, what have you been doing proactively to find out where those deficiencies are identified? What, if any, contract requirements, in terms of any reimbursement to the Federal Government or any potential loss of contract--what happens, first of all, do you find it; second, what happens when you find there is a problem with a contract agency? Mr. Patterson. Yes, sir. There are a number of things that we do. First of all, our inspectors conduct what we call post inspections. That means they go out to the facilities and they talk to the guards and validate through a number of ways their training. They actually--we are required--it is an FPS requirement for us to review at least 10 percent per month of all of the contractor training records for a particular geographic area. So if we, within a particular FPS region, that regional director is required to go out and review at least 10 percent of those records. One of the challenges that we have had is that there have been some inconsistencies in the process in which we review those records. So we are getting that together now and figuring out and going about a, or moving forward in a more uniform manner in how we review those records. Currently, I have directed a--we are conducting a 100 percent audit in four of the regions to take a look at how--and when I say 100 percent, I am talking about 100 percent right now. We are not gonna wait 10 percent, 10 percent, 10 percent. It is 100 percent within the next few months--2 months, within 4 of our regions, so that we can validate and look at what, in fact, our contractors are delivering to us, relative to the training that they say that they are. So, we are also developing, working with the Department of Homeland Security Science and Technology group a way that we can electronically validate and track this, so that I don't have 600 of my law enforcement guys out trying to track down over 160,000 training records, okay? It is inefficient and ineffective right now. So what we are trying to do is better--instead of having to plow through these records every month, to create an electronic system where these records can be folded into the system and then we can review them that way without having to send our folks to physically go and touch each record. Because it takes a lot of time. Quite frankly, the records can change. Records expire, they change. So in effect, when you have got 160,000 records at any given time, some of those records can be out of date, just because they expire over time. Mr. Barber. Well, I thank you. My time is up, but I just want to urge you to continue this aggressive action to make sure that everyone is trained to a standard, because that is one way for sure that we can hope for the protection to be universal across all Federal facilities. Thank you, Mr. Chairman. I yield back. Mr. Duncan. I thank the gentleman. The Chairman will now recognize Ms. Jackson Lee, the gentlelady from Texas, for 5 minutes. Ms. Jackson Lee. Mr. Chairman, let me thank both you and Mr. Barber for your courtesies and how timely a meeting this is. I thank you so very much. I hope that the witnesses, let me thank you for your testimony, will view the work of this committee, this subcommittee in particular, but the full committee Chairman and Ranking Member, as partners in excellence. I see this hearing as an attempt for excellence on behalf of the American people. Certainly, although we know that the jurisdiction of the Navy Yard falls in particular under DOD, and we know that there is a pending investigation, let me just say for the record two things before I pose my questions. One, I hope that this committee will have another--I know that we had some conversation, a secured briefing on the Navy Yard circumstances. Second, as a Member of Congress, I am always disturbed no matter what administration it is to rebuff members by talking about a pending investigation. We are sworn as officers of this Nation. We take an oath. We take a signed statement on Classified information. But more importantly, that is an easy way to hinder our oversight, which is it is a pending investigation. Well, a pending investigation could last for eternity. As I reflect on having been here for 9/11, what we discovered and should have been discovered--maybe it should have been discovered preceding the heinous and horrific tragedy if there was the appropriate interaction between the levels of government with the Members of Congress both House and Senate. So, I hope that the pending investigation of the Navy Yard will either move quickly or that the persons engaged will recognize that we, as Members of Congress, have a responsibility to the American people and those lost souls to be able to provide immediate solutions and resolutions. Which lies in the questioning that I wish to pose and hopefully will have the time to do so, as I thank all of the Members who are here. One, like the Ranking Member of the full committee, I believe that we should be enormously concerned of the securing of the Federal buildings that are throughout America. You could look at the Navy Yard as a Federal entity. It had a different jurisdiction, but it was penetrated, as was the Fort Hood in my State, which we continue to mourn the loss of military personnel and civilians who should have technically been on the safest place--one of the safest places in America. So, my question is to follow up on the training of those who protect. I am reminded of the Holocaust Museum, which is I guess semi-private, semi-public, but let me go further into how do we get a handle on training those who are then contracted- out on these Federal buildings? FPS contracts out. How do we get a handle? Is there an inventory of all of these contractors? Is there a set training structure for all of those contractors? One question. The second question is: Do we do continuous training of these individuals that are hired? I want to say to those in the Mickey Leland Building in Houston and FPS, we respect and thank you for your great service. We want to make it better. Last, this is a discussion I had with Chairman Duncan. I would like to know from Homeland Security how you would perceive having the responsibility of doing your background check? Do you do your own background check? Could it not be placed under the Office of Management to be able to have control over the contractors that you contract, and also your employees? It is a simple task. Mr. Chairman, I know that I am down at the limit, but I would ask for the ability for these individuals to answer the question. Mr. Duncan. I will grant a little leeway. Ms. Jackson Lee. I thank you. I haven't told--I will start with the gentleman from GAO, but I would like a response from the interagency and others who jump in on this last question dealing with the background checks. Mr. Goldstein. Ma'am, the work we have done that we are presenting to the committee today doesn't actually get into the issue of background checks. It was focused on the training and the certification of the contract guards. So I am not really in a position to answer that. Ms. Jackson Lee. Yes, I wasn't asking you that. You answer the question that you are able to do, which is the training of the contractors and how often. I want other members to answer the background checks question. Thank you. Mr. Goldstein. Certainly. We do feel that more attention to training and certification on the part of FPS is required. Much of the training that the contract guard companies say they are not getting is training related to active shooters and to other screening that is presented by FPS. To some degree, there has been an issue of shortages among personnel to get out to all the contractors, but to be fair, they have had a number of years. We first raised the issue of screener training about 4 years ago when we did penetration testing at Federal facilities around the country and were able to get bomb-making materials into 10 Federal buildings in 4 cities. So this has been an open issue now for a number of years. So, to still have Federal Protective Service contract guards at Federal facilities who don't have the required training to be in front of the machines they are using, this does not bode well. Ms. Jackson Lee. Again, the rest of the members there, answer the question about do you do your internal background checks, do you continuously have background checks on your contractors? Do you believe with a structural change, maybe the collaboration of this committee to internalize the background checks on both contractors and on your own staff for homeland security? Mr. Marshall. Yes, ma'am, I can answer that question. Everybody who works for the Department of Homeland Security, both the Federal employee or contract employee, has to have either a suitability determination or a fitness determination. Essentially what that is is that even though they are called two different things, the criteria is the same. We are trying to determine if that person belongs in DHS and is suitable for employment, and is in the best interest of the agency and for the efficiency of Government. We look at things like conduct in past employment, criminal history, alcohol and drug abuse, that type of thing; whether or not the person has engaged in any activities that are contrary to U.S. interests and so forth. With respect to contractors, they undergo the fitness. We, DHS, we adjudicate for that fitness determination. If that contractor has to have a security clearance, a National security clearance, that is conducted by the Department of Defense, Defense Security Service. They have jurisdiction over those investigations under the National Industrial Security Program. So, we do the fitness and we do the adjudication for the fitness to determine if that person is suitable, but any kind of security clearance falls under the purview of the Department of Defense. Ms. Jackson Lee. So after you do your clearance, if they do not need a National security clearance, that person is hired. Mr. Marshall. Correct. Ms. Jackson Lee. Do you do it for the contractors as well? Mr. Marshall. Yes, ma'am. That is correct. If there is no derogatory information developed, that person is deemed to be suitable to enter on duty and they can come on-board. Ms. Jackson Lee. May I ask Ms. Durkovich, you were tasked by President Clinton to--the agency was tasked to set certain standards for Federal buildings. Where is that in terms of its implementation and oversight of the security of Federal buildings throughout the Nation, I assume, working on the security protocols for all of the Federal buildings? Ms. Durkovich. Thank you. That is a very good question, Congresswoman. We have been hard at work for the last 17 years working with our 53 member agencies to develop a set of physical security criteria that is included in our risk-management process for Federal facilities. This is applicable to 399,000 non-military Federal buildings across the United States. Our member companies--our member organizations are responsible for developing these standards. Our risk-based process for Federal facility standards includes six key elements, the first of which is establishing the Federal security level for a building. That is driven by the function of that particular building, the agencies that reside in it, the people who pass through it, the iconic and historical significance of that building. Once that physical security level is set, we look at the baseline standards and measures and mitigation measures that are applicable to that building, and then look at 31 different, what we call design basis threat scenarios. So it ranges from active-shooter scenarios to arson to water to small aircraft. Based on those scenarios and physical--the facility security level, the facility is responsible for implementing the physical security criteria. All of the member agencies, according to the Executive Order, shall comply with the standards that they develop. So I would say over the course of the last 17 years, we have been very successful in helping implement a baseline security standard for non-military Federal facilities. Ms. Jackson Lee. What is the oversight? Who is checking? Ms. Durkovich. At this juncture, we do not have the resources to do formal compliance. Many of our member agencies have developed risk assessment tools that allow them to ensure that they are in compliance with these standards. We are looking at ways to begin more of a soft compliance effort, but again, the Executive Order requires our member agencies to comply with the standards that this interagency body develops. Mr. Duncan. Ms. Jackson Lee, we may have time for another round of questions. So I---- Ms. Jackson Lee. But can I just thank you very much for your courtesies? I would just like to put one question on the record. I will not ask for an answer. I didn't hear from Mr. Patterson. That one question on the record, if we could get an answer, is: Does FPS do--FPS, does it do continuing background checks on its contractors once the contract is given? Is there an on-going check on the individuals that are utilized? Mr. Chairman, Mr. Barber, thank you for your courtesy. Mr. Duncan. Thank you, Ms. Jackson Lee. That is a question we can have answered. I am going to go into a second round of questioning. I know Members do have a lot of interest in this subject, including myself. I want to follow up on--I recognize myself for 5 minutes--I want to follow up on an issue that Mr. Hudson brought up about the radios, because I think that is important, communications inside of a building and communication with local law enforcement is tremendously important. In my State, the Palmetto State, South Carolina, we learned after Hurricane Hugo that law enforcement needs to be able to communicate all across the State. I believe with a homeland security grant back after 9/11, the State of South Carolina went to an 800-megahertz radio system that we had highway patrol and DNR, and local sheriffs' agencies were all able to communicate in the event of an emergency. I understand that inside the District of Columbia, FPS may not want to hear all the chatter that is going on on the Hill and at the White House and at every other Federal building. That could be a little overwhelming if you were having to monitor all of that. But in the event of an active shooter, can they communicate with other law enforcement personnel about what is actually going on? So I am going to ask Mr. Marshall if you could just follow up on that. What are we doing? What steps are we taking to address the issue raised by the gentleman from North Carolina? Mr. Marshall. Congressman, I would like nothing better than to have an 800-megahertz radio capability within DHS. Speaking first-hand, like I said, I have implemented that in the local police department here in Maryland, a neighboring police department. The capabilities are tremendous with an 800- megahertz radio system. You don't have to listen to, like you said, all the chatter at the Federal buildings and so forth. But in the event of an active shooter, you would be notified to go to a specific talk group, everybody involved in that incident, say. Let's use the DHS headquarters, for example, on Nebraska Avenue. If, God forbid, something were to happen at DHS headquarters, we can notify our colleagues at the Federal Protective Service, Metropolitan Police Second District, my force protection group, to all go to a specific talk group to handle that incident. You are absolutely right. That capability is vital in any kind of incident. Mr. Duncan. Would something like an 800-megahertz system be able to penetrate most of the walls so most of the Federal facilities would be able to communicate? Mr. Marshall. Yes, sir. In my experience now, obviously, we would have to do something called acceptance testing. We would have to--once we were able to acquire that capability, we would have to go to certain spots on a grid and test the radio to find out where those dead spots might be. But from my experience, it works in like 99 percent of the locations, at least where I came from. But again, that capability is vital. So if that is available, I know those 800-megahertz frequencies are like hen's teeth. They are hard to get your hands on, because I think most of them are taken up. But I believe the Metropolitan Police is on an 800-megahertz system. If for some reason we could--or some, you know, capability to attach ourselves to the Metropolitan Police or, for that matter, Federal Protective Service or any other Federal Government agency who has that 800-megahertz frequency, that would be the ideal situation in the District of Columbia. Mr. Duncan. Right. Well, thanks for that. I may have taken Mr. Hudson's question, but it was on my mind. I want to ask you one other thing. Mr. Marshall, what have we learned about background checks and information flow that would affect clearances like we saw with the Navy Yard shooter, where local law enforcement, even supervisory positions within the agency they worked for, they had indicators? So how does that--what have we learned? How does that information flow down to the person that makes the decision on who gets clearances or not? Just tell me what we have learned and how we are applying it. Mr. Marshall. Okay. First of all, you mentioned the local agencies. One of the things I have always been troubled with with respect to local agencies is that there are roughly between 18,000 and 20,000 police departments or law enforcement agencies, sheriffs, local police, State police, and Federal agencies within the United States. The thing that has troubled me about what, the information we receive from the State and locals and the Federals, is that not all of those agencies contribute to, like, the FBI CJIS system. A person can be arrested in your State, the Palmetto State, and some small police department. They may not be a contributor to the FBI database. So that when we go to do our agency checks and our fingerprint checks, we may not have access to that information of that person's arrest within South Carolina. So, that is a gap. That is a gap that I think can be remedied. I don't know what it would take, maybe legislation perhaps, but that if we can get more of these agencies--and I don't know what percentage that are out there that don't contribute. But I believe it is large enough that we could probably close that gap somewhat by maybe encouraging, legislating for these folks to contribute, particularly if they get Homeland Security money. Now, with respect to the second part of your question, again, I wasn't briefed on the Navy Yard shooting specifically. But what I know through the media accounts and some anecdotal comments or conversations I have had with other people, from what I know, Mr. Alexis had a security clearance with the Navy. When he left the Navy, it was still an in-scope clearance, meaning that the investigation was within the required time frame in order for the organization he was going to to accept that investigation on reciprocity. We are required by Executive Order in the Federal Government to accept security clearances on reciprocity if there is an investigation that we can point to. The one thing about reciprocity is that we are also required to accept it on its face. We are not allowed to do any additional checks unless we have information--derogatory information to the contrary. So, it looks to me, not having been briefed, that the contracting company accepted Mr. Alexis's security clearance on reciprocity, which was one gap, without having to do additional checks. That also there was a faulty investigation. There was information within the investigation that was done by a private contractor that wasn't accurate. So, it was almost like a perfect storm. It was a gap that was--it was unfortunately hard to overcome. Mr. Duncan. Yes, we are human. I get that. Mr. Marshall. Yes, sir. Mr. Duncan. Timing is everything. So, I don't have any further questions. I will ask the gentleman from North Carolina if he would like to follow up with a 5-minute question. Mr. Hudson. Thank you, Mr. Chairman. I guess I would like to maybe get back to this issue of communications between, you know, FPS and the local and State agencies. Mr. Marshall mentioned there are 18,000 to 20,000 law enforcement agencies around the United States. In terms of passing along warnings, intelligence, information about suspects, could you, Mr. Marshall, and also Director Patterson answer if you like, maybe talk about what the gaps are that exist there, whether it is information flow from DHS down or from local law enforcements up, FPS, back and forth. What are the gaps in communications? What are the real challenges? I know some were highlighted with the Boston bombing incident, others may--we may have learned lessons from the Navy Yard. But what are some of the challenges we are facing when it comes to that up-and-down communication? Mr. Marshall. Well, Congressman, we are very fortunate in the Washington, DC, area to have so many law enforcement agencies, both Federal and local, and, of course, the regional county police departments. We are all members of that fraternity here, within this region. I believe we communicate very well together. We are all part of different working groups and organizations, intelligence organizations. So, I believe our sharing capability is a good one here, within this region. Where I have seen some gaps during my time here is when you get outside of this D.C. area and you deal with people who are coming in from other parts of the country. We don't always communicate well in that regard. We rely heavily on information from the criminal justice information system. If we see somebody suspicious, obviously, we would rely on a radio check for, you know, a criminal history check or a radio check, wants and wanted type of BOLOs and so forth. But regionally, I think we are okay. It is when we get outside of this region where I don't think we share often as well as we should. Mr. Hudson. Director Patterson. Mr. Patterson. Yes, sir. I would agree with Mr. Marshall that within the region here, I think we do a pretty good job. Part of the challenges that we have in FPS is that, as you well know, we are in 50 States. Some of our inspectors have to travel a very long way to move from facility to facility, sometimes between States. The challenge there sometimes is that the radio--the connectivity that they have when they leave one State to go to another State, we lose it. So we have to work within those States or with other Federal agencies to try to help us bridge between the facilities, sometimes, that our inspectors may travel. On the intelligence side of things, though, I think we do pretty well, because we try to link up with each one of the States' fusion centers, as many as we can. We have people that are linked and members of the joint terrorism task forces. So relative to threat information and those kind of things, we think we move that information fairly well up and down and have pretty good access. It is sometimes--what concerns me sometimes is just the ability and officer safety issue of, can my officer or can my inspector communicate or call for help if, in fact, he runs into a problem, if he is maybe somewhere in the northern tier, where it is--he is right out in the middle of nowhere and help is a bit of ways away, and he has got to figure out which radio he is or how he is gonna communicate back to ask for help? We are working that. We are working within the Department, and we are working with State and local as well as other Federal agencies, again, to bridge those gaps where we recognize them. Mr. Hudson. Appreciate that. Obviously I think this committee is very concerned about this issue, so please keep us informed as you move forward with this. Just to sort-of redirect a little bit, Ms. Durkovich, you talked a little bit about sort-of different facilities that are leased or owned by GSA and the different security level depending on the type of facility. You talked about the fact that ISC has set security standard guidelines for these non-Federal--or non-military Federal facilities. How well does the Federal Protective Service, in your opinion, follow these policies? Does their adherence differ based on the different type of location of the Federal facilities? Ms. Durkovich. Let me begin--and, first of all, thank you very much for that question--but by saying that FPS is an active member of the Interagency Security Committee. We have worked over the course of the last several years, both at--within the Office of Infrastructure Protection, but certainly with--within ISC to help them understand and implement the various standards, guidelines, and practices that we develop. Certainly, as they have worked to develop their own assessment tool, it has been done with the ISC standards in mind. I would say that they do a very good job. Again, it varies on the facility security level and the measures that are implemented at each of those facilities. But they have to work very closely with the facility security committee within each of those buildings to ensure that they are providing a level of security that is consistent with the Federal security level and the standards that are outlined by the ISC. They are, again, a very active participant in the ISC. They sit on a number of our standing committees, on a number of our working groups, to include the active-shooter working group. They recently chaired a working group on prohibited Federal items, which has become a standard for Federal facilities across the Nation, and have worked very closely with us with some best practices on armed security guards. So they are an active, robust member, again of the ISC, and I think do a very good job of implementing the standards and best practices that we promulgate. Mr. Hudson. Thank you. Mr. Chairman, thanks for the leeway. I will yield back. Mr. Duncan. Thank you, Mr. Hudson. The Chairman will recognize the Ranking Member for the last and final questions. Mr. Barber. Thank you, Mr. Chairman. Once again, thanks to our witnesses this morning for your testimony and for the work you are doing to make sure that Federal facilities, the people who work in them, and the people who come to them are properly protected. I just wanted to continue with a question for Mr. Patterson regarding what you are doing proactively, I guess, to probe and test how well safety and security standards are being implemented. Within the context of this open hearing, you may not be able to say all, but what can you tell us about what you are doing proactively to find out whether or not these facilities are following the standards that have been established? What do you do when you find that they are not? Mr. Patterson. Sir. Yes, sir. Well, one of the things that we are doing proactively is that we are creating something called a portfolio approach for each one of our inspectors. That means that the inspector will take ownership of a series of buildings, okay, and within those buildings will have responsibility to ensure that he or she are meeting with the facility security committees and others in there to ensure that we are, No. 1, in compliance or that they are in compliance with whatever standards that have been set forth for that facility. So that is a very proactive approach by us to ensure that we don't miss anything in a movement forward to better understand how we can, if you will, better do our job. We are working with the NASCO, the National Association of Security Companies, in looking at how we can collaborate, how we can partner in working in training our PSOs, relative to giving them the best training, better training, and to fill in the gaps that were pointed to today by the General Accounting Office, so that the next time that we come before this committee, we are not talking about some of the challenges that we are having there, because we have, in fact, taken a proactive approach in filling that, because we are working collaboratively with the security companies. We are also looking at partnering with local law enforcement in areas, departments, to help us in our response times, to ensure that when there are challenges for our inspectors to get to Federal facilities, that we do have an agreement and a partnership with them that they will respond sometimes when we cannot. So there are a myriad of things that we are looking for as moving forward to ensure that we have a very comprehensive approach to how the people, which are the most important thing, are protected in those facilities in the event of something bad, if you will. Mr. Barber. Does your proactive work include deliberately trying to breach these securities? Mr. Patterson. Yes, sir, we have a program called the covert testing program, where we actually have--we have a number of scenarios that we introduce through the system when we, through the magnetometer, X-ray, and it is done by our special agents, who are trained in introducing these objects. Once--you know, if there is a failure, then what we do is we work with the contractor to, No. 1, that we have identified a failure. Then we work to train those individuals so that there is an understanding of what just happened, what did we just do? How do we fix this? How do we rectify the situation so that it doesn't happen again? Sometimes we have to do it more than once, quite frankly, to--it is the process of standing behind a magnetometer X-ray machine, it can be a perishable skill if you are not doing it often. So one of the things that we are doing proactively is to work with the contractors to look at, you know, how often this training is being delivered to them? Then we are gonna look at how often we are testing that, and then using a metric there to see how well we are performing in that area. Mr. Barber. Let me just ask you one last question before my time expires. Mr. Patterson. Sure. Mr. Barber. Obviously, every Federal agency has been asked to not only tighten their belt but cinch it up so tight you can hardly breathe. What impact have budget cuts or appropriation reductions had on your ability to get the job done? Mr. Patterson. We are still able to get the job done, sir. You know, we have to work smarter. We look to how we leverage technology to do things that maybe we had done using an individual, and now--so, we are getting the job done, even with the sequestration and some of the budget cuts that have been coming. I am confident that we will continue to be able to effectively get the job done as we move forward. Mr. Barber. Thank you, Mr. Chairman. I yield back. Mr. Duncan. I want to thank the committee Members for their participation today, and thank the witnesses. As we mentioned, I think the goal of the hearing was to provide oversight of the DHS, and what it is currently doing to make sure that we protect Federal facilities, and what steps, if any, need to be taken to make sure that instances like the Navy Yard don't happen at any other Federal facilities. I want to thank you for your leadership and your valuable testimony today. You answered a lot of questions for us as we delved into that. So I want to thank you for that, and the Members for their valuable questions. Members of the subcommittee may have additional questions. We ask that you respond to those in writing. Without objection--any other questions, or without objection, the subcommittee will stand adjourned. [Whereupon, at 11:11 a.m., the subcommittee was adjourned.] A P P E N D I X ---------- Question From Chairman Jeff Duncan for L. Eric Patterson Question. What is the status of the standardized National Lesson Plan for guards, and the revising of the Security Guard Information Manual (SGIM)? When will the National Lesson Plan for guards be implemented? Answer. The Federal Protective Service (FPS) recognizes that ensuring that Protective Security Officers receive quality training is key to the success of the FPS protective mission. As such, FPS is working with the National Association of Security Companies (NASCO) to conduct a curriculum review of all Protective Security Officer (PSO) training. This review will consider long-standing requirements pertaining to PSO training and will result in a comprehensive PSO basic training curricula complete with written and performance measures. FPS anticipates that the PSO National Lesson Plan will be finalized and available for implemention in fiscal year 2015. The Security Guard Information Manual (SGIM) is undergoing a complete revision and will be released as the FPS Protective Security Officer Security Manager and Resource Tool (SMART) Book. An updated version of the SMART Book is expected to be released by the end of the second quarter of fiscal year 2014. Questions From Ranking Member Ron Barber for L. Eric Patterson Question 1. Does FPS conduct on-going evaluations of both its contract guards and Federal workforce? Answer. The Federal Protective Service (FPS) conducts rigorous and continuous Protective Security Officer (PSO) contract performance monitoring through various methods, including post inspections, administrative audits, monitoring of contractor-provided training and firearms qualifications, penetration tests, and obtaining customer feedback. FPS adheres to policies and procedures to ensure proper contract monitoring, including FPS Directive 18.104.22.168 ``Contract Protective Security Force Performance Monitoring'' and Office of Procurement Operations (OPO) Procurement Operating Procedure (POP) 403R4 ``Contractor Performance Assessment Reporting and Procedure''. FPS Contracting Officers have the ability and authority to take contractual actions to address contractor performance that does not comply with contract terms and conditions. Specifically, FPS employs remedies available under the Federal Acquisition Regulations and within the terms of its contracts to address contractor performance issues. A number of remedies are available for a contractor's non-performance or unacceptable performance in FPS PSO contracts. Remedies include, but are not limited to monitoring of contractor corrective action plans, assessing monetary deductions, directing removal of a contractor employee from performing under a contract, electing not to exercise a contract option, or terminating a contract for default or cause. To ensure robust contractor oversight, FPS is currently in the process of hiring and training 39 Contracting Officer Representatives (COR). CORs will assist FPS Contracting Officers in identifying adverse contract performance and taking timely corrective action. FPS adheres to the performance management regulations established by the Office of Personnel Management, and guidelines of the Department of Homeland Security and National Protection Programs Directorate to evaluate Federal employee performance. Question 2. Mr. Patterson, what protocols are used by FPS' facility security officers and facility security committee members to determine which standards to implement at Federal facilities? Answer. The Federal Protective Service (FPS) provides Facility Security Committee members with recommendations as part of the FPS's Facility Security Assessment (FSA) process. FPS designed its FSA process to meet the requirements of the Interagency Security Committee's (ISC) Risk Management Process for Federal Facilities. The FSA report provided by FPS includes an assessment of threats and vulnerabilities, and a comparison of the baseline level of protection called for in the ISC process with the existing level of protection at the facility, and FPS's recommendations for countermeasures to mitigate risk. FPS has also established an FSA steering committee to ensure consistency in implementation of the FSA program. The primary mission of the Steering Committee is the coordination of all FSA-related standards, programs, and operational applications. The Steering Committee serves as the FSA consultation entity, providing clarification and updates on development of the FPS FSA program. The Steering Committee also assists FPS Regions with guidance on the implementation of FSA reports, policies, and applications. Question 3. How does FPS intend to address the shortcomings of its risk assessment methodology as identified by GAO, particularly its absence of a component to assess consequence? Answer. The Federal Protective Service (FPS) has incorporated the Interagency Security Committee's (ISC) Risk Management Process for Federal Facilities into its current Facility Security Assessment (FSA) process. Specifically, the FSA process includes the ISC's Facility Security Level (FSL) Determinations, Physical Security Criteria for Federal Facilities, and the Design Basis Threat as incorporated into the Modified Infrastructure Survey Tool to identify and mitigate vulnerabilities. FPS also conducts a threat assessment and provides a Threat Assessment Report as part of each FSA, to ensure that stakeholders have an understanding of the threats they face. While potential impacts are considered as part of the FSL determination, FPS is continuing to explore the inclusion of consequence into the process. Quantifying applicable categories of consequence for Federal facilities and incorporating them into an algorithm in an assessment tool, however, is currently not feasible as there is not a body of work existing to facilitate such development. FPS continues to work with the ISC to explore consequences and impacts in the context of Federal facilities and missions. Question 4a. FPS has a long history of budget woes due to its reliance on fees, and a workforce that has too many contract guard staff. Further, GAO has documented that FPS' contract guard staff has been about 13,000 since 2001. What is the current ratio of contract guard to Federal guard staff at FPS? Question 4b. What elements are contained in FPS' contracts pertaining to the training curriculum used by private firms to train and certify guards? Answer. To accomplish its protective mission, the Federal Protective Service (FPS) employs Law Enforcement Personnel as well as contract Protective Security Officers (PSOs) who work in tandem to attend to daily security needs at Federal facilities and respond to threats directed against the facilities or the personnel working within them. Law Enforcement Personnel and PSOs have separate, but complementary, roles and responsibilities in ensuring Federal facility security. FPS directly employs approximately 1,007 Law Enforcement Personnel who are trained physical security experts and sworn law enforcement officers employed directly by the Federal Government. Law Enforcement Personnel perform a variety of critical functions, including conducting comprehensive security assessments of vulnerabilities at facilities, developing and implementing protective countermeasures, and providing uniformed police response and investigative follow-up. FPS Law Enforcement Personnel also conduct PSO guard post inspections on a daily basis. FPS also contracts approximately 13,000 PSOs, often referred to as ``security guards.'' PSOs are responsible for controlling access to Federal facilities, detecting and reporting criminal activities, and responding to emergency situations. PSOs also ensure prohibited items, such as firearms, explosives, knives, and other dangerous weapons, do not enter Federal facilities. It is important to note that PSOs are not sworn Law Enforcement officers. FPS works with the private guard companies to ensure the guards have met the certification, training, and qualification requirements specified in the contracts. These include, but are not limited to, FPS orientation, National Weapons Detection training, weapons qualification for both lethal and non-lethal weapons, FPS Basic Training, which covers subject areas such as defensive tactics, legal authorities, and response to incidents such as workplace violence, and bomb threats, and any State, local, and customer-specific requirements. It is important to note that the FPS does not unilaterally determine the total number of PSOs Nationally. Rather, the FPS works in partnership with tenant Facility Security Committees to build a consensus regarding the number of guard posts appropriate for each individual facility. The number of posts is determined by a number of factors, including a facility's security level, Facility Security Assessment, and the security needs and preferences of tenant agencies. Questions From Chairman Jeff Duncan for Caitlin Durkovich Question 1. Ms. Durkovich, in your role as chair of the Interagency Security Committee, what steps are you taking to make sure that Federal agencies are compliant in utilizing the committee's standards for physical security? Answer. Executive Order (EO) 12977 states that each executive agency and department shall cooperate and comply with the policies and recommendations of the Interagency Security Committee (ISC) issued pursuant to the order, but at this time the committee does not have the resources to carry out enforcement for nearly 400,000 facilities Nation-wide. The ISC relies on agencies to conduct their own compliance as required by the EO. That said, the ISC is examining potential options to support agencies' compliance efforts and is currently reviewing internal member agencies' best practices and lessons learned to develop a strategy to propose to the ISC membership. This work is being conducted through the ISC's Lessons Learned and Best Practices Working Group; a group established as a result of Government Accountability Office (GAO) Recommendation Report GAO 12-901 Federal Real Property Security-- Interagency Security Committee Should Implement a Lessons Learned Process. Additionally, the ISC has also developed a strategy for Federal departments and agencies to ensure risk assessment data tools are compliant with ISC standards. To date, one tool has been certified as ISC compliant and another tool is in the queue for certification. Question 2. Please explain the actions your staff is taking to increase the rate of utilization of the committee's standards. Answer. The ISC is developing an outreach strategy to improve engagement, marketing, and training efforts. The plan defines the goals and objectives of future outreach efforts; specifies the target audience of outreach activities; and describes outreach options. This strategy also consists of a number of on-line training programs, personal interaction, printed materials, and on-line communications. The ISC currently relies on Chief Security Officers (CSOs) and working group representatives to share information about ISC standards and best practices. The ISC is developing an enhanced outreach plan to increase awareness and improve marketing and training efforts. The plan will increase marketing activities, providing CSOs with materials they can share with their facilities, as well as new on-line training programs, on-line communications, and greater personal interaction. Question 3. How do you evaluate the outcomes of your agency's outreach efforts in terms of measuring Federal agencies' usage of the Interagency Security Committee's standards? Answer. As noted above, the ISC is currently assessing and enhancing its outreach efforts. The Interagency Security Committee Outreach Strategic Plan will provide a foundation for the ISC's implementation of outreach activities to increase awareness, understanding, and use of the ISC Standards, guidelines, best practices, and white papers among Federal agencies. The ISC developed a plan that defines the goals and objectives of future outreach efforts; specifies target audiences; and describes three categories of outreach options: Printed materials, personal interaction, and on-line communications which is consistent with the GAO's recommendations. An important aspect of the ISC's outreach is training and the ISC is currently doubling training available to Federal agencies. Both on-line and in-person training will be amplified through implementation of the plan. The implementation of the outreach plan will enable the ISC to better measure the most effective and efficient approach for increasing awareness, understanding, and application of the ISC standards. Question From Chairman Jeff Duncan for Greg Marshall Question. During the October 30 hearing, you discussed remotely deactivating access credentials if a change in an individual's suitability occurs. To clarify, how long does the deactivation process take? Can it be done in real time to avoid potential threat? Answer. The deactivation process can be done in real time and from remote locations. Execution of this access removal process includes the revocation of the individual's Personal Identification Verification Card (PIV card) in the Identity Management System (IDMS), suspension of access in the electronic physical access control system (PACS) that services the component who employs the individual, and updates to security guard post orders to include ``Do Not Admit'' instructions associated with the individual. Manual notifications are provided via email and/or telephone to all respective organizational points of contact to support facilities where either visual inspection or electronic verification is performed. Automated PIV card revocation checks is a functionality that is supported by the IDMS. DHS is currently working to deploy this capability to all the components. Questions From Ranking Member Ron Barber for Greg Marshall Question 1. Mr. Marshall, please explain to the committee what standards are involved in granting individuals' access to Federal facilities. Also, what process is used to identify and individual as being suitable for Federal employment? Question 2. Also, please describe to the committee how the mental health of an individual is taken into consideration when making a determination about his or her suitability for Federal employment? Answer. All individuals working for or on behalf of the DHS must undergo a background investigation with favorable results. In order for an individual to gain access to a DHS facility, a criminal history check with favorable results must be completed. For issuance of a PIV card, the background investigation must be initiated in accordance with Homeland Security Presidential Directive 12 requirements. DHS adheres to all Federal regulations and guidelines for suitability for Federal employment. DHS uses the criteria set forth in 5 Code of Federal Regulations, Part 731, to assess an individual's suitability. The individual completes security paperwork, Standard Form (SF) 85P, and undergoes a background investigation. Based on the suitability criteria, an adjudicative determination is made whether the individual will promote the integrity and efficiency of the service. Currently, there are no requirements for individuals to report mental health information when applying for Federal employment for non- cleared positions; however, OPM does permit agencies to use the SF 85P- S supplemental form for positions that require the carrying of a firearm. This supplemental questionnaire does require individuals to report consultation with mental health professionals and/or health care providers regarding a mental health condition. Otherwise, when DHS adjudicates a background investigation, the mental health condition of an individual is only considered to determine eligibility for access to National security information. It is reviewed when the individual chooses to report this information on standard security form SF-86, or during investigative interviews and other records checks. In cases where mental health information is not reported in an investigation by the individual, references, or by review of records, potential mental health issues are not examined. This poses a vulnerability and risk to the Department. In National security clearance investigations, DHS can obtain mental health records when the information is reported either on the security forms or through investigative interviews. This is in accordance with Executive Order 12968, Access to Classified Information and its implementing guidance. Additionally, the Adjudicative Guidelines for Determining Eligibility for Access to Classified Information requires DHS to evaluate an individual's ability to handle and protect National security information. DHS renders adjudicative determinations for access to classified material. When evaluating the information, DHS must apply the adjudicative criteria, which includes evaluating whether an individual's mental health condition adversely affects the individual's judgment and trustworthiness to safeguard classified information. Question 3. Mr. Marshall, what authority and access do you as a security professional have to the mental health records of individuals seeking approval for access into Government facilities, or to be cleared for Federal employment? Answer. As a security professional, I do not have categorical access to mental health records for the approval of access into DHS facilities or to be cleared (suitable) for Federal employment. In National security clearance investigations, DHS can only obtain mental health records when the information is reported either on security forms or through investigative interviews, and then only with the consent of the individual being investigated and the cooperation of the provider. At DHS, when applicants submit their security forms, included in their packages are signed release forms that allow investigators the ability to pursue information reported by the applicants on their SF 86 or other security/suitability questionnaire. The applicant's signature signals ``consent'' and the intent of the applicant for mental health providers to ``cooperate'' with any investigation. This is in accordance with Executive Orders and implementing guidance. Question 4. With regard to suitability assessments, does the Department contract with private firms to conduct background checks? If so, who is responsible for vetting contractors who conduct the checks? Answer. Yes, the Department does contract with private firms to conduct background checks. The Office of Personnel Management and the Department of Defense have oversight responsibility for the background investigation contract workforce. OPM delegates investigative authority to certain DHS components, who then employ contract background investigators. It is a requirement of the delegation that contract investigators must have been appropriately adjudicated. The Department of Defense has responsibilities regarding the security clearance adjudications of contract employees under the National Industrial Security Program. DHS accepts reciprocity of the investigation and adjudication of contract background investigators. Questions From Chairman Jeff Duncan for Mark Goldstein Question 1. Your testimony noted that taxpayer dollars may be put at risk because of problems with FPS's risk assessment process. Specifically, you said that these problems may result in facilities with too much or too little protection. On this issue, I think back to earlier in the year when many were alarmed by FPS's presence at protests outside IRS buildings. How does the risk assessment process impact FPS's responses to specific events, such as peaceful protests? Answer. Risk assessments, which are among FPS's physical security responsibilities, allow FPS to determine which protective measures should be in place at a facility. Responding to events/incidents, such as peaceful protests, is among FPS's law enforcement responsibilities. While the risk assessment process does not directly influence how FPS responds to specific events, it allows FPS to determine whether and what types of protective measures are needed to help mitigate the risks associated with these events. Question 2. How does the fact that FPS collects fees for certain services impact the oversight performed by DHS? Do you think because FPS collects fees for certain security services that less oversight is conducted by DHS than if the programs were based on appropriations? Answer. We have not conducted the work necessary to answer this question. For information on FPS's fee design, proposed alternatives, and challenges related to FPS and customer agency budget formulation, please see GAO's May 2011 report Budget Issues: Better Fee Design Would Improve Federal Protective Service's and Federal Agencies' Planning and Budgeting for Security (GAO-11-492). Questions From Ranking Member Ron Barber for Mark Goldstein Question 1. Mr. Goldstein, is there a need to impose a uniform physical security screening standard across the Federal Government? Also, should the Capitol Hill standard of administering a full screening of all personnel and visitors to Federal facilities regardless of their security clearance status be adopted? Answer. We have not conducted the work necessary to answer this question. Question 2. What process do agencies and departments use to determine which physical screening standards to apply throughout the Federal Government? Answer. To determine which physical screening measures to implement at Federal facilities, Federal agencies generally conduct risk assessments. These assessments evaluate the threat, vulnerability, and consequence of undesirable events (such as terrorist attacks or other acts of violence) occurring at a facility. After the assessments are completed, the information is used to determine risk and to recommend countermeasures, such as physical screening measures, to mitigate it.