    Combating Terrorism: Selected Challenges and Related
    Recommendations (20-SEP-01, GAO-01-822).

    Greater attention has been placed on combating terrorism as
    concerns have grown. Assignment of executive branch
    responsibilities and authorities also has received additional
    emphasis, including the appointment of a national coordinator in
    1998 in the National Security Council to serve as a focal point
    for overall leadership and coordination. Congress and the
    President both have recognized the need to review and clarify the
    structure for overall leadership and coordination. At the recent
    request of the President, the Vice President will oversee the
    development of a coordinated national effort to improve national
    preparedness, including efforts to combat terrorism. Federal
    efforts to develop a national strategy to combat terrorism and
    related guidance have progressed, but key efforts remain
    incomplete. The first step toward developing a national strategy
    is to conduct a national threat and risk assessment. The
    Department of Justice and the Federal Bureau of Investigation
    have collaborated on such an assessment, but they have not
    formally coordinated with other departments and agencies on this
    task. Under current policy, the federal government also has
    improved its capabilities to respond to a domestic terrorist
    incident. The Federal Bureau of Investigation and the Federal
    Emergency Management Agency are tasked with leading federal
    efforts in their respective roles for managing a terrorist crisis
    and the consequences of an incident. These two agencies would be
    supported by a number of other federal agencies with response
    capabilities. Federal assistance to state and local governments
    to prepare for terrorist incidents has resulted in training for
    thousands of first responders--those state and local officials
    who would first respond at the scene of an incident. To improve
    this, state and local officials have called for a single federal
    liaison for state and local preparedness programs. Regarding
    risks to computer systems and, more importantly, to the critical
    operations and infrastructures they support, an array of efforts
    has been undertaken to implement a national strategy outlined in
    Presidential Decision Directive 63. However, progress in certain
    key areas has been slow. Specifically, federal agencies have
    taken initial steps to develop critical infrastructure protection
    plans, but independent audits continue to identify persistent,
    significant information security weaknesses that place federal
    operations at high risk of tampering and disruption.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-01-822
        ACCNO:   A01496
        TITLE:   Combating Terrorism: Selected Challenges and Related
                 Recommendations
         DATE:   09/20/2001
      SUBJECT:   Advanced weapons systems
    	     Computer crimes
    	     Computer security
    	     Nuclear weapons
    	     Terrorism
    	     All-Hazard Emergency Operations Plan
    	     Critical Infrastructure Protection
    	     Grants Program
    	     DOD Defense-wide Information Assurance
    	     Program
    	     DOD Domestic Preparedness Program
    	     DOJ Five-Year Interagency
    	     Counterterrorism and Technology Crime
    	     Plan
    	     DOJ InfraGard Information-Sharing
    	     Program
    	     DOJ Metropolitan Firefighters and
    	     Emergency Services Program
    	     DOT Global Positioning System
    	     Federal Radiological Emergency Response
    	     Plan
    	     FEMA Federal Response Plan
    	     ILOVEYOU Computer Virus
    	     National Oil and Hazardous Substances
    	     Pollution Contingency Plan
    	     United States Interagency Domestic
    	     Terrorism Concept of Operations Plan

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Testimony.                                               **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-01-822

    Untitled

    (GAO/ NSIAD- 97- 254,

    Report to Congressional Committees

    United States General Accounting Office

    GAO

    September 2001 COMBATING TERRORISM

    Selected Challenges and Related Recommendations

    GAO- 01- 822

    Page i GAO- 01- 822 Combating Terrorism Letter 1

    Executive Summary 4 Purpose 4 Background 5 Results in Brief 6 Principal
    Findings 10 Recommendations for Executive Action 17 Agency Comments and Our
    Evaluation 18

    Chapter 1 Introduction 20 The Federal Government?s Role in Combating
    Domestic Terrorism 23 Risks of Cyber- Attacks and Related Government
    Strategy 27 Objectives, Scope, and Methodology 27

    Chapter 2 Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified 31

    Some Leadership and Coordination Functions Transcend Individual Agencies 31
    National Coordinator Established, but Some Responsibilities Are

    Fragmented Across Agencies 32 The Congress and the President Also Are
    Concerned About

    Leadership and Coordination 36 Different Proposals on Leadership and
    Coordination Have Their

    Pros and Cons 37 Focal Point Should Be Located in the Executive Office of
    the

    President 39 Conclusions 40 Recommendations for Executive Action 41 Agency
    Comments and Our Evaluation 42

    Chapter 3 Progress Made in Developing a National Strategy to Combat Domestic
    Terrorism 44

    Threat Assessments Are Being Completed 44 Attorney General?s Five- Year Plan
    Represents a Substantial Effort,

    but Key Elements Still Are Lacking for a National Strategy 48 Progress Made
    in Tracking Spending to Combat Terrorism 52 Agencies Complete Interagency
    Operational Guidance, Enhancing

    Unified and Coordinated Response Capability 54 Contents

    Page ii GAO- 01- 822 Combating Terrorism

    Individual Agencies Complete or Develop Plans and Guidance 56 Conclusions 56
    Recommendations for Executive Action 57 Agency Comments and Our Evaluation
    57

    Chapter 4 Federal Response Capabilities Are Improving 59 The Federal
    Government Has a Broad Array of Response

    Capabilities 59 Coordination of Special Events Has Improved 65 Federal
    Counterterrorism Exercises Are Improving 66 Evaluations of Exercises Need
    Improvement 75 Research and Development Enhances Future Federal Capabilities
    79 Conclusions 85 Recommendations for Executive Action 86 Agency Comments
    and Our Evaluation 87

    Chapter 5 Federal Assistance to State and Local Governments Can Be
    Consolidated 90

    Federal Programs Have Provided Training, Equipment, and Exercises 90
    Improvements Made in Delivery and Coordination of Assistance 96 Federal
    Liaison for State and Local Responders Did Not Meet

    Expectations 98 New Office Offers Potential to Consolidate Assistance
    Programs

    Under FEMA 99 Federally Funded National Guard Teams Continue to Experience

    Problems 101 Conclusions 103 Recommendations for Executive Action 104 Agency
    Comments and Our Evaluation 104

    Chapter 6 Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats 108

    Risks of Cyber- Attacks and Related Government Strategy 109 Despite
    Increased Efforts, Critical Federal Operations Remain at

    Risk 113 CIP Activities Have Raised Awareness and Prompted Information

    Sharing; However, Substantive Analysis of Infrastructure Vulnerabilities Has
    Been Limited 119 Many Research and Development Efforts Are Underway 124

    Page iii GAO- 01- 822 Combating Terrorism

    National Plan Is Not Fully Developed; Responsibilities Still Are Evolving
    126 Conclusions 127 Recommendations for Executive Action 128 Agency Comments
    and Our Evaluation 129

    Appendix I Compendium of Relevant Federal Policy and Planning Documents 131

    Appendix II Individual Agency Plans and Guidance for Combating Terrorism 137

    Appendix III Selected Federal Crisis Management Response Teams 145

    Appendix IV Selected Federal Consequence Management Response Teams 147

    Appendix V Compendium of Relevant GAO Recommendations 150

    Appendix VI Organizations Visited and Contacted 158

    Appendix VII Comments From the Executive Office of the President 163

    Appendix VIII Comments From the Department of Agriculture 168

    Page iv GAO- 01- 822 Combating Terrorism Appendix IX Comments From the
    Department of Commerce 172

    Appendix X Comments From the Department of Defense 176

    Appendix XI Comments From the Department of Energy 179

    Appendix XII Comments From the Department of Health and Human Services 183

    Appendix XIII Comments From the Department of Justice 188

    Appendix XIV Comments From the Department of the Treasury 194

    Appendix XV Comments From the Department of Veterans Affairs 196

    Appendix XVI Comments From the Federal Emergency Management Agency 199

    Appendix XVII GAO Contacts and Staff Acknowledgments 204

    Related GAO Products 205

    Page v GAO- 01- 822 Combating Terrorism Tables

    Table 1: Organizations Currently Responsible for Key Interagency Leadership
    and Coordination Functions for Programs to Combat Terrorism 34 Table 2:
    Proposals to Create a Focal Point for Overall Leadership

    and Coordination of Programs to Combat Terrorism 38 Table 3: Advantages and
    Disadvantages of Various Leadership

    Approaches 39 Table 4: Interagency Plans and Guidance for Combating
    Terrorism 55 Table 5: Characteristics of Federal Agencies? Processes to
    Capture

    Lessons Learned From Counterterrorist Operations, Special Events, and
    Exercises 77 Table 6: State and Local Responders Receiving Federal WMD

    Training, Fiscal Years 1998 to 2001 92 Table 7: Status of Key CIP Efforts in
    Eight Infrastructure Sectors 122

    Figures

    Figure 1: Aftermath of the April 1995 Terrorist Bombing of the Alfred P.
    Murrah Federal Building in Oklahoma City, Oklahoma 21 Figure 2: Terrorist
    Incidents in the United States, 1980 to 1999 23 Figure 3: Key Federal Crisis
    Management Response Teams 60 Figure 4: FBI Enhanced SWAT Team Executes
    Search During

    Wasatch Rings Exercise 61 Figure 5: Key Federal Consequence Management
    Response Teams 63 Figure 6: Arrival of a Simulated National Pharmaceutical
    Stockpile

    Push- Package During TOPOFF 2000 Exercise 72 Figure 7: U. S. Coast Guard
    Personnel Inspect Vehicle Remains for

    Chemical Residue During TOPOFF 2000 Exercise 73 Figure 8: FBI Enhanced SWAT
    Team Seizes Aircraft Suspected of

    Carrying Radiological Material During Wasatch Rings Exercise 75 Figure 9:
    Relationships Between Risk, Time, and Cost in

    Developing Products to Combat Terrorism 81 Figure 10: Status of 53 Remaining
    Cities Receiving Domestic

    Preparedness Program First Responder Training 94 Figure 11: Salt Lake City,
    Utah, Fire Department Personnel Treat

    ?Victim? During Wasatch Rings Exercise in Preparation for the 2002 Olympic
    Winter Games 95 Figure 12: Risks to Computer- Based Operations 110

    Page vi GAO- 01- 822 Combating Terrorism

    Figure 13: CIP Responsibilities Outlined by PDD 63 113

    Abbreviations

    AAR after- action report ATF Bureau of Alcohol, Tobacco, and Firearms CBIRF
    Chemical- Biological Incident Response Force CERT Computer Emergency
    Response Team CIAO Critical Infrastructure Assurance Office CIP critical
    infrastructure protection CONPLAN Concept of Operations Plan DOD Department
    of Defense DOE Department of Energy DTRA Defense Threat Reduction Agency EPA
    Environmental Protection Agency FBI Federal Bureau of Investigation FedCIRC
    Federal Computer Incident Response Center FEMA Federal Emergency Management
    Agency GAO General Accounting Office HHS Department of Health and Human
    Services ISAC Information Sharing and Analysis Center NDPO National Domestic
    Preparedness Office NIPC National Infrastructure Protection Center NSC
    National Security Council NSF National Science Foundation OCTAVE
    Operationally Critical Threat, Asset, and Vulnerability

    Evaluation OEP Office of Emergency Preparedness OMB Office of Management and
    Budget OSTP Office of Science and Technology Policy PCIE/ ECIE President?s
    Council on Integrity and Efficiency and

    Executive Council on Integrity and Efficiency PDD Presidential Decision
    Directive SWAT Special Weapons and Tactics TOPOFF Top Officials TSWG
    Technical Support Working Group USDA U. S. Department of Agriculture WMD
    weapons of mass destruction VA Department of Veterans Affairs

    Page 1 GAO- 01- 822 Combating Terrorism

    September 20, 2001 The Honorable Carl Levin Chairman The Honorable John
    Warner Ranking Minority Member Committee on Armed Services United States
    Senate

    The Honorable Bob Stump Chairman The Honorable Ike Skelton Ranking
    Democratic Member Committee on Armed Services House of Representatives

    We at the U. S. General Accounting Office, as all Americans, were shocked by
    the coordinated terrorist attacks on New York City and Washington, D. C., on
    September 11, 2001. This report, which already was scheduled for release
    this month before the events of September 11, summarizes federal efforts to
    combat terrorism prior to these events. Given the tragic events of September
    11, it is clear that combating terrorism efforts are now at the top of the
    national agenda. This report does not include recent efforts made in light
    of these recent attacks. While this report is a dispassionate and analytical
    discussion of the progress made and challenges faced by the federal
    government and the nation, we recognize the terrible cost of terrorism in
    human terms. The events of September 11 remind us that the victims of
    terrorism are real people- men, women, and children- and are our families,
    colleagues, friends, and neighbors. Our hearts go out to the victims,
    including the heroic first responders who were lost, and their families. We
    hope that this report promotes a reasoned discussion and additional actions
    designed to better prepare the nation to combat terrorism.

    Concerned that terrorists might use weapons of mass destruction a chemical,
    biological, radiological, or nuclear agent or weapon against civilian
    targets within the United States, or attack critical infrastructure through
    computer systems, the Congress and various federal agencies have undertaken
    numerous initiatives over the past few years designed to improve the
    nation?s ability to combat terrorism. As mandated in section 1035 of the
    Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001 (P.
    L. 106- 398, Oct. 30, 2000), we reviewed the strategy, policies,

    United States General Accounting Office Washington, DC 20548

    Comptroller General of the United States

    Page 2 GAO- 01- 822 Combating Terrorism

    and programs to combat domestic terrorism, particularly domestic terrorism
    involving weapons of mass destruction. We briefed your staffs previously on
    the preliminary results of our work. This report contains the final results
    of our review.

    In response to the mandate and, as agreed with your offices, this report
    assesses (1) the current framework for leadership and coordination of
    federal agencies? efforts to combat terrorism on U. S. soil, and proposals
    for change, (2) progress the federal government has made in developing and
    implementing a national strategy to combat terrorism domestically, (3) the
    federal government?s capabilities to respond to a domestic terrorist
    incident, (4) progress the federal government has made in helping state and
    local emergency responders prepare for a terrorist incident, and (5)
    progress made in developing and implementing a federal strategy for
    combating cyber- based attacks. This capping report updates and summarizes
    our extensive evaluations conducted in recent years of federal programs to
    combat domestic terrorism and protect critical infrastructure. We include a
    series of Recommendations for Executive Action, including three
    recommendations to the President, to improve overall leadership and
    coordination of federal efforts to combat terrorism as well as other
    improvements. Agency comments on a draft of this report were based on their
    efforts prior to the September 11, 2001, terrorist attacks.

    We are sending copies of this report to other interested congressional
    committees. We also are sending copies to the President; the Vice President;
    the Secretaries of Agriculture, Commerce, Defense, Energy, Health and Human
    Services, State, Transportation, the Treasury, and Veterans Affairs; and the
    Attorney General. In addition, we are sending copies to the Director, Bureau
    of Alcohol, Tobacco, and Firearms; the Director, Centers for Disease Control
    and Prevention; the Director of Central Intelligence; the Administrator,
    Environmental Protection Agency; the Director, Federal Emergency Management
    Agency; the Director, Federal Bureau of Investigation; the Administrator,
    General Services Administration; the Assistant to the President for National
    Security Affairs; the Assistant to the President for Science and Technology;
    the Director, Office of Management and Budget; the Commandant of the U. S.
    Coast Guard; and the Director, U. S. Secret Service. We will make copies
    available to other interested parties upon request. This report also will be
    available on GAO?s web site at www. gao. gov.

    If you or your offices have any questions about matters discussed in this
    report, please contact me at (202) 512- 5500; Henry L. Hinton, Jr., Managing
    Director, Defense Capabilities and Management, at (202) 512- 4300; or

    Page 3 GAO- 01- 822 Combating Terrorism

    Raymond J. Decker, Director, at (202) 512- 6020. They also can be reached by
    e- mail at hintonh@ gao. gov and deckerrj@ gao. gov, respectively. Contacts
    and key contributors are listed in appendix XVII.

    David M. Walker Comptroller General of the United States

    Executive Summary Page 4 GAO- 01- 822 Combating Terrorism

    With the coordinated terrorist attacks against the World Trade Center in New
    York City and the Pentagon in Washington, D. C., on September 11, 2001, the
    threat of terrorism rose to the top of the country?s national security and
    law enforcement agendas. Even before these catastrophic events, terrorism
    was a growing national security and law enforcement concern. Current federal
    efforts to combat terrorism are inherently difficult to lead and manage
    because the policies, strategies, programs, budgets, and activities are
    spread across more than 40 different federal agencies. For fiscal year 2002,
    the federal government?s proposed budget for these programs is over $12
    billion. In addition, the Congress recently approved the President?s request
    for $20 billion in emergency assistance and provided an additional $20
    billion to supplement existing contingency funds.

    Concerned about the preparedness of the federal government and state and
    local emergency responders to cope with a large- scale terrorist attack
    involving the use of weapons of mass destruction, the Congress in section
    1035 of the Floyd D. Spence National Defense Authorization Act for Fiscal
    Year 2001 (P. L. 106- 398) mandated that GAO report on the strategies,
    policies, and programs for combating domestic terrorism involving weapons of
    mass destruction. 1 As agreed with your offices, this report assesses

     the current framework for leadership and coordination of federal agencies?
    efforts to combat terrorism on U. S. soil, and proposals for change;

     progress the federal government has made in developing and implementing a
    national strategy to combat terrorism domestically;

     the federal government?s capabilities to respond to a domestic terrorist
    incident;

     progress the federal government has made in helping state and local
    emergency responders prepare for a terrorist incident; and

     progress made in developing and implementing a federal strategy for
    combating cyber- based attacks.

    1 Throughout this report, we use the term weapons of mass destruction to
    refer to chemical, biological, radiological, or nuclear agents or weapons.
    Some agencies define it to include large conventional explosives as well. As
    clearly demonstrated by the September 11, 2001, incidents, a terrorist
    attack would not have to fit this definition of weapons of mass destruction
    to result in mass casualties, destruction of critical infrastructures,
    economic losses, and disruption of daily life nationwide. Executive Summary

    Purpose

    Executive Summary Page 5 GAO- 01- 822 Combating Terrorism

    The threat of terrorism is a high- priority U. S. national security and law
    enforcement concern. U. S. policy on combating terrorism has been evolving
    for about 30 years. A series of presidential decision directives along with
    implementing guidance, executive orders, interagency agreements, and
    legislation provide the basis for counterterrorism programs and activities
    in more than 40 federal agencies, bureaus, and offices. In addition to
    reducing vulnerabilities and preventing and deterring terrorist acts before
    they occur, the U. S. strategy for combating terrorism consists of crisis
    management and consequence management. Crisis management involves efforts to
    prevent and deter a terrorist attack, protect public health and safety,
    arrest terrorists, and gather evidence for criminal prosecution. Consequence
    management includes efforts to provide medical treatment and emergency
    services, evacuate people from dangerous areas, and restore government
    services.

    Since 1982, the Department of Justice, through the Federal Bureau of
    Investigation, has been responsible for crisis management. Presidential
    Decision Directive 39, issued in June 1995 in the aftermath of the bombing
    of the federal building in Oklahoma City, Oklahoma, reaffirmed the
    Department of Justice, through the Federal Bureau of Investigation, as the
    lead agency responsible for crisis management of domestic terrorist
    incidents. Although state and local governments have the primary
    responsibility for managing the consequences of a domestic terrorist
    incident, the 1995 directive designated the Federal Emergency Management
    Agency as the lead agency responsible for coordinating federal agencies?
    responses and activities when state and local authorities request
    assistance.

    In May 1998, the President issued Presidential Decision Directive 62, which
    reaffirmed the earlier directive and established within the National
    Security Council in the Executive Office of the President a National
    Coordinator for Security, Infrastructure Protection and Counterterrorism to
    provide a focal point for federal efforts to combat terrorism. In May 2001,
    the President tasked the Vice President with overseeing the development of a
    coordinated effort to improve national preparedness (see app. VII). Also,
    the President established, within the Federal Emergency Management Agency, a
    new Office of National Preparedness, which will coordinate all federal
    domestic preparedness and consequence management programs and activities for
    terrorist- related weapons of mass destruction incidents or other threats.

    The United States also is developing and implementing a strategy for
    combating the threat of cyber, or computer- based, attacks. This strategy is
    Background

    Executive Summary Page 6 GAO- 01- 822 Combating Terrorism

    articulated in Presidential Decision Directive 63, which was issued in May
    1998 concurrently with Presidential Decision Directive 62. Protection
    against computer- based attacks requires vigilance against a broader array
    of threats, to include not only terrorists, but nation states, criminals,
    and others. Attacks could severely disrupt computer- supported operations
    and infrastructures, such as telecommunications, power distribution,
    financial services, national defense, and critical government operations.
    The risk to these infrastructures has increased in recent years due to their
    growing dependence on computers and the greater interconnectivity among
    computers.

    The proposed federal budget for these programs for fiscal year 2002 is over
    $12.8 billion, of which about $8.6 billion is to combat terrorism, about
    $1.8 billion is to combat weapons of mass destruction, and about $2.6
    billion is for critical infrastructure protection. This proposed budget
    represents about a 78- percent increase in total funding to combat terrorism
    compared with the fiscal year 1998 funding level of about $7.2 billion. In
    addition, the Congress recently approved the President?s request for $20
    billion in emergency assistance and provided an additional $20 billion to
    supplement existing contingency funds. The Office of Management and Budget
    tracks federal funds to combat terrorism and has provided this information
    to the Congress on an annual basis since fiscal year 1998.

    This capping report updates GAO?s extensive evaluations in recent years of
    federal programs to combat domestic terrorism and protect critical
    infrastructure.

    Greater attention has been placed on combating terrorism as concerns have
    grown. Assignment of Executive Branch responsibilities and authorities also
    has received additional emphasis, including the appointment of a national
    coordinator in 1998 in the National Security Council to serve as a focal
    point for overall leadership and coordination. The growing threat of
    terrorism, combined with the significant increase in funding and growth in
    the number of programs to combat terrorism over the past several years,
    presents evolving challenges to the existing framework for leadership and
    coordination. GAO?s analysis indicates that a need now exists to clarify and
    expand the responsibilities of the Executive Branch focal point. While the
    National Coordinator serves as a focal point for some interagency functions,
    other key overall leadership and coordination functions, such as guiding the
    development of a national strategy, are not clearly assigned to the focal
    point. In GAO?s view, the Results in Brief

    Executive Summary Page 7 GAO- 01- 822 Combating Terrorism

    functions and responsibilities of the focal point should include overseeing
    a threat and risk assessment and the development of a national strategy,
    coordinating governmentwide budgets, and monitoring overall agency
    implementation. A clear assignment of these responsibilities and the
    authority to discharge them are needed to provide assurance that (1) federal
    programs are based upon a coherent strategy and the programs are well
    coordinated and (2) gaps and duplication in capabilities are avoided as
    threats are likely to grow more complex and diffuse.

    The Congress and the President both have recognized the need to review and
    clarify the structure for overall leadership and coordination. At the
    request of the President in May 2001, the Vice President will oversee the
    development of a coordinated national effort to improve national
    preparedness, including efforts to combat terrorism. GAO believes it is
    important that the President, in conjunction with the Vice President?s
    efforts, focus on the functions, responsibilities, and authorities of the
    focal point. GAO makes a recommendation to the President that he assign a
    single focal point within the Executive Office of the President, with the
    time, responsibility, authority, and resources for overall leadership and
    coordination of federal programs to combat terrorism.

    Federal efforts to develop a national strategy to combat terrorism and
    related guidance have progressed, but key challenges remain. The initial
    step toward developing a national strategy is to conduct a national threat
    and risk assessment. The Department of Justice and the Federal Bureau of
    Investigation have collaborated on taking steps to conduct such an
    assessment. They have developed an assessment tool at the state and local
    level that will provide important information for federal resource
    decisions. However, at the national level, they have not completed
    assessments of the most likely weapon- of- mass- destruction agents and
    other terrorist threats. With regard to drafting a national strategy to
    combat terrorism, the Attorney General, working with several other agencies,
    published a Five- Year Interagency Counterterrorism and Technology Crime
    Plan. The Five- Year Plan, which was an interagency effort, identifies goals
    and objectives, sets priorities, and tracks agencies? progress; but it lacks
    two critical elements. First, while citing goals and objectives, the plan
    does not include measurable outcomes. Second, it does not identify state and
    local government roles in combating terrorism. The Five- Year Plan is not
    linked to resources, but the Office of Management and Budget has made
    progress in tracking and reporting on terrorism- related budgets and
    spending. However, the National Security Council and the Office of
    Management and Budget in the annual report to the Congress on combating
    terrorism have not identified priorities or

    Executive Summary Page 8 GAO- 01- 822 Combating Terrorism

    reported on duplication of efforts. GAO makes two related recommendations:
    one to complete a threat assessment and one to revise the Five- Year Plan to
    better serve as a national strategy.

    Beyond a national strategy, substantial progress has been made in completing
    operational guidance and related plans to coordinate agencies? responses at
    the site of a terrorist incident. A number of previous GAO recommendations
    that the federal government complete interagency operational guidance have
    been implemented. Progress also has been made by some individual agencies
    that have completed or are developing internal plans and guidance.

    Under current policy, the federal government also has improved its
    capabilities to prevent, deter, and respond to a domestic terrorist
    incident. The Federal Bureau of Investigation and the Federal Emergency
    Management Agency are tasked with leading federal efforts in their
    respective roles for managing a terrorist crisis and the consequences of an
    incident. These two agencies would be supported by a number of other federal
    agencies with response capabilities. The Federal Bureau of Investigation and
    the U. S. Secret Service have better coordinated their response capabilities
    during special events, such as the presidential inauguration, political
    conventions, and preparation for the 2002 Olympic Winter Games.

    Also, federal agencies have conducted a variety of exercises to test their
    response capabilities. These exercises have improved considerably in recent
    years and now regularly include interagency and intergovernmental command
    and control. Field exercises actually tested deployments with scenarios that
    practiced crisis and consequence management simultaneously. Improvements
    still are needed in consequence management exercises and in evaluating
    interagency aspects of federal exercises. Activities to develop future
    capabilities- through research and development and applying technology- are
    coordinated by interagency working groups. However, limits to the scope of
    these working groups? activities, in conjunction with the large number of
    projects and funding, provide the potential for duplication of efforts. GAO
    makes one recommendation to the President to direct the focal point to
    capture and evaluate interagency lessons learned from federal
    counterterrorism exercises and three other recommendations to improve
    readiness in consequence management, increase agencies? benefits from
    exercises, and complete a strategy to coordinate counterterrorism research
    and development.

    Executive Summary Page 9 GAO- 01- 822 Combating Terrorism

    Federal assistance to state and local governments to prepare for terrorist
    incidents has resulted in training for thousands of first responders- those
    state and local officials who would first respond at the scene of an
    incident. Some of these programs initially were developed without
    recognizing existing state and regional coordinating mechanisms for
    emergency preparedness. Moreover, these assistance programs overlapped
    because several federal agencies had similar efforts that were not well
    coordinated with each other. Since our earlier work, some programs have been
    consolidated; and there have been increased efforts to coordinate programs
    across agencies.

    To further improve this coordination, state and local officials have called
    for a single federal liaison for state and local preparedness programs. In
    response, the Attorney General established the National Domestic
    Preparedness Office within the Federal Bureau of Investigation to coordinate
    federal agencies? efforts to train first responders. However, this Office
    has not been effective due to funding, personnel, and organizational
    problems. Recently, the President directed that the Federal Emergency
    Management Agency establish an Office of National Preparedness to coordinate
    all federal consequence management programs dealing with weapons of mass
    destruction. This development creates an opportunity to consolidate within
    the Federal Emergency Management Agency the federal consequence management
    assistance programs to state and local governments that are at the
    Department of Justice and Federal Bureau of Investigation. GAO recommends
    that this be done.

    Finally, the federal government has provided some states with specialized
    National Guard teams, but these teams continue to experience problems that
    undermine their usefulness. GAO makes a recommendation to place a temporary
    moratorium on adding new, specialized National Guard response teams until
    their roles and missions are fully coordinated.

    Regarding risks to computer systems and, more importantly, to the critical
    operations and infrastructures they support, an array of efforts has been
    undertaken to implement a national strategy outlined in Presidential
    Decision Directive 63. However, progress in certain key areas has been slow.
    Specifically, federal agencies have taken initial steps to develop critical
    infrastructure protection plans; but independent audits continue to identify
    persistent, significant information security weaknesses that place federal
    operations at high risk of tampering and disruption. In addition, outreach
    efforts by numerous federal entities to establish cooperative relationships
    with and among private and other non- federal entities have raised awareness
    and prompted information sharing, and the federal

    Executive Summary Page 10 GAO- 01- 822 Combating Terrorism

    government and the private sector have initiated a variety of critical
    infrastructure protection- related research and development efforts.
    However, substantive analysis of sector- wide and cross- sector
    interdependencies and related vulnerabilities has been limited. An
    underlying deficiency impeding progress is the lack of a national plan that
    fully defines the roles and responsibilities of key participants and
    establishes interim objectives. The administration currently is reviewing
    and considering adjustments to the government?s critical infrastructure
    protection strategy that may address this deficiency. GAO recommends
    developing a more detailed strategy for combating computer- based attacks,
    which should be linked to a national strategy to combat terrorism.

    The management structure for leading and coordinating federal efforts to
    combat terrorism has evolved since June 1995 when Presidential Decision
    Directive 39 assigned the Department of Justice, through the Federal Bureau
    of Investigation, responsibility as the lead federal agency for crisis
    management and the Federal Emergency Management Agency responsibility as the
    lead federal agency for consequence management of domestic terrorist
    incidents. In May 1998, Presidential Decision Directive 62 established the
    position of National Coordinator within the National Security Council;
    however, its functions were never detailed in either an executive order or
    through legislation. Many of the overall leadership and coordination
    functions GAO has identified as critical were not given to the National
    Coordinator. In fact, several other agencies, such as the Department of
    Justice, Federal Bureau of Investigation, Federal Emergency Management
    Agency, and the Office of Management and Budget, currently perform these
    functions. Some of the functions currently located in different agencies
    include overseeing a threat and risk assessment, developing a national
    strategy, and coordinating program implementation across agencies. The
    interagency roles of these various agencies are not always clear and
    sometimes overlap, which leads to a fragmented approach. For example, the
    Department of Justice, the National Security Council, the Federal Bureau of
    Investigation, and the Federal Emergency Management Agency have developed-
    or plan to develop- aspects of national strategies to combat terrorism.
    National efforts to combat illegal drugs offer potential lessons in
    addressing the overall leadership and coordination of interagency efforts to
    combat terrorism. Importantly, the Office of National Drug Control Policy,
    through legislation, has the legitimacy and authority to carry out its
    functions. Principal Findings

    Overall Leadership and Coordination Need to Be Addressed

    Executive Summary Page 11 GAO- 01- 822 Combating Terrorism

    Both the Congress and the President have expressed concern about the overall
    national leadership and coordination of programs to combat terrorism. The
    Congress has held hearings, appointed commissions, and proposed legislation
    on these issues. The President asked the Vice President in May 2001 to
    oversee the development of a coordinated effort to improve national
    preparedness (see app. VII). While it is not yet clear what the Vice
    President specifically will be responsible for, agencies involved do not
    anticipate that his position will be one of permanent, overall leadership
    and coordination. The President also established an Office of National
    Preparedness within the Federal Emergency Management Agency to coordinate
    all federal consequence management programs dealing with weapons of mass
    destruction. Several proposals have been advanced to improve the overall
    leadership and coordination of programs to combat terrorism. These
    approaches generally create a single focal point located in either the
    Executive Office of the President or a lead executive agency. Each location
    has its advantages and disadvantages.

    Based upon numerous evaluations, the identification of recurring problems in
    the overall leadership and coordination of programs, and an analysis of
    various proposals, GAO believes a single focal point, with all critical
    functions and responsibilities, should be assigned to lead and coordinate
    these programs. This focal point, for example, could be an individual, an
    executive office, or a council. Furthermore, this focal point should be in
    the Executive Office of the President and be independent of any existing
    federal agency. A focal point within the Executive Office of the President
    would be independent, above the interests of any of the several individual
    agencies involved. The focal point needs to have the time, responsibility,
    authority, and resources for coordinating both crisis management and
    consequence management activities. Current proposals to create a new agency
    to combine functions currently in several agencies still would not contain
    all the government agencies and functions needed to combat terrorism. While
    not endorsing any specific organizational structure for the single focal
    point, GAO has identified basic functions that any focal point should
    perform.

    An important initial step in developing a national strategy is to conduct
    threat and risk assessments to define and prioritize requirements. The
    Department of Justice and the Federal Bureau of Investigation have made
    limited progress in implementing GAO?s recommendations that such assessments
    be performed at both the local and national level. For example, the
    Department of Justice and the Bureau have worked together to provide a
    threat and risk assessment tool to state and local Limited Progress Made in

    Developing a National Strategy and Related Guidance and Plans

    Executive Summary Page 12 GAO- 01- 822 Combating Terrorism

    governments. These state and local assessments may complement national-
    level threat and risk assessments and related policy- making. Regarding
    GAO?s recommendation for national- level authoritative threat assessments,
    the Bureau agreed to lead such assessments in July 1999. The Bureau is
    collaborating with other agencies to complete two assessments of terrorist
    threats, including those involving weapons of mass destruction.

    The Department of Justice has made progress toward developing a national
    strategy through its publication of the Attorney General?s FiveYear
    Interagency Counterterrorism and Technology Crime Plan. The plan represents
    a substantial interagency effort and is the one current document that could
    serve as a basis for the development of a national strategy. However, GAO
    believes the plan should be improved to better serve as a national strategy.
    First, the plan needs to have measurable outcomes consistent with the
    Government Performance and Results Act of 1993. Although the plan has
    objectives and performance indicators, it focuses on agency activities,
    which represent outputs as opposed to results- oriented outcomes. Second,
    the plan needs to better define the roles of state and local governments.
    Although the Department of Justice obtained state and local input in
    preparing the Five- Year Plan and identifies specific ways to enhance state
    and local responder capabilities, the plan does not identify state and local
    government roles in responding to a terrorist incident. To the extent that
    the plan should better address the roles of state and local authorities, and
    be developed with them, GAO believes it can become more of a national
    strategy than a federal plan.

    The Office of Management and Budget has made progress tracking budgets and
    expenditures for programs to combat terrorism and has issued four annual
    reports to the Congress. Through these reports, the executive branch and the
    Congress now have strategic oversight of the magnitude and direction of
    federal funding to combat terrorism. Each annual report progressively has
    contained more details about agency budgets and spending by various
    categories. In 1999, the National Security Council and the Office of
    Management and Budget initiated a new process by which interagency working
    groups reviewed the agencies? proposals and developed recommendations on
    whether they should be funded. The Office has stated that this new process
    resulted in the reallocation of resources to fund critical shortfalls and
    eliminate duplication. However, its annual reports have not identified
    priorities or reported on duplication of efforts.

    Executive Summary Page 13 GAO- 01- 822 Combating Terrorism

    Federal agencies also have made progress in completing guidance and plans
    related to terrorism. The Federal Bureau of Investigation and Federal
    Emergency Management Agency now have completed interagency guidance to
    combat terrorism domestically, thereby clarifying many command and control
    issues. Similarly, agencies have completed or are developing internal
    guidance and concepts of operations to respond to terrorist incidents.

    Federal capabilities to respond to terrorist incidents have improved. Such
    capabilities include a broad array of teams and related assets, such as
    mobile laboratories for initial on- site analysis of a weapon of mass
    destruction. The Federal Bureau of Investigation leads a variety of
    potential federal teams for crisis management, while the Federal Emergency
    Management Agency leads a variety of potential federal teams for consequence
    management. These capabilities have been improved in several ways. First,
    these capabilities have been enhanced through agency participation in
    special events. These events provide federal agencies with valuable
    experience working together to develop and practice plans to combat
    terrorism. The Federal Bureau of Investigation and the U. S. Secret Service
    have improved their cooperation for such events. For example, they now have
    a written agreement on command and control issues and jointly conduct some
    planning and exercises. Second, federal agencies also have improved their
    capabilities by conducting exercises. The Federal Bureau of Investigation
    has made progress in regularly practicing its interagency and
    intergovernmental leadership role in crisis management. However, the Federal
    Emergency Management Agency still is not using exercises to fully practice
    its leadership role over consequence management. Third, federal capabilities
    have been improved when agencies learn lessons from exercises and
    operations, such as special events. As in its earlier reviews, GAO found
    that some federal agencies have relatively good processes in place to
    capture and share lessons learned while others have less rigorous processes.
    Some federal agencies work to capture and share interagency lessons learned;
    however, as yet, there is no regular process in place to capture and share
    these types of evaluations that cross agency lines.

    Federal capabilities also have been enhanced through research and
    development projects. Examples of recently developed and fielded
    technologies include products to detect and identify weapons of mass
    destruction, transport contaminated materials, and validate protection
    equipment life spans. Federal agencies and an interagency working group
    presently are developing technologies, including vehicle explosives Federal
    Response

    Capabilities Have Improved but Further Action Could Be Taken

    Executive Summary Page 14 GAO- 01- 822 Combating Terrorism

    screening and barrier technologies, as well as decontamination products for
    use in urban facilities, such as subways and airports. Because of the high
    risk, long development time, and high cost, federal government involvement
    probably will be required for research and development projects related to
    weapons of mass destruction. Federal research and development programs are
    coordinated in a variety of ways, but primarily through an interagency
    working group. However, coordination is limited by a number of factors,
    raising the potential for duplication of efforts among different federal
    agencies.

    Recent developments may allow the consolidation of federal programs that
    provide assistance to state and local governments. These programs have
    improved domestic preparedness by training and equipping over 273,000 first
    responders since fiscal year 1998. These programs also have included
    exercises to allow first responders to interact with each other and with
    federal responders during realistic field conditions. However, some of these
    programs initially were implemented without leveraging existing regional and
    state structures for emergency management. For example, the Department of
    Defense provided training to localities without taking advantage of the
    existing state emergency management structures, mutual aid agreements among
    local jurisdictions, or other collaborative arrangements for emergency
    response. In addition, the number of programs led by three different federal
    agencies- the Departments of Defense and Justice and the Federal Emergency
    Management Agency- created an overlapping approach with potential
    duplication. More recently, some programs have been consolidated, such as
    the Department of Defense?s domestic preparedness programs, which were
    transferred to the Department of Justice. In addition, efforts have
    increased to better coordinate assistance programs across agencies.

    The number of federal agencies involved in the programs led to confusion on
    the part of state and local officials. These officials asked the federal
    government to establish a single federal liaison for state and local
    governments. In 1998, the Attorney General established the National Domestic
    Preparedness Office under the management of the Federal Bureau of
    Investigation to serve as a single point of contact for state and local
    authorities. However, the Office has not been effective in carrying out its
    tasks due to insufficient funding, lack of key functional expertise,
    potential organizational duplication, and a perceived lack of independence
    due to its location within the Bureau.

    In May 2001, the President asked the Director of the Federal Emergency
    Management Agency to establish an Office of National Preparedness that
    Federal Assistance to State

    and Local Governments Can Be Consolidated

    Executive Summary Page 15 GAO- 01- 822 Combating Terrorism

    will serve as the focal point within the federal government for the
    oversight, coordination, integration, and implementation of preparedness and
    consequence management programs and activities for weapons of mass
    destruction and related threats. This new Office provides an opportunity to
    consolidate federal programs to assist state and local governments,
    including some assistance programs currently under the Department of Justice
    and Federal Bureau of Investigation. However, the Department of Justice and
    the Federal Bureau of Investigation would retain their lead federal agency
    responsibilities for crisis management and their law enforcement and
    investigative roles and responsibilities.

    Federal assistance also has been provided in the form of special National
    Guard teams that are trained and equipped to provide states with
    capabilities to detect and analyze weapons of mass destruction and provide
    technical advice. These teams continue to experience problems with
    readiness, doctrine and roles, and deployment that undermine their
    usefulness in an actual terrorist incident. Until the Department of Defense
    has completed its coordination of the teams? roles and missions with the
    Federal Bureau of Investigation- the lead federal agency for crisis
    management- the establishment of any additional teams would be premature.
    The Department of Defense agrees with GAO?s assessment.

    To protect critical federal systems from computer- based attacks, federal
    entities, such as the Chief Information Officers Council and the Critical
    Infrastructure Assurance Office, have developed model policies and tools for
    measuring the effectiveness of agency information security programs and
    taken steps to identify critical assets and better coordinate the federal
    response to computer incidents. In addition, individual executive agencies
    have taken significant actions to correct identified computer security
    weaknesses associated with their systems and improve their information
    security programs. However, audits have continued to identify significant
    information security weaknesses in virtually every major federal agency and,
    since 1996, GAO has reported that poor security program management is an
    underlying cause that has diminished agencies? abilities to ensure that
    controls are appropriate and effective. In addition, a March 2001 report by
    the President?s Council on Integrity and Efficiency and the Executive
    Council on Integrity and Efficiency identified significant deficiencies in
    agencies? implementation of Presidential Decision Directive 63 and
    questioned the federal government?s ability to achieve the directive?s goal
    to protect the nation?s critical infrastructures from intentional
    destructive acts by May 2003. Factors cited as impediments to Limited
    Progress in

    Implementing a Strategy to Counter Computer- Based Threats

    Executive Summary Page 16 GAO- 01- 822 Combating Terrorism

    federal efforts include uncertainty regarding Presidential Decision
    Directive 63?s applicability and resource constraints.

    Beyond efforts to protect their own computer- dependent operations, lead
    agencies also have taken steps to foster cooperative relationships with the
    eight infrastructure sectors identified in Presidential Decision Directive
    63, which include telecommunications, banking and finance, transportation,
    energy, and emergency services. For most of the infrastructure sectors,
    representatives had been selected to coordinate and lead efforts, and
    education and outreach efforts had been undertaken to promote understanding
    of the risk and encourage cooperation. In addition, five industry specific
    centers had been established to gather and share information about
    vulnerabilities and computer- based attacks. However, substantive,
    comprehensive analysis of infrastructure sector vulnerabilities and
    development of related remedial plans had been limited because relationships
    were still being established, critical assets and entities had not been
    identified completely, and appropriate methodologies still were being
    identified and developed. Factors that had impeded progress in gaining
    private sector involvement included lack of senior executives? awareness
    about the importance of their assets to national and economic security and
    concerns about antitrust violations and release of sensitive information.
    Further, in April 2001, GAO reported significant deficiencies in progress
    made by the Federal Bureau of Investigation?s National Infrastructure
    Protection Center, which was established to serve as a national analysis and
    warning center for cyber threats and attacks. In that report, GAO identified
    several impediments to progress, including staffing shortfalls and
    inconsistent interpretations of the Center?s role and responsibilities among
    other entities involved in critical infrastructure protection.

    Other federal efforts include activities to expand international cooperation
    regarding critical infrastructure protection. The Departments of State,
    Justice, and Commerce have organized and participated in meetings with
    representatives of other countries to discuss infrastructure protection,
    developed a United Nations Resolution on cyber- crime, and were in the
    process of negotiating a Council of Europe treaty on cyber- crime. In
    addition, GAO identified a variety of research and development efforts that
    were either being planned or performed.

    A recurring finding resulting from work done by GAO and by agency inspectors
    general is that a fundamental deficiency in the implementation of
    Presidential Decision Directive 63 has been the lack of an adequate national
    plan that delineates interim objectives and the specific roles and

    Executive Summary Page 17 GAO- 01- 822 Combating Terrorism

    responsibilities of federal and non- federal entities involved in critical
    infrastructure protection. In addition, several agency officials said that
    funding and staffing constraints contributed to their delays in implementing
    Presidential Decision Directive 63 requirements. The administration
    currently is reviewing the federal critical infrastructure protection
    strategy and, according to a May 2001 White House press statement, is
    developing recommendations on how to structure an integrated approach to
    cyber- security and critical infrastructure protection.

    The federal government?s cyber- security strategy should be linked to a
    national strategy to combat terrorism as discussed earlier. However, the two
    areas are different in that the threats to computer- based infrastructures
    are broader than terrorism and programs to protect them are more closely
    associated with traditional information security activities.

    GAO is making multiple recommendations, which are summarized below. Chief
    among these are three recommendations to the President in chapters 2, 4, and
    5. They are the following:

     Designate a single focal point with responsibility and authority for all
    critical functions necessary to provide overall leadership and coordination
    of federal programs to combat terrorism (see ch. 2).

     Direct the focal point to develop a formal process to evaluate interagency
    lessons learned from major federal exercises to combat terrorism (see ch.
    4).

     Consolidate selected Department of Justice and Federal Bureau of
    Investigation assistance programs to state and local governments into the
    Federal Emergency Management Agency (see ch. 5).

    GAO also is making a number of additional recommendations for executive
    action to improve federal efforts to combat terrorism. They entail taking
    the following actions:

     Complete a threat assessment on likely weapons of mass destruction and
    other weapons that might be used by terrorists (see ch. 3).

     Revise the Attorney General?s Five- Year Interagency Counterterrorism and
    Technology Crime Plan to better serve as a national strategy (see ch. 3).

     Expand the Federal Emergency Management Agency?s role in managing federal
    exercises (see ch. 4).

     Prepare agencies? after- action reports or similar evaluations of
    exercises and operations (see ch. 4). Recommendations for

    Executive Action

    Executive Summary Page 18 GAO- 01- 822 Combating Terrorism

     Complete a strategy to coordinate research and development to improve
    federal capabilities and to avoid duplication of effort (see ch. 4).

     Place a temporary moratorium on new National Guard teams until their roles
    and missions are fully coordinated in writing with the lead federal agency
    for crisis management (see ch. 5).

     Develop a strategy for combating computer- based attacks that more clearly
    defines specific roles and responsibilities of organizations involved,
    interim objectives and milestones for achieving goals, and related
    performance measures (see ch. 6).

    GAO provided a draft of this report to appropriate federal agencies for
    their review and comment in August 2001. Agency comments were based on their
    efforts prior to the September 11, 2001, terrorist attacks on New York City
    and Washington, D. C. The Office of Management and Budget provided
    consolidated written comments from the National Security Council, Office of
    Management and Budget, and Office of Science and Technology Policy on a
    draft of this report. The Departments of Agriculture, Commerce, Defense,
    Energy, Health and Human Services, Justice, the Treasury, and Veterans
    Affairs and the Federal Emergency Management Agency also provided written
    comments on a draft of this report. These comments are reprinted, along with
    GAO?s comments, in appendixes VII to XVI. The Departments of State and
    Transportation, the Environmental Protection Agency, and the General
    Services Administration provided GAO with oral comments on a draft of this
    report. Written and oral comments from all of these agencies, as well as
    their technical comments, have been incorporated in the report, as
    appropriate.

    Several agencies generally concurred with GAO?s report and/ or its
    recommendations, including the Departments of Commerce, Defense, Energy,
    Transportation, and Veterans Affairs; the Federal Emergency Management
    Agency; and the Environmental Protection Agency. The Department of Health
    and Human Services stated that the report?s observations and comments will
    be useful for the Vice President?s pending comprehensive review on national
    preparedness. The Department of Transportation noted that, overall, the
    report provides a useful, comprehensive ?capping? effort identifying the
    efforts undertaken by multiple federal agencies to combat terrorism. The
    Department of Energy said the report accurately describes both the recent
    accomplishments and the lack of progress within the interagency community in
    this area. In contrast, the Department of Justice had ?serious reservations?
    about some of the discussion and recommendations in the report that the
    President designate a single focal point and that its assistance programs to
    state and Agency Comments

    and Our Evaluation

    Executive Summary Page 19 GAO- 01- 822 Combating Terrorism

    local governments be consolidated under the Federal Emergency Management
    Agency.

    Two agencies- the Departments of Energy and Transportation- supported GAO?s
    most important recommendation to the President- that he work with the
    Congress to establish a single focal point for overall leadership and
    coordination for programs to combat terrorism. The Department of Energy
    stated that a single responsible and accountable focal point for combating
    terrorism should be established, independent of any existing federal agency.
    The Department of Transportation said the report makes a reasonable case for
    a single point of focus for terrorism issues in the Executive Branch. In
    contrast, the Department of Justice said, in light of the Vice President?s
    pending review, this recommendation is premature. The Department also said
    that, in its view, there is no need at this time to change or expand the
    role of the current NSC National Coordinator. Other federal agencies-
    including the Executive Office of the President- did not comment on this
    recommendation. The Office of Management and Budget referred us to the
    President?s May 8, 2001, statement (see app. VII) in which the President
    tasked the Vice President with overseeing the development of a coordinated
    effort to improve national preparedness. Officials from several other
    agencies indicated that it would be premature for them to comment on this
    recommendation until the Vice President has completed his review of national
    preparedness. GAO disagrees that its recommendation on this matter is
    premature. Notwithstanding the Vice President?s review, GAO?s recommendation
    is based upon its own reviews over a 5- year period. Those reviews
    consistently showed problems related to overall leadership and coordination,
    as discussed in this report.

    Agency comments on GAO?s other recommendations, along with GAO?s evaluation,
    are presented at the end of chapters 2, 3, 4, 5, and 6. In some cases,
    agencies did not directly comment on recommendations that GAO made to them.

    GAO also provided a draft of this report to state officials in Colorado and
    Utah for their review and comment. Officials representing Colorado?s Office
    of Emergency Management and Utah?s Olympic Public Safety Command concurred
    with those sections of GAO?s report they reviewed regarding the Top
    Officials 2000 and Wasatch Rings exercises, respectively. The official from
    Utah strongly supported our recommendation that the President designate a
    single focal point. The official stated that it is critical that the focal
    point have adequate authority to carry out its responsibilities.

    Chapter 1: Introduction Page 20 GAO- 01- 822 Combating Terrorism

    With the coordinated terrorist attacks against the World Trade Center in New
    York City and the Pentagon in Washington, D. C., on September 11, 2001, the
    threat of terrorism rose to the top of the country?s national security and
    law enforcement agendas. Even before these catastrophic incidents, the
    threat of attacks against people, property, and infrastructures had
    increased concerns about terrorism. The terrorist bombings in 1993 of the
    World Trade Center in New York City and in 1995 of the Alfred P. Murrah
    Federal Building in Oklahoma City (see fig. 1), which killed 168 people and
    wounded hundreds of others, prompted increased emphasis on the need to
    strengthen and coordinate the federal government?s ability to effectively
    combat terrorism domestically. Also, the 1995 Aum Shinrikyo sarin nerve
    agent attack in the Tokyo subway system raised new concerns about U. S.
    preparedness to combat terrorist incidents involving weapons of mass
    destruction (WMD)- a chemical, biological, radiological, or nuclear agent or
    weapon. 1

    1 Throughout this report, we use the term weapons of mass destruction to
    refer to chemical, biological, radiological, or nuclear agents or weapons.
    Some agencies define it to include large conventional explosives as well. As
    clearly demonstrated by the September 11, 2001, incidents, a terrorist
    attack would not have to fit this definition of weapons of mass destruction
    to result in mass casualties, destruction of critical infrastructures,
    economic losses, and disruption of daily life nationwide. Chapter 1:
    Introduction

    Chapter 1: Introduction Page 21 GAO- 01- 822 Combating Terrorism

    Figure 1: Aftermath of the April 1995 Terrorist Bombing of the Alfred P.
    Murrah Federal Building in Oklahoma City, Oklahoma

    Source: Federal Emergency Management Agency.

    Chapter 1: Introduction Page 22 GAO- 01- 822 Combating Terrorism

    U. S. intelligence and law enforcement communities continuously assess both
    foreign and domestic terrorist threats to the United States. The U. S.
    foreign intelligence community- the Central Intelligence Agency, the Defense
    Intelligence Agency, the Federal Bureau of Investigation (FBI), and the
    Department of State?s Bureau of Research and Intelligence- monitors the
    foreign- origin terrorist threat to the United States. In addition, the FBI
    gathers intelligence and assesses the threat posed by domestic sources.
    According to the U. S. intelligence community, conventional explosives and
    firearms continue to be the terrorists? weapons of choice. Terrorists are
    less likely to use weapons of mass destruction, although the possibility
    that terrorists will use these weapons may increase over the next decade.

    According to the FBI, during the 1990s, there were, on average, about five
    terrorist incidents in the United States each year. 2 In contrast, during
    the 1980s, there were, on average, 22 terrorist incidents in the United
    States each year. Figure 2 provides FBI statistics on the number of
    terrorist incidents in the United States between 1980 and 1999, five of
    which the FBI categorized as WMD incidents.

    2 The FBI broadly defines terrorism as ?the unlawful use of violence,
    committed by a group of two or more individuals against persons or property
    to intimidate or coerce a government, the civilian population, or any
    segment thereof, in furtherance of political or social objectives.? The FBI
    includes in its annual reports on terrorism in the United States acts such
    as bombings, arson, kidnapping, assaults, and hijackings committed by
    persons who may be suspected of associating with militia groups, animal
    rights groups, and others.

    Chapter 1: Introduction Page 23 GAO- 01- 822 Combating Terrorism

    Figure 2: Terrorist Incidents in the United States, 1980 to 1999

    Note: As of August 31, 2001, FBI officials said that 2000 data were not
    available. Source: FBI.

    U. S. policy and strategy for dealing with terrorism, along with the nature
    and perception of the terrorist threat, has been evolving over the past 30
    years. A complex framework of programs and activities across more than 40
    federal agencies, bureaus, and offices are in place to combat terrorism. The
    evolution of these programs came from a variety of presidential decision
    directives, implementing guidance, executive orders, interagency agreements,
    and legislation. 3 Formal interagency coordination intended to combat
    terrorism is managed by the National Security Council (NSC), which also
    sponsors a number of interagency working groups on terrorism issues.

    The United States regards terrorist attacks against its territory, citizens,
    or facilities as a national security threat and criminal act, wherever the
    attack may occur. U. S. policy is to react rapidly and decisively to
    terrorism

    3 See app. I, which summarizes presidential decision directives, executive
    orders, and other guidance. Also see app. II, Selected Laws Related to
    Terrorism, in Combating Terrorism: Federal Agencies? Efforts to Implement
    National Policy and Strategy Sept. 26, 1997), p. 73. The Federal

    Government?s Role in Combating Domestic Terrorism

    Chapter 1: Introduction Page 24 GAO- 01- 822 Combating Terrorism

    directed at the United States, whether it occurs domestically or
    internationally and whether it involves the use of conventional weapons or
    WMD devices. U. S. policy on combating terrorism for terrorist incidents
    overseas was formalized in 1986 under National Security Decision Directive
    207. The Department of State was reaffirmed as the lead agency for
    international terrorism policy, procedures, and programs; and the FBI,
    through the Department of Justice, was reaffirmed as the lead agency for
    handling domestic terrorist threats. Following the April 1995 bombing of the
    Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma, the President
    issued Presidential Decision Directive (PDD) 39, which enumerated
    responsibilities for federal agencies in combating terrorism, including
    domestic incidents. In May 1998, the President reaffirmed PDD 39 with the
    issuance of PDD 62, which further articulated responsibilities for specific
    agencies. PDD 62 also established a National Coordinator for Security,
    Infrastructure Protection and Counterterrorism within the NSC, to coordinate
    agencies? programs. Both presidential decision directives and implementing
    guidance divide the federal response to terrorist attacks into two
    categories- crisis management and consequence management. Throughout the
    management of a terrorist incident, crisis and consequence management
    components operate concurrently. The concept of operations for a federal
    response to a terrorist threat or incident provides for an overall lead
    federal agency to ensure multi- agency coordination and a tailored, time-
    phased deployment of specialized federal assets. It is critical that all
    participating federal, state, and local agencies interact in a seamless
    manner.

    Prior to an event involving a weapon of mass destruction or the release of
    biological, chemical, or nuclear/ radiological material, crisis management
    activities and the achievement of law enforcement goals and objectives
    generally will have priority. However, consequence management planning to
    address the effects of a terrorist incident also will occur. When an
    incident results in the use of a weapon of mass destruction or the release
    of material, the execution of consequence management activities generally
    will have priority, with crisis management activities continuing until law
    enforcement goals and objectives have been met. Therefore, crisis and
    consequence management activities may overlap and/ or run concurrently
    during the emergency response and are dependent upon the threat and/ or
    strategies for responding to the incident.

    The Department of State is the lead federal agency for crisis and
    consequence management of international terrorist incidents. Although the
    Department has a number of contingency arrangements and plans already in
    place to respond to a terrorist attack on U. S. interests abroad,

    Chapter 1: Introduction Page 25 GAO- 01- 822 Combating Terrorism

    support for international crisis and consequence management comes from
    domestic assets. For example, Department of Defense (DOD); FBI; Bureau of
    Alcohol, Tobacco, and Firearms (ATF); Department of Health and Human
    Services (HHS); Environmental Protection Agency (EPA); or Department of
    Energy (DOE) teams could support overseas operations involving a WMD
    incident. Finally, a domestic terrorist incident may have significant
    international implications. For example, a domestic incident may involve a
    foreign terrorist organization or a biological terrorist incident could
    involve spreading the biological agent to virtually any city that has an
    international airport.

    The Department of Justice, through the FBI, is the lead agency for crisis
    management of domestic terrorist incidents. The Department of Justice and
    the FBI manage and resolve a crisis resulting from a terrorist incident.
    They also conduct criminal investigations and pursue, arrest, and prosecute
    terrorists. When threats are communicated, particularly involving the use of
    weapons of mass destruction, the FBI initiates threat credibility
    assessments in close coordination with experts from other federal
    departments and agencies, such as DOD, DOE, HHS, EPA, and the Federal
    Emergency Management Agency (FEMA), to assess the threat from technical,
    operational, and behavioral perspectives. All federal agencies and
    departments, as needed, support the overall lead federal agency and the FBI
    on- scene commander.

    Based on the preliminary threat assessment, the FBI Director, through the
    Attorney General, may authorize the deployment of a Domestic Emergency
    Support Team, which is comprised of those agencies that can advise or
    provide assistance to the FBI in managing the crisis on site. Upon the
    Attorney General?s approval of the FBI?s request, each agency?s
    representatives are expected to be ready to deploy quickly.

    In the event the President declares a national emergency, FEMA becomes the
    lead agency in charge of consequence management, which includes efforts to
    provide medical treatment and emergency services, evacuate people from
    dangerous areas, and restore government services. Unlike crisis management,
    the federal government does not have primary responsibility for consequence
    management; state and local authorities do. FEMA, using the Federal Response
    Plan, coordinates federal agencies? response and activities when the state
    and local authorities request

    Chapter 1: Introduction Page 26 GAO- 01- 822 Combating Terrorism

    assistance. 4 Although state and local authorities will be the first to
    respond to a terrorist attack, any mass casualty- producing event would
    prompt a rapid, vigorous federal response, not just monitoring activity. The
    plan outlines the roles of other federal agencies, such as the Departments
    of Agriculture (USDA), Defense, Energy, Health and Human Services,
    Transportation, and Veterans Affairs (VA), and EPA, in consequence
    management covering a wide variety of contingencies, involving both
    conventional or WMD terrorists attacks.

    The transition from crisis management to consequence management can occur in
    a variety of ways, although in general, both activities occur concurrently.
    If a terrorist incident becomes imminent or actually occurs, state and local
    authorities would initiate consequence management actions, while FEMA would
    monitor the situation. In the event state and local authorities become
    overwhelmed, the President could direct FEMA, with support of other federal
    agencies, to assist the state, in coordination with the FBI. Upon
    determination that applicable law enforcement goals and objectives have been
    met, no further immediate threat( s) exist( s), and federal crisis
    management actions are no longer required, the Attorney General, in
    consultation with the FBI Director and FEMA Director, will transfer the
    overall lead federal agency role to FEMA.

    For fiscal year 2002, the federal government?s proposed budget for these
    programs is over $12.8 billion, of which about $8.6 billion is to combat
    terrorism, about $1. 8 billion is to combat weapons of mass destruction, and
    about $2. 6 billion is for critical infrastructure protection (CIP). 5
    Compared with the fiscal year 1998 funding level of about $7.2 billion, this
    proposed budget represents about a 78- percent increase in total funding to
    combat terrorism. In addition, the Congress recently approved the
    President?s request for $20 billion in emergency assistance and provided an
    additional $20 billion to supplement existing contingency funds.

    4 The Federal Response Plan implements the authorities of the Robert T.
    Stafford Disaster Relief and Emergency Assistance Act (42 U. S. C. 5121 et
    seq.) to respond to incidents or situations requiring federal emergency
    disaster assistance.

    5 The actual figures are $8. 567 billion to combat terrorism, $1. 766
    billion for defense against weapons of mass destruction, and $2. 595 billion
    for critical infrastructure protection. The total amount of $12. 821 billion
    is the sum of these three categories less funding that overlaps categories.

    Chapter 1: Introduction Page 27 GAO- 01- 822 Combating Terrorism

    During the 1990s, concerns surfaced regarding computer- based attacks
    because of the nation?s growing reliance on interconnected computer systems.
    Attacks could severely disrupt computer- supported operations, compromise
    the confidentiality of sensitive information, and diminish the integrity of
    critical data. A significant concern is that terrorists or hostile foreign
    states could severely damage or disrupt critical operations, resulting in
    harm to the public welfare.

    In response to concerns about the potentially devastating implications of
    computer- based attacks, the President issued PDD 63 in May 1998, which
    described a range of activities to improve the nation?s ability to detect
    and respond to serious physical and computer- based attacks. The directive
    called on the federal government to serve as a model of how infrastructure
    assurance is best achieved and designated ?lead agencies? to work with
    private- sector and government entities in each of eight infrastructure
    sectors and five special function areas. In addition, PDD 63 established
    entities to provide central coordination and support and encourage private-
    sector cooperation. Chapter 6 contains a more detailed description of the
    directive?s requirements and the organizations established to address
    critical infrastructure protection.

    Section 1035 of the Floyd D. Spence National Defense Authorization Act for
    Fiscal Year 2001 (P. L. 106- 398) mandated that we submit to the Senate and
    House Committees on Armed Services a report on the strategy, policies, and
    programs of the United States for combating domestic terrorism, particularly
    domestic terrorism involving weapons of mass destruction.

    Based upon the act and, as agreed with your offices, our objectives were to
    evaluate (1) the current framework for leadership and coordination of
    federal agencies? efforts to combat terrorism on U. S. soil, and proposals
    for change, (2) progress the federal government has made in developing and
    implementing a national strategy to combat terrorism domestically, (3) the
    federal government?s capabilities to respond to a domestic terrorist
    incident, (4) progress the federal government has made in helping state and
    local emergency responders prepare for a terrorist incident, and (5)
    progress made in developing and implementing a federal strategy for
    combating cyber- based attacks. This capping report updates and summarizes
    our extensive evaluations conducted in recent years of federal programs to
    combat domestic terrorism and protect critical infrastructures. A
    comprehensive list of GAO reports and testimonies related to terrorism
    appears at the end of this report. Risks of CyberAttacks

    and Related Government Strategy

    Objectives, Scope, and Methodology

    Chapter 1: Introduction Page 28 GAO- 01- 822 Combating Terrorism

    The scope of this effort was governmentwide, including selected state and
    local emergency response agencies. A complete listing of organizations
    visited and contacted and locations visited are found in appendix VI.

    The scope was limited to terrorist incidents on U. S. soil, whether foreign
    or domestic in origin. Our review did not include terrorist incidents
    outside of the United States or federal agencies? efforts to combat
    terrorism overseas. While we recognize that the role of intelligence and
    counter- intelligence for both operational and cyber issues is a key
    component of U. S. policies to combat terrorism, the scope did not include
    efforts by the U. S. intelligence community to gather and coordinate
    intelligence and counter- intelligence on terrorists, detect terrorist plans
    overseas, or respond to a terrorist incident. The scope also did not include
    efforts by the Immigration and Naturalization Service, U. S. Border Patrol,
    or U. S. Customs Service to prevent terrorists? entry into the United
    States. In addition, the report?s discussion of DOD?s terrorist response
    capabilities and assets is limited, since much of this information is
    classified.

    For each objective, we interviewed agency officials, reviewed supporting
    documentation, compared current programs with our previous findings to
    review progress that has been made, reviewed about 30 of our prior
    counterterrorism reports, and followed up on findings and recommendations
    made in our previous reports (see app. V for the status of relevant prior
    GAO recommendations).

    To evaluate the current framework for leadership and coordination of federal
    agencies? efforts to combat terrorism on U. S. soil, we conducted an
    analysis of interagency leadership and coordination functions and the roles
    and responsibilities of lead federal agencies and various interagency
    working groups. In addition, we reviewed a variety of proposals to change
    overall leadership and coordination, including various bills introduced in
    the U. S. House of Representatives and U. S. Senate, proposals contained in
    congressional committee reports, and related commissions. Also, we met with
    officials who helped prepare various commission reports that proposed
    changes to the leadership and coordination of federal counterterrorism
    efforts. Finally, we attended congressional briefings and hearings on
    terrorism issues and a national conference on WMD terrorism preparedness and
    response.

    To evaluate what progress the federal government has made in developing a
    national strategy to combat terrorism domestically, we conducted an analysis
    of the process to develop and track budgets to combat terrorism, the
    Attorney General?s Five- Year Interagency Counterterrorism and

    Chapter 1: Introduction Page 29 GAO- 01- 822 Combating Terrorism

    Technology Crime Plan to determine whether it serves as a national
    counterterrorism strategy, agency response and concept of operation plans
    and their adequacy, interagency guidance, and agency threat and risk
    assessments.

    To evaluate the federal government?s capabilities to respond to a terrorist
    incident, we conducted an analysis of federal response teams and their
    missions, other support assets and specialized capabilities, how response
    teams and support assets are coordinated, the effectiveness of federal
    interagency exercise programs, and the status of research and development
    efforts and how they are coordinated.

    To evaluate what progress the federal government has made in helping state
    and local emergency responders prepare for a terrorist incident, we
    conducted an analysis of how well federal agencies coordinate assistance to
    state and local emergency response agencies; how requirements are determined
    for training, equipment, and exercises; how well training and equipment are
    provided to and exercises conducted with state and local responders; whether
    training is provided efficiently and effectively; and whether exercises have
    tested the command and control system of federal, state, and local emergency
    responders. Also, we observed ?Wasatch

    Rings,? a multi- agency WMD field training exercise cosponsored by the FBI
    and the Utah Olympic Public Safety Command in preparation for the 2002
    Olympic Winter Games in Salt Lake City, Utah. Regarding National Guard
    teams, we reviewed recent audit reports by GAO and the DOD Inspector
    General, reviewed testimony from related congressional hearings, and held
    discussions with state and local officials.

    To evaluate federal efforts to combat computer- based attacks, we conducted
    an analysis of progress made in implementing PDD 63 to protect critical
    federal systems and ensure protection of private and other non- federal
    critical systems. We also surveyed related research and development. To
    accomplish this, we reviewed reports related to PDD 63, including the

     President?s Council on Integrity and Efficiency/ Executive Council on
    Integrity and Efficiency (PCIE/ ECIE) report on federal implementation of
    PDD 63, March 2001;

     Report of the President of the United States on the Status of Critical
    Infrastructure Protection Activities, January 2001;

     Individual agency inspector general reports; and

    Chapter 1: Introduction Page 30 GAO- 01- 822 Combating Terrorism

     Defending America?s Cyberspace: National Plan for Information Systems
    Protection: Version 1.0: An Invitation to Dialogue, The White House, January
    2000.

    We also reviewed CIP plans and other relevant documents and interviewed key
    officials from the Departments of Commerce, Defense, Energy, Health and
    Human Services, Justice, State, Transportation, and the Treasury and the
    EPA, FEMA, and General Services Administration. In addition, we interviewed
    officials from the NSC, Office of Science and Technology Policy (OSTP), and
    Critical Infrastructure Assurance Office (CIAO), as well as representatives
    from the banking and finance and emergency law enforcement infrastructure
    sectors.

    We performed our review from December 2000 through August 2001 in accordance
    with generally accepted government auditing standards.

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 31 GAO- 01- 822 Combating Terrorism

    Because of the interagency and intergovernmental nature of programs to
    combat terrorism, certain leadership and coordination functions are needed
    above the level of individual agencies. These include, among others,
    overseeing a threat and risk assessment, developing a national strategy,
    monitoring governmentwide budgets, and coordinating agency implementation.
    The President established, within the NSC, a national coordinator for
    terrorism, with general responsibilities to coordinate federal activities.
    However, the coordinator was not specifically given responsibilities for all
    the requisite leadership and coordination functions. Further, these
    functions are fragmented across different organizations and some individual
    agencies are performing functions that would be more appropriately
    coordinated above that level. The Congress and the President also have
    expressed concerns about the overall leadership and coordination of programs
    to combat terrorism. The Congress and various commissions have proposed
    several changes to create a single focal point for overall leadership and
    coordination and to centralize key functions within it. These proposals vary
    in their scope of coverage and their location for the focal point. The
    proposals generally place their focal point in either the Executive Office
    of the President or in a lead executive agency. Each location has its
    advantages and disadvantages. These proposals also vary in the interagency
    functions they centralize within the focal point. Because overall leadership
    and coordination must encompass both crisis and consequence management
    programs, we believe that the single focal point for overall leadership and
    coordination would be most effective in the Executive Office of the
    President rather than in any executive agency. While we do not endorse any
    specific model for the single focal point, we have identified basic
    characteristics and functions for such a focal point.

    The challenge to provide overall leadership and coordination of federal
    programs to combat terrorism is significantly affected by several factors.
    First, there are numerous federal agencies- more than 40- which have some
    role in combating terrorism. Second, these federal agencies represent
    different types of organizations, including those involved in intelligence,
    law enforcement, military matters, health services, environmental
    protection, emergency management, and diplomacy. 1

    1 Activities involving diplomacy, carried out by the Department of State,
    are relevant to the extent that some domestic terrorist incidents could have
    a foreign origin and/ or international implications. Chapter 2: Overall
    Leadership and

    Coordination Responsibilities Need to Be Centralized and Clarified

    Some Leadership and Coordination Functions Transcend Individual Agencies

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 32 GAO- 01- 822 Combating Terrorism

    Agencies? missions often include both domestic and international components.
    In addition, these agencies undertake a wide variety of activities to combat
    terrorism, including prevention, detection, crisis response, criminal
    prosecution, and consequence management, which require effective interagency
    coordination. Further, because terrorist incidents could potentially occur
    anywhere in the United States, federal efforts to combat terrorism must be
    intergovernmental to include state and local governments. As a result of
    these factors, no individual agency is in charge of all relevant
    capabilities needed to combat terrorism. These factors make it important
    that certain overall leadership and coordination functions are performed
    above the level of individual agencies. Examples of such functions that we
    have identified in the course of our previous work are as follows: 2

     Act as the top official accountable to the President and the Congress.

     Oversee a national threat and risk assessment.

     Lead the development of a national strategy.

     Set priorities within the national strategy.

     Coordinate and monitor international programs.

     Provide liaison and assistance to state and local governments.

     Monitor governmentwide budgets across federal agencies.

     Develop and monitor overall performance measures.

     Coordinate overall research and development. In May 1998, the President
    issued PDD 62, which established the position of a National Coordinator for
    Security, Infrastructure Protection and Counterterrorism at the NSC within
    the Executive Office of the President to provide a focal point for federal
    efforts to combat terrorism. Part of the rationale for creating this
    National Coordinator was to improve leadership and coordination among the
    various federal agencies. The directive enumerated responsibilities for the
    coordinator that included general coordination of federal efforts, chairing
    certain meetings, sponsoring interagency working groups, and providing
    budget advice. Many efforts of the Office of the National Coordinator have
    been positive and are discussed later in this report. Specific examples
    include tracking budgeting and spending and the activities of some of the
    working groups.

    2 See Combating Terrorism: Comments on Bill H. R. 4210 to Manage Selected
    Counterterrorist Programs (GAO/ T- NSIAD- 00- 85, May 4, 2000) and Combating
    Terrorism: Observations on Options to Improve the Federal Response (GAO- 01-
    660T, Apr. 24, 2001). National Coordinator

    Established, but Some Responsibilities Are Fragmented Across Agencies

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 33 GAO- 01- 822 Combating Terrorism

    However, other than the general responsibilities identified in PDD 62, the
    functions of the National Coordinator were never detailed in either an
    executive order or legislation. Many of the overall leadership and
    coordination functions we have identified as critical were not given to the
    National Coordinator. In fact, several other agencies have these leadership
    and coordination functions, such as the Department of Justice, the FBI,
    FEMA, and the Office of Management and Budget (OMB). Some of the functions
    currently resident in different agencies include completing a threat and
    risk assessment, developing a national strategy, providing liaison to state
    and local governments, and developing and monitoring performance measures.
    Officials from a number of agencies that combat terrorism have indicated to
    us that the interagency roles of these various agencies are not always clear
    and sometimes overlap, leading to a fragmented approach. Table 1 below shows
    that several of the key leadership and coordination functions are spread
    across different or multiple agencies.

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 34 GAO- 01- 822 Combating Terrorism

    Table 1: Organizations Currently Responsible for Key Interagency Leadership
    and Coordination Functions for Programs to Combat Terrorism

    Key interagency leadership and coordination function Current organization
    responsible for the

    function

    Act as the top official accountable to the President NSC (National
    Coordinator for Security,

    Infrastructure Protection and Counterterrorism), as appointed by the
    President in PDD 62. Act as the top official accountable to the Congress
    Numerous officials (including the Attorney

    General, Director of the FBI, Secretary of State, and Secretary of Defense)
    who testify before the Congress on these matters. Oversee a national threat
    and risk assessment FBI. See ch. 3 for more information on this

    function. Lead the development of a national strategy Attorney General
    (other offices also have

    discussed doing this). See ch. 3 for more information on this function. Set
    priorities within a national strategy OMB, on behalf of the President, is
    required to

    identify priorities in its annual reports; to date, it has not done so. See
    ch. 3 for more information on this function. Coordinate and monitor
    international programs Secretary of State (via Coordinator for

    Counterterrorism). Provide liaison and assistance to state and local
    governments Department of Justice (the Office for State and

    Local Domestic Preparedness Support and the National Domestic Preparedness
    Office) and FEMA. See ch. 5 for more information on this function. Monitor
    budgets across federal agencies NSC and OMB. See ch. 3 for more information

    on this function. Develop and monitor overall performance measures No agency
    assigned to do this overall task. See

    ch. 3 for more information on this function. Coordinate overall research and
    development NSC (via the Preparedness Against Weapons

    of Mass Destruction Research and Development Subgroup). See ch. 4 for more
    information on this function.

    Source: GAO analysis of interagency functions to combat terrorism.

    The current fragmented placement of these functions limits accountability
    and hinders unity of effort. To the extent that a single focal point- such
    as the current National Coordinator or other proposed focal points as
    discussed later in this chapter- is assigned these functions and held
    accountable for them, more progress might be made in developing and
    advancing federal efforts to combat terrorism. Our analysis indicates that
    the following deficiencies discussed in this report are due, in part, to the
    current fragmented structure for overall leadership and coordination.

     Overall Accountability. In some cases, the President and the Congress have
    held different officials accountable for interagency functions. For

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 35 GAO- 01- 822 Combating Terrorism

    example, while the President appointed a national coordinator, the Congress
    directed a different official, the Attorney General, to develop an
    interagency strategy (see ch. 3).

     Threat and risk assessment. There has been only limited progress in the 3
    years since the FBI agreed to perform an assessment; meanwhile, agencies may
    continue to expend resources for less likely threats and worst case
    chemical, biological, radiological, or nuclear scenarios (see ch. 3).

     National strategy. A strategy was developed by the Department of Justice,
    but it does not have measurable outcomes and should include the roles of
    state and local governments to truly become a national strategy. Also, other
    agencies may be developing competing ?national? strategies (see ch. 3).

     Monitoring budgets. OMB, working with the National Coordinator, has made
    progress in tracking and analyzing agency funding to combat terrorism.
    However, these offices have not identified priorities or duplication (see
    ch. 3). Also, there is no clear linkage between these budgets and the
    implementation of a national strategy (see ch. 3).

     Tracking and Implementing Lessons Learned. An interagency working group is
    responsible for planning exercises that combine federal efforts and practice
    coordination with state and local governments. While this group has made
    some attempts to develop a system for tracking lessons learned from these
    exercises, the process is not standardized and varies from exercise to
    exercise (see ch. 4).

     Coordinating agency implementation. Different agencies developed programs
    to provide assistance to state and local governments that are similar and
    potentially duplicative. These multiple programs have created confusion and
    frustration among state and local officials (see ch. 5).

    National efforts to combat illegal drugs offer potential lessons in
    addressing the overall leadership and coordination of interagency efforts to
    combat terrorism. There are similarities between combating illegal drugs and
    combating terrorism in terms of the number of agencies, disciplines, and
    activities, and the intergovernmental nature of the effort. The Congress
    created the Office of National Drug Control Policy in 1988 because
    fragmentation had hampered federal efforts to share information and
    coordinate programs. The Congress wanted strong, centralized leadership so
    the Office was located within the Executive Office of the President where it
    could rise above the particular interests of any one federal agency. The
    duties of the Office are to (1) develop a national drug control strategy
    containing both long- and short- term objectives, which is revised annually;
    (2) develop an annual consolidated drug control budget providing funding
    estimates for implementing the strategy; and (3) oversee and coordinate
    implementation of the strategy by the various federal

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 36 GAO- 01- 822 Combating Terrorism

    agencies. The Office, however, is not responsible for implementing the
    strategy- that is the role of individual agencies. Despite continuing
    difficulties in combating illegal drugs, the Office has set up a useful
    framework for leadership and coordination, and we supported its
    reauthorization in 1998. Most of the interagency leadership and coordination
    functions that we believe are needed for combating terrorism are resident in
    the Office of National Drug Control Policy structure. Moreover, through
    legislation, the Office has the legitimacy and authority to carry out these
    functions.

    Both the Congress and the President have expressed concerns about the
    overall leadership and coordination of programs to combat terrorism. The
    Congress has demonstrated its concerns by holding hearings, appointing
    commissions, and introducing various bills. The President has demonstrated
    concern by recently appointing the Vice President to oversee domestic
    preparedness efforts and by establishing an Office of National Preparedness
    within FEMA to coordinate all federal programs dealing with WMD consequence
    management programs.

    The Congress has expressed concerns about the overall leadership and
    coordination of programs to combat terrorism. Congressional committees have
    demonstrated this concern through a variety of hearings, committee reports,
    proposed legislation, and congressionally chartered commissions to examine
    programs related to terrorism. Examples of these are as follows:

     Multiple hearings have been held in the last several years that addressed
    problems in coordinating programs related to terrorism. These include
    hearings by the House Committee on Government Reform, House Committee on
    Armed Services, House Committee on Transportation and Infrastructure, Senate
    Committee on Governmental Affairs, Senate Committee on Appropriations,
    Senate Committee on Armed Services, Senate Select Committee on Intelligence,
    or their related subcommittees.

     Several legislative bills have been introduced in the last few years to
    resolve problems in coordinating programs related to terrorism. These bills
    included H. R. 4210, the Terrorism Preparedness Act of 2000; H. R. 525, the
    Preparedness Against Domestic Terrorism Act of 2001; H. R. 1158, the
    National Homeland Security Act; and H. R. 1292 the Homeland Security
    Strategy Act of 2001. In addition, laws have been passed that addressed
    improvements in programs related to terrorism.

     The Congress established three separate commissions to examine, among
    other things, problems coordinating programs related to terrorism. These The
    Congress and the

    President Also Are Concerned About Leadership and Coordination

    The Congress Shows Concern Through Hearings, Commissions, and Legislation

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 37 GAO- 01- 822 Combating Terrorism

    include the Advisory Panel to Assess Domestic Response Capabilities for
    Terrorism Involving Weapons of Mass Destruction (also known as the Gilmore
    Panel because it was chaired by Governor James Gilmore III of Virginia); the
    United States Commission on National Security in the 21st Century (also
    known as the Hart- Rudman Commission because it was chaired by former
    Senators Gary Hart and Warren Rudman); and the National Commission on
    Terrorism (also known as the Bremer Commission because its Chairman was
    former Ambassador Paul Bremer). 3 More details on these legislative
    proposals and commission recommendations appear below and in table 2.

    The President also has expressed concerns that efforts to protect the United
    States against a WMD weapon must have maximum effectiveness and be
    seamlessly integrated, harmonious, and comprehensive. In May 2001, the
    President asked the Vice President to oversee the development of a
    coordinated national effort on these matters. According to the Office of the
    Vice President, as of August 31, 2001, details on the Vice President?s
    efforts had not yet been determined. While it is not yet clear what specific
    areas the Vice President will be responsible for, agencies involved do not
    anticipate that this position will be permanent or provide overall
    leadership and coordination of federal efforts to combat terrorism. The
    President also asked the Director of FEMA to create a new Office of National
    Preparedness to assist the Vice President in implementing a national
    strategy on consequence management. This new Office, which was established
    in July 2001, was created to coordinate all federal programs dealing with
    WMD consequence management.

    Several proposals have been advanced to improve the overall leadership and
    coordination of programs to combat terrorism. These approaches generally
    create a single focal point located in either the Executive Office of the
    President or a lead executive agency. Each location has its advantages and
    disadvantages.

    3 The Bremer commission was focused on international terrorism. As noted
    earlier, international matters are relevant to the extent that some domestic
    terrorist incidents could have a foreign origin. President Appointed Vice

    President to Oversee National Effort

    Different Proposals on Leadership and Coordination Have Their Pros and Cons

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 38 GAO- 01- 822 Combating Terrorism

    Several new proposals have been advanced- through proposed legislation,
    committee reports, or various commissions- to change the overall leadership
    and coordination of programs to combat terrorism. All of these proposals
    provide for a focal point for the overall leadership and coordination of
    programs to combat terrorism. The proposals provide the focal point with
    different, but often similar, functions to centralize the interagency
    leadership and coordination of federal programs. However, the various
    proposals differ in the scope of their coverage. Some limit the scope to
    domestic preparedness, others to all programs to combat terrorism, and still
    others to the larger issue of homeland security that encompasses threats
    other than terrorism, such as military attacks. The proposals also vary as
    to the location of the focal point. They generally place the focal point in
    either the Executive Office of the President or in a lead executive agency.
    Table 2 shows various proposals regarding the focal point for overall
    leadership, the scope of the focal point?s activities, and its location.

    Table 2: Proposals to Create a Focal Point for Overall Leadership and
    Coordination of Programs to Combat Terrorism Source of proposal Focal point
    for overall

    leadership Scope of responsibilities Location of focal point

    H. R. 4210 (original version)

    Office of Terrorism Preparedness Domestic terrorism incidents involving

    weapons of mass destruction Executive Office of the President

    H. R. 525 President?s Council on Domestic Terrorism Preparedness

    Domestic terrorism preparedness (consequence management only) Executive
    Office of the

    President H. R. 1158 Cabinet- level head of

    proposed National Homeland Security Agency

    Homeland security (including domestic terrorism, maritime and border
    security, disaster relief, and critical infrastructure activities)

    Lead executive agency (National Homeland Security Agency)

    H. R. 1292 Single official to be designated by the President

    Homeland security (including antiterrorism and protection of territory and
    critical infrastructures from unconventional and conventional threats by
    military or other means)

    To be determined based upon the President?s designation

    Senate Report 106- 404 Deputy Attorney General for Combating
    Counterterrorism

    Domestic terrorism preparedness (crisis and consequence management) Lead
    executive agency

    (Department of Justice) Gilmore Panel National Office for

    Combating Terrorism Domestic and international terrorism (crisis and
    consequence management) Executive Office of the

    President Hart- Rudman Commission Cabinet- level head of

    proposed National Homeland Security Agency

    Homeland security (including domestic terrorism, maritime and border
    security, disaster relief, and critical infrastructure activities)

    Lead executive agency (National Homeland Security Agency)

    Center for Strategic and International Studies Assistant to the President

    or Vice President for Combating Terrorism

    Homeland Defense (including domestic terrorism and critical infrastructure
    protection)

    Executive Office of the President

    Source: GAO analysis of various proposals.

    Several New Proposals on Leadership and Coordination

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 39 GAO- 01- 822 Combating Terrorism

    The two locations for the focal point have their pros and cons. Table 3
    summarizes the advantages and disadvantages of placing the single focal
    point within the Executive Office of the President versus within a lead
    executive agency.

    Table 3: Advantages and Disadvantages of Various Leadership Approaches
    Location Advantages Disadvantages

    Focal point within the Executive Office of the President

     Would be positioned outside the particular interests of any one federal
    agency

     Would be located close to the President to resolve cross agency
    disagreement

     Could increase coordination and accountability while leveraging expertise
    located in different agencies

     Could potentially interfere with operations conducted by the respective
    executive agencies

     Could hinder direct communications between the President and the cabinet
    officer in charge of the respective executive agencies

    Focal point within a lead executive agency  Would provide a clear and
    streamlined chain of command within agency in matters of policy and
    coordination

     Could have better access to President than a mid- level focal point within
    the Executive Office of the President

     Would lack autonomy

     Would have other major missions and duties that might distract the focal
    point from combating terrorism

     Could be viewed by other agencies as parochial rather than working in the
    collective best interest

    Source: GAO analysis.

    In contrast to these proposals, the current system is a hybrid approach
    because it combines leadership and coordination responsibilities in both the
    Executive Office of the President and specific lead executive agencies. As
    shown previously in table 1, many of the key interagency leadership and
    coordination functions are fragmented because they are spread across
    different organizations. Two of the proposals (the original H. R. 4210 and
    the Gilmore Panel) model their focal point after the Office of National Drug
    Control Policy because of its centralized approach to overall leadership and
    coordination.

    Based upon years of evaluations, the fragmentation of leadership and
    coordination (as discussed above and throughout this report), and our
    assessment of the various proposals, our analysis indicates there needs to
    be a single focal point with responsibility for all critical functions to
    lead and coordinate these programs. 4 Furthermore, the focal point should be
    in the Executive Office of the President and be independent of any existing

    4 A list of our reports and testimonies related to terrorism appears at the
    end of this report. Various Locations for

    Focal Point Have Pros and Cons

    Focal Point Should Be Located in the Executive Office of the President

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 40 GAO- 01- 822 Combating Terrorism

    federal agency. Such a position would allow the focal point to be outside
    the interests of any individual agency. Proposals to create a focal point
    within a lead agency- whether the Department of Justice or FEMA- would not
    allow the focal point to have the governmentwide perspective needed.
    Specifically, the focal point needs to be above both crisis and consequence
    management. In addition, creating a new agency to combine functions
    currently in several agencies- such as the proposed National Homeland
    Security Agency- still would not contain all the government agencies and
    functions needed to combat terrorism. 5

    Notwithstanding our belief that the focal point should be in the Executive
    Office of the President, the exact structure for the focal point could vary.
    The various proposals potentially make this focal point a new office (e. g.,
    the proposed National Office for Combating Terrorism) or a council (e. g.,
    the proposed President?s Council on Domestic Terrorism Preparedness) or a
    person (e. g., the proposed Assistant to the President for Combating
    Terrorism). The current National Coordinator within the NSC also could
    potentially serve as the focal point if it were clearly responsible for the
    key functions we have identified.

    Key interagency functions are resident in several different organizations,
    resulting in fragmented leadership and coordination. These circumstances
    hinder unity of effort and limit accountability. However, the current
    attention being focused on this issue provides an opportunity to improve the
    overall leadership and coordination of programs to combat terrorism. The
    Congress has introduced various bills to create a focal point for terrorism-
    related efforts. Several commissions and research organizations, some of
    which were chartered by the Congress, also have recommended major changes to
    the manner in which terrorism- related programs are led and coordinated. The
    President has expressed concerns over current efforts and recently has
    tasked the Vice President to review these activities across the government.
    While there are many proposals to create a focal point, there is no clear
    consensus on where the focal point should be located or what
    responsibilities it should have. Given the consensus

    5 The Hart- Rudman Commission, and subsequently H. R. 1158, called for the
    creation of a National Homeland Security Agency, which would combine several
    existing agencies from different departments, including FEMA (its regional
    offices), the Department of the Treasury (U. S. Customs Service), the
    Department of Justice (U. S. Border Patrol), the Department of
    Transportation (U. S. Coast Guard), and several elements from other
    departments. Conclusions

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 41 GAO- 01- 822 Combating Terrorism

    that there is a need to address the overall leadership and coordination
    issues, and the uncertainty about the location of the focal point for these
    matters, we are making our recommendations to the President of the United
    States. In our view, the President and the Congress need to work together to
    implement a governmentwide solution on overall leadership and coordination
    to combat terrorism. We believe the President, in conjunction with the Vice
    President?s overall assessment, should clearly determine the
    responsibilities and functions of this critical focal point and place the
    authority for them within the focal point.

    We recommend that the President, in conjunction with the Vice President?s
    efforts, appoint a single focal point that has the responsibility and
    authority for all critical leadership and coordination functions to combat
    terrorism. The focal point should have the following characteristics and
    responsibilities.

     The focal point should be in the Executive Office of the President,
    outside individual agencies, and encompass activities to include prevention,
    crisis management, and consequence management.

     The focal point should oversee a national- level authoritative threat and
    risk assessment on the potential use of weapons of mass destruction by
    terrorists on U. S. soil. Such assessments should be updated regularly.

     The focal point also should lead the development of a national strategy
    for combating terrorism. The current Attorney General?s Five- Year Plan
    could serve as an initial point of departure with revisions to include
    measurable outcomes and the roles and participation of state and local
    governments. In addition, the national strategy should include research and
    development priorities and needs in order to facilitate interagency
    coordination, decrease duplication, and leverage monetary resources.

     The focal point should coordinate implementation of the national strategy
    among the various federal agencies. This would entail reviewing agency and
    interagency programs to ensure that they are being implemented in accordance
    with the national strategy and do not constitute duplication of effort.

     The focal point should analyze and prioritize governmentwide budgets and
    spending to combat terrorism to eliminate gaps and duplication of effort.
    The focal point?s role will be to provide advice or to certify that the
    budgets are consistent with the national strategy, not to make final budget
    decisions.

     The focal point should coordinate the nation?s strategy for combating
    terrorism with efforts to prevent, detect, and respond to computer- based
    attacks on critical infrastructures. We do not see the focal point for
    Recommendations for

    Executive Action

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 42 GAO- 01- 822 Combating Terrorism

    combating terrorism with responsibility for also protecting computerbased
    infrastructures because the threats are broader than terrorism and such
    programs are more closely associated with traditional information security
    activities. Nonetheless, there should be close coordination between the two
    areas.

     The focal point should be established by legislation to provide it with
    legitimacy and authority and its head should be appointed by the President
    with the advice and consent of the U. S. Senate. This would provide
    accountability to both the President and the Congress. Also, it would
    provide continuity across administrations.

     The focal point should be adequately staffed to carry out its duties for
    planning and oversight across the federal government.

    While some of the details of these interagency functions could be delegated
    to other agencies, the focal point should retain overall responsibility and
    be held accountable for their implementation.

    Agency comments on a draft of this report were based on their efforts prior
    to the September 11, 2001, terrorist attacks. The Departments of Energy and
    Transportation agreed with our recommendation that the President appoint a
    single focal point for all critical leadership and coordination functions to
    combat terrorism. DOE agreed that a single responsible and accountable
    ?focal point? for combating terrorism should be established, independent of
    any existing federal agency. DOE said that regardless of where this entity
    is placed, it should be given the authority to cut across agency lines with
    a clear set of obtainable goals and milestones. The key to its success will
    be strong leadership, an organization with a sense of purpose, and access to
    the tools necessary to do the job. Similarly, Department of Transportation
    officials believe the report makes a reasonable case for a single point of
    focus for terrorism issues in the Executive Branch.

    The Department of Justice disagreed with our recommendation to create a
    single focal point with specific functions. The Department said that the
    National Coordinator at the NSC was working in a ?manner that recognizes the
    unique roles and contributions of each agency to the overall effort.? In its
    view, there is no need to change or expand that role at this time. Moreover,
    the Department stated that our recommendation was premature in light of the
    Vice President?s pending review. We agree that the National Coordinator at
    the NSC has made some important contributions. However, this position?s
    responsibilities are not clearly defined and it lacks responsibilities for
    some overall leadership and Agency Comments

    and Our Evaluation

    Chapter 2: Overall Leadership and Coordination Responsibilities Need to Be
    Centralized and Clarified

    Page 43 GAO- 01- 822 Combating Terrorism

    coordination functions that it should have. With respect to the Vice
    President?s pending review, our recommendation states that the President
    should make the appointment working with the Congress and in conjunction
    with the Vice President?s efforts.

    The Executive Office of the President did not comment on this
    recommendation. OMB referred us to the President?s May 8, 2001, statement
    (see app. VII) in which he tasked the Vice President with overseeing the
    development of a coordinated national effort to improve national
    preparedness. Most agencies did not comment directly on our recommendation
    that the President create a single focal point. Officials from these other
    agencies indicated that it would be premature for them to comment on the
    recommendation in deference to the Vice President?s review of national
    preparedness. We disagree that our recommendation for a single focal point
    is premature. Notwithstanding the Vice President?s pending review, our
    recommendation is based upon our own reviews over a 5- year period. Our
    reviews consistently showed problems related to overall leadership and
    coordination, as discussed in this report.

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 44 GAO- 01- 822 Combating Terrorism

    The federal government has made progress in recent years in developing a
    national strategy to combat terrorism, but several key components still are
    not complete or are missing. In the past, we have recommended that the
    federal government conduct a terrorist threat and risk assessment to
    establish requirements and prioritize program investments. The Department of
    Justice and the FBI have made some progress in implementing our
    recommendations. The Attorney General?s Five- Year Plan represents a
    substantial interagency effort and is the one document that could serve as
    the basis for a national strategy. However, it lacks two critical elements:
    measurable outcomes and identification of state and local government roles.
    In the past, the amount of funds being spent to combat terrorism was unknown
    and difficult to determine. Now, OMB is tracking counterterrorism budgets
    and expenditures and issuing annual reports to the Congress- a significant
    step toward improving the management and coordination of these programs and
    activities. Nonetheless, the NSC and OMB have not identified priorities or
    reported on duplication of efforts. Finally, consistent with our prior
    recommendations, agencies now have completed interagency guidance to combat
    domestic terrorism, clarified command and control issues, and completed or
    are developing internal guidance and concepts of operations to manage
    terrorist incidents.

    An important step in developing sound programs to combat terrorism is to
    develop a thorough assessment of the terrorist threat. Intelligence and law
    enforcement agencies continuously assess the foreign and domestic terrorist
    threats to the United States. To be considered a threat, a terrorist group
    must not only exist, but also have the intention and capability to launch
    attacks. 1

    The intelligence community (both foreign and domestic agencies) reports an
    increased possibility that terrorists may use weapons of mass destruction in
    the next decade. However, there are several qualifications to this threat.
    For example, terrorists would have to overcome significant technical and
    operational challenges to successfully make and release chemical or
    biological agents of sufficient quality and quantity to kill or injure large
    numbers of people without substantial assistance from a foreign government
    sponsor. In most cases, specialized knowledge is

    1 Other factors to consider in analyzing threats include a terrorist group?s
    history, its targeting, and the security environment in which it operates.
    Chapter 3: Progress Made in Developing a

    National Strategy to Combat Domestic Terrorism

    Threat Assessments Are Being Completed

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 45 GAO- 01- 822 Combating Terrorism

    required in the manufacturing process and in improvising an effective
    delivery device for most chemical and nearly all biological agents that
    could be used in terrorist attacks. Moreover, some of the required
    components of chemical agents and highly infective strains of biological
    agents are difficult to obtain. Finally, terrorists may have to overcome
    other obstacles to successfully launch an attack that would result in mass
    casualties, such as unfavorable meteorological conditions and personal
    safety risks. These types of qualifications are important because, without
    them, decisionmakers in both the executive or legislative branch may get an
    exaggerated view of the terrorist threat, particularly as it relates to WMD
    materials.

    In prior reports, we have recommended that the federal government conduct
    multidisciplinary and analytically sound threat and risk assessments to
    define and prioritize requirements and properly focus programs and
    investments in combating terrorism. 2 Threat and risk assessments are
    decision- making support tools that are used to establish requirements and
    prioritize program investments. Without the benefits that a threat and risk
    assessment provides, many agencies have been relying on worst case chemical,
    biological, radiological, or nuclear scenarios to generate countermeasures
    or establish their programs. By using these worst case scenarios, the
    federal government is focusing on vulnerabilities (which are unlimited)
    rather than credible threats (which are limited).

    The Department of Justice and the FBI have made some progress in
    implementing our recommendations that threat and risk assessments be done at
    both the local and national level.

    Regarding local threat and risk assessments, the Department of Justice?s
    Office for State and Local Domestic Preparedness Support and the FBI have
    worked together to provide a threat and risk assessment tool to state and
    local governments. 3 This tool includes a step- by- step methodology for

    2 Combating Terrorism: Threat and Risk Assessments Can Help Prioritize and
    Target Program Investments (GAO/ NSIAD- 98- 74, Apr. 9, 1998) and Combating
    Terrorism: Need for Comprehensive Threat and Risk Assessments of Chemical
    and Biological Attack

    (GAO/ NSIAD- 99- 163, Sept. 7, 1999). 3 Fiscal Year 1999 State Domestic
    Preparedness Equipment Program, Assessment and Strategy Development Tool
    Kit, May 15, 2000. This document was published by the Department of
    Justice?s Office for State and Local Domestic Preparedness Support. Progress
    Made in

    Completing State and Local Assessments

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 46 GAO- 01- 822 Combating Terrorism

    assessing threats, risks, and requirements. It also includes information on
    how to prioritize programs and project spending amounts. Department of
    Justice officials told us that, as of August 31, 2001, four states had
    completed these assessments. The information from the risk and needs
    assessment will be used to develop statewide domestic preparedness strategic
    plans. The statewide assessment process includes an initial risk assessment
    and identification of the most likely scenarios. This risk assessment is the
    culmination of three other assessments: threat, vulnerability, and public
    health assessments. This design feature enables the preparedness programs to
    focus resources on preparing for the ?most

    likely? scenarios. The Department plans to use the results of these
    assessments to drive the allocation of its equipment, training, and exercise
    program resources, which is consistent with previous GAO recommendations.
    Department of Justice officials stated that the systematic collection of
    these data is an unprecedented undertaking to remedy the federal
    government?s current reliance on anecdotal information. They view the state
    assessments as being profoundly useful in presenting a national picture of
    preparedness and priorities. Thus, these officials believe that the
    compilation of all the state assessments and plans can be a foundation for a
    national domestic preparedness strategy.

    Regarding our 1999 recommendations for national- level authoritative threat
    and risk assessments, the FBI agreed to lead two assessments. However, the
    FBI noted some limitations to its methodology for producing such assessments
    in the domestic context. For example, the FBI stated that its law
    enforcement role placed limitations on its collection and use of
    intelligence data. FBI officials also said that they had little intelligence
    on specific domestic terrorist groups. They said the largest domestic threat
    is the ?lone wolf? terrorist- an individual who operates alone and thus is
    difficult to identify or collect intelligence on. When the FBI has credible
    intelligence on a specific terrorist, it would make an arrest first and
    analyze the intelligence afterwards. FBI officials also noted that these
    would be threat assessments- not risk assessments.

    The first threat assessment that the FBI is doing is a report on those
    chemical and biological agents that may be more likely to be used in the
    United States by a terrorist group that was not state sponsored (e. g.,
    terrorist groups without access to foreign government chemical or biological
    stockpiles, production capabilities, or funding). Because of the limitations
    on intelligence discussed above, the FBI decided to focus on such WMD
    agents. While not identifying specific terrorist groups, this assessment
    would still be useful in determining requirements for programs National-
    Level Threat

    Assessments Are Underway

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 47 GAO- 01- 822 Combating Terrorism

    to combat terrorism. Once FBI officials became aware of a similar assessment
    being conducted jointly by the Department of Justice?s National Institute of
    Justice and the Technical Support Working Group (TSWG), the FBI became a co-
    sponsor. 4 This report will be provided to state and local governments to
    help them conduct their own threat and risk assessments and reduce their
    vulnerabilities. The Department of Justice anticipated that a draft of the
    assessment would be available for interagency review and comment in
    September 2001 and the final assessment would be published in December 2001.

    The second threat assessment is a national- level threat assessment of the
    terrorist threat in the United States. According to the Department of
    Justice, the FBI is in the process of conducting such an assessment. It will
    be a comprehensive assessment that encompasses domestic terrorism,
    international terrorism, WMD terrorism, cyber- terrorism, and proliferation.
    The report will assess the current threat, the projected threat, emerging
    threats, and related FBI initiatives. The Department stated that this
    assessment is being finalized and anticipated that the classified report
    would be published in October 2001.

    While not fully responsive to our recommendation that threat and risk

    assessments be done, we are hopeful that these threat assessments by the
    FBI, once completed, will set priorities and help guide federal programs to
    combat terrorism. In our draft report, we raised concerns that the FBI was
    not going to coordinate these threat assessments with other intelligence
    agencies. The Department of Justice indicated that these assessments will be
    fully coordinated before publication.

    4 TSWG conducts the national interagency research and development program
    for combating terrorism. TSWG and its coordination role are discussed in
    more detail in chapter 4.

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 48 GAO- 01- 822 Combating Terrorism

    As we have noted in our prior work, a national strategy on combating
    terrorism is needed that has a clear outcome or goal against which
    performance can be measured. 5 The Attorney General?s Five- Year Interagency
    Counterterrorism and Technology Crime Plan, issued in December 1998,
    represents a substantial interagency effort and is the one document that
    could serve as a basis for a national strategy. However, we believe it lacks
    two critical elements: (1) measurable outcomes and (2) identification of
    state and local government roles in responding to a terrorist incident.

    A national strategy should provide a clear statement as to what the nation
    hopes to achieve through its programs to combat terrorism. A national
    strategy should not only define the roles and missions of federal, state,
    and local governments, but also establish objectives, priorities,
    outcomerelated goals with milestones, and performance measures. A national
    strategy should incorporate the principles of the Government Performance and
    Results Act of 1993, which requires federal agencies to set strategic goals,
    measure performance, and report on the degree to which goals are met. 6
    Further, the Department of State emphasized that a national strategy also
    has to be comprehensive, that is, it must include the international
    component.

    The Congress directed the Attorney General to develop the Five- Year Plan to
    serve as a baseline strategy for coordination of national policy and
    operational capabilities to combat terrorism in the United States and
    against American interests overseas. 7 Department of Justice officials
    believe that this plan, in combination with several related presidential
    decision directives, represents a comprehensive national strategy. The
    classified plan identifies several high- level goals aimed at preventing and
    deterring terrorism, maximizing international cooperation to combat
    terrorism, improving domestic crisis and consequence planning and
    management, improving state and local capabilities, safeguarding

    5 See Combating Terrorism: Linking Threats to Strategies and Resources (GAO/
    TNSIAD- 00- 218, July 26, 2000), p. 7. 6 P. L. 103- 62 (Aug. 3, 1993).

    7 See the Conference Committee Report (House Report 105- 405, Nov. 13, 1997)
    accompanying the Fiscal Year 1998 Appropriations Act for the Departments of
    Commerce, Justice, and State, the Judiciary, and Related Agencies (P. L.
    105- 119, Nov. 26, 1997). Attorney General?s

    Five- Year Plan Represents a Substantial Effort, but Key Elements Still Are
    Lacking for a National Strategy

    Five- Year Plan Serves as a Baseline for a National Strategy to Combat
    Terrorism

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 49 GAO- 01- 822 Combating Terrorism

    information infrastructure, and leading research and development efforts to
    enhance counterterrorism capabilities. It sets forth current and projected
    efforts by the Attorney General in partnership with other federal agencies
    and state and local entities to improve readiness to address the terrorist
    threat.

    In September 1999, the Attorney General released an unclassified edition of
    the Five- Year Plan, which was distributed to state and local governments.
    In addition, the Attorney General issues an annual update to the Five- Year
    Plan, which tracks agencies? progress. The annual updates do not revise the
    basic Five- Year Plan.

    A national strategy on combating terrorism needs a clear outcome or goal
    against which performance can be measured. Although the Attorney General?s
    Five- Year Plan links performance to objectives, it focuses on agency
    activities representing outputs rather than results- oriented outcomes.

    In 1993, the Congress enacted the Government Performance and Results Act
    (commonly referred to as the Results Act). The legislation was designed to
    have agencies focus on the performance and results of their programs rather
    than on program resources and activities, as they had done in the past.
    Thus, the Results Act became the primary legislative framework through which
    agencies are required to set strategic goals, measure performance, and
    report on the degree to which goals are met. The outcome- oriented
    principles of the Results Act include (1) establishing general goals and
    quantifiable, measurable, outcomeoriented performance goals and related
    measures; (2) developing strategies for achieving the goals, including
    strategies for overcoming or mitigating major impediments; (3) ensuring that
    goals at lower organizational levels align with and support general goals;
    and (4) identifying the resources that will be required to achieve the
    goals. Moreover, in its guidance on implementing the Results Act, the Chief
    Financial Officers Council advised agencies that to comply with the spirit
    and intent of the act, the goals and measures used at lower organizational
    levels should be linked with the agency?s strategic goals.

    According to the Department of Justice, the Fiscal Year 1999 Update to the
    Five- Year Plan reports outcomes that can be used to gauge progress. For
    example, the FBI, FEMA, and the U. S. Secret Service are working together to
    coordinate the planning of special events (see a more detailed discussion of
    this cooperation in ch. 4). The FBI determined that bomb Five- Year Plan
    Focuses on

    Outputs, Not Outcomes

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 50 GAO- 01- 822 Combating Terrorism

    squads need radiological monitors and personal protective equipment and it
    is providing that equipment to every accredited bomb squad in the United
    States. OSTP established an annual process to develop and coordinate broad
    national technical goals and priorities to combat terrorism. The Fiscal Year
    2000 Update to the Five- Year Plan also cited completed measurable outcomes.
    For example, the Department of Justice drafted proposed Sentencing
    Guidelines for the Biological Weapons AntiTerrorism Act of 1989. 8 HHS
    designed and developed a national pharmaceutical stockpile and delivery
    system. The Department of Justice began detailing Assistant U. S. Attorneys
    to the Criminal Division to develop prosecutive expertise in computer crime
    investigations.

    While the Department of Justice considers these outcomes, we consider them
    outputs, since they represent agency activities rather than the results that
    agency activities would achieve. While these Department of Justice examples
    of measurable outputs are important, the plan does not have a defined
    outcome of where the nation should be in terms of domestic preparedness and
    capabilities within a specified period of time. Such an outcome would be
    useful in establishing requirements and priorities. While the plan lays out
    goals for preparedness, it does not attempt to (1) define the level( s) of
    preparedness necessary to handle a weapon of mass destruction incident, (2)
    determine how much preparedness is enough given the terrorist threat, or (3)
    identify what level of risk is desirable- or attainable.

    If the Department of Justice applied the Results Act principles to the
    FiveYear Plan- and ultimately to a national strategy to combat terrorism-
    then we believe all performance indicators could be measured and a defined
    outcome of where the nation should be in terms of domestic preparedness and
    capabilities within a certain time frame could help establish
    counterterrorism program requirements and priorities. The result would be a
    more rational and efficient counterterrorism effort governmentwide.

    Although the Department of Justice obtained state and local input in
    preparing the Five- Year Plan and identifies specific ways to enhance state
    and local responder capabilities, the plan does not identify state and local
    government roles in responding to a terrorist incident. According to the

    8 P. L. 101- 298 (May 22, 1990). Five- Year Plan Does Not

    Identify Roles for State and Local Governments

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 51 GAO- 01- 822 Combating Terrorism

    Department of Justice, state and local input was obtained through (1) a
    Stakeholders Forum held in 1998 for state and local jurisdictions concerning
    response incidents of domestic terrorism, (2) a questionnaire distributed by
    national associations representing the state and local emergency
    preparedness community to a cross- section of their constituencies, (3) the
    Inventory of State and Local Law Enforcement Technology Needs to Combat
    Terrorism, (4) a 1998 study funded by the National Institute of Justice, and
    (5) the State and Local Experts Forum convened by the Attorney General in
    1999 for 25 leading state and local law enforcement, fire, medical/ public
    health, and emergency management professionals. One of the six goals in the
    Five- Year Plan (Safeguard Public Safety by Improving State and Local
    Capabilities) focuses exclusively on state and local concerns.

    However, state and local first responder organizations those entities that
    represent state and local officials who would respond first to the scene of
    an incident continue to criticize the plan. For example, according to the
    International Association of Fire Chiefs, the current national preparedness
    effort, though useful, has overlooked goal setting. The lack of clearly
    defined preparedness goals should be addressed through the development of
    performance capability objectives that, once met through the rational
    deployment of local, state, and federal assets, define the end- game, or
    goal: adequate preparedness. The Association also noted that until a
    national strategy is put in place, it would be exceedingly difficult to
    quantify the level of preparedness reached by the collective national
    response mechanism. Several other organizations have taken the same or
    similar positions. 9

    Although combating terrorism is primarily a federal responsibility, state
    and local emergency responders (police, fire, and emergency medical
    personnel) are almost certain to be the first to respond to the use of a
    weapon of mass destruction. We believe the Five- Year Plan should
    specifically address the role of state and local emergency responders, since
    their initial actions in handling a conventional explosive or incendiary
    device, or an unconventional weapon containing WMD matter will be critical
    to the success of the overall response and, thus, to public health and
    safety. To the extent the plan can better address the roles of

    9 These include, for example, the National Governors Association, the
    National Emergency Management Association, and the National League of
    Cities.

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 52 GAO- 01- 822 Combating Terrorism

    state and local authorities, and be developed with them, it can become more
    of a national strategy than a federal plan.

    Efforts to develop a national strategy also may be hindered by other
    agencies developing competing national strategies. It also demonstrates that
    the President and the Congress sometimes have provided different messages on
    overall leadership and coordination. Notwithstanding the creation of the
    position of National Coordinator, the Congress directed the Attorney General
    to develop a national strategy. 10 In addition to the resultant Attorney
    General?s Five- Year Interagency Counterterrorism and Technology Crime Plan,
    both the NSC and the National Domestic Preparedness Office (NDPO) (discussed
    in ch. 5) also have planned to develop national strategies. More recently,
    FEMA?s new Office of National Preparedness (also discussed in ch. 5) will
    develop a national strategy. This potential proliferation of ?national?
    strategies written by different entities clearly demonstrates the current
    fragmentation of overall leadership and coordination.

    The NSC and OMB both have roles in overseeing governmentwide programs to
    combat terrorism. The NSC has the responsibility to coordinate policies and
    operations and OMB has the responsibility to track funding for terrorism-
    related programs. At the time of our initial report, we found that the
    amount of funds being spent to combat terrorism was unknown and difficult to
    determine. 11 Despite their oversight roles, the NSC and OMB were not
    regularly collecting, aggregating, and reviewing funding and spending data
    relative to combating terrorism on a crosscutting, governmentwide basis.
    Further, funding priorities for terrorism- related programs were not
    established. As a result, there was no assurance that (1) agencies? requests
    were funded through a coordinated and focused approach, (2) the highest
    priority requirements were being met, (3) terrorism- related activities and
    capabilities were not unnecessarily duplicative, and (4) funding gaps or
    misallocation had not

    10 This plan was directed in the Conference Committee Report (House Report
    105- 405, Nov. 13, 1997) accompanying the Fiscal Year 1998 Appropriations
    Act for the Departments of Commerce, Justice, and State, the Judiciary, and
    Related Agencies (P. L. 105- 119, Nov. 26, 1997).

    11 Combating Terrorism: Spending on Governmentwide Programs Requires Better
    Management and Coordination (GAO/ NSIAD- 98- 39, Dec. 1, 1997). Other
    Agencies May

    Produce Competing Strategies

    Progress Made in Tracking Spending to Combat Terrorism

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 53 GAO- 01- 822 Combating Terrorism

    occurred. Based upon our findings, the Congress required OMB to establish a
    reporting system on the budgeting and expenditure of funds to combat
    terrorism. 12 Further, the Congress mandated an annual report containing
    agency budget and expenditure information that would identify any priorities
    and any duplication of efforts to combat terrorism.

    Subsequent to this requirement being established, OMB has tracked budgets
    and expenditures for programs to combat terrorism and has issued four annual
    reports to the Congress. These OMB reports are a significant step toward
    improving the management and coordination of these programs and activities.
    The reports capture governmentwide information in a uniform fashion,
    highlight budget initiatives, and provide increasingly detailed information
    about individual agencies? spending. The last two reports have an annex with
    several years of budget data on programs to combat terrorism and critical
    infrastructure protection presented by agency, category, and categories
    within agencies. 13 The most recent report also has a detailed discussion of
    the different agencies? roles, missions, and activities. Through these
    reports, the executive branch and the Congress have strategic oversight of
    the magnitude and direction of federal funding for this priority national
    security and law enforcement concern.

    In 1999, the NSC and OMB began a new process to identify priorities and
    duplication- as required by law. Interagency working groups reviewed the
    agencies? proposals and developed recommendations on whether they should be
    funded. The agencies integrated the working groups? funding recommendations
    into their fiscal year 2001 President?s Budget submissions. According to
    OMB, the NSC and OMB then reviewed agencies? actions on the recommendations
    and made necessary course corrections during the final decision- making by
    the President, based on information from the working groups, other agency
    priorities, and available resources. The new process may represent progress
    because, before it was implemented, agencies would make budget
    recommendations related to terrorism through the annual OMB budget
    submission. At that time, decisions were made on an agency- by- agency basis
    rather than in a governmentwide context. OMB has stated that this
    interagency budget review resulted in reallocation of resources- within and
    between agencies- to fund critical shortfalls and to eliminate

    12 Section 1051 of the National Defense Authorization Act for Fiscal Year
    1998 (P. L. 105- 85). 13 See OMB?s Annual Report to Congress on Combating
    Terrorism, July 2001.

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 54 GAO- 01- 822 Combating Terrorism

    duplication. However, to date, OMB?s annual reports have not identified
    priorities or reported on duplication of efforts.

    Although OMB notes that the Attorney General?s Five- Year Plan sets
    priorities, the plan does not link recommended actions to budget resources-
    a key step in developing a national strategy. While the original plan
    indicated that the annual updates would address this matter, they also have
    not linked actions with required resources. In the absence of a national
    strategy with measurable outcomes (as discussed earlier in this chapter), we
    are concerned that this new process could be used to justify higher budgets
    for all programs to combat terrorism rather than to establish governmentwide
    requirements and prioritize programs to focus resources.

    Federal agencies have completed interagency guidance to combat terrorism
    domestically and clarified many command and control issues. Completed
    interagency guidance should positively impact federal response operations
    leading to a more organized, unified, and coordinated national terrorism
    response capability. This is significant progress since 1999 when we
    reported that federal agencies had neither completed interagency guidance as
    directed by PDD 39 nor coordinated all proposed guidance with all federal
    agencies with domestic counterterrorism roles. 14 As a result, federal
    response operations potentially were not as wellcoordinated and highly
    integrated as intended, sometimes resulting in conflict or confusion over
    roles and responsibilities as well as the transfer of tactical authority.
    Table 4 summarizes recently completed interagency plans and guidance. 15

    14 Combating Terrorism: Issues to Be Resolved to Improve Counterterrorism
    Operations

    (GAO/ NSIAD- 99- 135, May 13, 1999). 15 A more complete listing of
    interagency plans and guidance for combating terrorism appears in app. I.
    Agencies Complete

    Interagency Operational Guidance, Enhancing Unified and Coordinated Response
    Capability

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 55 GAO- 01- 822 Combating Terrorism

    Table 4: Interagency Plans and Guidance for Combating Terrorism Interagency
    plan or guidance Description

    Attorney General?s Five- Year Interagency Counterterrorism and Technology
    Crime Plan Drafted by the Department of Justice in conjunction with other
    agencies, this plan

    and its annual updates serve as a baseline strategy for the coordination of
    national policy and operational capabilities to combat domestic terrorism.
    The classified plan was issued in December 1998. Federal Response Plan and
    Terrorism Incident Annex Drafted by FEMA and coordinated with 26 other
    federal departments and agencies

    and the American Red Cross, the plan outlines the way the federal government
    responds to domestic incidents in which the President has declared an
    emergency requiring federal emergency disaster assistance. The plan was
    issued in April 1992 and revised in April 1999. The Terrorism Incident
    Annex, issued in February 1997, provides a concept of operations outlining
    how the federal government would assist state and local authorities in
    managing the consequences of a terrorist attack in the United States.
    CONPLAN (United States Government Interagency Domestic Terrorism Concept of
    Operations Plan)

    Drafted by the FBI and coordinated with FEMA, DOD, DOE, HHS, and EPA, the
    CONPLAN was issued in January 2001. It provides overall guidance to federal,
    state, and local agencies concerning how the federal government would
    respond to a potential or actual terrorist threat or incident in the United
    States, particularly one involving weapons of mass destruction. It is
    intended to integrate the plans and procedures of individual agencies and
    departments with responsibilities to respond to a WMD incident and to
    establish a conceptual framework for integrating federal crisis and
    consequence WMD response. Domestic Guidelines (Guidelines for the
    Mobilization, Deployment, and Employment of U. S. Government Agencies in
    Response to a Domestic Terrorist Threat or Incidents in Accordance with
    Presidential Decision Directive 39)

    Drafted by the FBI, the classified document provides guidance for deploying
    federal capabilities in response to a terrorist threat or incident. The
    Domestic Guidelines were issued in November 2000.

    International Guidelines (Coordinating Subgroup Guidelines for the
    Mobilization, Deployment, and Employment of U. S. Government Elements in
    Response to an Overseas Terrorist Incident)

    Drafted by the Department of State, the classified International Guidelines
    outline procedures for deploying the Foreign Emergency Support Team and for
    coordinating federal operations overseas. The International Guidelines were
    issued in January 2001.

    Source: GAO analysis.

    Federal agencies also are updating and revising interagency guidance to meet
    responders? needs and new developments. For example, FEMA is clarifying the
    Federal Response Plan to include an explanation of its relationship to other
    federal emergency plans, such as the Federal Emergency Response Plan,
    National Oil and Hazardous Substances Pollution Contingency Plan (National
    Contingency Plan), and Federal Radiological Emergency Response Plan. A
    change to the Federal Response Plan will be issued to expand and clarify
    individual agency roles and responsibilities as well as funding
    arrangements. Also, HHS is developing an annex to the Federal Response Plan
    for biological terrorism. (See app. I for a compendium of related federal
    policy and planning documents.)

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 56 GAO- 01- 822 Combating Terrorism

    Agencies have completed or are developing internal guidance and concepts of
    operations to deal with terrorist incidents, including those involving a
    weapon of mass destruction. For example, DOD developed a detailed
    contingency plan to guide its actions in deploying and responding to a
    terrorist incident (including domestic incidents) and HHS developed a
    concept of operations plan to deal with the health and medical consequences
    of terrorist attacks and augment and support state and local governments.
    HHS is completing additional plans that coordinate efforts among state
    health departments and agencies and the federal government, and has
    developed medical and health responses for smallpox. The Centers for Disease
    Control and Prevention and the Office of Emergency Preparedness developed
    plans that support HHS? strategic objectives and goals for preventing
    bioterrorism, conducting epidemiological surveillance, providing medical and
    public health readiness for mass casualty events, ensuring a national
    pharmaceutical stockpile, and securing information technology
    infrastructures.

    Another example of the progress made is FEMA?s completion of the final draft
    of a terrorism supplement (Attachment G) to the State and Local Guide 101
    for All- Hazard Emergency Operations Plan. FEMA issued the attachment in
    April 2001. The attachment will aid state and local emergency planners in
    developing and maintaining a Terrorist Incident Appendix to their Emergency
    Operations Plans for terrorist incidents involving weapons of mass
    destruction.

    Appendix II describes individual agency plans and guidance for combating
    terrorism.

    The federal government has made progress in recent years in developing a
    national strategy to combat terrorism, but several key components still are
    incomplete or are missing. Although the Department of Justice and the FBI
    agreed to implement our 1999 recommendations to conduct multidisciplinary
    and analytically sound threat and risk assessments, these still are not
    complete more than 2 years after the FBI agreed to do them. The Attorney
    General should ensure that national- level threat assessments regarding
    terrorist use of weapons of mass destruction are completed expeditiously.

    While the Attorney General?s Five- Year Plan is a substantial interagency
    effort and could serve as the basis for a national strategy, we believe it
    lacks two critical elements: measurable outcomes and identification of state
    and local government roles. By including measurable outcomes, the Individual
    Agencies

    Complete or Develop Plans and Guidance

    Conclusions

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 57 GAO- 01- 822 Combating Terrorism

    Five- Year Plan would incorporate the principal tenets of the Government
    Performance and Results Act of 1993, which holds federal agencies
    accountable for achieving program results and requires them to clarify their
    missions, set program goals, and measure performance toward achieving these
    goals.

    To help support a national strategy, we recommend that the Attorney General
    direct the Director of the FBI to work with appropriate agencies across
    government to complete ongoing national- level threat assessments regarding
    terrorist use of weapons of mass destruction. If a single focal point is
    established in the Executive Office of the President to lead and coordinate
    federal programs to combat terrorism, then this focal point should maintain
    oversight to ensure the assessments are coordinated fully with key federal
    agencies that combat terrorism (see Recommendations for Executive Action in
    ch. 2).

    To guide federal efforts in combating domestic terrorism, we recommend that
    the Attorney General use the Five- Year Interagency Counterterrorism and
    Technology Crime Plan and similar plans of other agencies as a basis for
    developing a national strategy by including (1) desired outcomes that can be
    measured and that are consistent with the Results Act and (2) state and
    local government input to better define their roles in combating terrorism.
    If a single focal point is established in the Executive Office of the
    President to lead and coordinate federal programs to combat terrorism, then
    the focal point should take over this role from the Department of Justice to
    ensure that the national strategy is seen as an interagency document (see
    Recommendations for Executive Action in ch. 2).

    Agency comments on a draft of this report were based on their efforts prior
    to the September 11, 2001, terrorist attacks. The Department of Energy
    agreed with our recommendation to complete a national- level threat
    assessment. DOE said that the first step toward developing a national
    strategy is to conduct a thorough threat and risk assessment to define and
    prioritize requirements. The Department of Justice did not comment on our
    recommendation that the Attorney General direct the Director of the FBI to
    complete a national- level threat assessment regarding terrorist use of
    weapons of mass destruction. However, Department of Justice officials
    provided us with an update on their progress and we revised the report, as
    appropriate. While the Department of Justice and the FBI appear to be
    working to produce threat Recommendations for

    Executive Action Agency Comments and Our Evaluation

    Chapter 3: Progress Made in Developing a National Strategy to Combat
    Domestic Terrorism

    Page 58 GAO- 01- 822 Combating Terrorism

    assessments, we believe our recommendation still is valid until such
    assessments are complete.

    The Department of Justice disagreed with our recommendation that the
    Attorney General?s Five- Year Plan be revised to include measurable
    outcomes. According to the Department, each agency must have the flexibility
    to link the goals and objectives of the Five- Year Plan to its own strategic
    goals and measures. We disagree with the Department of Justice and still
    believe that the Five- Year Plan focuses more on agency outputs than
    outcomes that are results oriented. We believe that having overall results-
    oriented outcomes would not limit the flexibility of individual agency
    strategic goals and measures. We believe it would improve the strategic
    planning process across agencies.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 59 GAO- 01- 822 Combating Terrorism

    Federal capabilities to respond to terrorist incidents are improving.
    Federal agencies have a broad array of capabilities to respond to terrorist
    incidents. The FBI and FEMA could lead a variety of potential federal teams
    and related assets for crisis and consequence management. These federal
    capabilities are enhanced through agency participation in special events,
    such as political conventions, sporting events, and international meetings.
    Since our last review, the FBI and the U. S. Secret Service have improved
    their cooperation for such events. Federal agencies also exercise their
    capabilities to respond to a terrorist incident through exercises. The FBI
    has made progress in exercising its interagency and intergovernmental
    leadership role in crisis management. FEMA is not using exercises to
    practice fully its leadership role over consequence management. Evaluations
    from such exercises, as well as from actual operations, allow agencies to
    learn lessons from their successes and mistakes. Based upon our earlier
    work, we found that some individual federal agencies have improved their
    processes to capture and share lessons learned. However, as yet, there is no
    regular process in place to capture and share lessons learned at the
    interagency level. Federal capabilities also are enhanced through research
    and development projects. While federal research and development programs
    are coordinated in a variety of ways, coordination is limited, raising the
    potential for duplication of efforts among different federal agencies.

    The FBI leads a variety of potential federal teams for crisis management. In
    exceptionally grave situations, DOD could play an important role in crisis
    management. FEMA also leads a variety of potential federal teams for
    consequence management. We found that these consequence management teams
    generally do not duplicate each other due to their unique capabilities and
    other mission requirements. Other federal assets, such as mobile
    laboratories to perform an initial on- site analysis of a weapon of mass
    destruction, would potentially support crisis and consequence management.

    The Department of Justice, acting through the FBI, is the overall lead
    federal agency for domestic terrorist incidents and the FBI is the lead
    agency for crisis response to domestic incidents. Crisis response assets
    within the FBI include the Critical Incident Response Group, which
    integrates the tactical and investigative expertise necessary to deal with
    terrorist incidents. The group includes crisis managers, hostage
    negotiators, behaviorists, and surveillance assets. The group also contains
    the Hostage Rescue Team, which can operate in a chemical and biological
    Chapter 4: Federal Response Capabilities Are

    Improving The Federal Government Has a Broad Array of Response Capabilities

    FBI Leads Federal Crisis Management Response Teams

    Chapter 4: Federal Response Capabilities Are Improving

    Page 60 GAO- 01- 822 Combating Terrorism

    environment, and is trained in hostage rescue, precision shooting, advanced
    medical support, and tactical site survey. Furthermore, all but one of the
    FBI?s 56 field offices include a Special Weapons and Tactics (SWAT) team
    trained to plan and execute high- risk tactical operations. Numerous other
    federal agencies may be called upon for support as needed. The FBI uses the
    United States Interagency Domestic Terrorism Concept of Operations Plan
    (CONPLAN) (discussed in ch. 3) to manage its operations with interagency and
    intergovernmental partners. Figure 3 illustrates key federal crisis
    management teams.

    Figure 3: Key Federal Crisis Management Response Teams

    Note: The U. S. Army Technical Escort Unit has a dual role and may serve as
    a consequence management response team as well. It is marked with an
    asterisk.

    Source: GAO analysis.

    Appendix III provides more detailed information on the mission and personnel
    strength for the crisis management response teams shown in figure 3 above.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 61 GAO- 01- 822 Combating Terrorism

    Figure 4 shows an FBI enhanced SWAT team executing a law enforcement search
    of a building during the Wasatch Rings counterterrorism exercise in
    preparation for the 2002 Olympic Winter Games in Salt Lake City, Utah.

    Figure 4: FBI Enhanced SWAT Team Executes Search During Wasatch Rings
    Exercise

    Source: Oak Ridge Institute for Science and Education.

    If an exceptionally serious terrorist threat or incident is beyond the FBI?s
    capabilities to resolve, a military joint special operations task force may
    be established to respond in accordance with contingency plans developed by
    DOD. As a general principle, the Posse Comitatus Act and DOD regulations
    prohibit the Armed Forces of the United States from being used to enforce
    domestic law. 1 However, the Posse Comitatus Act is

    1 See 18 U. S. C. section 1385. In Extreme Situations,

    Military Could Have Crisis Management Role

    Chapter 4: Federal Response Capabilities Are Improving

    Page 62 GAO- 01- 822 Combating Terrorism

    subject to exceptions that permit the use of the Armed Forces in dealing
    with domestic terrorist incidents in special situations. According to
    Department of Justice officials, these statutory exceptions would require a
    request from the Attorney General and concurrence by the Secretary of
    Defense. Department of Justice officials added that, in most cases, as a
    matter of policy, approval by the President will also be sought whenever
    possible. Further, Department of Justice officials state that if military
    forces are required to restore order as a result of an act of domestic
    terrorism that renders ordinary means of enforcement unworkable or hinders
    the ability of civilian law enforcement authorities, the President must
    issue an executive order and a proclamation. These documents are maintained
    in draft form and are ready for the President?s signature, if needed.

    If military force is required and approved, the on- scene FBI commander
    passes operational control of the incident site to the military commander.
    The military commander develops and submits courses of action to the
    National Command Authority. If the incident cannot be resolved peacefully,
    then the National Command Authority may order a military operation,
    including disabling a weapon of mass destruction. Once this is accomplished,
    the military commander returns operational control of the site to the FBI.
    To date, military action has never been required to resolve a domestic
    terrorist incident. Further, FBI officials stated that the FBI?s own
    tactical skills to resolve a terrorist incident generally are equal to the
    military?s, although technical assistance would be required in certain WMD
    incidents.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 63 GAO- 01- 822 Combating Terrorism

    Although state and local governments have primary responsibility for
    managing the consequences of a domestic terrorist incident, their response
    capabilities may quickly become overwhelmed. Should state and local
    authorities request assistance, FEMA would coordinate federal agencies?
    responses and activities. The federal government can provide considerable
    assets to assist state and local authorities. For example, 8 federal
    agencies have 24 types of teams that could respond to terrorist use of
    weapons of mass destruction. FEMA uses the Federal Response Plan (discussed
    in ch. 3) to task and manage other federal agencies. Figure 5 illustrates
    key federal consequence management teams.

    Figure 5: Key Federal Consequence Management Response Teams

    Note: The U. S. Army Technical Escort Unit has a dual role and may serve as
    a crisis management response team as well. It is marked with an asterisk.

    Source: GAO analysis.

    FEMA Leads Federal Consequence Management Response Teams

    Chapter 4: Federal Response Capabilities Are Improving

    Page 64 GAO- 01- 822 Combating Terrorism

    In commenting on a draft of this report, the Department of State noted
    consequence management assets are finite and the same assets that would be
    used to respond to a domestic terrorist incident also would be used to
    respond to an overseas terrorist incident.

    Appendix IV provides more detailed information on the mission and personnel
    strength for the consequence management response teams shown in figure 5.

    While there are numerous federal teams, we found that the response teams do
    not duplicate one another for a number of reasons. In general, each team has
    a unique combination of capabilities and functions when deployed to or near
    the site of a terrorist incident. No single team or agency has all the
    capabilities and functions that might be required to respond to a terrorist
    incident. Some federal response teams have capabilities and functions that
    are clearly unique, such as the ability of HHS? Disaster Mortuary
    Operational Response Teams to process, prepare, and dispose of contaminated
    fatalities. Several federal teams would be more likely to respond to certain
    types of incidents because they have expertise concerning the type of agent
    used in the attack. For example, DOE teams specialize in responding to
    incidents involving radiological agents or weapons. Other teams have similar
    capabilities and functions, but there are also distinctions among these
    teams that differentiate them. One distinction is that they perform a wide
    variety of functions. In general, these functions fall into one of three
    categories: performing hands- on response functions; providing technical
    advice to federal, state, and local authorities; or coordinating the
    response efforts and activities of other federal teams. Because of the
    differences in the capabilities and expertise of teams, the type of incident
    would determine which individual teams would be most appropriate to deploy.
    2

    Even in the absence of a terrorist threat, federal agencies still would need
    most of their response teams to carry out other missions. Most federal teams
    are long- standing and have purposes other than combating terrorism, such as
    responding to natural disasters, hazardous material spills, and military
    crises. For example, DOD teams can provide a wide variety of consequence
    management capabilities in response to domestic

    2 For a detailed review of federal consequence management response
    capabilities, see our report Combating Terrorism: Federal Response Teams
    Provide Varied Capabilities; Opportunities Remain to Improve Coordination
    (GAO- 01- 14, Nov. 30, 2000). Consequence Management

    Teams Generally Are Not Duplicative

    Chapter 4: Federal Response Capabilities Are Improving

    Page 65 GAO- 01- 822 Combating Terrorism

    terrorist incident. However, these teams have a primary military role and
    mission.

    A few agencies have fixed assets, such as laboratories, which may augment
    teams and the overall federal response in a chemical or biological terrorist
    incident. In some incidents, these laboratories may perform functions that
    enable deployed federal response teams to perform their role. For example,
    when a diagnosis is confirmed by one of the laboratories at the Centers for
    Disease Control and Prevention, the U. S. Army Medical Research Institute of
    Infectious Diseases, or those within the Laboratory Response Network, the
    National Medical Response Teams and the Disaster Medical Assistance Teams
    can begin to treat victims appropriately. According to HHS, this Laboratory
    Response Network has responded to hundreds of state and local events since
    its inception. It represents an operational partnership for early detection
    and laboratory confirmation between the Centers for Disease Control and
    Prevention, the FBI, DOD, and state and local health departments. The
    network has a common training doctrine and develops standardized assays that
    it distributes to its partners. It is a critical new component of national
    preparedness for bioterrorism.

    Federal capabilities are demonstrated and enhanced through agency
    participation in special events. These events provide federal agencies with
    valuable experience working together to develop and practice plans to combat
    terrorism. PDD 62 established a process to designate certain events as
    National Special Security Events. The FBI and the U. S. Secret Service have
    improved their cooperation for such events. For example, they now have a
    written agreement on command and control and conduct planning and exercises
    together.

    Special events are high- visibility events in which federal agencies
    initiate contingency measures against terrorist attacks and most agencies
    involved gain valuable experience coordinating their activities. PDD 62
    created a category of special events called National Special Security
    Events, which are events of such significance that they warrant greater
    federal planning and protection than other special events. Upcoming events
    must be nominated by the NSC, then certified by the Attorney General and
    Secretary of the Treasury before they officially are designated as National
    Special Security Events. Such events have included the major political party
    conventions, Presidential inaugurations, Olympic games, and the Agency
    Laboratories

    Augment Federal Response Teams

    Coordination of Special Events Has Improved

    Special Events Provide Coordination Experience

    Chapter 4: Federal Response Capabilities Are Improving

    Page 66 GAO- 01- 822 Combating Terrorism

    World Trade Organization Ministerial Meeting. For these events, PDD 62
    reaffirmed the FBI?s lead federal agency role for crisis management, but
    designated the U. S. Secret Service as lead federal agency for security
    design, planning, and implementation at such events. The directive also
    encouraged cooperation among federal agencies in counterterrorism planning
    for these events.

    In a previous report, we noted that the U. S. Secret Service and the FBI did
    not always coordinate their command and control structures or contingency
    plans, and agency officials acknowledged that their agencies had not worked
    well together. 3 Since then, special event cooperation and coordination
    between the U. S. Secret Service and the FBI has improved. Specifically,

     The FBI and the U. S. Secret Service have a written agreement on command
    and control arrangements for special events, and officials from both
    agencies agreed that this document is followed when preparing for special
    events.

     The FBI?s Special Events Management Planning Handbook enumerates the roles
    and responsibilities of other federal agencies (including the U. S. Secret
    Service) for special events and stresses the need for cooperative planning
    for terrorist incidents.

     U. S. Secret Service evaluations on special events discuss interaction
    with the FBI and FEMA and identify the need for additional cooperative
    planning.

     We observed close cooperation and detailed planning between the U. S.
    Secret Service, the FBI, and other federal agencies during an exercise in
    preparation for the 2002 Olympic Winter Games in Salt Lake City, Utah.

    To improve their preparedness to respond to a terrorist incident, federal
    agencies exercise their capabilities. The FBI has made progress in
    practicing its interagency and intergovernmental leadership role in crisis
    management through a number of exercises. FEMA has made some progress, but
    is not using exercises to fully practice its leadership role over
    consequence management. Two recent exercises, ?Top Officials

    3 Combating Terrorism: Issues to Be Resolved to Improve Counterterrorism
    Operations

    (GAO/ NSIAD- 99- 135, May 13, 1999). FBI and U. S. Secret

    Service Have Improved Coordination

    Federal Counterterrorism Exercises Are Improving

    Chapter 4: Federal Response Capabilities Are Improving

    Page 67 GAO- 01- 822 Combating Terrorism

    (TOPOFF) 2000? and ?Wasatch Rings,? provide good examples of federally
    sponsored interagency and intergovernmental exercises.

    PDD 39 required key federal agencies to exercise their capabilities to
    combat terrorism. Exercises test and evaluate policies and procedures, test
    the effectiveness of response capabilities, and increase the confidence and
    skill level of personnel. Exercises also identify strengths and weaknesses
    before they arise in an actual incident. Exercises further allow agencies to
    apply operational lessons learned from past exercises and actual
    deployments.

    In counterterrorism, where federal operations are inherently interagency
    matters, exercises also allow various department and agency personnel to
    become familiar with each other?s missions and procedures and learn to
    coordinate and operate together. Interagency exercises can help identify
    aspects of cooperation that work well and problems and conflicts that
    require interagency resolution. Interagency exercises are planned through an
    interagency Exercise Subgroup cochaired by the Department of State (for
    international exercises) and the FBI (for domestic exercises). The
    Department of State and the FBI alternate as host for bi- monthly exercise
    planning meetings. These meetings address both domestic and international
    exercise plans. The major agencies most likely to react to terrorist
    incidents participate regularly, and other agencies participate less
    frequently. The meetings allow various agencies to address issues, plan
    future exercises, and compare and resolve agency exercise schedule
    conflicts. They also serve as a forum for interagency discussion and
    planning for national- level counterterrorism exercises.

    We previously reported that domestic crisis exercises led by federal law
    enforcement agencies did not include many of the federal, state, and local
    authorities that would be needed to effectively respond to a terrorist
    crisis. We noted that the FBI?s domestic crisis response program was well
    developed with regularly scheduled field exercises that tested regional and
    field office capabilities at the tactical level, but generally did not
    exercise the broader interagency leadership role that the FBI would play in
    a major terrorist incident. In addition, we reported that crisis management
    exercises were ending in a successful tactical resolution of the incidents
    and did not include more likely scenarios where terrorist attacks were
    successful, requiring consequence management. Exercises Important to

    Response Readiness The FBI Regularly Practices Its Crisis Management
    Leadership Role Through Exercises

    Chapter 4: Federal Response Capabilities Are Improving

    Page 68 GAO- 01- 822 Combating Terrorism

    Since our earlier review, the FBI has taken steps to strengthen its
    leadership role through a number of interagency and intergovernmental
    exercises. In planning national- level field exercises, the FBI has given
    priority for state and local agencies? participation. In addition to its own
    regional field exercises, the FBI participated in or sponsored a major
    interagency and intergovernmental field exercises at least once per year.
    These have been field exercises that included both crisis and consequence
    management and tested interagency command and control and communications
    issues by establishing a Joint Operations Center. These exercises included
    the following:

     In June 1998, the FBI participated in the ?Gauged Strength? exercise in
    Norfolk, Va. Although this exercise was sponsored by DOD, the FBI had robust
    participation and established interagency organizations, such as a Joint
    Operations Center and a Joint Information and Intelligence Support Element.
    State and local participation was limited by DOD classification
    requirements.

     In February 1999, the FBI sponsored the ?Westwind? exercise in Los
    Angeles, Calif. This exercise, cosponsored by the state, tested the
    compatibility of federal, state, and local terrorism response plans through
    the integration of the Joint Operation Center and Incident Command Post. The
    exercise also tested the activation of the Terrorism Early Warning Group and
    the mobilization and deployment of the Domestic Emergency Support Team.

     In May 2000, the FBI participated in the TOPOFF 2000 exercise in three
    locations across the country. This Department of Justice- sponsored exercise
    included a radiological scenario in Washington, D. C.; a chemical scenario
    in Portsmouth, NH, and a biological scenario in Denver, Colo. The FBI
    established interagency Joint Operations Centers in all three cities. FBI
    officials told us that this was the largest, most complex federal
    counterterrorist exercise ever conducted.

     In April 2001, the FBI sponsored the Wasatch Rings exercise in Salt Lake
    City, Utah. This exercise, cosponsored by the state, tested federal, state,
    and local contingency plans related to the upcoming 2002 Olympic Winter
    Games. The FBI established a Joint Operations Center, which was co- located
    with a state and local command center. Again, the interagency Domestic
    Emergency Support Team was deployed.

    For additional information and our observations on these last two exercises,
    see the information in the text boxes that follow.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 69 GAO- 01- 822 Combating Terrorism

    FEMA was designated as the lead federal agency for consequence management
    under PDD 39 and was also tasked under a fiscal year 1995 emergency
    supplemental appropriation to develop exercises that focused on consequences
    of a terrorist incident. 4 We previously reported that FEMA held a number of
    tabletop exercises in response to these directives, but only planned or
    sponsored one interagency field exercise to test its consequence management
    leadership role. Tabletop exercises identify important policy and
    operational issues, but are not a substitute for field exercises that test
    the federal government?s ability to use and coordinate teams and assets in a
    realistic setting.

    Although federal agencies are beginning to work together to improve
    consequence management exercises, agency officials said the consequence
    management component needs to be carried out further to effectively test
    agency capabilities. For example, the consequences of a biological incident
    that can include mass casualties or an overwhelmed health care system have
    not been fully included as part of the consequence management exercises.
    These scenarios present unique challenges, such as identifying alternative
    facilities for mass casualties, identifying military reserve units that need
    to be brought in, determining how mass casualties would be moved, and
    establishing quarantine areas.

    In our review of exercises over the last 3 years, we found that FEMA
    participated in some field exercises and held numerous tabletop exercises.
    However, FEMA generally did not sponsor any interagency field exercise.
    Without field exercises involving a consequence management component,
    federal agencies are not able to train and exercise their response
    capabilities, deploy personnel and equipment, and practice roles and
    responsibilities in realistic settings. One FBI official said that more of
    the major interagency field exercises could include a robust consequence
    management component if FEMA was more involved in the initial planning
    phases of the exercises within the interagency exercise group. FEMA,
    however, is taking on leadership roles during field exercises in which it
    participates. For instance, during the Wasatch Rings exercise briefing, we
    observed FEMA outlining various consequences to possible WMD scenarios and
    coordinating with federal agency officials on the appropriate response.

    4 Emergency Supplemental Appropriations for Additional Disaster Assistance,
    for Counterterrorism Initiatives, for Assistance in the Recovery From the
    Tragedy That Occurred at Oklahoma City, and Recission Act (P. L. 104- 19,
    July 27, 1995). FEMA Not Fully Practicing

    Its Leadership Role Through Exercises

    Chapter 4: Federal Response Capabilities Are Improving

    Page 70 GAO- 01- 822 Combating Terrorism

    FEMA?s participation in the Interagency Working Group on Exercises has been
    sporadic. For example, during our observation of the January 2001 meeting of
    the Interagency Working Group on Exercises, FEMA did not actively
    participate. In March 2001, we were told that FEMA formally was attending
    meetings within the Exercise Subgroup. Active participation within the
    Exercise Subgroup allows federal agencies to establish objectives and
    prepare a schedule of large interagency counter- terrorist exercises. This
    also allows agencies the opportunity to discuss complex transfers of command
    and control between agencies. Without interagency exercise objectives set by
    the Exercise Subgroup, agencies are not likely to exercise key scenarios
    and, as a result, the federal government will be less prepared to respond in
    a tailored, synchronized manner if an incident occurs.

    The following textbox provides our observations on TOPOFF 2000, a
    congressionally directed, Department of Justice and FEMA cosponsored field
    exercise to assess the nation?s crisis and consequence management capacity.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 71 GAO- 01- 822 Combating Terrorism

    Figure 6 shows simulated National Pharmaceutical Stockpile pushpackages
    after they had been delivered and unloaded at Buckley Air National Guard
    Base in Denver, Colorado, for the first time in TOPOFF

    Chapter 4: Federal Response Capabilities Are Improving

    Page 72 GAO- 01- 822 Combating Terrorism

    2000 to treat victims exposed to plague. The items in the simulated
    stockpile were subsequently distributed to hospitals and other points of
    distribution, such as makeshift medical treatment centers, so that victims
    could be appropriately treated. The delivery of the stockpile during an
    exercise provided an opportunity for federal, state, and local governments
    to coordinate their respective responses.

    Figure 6: Arrival of a Simulated National Pharmaceutical Stockpile Push-
    Package During TOPOFF 2000 Exercise

    Note: The aircraft shown was used by technical assistance personnel; it is
    far too small to deliver an actual push- package from the National
    Pharmaceutical Stockpile. Also, the Stockpile uses specialized cargo
    containers for air transportation of its pharmaceuticals, supplies, and
    equipment.

    Source: GAO.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 73 GAO- 01- 822 Combating Terrorism

    Figure 7 shows members of the U. S. Coast Guard Atlantic Strike Team
    hazardous materials unit inspecting remains of a vehicle for chemical
    residue during the TOPOFF 2000 exercise in Portsmouth, New Hampshire.

    Figure 7: U. S. Coast Guard Personnel Inspect Vehicle Remains for Chemical
    Residue During TOPOFF 2000 Exercise

    Source: U. S. Coast Guard.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 74 GAO- 01- 822 Combating Terrorism

    The following textbox provides our observations on Wasatch Rings, an FBI and
    Utah Olympic Public Safety Command cosponsored multi- agency WMD field
    training exercise in preparation for the 2002 Olympic Winter Games in Salt
    Lake City, Utah.

    Figure 8 shows an FBI enhanced SWAT team seizing an aircraft suspected of
    carrying radiological material during the Wasatch Rings counterterrorism
    exercise in preparation for the 2002 Olympic Winter Games in Salt Lake City,
    Utah.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 75 GAO- 01- 822 Combating Terrorism

    Figure 8: FBI Enhanced SWAT Team Seizes Aircraft Suspected of Carrying
    Radiological Material During Wasatch Rings Exercise

    Source: Oak Ridge Institute for Science and Education.

    Federal capabilities also are enhanced when agencies learn lessons from
    their successes and mistakes from exercises and operations. As in our
    earlier work, we found that some federal agencies have relatively good
    processes in place to capture and share lessons learned internally within
    departments and externally with participating agencies, while others have
    less rigorous processes. Some federal agencies continue to work on
    implementing an interagency process to capture and share lessons learned;
    however, as yet, there is no regular process being used to capture and share
    lessons learned. Evaluations of

    Exercises Need Improvement

    Chapter 4: Federal Response Capabilities Are Improving

    Page 76 GAO- 01- 822 Combating Terrorism

    A valuable part of the lessons learned process is preparation of an
    afteraction report (AAR) or other evaluation that documents the results of
    an exercise, special event, or operation. Characteristics of an AAR
    typically include a summary of objectives, operational limitations, major
    participants, a description of strengths and weaknesses, and corrective
    actions. Effective follow- up and validation of the strengths and weaknesses
    also are important steps in the process, as they are the means to ensure
    that problems are corrected. Dissemination of AARs within an organization,
    and when appropriate to other participating agencies, is another important
    feature that provides aspects of the operations that worked well and those
    that need improvement. For counterterrorism operations that are inherently
    interagency matters, the lessons learned should also address the interaction
    between different agencies to highlight problems for resolution in
    interagency forums.

    In our prior review of agencies? processes to capture lessons learned, we
    found that while some agencies had relatively good processes in place to
    capture and share lessons learned, other agencies had less rigorous
    processes. For example, the other agencies did not have a written policy
    that required that they produce AARs or a formal process to capture lessons
    learned. The production of AARs by some of these agencies was sporadic, in
    particularly for operations, special events, and exercises led by other
    agencies. In addition, few of these other agencies included discussions of
    interagency issues in their AARs. The dissemination of AARs was limited at
    many agencies, which minimized the benefits of lessons learned. These
    limitations make it more difficult for the agencies to capture the strengths
    and weaknesses shown in operations or exercises so they can continue or
    expand good practices or take corrective actions when necessary to improve
    future performance.

    In our most recent review from July 1998 to August 2001 of agencies?
    processes to capture lessons learned, we found that some agencies? processes
    had improved. HHS and the U. S. Secret Service have adopted a formal policy
    to produce AARs to capture lessons learned, while three other agencies, VA,
    EPA, and the FBI, are in the process of drafting a policy. In addition,
    those agencies that adopted a formal process generally produced AARs for
    special events and select exercises. HHS began producing AARs for special
    events while the U. S. Secret Service started producing AARs on special
    events and tabletop exercises. In other agencies, our review found little,
    if any, improvement. Performance by the Bureau of Alcohol, Tobacco, and
    Firearms (ATF) and FEMA, however, fared worse compared to our prior review
    because they did not capture After- Action Reports Are

    Important Learning Tools Some Individual Agencies Have Improved AfterAction
    Reports, Although Deficiencies Remain

    Chapter 4: Federal Response Capabilities Are Improving

    Page 77 GAO- 01- 822 Combating Terrorism

    lessons learned for any exercises, special events, or operations. Overall,
    agency officials generally cited a lack of dedicated staff or the tempo of
    ongoing operations or exercises as reasons why they did not write AARs or
    capture lessons learned. Table 5 describes selected agencies? processes for
    capturing lessons learned and producing AARs.

    Table 5: Characteristics of Federal Agencies? Processes to Capture Lessons
    Learned From Counterterrorist Operations, Special Events, and Exercises

    Agency Formal policy and/ or process to capture lessons learned

    Actual agency production of AARs AAR discussion of

    interagency issues and dissemination

    Changes from prior GAO review of AARs

    DOE Policy requires AARs; formal process is After Action Tracking System

    Generally produces AARs for exercises, including those led by other
    agencies; AARs were not produced for special events

    AARs generally discuss interagency issues; AARs disseminated internally and
    sometimes externally

    No change in formal policy; AARs not produced for special events

    FEMA Policy requires AARs; formal process is the Corrective Action Program

    Produces no AARs for exercises and special events

    Not applicable; AARs not done Performance degraded

    because FEMA previously produced AARs for its exercises U. S. Coast Guard
    Policy requires AARs;

    formal process is Coast Guard Standard After Action Information and Lessons
    Learned System (CGSails)

    Produces AARs for some field exercises and some tabletop exercises

    AARs generally discuss interagency issues; AARs disseminated widely via web-
    based system/ reporting process

    GAO previously did not conduct a detailed review of U. S. Coast Guard
    processes to capture lessons learned

    DOD Policy requires AARs; new formal process is the Joint Lessons Learned
    Program

    Some units produce AARs; DOD does not have visibility over them to determine
    the extent to which the requirement is met

    When produced, AARs generally discuss interagency issues and are
    disseminated internally and sometimes externally

    Adopted new formal policy to capture lessons learned; new office reviews and
    analyzes terrorism- related operations and exercise lessons learned FBI
    Formal policy is being

    drafted Produces no AARs for operations or special

    events; generally, produces AARs for FBI field exercises, but not tabletop
    exercises

    AARs generally discuss interagency issues; AARs disseminated internally to
    participating FBI offices, but not externally

    No change in production of AARs; FBI is in the process of drafting a formal
    policy

    U. S. Secret Service Policy requires AARs to capture lessons learned
    Generally produces

    AARs for special events and some tabletop exercises; rarely produces AARs
    for field exercises

    AARs generally discuss interagency issues; AARs are disseminated internally,
    but not externally

    Adopted formal policy to capture lessons learned; produced AARs for special
    events and some tabletop exercises

    Chapter 4: Federal Response Capabilities Are Improving

    Page 78 GAO- 01- 822 Combating Terrorism

    Agency Formal policy and/ or process to capture lessons learned

    Actual agency production of AARs AAR discussion of

    interagency issues and dissemination

    Changes from prior GAO review of AARs

    HHS Policy requires AARs to capture lessons learned Produces AARs for

    special events; rarely produces AARs for exercises

    AARs generally discuss interagency issues; AARs disseminated internally, but
    not externally

    Generally produces AARs for special events; adopted formal policy to capture
    lessons learned EPA Formal policy is being

    drafted Produced AAR for exercise sponsored by

    another agency Not applicable; AARs not

    done EPA is in the process of drafting a formal AAR

    policy USDA No formal policy or

    process Produces AARs for some exercises AARs generally discuss

    interagency issues; AARs disseminated internally

    GAO previously did not conduct a detailed review of USDA processes to
    capture lessons learned VA Formal policy is being

    drafted Produces AARs for field exercises AARs generally discuss

    interagency issues; AARs are disseminated internally, but not externally

    GAO previously did not conduct a detailed review of VA processes to capture
    lessons learned ATF No formal policy Does not produce

    AARs for exercises and special events

    Not applicable; AARs not done Performance degraded

    because AARs previously were produced for ATF exercises

    Note: The period of review was July 1998 to June 2001. Source: GAO analysis.

    Although some agencies adopted formal policies to capture lessons learned,
    there were recurring interagency problems because there was no central place
    where officials assembled and analyzed AARs together to discuss interagency
    problems. The Exercise Subgroup discussed developing a formal interagency
    process and has looked specifically at the processes being used by DOD and
    DOE, although no process has been adopted and developed. At the interagency
    level, there continues to be no formal process implemented to review and
    analyze AARs. The lack of an interagency process to centralize lessons
    learned prevents agencies from learning or cause them to make the same
    mistakes. This problem is further magnified because agencies that
    participated in national- level field exercises may have to wait up to a
    year before reviewing AARs because of the time it takes agencies to prepare
    AARs. After more than a year, the Department of Justice?s Office for State
    and Local Domestic Preparedness Support released its AAR on the TOPOFF 2000
    no- notice field exercise. Without AARs, agencies may not be able to correct
    previously identified shortfalls or fully implement lessons learned. The
    Office currently is planning the TOPOFF II exercise for fiscal year 2003.
    Interagency Process to

    Capture After- Action Reports Is Not in Place

    Chapter 4: Federal Response Capabilities Are Improving

    Page 79 GAO- 01- 822 Combating Terrorism

    Federal capabilities to combat terrorism can be enhanced through research
    and development. The considerable risk, long development time, and high cost
    necessitate federal government involvement to promote research and
    development related to WMD terrorism. Federal research and development
    programs are coordinated through a variety of mechanisms, but primarily
    through an interagency working group called the Technical Support Working
    Group (TSWG). 5 However, coordination is limited by a number of factors,
    raising the potential for duplicative efforts among federal agencies.

    Federally sponsored research and development efforts enhance the
    government?s capability to combat terrorism by providing products that meet
    a range of crisis and consequence management needs. Federal agencies and
    interagency working groups have or are developing a variety of products to
    combat terrorism. Examples of recently developed and fielded technologies
    include products to detect and identify weapons of mass destruction,
    transport contaminated materials, and validate protection equipment life
    spans, such as

     tools for assessing exposure risks of airborne chemical and biological
    agents in new and existing structures in order to compare the relative risk
    to occupants under different release and protection scenarios,

     puncture- and tear- resistant containers in multiple sizes for the initial
    packaging and transport of chemical- and biological- contaminated objects,

     tests to determine the life span of chemical gas mask canisters when
    removed from protective containers and attached to gas masks, and

     computer- based information and instruction tool sets for first
    responders. Additional technologies presently are under development by TSWG
    and federal agencies. These endeavors include developing
    continuousmonitoring chemical detectors for facility protection, filtration

    5 TSWG was established as the technology development component of the
    Department of State- chaired Interagency Group on Terrorism. Its mission is
    to conduct the national interagency research and development program for
    combating terrorism. TSWG operates under the policy oversight of the
    Department of State Office of the Coordinator for Counterterrorism and the
    management and technical oversight of the DOD Office of the Assistant
    Secretary of Defense for Special Operations and Low- Intensity Conflict. An
    Executive Committee chaired by a Department of State representative provides
    program direction. Members of the Executive Committee include
    representatives from DOD, DOE, and the FBI. DOD manages and executes the
    program through the Combating Terrorism Technology Support Office. Research
    and

    Development Enhances Future Federal Capabilities

    Research and Development Enhances Response Capabilities

    Chapter 4: Federal Response Capabilities Are Improving

    Page 80 GAO- 01- 822 Combating Terrorism

    systems for small rooms and buildings, modeling systems that project the
    spread of animal or plant disease outbreaks resulting from terrorist
    attacks, vehicle explosive screening and barrier technologies, and
    decontamination technologies for urban facilities, including subways and
    airports. The National Institutes of Health is engaged in research that will
    lead to the development of new or improved vaccines, antibiotics, and
    antivirals. The Centers for Disease Control and Prevention, in collaboration
    with other federal agencies, is conducting research on the diagnosis and
    treatment of smallpox. The Food and Drug Administration is investigating a
    variety of biological agents that could be used as terrorist weapons.

    Research and development related to WMD terrorism can involve considerable
    risk, lengthy development times, and high costs as well as specific
    requirements not available in off- the- shelf products. These factors not
    only limit and affect the type of research and development in which various
    sectors of the private and public markets engage, but necessitate federal
    government involvement and collaboration to promote research and
    development. For example, the Defense Advanced Research Projects Agency and
    the National Institutes of Health conduct high cost, very high risk, and
    time- intensive research and development in which industry typically may not
    engage. Figure 9 below depicts the relationship between risk, time, and cost
    associated with the development of products to combat terrorism,
    demonstrating that the federal government is the primary driver of WMD
    research and development. Research and

    Development Will Likely Require Government Involvement

    Chapter 4: Federal Response Capabilities Are Improving

    Page 81 GAO- 01- 822 Combating Terrorism

    Figure 9: Relationships Between Risk, Time, and Cost in Developing Products
    to Combat Terrorism

    Source: GAO analysis of TSWG data.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 82 GAO- 01- 822 Combating Terrorism

    The Assistant to the President for Science and Technology heads the Office
    of Science and Technology Policy and serves on the cabinet- level National
    Science and Technology Council. These entities advise the President on the
    coordination of federal research and development investments and macro-
    level policies, plans, and programs. The Council establishes national goals
    for federal science and technology investment and prepares research and
    development strategies that are coordinated across federal agencies. The
    Council's Committee on National Security provides a formal mechanism for
    interagency policy review, planning, and coordination as well as the
    exchange of information regarding national security- related research and
    development. However, these organizations have not created a national
    research and development strategy specific to combating WMD- related
    terrorism. They also do not coordinate individual agency projects. As a
    result, the management of technology research and development at the agency-
    level is self- governing and highly dependent on voluntary coordination
    mechanisms. Individual agencies have a number of research and development or
    applied technology programs that are coordinated in varying ways and degrees
    with other agencies through formal and informal mechanisms.

    The primary coordination mechanism for terrorism- related research and
    development is TSWG, an interagency working group that, in fiscal year 2000,
    coordinated more than $60 million in research and development activities
    across the counterterrorism community in eight categories of terrorism-
    related products. The eight categories are (1) explosives detection and
    defeat; (2) personnel protection; (3) tactical operations support; (4)
    infrastructure protection; (5) chemical, biological, radiological, and
    nuclear countermeasures; (6) investigative support and forensics; (7)
    physical security; and (8) surveillance, collection, and operations support.
    TSWG serves an important function, providing a way for technologies to be
    developed when a single agency cannot invest sufficiently in a technology
    that would benefit multiple agencies, collaborate directly with other
    agencies in such investments, or afford to risk investing scarce operational
    resources and manpower in unproven technologies. TSWG?s purview represents a
    minor share of all terrorismrelated research and development being conducted
    across the federal government because numerous federal agencies also
    independently engage in research and development or technology application
    projects specific to their respective agency missions for combating
    terrorism. In addition, TSWG?s activities are limited to the development of
    products of use to- and supported by- the majority of its members. Federal
    Research and

    Development Is Coordinated in a Variety of Ways

    Chapter 4: Federal Response Capabilities Are Improving

    Page 83 GAO- 01- 822 Combating Terrorism

    Federal agencies also depend on informal coordination mechanisms, such as
    liaison programs and personal relationships, to facilitate information
    sharing concerning ongoing and planned research and development activities.
    For example, DOE maintains an informal liaison program with other agencies,
    including the Federal Aviation Administration. However, officials
    acknowledge that informal relationships cannot be expected to capture the
    universe of projects or inform agencies of all relevant and related research
    and development projects. For example, the Defense Advanced Research
    Projects Agency was unaware of U. S. Coast Guard plans to develop methods to
    detect biological agents on infected cruise ships and, therefore, was unable
    to share information on its research to develop chemical and biological
    detection devices for buildings that could have applicability in this area.

    In commenting on a draft of this report, OSTP described more recent
    mechanisms to coordinate research and development related to combating
    terrorism within the NSC?s Policy Coordinating Committee on Counterterrorism
    and National Preparedness. In implementing National Security Presidential
    Decision- 1, dated February 2001, the NSC established the NSC- chaired
    Preparedness Against Weapons of Mass Destruction Group. It has eight
    subgroups, including the OSTP- chaired Research and Development Subgroup,
    which reports to the NSC chair. According to OSTP, all federal departments
    and agencies with interests, equities, or needs in research and development
    for combating terrorism are represented on the Research and Development
    Subgroup. To ensure communication and coordination of Subgroup activities
    and TSWG, a TSWG cochair is a member of the Subgroup.

    According to OSTP, the Subgroup assesses federal research and development
    programs to help agencies integrate the highest priority items into their
    budgets, thereby reducing gaps and duplication in efforts to prevent,
    counter, and respond to chemical, biological, radiological, or nuclear
    terrorist attack. The Subgroup has a broad role in identifying longrange,
    large- scale research and development issues that involve preventing,
    countering, and responding to chemical, biological, radiological, or nuclear
    terrorist attacks. According to OSTP, the Subgroup is consulting with other
    subgroup chairs to identify comprehensive research and development needs in
    preparedness for combating terrorism; identifying and prioritizing research
    and development gap- filling objectives; implementing a process for
    reporting progress toward achieving research and development objectives; and
    continuing the ongoing effort to achieve concordance of research and
    development objectives with agency programs.

    Chapter 4: Federal Response Capabilities Are Improving

    Page 84 GAO- 01- 822 Combating Terrorism

    We reported in 1999 that current formal and informal research and
    development coordination mechanisms may not ensure that potential overlaps,
    gaps, and opportunities for collaboration are addressed. 6 A number of
    factors continue to limit research and development coordination, creating
    the potential for duplicative efforts among federal agencies. For example,
    TSWG?s scope is limited to projects with relatively short- term development
    cycles and member federal agencies only propose and discuss projects that
    they believe will garner broad interest and support from other agencies.
    Information concerning research and development projects with more narrow
    applicability, but potentially of equal importance, either are not shared or
    are communicated through alternate methods. Furthermore, excluding TSWG,
    federal agency announcements and requests for proposals generally do not
    require contractors and national laboratories to disclose whether they are
    conducting the same or similar projects for other agencies or even to
    identify other requesters.

    Federal agencies need to coordinate their research and development efforts
    because they pursue many of the same capabilities and may contract with many
    of the same laboratories and industries to perform research and development
    work. A DOE official acknowledged that a national laboratory developed
    similar products for multiple agencies and charged each of them separately.
    For example, two offices within Sandia National Laboratory concurrently and
    separately worked on similar thermal imagery projects for two different
    federal agencies, rather than consolidating the requests and combining
    resources. The Attorney General?s Five- Year Plan recommended that responses
    to federal research and development requests for proposals identify pending
    similar submissions to mitigate against duplicate funding for essentially
    the same project and to facilitate collaboration among federal agencies.

    The extent of compartmentalization of research and development activities
    further limits coordination. Many programs are compartmentalized or
    classified; therefore, results often are not widely shared, even among
    agencies with similar missions and, in some instances, even within the same
    agency. For example, DOE has three programs that focus on agency mission-
    specific research, development, and applied technology. DOE coordinates some
    programs? activities with a number of

    6 Chemical and Biological Defense: Coordination of Nonmedical Chemical and
    Biological R& D Programs (GAO/ NSIAD- 99- 160, Aug. 16, 1999). Limits to
    Coordination

    Raise Potential for Duplication

    Chapter 4: Federal Response Capabilities Are Improving

    Page 85 GAO- 01- 822 Combating Terrorism

    interagency organizations and groups, but does not coordinate other
    initiatives due to classification concerns. However, some DOE program
    officials coordinate with or participate in at least 12 interagency
    organizations and groups involved in technology application programs for
    combating terrorism.

    Federal coordination is limited by the lack of formal mechanisms to capture
    the entire universe of governmentwide research and development efforts. The
    absence of a single oversight and coordinating entity to ensure against
    duplication further hinders coordination. To address this problem, the
    Attorney General?s Five- Year Plan calls for a comprehensive mechanism and
    research and development strategy consistent with and complementary to the
    nation?s overall technology goals. The plan advocates setting national
    counter- terrorism priorities, tracking ongoing projects consistent with
    these priorities, defining near- and longer- term technology needs,
    supporting fundamental research in targeted technical sectors, and promoting
    technological breakthroughs.

    The development of such a plan may benefit individual agency efforts. Some
    individual agencies, such as DOE and the Department of Transportation, have
    developed agency- specific research and development plans that are linked to
    their overall agency strategic plans that may identify agency- specific
    research and development goals and objectives as well as the roles of other
    federal agencies in achieving those goals. For example, the Department of
    Transportation Research and Development Plan supports the Department?s
    budget and program development process, establishes priorities, and links
    research and technology development initiatives occurring throughout the
    Department to specific strategic goals. By focusing on research and
    development needs that concern the Department as a whole, the plan allows
    the Department of Transportation to transcend individual research and
    development projects and facilitates internal planning and coordination. If
    a governmentwide research and development strategy to combat terrorism was
    completed, then it would provide a way for agencies, through their own plans
    or related efforts, to link their research and development to related
    efforts where appropriate.

    Although FEMA has made some progress, it is not using exercises to fully
    practice its leadership role over consequence management. If FEMA played a
    larger role in managing federal exercises to combat terrorism, then it would
    improve federal agencies? overall readiness in consequence management. In
    addition, if FEMA was more involved in the initial planning phases of field
    exercises within the Interagency Working Group Conclusions

    Chapter 4: Federal Response Capabilities Are Improving

    Page 86 GAO- 01- 822 Combating Terrorism

    on Exercises, then major interagency field exercises could include a more
    robust consequence management component. Active leadership and participation
    within the Working Group would allow FEMA to (1) establish objectives and
    prepare a schedule of large interagency counter- terrorist exercises and (2)
    ensure that complex transfers of command and control between agencies are
    exercised. Without field exercises involving a consequence management
    component, federal agencies are not able to train and exercise their
    response capabilities, deploy personnel and equipment, and practice roles
    and responsibilities under realistic conditions.

    To ensure that individual agencies learn lessons after each federal
    counterterrorism exercise, special event, or operation, agencies should
    prepare a timely AAR or other evaluation that documents the results.
    Dissemination of AARs within an agency- and, whenever possible and
    appropriate, to other participating agencies- would provide participants
    with information on the operations that worked well and those that need
    improvement. Finally, taking corrective action and effective follow- up
    would help ensure that problems are corrected.

    At the interagency level it is also important to capture and evaluate
    lessons learned. While most agencies are making progress evaluating their
    own exercises, little progress has been made at the interagency level. There
    is a need for a regular lessons learned process for major interagency
    exercises.

    Although research and development efforts are being coordinated through a
    variety of mechanisms, development of a strategic plan for research and
    development could help prevent duplication and leverage resources. OSTP?s
    efforts are on hold pending the Vice President?s review of national
    preparedness.

    To improve readiness in consequence management, we recommend that the
    Director of the Federal Emergency Management Agency play a larger role in
    managing federal exercises to combat terrorism. As part of this, FEMA should
    seek a formal role as a cochair of the Interagency Working Group on
    Exercises and help to plan and conduct major interagency counterterrorist
    exercises to ensure that consequence management is adequately addressed.

    To ensure that agencies benefit fully from exercises in which they
    participate, we recommend that the Secretaries of Agriculture, Defense,
    Energy, Health and Human Services, and Veterans Affairs; the Directors of
    the Bureau of Alcohol, Tobacco, and Firearms, Federal Emergency
    Recommendations for

    Executive Action

    Chapter 4: Federal Response Capabilities Are Improving

    Page 87 GAO- 01- 822 Combating Terrorism

    Management Agency, Federal Bureau of Investigation, and the U. S. Secret
    Service; the Administrator of the Environmental Protection Agency; and the
    Commandant of the U. S. Coast Guard require their agencies to prepare AARs
    or similar evaluations for all exercises they lead and for all field
    exercises in which they participate.

    To ensure that individual agencies capture, evaluate, and disseminate
    interagency lessons learned after each federal counterterrorism exercise,
    special event, or operation, we recommend that the President direct the
    focal point for overall leadership and coordination (discussed at the end of
    ch. 2) to develop a formal process to capture and evaluate interagency
    lessons learned from major interagency and intergovernmental federal
    exercises to combat terrorism. While agencies sponsoring and participating
    in such exercises should continue to collect and analyze information on
    their individual performance, the focal point should analyze interagency
    lessons learned and task individual agencies to take corrective actions as
    appropriate.

    To reduce duplication and leverage resources, we recommend that the
    Assistant to the President for Science and Technology complete efforts to
    develop a strategic plan for research and development to combat terrorism,
    coordinating this with federal agencies and state and local authorities. If
    our recommendation in chapter 2 is adopted and a single focal point is
    established in the Executive Office of the President to lead and coordinate
    federal programs to combat terrorism, then the focal point should also
    ensure that a research and development strategy for combating terrorism is
    integrated or coordinated with the national strategy to combat terrorism
    (see Recommendations for Executive Action in ch. 2).

    Agency comments on a draft of this report were based on their efforts prior
    to the September 11, 2001, terrorist attacks. FEMA agreed with our
    recommendation that it play a larger role in managing federal exercises to
    combat terrorism. FEMA said the creation of the Office of National
    Preparedness in FEMA to coordinate all federal programs dealing with WMD
    consequence management and its May 8, 2001, charge (see app. VII) by the
    President to work with the Department of Justice to ensure that ?all

    facets of our response to the threat from weapons of mass destruction are
    coordinated and cohesive? will improve consequence management readiness and
    will ensure that FEMA plays a larger role in federal exercises. FEMA also
    agreed with our recommendation that it should seek a formal role as cochair
    of the Interagency Working Group on Exercises. Agency Comments

    and Our Evaluation

    Chapter 4: Federal Response Capabilities Are Improving

    Page 88 GAO- 01- 822 Combating Terrorism

    The Departments of Energy and Health and Human Services and EPA also agreed
    that exercises to combat terrorism need a more robust consequence management
    emphasis. For example, DOE said it would be very beneficial to exercise the
    complete domestic counterterrorism command and control and response
    mechanisms using a realistic, progressive, end- to- end scenario with
    participation by the actual decision makers through both the crisis
    management and consequence management phases. In general, EPA is in
    agreement with the report. One of EPA?s principal concerns has been the lack
    of development of consequence management in exercises. Beyond the immediate
    consequences caused by the use of a weapon of mass destruction, the long-
    term consequences of cleaning up to a safe level have not been played out.

    The Departments of Defense, Energy, Justice, and Veterans Affairs and FEMA
    concurred with our recommendation that agencies prepare AARs or similar
    evaluations for all exercises they lead and for all field exercises in which
    they participate. DOD encourages this practice. DOE said the report?s
    recommendations on the importance of interagency exercises and feedback on
    lessons learned are completely accurate. FEMA said it will review and
    evaluate its current procedures regarding AARs and make any necessary
    changes to ensure that its AARs for weapons of mass destruction are
    completed in a timely fashion.

    The Department of Agriculture agreed with the practice of writing AARs, but
    asked that we delete our recommendation to the Secretary of Agriculture
    because the Department already produces AARs for exercises it sponsors. We
    continue to believe that this is a valid recommendation because the
    Department could learn important lessons when it participates in field
    exercises sponsored by other agencies.

    The Department of Health and Human Services, ATF, the U. S. Secret Service,
    EPA, and U. S. Coast Guard did not comment on this recommendation.

    The Department of Justice supported our recommendation about agencies
    capturing and sharing lessons learned at the interagency level. The
    Department also cited efforts begun by the NDPO to develop a program to
    address this concern. This program would include a mechanism for not only
    identifying interagency problems, but assigning responsibility for
    corrective actions and tracking progress as well. The Executive Office of
    the President did not comment on our recommendation that the President

    Chapter 4: Federal Response Capabilities Are Improving

    Page 89 GAO- 01- 822 Combating Terrorism

    direct the focal point to develop a formal process to capture and evaluate
    interagency lessons learned from exercises to combat terrorism.

    DOE said it shares our observations on the importance of an aggressive
    counterterrorism research and development effort. DOE stated that better
    interagency communication and a more extensive and formal coordination
    mechanism would increase efficiency, be more cost effective, and ensure
    against duplication of effort. Department of Transportation officials
    commented that the report may help them in their research and development
    efforts. The Executive Office of the President- and the Office of Science
    and Technology Policy- did not comment on our recommendation that the
    Assistant to the President for Science and Technology complete efforts to
    develop a strategic plan for research and development to combat terrorism.
    Notwithstanding agencies? lack of comment on this recommendation, we still
    believe it has merit as one method to better coordinate research and
    development.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 90 GAO- 01- 822 Combating Terrorism

    The federal government has several programs to train and equip state and
    local authorities to respond to terrorist WMD incidents. These programs have
    improved domestic preparedness training and equipped over 273,000 first
    responders. The programs also have included exercises to allow first
    responders to interact with themselves and federal responders. Some of these
    programs initially were implemented without appreciation for existing state
    and regional structures for emergency management. In addition, the fact that
    these programs have been led by three different federal agencies- DOD, the
    Department of Justice, and FEMA- created overlapping and duplicative
    activities. The multitude and overlap of these programs led to confusion on
    the part of state and local officials. These officials asked the federal
    government to establish a single federal liaison for them. In 1998, the
    Attorney General established the National Domestic Preparedness Office
    (NDPO) within the FBI to serve as such a liaison. However, the Office never
    met its expected role due to a variety of reasons related to its budget,
    personnel, and location. In May 2001, the President asked the Director of
    FEMA to establish an Office of National Preparedness to coordinate all
    federal programs dealing with WMD consequence management programs. This new
    Office provides a logical location for consolidating many programs to assist
    state and local governments, including some programs currently under the
    Department of Justice and the FBI. Federal assistance also has been provided
    in the form of special National Guard teams that are trained and equipped to
    provide states with capabilities to detect and analyze WMD agents and
    provide technical advice. These teams continue to experience problems with
    readiness, doctrine and roles, and deployment that undermine their
    usefulness in an actual terrorist incident.

    The federal government has had several programs that train and/ or equip
    state and local authorities to respond to terrorist WMD incidents. Whereas
    DOD ran the Domestic Preparedness Program from 1997 until 2000, the
    Department of Justice, HHS, and FEMA are the main agencies now conducting
    these programs. They also have included exercises to allow first responders
    to interact with themselves and federal responders in realistic field
    settings. These programs are as follows:

     DOD began the Domestic Preparedness Program in 1997 to enhance the
    nation?s ability to mitigate the effects of terrorist use of weapons of mass
    Chapter 5: Federal Assistance to State and

    Local Governments Can Be Consolidated Federal Programs Have Provided
    Training, Equipment, and Exercises

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 91 GAO- 01- 822 Combating Terrorism

    destruction. 1 The program identified 120 cities to receive training,
    exercises, and funding for training equipment support. The program provided
    cities with classroom training, exercises, and 5- year renewable loans of
    equipment to be used for training. Beginning in fiscal year 2001, the
    President transferred responsibility for the program from DOD to the
    Department of Justice.

     The Department of Justice?s Office for State and Local Domestic
    Preparedness Support, which was created in 1998, provides assistance to
    state and local governments. This Office has a variety of programs, such as
    its Metropolitan Firefighters and Emergency Medical Services program. Since
    fiscal year 2001, it also implements the domestic preparedness program
    formerly managed by DOD. The Office also uses DOD?s Pine Bluff Arsenal, the
    National Sheriff?s Association, the International Association of Fire
    Fighters, private corporations, and the National Domestic Preparedness
    Consortium to train first responders. 2 In total, the Office provides 30
    courses using 10 different partner organizations to deliver training.

     FEMA provides WMD- related courses at its National Fire Academy and
    Emergency Management Institute in Maryland. The Academy and Institute also
    provide WMD course materials to local and state organizations for their use
    in training first responders. FEMA makes grants for terrorismrelated
    training to states at either local or FEMA regional locations. FEMA also
    makes grants to help states develop and test their emergency plans through
    exercises.

     HHS supports the development of Metropolitan Medical Response Systems in
    order to enhance local planning and health care capacity to respond to the
    health consequences of a WMD release. This program encourages local
    jurisdictions to strengthen regional and state response relationships. Begun
    in 1996, the program now includes 97 metropolitan jurisdictions or areas
    with a total population of approximately 150 million people. The U. S.
    Public Health Service Noble Training Center, located in the former Noble
    Army Community Hospital at Fort McClellan in Anniston, Alabama, provides a
    unique medical training facility dedicated to preparing health personnel to
    respond to chemical and biological weapons attacks.

    1 The program was directed by the Defense Against Weapons of Mass
    Destruction Act of 1996 (P. L. 104- 201, Sept. 23, 1996). Because of the
    Senators who authored the original bill in the U. S. Senate, the program was
    also known as the Nunn- Lugar- Domenici program.

    2 The consortium consists of five facilities that provide training,
    including Fort McClellen, Ala., New Mexico Institute of Mining and
    Technology, Texas A& M University, Louisiana State University, and the
    Nevada Test Site.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 92 GAO- 01- 822 Combating Terrorism

    Several other federal organizations offer courses that are not directed
    specifically at responding to WMD incidents, but provide first responders
    with valuable skills and knowledge in handling hazardous materials. For
    example, the EPA offers several courses in how to handle incidents involving
    hazardous materials and DOE offers several courses aimed at handling the
    consequences of radiological incidents. In addition, HHS? National Institute
    for Occupational Safety and Health offers training to the health community
    in areas such as hazardous materials. Many of these courses are related to
    the agencies? core mission and basic functions independent of combating
    terrorism.

    Through these programs, thousands of first responders have been trained and
    now have a greater awareness of how to respond to a potential chemical or
    biological terrorist incident. For example, local officials credited DOD?s
    Domestic Preparedness Program with bringing local, state, and federal
    regional emergency response agencies together into a closer working
    relationship. As of October 1, 2000 (when the Department of Justice took
    over the program), DOD had completed training in 105 cities that included 4
    days of training plus a chemical tabletop exercise. In addition, 68 of those
    105 cities also received additional training, which included delivery of
    equipment plus a chemical field exercise and a biological tabletop exercise.
    Table 6 shows the number of first responders trained by DOD, the Department
    of Justice, and FEMA.

    Table 6: State and Local Responders Receiving Federal WMD Training, Fiscal
    Years 1998 to 2001 Federal WMD Training Program FY 1998 FY 1999 FY 2000 FY
    2001 Total

    Department of Justice Metropolitan Firefighters and Emergency Medical
    Services Program 24,955 20,925 4,221 1,695 51,796 Department of Justice
    National Domestic Preparedness Consortium 49 2,022 9,375 14,059 25,505
    Department of Defense/ Department of Justice Domestic Preparedness Program
    9,348 9,119 9,077 630 28,174 FEMA National Fire Academy and Emergency
    Management Institute 43,759 51,693 40,982 31,891 168,325 Total 78,111 83,759
    63,655 48,275 273,800

    Note: Fiscal year 1998- 2000 data are complete. Department of Justice data
    for fiscal year 2001 are through August 31, 2001; and FEMA data for fiscal
    year 2001 are through July 31, 2001. All Domestic Preparedness Program
    training for fiscal years 1998- 2000 was conducted by DOD; thereafter, by
    the Department of Justice.

    Source: Data from DOD, the Department of Justice, and FEMA.

    Figure 10 shows the status of 53 remaining cities that are receiving
    Domestic Preparedness Program first responder training. These 53 cities
    represent the number of the original 120 cities that remained after DOD

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 93 GAO- 01- 822 Combating Terrorism

    transferred the program to the Department of Justice on October 1, 2000. As
    shown by the map, about two- thirds of the cities have completed the initial
    training and have begun the exercise phase. The remaining one- third of the
    cities have initiated the training phase, but have not begun the exercise
    phase. Phase I initial training includes 4 days of training and a 1- day
    chemical tabletop exercise. Phase II consists of equipment support and
    exercises.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 94 GAO- 01- 822 Combating Terrorism

    Figure 10: Status of 53 Remaining Cities Receiving Domestic Preparedness
    Program First Responder Training

    Note: Data are current as of August 31, 2001. Source: Department of Justice.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 95 GAO- 01- 822 Combating Terrorism

    Figure 11 shows an intergovernmental exercise in which federal, state, and
    local emergency responders exercised together.

    Figure 11: Salt Lake City, Utah, Fire Department Personnel Treat ?Victim?
    During Wasatch Rings Exercise in Preparation for the 2002 Olympic Winter
    Games

    Source: GAO.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 96 GAO- 01- 822 Combating Terrorism

    As we reported earlier, some WMD training programs initially failed to
    leverage existing state and local response mechanisms. 3 DOD provided
    training to cities without taking advantage of the existing state emergency
    management structures, mutual aid agreements among local jurisdictions, or
    other collaborative arrangement for emergency response. For example,
    California has a Specialized Training Institute that provides emergency
    management training to first responders statewide; in Texas, the state?s
    Division of Emergency Management conducts training for local responders. Use
    of these capabilities and mechanisms could have allowed training
    consolidation and could have resulted in far fewer training sessions.
    Training in fewer locations and taking advantage of existing emergency
    response structures could have hastened the accomplishment of program goals
    and have the added benefit of reinforcing local response integration. Such
    an approach also could have covered a greater percentage of the population
    and make effective use of existing state emergency management training
    venues.

    In taking over the DOD domestic preparedness program, the Department of
    Justice has taken a number of steps to improve the delivery of the program
    to better leverage existing state and local programs. For example, the
    Department plans to modify the former DOD program?s delivery in metropolitan
    areas by requiring cities to include their mutual aid partners in all
    training and exercise activities. The Department also has made the training
    timeline more flexible, to better fit into state and local training
    schedules. In addition, the Department has provided grants to defray
    administrative costs of conducting analysis and planning for the programs.
    Equipment loans from DOD- a source of confusion and frustration among local
    officials over maintenance responsibility and the final disposition of the
    equipment- were converted into a grant program when the Department of
    Justice took over.

    FEMA programs did not appear to have these deficiencies. FEMA already
    leveraged state and local mechanisms by delivering numerous courses through
    and in cooperation with state and local fire training academies and
    emergency managers.

    Our earlier reports also found that federal assistance programs were
    overlapping and potentially duplicative. In a March 2000 report, based

    3 Combating Terrorism: Opportunities to Improve Domestic Preparedness
    Program Focus and Efficiency, (GAO/ NSIAD- 99- 3, Nov. 12, 1998).
    Improvements Made

    in Delivery and Coordination of Assistance

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 97 GAO- 01- 822 Combating Terrorism

    upon an extensive review and comparison of training programs and curriculum,
    we found that federal training programs on WMD preparedness are not well
    coordinated among agencies, resulting in inefficiencies and concerns in the
    first responder communities. 4 The three main agencies at that time- DOD,
    the Department of Justice, and FEMA- were providing similar awareness
    courses as part of their train- the- trainer programs. We recommended that
    DOD, the Department of Justice, and FEMA eliminate their duplicative
    training programs.

    Based upon our previous recommendation, a number of steps have been taken to
    reduce duplication and improve coordination. DOD transferred its Domestic
    Preparedness Program to the Department of Justice starting in fiscal year
    2001. The Department of Justice is integrating the DOD program into its own
    program. It conducted a side- by- side analysis of course content, learning
    objectives, and instructional methods for its existing program and the DOD
    program it took over. The Department of Justice eliminated DOD?s awareness
    course because it duplicated a similar course. The Department of Justice and
    FEMA have coordinated their awareness training courses, with the FEMA course
    being delivered to state training academies and the Department of Justice
    course being delivered to local jurisdictions that have not been reached by
    the state academies.

    Efforts also have increased to coordinate assistance efforts across all
    agencies. The NSC established an interagency working group on Assistance to
    State and Local Authorities to review and guide WMD training and equipment
    programs. Several other agencies involved in training have established a
    Training Resources and Data Exchange working group. This group has initiated
    the development of agreed- upon learning objectives by discipline and
    competency level for federal training efforts. Other efforts include an
    interagency joint course development and review process. According to the
    Department of Justice, this group represents an effort towards the
    elimination of duplicative federal efforts and non- standard federal
    training curriculum. The Department of Justice has set up a centralized
    scheduling desk to help manage the many training and exercise activities in
    which state and local governments participate.

    Despite these changes, state and local officials have expressed concerns
    about duplication and overlap among federal programs for WMD training

    4 Combating Terrorism: Need to Eliminate Duplicate Federal Weapons of Mass
    Destruction Training, (GAO/ NSIAD- 00- 64, Mar. 21, 2000).

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 98 GAO- 01- 822 Combating Terrorism

    and other related courses. Some officials said that the number of federal
    organizations involved in WMD training creates confusion about which federal
    organization is in charge of that training. Department of Justice officials
    believe that their efforts have eliminated confusion among state and local
    officials. However, our recent discussions with state and local officials
    from Colorado and recent testimonies by organizations representing first
    responders, indicate that there still is confusion about federal assistance
    programs. For example, a representative of the International Association of
    Fire Chiefs- a Department of Justice partner for providing training to state
    and local governments- testified that it has been their experience in a
    number of jurisdictions that efforts undertaken to date at the federal
    level, while by themselves valuable, would benefit greatly from an increased
    level of coordination and accountability. According to the Association,
    efforts that may be duplicative or worse, contradictory, lead to confusion
    at the local level and expend precious federal resources unnecessarily. The
    Association said efforts underway at the federal, state, and local levels of
    government ought to be better synchronized for the benefit of public safety.
    At the federal level, there certainly is expertise located in different
    agencies that should be leveraged to create the most effective preparedness
    effort possible. The Association representative believed this could be
    better accomplished by designating one federal official with responsibility
    and authority to coordinate and deliver these programs. The Association has
    in the past requested a single point- of- contact in Washington to whom it
    can turn for answers and provide input. 5

    Groups representing first responders repeatedly called for a single liaison
    in the federal government to provide ?one stop shopping? for federal
    assistance. They said that first responders were confused by the multitude
    of federal programs from different agencies. In response to these concerns,
    the Attorney General established the NDPO in October 1998 under the
    management of the FBI to serve as a single point of contact for state and
    local authorities. NDPO was to be staffed by personnel detailed from a
    variety of federal, state, and local governments with consequence

    5 See Preparedness Against Domestic Terrorism Act of 2001 (H. R. 525),
    Statement by the International Association of Fire Chiefs before the
    Subcommittee on Economic Development, Public Buildings and Emergency
    Management, Committee on Transportation and Infrastructure, U. S. House of
    Representatives, May 9, 2001, pp. 2- 3. Officials from other organizations
    representing first responders, such as the National Emergency Management
    Association and the National League of Cities, made similar comments.
    Federal Liaison for

    State and Local Responders Did Not Meet Expectations

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 99 GAO- 01- 822 Combating Terrorism

    management roles. NDPO was to coordinate federal efforts and resources to
    assist state and local governments in planning, training, exercising, and
    providing equipment to enhance their readiness to respond to a WMD incident.
    NDPO officials have cited a number of accomplishments to include starting a
    state and local advisory group, developing planning guides, and publishing
    an on- scene commander?s guide.

    However, groups representing first responders have said that the NDPO had
    not met their expectations. Our work indicates that there were several
    reasons for NDPO not realizing its original purpose, including the
    following.

     There was insufficient funding for NDPO (it had no direct funding for its
    first 2 years).

     There was little staffing from NDPO?s interagency and intergovernmental
    partners, so the Office lacked key functional expertise.

     There was no consensus on NDPO?s role in relation to other federal
    entities.

     NDPO?s location in the FBI building hampered interaction with first
    responders.

     First responders did not perceive NDPO as independent. In May 2001, the
    President announced the establishment of a new Office of National
    Preparedness in FEMA that will lead the federal government in the oversight,
    coordination, integration, and implementation of domestic preparedness and
    consequence management programs and activities for WMD- related threats. The
    new Office will be expected to coordinate all federal programs to support
    state and local preparedness and consequence management response involving
    planning, training, exercises, research and development, expert advice, and
    equipment acquisition. At the time of our review, FEMA was still planning
    this Office. We believe the creation of this Office is a positive
    development for three reasons. The first reason is that FEMA- as the lead
    agency for consequence management and preparing state and local governments
    for WMD terrorism- is the most logical agency to coordinate these functions.
    The second reason is that the announcement, coming from the President,
    clearly puts FEMA in the lead for this governmentwide matter. Finally, we
    believe the creation of the new Office of National Preparedness within FEMA
    provides the opportunity to consolidate certain programs or offices
    currently run by the Department of Justice and the FBI. However, the
    Department of Justice and the FBI would retain their law enforcement and
    investigative roles and responsibilities. New Office Offers

    Potential to Consolidate Assistance Programs Under FEMA

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 100 GAO- 01- 822 Combating Terrorism

    Establishment of the Office of National Preparedness creates the potential
    to consolidate some Department of Justice assistance programs into FEMA. The
    Department of Justice?s Office for State and Local Domestic Preparedness
    Support provides assistance to state and local governments in the form of
    grants and exercise support. This Department of Justice Office also performs
    substantial liaison with state and local governments when administering its
    grants. In fact, the lead recipients of these Department of Justice grants
    are the state emergency management agencies- the core clients for FEMA?s
    assistance programs. These Department of Justice programs might be more
    appropriately consolidated within FEMA because it is the lead agency for
    domestic preparedness as well as emergency management in general. While it
    is unclear whether the new FEMA Office will administer grants and related
    assistance, having such programs consolidated under FEMA, in proximity to
    its new Office of National Preparedness, may simplify federal assistance
    from the perspective of state and local governments. Conversely, the
    continuance of multiple assistance programs run by FEMA and the Department
    of Justice may continue the current confusion and frustration among the
    first responder community.

    In addition, the creation of the Office of National Preparedness provides
    the opportunity to consolidate the NDPO or its functions into FEMA. As
    stated above, the new FEMA Office will be expected to coordinate all federal
    consequence management programs to support state and local preparedness
    involving planning, training, exercises, expert advice, and equipment
    acquisition. These activities are very similar to the purpose of the NDPO.
    Once the Office of National Preparedness is in place, we believe that the
    continued existence and operations of the NDPO would not be needed. As with
    the Office for State and Local Domestic Preparedness Support, the existence
    of both the NDPO and the new Office of National Preparedness will continue
    to create confusion and frustration among the first responder community. As
    of August 2001, negotiations were ongoing between the Attorney General and
    the Director of FEMA about transferring NDPO?s functions and some of its
    personnel to FEMA?s new Office of National Preparedness. Once the new Office
    is operational, the Department of Justice plans to shut down NDPO.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 101 GAO- 01- 822 Combating Terrorism

    In addition to training and equipping first responders, the federal
    government has provided assistance to state governments by establishing
    specialized National Guard teams, known as Weapons of Mass Destruction Civil
    Support Teams. These teams- originally called Rapid Assessment and Initial
    Detection or ?RAID? teams- were developed to assist state and local
    authorities in responding to a terrorist incident involving weapons of mass
    destruction. Although the federal government funds the teams, they are
    considered state assets operating under the Governor and Adjutant General of
    their state. 6 Twenty- seven teams have been established and the Congress
    has authorized an additional five teams. DOD plans- and officials suggested-
    that there eventually should be a team in each state, territory, and the
    District of Columbia, for a total of 54 teams. At least one state,
    California, has two teams. The teams are composed of 22 full- time members
    of the National Guard, organized into six functional areas. The teams
    include personnel with a military occupational specialty in WMD warfare.

    Earlier GAO and DOD Inspector General reports, as well as our more recent
    observations, indicated there are continued problems with these teams
    regarding their readiness, doctrine, roles compared to other teams, and time
    to deploy. 7 DOD concurred with recent recommendations by its Inspector
    General to address these problems. The specific problems experienced by
    these teams are as follows.

     The readiness of the teams has fallen behind schedule. In the Strom
    Thurmond National Defense Authorization Act for Fiscal Year 1999, the
    Congress required that none of the National Guard teams could be used to
    respond to an emergency unless the Secretary of Defense certifies that the
    team has the requisite skills, training, and equipment to be proficient in
    all mission requirements. According to the DOD Inspector General, the Army?s
    process for certifying the teams lacked rigor and would not provide
    meaningful assurance of their readiness. As a result, the program schedule
    has slipped. Although the first 10 teams originally were

    6 Although the National Guard teams generally would remain as state assets
    when activated in response to a terrorist incident under title 32, they
    could be federalized into the U. S. military under title 10.

    7 Our earlier report was Combating Terrorism: Use of National Guard Response
    Teams Is Unclear (GAO/ NSIAD- 99- 110, May 21, 1999). The DOD Inspector
    General report was

    Management of National Guard Weapons of Mass Destruction- Civil Support
    Teams

    (DOD- IG D- 2001- 043, Jan. 31, 2001). Federally Funded

    National Guard Teams Continue to Experience Problems

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 102 GAO- 01- 822 Combating Terrorism

    scheduled to be fully operational by January 2000, a total of nine teams had
    been certified as operational during July and August 2001.

     The doctrine and role for the teams were not well developed. According to
    the DOD Inspector General, the Army developed doctrine for the teams
    independently, without coordinating with appropriate military and civilian
    organizations. Specifically, the Army developed the doctrine independent of
    the Joint Task Force for Civil Support (which would be the higher
    headquarters for the teams if they were federalized) and the FBI (which
    would act as the lead federal agency during a crisis). The absence of
    finalized doctrine has encouraged and promoted an environment of persistent
    changes to operational concepts and mission requirements. The DOD Inspector
    General recommended that DOD coordinate with the FBI to determine the exact
    roles and missions that the National Guard teams would fulfill.

     The teams? original role of planning for follow- on military assets is now
    done by another organization. Both DOD and the Army have stated that the
    National Guard teams could be used to identify additional military units
    that could provide support in an incident. However, the establishment of the
    Joint Task Force for Civil Support in October 1999 made this task no longer
    necessary for the National Guard teams. The Joint Task Force for Civil
    Support is DOD?s single point for command, control, and advice on DOD
    support to terrorist WMD incidents.

     The team?s role in providing technical assistance overlaps with other
    federal teams. There are numerous other military and federal organizations
    that can help incident commanders deal with WMD by providing advice,
    technical experts, and equipment. As in our earlier review, officials with
    the two agencies responsible for managing the federal response to a
    terrorist incident- the FBI and FEMA- continue to be skeptical about the
    role of the National Guard teams. For example, the head of the FBI?s
    Hazardous Materials Response Unit noted that the FBI unit, not the National
    Guard teams, would be the authoritative source of technical advice on WMD
    matters during crisis management. The FBI official also noted that many of
    the same federal experts from DOD, HHS, and DOE would be providing advice to
    both the National Guard teams and the Hazardous Materials Response Unit.

     The teams? role in providing technical assistance may also overlap with
    state and/ or local teams. There are over 600 local and state hazardous
    materials teams in the United States that daily have to assess and take
    appropriate actions in incidents involving highly toxic industrial chemicals
    and other hazardous materials. Large jurisdictions, for example, usually
    have robust capabilities to deal with hazardous materials. DOD?s plans for
    the National Guard teams did not consider these state and local teams.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 103 GAO- 01- 822 Combating Terrorism

     The teams? deployment times remain uncertain. The original plans for the
    teams were based upon an assumption that they would deploy and arrive
    quickly. Although plans call for the teams to deploy within 4 hours,
    transporting the team to a distant location with its equipment may require
    military airlift. However, there are no plans to arrange for dedicated
    airlift to the teams in case of contingencies. In our earlier review,
    officials at the state and local level cited the importance of the first 2
    hours and thus questioned the benefits of the National Guard teams because
    of potential time lags before they arrive. For example, officials from two
    states indicated that the usefulness of the National Guard teams may have
    been overstated in the recent TOPOFF 2000 exercise because both were
    essentially pre- deployed.

    In our earlier report, we stated that the Congress may wish to consider
    restricting the use of appropriated funds for any additional National Guard
    teams without further assessments. Similarly, the DOD Inspector General
    recommended that DOD conduct a thorough program evaluation of the teams,
    including such areas as operational concept and doctrine. DOD concurred with
    the recommendations of the Inspector General to address these problems and
    is initiating a comprehensive review of the teams. DOD, among other
    corrective actions, has agreed to coordinate the roles of the National Guard
    teams with the FBI. However, our assessment is that, until some of the above
    issues are resolved, the roles and use of these National Guard teams are
    unclear.

    Despite efforts to reduce duplication in assistance programs, there are
    still multiple programs that create confusion among the first responders
    these programs are meant to serve. Based upon our earlier recommendations,
    the Executive Branch has taken steps to reduce duplication and improve
    coordination of assistance programs. However, an attempt to create a single
    liaison for state and local governments through the NDPO was not successful
    for a variety of reasons. The creation of the new Office of National
    Preparedness in FEMA, while leaving the Department of Justice?s Office of
    State and Local Domestic Preparedness Support and FBI?s NDPO programs in
    place, will create additional duplication of effort and more confusion among
    the first responders. The new FEMA Office provides a logical location for
    consolidating federal programs to assist state and local governments,
    including the Office for State and Local Domestic Preparedness Support and
    the NDPO.

    National Guard Weapons of Mass Destruction Civil Support teams continue to
    experience problems with readiness, doctrine and roles, and Conclusions

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 104 GAO- 01- 822 Combating Terrorism

    deployment that could undermine their usefulness in an actual terrorist
    incident. The establishment of any additional teams would be premature until
    DOD has completed its coordination of the teams? roles and missions with the
    FBI- the lead federal agency for crisis management. In our view, such
    coordination will not be complete until there is a written agreement between
    the DOD and the FBI that clarifies the roles of the teams in relation to the
    FBI.

    To eliminate overlapping assistance programs and to provide a single liaison
    for state and local officials, we recommend that the President, working
    closely with Congress, consolidate the activities of the FBI?s National
    Domestic Preparedness Office and the Department of Justice?s Office for
    State and Local Domestic Preparedness Support under the Federal Emergency
    Management Agency.

    To clarify the roles and missions of specialized National Guard response
    teams in a terrorist incident involving weapons of mass destruction, we
    recommend that the Secretary of Defense suspend the establishment of any
    additional National Guard Weapons of Mass Destruction Civil Support Teams
    until DOD has completed its coordination of the teams? roles and missions
    with the FBI. We also recommend that the Secretary of Defense reach a
    written agreement with the Director of the FBI that clarifies the roles of
    the teams in relation to the FBI.

    Agency comments on a draft of this report were based on their efforts prior
    to the September 11, 2001, terrorist attacks. The Department of Justice
    agreed with our recommendation that the NDPO be consolidated into FEMA?s new
    Office of National Preparedness. The Department said it is prepared to
    coordinate the transfer of the functions of that office to FEMA, including
    the detailing of staff as appropriate, once the new Office is operational.

    However, the Department of Justice disagreed with our recommendation that
    its Office for State and Local Domestic Preparedness Support also be
    consolidated into FEMA. According to the Department, shifting the
    facilitation and coordination function to FEMA should not affect its
    programs in the Office of Justice Programs, including the Office for State
    and Local Domestic Preparedness Support. The Department stated that those
    programs ?fit squarely? within the Office of Justice Program?s mission of
    providing grant assistance to state and local governments. We are not
    challenging the basic mission of the Office of Justice Programs to
    Recommendations for

    Executive Action Agency Comments and Our Evaluation

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 105 GAO- 01- 822 Combating Terrorism

    provide grant assistance to state and local governments. However, it is
    important to note that other federal agencies, including FEMA, also provide
    grants to state and local governments. The key question is what agency is
    the most appropriate one to provide such assistance specifically related to
    domestic preparedness. In our view, FEMA is the lead agency for domestic
    preparedness and should, therefore, coordinate and implement such programs.
    Therefore, we continue to believe our recommendation has merit.

    In technical comments that supplemented their letter, officials from the
    Department of Justice and its Office for State and Local Domestic
    Preparedness Support cited additional reasons why they did not agree with
    our recommendation that the Department?s assistance programs be consolidated
    under FEMA. They said that the responsibilities we state for FEMA?s new
    Office of National Preparedness are broader than those announced by the
    President and those agreed upon between FEMA and the Department of Justice.
    They also said that our recommendation was based upon the erroneous
    conclusion that FEMA is the lead agency for preparing state and local
    governments to deal with the consequences of WMD terrorism. These officials
    stated that from both a legal and programmatic perspective, the Department
    of Justice clearly is the lead agency for domestic preparedness and such
    programs are already consolidated there. We disagree. While the
    responsibilities of FEMA?s new Office of National Preparedness are still in
    development, we continue to believe that FEMA is the lead agency for
    preparing state and local governments for the consequences of WMD terrorism.
    8

    Officials from the Office for State and Local Domestic Preparedness Support
    also said that our recommendation was done without any analysis of FEMA?s
    capacity or capability to lead national preparedness efforts. Specifically,
    they said that ?investing domestic preparedness programs responsibilities in
    a sub- Cabinet agency charged with dealing with dozens of disasters and
    emergencies each year places responsibility in an agency that will be
    severely challenged to provide the necessary sustainment and continuity.? We
    disagree with this position because we believe that FEMA?s continuous
    experience in dealing with the consequences of a wide variety of disasters-
    through both preparedness programs and responses

    8 FEMA is responsible for emergency preparedness under 42 U. S. C. chapter
    68. FEMA also has lead responsibilities for emergency preparedness under
    Executive Order 12656 and is responsible for ensuring that state plans are
    adequate and capabilities are tested under PDD 39.

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 106 GAO- 01- 822 Combating Terrorism

    to real incidents- makes it the most appropriate agency to lead national
    preparedness efforts. FEMA officials indicated to us that the new Office of
    National Preparedness would be responsible for providing sustainment and
    continuity to the efforts- by both FEMA and the rest of the federal
    government- to improve national preparedness.

    FEMA indicated that our recommendation to consolidate programs was
    premature. FEMA believes that before any additional mandates or changes are
    placed on the new Office of National Preparedness, it needs a chance to
    accomplish its tasks as put forth by the President- to coordinate federal
    programs dealing with WMD consequence management, working closely with state
    and local governments to ensure that their needs are addressed. FEMA said
    there are no plans to take programs away from other departments or agencies.
    However, officials from FEMA told us they disagreed with the position taken
    by the Office for State and Local Domestic Preparedness Support that the
    Department of Justice, and not FEMA, is the lead agency for preparing state
    and local governments for WMD terrorism. These officials stated that FEMA is
    designated the lead agency, and that the President?s May 8, 2001, statement
    (see app. VII) clearly reinforces FEMA?s lead role.

    Although the Department of Justice and FEMA did not support our
    recommendation, we still believe it has merit. Consolidation of DOD?s
    programs to the Department of Justice simplified the delivery of assistance
    and resulted in reduced duplication. Further consolidation under FEMA- the
    lead agency for domestic preparedness- could simplify and coordinate these
    programs even more. Contrary to Department of Justice assertions, confusion
    still exists among first responders regarding the multitude of federal
    agencies involved. Organizations representing first responders still are
    calling for a single coordination point. In addition, the fundamental
    disagreement between the Department of Justice and FEMA as to which agency
    is the lead for national preparedness reinforces our recommendations that a
    single focal point is needed above the level of individual agencies (see ch.
    2) and our recommendation above that preparedness programs should be
    consolidated.

    The Department of Defense concurred with GAO?s recommendation that the
    Secretary of Defense suspend the establishment of any additional National
    Guard Weapons of Mass Destruction Civil Support Teams until the Department
    has completed its coordination of the teams? roles and missions with the
    FBI. Finally, the Department concurred with GAO?s recommendation that the
    Secretary of Defense reach a written agreement with the Director of the FBI
    that clarifies the roles of the teams in relation

    Chapter 5: Federal Assistance to State and Local Governments Can Be
    Consolidated

    Page 107 GAO- 01- 822 Combating Terrorism

    to the Bureau. FEMA, in its response to a draft of this report, said DOD
    also should consult with FEMA on the role of the Civil Support Teams.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 108 GAO- 01- 822 Combating Terrorism

    In addition to efforts to combat terrorism discussed in chapters 2 through
    5, the federal government has begun to develop and implement a strategy for
    combating the threat of cyber, or computer- based, attacks. Protection
    against cyber attacks requires vigilance against a broader array of threats,
    to include not only terrorists, but nation states, criminals, and others.
    The strategy was outlined in PDD 63, issued in May 1998, which describes a
    plan for protecting the nation?s critical computer- supported
    infrastructures, such as telecommunications, power distribution, financial
    services, national defense, and critical government operations, from
    physical and cyber attacks.

    The computer- based risks to these infrastructures have increased during the
    1990s due to their growing dependence on computers and the greater
    interconnectivity among computers. While no devastating instances of

    ?cyber- terrorism? have occurred, computer- based incidents, such as the
    ILOVEYOU virus in May 2000, have caused significant disruptions and damage.
    In addition, the number of incidents reported has increased dramatically, as
    have the number of computer crime cases opened by the FBI and other law
    enforcement agencies. As a result, government officials are increasingly
    concerned about attacks from individuals and groups with malicious
    intentions.

    In accordance with PDD 63 and other information security requirements
    outlined in laws and federal guidance, an array of efforts has been
    undertaken to address these risks. However, progress in certain key areas
    has been slow. For example, federal agencies have taken initial steps to
    develop critical infrastructure protection (CIP) plans. However, independent
    audits continue to identify persistent, significant information security
    weaknesses at virtually all major federal agencies that place their
    operations at high risk of tampering and disruption. 1 Outreach efforts by
    numerous federal entities to establish cooperative relationships with and
    among private and other non- federal entities have raised awareness and
    prompted information sharing, and the federal government and the private
    sector have initiated a variety of CIP research and development efforts.
    However, substantive analysis of interdependencies within and among industry
    sectors and related vulnerabilities has been limited.

    1 Information Security: Serious and Widespread Weaknesses Persist at Federal
    Agencies,

    (GAO/ AIMD- 00- 295, Sept. 6, 2000). Chapter 6: Limited Progress in
    Implementing

    a Strategy to Counter Computer- Based Threats

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 109 GAO- 01- 822 Combating Terrorism

    An underlying deficiency impeding progress is the lack of a national plan
    that fully defines the roles and responsibilities of key participants and
    establishes interim objectives.

    The risks associated with our nation?s reliance on interconnected computer
    systems are substantial and varied. Attacks could severely disrupt computer-
    supported operations, compromise the confidentiality of sensitive
    information, and diminish the integrity of critical data. A significant
    concern is that terrorists or hostile foreign states could severely damage
    or disrupt critical operations resulting in harm to the public welfare.
    Threats are increasing, in part, because the number of individuals with
    computer skills is increasing and because intrusion, or ?hacking,?

    techniques have become readily accessible through magazines, computer
    bulletin boards, and Internet web sites. In addition, the Director of
    Central Intelligence has stated that some terrorists groups are acquiring
    rudimentary cyber- attack tools. 2 Further, according to the National
    Security Agency, foreign governments already have or are developing computer
    attack capabilities and potential adversaries are developing a body of
    knowledge about U. S. systems and methods to attack these systems. However,
    the sources of and motives behind cyber- attacks often cannot be readily
    determined. This is because groups or individuals can attack remotely from
    anywhere in the world, over the Internet, other networks, or dial- up lines,
    and they can disguise their identity, location, and intent by launching
    attacks across a span of communications systems and computers. As a result,
    efforts to combat such attacks must consider the entire range of threats,
    including criminals intent on fraud and disgruntled employees. Accordingly,
    efforts to protect critical infrastructures from devastating computer- based
    attacks by terrorist and hostile nation states are similar to and must be
    integrated with other federal computer security activities. Figure 12
    provides an overview of the related risks.

    2 Prepared statements by George J. Tenet, Director of Central Intelligence,
    before the Senate Select Committee on Intelligence, Feb. 7, 2001, and Feb.
    2, 2000. Risks of CyberAttacks

    and Related Government Strategy

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 110 GAO- 01- 822 Combating Terrorism

    Figure 12: Risks to Computer- Based Operations

    Source: GAO analysis.

    While complete data are not available because many incidents are not
    reported, available data show that the number of attacks is increasing. The
    number of incidents reported to Carnegie- Mellon University?s CERT

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 111 GAO- 01- 822 Combating Terrorism

    Coordination Center 3 has increased from about 1,300 in 1993 to about 9,800
    in 1999 and to over 21,000 in 2000- figures that the Center estimates may
    represent only about 20 percent of the incidents that are actually occurring
    because most are not detected or reported. Similarly, the FBI reports that
    its caseload of computer intrusion- related investigations more than doubled
    from 1998 to 2000. Additionally, other federal law enforcement agencies have
    reported significant increases in the number of computer intrusion- related
    investigations. While PDD 63 covered both physical and computer- based
    threats, federal efforts to meet the directive?s requirements have pertained
    primarily to computer- based threats, since this was an area that the
    leaders of the administration?s critical infrastructure protection strategy
    viewed as needing attention.

    Concerns about computer- based vulnerabilities have been publicly reported
    repeatedly during the 1990s. In 1991, the National Research Council studied
    the issue and reported that ?as computer systems become more prevalent,
    sophisticated, embedded in physical processes and interconnected, society
    becomes more vulnerable to poor system design, accidents that disable
    systems, and attacks on computer systems.? 4 In July 1996, the President?s
    Commission on Critical Infrastructure Protection was established to
    investigate the nation?s vulnerability to both cyber and physical threats.
    The Commission?s October 1997 report, Critical Foundations: Protecting
    America?s Infrastructures, described the potentially devastating
    implications of poor information security from a national perspective. Also,
    since 1996, congressional interest in protecting national infrastructures
    has remained strong and, since 1997- most recently in January 2001- GAO has
    designated information security as a governmentwide high- risk area, in
    reports to the Congress. 5

    3 Originally called the Computer Emergency Response Team (CERT), the CERT
    Coordination Center was established in 1988 by the Defense Advanced Research
    Projects Agency. The center is charged with (1) establishing a capability to
    quickly and effectively coordinate communication among experts in order to
    limit the damage associated with, and respond to, incidents and (2) building
    awareness of security issues across the Internet community.

    4 Computers at Risk: Safe Computing in the Information Age, The National
    Research Council, 1991. 5 High- Risk Series: Information Management and
    Technology (GAO/ HR- 97- 9, Feb. 1, 1997); High- Risk Series: An Update
    (GAO/ HR- 99- 1, Jan. 1999); and High- Risks Series: An Update (GAO- 01-
    263, Jan. 2001).

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 112 GAO- 01- 822 Combating Terrorism

    In response to the Commission?s 1997 report, the President issued PDD 63,
    which called for a range of activities to improve federal agency security
    programs, improve the nation?s ability to detect and respond to serious
    attacks, and establish a partnership between the government and private
    sector. The directive called on the federal government to serve as a model
    of how infrastructure assurance is best achieved and designated ?lead

    agencies? to work with private- sector and government entities in each of
    eight infrastructure sectors and five special function areas. PDD 63 further
    stated that the United States would have an initial operating capability by
    the year 2000 and, by 2003, have developed the ability to protect the
    nation?s critical infrastructures from intentional destructive attacks.

    PDD 63 also designated and established entities to provide central
    coordination and support, including

     the National Coordinator for Security, Infrastructure Protection and
    Counterterrorism under the Assistant to the President for National Security
    Affairs, to oversee national policy development and implementation;

     a Critical Infrastructure Coordination Group, made up of senior level
    officials, to coordinate the implementation of PDD 63 with the National
    Coordinator; 6

     the Critical Infrastructure Assurance Office (CIAO), housed in the
    Department of Commerce, to develop a national plan for critical
    infrastructure protection based upon infrastructure plans developed by the
    private sector and federal agencies; and

     the National Infrastructure Protection Center (NIPC) at the FBI as a
    national- level threat assessment, warning, vulnerability, and law
    enforcement investigation and response entity.

    To facilitate private- sector participation, PDD 63 also encouraged creation
    of information sharing and analysis centers (ISAC) that could serve as
    mechanisms for gathering, analyzing, appropriately sanitizing, and
    disseminating information to and from infrastructure sectors and the NIPC.
    Figure 13 shows the responsibilities outlined in PDD 63.

    6 In February 2001, the Critical Infrastructure Coordination Group was
    replaced with the Information Infrastructure Protection and Assurance Group
    under the Policy Coordinating Committee on Counter- terrorism and National
    Preparedness.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 113 GAO- 01- 822 Combating Terrorism

    Figure 13: CIP Responsibilities Outlined by PDD 63

    Source: CIAO.

    Federal entities have long been required to protect their computer systems
    and data. However, since 1998, a number of new activities have been
    initiated in response to the growing risks to critical operations and to
    respond to computer- based incidents. Key efforts include the following:

     The federal Chief Information Officers and the Chief Financial Officers
    Councils, under the auspices of OMB, have sponsored a number of activities,
    including security conferences, best practices initiatives, and distribution
    of model policies. Also, during 2000, the Chief Information Officers Council
    sponsored development of the Federal Information Technology Security
    Assessment Framework as a tool for measuring the Despite Increased

    Efforts, Critical Federal Operations Remain at Risk

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 114 GAO- 01- 822 Combating Terrorism

    completeness and effectiveness of agencies? information security programs.

     The CIAO, as required in PDD 63, coordinated development of the

    National Plan for Information Systems Protection: Version 1.0: An Invitation
    to a Dialogue, which the White House released in January 2000. In addition,
    the CIAO has assisted federal agencies in identifying their critical assets
    and associated infrastructure interdependencies through a process referred
    to as Project Matrix. According to the Report of the President of the United
    States on the Status of Federal Critical Infrastructure Protection
    Activities, issued in January 2001, 14 federal departments and agencies had
    been asked to participate in Project Matrix.

     The Federal Computer Incident Response Center (FedCIRC), initially
    established by the National Institute of Standards and Technology in 1996
    and, since 1998, operated by the General Services Administration, has
    coordinated the response to computer incidents of federal civilian agencies.
    In addition, it has provided civilian agencies technical information, tools,
    methods, and guidance; provided a mechanism for sharing information among
    agencies, law enforcement, the private sector and academia; and issued
    advisories.

     The Joint Task Force for Computer Network Defense was established in
    December 1998 by DOD as the primary agent to coordinate and direct the
    department?s efforts to prevent and detect cyber attacks on DOD computers,
    contain damage, and restore computer functionality. 7 Its efforts include
    developing standard tactics, techniques, and procedures for responding to
    cyber incidents and sharing information on cyber threats and attacks.

    Further, the Congress has continued to demonstrate its interest in improving
    the protection of federal operations through hearings and by enacting
    information security reform provisions as part of the Floyd D. Spence
    National Defense Authorization Act for Fiscal Year 2001 that supplement
    requirements outlined in the Paperwork Reduction Act of 1995 and the
    Computer Security Act of 1987 and that are consistent with National
    Institute of Standards and Technology and OMB guidance. These new provisions
    require agencies? information security programs to incorporate a cycle of
    risk management activities that

     assess risks and determine protection needs, 7 In April 2001, the Joint
    Task Force for Computer Network Defense was renamed the Joint Task Force for
    Computer Network Operations.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 115 GAO- 01- 822 Combating Terrorism

     select and implement cost- effective policies and controls,

     promote awareness of risks, policies, and the need for controls, and

     implement a program of routine tests and examinations for evaluating the
    effectiveness of policies and related controls and report the results to
    those who can take appropriate corrective action.

    The new provisions also require annual evaluations of agency information
    security programs by both management and agency inspectors general. The
    results of these reviews, which are initially scheduled to become available
    in late 2001, are expected to provide a more complete picture of the status
    of federal information security than currently exists, thereby providing the
    Congress and OMB an improved means of overseeing agency progress and
    identifying areas needing improvement.

    In addition to these broad efforts, our recent audits have shown that
    individual agencies, including the EPA, the Internal Revenue Service, and
    VA, have taken significant actions to correct identified computer security
    weaknesses and improve their information security management programs.
    Further, according to the President?s Status Report, the DOD has initiated
    efforts to bolster its encryption capabilities, advance its computer
    forensics capabilities by establishing a lab in September 1999, improve its
    ability to actively defend computer systems, focus attention on
    infrastructures critical to operations by designating lead components, and
    create better relationships between installation commanders and local and
    private sector leaders.

    Despite the many improvements initiated, we reported in September 2000 and
    April 2001 that audits have continued to identify information security
    weaknesses in virtually every major federal agency. 8 These weaknesses place
    a broad array of federal operations and assets at risk of fraud, misuse, and
    disruption. For example, weaknesses at the Department of the Treasury
    increased the risk of fraud and disruption associated with billions of
    dollars of federal payments and collections and weaknesses at DOD increase
    the vulnerability of various military operations. These weaknesses also
    place enormous amounts of confidential data, ranging from personal and tax
    data to proprietary business information, at risk of inappropriate
    disclosure.

    8 (GAO/ AIMD- 00- 295) and Computer Security: Weaknesses Continue to Place
    Critical Federal Operations and Assets at Risk (GAO- 01- 600T, Apr. 5,
    2001).

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 116 GAO- 01- 822 Combating Terrorism

    In addition, a March 2001 report by the President?s Council on Integrity and
    Efficiency and the Executive Council on Integrity and Efficiency (PCIE/
    ECIE) identified significant deficiencies in agencies? implementation of PDD
    63 based on reviews conducted by agency inspectors general. 9 For example,
    PDD 63 required federal departments and agencies to establish plans for
    protecting their own critical infrastructure that were to be implemented
    within 2 years, or by May 2000, and it required federal departments and
    agencies to develop procedures and conduct vulnerability assessments.
    However, the PCIE/ ECIE report stated that

     many agency CIP plans were incomplete and some agencies had not developed
    CIP plans,

     most agencies had not completely identified their mission- essential
    infrastructure assets, and

     few agencies had completed vulnerability assessments of their minimum
    essential infrastructure assets or developed remediation plans.

    The PCIE/ ECIE report concluded that the federal government could improve
    its PDD 63 planning and assessment activities and questioned the federal
    government?s ability to protect the nation?s critical infrastructures from
    intentional destructive acts by May 2003, as required in PDD 63.

    The results of our review of PDD 63- related activities at eight lead
    agencies were generally consistent with the PCIE/ ECIE report?s findings,
    although some agencies had made progress since their respective inspectors
    general reviews. For example, while five agencies had or were in the process
    of updating their plans based on inspector general reviews, other
    independent reviews, or more recent initiatives, three were not revising
    their plans to address reported deficiencies. In addition, while most of the
    agencies we reviewed had identified critical assets, many had not completed
    vulnerability assessments on all of their critical assets. For example, one
    agency had not performed vulnerability assessments on 4 of 13 of its
    critical assets. Another department had not supplemented its vulnerability
    assessment procedures to include CIP aspects, such as determining a system?s
    significance to national security. Further, most of

    9 The PCIE primarily is comprised of the presidentially- appointed
    inspectors general and the ECIE is primarily comprised of the agency head-
    appointed inspectors general. In November 1999, PCIE and ECIE formed a
    working group to review the adequacy of federal agencies? implementation of
    PDD 63. The March 2001 report is based on reviews by 21 inspectors general
    of their respective agencies? PDD 63 planning and assessment activities.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 117 GAO- 01- 822 Combating Terrorism

    the eight agencies we reviewed had not taken the additional steps to
    identify interdependencies and, as a result, some agency officials said that
    they were not sure which of their assets were critical from a national
    perspective and, therefore, subject to PDD 63. According to a report by the
    CIP Research and Development Interagency Working Group, the effect of
    interdependencies is that a disruption in one infrastructure can spread and
    cause appreciable impact on other infrastructures. 10 The report also stated
    that understanding interdependencies is important because the proliferation
    of information technology has made the infrastructures more interconnected
    and the advent of competition, ?just in time? business, and mergers among
    infrastructure owners and operators have eroded spare infrastructure
    capacity.

    We identified several factors that had impeded federal agency efforts to
    comply with PDD 63. First, no clear definitions have been developed to guide
    development and implementation of agency plans and measure performance. For
    example, PDD 63 established December 2000 as the deadline for achieving an
    initial operating capability and May 2003 for achieving full operational
    capability of key functions. However, the specific capabilities to be
    achieved at each milestone had not been defined. The PCIE/ ECIE report noted
    that agencies had used various interpretations of initial operating
    capability and stated that, without a definition, there is no consistent
    measure of progress toward achieving full security preparedness.

    Several agency officials said that funding and staffing constraints
    contributed to their delays in implementing PDD 63 requirements. According
    to one chief information officer, this may be because senior officials do
    not fully understand the importance of their agency?s assets to the nation?s
    critical infrastructures and the magnitude of the related risks. In
    addition, the availability of adequate technical expertise to provide
    information security has been a continuing concern to agencies. Further,
    though we specifically have not analyzed the technical skills of agency
    personnel involved in computer security across government, we have observed
    a number of instances where agency staff did not have the skills needed to
    carry out their computer security responsibilities and were not adequately
    overseeing activities conducted by contractors. Recognizing

    10 Report on the Federal Agenda in Critical Infrastructure Protection
    Research and Development, Research Vision, Objectives, and Programs, CIP
    Research and Development Interagency Working Group, Jan. 2001.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 118 GAO- 01- 822 Combating Terrorism

    the need to improve the government?s ability to attract and retain workers
    and expand training and education opportunities, the Chief Information
    Officers Council established a Federal Information Technology Workforce
    Committee to focus on this issue. In addition, in November 2000, the Office
    of Personnel Management established higher pay for information technology
    workers to give agencies flexibility in addressing recruitment and retention
    problems affecting the government?s information technology workforce. These
    new pay rates became effective in January 2001.

    Finally, since 1996, we have reported that poor security program management
    is an underlying cause of federal information security weaknesses and this
    has diminished agencies? ability to ensure that controls are appropriate and
    effective. 11 Specifically, many agencies have not developed security plans
    for major systems based on risk, documented security policies, and
    implemented a program for testing and evaluating the effectiveness of the
    controls they relied on. As a result, agencies

     were not fully aware of the information security risks to their
    operations,

     had accepted an unknown level of risk by default rather than consciously
    deciding what level of risk was tolerable,

     had a false sense of security because they were relying on controls that
    were not effective, and

     could not make informed judgments as to whether they were spending too
    little or too much of their resources on security.

    For example, audits by us and DOD?s Inspector General have reported that an
    underlying cause of weak information security at DOD is poor security
    management. The Department has taken steps to improve its information
    security- notably, establishing the Defense- wide Information Assurance
    Program under the jurisdiction of the Chief Information Officer and, as
    mentioned earlier, the Joint Task Force for Computer Network Defense.
    However, in March 2001, we reported that a number of challenges faced by
    both programs, including departmentwide planning, data collection and

    11 Information Security: Opportunities for Improved OMB Oversight of Agency
    Practices

    (GAO/ AIMD- 96- 110, Sept. 24, 1996); Information Security: Serious
    Weaknesses Place Critical Federal Operations and Assets at Risk (GAO/ AIMD-
    98- 92, Sept. 23, 1998); and (GAO/ AIMD- 00- 295).

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 119 GAO- 01- 822 Combating Terrorism

    integration, vulnerability assessment procedures, and performance
    management, have limited their progress. 12

    As required by PDD 63, federal entities have taken steps to foster
    cooperative relationships between the federal government and non- federal
    sectors. For example, in December 1999, the CIAO helped establish the
    Partnership for Critical Infrastructure Security as a forum of private-
    sector member companies for raising awareness and understanding of
    crossindustry critical infrastructure issues and as a catalyst for action
    among the owners and operators of the critical infrastructures. As of March
    2001, the Partnership had 51 members from various infrastructure sectors. It
    also had created working groups to address interdependency vulnerability
    assessment; information sharing, awareness, and education; legislation and
    public policy objectives; research and development and workforce
    development; and organization issues/ public private cooperation. Further,
    the CIAO has worked with the audit community to produce and distribute a
    guide for corporate boards on managing information security risks and
    coordinated or sponsored a series of conferences to raise awareness-
    including conferences for the legal community to advance the understanding
    of legal issues associated with information security.

    The NIPC, which is responsible for analysis, warning, and response related
    to cyber incidents, also had made some progress in this area. Specifically,
    in April 2001, 13 we reported that the NIPC had worked to build information-
    sharing relationships with the private sector through the adoption and
    expansion of the InfraGard Program, which started in 1996, to provide a
    secure mechanism for two- way information sharing about intrusion,
    incidents, and system vulnerabilities. By early January 2001, 518 entities
    were InfraGard members- up from 277 members in October 2000. Members
    included representatives from private industry, other government agencies,
    state and local law enforcement, and the academic community. The NIPC also
    had established computer crime squads and teams in the FBI?s 56 field
    offices across the country to support the investigation of the growing
    number of crimes involving attacks on

    12 Information Security: Challenges to Improving DOD?s Incident Response
    Capabilities

    (GAO- 01- 341, Mar. 29, 2001) and Information Security: Progress and
    Challenges to an Effective Defense- wide Information Assurance Program (GAO-
    01- 307, Mar. 30, 2001).

    13 Critical Infrastructure Protection: Significant Challenges in Developing
    National Capabilities (GAO- 01- 323, Apr. 25, 2001). CIP Activities Have

    Raised Awareness and Prompted Information Sharing; However, Substantive
    Analysis of Infrastructure Vulnerabilities Has Been Limited

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 120 GAO- 01- 822 Combating Terrorism

    computers. In addition, as of December 2000, one interagency task force had
    been created to coordinate investigative work and facilitate information
    sharing regarding computer crime with other law enforcement entities.

    We also reported that the NIPC had (1) issued assessments, advisories, and
    alerts to warn the public about identified vulnerabilities, attacks
    underway, and potential attacks and (2) standardized its procedures for
    implementing crisis action teams and developed a detailed concept of
    operations to guide the federal government?s response to computer- based
    attacks. However, the report stated that most of the NIPC?s activities had
    been focused on tactical analysis related to individual cyber incidents or
    notices of recently reported vulnerabilities and that strategic analysis to
    determine the broader implications of individual incidents had been limited.
    We noted that the NIPC faced a number of impediments to developing more
    substantive analytical capabilities, including a lack of a methodology for
    strategic analysis, a lack of needed staff and expertise, and inadequate
    data on infrastructure vulnerabilities. We also identified barriers to
    issuing early warnings, including (1) a lack of a comprehensive
    governmentwide or nationwide framework for promptly obtaining and analyzing
    information on imminent attacks, (2) shortage of skilled staff, (3) the need
    to ensure that the NIPC does not raise undue alarm for insignificant
    incidents, and (4) the need to ensure that sensitive information is
    protected. Finally, we reported that the NIPC?s plans for developing its
    analytical and warning capabilities were fragmented and incomplete.

    To assist in establishing relationships with major infrastructure owners and
    operators, PDD 63 required lead agencies to assign a high- ranking official,
    as an agency sector liaison, to lead efforts in cooperation with the sector
    owners and operators in addressing problems related to critical
    infrastructure protection and, in particular, in recommending components of
    a national infrastructure assurance plan. Similarly, the directive required
    the agency sector liaison officials, after discussions and coordination with
    entities of their infrastructure sector, to identify infrastructure sector
    coordinators to represent their sector. In addition, PDD 63 outlined tasks
    that the lead agencies were to encourage and assist the infrastructure
    sectors in accomplishing, including developing vulnerability education and
    outreach programs, establishing ISACs, performing vulnerability assessments
    of the sectors, and developing related remediation plans.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 121 GAO- 01- 822 Combating Terrorism

    As of March 2001, progress in meeting some of these requirements was well
    underway. Each of the eight lead agencies we reviewed had designated sector
    liaisons, and seven of the eight major infrastructure sectors had identified
    one or more individuals or groups as sector coordinators for their
    respective infrastructure sector. Infrastructure sector coordinators had not
    been selected for the public health services sector because, according to
    officials at the Department of Health and Human Services, the infrastructure
    owners and operators had not been fully identified due to the large and
    diverse communities involved. Also, according to relevant agency and private
    sector officials and the

    President?s Status Report, most infrastructure sectors had planned or held
    education and outreach events, such as workshops, conferences, and industry
    meetings to address broad CIP needs and specific concerns. Further, six
    ISACs within five infrastructures had been established to gather and share
    information about vulnerabilities, attempted intrusions, and attacks within
    their respective infrastructures and to meet specific sector objectives.
    Three of these ISACs- for the telecommunications and electric power
    industries and emergency fire services segment- were based on groups that
    had existed previously. The three other ISACs- for the financial services,
    information technology, and emergency law enforcement sectors- had been
    established since October 1999. In addition, at the time of our audit, the
    formation of at least three more ISACs for various infrastructure segments
    was being discussed.

    However, beyond building partnerships, raising awareness, and improving
    information sharing, substantive, comprehensive analysis of infrastructure
    sector vulnerabilities and development of related remedial plans had been
    limited. While some assessments had been performed for individual sector
    components, these did not necessarily consider the interdependencies within
    and among the infrastructures. For example, within the banking and finance
    sector, most large institutions individually had undergone vulnerability
    assessments. However, a vulnerability assessment of the most important
    banking and finance institutions as a group to identify interdependencies
    and events that could cause a system failure across the infrastructure had
    not occurred. Such sector- wide assessments had not yet been performed
    because sector coordinators were still establishing the necessary
    relationships, identifying critical assets and critical entities, and
    researching and identifying appropriate methodologies. In addition, some
    federal officials stated that their agencies did not have the resources to
    assist in the completion of sector vulnerability assessments. In addition,
    the emergency fire services sector liaison officials told us that a
    sectorwide vulnerability assessment would be impractical due to the
    thousands

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 122 GAO- 01- 822 Combating Terrorism

    of local organizations that would have to participate and the lack of
    national associations or government organizations of fire departments.

    Table 7 shows the status of key CIP efforts in the eight infrastructure
    sectors as of March 2001.

    Table 7: Status of Key CIP Efforts in Eight Infrastructure Sectors
    Infrastructure sector Sector liaisons and

    sector coordinators designated

    Vulnerability assessments and remedial plans developed

    Education and awareness programs implemented

    Information sharing and analysis centers established

    Banking and finance Yes  Some assessments performed

     No remedial plans

     Assessment methodology being researched

     Some efforts

     Sector developing a program

     ISAC formally established in October 1999

    Electric power, oil and gas Yes  Some assessments for

    electric and gas

     No remedial plans

     Some efforts  Electric industry ISAC only

     None for oil and gas Emergency fire services segment Yes  Some
    assessments

    performed

     No remedial plans

     Some training for states and localities

     United States Fire Academy designated March 1, 2001 Emergency law
    enforcement Yes  No assessments

     Methodology being researched

     No remedial plans

     Some meetings to discuss legal issues

     ?Cybercitizen

    Partnership? to raise ethics issues with children

     NIPC designated to act as the sector ISAC in December 2000

    Information and communication Yes  Methodology developed

     No assessments yet performed

     Department of Commerce coordinating with industry and DOD to perform
    regional communications assessments

     No remedial plans

     Some meetings on CIP issues held

     Information Technology ISAC established January 2001

     Telecommunication ISAC function recognized in January 2000

    Public health services Liaison only  No assessment

     No remedial plans

     Some discussions held about performing assessments

     Some meetings on CIP issues held No

    Transportation segments

     Liaison

     Coordinator for rail and aviation only

     No sector assessments

     DOT performed a surface transportation assessment

     No remedial plans

     Some efforts No Water supply Yes  One assessment

    performed

     Methodology being further tested

     No remedial plans

     Some efforts No

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 123 GAO- 01- 822 Combating Terrorism

    Factors cited by the private sector as impeding progress in building the
    necessary government/ private- sector partnerships and identifying and
    addressing vulnerabilities included the following:

     Concerns have been raised that organizations potentially could face
    antitrust violations for sharing information with other industry partners,
    subject their information to Freedom of Information Act disclosures, or face
    potential liability concerns for information shared in good faith.

     An inadvertent release of confidential business information, such as trade
    secrets or proprietary information, could damage reputations, lower consumer
    confidence, hurt competitiveness, and decrease market shares of firms.
    Further, the private sector may have reservations about sharing information
    with law enforcement agencies because compliance with law enforcement
    procedures can be costly.

     Some senior executives are not fully aware of the importance of their
    assets to the national and economic security of the nation.

     Due to the complexity and breadth of some infrastructures, organizations
    and entities that could coordinate CIP efforts across the infrastructure do
    not exist.

    In addition, PDD 63 called for a plan to expand international cooperation on
    critical infrastructure protection and designated the Department of State as
    the lead agency in this area. According to Department of State officials and
    the President?s Status Report on CIP, an international strategy is being
    implemented that coordinates CIP outreach to other governments and
    international intergovernmental organizations and promotes CIP awareness,
    vigilance in security standards and practices, and law enforcement
    cooperation. As part of this strategy, the Department of State had organized
    meetings with key allies to discuss common issues related to infrastructure
    protection. Also, according to agency officials, in early 2001, the
    Department of State developed a United Nations Resolution on cyber- crime,
    which passed unanimously in the United Nations General Assembly and, as of
    March 2001, was developing follow- up actions. In addition, Department of
    Justice officials were negotiating a Council of Europe convention intended
    to facilitate international law enforcement issues related to computer crime
    and, as of March 2001, this treaty still was being negotiated. The
    Department of Justice also chairs the G- 8 High Tech Crime Subgroup that is
    focused on enhancing law enforcement?s abilities to prevent, investigate,
    and prosecute high- tech crime. 14 Further,

    14 Eight major industrialized countries comprise the G- 8, which includes
    Canada, France, Germany, Italy, Japan, Russia, the United Kingdom, and the
    United States.

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 124 GAO- 01- 822 Combating Terrorism

    Department of Commerce officials had participated in meetings with
    representatives from other countries to discuss and negotiate CIP issues,
    including the Council of Europe treaty.

    The National Plan recognized that a vigorous and effective program for CIP
    research and development should seek to enhance security by rapidly
    identifying, developing, and facilitating the fielding of technological
    solutions to existing and emerging infrastructure threats and
    vulnerabilities. According to PDD 63, OSTP is responsible for coordinating
    research and development efforts through the National Science and Technology
    Council. In January 2001, the CIP Research and Development Interagency
    Working Group, tasked by the National Science and Technology Council?s
    Committee on National Science and Technology and the Critical Infrastructure
    Coordination Group, identified eight priority research and development
    areas:

     establishment of an Institute for Information Infrastructure Protection;

     education and training of research personnel;

     interdependency analyses;

     threat, vulnerability, and risk assessment studies;

     system protection and information assurance;

     reconstitution of damaged or compromised systems;

     security of automated infrastructure control systems; and

     intrusion detection and monitoring. Assessing the extent to which these
    priorities are being addressed was not within the scope of our review.
    However, we identified a variety of research and development efforts that
    were either being planned or performed by federal entities and, in some
    cases, were being sponsored by the infrastructure sectors. These included
    the following:

     The National Institute of Standards and Technology has established the CIP
    Grants Program to fund research to provide commercial solutions to
    information technology security problems central to critical infrastructure
    protection that are not being adequately addressed. According to Department
    of Commerce officials, this initial funding is inadequate to address the
    scope and breadth of CIP research challenges.

     As part of a Department of Energy proposal to conduct nine complementary,
    interrelated CIP research and development programs encompassing analysis and
    risk management and protection and mitigation, work is underway to (1)
    develop energy infrastructure interdependencies analysis methodologies and
    tools and (2) develop and Many Research and

    Development Efforts Are Underway

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 125 GAO- 01- 822 Combating Terrorism

    leverage databases, methodologies, and tools to evaluate consequences of
    disruptions and processes for restoration.

     The Department of Transportation has ongoing projects to analyze the
    vulnerabilities of the Global Positioning System and identify cyber-
    security gaps in transportation information systems. In addition, the
    Department, under the National Science and Technology Council, has
    formulated a transportation infrastructure assurance research and
    development plan with the goal of developing a comprehensive approach to
    assessing threats to the nation?s transportation system and preparing
    projects that provide solutions to these threats. The plan addresses
    security of vital communications, navigation, and information systems and
    networks.

     The Carnegie- Mellon CERT Coordination Center has ongoing research and
    development efforts pertaining to development of a risk assessment
    methodology-? OCTAVE? (Operationally Critical Threat, Asset, and
    Vulnerability Evaluation).

     The Banking and Finance Sector?s Research and Development Working Group is
    undertaking projects to (1) model the infrastructure sector to identify
    vulnerabilities and (2) develop forensic tools needed by law enforcement in
    combating electronic crimes and attacks.

     The TSWG, an interagency group to coordinate and conduct research and
    development projects for combating terrorism, has funded efforts to examine
    vulnerabilities associated with specific types of attacks and determining
    the precise locations of critical assets.

     The Defense Advanced Research Projects Agency has supported efforts
    focusing on the security of the Internet and anomaly and misuse detection.

     The Department of State has sponsored international activities to
    coordinate CIP- related research and development with other nations,
    including (1) holding bilateral negotiations and meetings aimed at
    identifying, developing, and facilitating CIP solutions; (2) sponsoring with
    the European Union workshops to exchange information on cybersecurity
    research; and (3) establishing dialogue on telecommunicationsrelated issues.

    According to the CIP Research and Development Interagency Working Group, one
    area that has received almost no attention is identifying the
    interdependencies and cascading effects among infrastructures. The working
    group?s January 2001 report stated that, to address this deficiency, the
    government, the national laboratories, academia, and private industry were
    working to build understanding and tools to address interdependencies,
    including efforts to build test facilities and to learn

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 126 GAO- 01- 822 Combating Terrorism

    about secure operations of complex interactive networks and about various
    aspects of damage caused by earthquakes. 15

    In addition to the impediments previously identified, an underlying
    deficiency in the implementation of the strategy outlined in PDD 63 is the
    lack of a national plan that clearly delineates the roles and
    responsibilities of federal and non- federal entities and defines interim
    objectives. We first identified the need for a detailed plan in September
    1998, when we reported that developing a governmentwide strategy that
    clearly defined and coordinated the roles of new and existing federal
    entities was important to ensure governmentwide cooperation and support for
    PDD 63. 16 At that time, we recommended that OMB and the Assistant to the
    President for National Security Affairs ensure such coordination.

    PDD 63 required, within 180 days, a schedule for the completion of a
    national infrastructure assurance plan with milestones for accomplishing a
    number of tasks that included

     developing vulnerability assessments and related remedial plans,

     establishing a national center to warn of significant events,

     creating a system for responding to significant infrastructure attacks,

     developing an education and awareness program, and

     establishing a research and development program. In January 2000, the
    President issued Defending America?s Cyberspace: National Plan for
    Information Systems Protection: Version 1.0: An Invitation to a Dialogue as
    a first major element of a more comprehensive effort to protect the nation?s
    information systems and critical assets from future attacks. The plan
    proposed achieving the twin goals of making the U. S. government a model of
    information security and developing a publicprivate partnership to defend
    our national infrastructures by achieving three crosscutting infrastructure
    protection objectives:

     minimize the possibility of significant and successful attacks;

     identify, assess, contain, and quickly recover from an attack; and

     create and build strong foundations, including people, organizations, and
    laws, for preparing, preventing, detecting and responding to attacks.

    15 CIP Research and Development Interagency Working Group Report, January
    2001. 16 Information Security: Serious Weaknesses Place Critical Federal
    Operations and Assets at Risk (GAO/ AIMD- 98- 92, Sept. 23, 1998). National
    Plan Is Not

    Fully Developed; Responsibilities Still Are Evolving

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 127 GAO- 01- 822 Combating Terrorism

    However, this plan focused largely on federal CIP efforts, saying little
    about the private- sector role.

    A more complete plan is needed because, although some progress has been made
    in implementing PDD 63, questions have surfaced regarding specific roles and
    responsibilities and the time frames within which objectives are to be met.
    For example, the PCIE/ ECIE reported that several agencies had decided not
    to implement PDD 63 requirements because they believed that they were exempt
    from the directive. As a result, these agencies had not prepared CIP plans,
    identified critical assets, performed related vulnerability assessments, or
    developed remediation plans. However, according to the CIAO, PDD 63
    requirements apply to all departments and agencies. Also, in a recent review
    of the NIPC, we found that various officials involved in critical
    infrastructure protection did not consistently interpret the NIPC?s role.
    Several expressed an opinion that this lack of consensus had hindered the
    NIPC?s progress and diminished support from other federal agencies. In
    addition, without clearly defined interim objectives and milestones, the
    success of efforts to improve federal and non- federal critical
    infrastructure protection cannot be measured. The PCIE/ ECIE report noted
    that, as of March 2001, agencies still needed guidance for measuring their
    progress in identifying critical assets, performing vulnerability
    assessments, and developing and implementing remedial plans.

    The new administration has been reviewing and considering adjustments to the
    government?s CIP strategy that may address these deficiencies. In a May 2001
    White House press statement, it was announced that the administration was
    reviewing how it is organized to deal with information security issues and
    that recommendations would be made on how to structure an integrated
    approach to cyber- security and critical infrastructure protection.
    Specifically, the announcement stated that the White House, federal
    agencies, and private industry had begun to collaboratively prepare a new
    version of the National Plan that would be completed later this year.

    An array of efforts has been undertaken to address risks to the critical
    infrastructures and implement PDD 63 requirements. Many of these efforts
    have built on longstanding efforts to strengthen federal information
    security. However, substantive analysis and related remedial actions to
    protect critical infrastructures have been very limited. In addition, a
    national strategy has not been fully developed for accomplishing CIP goals
    and integrating CIP activities with the established framework of federal
    Conclusions

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 128 GAO- 01- 822 Combating Terrorism

    information security laws and organizational responsibilities. Developing
    such a strategy and gaining both public and private sector support is
    important to ensuring that our nation has the capability to deal with the
    growing threat of computer- based attacks on our nation?s critical
    infrastructures. Meeting the challenges of accomplishing these efforts will
    not be easy and will require clear central direction and dedication of
    expertise and resources from multiple federal agencies.

    We have made scores of recommendations in reports to individual executive
    agencies regarding weaknesses in their individual computer security
    practices, and most agencies have corrective actions underway. Accordingly,
    we are making no additional recommendations to the agencies at this time. In
    addition, in our recent report regarding the progress of the NIPC, we made
    recommendations to the Attorney General and the Assistant to the President
    for National Security Affairs regarding the need to define more fully the
    role and responsibilities of the NIPC, develop plans for establishing
    analysis and warning capabilities, and improve information- sharing
    relationships between the private- sector and federal entities.

    To supplement our previous recommendations, we further recommend that the
    Assistant to the President for National Security Affairs ensure that the
    federal government?s CIP strategy, which is currently under review, define

     specific roles and responsibilities of organizations involved in critical
    infrastructure protection and related information security activities;

     interim objectives and milestones for achieving CIP goals and a specific
    action plan for achieving these objectives, including implementation of
    vulnerability assessments and related remedial plans; and

     performance measures for which entities can be held accountable. We
    believe the federal government?s cyber- security strategy should be linked
    to the national strategy to combat terrorism as discussed in chapter 3.
    However, the two areas are different in that the threats to computerbased
    infrastructures are broader than terrorism and programs to protect them are
    more closely associated with traditional information security activities.
    Recommendations for

    Executive Action

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 129 GAO- 01- 822 Combating Terrorism

    Agency comments on a draft of this report were based on their efforts prior
    to the September 11, 2001, terrorist attacks. In commenting on a draft of
    this report, none of the agencies addressed our recommendation. However, the
    agencies did provide us with comments on their concerns regarding the
    protection of the nation?s critical computer- dependent infrastructures from
    computer- based attacks.

    DOE highlighted two points in the area of critical infrastructure
    protection. First, DOE stated that while computer- based attacks are real
    and viable threats, and in some cases may be interpreted as terrorism, they
    cannot be labeled as such in many instances. Second, DOE raised the concern
    that we should not allow the highly visible cyber issues to overshadow the
    threat of possible physical attacks against other infrastructure elements,
    particularly energy, transportation, and water supply systems. In addition,
    DOE stated that further focus and resources need to be applied to better
    understand the threat and how best to protect, mitigate, respond, and
    recover from attacks against our critical infrastructures. DOE also made
    separate technical comments, which have been incorporated in the report, as
    appropriate.

    The Department of Justice stated that establishing a central authority
    within the Executive Branch for formulating policy regarding computerbased
    attacks on critical infrastructure facilities may help coordinate efforts
    underway in agencies across the federal government. However, the Department
    added that careful consideration should be given to how such central
    authority would be administered, noting that data gathered under criminal
    and intelligence authorities often is carefully prescribed and that court-
    sanctioned criminal and intelligence techniques are subject to different
    legal requirements. The Department made no technical comments related to
    chapter 6.

    HHS provided specific comments on its public health service critical
    infrastructure sector efforts. In particular, HHS stated that it was
    researching a vulnerability assessment methodology, had held some education
    and awareness meetings, was working jointly with the CIAO to develop an
    education and awareness program, and was developing a virtual ISAC. We made
    these changes in the report, as appropriate.

    The Department of Commerce stated that the administration is reviewing the
    organizational structures for counter- terrorism and CIP to provide
    leadership and ensure effective coordination of federal government efforts.
    In addition, the Department said that the administration is committed to
    developing a new National Plan for Critical Infrastructure Agency Comments

    and Our Evaluation

    Chapter 6: Limited Progress in Implementing a Strategy to Counter Computer-
    Based Threats

    Page 130 GAO- 01- 822 Combating Terrorism

    Protection. The Department also provided technical comments, which have been
    incorporated in the report, as appropriate. The Departments of the Treasury
    and Transportation also provided technical comments on the draft of this
    report. We made these changes in the report, as appropriate.

    Despite the lack of agency comments on our recommendation, we still believe
    that it has merit and will supplement our previous recommendations.

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 131 GAO- 01- 822 Combating Terrorism

    Appendix I describes, in chronological order, selected federal interagency
    policy and planning documents related to combating terrorism that form the
    foundation for the federal government?s efforts to combat terrorism and
    protect the nation?s critical infrastructure against attack. These documents
    delineate federal agencies? roles and responsibilities for responding to
    potential or actual terrorist threats or incidents as well as the processes
    and mechanisms by which the federal government mobilizes and deploys
    resources and coordinates assistance to state and local authorities.

    This August 1973 plan provides the organizational structure and procedures
    for preparing for and responding to discharges of oil and releases of
    hazardous substances, pollutants, and contaminants. The plan lists the
    general responsibilities of federal agencies regarding such incidents,
    identifies the fundamental kinds of activities that are performed pursuant
    to the plan, and describes the specific responsibilities of the National
    Response Team, the Regional Response Teams, the National Response Center,
    and the U. S. Coast Guard?s National Strike Force Teams for planning and
    responding to such incidents.

    Federal agencies may conduct consequence management activities in a
    terrorist incident under the National Oil and Hazardous Substances Pollution
    Contingency Plan because it provides authority and funding sources to
    respond to hazardous materials incidents regardless of the suspected cause.
    For example, a terrorist act may at first appear to be a routine hazardous
    materials incident, leading to the activation of a federal response under
    this plan. If the Federal Response Plan is activated, the response actions
    of the National Contingency Plan are conducted as one of the Federal
    Response Plan?s emergency support functions.

    The National Contingency Plan is authorized under section 105 of the
    Comprehensive Environmental Response, Compensation and Liability Act of
    1980, 42 U. S. C. 9605, and 40 Code of Federal Regulations Part 300.

    This November 1988 Executive Order assigns specific responsibilities during
    national security emergencies to federal departments and agencies based on
    extensions of their regular missions. The order also designates the National
    Security Council (NSC) as the principal forum for consideration of national
    security emergency preparedness policy, and instructs the Director of the
    Federal Emergency Management Agency (FEMA) to advise the NSC on issues of
    national security emergency preparedness, including mobilizing preparedness,
    civil defense, continuity Appendix I: Compendium of Relevant

    Federal Policy and Planning Documents National Contingency Plan (National
    Oil and Hazardous Substances Pollution Contingency Plan)

    Executive Order 12656: Assignment of Emergency Preparedness Responsibilities

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 132 GAO- 01- 822 Combating Terrorism

    of government, technological disasters, and other issues. It also directs
    the FEMA Director to assist in the implementation of national security
    emergency preparedness policy by coordinating with other federal departments
    and agencies and with state and local governments.

    The April 1992 Federal Response Plan, as amended, lays out the manner in
    which the federal government, with FEMA coordinating the support/ assistance
    efforts of other agencies, responds to domestic incidents or situations in
    which the President has declared an emergency requiring federal emergency
    disaster assistance. More specifically, the plan outlines the planning
    assumptions, policies, concept of operation, organizational structures, and
    specific assignment of responsibilities to lead departments and agencies in
    providing federal assistance. The plan also categorizes the types of federal
    assistance into specific emergency support functions, such as
    transportation, communications, fire fighting, and health and medical
    services.

    The Terrorism Incident Annex establishes a general concept of operations for
    the federal response to a terrorist incident, including the concurrent
    operation under other plans such as the National Oil and Hazardous
    Substances Pollution Contingency Plan and the Federal Radiological Emergency
    Response Plan.

    The Federal Response Plan is authorized under the Robert T. Stafford
    Disaster Relief and Emergency Assistance Act, 42 U. S. C. 5121 et seq., and
    44 Code of Federal Regulations Subchapters D (Disaster Assistance) and F
    (Preparedness).

    This June 1995 directive sets forth U. S. general policy to use all
    appropriate means to deter, defeat, and respond to all terrorist attacks
    against U. S. interests. More specifically, Presidential Decision Directive
    (PDD) 39 directs federal departments and agencies to take various measures
    to (1) reduce vulnerabilities to terrorism (e. g., to assess the
    vulnerabilities of government facilities and critical national
    infrastructure); (2) deter and respond to terrorism (e. g., to pursue,
    arrest, and prosecute terrorists and to minimize damage and loss of life and
    provide emergency assistance); and (3) develop effective capabilities to
    prevent and manage the consequences of terrorist use of weapons of mass
    destruction. Federal Response

    Plan and Terrorism Incident Annex

    Presidential Decision Directive 39

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 133 GAO- 01- 822 Combating Terrorism

    This May 1996 plan establishes an organizational and operational structure
    for coordinated responses by federal agencies to peacetime radiological
    emergencies, taking into consideration the specific statutory authorities
    and responsibilities of each agency. The plan provides guidance as to which
    agency will lead and coordinate the federal response to a radiological
    emergency (i. e., the lead federal agency). According to the guidance, the
    specific agency depends on the type of emergency involved. For example, the
    Nuclear Regulatory Commission is the lead agency for an emergency that
    occurs at a nuclear facility or any activity licensed by the Commission. The
    plan also identifies the specific roles and responsibilities of each federal
    lead agency, such as responding to requests from state and local governments
    for technical information and assistance.

    This plan may be used whenever any of the signatory agencies respond to a
    radiological emergency, which would include terrorist acts to spread
    radioactivity in the environment. The Federal Response Plan may be
    implemented concurrently with the Federal Radiological Emergency Response
    Plan. The functions and responsibilities of the Federal Radiological
    Emergency Response Plan do not change, except for the coordination that
    occurs between the lead federal agency and the Federal Coordinating Officer
    (usually a FEMA official).

    This May 1998 directive attempts to increase the federal government?s
    effectiveness in countering terrorism threats against U. S. targets. PDD 62
    organizes and clarifies the roles and activities of many agencies
    responsible for combating a wide range of terrorism, including preventing
    terrorist acts, apprehending and prosecuting terrorists, increasing
    transportation security and protecting critical computer- based systems.
    This directive also provides for consequence management of terrorist
    incidents.

    To carry out the integrated program, PDD 62 establishes the Office of the
    National Coordinator for Security, Infrastructure Protection and
    Counterterrorism. Working with the NSC, the National Coordinator is
    responsible for overseeing the wide range of policies and programs covered
    by PDD 62 and is to take the lead in developing guidelines that might be
    needed for crisis management. Federal Radiological

    Emergency Response Plan

    Presidential Decision Directive 62

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 134 GAO- 01- 822 Combating Terrorism

    This May 1998 directive acknowledges computer security as a national
    security risk and established several entities within the NSC, the
    Department of Commerce, and the Federal Bureau of Investigation (FBI) to
    address critical infrastructure protection, including federal agencies?
    information infrastructures. PDD 63 tasks federal agencies with developing
    critical infrastructure protection (CIP) plans and establishing related
    links with private industry sectors. It called for the development of a
    national plan for critical infrastructure protection.

    The December 1998 classified Attorney General?s Five- Year Plan and its
    annual updates are intended to provide a baseline strategy for coordination
    of national policy and operational capabilities to combat terrorism in the
    United States and against American interests overseas. The plan identifies
    several high- level goals aimed at preventing and deterring terrorism,
    facilitating international cooperation to combat terrorism, improving
    domestic crisis and consequence planning and management, improving state and
    local capabilities, safeguarding information infrastructure, and leading
    research and development efforts to enhance counterterrorism capabilities.
    It also identifies the specific tasks federal agencies perform when
    responding to terrorist incidents and sets forth current and projected
    efforts by the Attorney General in partnership with other federal agencies;
    the National Coordinator for Security, Infrastructure Protection and
    Counterterrorism; and state and local entities to improve readiness to
    address the threat of terrorism.

    The January 2000 National Plan for Information Systems Protection provides a
    vision and framework for the federal government to prevent, detect, respond
    to, and protect the nation?s critical cyber- based infrastructure from
    attack and reduce existing vulnerabilities by complementing and focusing
    existing Federal Computer Security and Information Technology requirements.
    Subsequent versions of the plan will (1) define the roles of industry and
    state and local governments working in partnership with the federal
    government to protect privately owned physical and cyber- based
    infrastructures from deliberate attack and (2) examine the international
    aspects of critical infrastructure protection.

    The National Plan for Information Systems Protection is authorized by PDD
    63, which calls for the development of a national plan for information
    system protection to prioritize CIP goals, principles, and long- term
    planning efforts. Presidential Decision

    Directive 63 Attorney General?s Five- Year Interagency Counterterrorism and
    Technology Crime Plan

    National Plan for Information Systems Protection

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 135 GAO- 01- 822 Combating Terrorism

    The November 2000 Domestic Guidelines (Guidelines for the Mobilization,
    Deployment, and Employment of U. S. Government Agencies in Response to
    Domestic Terrorist Threat or Incidence in Accordance With Presidential
    Decision Directive 39) provide a road map for government agencies?
    mobilization, deployment, and use under PDD 39 in response to a terrorist
    threat or incident. The Domestic Guidelines describe specific procedures and
    responsibilities for deploying the Domestic Emergency Support Team,
    particularly in weapons of mass destruction (WMD) incidents, and facilitate
    interagency coordination in support of the lead federal agency?s mission to
    combat terrorism in the United States.

    The January 2001 CONPLAN (U. S. Government Interagency Domestic Terrorism
    Concept of Operations Plan) provides overall guidance to federal, state, and
    local agencies concerning how the federal government would respond to a
    potential or actual terrorist threat or incident that occurs in the United
    States, particularly one involving weapons of mass destruction. The CONPLAN
    outlines an organized and unified capability for a timely, coordinated
    response by federal agencies- specifically, the Department of Justice, the
    FBI, Department of Defense, Department of Energy, FEMA, Environmental
    Protection Agency (EPA), and Department of Health and Human Services- to a
    terrorist threat or act. It establishes conceptual guidelines for assessing
    and monitoring a developing threat, notifying appropriate agencies
    concerning the nature of the threat, and deploying necessary advisory and
    technical resources to assist the lead federal agency in facilitating
    interdepartmental coordination of crisis and consequence management
    activities.

    The January 2001 International Guidelines (Coordinating Subgroup Guidelines
    for the Mobilization, Deployment, and Employment of U. S. Government
    Elements in Response to an Overseas Terrorist Incident) outline procedures
    for deploying the Foreign Emergency Support Team and otherwise coordinating
    federal operations overseas.

    This February 2001 directive communicates presidential decisions concerning
    the national security policies of the United States. It also reiterates the
    role of the NSC system as the process to coordinate executive departments
    and agencies in the effective development and implementation of those
    national security policies. The directive designates the NSC Principals
    Committee as the senior interagency forum for consideration of policy issues
    affecting national security and tasks the Domestic Guidelines

    CONPLAN International Guidelines

    National Security Presidential Directive- 1 (NSPD- 1)

    Appendix I: Compendium of Relevant Federal Policy and Planning Documents

    Page 136 GAO- 01- 822 Combating Terrorism

    NSC Policy Coordination Committees with the management of the development
    and implementation of national security policies by multiple U. S. agencies.
    It also establishes the Policy Coordination Committees and defines their
    roles and responsibilities.

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 137 GAO- 01- 822 Combating Terrorism

    Appendix II describes, in chronological order, selected individual agency
    plans and guidance for combating terrorism that either have been completed
    recently or are being drafted. These documents clarify agencies? roles and
    procedures for responding to terrorist attacks; provide guidance for the
    allocation of resources for planning, exercising, and implementing agency
    plans and programs; and delineate agency strategies for addressing
    terrorism.

    This unclassified directive issued on February 18, 1997, establishes DOD
    policy and assigns responsibility for providing military assistance to civil
    authorities. The employment of U. S. military forces in response to acts or
    threats of domestic terrorism is contingent upon authorization by the
    President as well as approval by the Secretary of Defense. The directive
    does not address non- federalized National Guard assets in support of local
    and/ or state civil agencies approved by the governor.

    The guide includes a Biological Warfare Response Template that addresses
    both crisis and consequence management within five scenarios. States may use
    the template to formulate an integrated approach to biological weapons
    emergency responses. The Biological Weapons Improved Program was initiated
    in 1998 and the final draft of the planning guide was issued on August 1,
    2000. The guide was developed as the result of the Defense Against Weapons
    of Mass Destruction Act of 1996 (P. L. 104- 201, Sept. 23, 1996), which
    required the Secretary of Defense to develop and implement a program to
    improve the responses of federal, state, and local agencies to emergencies
    involving biological and chemical weapons. DOD developed the Biological
    Warfare Improved Response Program and coordinated the associated planning
    guide with the Department of Health and Human Services (HHS), Federal
    Emergency Management Agency (FEMA), the Federal Bureau of Investigation
    (FBI), Environmental Protection Agency (EPA), the Department of Energy
    (DOE), and the Department of Agriculture. Appendix II: Individual Agency
    Plans and

    Guidance for Combating Terrorism Department of Defense

    DOD Directive 3025.15 Military Assistance to Civil Authorities

    Improving Local and State Agency Response to Terrorist Incidents Involving
    Biological Weapons. Interim Planning Guide

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 138 GAO- 01- 822 Combating Terrorism

    The August 10, 2000, memorandum states that some chemical, biological,
    radiological, nuclear, and high- yield explosive incidents may have
    qualitative and quantitative differences from routine incidents. Thus, all
    official requests for DOD support for chemical, biological, radiological,
    nuclear, and high- yield explosive incidents are routed through the
    Executive Secretary of the Department of Defense, who determines if the
    incident warrants special operational management. For incidents not
    requiring special operations, the Secretary of the Army will serve as the
    Executive Agent through the Director of Military Support channels.

    DOD has several contingency plans to address its potential crisis and
    consequence management support roles in both domestic and international
    situations. Some of these are classified.

    The April 1999 document, Design Basis Threat for the Department of Energy
    Programs and Facilities, identifies and characterizes potential adversary
    threats to DOE?s programs and facilities that could adversely affect
    national security, the health and safety of employees, the public, or the
    environment. The document specifically addresses the protection of DOE
    facilities in the United States against terrorist attacks and is coordinated
    with DOD and the Nuclear Regulatory Commission as well as with the
    intelligence community and the FBI. It serves as the foundation for DOE?s
    defensive policies and requirements, including facility protection
    strategies and countermeasures. Management of DOD

    Operational Response to Consequences of Certain Incidents Involving
    Chemical, Biological, Radiological, Nuclear, and High Yield Explosives

    Contingency Plans Department of Energy Design Basis Threat for the
    Department of Energy Programs and Facilities

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 139 GAO- 01- 822 Combating Terrorism

    The June 1996 plan provides a coordinated federal response for urgent public
    health and medical care needs resulting from chemical and/ or biological
    terrorist threats or acts within the United States. The plan supports the
    FBI and FEMA by leading the Emergency Support Function No. 8 response to the
    health and medical aspects of a chemical or biological terrorist incident.
    It also supplements and assists affected state and local governments by
    providing resources from (1) HHS and its supporting federal agencies and
    departments and (2) non- federal sources, such as major pharmaceutical
    suppliers and international disaster response organizations like the
    Canadian Ministry of Health. The plan is an appendix to Emergency Support
    Function No. 8 of the Federal Response Plan. Portions of the plan may be
    implemented under HHS authorities prior to formal implementation of the
    Federal Response Plan.

    The April 1999 plan serves as a tool for infection control professionals and
    healthcare epidemiologists to guide the development of response plans for
    their institutions in preparation for a real or suspected bioterrorism
    attack and encourages institution- specific response plans to be prepared in
    partnership with local and state health departments. The plan is updated as
    needed to reflect public health guidelines and new information.

    The unpublished April 2000 report outlines steps for strengthening public
    health and health care capacity to protect the United States against
    chemical and biological terrorism in cooperation with law enforcement,
    intelligence, and defense agencies in addition to the Centers for Disease
    Control and Prevention (CDC).

    The June 2000 draft manual outlines criteria for implementation of the
    smallpox response plan and CDC vaccine and personnel mobilization
    activities. The draft manual assists state and local health officials with
    specific activities essential for the management of a smallpox emergency.
    Department of Health

    and Human Services Department of Health and Human Services Health and
    Medical Services Support Plan for the Federal Response to Acts of Chemical/
    Biological (C/ B) Terrorism

    Bioterrorism Readiness Plan: A Template for Healthcare Facilities

    Preparedness and Response to Biological and Chemical Terrorism: A Strategic
    Plan

    Centers for Disease Control and Prevention Smallpox Outbreak Response Plan
    and Guidelines

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 140 GAO- 01- 822 Combating Terrorism

    The January 2001 departmental 5- year plan builds on HHS? strategic plan to
    include budget projections for the agencies and offices involved in
    achieving the department?s goals for (1) prevention of bioterrorism; (2)
    infectious disease surveillance; (3) medical and public health readiness for
    mass casualty events; (4) the national pharmaceutical stockpile; (5)
    research and development; and (6) secure and continuously operating
    information technology infrastructure.

    This February 2001 draft- planning guidance is designed to help state public
    health officials determine their role in terrorism response and understand
    the emergency response roles of local health departments and emergency
    management communities. It also may be used to help coordinate efforts among
    state health departments and agencies and organizations at all levels of
    government that would respond to a WMD terrorist event.

    The draft plan describes how HHS will provide coordinated federal assistance
    for public health and medical care needs resulting from terrorist threats or
    acts using weapons of mass destruction within the United States or its
    territories and possessions. The plan encompasses both crisis and
    consequence management responsibilities; describes the essential features
    for a systematic, coordinated and effective national health and medical
    response; and defines procedures for the use of Department resources to
    augment and support state and local governments.

    The December 1999 manual serves as a planning resource for special events
    held within the United States. It provides an overview of the issues FBI
    personnel consider when planning and coordinating support for special events
    and identifies the roles and functions of other federal agencies that often
    support special events. Fiscal Years 2002 and 2006

    Plan for Combating Bioterrorism

    The Public Health Response to Terrorism: Planning Guidance for State Public
    Health Officials, Centers for Disease Control and Prevention.

    U. S. Department of Health and Human Services Counterterrorism Concept of
    Operations Plan

    Department of Justice/ FBI

    National Special Security Events Operations Manual

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 141 GAO- 01- 822 Combating Terrorism

    The December 1999 blueprint discusses the role of the National Domestic
    Preparedness Office as a single coordinating office and information
    clearinghouse for federal assistance programs to prepare state and local
    officials to respond to WMD acts of terrorism within the United States.

    The plan provides guidance to the FBI On- Scene Commander to effectively
    respond to a WMD threat or incident. The plan highlights the FBI?s policy
    for crisis management of WMD terrorist events and delineates specific
    responsibilities of FBI components during a WMD incident. The plan sets out
    procedures and resources available to support the FBI?s investigative and
    crisis management responsibilities.

    This June 2000 interim document provides guidance to the U. S. Coast Guard
    concerning participation in WMD incidents and planning while recognizing
    resource and training shortfalls. It also provides guidance concerning
    command and control and operating procedures.

    The August 2000 plan provides a national framework for current and future U.
    S. Coast Guard program operations and strategies for attaining the Marine
    Safety and Environmental Protection Program?s mission to protect the public,
    the environment, and U. S. economic interests through the prevention and
    mitigation of maritime accidents. The plan aims to reduce the vulnerability
    of the marine transportation system to intentional harm from terrorist acts.
    It also directs the U. S. Coast Guard to achieve a specific readiness level
    in interdiction and consequence management responsibilities concerning the
    use or threat of use of weapons of mass destruction. The Marine
    Transportation System Report submitted to the Congress in September 1999 and
    the President?s Commission on Seaport Crime and Security, along with the
    Oceans Report to the President,

    ?Turning to the Sea: America?s Ocean Future,? provide the blueprint for the
    U. S. Coast Guard to obtain these objectives as part of their responsibility
    for port security. Blueprint for the National

    Domestic Preparedness Office

    Weapons of Mass Destruction Incident Contingency Plan

    Department of Transportation/ U. S. Coast Guard

    Interim Guidance Regarding Coast Guard Response to Weapons of Mass
    Destruction (WMD) Incidents

    U. S. Coast Guard Marine Safety and Environmental Protection Business Plan,
    FY 2001- 2005

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 142 GAO- 01- 822 Combating Terrorism

    The December 2000 document provides guidance for the allocation of resources
    for planning, exercising, and executing the U. S. Coast Guard?s contingency
    preparedness program that includes, but is not limited to, terrorist
    incidents. The guidance seeks to encourage standardization and consistency
    in the U. S. Coast Guard?s contingency preparedness efforts and to help
    focus limited resources toward high- risk contingencies. It directs the U.
    S. Coast Guard to update outdated plans; strengthen ties with federal,
    state, and local governments, and industry to improve coordination during
    responses; develop a 5- year national exercise schedule to anticipate
    planning and resource requirements; and record all exercise after- action
    reports and lessons learned in a centralized U. S. Coast Guard database.

    The January 2000 plan supercedes the 1986 version and represents EPA?s
    current programmatic and operational concepts for responding to radiological
    incidents and emergencies. It is used as a guide for planning and
    maintaining readiness to respond to those releases in accordance with EPA?s
    mission to protect the environment and support the Federal Radiological
    Emergency Response Plan and National Oil and Hazardous Substances Pollution
    Contingency Plan. The plan covers both EPA?s role as a lead federal agency
    for response coordination under the Federal Radiological Emergency Response
    Plan and its role as a lead agency for directing and managing an emergency
    response pursuant to the National Oil and Hazardous Substances Pollution
    Contingency Plan.

    The March 2000 manual serves as a resource for EPA regional and headquarters
    personnel to use during domestic terrorism- related planning or response
    activities. Although the manual is not agency policy, EPA updates it
    periodically. It provides background information on the response framework
    and other agencies? responsibilities and presents details pertaining to the
    specific roles and responsibilities of EPA response personnel during a
    terrorist threat or incident.

    Several annexes provide an overview of EPA?s strategy for addressing
    counterterrorism, including the EPA organizations involved in developing and
    implementing its counterterrorism strategy to protect public health and the
    environment from the threat or adverse effects of nuclear, U. S. Coast Guard

    Contingency Preparedness Program Guidance

    Environmental Protection Agency

    Environmental Protection Agency Radiological Emergency Response Plan

    EPA Regional CounterTerrorism Program Reference Manual including Annexes for
    EPA?s Counterterrorism Planning, Preparedness, and Response Strategy

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 143 GAO- 01- 822 Combating Terrorism

    biological, and/ or chemical substances released during terrorist incidents.
    The annexes also discuss funding for regional counterterrorism activities,
    supporting legal authorities, and interagency counterterrorism workgroups.

    FEMA?s September 1997 Strategic Plan presents three strategic goals that
    support the agency?s mission to reduce the loss of life and property and
    protect U. S. institutions from all hazards by leading and supporting the
    nation in a comprehensive, risk- based emergency management program of
    mitigation, preparedness, response, and recovery. Several of the goals
    address FEMA?s role as the lead agency for consequence management in a
    terrorist incident and describe related activities.

    The June 2000 Terrorism Preparedness Strategic Plan outlines the mission,
    vision, and goals of FEMA?s Terrorism Preparedness Program and supports
    FEMA?s Strategic Plan by clarifying agency goals and objectives related to
    terrorism. The Terrorism Preparedness Strategic Plan presents several goals
    related to mitigation and preparedness. It emphasizes providing guidance on
    FEMA?s roles and responsibilities in terrorism related activities;
    supporting federal, state, and local consequence management planning,
    training, and exercise programs; improving coordination and sharing of
    information at all levels of government; establishing an organizational
    structure for coordinating terrorism preparedness within FEMA; and
    developing systems to monitor and track resources needed to support FEMA?s
    terrorism consequence management programs and activities.

    The August 2000 plan clarifies roles and responsibilities in the
    implementation of FEMA- wide programs and activities in terrorism
    preparedness and supports FEMA?s June 2000 Terrorism Preparedness Strategic
    Plan and overall FEMA Strategic Plan. Under this plan, the Senior Advisor
    for Terrorism Preparedness provides overall direction, coordination, and
    oversight for the implementation of FEMA?s terrorismrelated programs and
    activities. It also sets forth the roles and responsibilities of each of
    FEMA?s directorates that support terrorismrelated consequence management
    activities. Federal Emergency

    Management Agency Strategic Plan Fiscal Year 1998 through Fiscal Year 2007
    With Operational Objectives through Fiscal Year 2003

    FEMA Terrorism Preparedness Strategic Plan

    FEMA Implementation Plan

    Appendix II: Individual Agency Plans and Guidance for Combating Terrorism

    Page 144 GAO- 01- 822 Combating Terrorism

    In April 2001, FEMA issued Attachment G to the State and Local Guide 101 for
    All- Hazard Emergency Operations Planning under the authority of the Robert
    T. Stafford Disaster Relief Act and the Emergency Assistance Act, as
    amended. Issued in September 1996, the State and Local Guide 101 provides
    emergency managers with information on FEMA?s concept for developing risk-
    based, all- hazard emergency operations plans. The voluntary guide provides
    a ?toolbox? of ideas and advice for state and local authorities and
    clarifies the preparedness, response, and short- term recovery planning
    elements that warrant inclusion in state and local emergency operations
    plans.

    Attachment G to the State and Local Guide 101 aids state and local emergency
    planners in developing and maintaining a Terrorist Incident Appendix to
    their Emergency Operations Plan for incidents involving terrorist- initiated
    weapons of mass destruction. Attachment G: Terrorism

    Supplement to the State and Local Guide 101 for All- Hazard Emergency
    Operations Planning

    Appendix III: Selected Federal Crisis Management Response Teams

    Page 145 GAO- 01- 822 Combating Terrorism

    Appendix III lists selected federal crisis management response teams by
    agency. It describes their mission and number of personnel that could be
    deployed. If state and local first responders are unable to manage a weapons
    of mass destruction terrorist incident or become overwhelmed, the incident
    commander can request these and other federal assets.

    Agency/ Team Mission Number of personnel Department of Defense

    U. S. Army 52nd Ordnance Group (Explosive Ordnance Disposal) Trained on
    chemical and nuclear weapons of mass

    destruction and on specialized equipment for diagnostics and render- safe/
    mitigation of a nuclear device.

    Three Explosive Ordnance Disposal companies located in San Diego, CA; San
    Antonio, TX; and Andrews AFB, Washington, D. C. U. S. Army Technical Escort
    Unit Provides field sampling, monitoring, recovery,

    decontamination, transportation, and verification of weaponized and non-
    weaponized chemical and biological materials.

    Approximately 150 military and civilian personnel at Aberdeen Proving
    Grounds, MD; Pine Bluff Arsenal, AR; and Dugway Proving Grounds, UT. Joint
    Special Operations Task Force Determined based upon circumstances.
    Determined based upon

    circumstances.

    Federal Bureau of Investigation

    Critical Incident Response Group (includes Hostage Rescue Team, Crisis
    Negotiation, Crisis Management, and Behavioral Assessment)

    Facilitates rapid response to and management of crisis incidents. Provides
    on- scene commander with rapid response/ support in crisis incidents,
    including crisis negotiations, command post, behavioral assessment, and
    crisis information management.

    Approximately 230, including the Hostage Rescue Team.

    Hostage Rescue Team Deploys to any location within 4 hours and conducts a
    successful rescue operation of persons held by a criminal or terrorist
    force.

    Authorized about 90 personnel at the FBI Academy at Quantico, VA. Special
    Weapons and Tactics (SWAT) Teams Plan and execute high- risk tactical
    operations that

    exceed the capabilities of field office investigative resources. Provide
    management support of SWAT operations.

    Over 1,000 trained personnel in 56 field offices, with nine enhanced SWAT
    teams. Hazardous Materials Response Unit Responds safely and effectively to
    incidents

    involving hazardous materials and develops the FBI?s technical proficiency
    and readiness for crime scene and evidence- related operations in cases
    involving chemical, biological, and radiological materials.

    Headquarters unit plus 17 smaller and less capable units through the United
    States.

    Department of Energy

    Nuclear Emergency Search Team Provides specialized technical expertise in
    resolving nuclear or radiological terrorist incidents. Searches for lost or
    stolen nuclear material, weapons, or devices.

    Varies in size from a five person technical advisory team to a tailored
    deployment of dozens. Basic team consists of seven persons.

    Appendix III: Selected Federal Crisis Management Response Teams

    Appendix III: Selected Federal Crisis Management Response Teams

    Page 146 GAO- 01- 822 Combating Terrorism

    Agency/ Team Mission Number of personnel

    Nuclear/ Radiological Advisory Team Provides technical advice, emergency
    response, and follow- on expertise to the On- Scene Commander.

    Eight- person team. Lincoln Gold Augmentation Team Provides expert technical
    advice to deployable U. S.

    military Explosive Ordnance Disposal operators concerning diagnostics,
    render- safe procedures, weapons analysis, and device modeling and effects
    prediction.

    Five- person team. Joint Technical Operations Team Provides advanced
    technical capabilities to move or

    neutralize nuclear weapons. Thirty one- person team composed of 21 DOE and

    10 DOD personnel, all of whom have other primary duties.

    Department of Health and Human Services

    Domestic Emergency Support Team component Provides technical assistance as
    needed. The size and composition of each team is determined by the type and
    location of the event or threat. National Medical Response Team/ WMD Each
    team provides an operational response

    capability, including a pharmaceutical cache for treating up to 5,000 people
    for chemical weapons exposure.

    The size and composition of each team is determined by the type and location
    of the event or threat.

    Bureau of Alcohol, Tobacco, and Firearms

    National Response Team Assists federal, state, and local investigators in
    meeting the challenges faced at the scenes of significant arson and
    explosives incidents.

    Four teams organized geographically to cover the United States.

    Environmental Protection Agency

    Radiological Emergency Response Team Conducts environmental monitoring,
    performs laboratory analyses, and provides advice and guidance on measures
    to protect the public.

    As many as 60 personnel with these collateral duties are located in Las
    Vegas, NV, and Montgomery, AL.

    Source: GAO analysis and discussions with agency officials.

    Appendix IV: Selected Federal Consequence Management Response Teams

    Page 147 GAO- 01- 822 Combating Terrorism

    Appendix IV lists selected federal consequence management response teams by
    agency. It describes their mission and number of personnel that could be
    deployed. If state and local first responders are unable to manage a weapons
    of mass destruction terrorist incident or become overwhelmed, the incident
    commander can request these and other federal assets.

    Response team Mission Number of team

    (dedicated/ collateral) members and team?s primary location Department of
    Defense

    Joint Task Force for Civil Support Supports lead federal agency, establishes
    command and control of designated Department of Defense (DOD) forces, and
    provides military assistance to civil authorities to save lives, prevent
    human suffering, and provide temporary critical life support.

    Sixty dedicated personnel located at Fort Monroe, VA.

    Chemical/ Biological Rapid Response Team Coordinates and integrates DOD?s
    technical

    assistance for the neutralization, containment, dismantlement, and disposal
    of chemical or biological materials. Assists first responders in dealing
    with consequence management.

    Fourteen dedicated personnel located at Aberdeen Proving Grounds, MD.

    U. S. Army Technical Escort Unit Provides chemical/ biological advice,
    assessment, sampling, detection, field verification, packaging, escort, and
    render- safe for chemical/ biological devices or hazards.

    Approximately 190 personnel located at Aberdeen Proving Grounds, MD; Fort
    Belvoir, VA; Pine Bluff, AR; and Dugway, UT. U. S. Army Special Medical
    Augmentation Response Team- Nuclear/ Biological/ Chemical

    Provides technical advice in the detection, neutralization, and containment
    of chemical, biological, or radiological hazardous materials in a terrorist
    event.

    Six teams located at various sites with six members per team who have these
    collateral duties.

    U. S. Army Special Medical Augmentation Response Team- Aero Medical
    Isolation

    Provides a rapid response evacuation unit to any area of the world to
    transport and provide patient care under conditions of biological
    containment to service members or U. S. civilians exposed to certain
    contagious and highly dangerous diseases.

    Approximately 20 personnel who have this collateral duty are stationed at
    Fort Detrick, MD.

    U. S. Marine Corps Chemical- Biological Incident Response Force Provides
    force protection or mitigation in the event

    of a terrorist incident, domestically or overseas. Three hundred seventy-
    three dedicated personnel at Indian Head,

    MD. U. S. Army Radiological Advisory Medical Team Assists and furnishes
    radiological health hazard

    guidance to the on- scene commander or other responsible officials at an
    incident site and the installation medical authority.

    Eight to 10 personnel who have these collateral duties are located at Walter
    Reed Army Hospital, Washington, D. C.

    Department of Health and Human Services

    Management Support Teams Manage federal medical teams and assets that are
    deployed in response to an incident. Six to eight dedicated personnel

    located at Rockville, MD, supplemented by 18 to 20 Department of Veterans
    Affairs personnel who have these collateral duties.

    Appendix IV: Selected Federal Consequence Management Response Teams

    Appendix IV: Selected Federal Consequence Management Response Teams

    Page 148 GAO- 01- 822 Combating Terrorism

    Response team Mission Number of team

    (dedicated/ collateral) members and team?s primary location

    National Medical Response Teams Decontaminate casualties resulting from a
    hazardous materials incident, provide medical care, and deploy with
    pharmaceutical cache of antidotes and medical equipment.

    Four teams located at Washington, D. C. (non- deployable); WinstonSalem, NC;
    Denver, CO; and Los Angeles, CA, with 36 members per team who have these
    collateral duties. Disaster Medical Assistance Teams Provide emergency
    medical care during a disaster

    or other event. Forty- four teams at various locations nationwide with 34
    members per

    team who have these collateral duties. Disaster Mortuary Operational
    Response Teams Provide identification and mortuary services to state

    and local health officials upon request in the event of major disasters and
    emergencies.

    Ten teams at various locations nationwide with 25 to 31 members per team who
    have these collateral duties. National Pharmaceutical Stockpile Resupplies
    state and local public health agencies

    with pharmaceuticals and other medical supplies in the event of a terrorist
    incident.

    Six rapid response inventories are located at five of six permanent sites.

    Department of Energy

    Radiological Assistance Program Teams Assist federal agencies, state and
    local

    governments, private business, or individuals in incidents involving
    radiological materials.

    Twenty- six teams at various locations nationwide with seven members per
    team who have these collateral duties. Federal Radiological Monitoring and
    Assessment Center a Collects, evaluates, interprets, and distributes offsite
    radiological data in support of the lead federal

    agency, state, and local governments. Coordinates federal resources in
    responding to the off- site monitoring and assessment needs at the scene of
    a radiological emergency.

    Team members deploy in phases. Phases I (15 members) and II (45 members)
    consist of Department of Energy personnel with these collateral duties from
    Nellis Air Force Base, NV, and other locations. Phase III (known as Full
    Federal Radiological Monitoring and Assessment Center) involves multiple
    federal agencies and may have 150 or more personnel from various federal
    agencies. Aerial Measuring System Detects, measures, and tracks ground and
    airborne

    radioactivity over large areas using fixed- wing and rotary- wing aircraft.

    Five to 10 dedicated and collateral duty personnel located at Nellis Air
    Force Base, NV, and Andrews Air Force Base, MD. Radiation Emergency
    Assistance Center/ Training Site Provides medical advice and on- site
    assistance in

    triage, diagnosis, and treatment of all types of radiation exposure events.

    Four to eight dedicated personnel located in Oak Ridge, TN.

    Department of Transportation

    U. S. Coast Guard National Strike Teams Respond to oil and hazardous
    substance pollution

    incidents in and around waterways to protect public health and the
    environment. Area of responsibility includes all Coast Guard Districts and
    Federal Response Regions. Support Environmental Protection Agency?s On-
    Scene Coordinators for inland area incidents.

    Three teams located in Fort Dix, NJ; Mobile, AL; and Novato, CA, with 35 to
    39 dedicated members per team.

    Appendix IV: Selected Federal Consequence Management Response Teams

    Page 149 GAO- 01- 822 Combating Terrorism

    Response team Mission Number of team

    (dedicated/ collateral) members and team?s primary location

    U. S. Coast Guard On- Scene Coordinators Coordinate all containment, removal
    and disposal

    efforts, and resources during a hazardous release incident in coastal or
    major navigational waterways.

    Approximately 50 dedicated personnel in pre- designated Coast Guard regional
    zones at various locations nationwide.

    Department of Veterans Affairs

    Medical Emergency Radiological Response Team Provides technical advice,
    radiological monitoring,

    decontamination expertise, and medical care as a supplement to an
    institutional health care provider.

    Twenty- one to 23 personnel with these collateral duties are located at
    various sites nationwide.

    Environmental Protection Agency

    On- Scene Coordinators Direct response efforts and coordinates all other
    efforts at the scene of a hazardous materials discharge or release.

    Approximately 200 dedicated personnel, plus contractor support, at various
    locations nationwide. Environmental Response Team Provides technical support
    for assessing, managing,

    and disposing of hazardous waste. Twenty- two dedicated personnel, plus
    contractor support, located in

    Edison, NJ, and Cincinnati, OH. Radiological Emergency Response Team
    Provides mobile laboratories for field analysis of

    samples and technical expertise in radiation monitoring, radiation health
    physics, and risk assessment.

    As many as 60 personnel with these collateral duties are located in Las
    Vegas, NV, and Montgomery, AL.

    Federal Emergency Management Agency

    Emergency Response Team Coordinates federal response and recovery activities
    within a state. Size is dependent on the severity and

    magnitude of the incident. Team members with these collateral duties are
    geographically dispersed at Federal Emergency Management Agency headquarters
    and 10 regional offices.

    Nuclear Regulatory Commission

    Regional Incident Response Teams Carry out the responsibilities and
    functions of the lead federal agency during incidents at licensed
    facilities, such as nuclear power plants.

    Four teams located in Atlanta, GA; Lisle, IL; Arlington, TX; and King of
    Prussia, PA, with 25- 30 members per team who have these collateral duties.
    a The Department of Energy has the lead responsibility for coordinating the
    Federal Radiological

    Monitoring Assessment Center during the early phase of an emergency. The
    Environmental Protection Agency assumes control during later phases.

    Source: GAO analysis and discussions with agency officials.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 150 GAO- 01- 822 Combating Terrorism

    Appendix V provides a compendium of selected GAO recommendations for
    combating domestic terrorism made over the last 5 years. This appendix also
    provides the current status of GAO?s prior recommendations.

    Combating Terrorism: Spending on Governmentwide Programs Requires Better
    Management and Coordination (GAO/ NSIAD- 98- 39, Dec. 1, 1997).
    Recommendations, p. 13.

    GAO recommendations Status of recommendations

    We recommend that consistent with the responsibility for coordinating
    efforts to combat terrorism, Assistant to the President for National
    Security Affairs, the National Security Council (NSC), in consultation with
    the Director, Office of Management and Budget (OMB), and the heads of other
    executive branch agencies, take steps to ensure that (1) governmentwide
    priorities to implement the national counterterrorism policy and strategy
    are established; (2) agencies? programs, projects, activities, and
    requirements for combating terrorism are analyzed in relation to established
    governmentwide priorities; and (3) resources are allocated based on the
    established priorities and assessments of the threat and risk of terrorist
    attack.

    Recommendation partially implemented. (1) The Attorney General?s Five- Year
    Counter- Terrorism and Technology Crime Plan, issued in December 1998,
    included priority actions for combating terrorism. According to the NSC and
    OMB, the FiveYear Plan, in combination with Presidential Decision Directives
    (PDD) 39 and 62, represent governmentwide priorities that they use in
    developing budgets to combat terrorism. (2) According to the NSC and OMB,
    they analyze agencies? programs, projects, activities, and requirements
    using the Five- Year Plan and related presidential decision directives. (3)
    According to the NSC and OMB, they allocate agency resources based upon the
    priorities established above. However, there is no clear link between
    resources and threats. No national threat and risk assessment has been
    completed to use for resource decisions. To ensure that federal expenditures
    for terrorism- related activities are well- coordinated and focused on
    efficiently meeting the goals of U. S. policy under PDD 39, we recommend
    that the Director, OMB, use data on funds budgeted and spent by executive
    departments and agencies to evaluate and coordinate projects and recommend
    resource allocation annually on a crosscutting basis to ensure that
    governmentwide priorities for combating terrorism are met and programs are
    based on analytically sound threat and risk assessments and avoid
    unnecessary duplication.

    Recommendation partially implemented. OMB now is tracking agency budgets and
    spending to combat terrorism. According to the NSC and OMB, they have a
    process in place to analyze these budgets and allocate resources based upon
    established priorities. However, there is no clear link between resources
    and threats. No national threat and risk assessment has been completed to
    use for resource decisions.

    Appendix V: Compendium of Relevant GAO Recommendations

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 151 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Opportunities to Improve Domestic Preparedness Program
    Focus and Efficiency (GAO/ NSIAD- 99- 3, Nov. 12, 1998). Recommendations, p.
    22.

    GAO recommendations Status of recommendations

    The Secretary of Defense- or the head of any subsequent lead agency- in
    consultation with the other five cooperating agencies in the Domestic
    Preparedness Program, refocus the program to more efficiently and
    economically deliver training to local communities.

    Recommendation implemented. The Department of Defense (DOD) transferred the
    Domestic Preparedness Program to the Department of Justice on October 1,
    2000. The Department of Justice has implemented this recommendation by
    emphasizing the program?s train- the- trainer approach and concentrating
    resources on training metropolitan trainers in recipient jurisdictions. The
    Secretary of Defense, or the head of any subsequent lead agency, use
    existing state and local emergency management response systems or
    arrangements to select locations and training structures to deliver courses
    and consider the geographical proximity of program cities.

    Recommendation implemented. DOD transferred the Domestic Preparedness
    Program to the Department of Justice on October 1, 2000. The Department of
    Justice has implemented this recommendation by modifying the programs in
    metropolitan areas and requiring cities to include their mutual aid partners
    in all training and exercise activities. The National Coordinator for
    Security, Infrastructure Protection and Counterterrorism actively review and
    guide the growing number of weapons of mass destruction (WMD) consequence
    management training and equipment programs and response elements to ensure
    that agencies? separate efforts leverage existing state and local emergency
    management systems and are coordinated, unduplicated, and focused toward
    achieving a clearly defined end state.

    Recommendation partially implemented. The NSC established an interagency
    working group called the Interagency Working Group on Assistance to State
    and Local Authorities. One function of this working group is to review and
    guide the growing number of WMD consequence management training and
    equipment programs. However, as described in our current report, we believe
    that more needs to be done to ensure that federal efforts are coordinated,
    unduplicated, and focused toward achieving a clearly defined end state- a
    results- oriented outcome as intended for government programs by the Results
    Act. We make a related recommendation in this current report to consolidate
    assistance programs.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 152 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Issues to Be Resolved to Improve Counterterrorist
    Operations (GAO/ C- NSIAD- 99- 3, February 26, 1999). Recommendations, pp.
    38, 39, and 65.

    GAO recommendations Status of recommendations

    The Attorney General direct the Director, FBI, to coordinate the Domestic
    Guidelines and CONPLAN with all federal agencies with counterterrorism roles
    and finalize them. Further, the Domestic Guidelines and/ or CONPLAN should
    seek to clarify federal, state, and local roles, missions, and
    responsibilities at the incident site.

    Recommendation implemented. The Domestic Guidelines were issued in November
    2000. The CONPLAN was coordinated with key federal agencies and was issued
    in January 2001.

    The Secretary of Defense review command and control structures and make
    changes, as appropriate, to ensure there is unity of command to DOD units
    participating in domestic counterterrorist operations to include both crisis
    response and consequence response management and cases in which they might
    be concurrent.

    Recommendation implemented. In May 2001, the Secretary of Defense assigned
    responsibility for providing civilian oversight of all DOD activities to
    combat terrorism and domestic WMD (including both crisis and consequence
    management) to the Assistant Secretary of Defense for Special Operations and
    Low Intensity Conflict. The Secretary of Defense require the services
    produce after- action reports (AAR) or similar evaluations for all
    counterterrorism field exercises that they participate in. When appropriate,
    these AARs or evaluations should include a discussion of interagency issues
    and be disseminated to relevant internal and external organizations.

    Recommendation partially implemented. The Joint After Action Reports
    database contains lessons learned. These reports address interagency issues,
    where appropriate. Many DOD units produce AARs and many of them address
    interagency issues. However, DOD officials acknowledged that service units
    or commands do not always produce AARs and/ or disseminate them internally
    and externally as appropriate. We make a similar recommendation to DOD and
    other agencies in this current report.

    Combating Terrorism: Use of National Guard Response Teams Is Unclear (GAO/
    NSIAD- 99- 110, May 21, 1999). Recommendations, p. 20.

    GAO recommendations Status of recommendations

    The National Coordinator for Security, Infrastructure Protection and
    Counterterrorism, in consultation with the Attorney General, the Director,
    FEMA, and the Secretary of Defense, reassess the need for the Rapid
    Assessment and Initial Detection teams in light of the numerous local,
    state, and federal organizations that can provide similar functions and
    submit the results of the reassessment to the Congress. If the teams are
    needed, we recommend that the National Coordinator direct a test of the
    Rapid Assessment and Initial Deployment team concept in the initial 10
    states to determine how the teams can best fit into coordinated state and
    federal response plans and whether the teams can effectively perform their
    functions. If the teams are not needed, we further recommend that they be
    inactivated.

    Recommendation partially implemented. With authorization from the Congress,
    DOD established additional National Guard teams and changed their names from
    Rapid Assessment and Initial Detection teams to WMD Civil Support Teams.
    However, subsequent to our report and a report by the DOD Inspector General,
    which found some similar problems, DOD has agreed to review the National
    Guard teams and work with other agencies to clarify their roles in
    responding to terrorist incidents. We make a similar recommendation in this
    current report.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 153 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Need for Comprehensive Threat and Risk Assessments of
    Chemical and Biological Attack (GAO/ NSIAD- 99- 163, Sept. 7, 1999).
    Recommendations, p. 22.

    GAO recommendations Status of recommendations

    The Attorney General direct the FBI Director to prepare a formal,
    authoritative intelligence threat assessment that specifically assesses the
    chemical and biological agents that would more likely be used by a domestic-
    origin terrorist- non- state actors working outside a state run laboratory
    infrastructure.

    Recommendation partially implemented. The Federal Bureau of Investigation
    (FBI) agreed with our recommendation. The FBI, working with the National
    Institute of Justice and the Technical Support Working Group, has produced a
    draft threat assessment of the chemical and biological agents that would
    more likely be used by terrorists. Along these lines, we make a similar
    recommendation in this current report. The Department of Justice anticipated
    that a draft of the assessment would be available for interagency review and
    comment in September 2001 and the final assessment would be published in
    December 2001. The Attorney General direct the FBI Director to sponsor a
    national- level risk assessment that uses national intelligence estimates
    and inputs from the intelligence community and others to help form the basis
    for, and prioritize, programs developed to combat terrorism. Because threats
    are dynamic, the Director should determine when the completed national-
    level risk assessment should be updated.

    Recommendation partially implemented. According to the Department of
    Justice, the FBI is in the process of conducting such an assessment. The
    report will assess the current threat, the projected threat, emerging
    threats, and related FBI initiatives. Along these lines, we make a similar
    recommendation in this current report. The Department stated that this
    assessment is being finalized and anticipated that the classified report
    would be published in October 2001.

    Combating Terrorism: Chemical and Biological Medical Supplies are Poorly
    Managed (GAO/ HEHS/ AIMD- 00- 36, Oct. 29, 1999). Recommendations, p. 10.

    GAO recommendations Status of recommendations

    The Department of Health and Human Services? (HHS) Office of Emergency
    Preparedness (OEP) and Centers for Disease Control and Prevention (CDC), the
    Department of Veterans Affairs (VA), and U. S. Marine Corps Chemical-
    Biological Incident Response Force (CBIRF) establish sufficient systems of
    internal control over chemical and biological pharmaceutical and medical
    supplies by (1) conducting risk assessments, (2) arranging for periodic,
    independent inventories of stockpiles, (3) implementing a tracking system
    that retains complete documentation for all supplies ordered, received, and
    destroyed, and (4) rotating stock properly.

    Recommendation partially implemented. All of the agencies have made
    significant progress toward implementing our recommendations. They have
    conducted risk assessments, completed periodic physical inventories of the
    stockpiles, and developed and implemented procedures for stock rotation.
    Each of the agencies is taking steps to replace their current tracking
    systems with ones that are capable of tracking pharmaceutical and medical
    supplies from the time an order is placed until the item is consumed or
    otherwise disposed of.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 154 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Need to Eliminate Duplicate Federal Weapons of Mass
    Destruction Training (GAO/ NSIAD- 00- 64, Mar. 21, 2000). Recommendations,
    p. 25.

    GAO recommendations Status of recommendations

    The Secretary of Defense and the Attorney General eliminate duplicative
    training to the same metropolitan areas. If the Department of Justice
    extends the Domestic Preparedness Program to more than the currently planned
    120 cities, it should integrate the program with the Metropolitan
    Firefighters Program to capitalize on the strengths of each program and
    eliminate duplication and overlap.

    Recommendation partially implemented. DOD transferred the Domestic
    Preparedness Program to the Department of Justice on October 1, 2000. The
    Department of Justice, is attempting to better integrate the assistance
    programs under its management. We make a similar recommendation in this
    current report to further consolidate these programs.

    Combating Terrorism: Federal Response Teams Provide Varied Capabilities;
    Opportunities Remain to Improve Coordination

    (GAO- 01- 14, Nov. 30, 2000). Recommendations, p. 27.

    GAO recommendations Status of recommendations

    To guide resource investments for combating terrorism, we recommend that the
    Attorney General modify the Attorney General?s Five- Year Interagency
    Counterterrorism and Technology Crime Plan to cite desired outcomes that
    could be used to develop budget requirements for agencies and their
    respective response teams. This process should be coordinated as an
    interagency effort.

    Recommendation not implemented. The Department of Justice asserts that the
    current plan includes desired outcomes. As discussed in this report, we
    disagree with the Department and believe what it cites as outcomes are
    outputs- agency activities rather than results the federal government is
    trying to achieve. In this current report, we repeat this recommendation to
    the Attorney General. We also recommend that the President establish a
    single focal point for overall leadership and coordination to combat
    terrorism. If such a focal point is established, then we believe that the
    focal point, and not the Attorney General, should be responsible for
    developing a national strategy. The Director, Federal Emergency Management
    Agency, take steps to require that the Weapons of Mass Destruction
    Interagency Steering Group develop realistic scenarios involving chemical,
    biological, radiological, and nuclear agents and weapons with experts in the
    scientific and intelligence communities.

    FEMA said it will take steps to ensure that the Weapons of Mass Destruction
    Interagency Steering Group works with relevant scientific and intelligence
    communities in developing WMD scenarios.

    The Director, Federal Emergency Management Agency, sponsor periodic
    national- level consequence management field exercises involving federal,
    state, and local governments. Such exercises should be conducted together
    with national- level crisis management field exercises.

    FEMA stated it would support and sponsor periodic national consequence
    management field exercises to ensure better coordination among federal and
    state and local response teams. Along these lines, we make a similar
    recommendation in this current report.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 155 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Accountability Over Medical Supplies Needs Further
    Improvement (GAO- 01- 463, Mar. 30, 2001). Recommendations, pp. 25 and 26.

    GAO recommendations Status of recommendations

    We recommended that the Secretary of Health and Human Services require the
    Director of the Centers for Disease Control and Prevention to

    execute written agreements as soon as possible with all CDC?s partners
    covering the storage, management, stock rotation, and transporting of
    medical supplies designated for treatment of biological or chemical
    terrorism victims;

    issue written guidance on security to private warehouses that store
    stockpiles; and

    install proper fencing, to the extent practical, prior to placing
    inventories at storage locations.

    Recommendation partially implemented. CDC?s National Pharmaceutical
    Stockpile Program has final written agreements in place with most partners
    and anticipates finalizing those under negotiation within the next few
    months. CDC also issued written standard operating procedures that address
    security to its private warehouse partners and installed fencing at all
    locations where inventories are currently stored.

    The Secretary of Health and Human Services require the Director of the
    Office of Emergency Preparedness (OEP) to

    finalize, approve, and issue an inventory requirements list;

    improve physical security at its central location to comply with DEA
    regulations, or move the supplies as soon as possible to a location that
    meets these requirements;

    issue a written policy on the frequency of inventory counts and acceptable
    discrepancy rates;

    finalize and implement approved national and local operating plans
    addressing VA?s responsibilities for the procurement, storage, management,
    and deployment of OEP?s stockpiles;

    train VA personnel and conduct periodic quality reviews to ensure that
    national and local operating plans are followed; and

    immediately contact FDA or the pharmaceutical and medical supply
    manufacturers of items stored at its central location to determine the
    impact of items exposed to extreme temperatures, replace those items deemed
    no longer usable, and either add environmental controls to the current
    location or move the supplies as soon as possible to a climate controlled
    space.

    Recommendation partially implemented. OEP finalized its inventory
    requirements list in February 2001. In June 2001, the supplies stored at the
    central location were moved to a facility that meets security and controlled
    temperature requirements. Pharmaceuticals at the central cache are in the
    process of being potency tested by FDA, and VA has ordered drugs to replace
    those no longer deemed usable. Further, OEP issued written policies on the
    frequency of inventory counts and acceptable discrepancy rates. In March
    2001, OEP issued national and local operating plans to VA and provided
    training and conducted periodic quality reviews to ensure that these plans
    are followed.

    The Commandant of the Marine Corps direct the Marine Corps Systems Command
    to program funding and complete the fielding plan for the CBIRF- specific
    authorized medical allowance list, require the Commanding Officer of the
    CBIRF to adjust its stock levels to conform with this list, and remove
    expired items from stock and replace them with current pharmaceutical and
    medical supplies.

    Recommendation partially implemented. The Marine Corps Systems Command
    programmed funding in June 2001 to cover deficiencies identified in its
    authorized medical allowance list. CBIRF expects to fill these deficiencies
    by October 1, 2001. Further, it removed and destroyed expired items from its
    stock.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 156 GAO- 01- 822 Combating Terrorism

    Critical Infrastructure Protection: Significant Challenges in Developing
    National Capabilities (GAO- 01- 323, Apr. 25, 2001). Recommendations, pp.
    57, 68, and 85.

    GAO recommendations Status of recommendations

    The Assistant to the President for National Security Affairs, in
    coordination with pertinent executive agencies,

     establish a capability for strategic analysis of computer- based threats,
    including developing a related methodology, acquiring staff expertise, and
    obtaining infrastructure data;

     develop a comprehensive governmentwide data- collection and analysis
    framework and ensure that national watch and warning operations for
    computer- based attacks are supported by sufficient staff and resources; and

     clearly define the role of the National Infrastructure Protection Center
    (NIPC) in relation to other government and privatesector entities, including

     lines of authority among the NIPC and the National Security Council,
    Justice, the FBI, and other entities;

     the NIPC?s integration into the national warning system; and

     protocols that articulate how and under what circumstances the NIPC would
    be placed in a support function to either the DOD or the intelligence
    community.

    Recommendation not implemented. The Administration currently is reviewing
    the federal critical infrastructure protection (CIP) strategy. As of July
    2001, no final documents on this strategy had been issued.

    The Attorney General task the FBI Director to require the NIPC Director to
    develop a comprehensive written plan for establishing analysis and warning
    capabilities that integrates existing planning elements and includes

     milestones and performance measures;

     approaches (or strategies) and the various resources needed to achieve the
    goals and objectives;

     a description of the relationship between the long- term goals and
    objectives and the annual performance goals; and

     a description of how program evaluations could be used to establish or
    revise strategic goals, along with a schedule for future program
    evaluations.

    Recommendation not implemented. According to the Director of the NIPC, the
    NIPC has begun developing a plan that incorporates these elements.

    The Attorney General direct the FBI Director to task the NIPC Director to

     ensure that the Special Technologies and Applications Unit has access to
    the computer and communications resources necessary to analyze data
    associated with the increasing number of complex investigations;

     monitor implementation of new performance measures to ensure that they
    result in field offices? fully reporting information on potential computer
    crimes to the NIPC; and

     complete development of the emergency law enforcement plan, after comments
    are received from law enforcement sector members. As the national strategy
    for critical infrastructure protection is reviewed and possible changes
    considered, we recommend that the Assistant to the President for National
    Security Affairs define the NIPC?s responsibilities for monitoring
    reconstitution.

    Recommendation partially implemented. An emergency law enforcement services
    sector plan has been issued.

    Appendix V: Compendium of Relevant GAO Recommendations

    Page 157 GAO- 01- 822 Combating Terrorism

    GAO recommendations Status of recommendations

    The Assistant to the President for National Security Affairs (1) direct
    federal agencies and encourage the private sector to better define the types
    of information that are necessary and appropriate to exchange in order to
    combat computer- based attacks and procedures for performing such exchanges;
    (2) initiate development of a strategy for identifying assets of national
    significance that includes coordinating efforts already underway, such as
    those at DOD and Commerce; and (3) resolve discrepancies between PDD 63
    requirements and guidance provided by the federal Chief Information Officers
    Council regarding computer incident reporting by federal agencies. The
    Attorney General direct the FBI Director to direct the NIPC Director to (1)
    formalize relationships between the NIPC and other federal entities,
    including DOD and the Secret Service, and private- sector ISACs so that a
    clear understanding of what is expected from the respective organizations
    exists; (2) develop a plan to foster the two- way exchange of information
    between the NIPC and the ISACs; and (3) ensure that the Key Asset Initiative
    is integrated with other similar federal activities.

    Recommendation partially implemented. The Administration currently is
    reviewing the federal CIP strategy. As of July 2001, no final documents on
    this strategy had been issued. The NIPC has created the Interagency
    Coordination Cell to foster cooperation across government agencies in
    investigative matters and on matters of common interest and has continued to
    foster better relationships with the information sharing and analysis
    centers.

    Appendix VI: Organizations Visited and Contacted

    Page 158 GAO- 01- 822 Combating Terrorism

    During the course of our review, we visited and/ or contacted officials from
    the following organizations:

     Office of Crisis Planning and Management, Washington, D. C.

     Office of Procurement, Property and Emergency Preparedness, Washington, D.
    C.

     Office of the Chief Information Officer, Washington, D. C.

     Office of the Assistant Secretary of Commerce for Communications and
    Information, National Telecommunications and Information Administration,
    Washington, D. C.

     Critical Infrastructure Assurance Office, Washington, D. C.

     National Institute of Standards and Technology, Information Technology
    Laboratory, Computer Security Division, Gaithersburg, Md.

     Office of the Assistant Secretary of Defense for Command, Control,
    Communications, and Intelligence, Principal Director (Acting), Security and
    Information Operations, Washington, D. C.

     Office of Assistant Secretary of Defense for Command, Control,
    Communications, and Intelligence, Director, Critical Infrastructure
    Protection, Arlington, Va.

     Office of the Assistant Secretary of Defense for Reserve Affairs,
    Washington, D. C.

     Office of the Assistant Secretary of Defense for Special Operations and
    Low Intensity Conflict, Washington, D. C.

     Office of the Deputy Assistant Secretary of Defense for Counterterrorism,
    Plans, and Support, Washington, D. C.

     Office of the Joint Chiefs of Staff, Directorate of Operations (J- 3),
    Chemical, Biological, Radiological, and Nuclear Material, or High- Yield
    Explosive Division, Washington, D. C.

     Defense Advanced Research Projects Agency, Arlington, Va.

     Office of Defense Programs, Germantown, Md.

     Office of Non- Proliferation Research and Engineering, Washington, D. C.

     Office of Security and Emergency Operations, Washington, D. C.

     Office of the Chief Information Officer, Office of the Associate CIO for
    Cyber Security, Washington, D. C. Appendix VI: Organizations Visited and

    Contacted Cabinet Departments and Related Agencies

    Department of Agriculture Department of Commerce

    Department of Defense Department of Energy

    Appendix VI: Organizations Visited and Contacted

    Page 159 GAO- 01- 822 Combating Terrorism

     Office of Critical Infrastructure Protection, Washington, D. C.

     Office of Security Affairs, Germantown, Md.

     Office of Safeguards and Security, Germantown, Md.

     Office of Emergency Operations, Washington, D. C.

     Office of Emergency Management, Washington, D. C.

     Office of Emergency Response, Germantown, Md.

     Office of the Assistant Secretary for Management and Budget, Office of
    Information Resources Management, Washington, D. C.

     Office of Emergency Preparedness, Rockville, Md.

     Centers for Disease Control and Prevention, Atlanta, Ga.

     U. S. Public Health Service, Rockville, Md.

     U. S. Public Health Service, Region VIII, Denver, Colo.

     Office of the Deputy Attorney General, Washington, D. C.

     Criminal Division, Computer Crime and Intellectual Property Section,
    Washington, D. C.

     Justice Management Division, Washington, D. C.

     Office of Justice Programs, Washington, D. C.

     Office for State and Local Domestic Preparedness Support, Washington, D.
    C.

     National Institute for Justice, Washington, D. C.

     Federal Bureau of Investigation, Washington, D. C.

     Counter Terrorism Division, Washington, D. C.

     Domestic Terrorism/ Counterterrorism Planning Section, Washington, D. C.

     Special Events Management Unit, Washington, D. C.

     National Domestic Preparedness Office, Washington, D. C.

     WMD Countermeasures Unit, Washington, D. C. National Infrastructure
    Protection Center, Washington, D. C.

     Critical Incident Response Group, Quantico, Va.

     Crisis Management Unit, Quantico, Va.

     Hazardous Materials Response Unit, Quantico, Va.

     Salt Lake City Field Office, Utah

     Office of the Undersecretary of Management, Bureau of Information Resource
    Management/ Chief Information Officer, Washington, D. C.

     Office of the Under Secretary for Arms Control and International Security
    Affairs, Bureau of Political- Military Affairs, Washington, D. C.

     Office of the Undersecretary for Global Affairs, Bureau for International
    Narcotics and Law Enforcement Affairs, Washington, D. C.

     Office of the Coordinator for Counterterrorism, Washington, D. C.

     Technical Support Working Group, Arlington, Va. Department of Health and

    Human Services Department of Justice

    Department of State

    Appendix VI: Organizations Visited and Contacted

    Page 160 GAO- 01- 822 Combating Terrorism

     Office of the Secretary of Transportation, Washington, D. C.

     Office of Security and Administrative Management, Washington, D. C.

     Office of Intelligence and Security, Washington, D. C.

     Federal Aviation Administration, Office of the Assistant Administrator for
    Information Services and Chief Information Officer, Office of Information
    Systems Security, Washington, D. C.

     Research and Special Programs Administration, Washington, D. C.

     Office of Emergency Transportation, Washington, D. C.

     Office of Innovation, Research and Education, Washington, D. C.

     U. S. Coast Guard, Headquarters, Washington, D. C.

     National Response Center, Washington, D. C.

     Office of the Under Secretary for Enforcement, Washington, D. C.

     Bureau of Alcohol, Tobacco and Firearms, Headquarters, Washington, D. C.

     United States Secret Service, Washington, D. C.

     Major Events Division, Washington, D. C.

     Technical Security Division, Washington, D. C.

     Office of Protective Operations, Olympic Coordinator, Salt Lake City, Utah

     Office of the Assistant Secretary for Financial Institutions, Washington,
    D. C.

     Office of the Deputy Assistant Secretary (Information Systems) and Chief
    Information Officer, Washington, D. C.

     Headquarters, Washington, D. C.

     Office of Emergency Preparedness/ Emergency Management Strategic
    Healthcare Group, Martinsburg, W. Va.

     Office of the Assistant Administrator for Environmental Information,
    Washington, D. C.

     Office of the Assistant Administrator for Water, Office of Ground and
    Drinking Water, Washington, D. C.

     Chemical Emergency Preparedness and Prevention Office, Washington, D. C.

     Region VIII, Denver, Colo.

     National Security Council Staff; National Coordinator for Security,
    Infrastructure Protection and Counterterrorism, Washington, D. C.

     Office of Management and Budget, Headquarters, Washington, D. C.
    Department of

    Transportation Department of the Treasury

    Department of Veterans Affairs

    Other Agencies Environmental Protection Agency

    Executive Office of the President

    Appendix VI: Organizations Visited and Contacted

    Page 161 GAO- 01- 822 Combating Terrorism

     Office of Science and Technology Policy, Headquarters, Washington, D. C.

     Office of the Director, Washington, D. C.

     Information Technology Services, Washington, D. C.

     Office of the Inspector General , Washington, D. C.

     Office of National Security Affairs, Washington, D. C.

     Preparedness, Training, and Exercises Directorate, Washington, D. C.

     Readiness Division, Washington, D. C.

     Program Development Branch, Washington, D. C.

     Response and Recovery Directorate, Washington, D. C.

     Region VIII, Denver, Colo.

     Federal Technology Service, Office of Information Assurance and Critical
    Infrastructure Protection, Washington, D. C.

     Federal Computer Incident Response Center, Washington, D. C.

     Office of the Inspector General, Washington, D. C.

    Tri- County Health Department, Commerce City, Colo.

     Office of Emergency Management, Arapahoe County, Colo.

     Sheriff/ Emergency Law Enforcement Services Sector Coordinator, Arapahoe
    County, Colo.

     Aurora Fire Department, Aurora, Colo.

     Office of Emergency Management, Aurora, Colo.

     Aurora Police Department, Aurora, Colo.

     Buckley Air National Guard Base, Aurora, Colo.

     8th Weapons of Mass Destruction Civil Support Team, Aurora, Colo.

     Denver Police Department, Denver, Colo.

     Department of Environmental Health, Denver, Colo.

     Department of Fire, Denver, Colo.

     Department of Safety, Denver, Colo.

     Office of Health and Emergency Management, Denver, Colo.

     Denver Health, Colo.

     Denver Public Health Department, Denver, Colo.

     Department of Emergency Medicine, Denver, Colo. Federal Emergency

    Management Agency General Services Administration

    State and Local Organizations

    Adams, Arapahoe, and Douglas Counties, Colo.

    Arapahoe County, Colo. Aurora, Colo.

    City and County of Denver, Colo.

    Appendix VI: Organizations Visited and Contacted

    Page 162 GAO- 01- 822 Combating Terrorism

     Colorado Department of Public Health and Environment, Denver, Colo.

     Office of Emergency Management, Department of Local Affairs, Division of
    Local Government, Golden, Colo.

     Rocky Mountain Poison and Drug Center, Denver, Colo.

     Department of Public Safety, Salt Lake City, Utah

     Utah Olympic Public Safety Command, Salt Lake City, Utah

     Banking and Finance Infrastructure Sector Coordinator (a position outlined
    in Presidential Decision Directive 63), in Washington, D. C.

     Financial Services- Information Sharing and Analysis Center, Reston, Va.
    State of Colorado

    State of Utah Private Sector

    Appendix VII: Comments From the Executive Office of the President

    Page 163 GAO- 01- 822 Combating Terrorism

    Appendix VII: Comments From the Executive Office of the President

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix VII: Comments From the Executive Office of the President

    Page 164 GAO- 01- 822 Combating Terrorism

    Now on pp. 83, 85. Now on p. 148.

    Now on p. 34.

    Appendix VII: Comments From the Executive Office of the President

    Page 165 GAO- 01- 822 Combating Terrorism

    Appendix VII: Comments From the Executive Office of the President

    Page 166 GAO- 01- 822 Combating Terrorism

    Appendix VII: Comments From the Executive Office of the President

    Page 167 GAO- 01- 822 Combating Terrorism

    The following are GAO?s comments on the Office of Management and Budget?s
    (OMB) letter dated September 4, 2001, which provided a consolidated response
    from selected offices within the Executive Office of the President,
    including OMB, the Office of Science and Technology Policy, and the National
    Security Council.

    We incorporated the consolidated comments where appropriate throughout the
    report. In addition to the letter reprinted in this appendix, OMB referred
    us to the President?s May 8, 2001, statement about the Vice President?s
    effort related to national preparedness. As a result, we have reprinted that
    statement in this appendix. GAO Comments

    Appendix VIII: Comments From the Department of Agriculture

    Page 168 GAO- 01- 822 Combating Terrorism

    Appendix VIII: Comments From the Department of Agriculture

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix VIII: Comments From the Department of Agriculture

    Page 169 GAO- 01- 822 Combating Terrorism

    Appendix VIII: Comments From the Department of Agriculture

    Page 170 GAO- 01- 822 Combating Terrorism

    The following are GAO?s comments on the Department of Agriculture?s letter
    dated September 5, 2001.

    The Department of Agriculture (USDA) requested that we revise our discussion
    of after- action reports (AARs) in chapter 4. After USDA provided us with
    AARs, we updated table 5 in chapter 4 to indicate that the Department does
    produce evaluations for terrorism- related exercises that it sponsors. USDA
    agrees with the practice of writing AARs, but asked that we delete our
    recommendation to the Secretary of Agriculture because the Department
    already produces AARs for exercises that it sponsors. We continue to believe
    that this is a valid recommendation because the Department also could learn
    valuable lessons when it participates in field exercises sponsored by other
    agencies. We have incorporated this discussion at the end of chapter 4.

    In addition, USDA requested that we revise the report to address the issue
    of terrorism targeted at U. S. agriculture and the role of the Department in
    such incidents. Its letter stated that an attack aimed at the safety of our
    food supply and agricultural infrastructure would cause widespread and long-
    range damage. As our report clearly states, the objectives and scope of our
    report focused on federal efforts to respond to terrorist using WMD directly
    against civilian targets. Therefore, we did not focus on terrorism directed
    against agricultural targets. Consequently, our discussion of USDA was
    limited.

    The Department also requested that we address the issue of terrorism
    targeted at federal government employees, facilities, and programs. Its
    letter stated that there is an increase in the intensity and frequency of
    domestic terrorist incidents aimed at its employees, facilities, and
    programs- particularly those of the Forest Service, Animal and Plant Health
    Inspection Service, and Agricultural Research Service. Again, the objectives
    and scope of this report focused on federal efforts to respond to terrorist
    incidents involving WMD against civilian targets. Therefore, we did not
    focus on terrorism directed against federal government employees and
    programs.

    The Department further requested that we revise the report to include
    agriculture in our discussion of critical infrastructures in chapter 6. The
    objectives and scope of this report focused on the critical infrastructures
    identified by the President?s Commission on Critical Infrastructure
    Protection and the Critical Infrastructure Assurance Office. While we
    recognize the importance of the food supply, agriculture has not been GAO
    Comments

    Appendix VIII: Comments From the Department of Agriculture

    Page 171 GAO- 01- 822 Combating Terrorism

    designated as a critical infrastructure by either group; therefore, it was
    not included in our review.

    The Department provided us with a separate discussion and summary of USDA?s
    capabilities to prepare for and respond to a terrorist incident. Given the
    objectives and scope of our review, we have not reprinted that document in
    this report.

    Appendix IX: Comments From the Department of Commerce Page 172 GAO- 01- 822
    Combating Terrorism

    Appendix IX: Comments From the Department of Commerce

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix IX: Comments From the Department of Commerce Page 173 GAO- 01- 822
    Combating Terrorism

    Now on p. 124. Now on pp. 113- 115.

    Now on p. 112.

    Appendix IX: Comments From the Department of Commerce Page 174 GAO- 01- 822
    Combating Terrorism

    Now on p. 119.

    Appendix IX: Comments From the Department of Commerce

    Page 175 GAO- 01- 822 Combating Terrorism

    The following is GAO?s comment on the Department of Commerce?s letter dated
    September 7, 2001.

    We incorporated the Department?s comments where appropriate in chapter 6.
    GAO Comment

    Appendix X: Comments From the Department of Defense Page 176 GAO- 01- 822
    Combating Terrorism

    Appendix X: Comments From the Department of Defense

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix X: Comments From the Department of Defense Page 177 GAO- 01- 822
    Combating Terrorism

    Now on pp. 18, 104. Now on pp. 17, 86- 87.

    Appendix X: Comments From the Department of Defense

    Page 178 GAO- 01- 822 Combating Terrorism

    The following are GAO?s comments on the Department of Defense?s letter dated
    August 27, 2001.

    We incorporated the Department?s comments where appropriate in chapters 4
    and 5. In addition to the letter reprinted in this appendix, officials from
    the Department provided us with technical comments, which we also
    incorporated where appropriate. GAO Comments

    Appendix XI: Comments From the Department of Energy Page 179 GAO- 01- 822
    Combating Terrorism

    Appendix XI: Comments From the Department of Energy

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XI: Comments From the Department of Energy Page 180 GAO- 01- 822
    Combating Terrorism

    Appendix XI: Comments From the Department of Energy Page 181 GAO- 01- 822
    Combating Terrorism

    Appendix XI: Comments From the Department of Energy Page 182 GAO- 01- 822
    Combating Terrorism

    The following is GAO?s comment on the Department of Energy?s letter dated
    August 27, 2001.

    We incorporated the Department?s comments where appropriate throughout the
    report. GAO Comment

    Appendix XII: Comments From the Department of Health and Human Services

    Page 183 GAO- 01- 822 Combating Terrorism

    Appendix XII: Comments From the Department of Health and Human Services

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XII: Comments From the Department of Health and Human Services

    Page 184 GAO- 01- 822 Combating Terrorism

    Now on p. 57. Now on p. 56.

    Now on p. 55. Now on p. 26.

    Appendix XII: Comments From the Department of Health and Human Services

    Page 185 GAO- 01- 822 Combating Terrorism

    Now on p. 91. Now on pp. 80- 81. Now on p. 80.

    Now on p. 72. Now on p. 71.

    Now on p. 65. Now on p. 65.

    Now on p. 60.

    Appendix XII: Comments From the Department of Health and Human Services

    Page 186 GAO- 01- 822 Combating Terrorism

    Now on p. 148. Now on p. 146.

    Now on p. 122.

    Appendix XII: Comments From the Department of Health and Human Services

    Page 187 GAO- 01- 822 Combating Terrorism

    The following is GAO?s comment on the Department of Health and Human
    Service?s letter dated August 29, 2001.

    We incorporated the Department?s comments where appropriate throughout the
    report. GAO Comment

    Appendix XIII: Comments From the Department of Justice Page 188 GAO- 01- 822
    Combating Terrorism

    Appendix XIII: Comments From the Department of Justice

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XIII: Comments From the Department of Justice Page 189 GAO- 01- 822
    Combating Terrorism

    Appendix XIII: Comments From the Department of Justice Page 190 GAO- 01- 822
    Combating Terrorism

    Appendix XIII: Comments From the Department of Justice Page 191 GAO- 01- 822
    Combating Terrorism

    Appendix XIII: Comments From the Department of Justice

    Page 192 GAO- 01- 822 Combating Terrorism

    The following are GAO?s comments on the Department of Justice?s letter dated
    September 6, 2001.

    Regarding the Department of Justice?s comments on chapter 2 about creating a
    single focal point, on chapter 3 about the Attorney General?s Five- Year
    Plan, on chapter 4 about lessons learned, on chapter 5 about consolidating
    some of its functions under FEMA, and on chapter 6 about computer- based
    threats, we have incorporated its comments as appropriate in those
    respective chapters.

    In addition to the letter in this appendix, the Department of Justice
    provided us with technical comments on our report. The Department?s Office
    for State and Local Domestic Preparedness Support also provided us with
    extensive technical comments and supporting documentation. Because these
    points were not fully addressed in the Department?s letter, we are
    summarizing them below, including our response.

     The Department commented that chapter 1 of our draft report needed to
    clarify its discussion of the concurrency of crisis and consequence
    management and the respective roles of lead and support agencies. We
    incorporated its comments as appropriate.

     The Department commented that chapter 3 of our draft report downplayed the
    significance of its efforts to help states and local governments conduct
    threat and risk assessments. It said that the Department plans to use the
    results of these assessments in deciding how to allocate its equipment,
    training, and exercise program resources consistent with previous GAO
    recommendations. We revised the report to discuss these assessments in more
    detail and to reflect their potential importance. We also separated our
    discussion of state and local- level assessments from our discussion of a
    national- level assessment that the FBI had previously agreed to produce.

     The Department commented that chapter 5 of our draft report did not
    adequately reflect its efforts to reduce duplication and improve the
    delivery and coordination of assistance to state and local governments. The
    Department said it had taken a number of actions to reduce duplication and
    better integrate these programs across the federal government. We updated
    the report to reflect these ongoing efforts. The Department also asserted
    that because of its efforts, state and local first responders are no longer
    confused by the multitude of federal assistance programs. We disagree with
    this point and revised the report by providing additional evidence of
    continued confusion.

     The Department commented that chapter 5 of our draft report incorrectly
    stated that FEMA was the lead agency for preparing state and local GAO
    Comments

    Appendix XIII: Comments From the Department of Justice

    Page 193 GAO- 01- 822 Combating Terrorism

    governments to manage the consequences of WMD terrorism. The Office for
    State and Local Domestic Preparedness Support took the position that the
    Department of Justice, in both legal and programmatic terms, was the lead
    agency for preparing state and local governments for WMD terrorism. We
    disagree with the Office?s position and discuss this issue at the end of
    chapter 5.

    In addition, the Department provided us with an update related to chapter 3
    on our previous recommendations that it develop threat and risk assessments.
    We updated chapter 3 of the report to reflect these efforts and provide the
    Department?s latest milestones for their completion.

    Appendix XIV: Comments From the Department of the Treasury

    Page 194 GAO- 01- 822 Combating Terrorism

    Appendix XIV: Comments From the Department of the Treasury

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XIV: Comments From the Department of the Treasury

    Page 195 GAO- 01- 822 Combating Terrorism

    The following is GAO?s comment on the Department of the Treasury?s letter
    dated September 10, 2001.

    In addition to the letter reprinted in this appendix, the Department
    provided technical comments from the U. S. Secret Service; the Bureau of
    Alcohol, Tobacco and Firearms; and the Office of Enforcement. We
    incorporated these technical comments where appropriate throughout the
    report. GAO Comment

    Appendix XV: Comments From the Department of Veterans Affairs

    Page 196 GAO- 01- 822 Combating Terrorism

    Appendix XV: Comments From the Department of Veterans Affairs

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XV: Comments From the Department of Veterans Affairs

    Page 197 GAO- 01- 822 Combating Terrorism

    Appendix XV: Comments From the Department of Veterans Affairs Page 198 GAO-
    01- 822 Combating Terrorism

    The following are GAO?s comments on the Department of Veterans Affairs?
    letter dated September 5, 2001.

    The Department of Veterans Affairs (VA) concurred with the intent of our
    recommendation on after- action reports (AARs) in chapter 4 and agreed that
    it will implement the recommendation. Our past and ongoing work has already
    demonstrated that VA has a good record of producing AARs. However, VA asked
    that we change the wording of the recommendation to limit it to exercises
    that are ?designated as federal interagency counterterrorist exercises by
    the lead federal agency.? We disagree with this revision because it might
    limit the production of AARs in a manner to exclude important exercises. In
    our previous work, we found that some of the better consequence management
    exercises were sponsored by VA or the Department of Defense (DOD), not by
    FEMA- the lead federal agency for consequence management. 1 For example, in
    September 1997, VA and DOD sponsored a field exercise to practice providing
    medical care to victims of a terrorist WMD attack. That exercise, which had
    over 2,000 participants, also included state and local responders and local
    community hospitals. Changing the wording of our recommendation, as
    suggested by VA, might exempt agencies from producing AARs for such
    exercises. Given the Department?s good record in producing AARs, even in
    cases when they were not ?designated? by a lead federal agency, we believe
    that the wording in our recommendation will not place any additional burden
    upon the Department.

    1 Combating Terrorism: Issues to Be Resolved to Improve Counterterrorist
    Operations

    (GAO/ NSIAD- 99- 135, May 13, 1999). GAO Comments

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Page 199 GAO- 01- 822 Combating Terrorism

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Note: GAO comments supplementing those in the report text appear at the end
    of this appendix.

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Page 200 GAO- 01- 822 Combating Terrorism

    Now on p. 52. Now on p. 37.

    Now on pp. 13, 17, 69- 70. Now on p. 86.

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Page 201 GAO- 01- 822 Combating Terrorism

    Now on pp. 15, 103- 104, 107. Now on p. 77.

    Now on p. 55. Now on p. 104.

    Now on pp. 14, 90, 99- 100.

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Page 202 GAO- 01- 822 Combating Terrorism

    Now on p. 122. See comment, p. 203.

    Now on p. 92.

    Appendix XVI: Comments From the Federal Emergency Management Agency

    Page 203 GAO- 01- 822 Combating Terrorism

    The following is GAO?s comment on the Federal Emergency Management Agency?s
    letter dated August 31, 2001.

    After we received FEMA?s written comments, FEMA provided us with revised
    figures for the number of persons trained at the National Fire Academy and
    Emergency Management Institute from fiscal year 1998 through July 31, 2001,
    of fiscal year 2001. We incorporated the Agency?s comments where appropriate
    throughout the report. GAO Comment

    Appendix XVII: GAO Contacts and Staff Acknowledgments

    Page 204 GAO- 01- 822 Combating Terrorism

    Counterterrorism: Raymond J. Decker (202) 512- 6020 Stephen L. Caldwell
    (202) 512- 9610

    Cyberterrorism: Robert F. Dacey (202) 512- 3317 Jean L. Boltz (202) 512-
    5247

    In addition to those named above, Mark A. Pross, Michael W. Gilmore, Richard
    A. McGeary, Danielle P. Hollomon, James C. Lawson, Krislin M. Nalwalk, Harry
    L. Purdy, Karl W. Siefert, Yvonne J. Vigil, Keith A. Rhodes, Rahul Gupta,
    Grace A. Alexander, Jane D. Trahan, and Heather J. Taylor made key
    contributions to this report. Appendix XVII: GAO Contacts and Staff

    Acknowledgments GAO Contacts:

    Acknowledgments

    Related GAO Products Page 205 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Actions Needed to Improve DOD?s Antiterrorism Program
    Implementation and Management (GAO- 01- 909, Sept. 19, 2001).

    Critical Infrastructure Protection: Significant Challenges in Protecting
    Federal Systems and Developing Analysis and Warning Capabilities

    (GAO- 01- 1132T, Sept. 12, 2001).

    International Crime Control: Sustained Executive- Level Coordination of
    Federal Response Needed (GAO- 01- 629, Aug. 13, 2001).

    FBI Intelligence Investigations: Coordination Within Justice on
    Counterintelligence Criminal Matters Is Limited (GAO- 01- 780, July 16,
    2001).

    Critical Infrastructure Protection: Significant Challenges in Developing
    Analysis, Warning, and Response Capabilities (GAO- 01- 769T, May 22, 2001).

    Combating Terrorism: Comments on H. R. 525 to Create a President?s Council
    on Domestic Preparedness (GAO- 01- 555T, May 9, 2001).

    Critical Infrastructure Protection: Significant Challenges in Developing
    National Capabilities (GAO- 01- 323, Apr. 25, 2001).

    Combating Terrorism: Observations on Options to Improve the Federal Response
    (GAO- 01- 660T, Apr. 24, 2001).

    Combating Terrorism: Accountability Over Medical Supplies Needs Further
    Improvement (GAO- 01- 463, Mar. 30, 2001).

    Combating Terrorism: Comments on Counterterrorism Leadership and National
    Strategy (GAO- 01- 556T, Mar. 27, 2001).

    Combating Terrorism: FEMA Continues to Make Progress in Coordinating
    Preparedness and Response (GAO- 01- 15, Mar. 20, 2001).

    Combating Terrorism: Federal Response Teams Provide Varied Capabilities;
    Opportunities Remain to Improve Coordination

    (GAO- 01- 14, Nov. 30, 2000).

    West Nile Virus Outbreak: Lessons for Public Health Preparedness

    (GAO/ HEHS- 00- 180, Sept. 11, 2000). Related GAO Products

    Related GAO Products Page 206 GAO- 01- 822 Combating Terrorism

    Information Security: Serious and Widespread Weaknesses Persist at Federal
    Agencies (GAO/ AIMD- 00- 295, Sept. 6, 2000).

    Combating Terrorism: Linking Threats to Strategies and Resources

    (GAO/ T- NSIAD- 00- 218, July 26, 2000).

    Critical Infrastructure Protection: Challenges to Building a Comprehensive
    Strategy for Information Sharing and Coordination

    (GAO/ T- AIMD- 00- 268, July 26, 2000).

    Combating Terrorism: Action Taken but Considerable Risks Remain for Forces
    Overseas (GAO/ NSIAD- 00- 181, July 19, 2000).

    Security Protection: Standardization Issues Regarding Protection of
    Executive Branch Officials (GAO/ GGD/ OSI- 00- 139, July 11, 2000).

    Aviation Security: Long- Standing Problems Impair Airport Screeners?
    Performance (GAO/ RCED- 00- 75, June 28, 2000).

    Critical Infrastructure Protection: Comments on the Proposed Cyber Security
    Information Act of 2000 (GAO/ T- AIMD- 00- 229, June 22, 2000).

    Weapons of Mass Destruction: DOD?s Actions to Combat Weapons Use Should Be
    More Integrated and Focused (GAO/ NSIAD- 00- 97, May 26, 2000).

    Security: Breaches at Federal Agencies and Airports (GAO/ T- OSI- 00- 10,
    May 25, 2000).

    Critical Infrastructure Protection: ?I LOVE YOU? Computer Virus Highlights
    Need for Improved Alert and Coordination Capabilities

    (GAO/ T- AIMD- 00- 181, May 18, 2000).

    Combating Terrorism: Comments on Bill H. R. 4210 to Manage Selected
    Counterterrorist Programs (GAO/ T- NSIAD- 00- 172, May 4, 2000).

    Combating Terrorism: How Five Foreign Countries Are Organized to Combat
    Terrorism (GAO/ NSIAD- 00- 85, Apr. 7, 2000).

    Combating Terrorism: Issues in Managing Counterterrorist Programs

    (GAO/ T- NSIAD- 00- 145, Apr. 6, 2000).

    Related GAO Products Page 207 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Need to Eliminate Duplicate Federal Weapons of Mass
    Destruction Training (GAO/ NSIAD- 00- 64, Mar. 21, 2000).

    Critical Infrastructure Protection: National Plan for Information Systems
    Protection (GAO/ AIMD- 00- 90R, Feb. 11, 2000).

    Critical Infrastructure Protection: Comments on the National Plan for
    Information Systems Protection (GAO/ T- AIMD- 00- 72, Feb. 1, 2000).

    Combating Terrorism: Chemical and Biological Medical Supplies Are Poorly
    Managed (GAO/ HEHS/ AIMD- 00- 36, Oct. 29, 1999).

    Food Safety: Agencies Should Further Test Plans for Responding to Deliberate
    Contamination (GAO/ RCED- 00- 3, Oct. 27, 1999).

    Combating Terrorism: Observations on the Threat of Chemical and Biological
    Terrorism (GAO/ T- NSIAD- 00- 50, Oct. 20, 1999).

    Critical Infrastructure Protection: Fundamental Improvements Needed to
    Assure Security of Federal Operations (GAO/ T- AIMD- 00- 7, Oct. 6, 1999).

    Critical Infrastructure Protection: The Status of Computer Security at the
    Department of Veterans Affairs (GAO/ AIMD- 00- 5, Oct. 4, 1999).

    Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year
    2000 Experiences (GAO/ AIMD- 00- 1, Oct. 1, 1999).

    Information Security: The Proposed Computer Security Enhancement Act of 1999
    (GAO/ T- AIMD- 99- 302, Sept. 30, 1999).

    Combating Terrorism: Need for Comprehensive Threat and Risk Assessments of
    Chemical and Biological Attack (GAO/ NSIAD- 99- 163, Sept. 7, 1999).

    Information Security: NRC?s Computer Intrusion Detection Capabilities

    (GAO/ AIMD- 99- 273R, Aug. 27, 1999).

    Combating Terrorism: Analysis of Federal Counterterrorist Exercises

    (GAO/ NSIAD- 99- 157BR, June 25, 1999).

    Combating Terrorism: Observations on Growth in Federal Programs

    (GAO/ T- NSIAD- 99- 181, June 9, 1999).

    Related GAO Products Page 208 GAO- 01- 822 Combating Terrorism

    Combating Terrorism: Analysis of Potential Emergency Response Equipment and
    Sustainment Costs (GAO/ NSIAD- 99- 151, June 9, 1999).

    Combating Terrorism: Use of National Guard Response Teams Is Unclear (GAO/
    NSIAD- 99- 110, May 21, 1999).

    Combating Terrorism: Issues to Be Resolved to Improve Counterterrorist
    Operations (GAO/ NSIAD- 99- 135, May 13, 1999).

    Combating Terrorism: Observations on Biological Terrorism and Public Health
    Initiatives (GAO/ T- NSIAD- 99- 112, Mar. 16, 1999).

    Combating Terrorism: Observations on Federal Spending to Combat Terrorism
    (GAO/ T- NSIAD/ GGD- 99- 107, Mar. 11, 1999).

    Combating Terrorism: FBI?s Use of Federal Funds for CounterterrorismRelated
    Activities (FYs 1995- 98) (GAO/ GGD- 99- 7, Nov. 20, 1998).

    Combating Terrorism: Opportunities to Improve Domestic Preparedness Program
    Focus and Efficiency (GAO/ NSIAD- 99- 3, Nov. 12, 1998).

    Combating Terrorism: Observations on the Nunn- Lugar- Domenici Domestic
    Preparedness Program (GAO/ T- NSIAD- 99- 16, Oct. 2, 1998).

    Combating Terrorism: Observations on Crosscutting Issues

    (GAO/ T- NSIAD- 98- 164, Apr. 23, 1998).

    Combating Terrorism: Threat and Risk Assessments Can Help Prioritize and
    Target Program Investments (GAO/ NSIAD- 98- 74, Apr. 9, 1998).

    Combating Terrorism: Spending on Governmentwide Programs Requires Better
    Management and Coordination (GAO/ NSIAD- 98- 39, Dec. 1, 1997).

    Combating Terrorism: Federal Agencies? Efforts to Implement National Policy
    and Strategy (GAO/ NSIAD- 97- 254, Sept. 26, 1997).

    Combating Terrorism: Status of DOD Efforts to Protect Its Forces Overseas
    (GAO/ NSIAD- 97- 207, July 21, 1997).

    Chemical Weapons Stockpile: Changes Needed in the Management Structure of
    Emergency Preparedness Program (GAO/ NSIAD- 97- 91, June 11, 1997).

    Related GAO Products Page 209 GAO- 01- 822 Combating Terrorism

    Aviation Security: FAA?s Procurement of Explosives Detection Devices

    (GAO/ RCED- 97- 111R, May 1, 1997).

    Aviation Security: Commercially Available Advanced Explosives Detection
    Devices (GAO/ RCED- 97- 119R, Apr. 24, 1997).

    Terrorism and Drug Trafficking: Responsibilities for Developing Explosives
    and Narcotics Detection Technologies (GAO/ NSIAD- 97- 95, Apr. 15, 1997).

    Federal Law Enforcement: Investigative Authority and Personnel at 13
    Agencies (GAO/ GGD- 96- 154, Sept. 30, 1996).

    Aviation Security: Urgent Issues Need to Be Addressed

    (GAO/ T- RCED/ NSIAD- 96- 151, Sept. 11, 1996).

    Terrorism and Drug Trafficking: Technologies for Detecting Explosives and
    Narcotics (GAO/ NSIAD/ RCED- 96- 252, Sept. 4, 1996).

    Aviation Security: Immediate Action Needed to Improve Security

    (GAO/ T- RCED/ NSIAD- 96- 237, Aug. 1, 1996).

    Terrorism and Drug Trafficking: Threats and Roles of Explosives and
    Narcotics Detection Technology (GAO/ NSIAD/ RCED- 96- 76BR, Mar. 27, 1996).

    Nuclear Nonproliferation: Status of U. S. Efforts to Improve Nuclear
    Material Controls in Newly Independent States (GAO/ NSIAD/ RCED- 96- 89,
    Mar. 8, 1996).

    Aviation Security: Additional Actions Needed to Meet Domestic and
    International Challenges (GAO/ RCED- 94- 38, Jan. 27, 1994).

    Nuclear Security: Improving Correction of Security Deficiencies at DOE?s
    Weapons Facilities (GAO/ RCED- 93- 10, Nov. 16, 1992).

    Nuclear Security: Weak Internal Controls Hamper Oversight of DOE?s Security
    Program (GAO/ RCED- 92- 146, June 29, 1992).

    Electricity Supply: Efforts Underway to Improve Federal Electrical
    Disruption Preparedness (GAO/ RCED- 92- 125, Apr. 20, 1992).

    (350016)

    The first copy of each GAO report is free. Additional copies of reports are
    $2 each. A check or money order should be made out to the Superintendent of
    Documents. VISA and MasterCard credit cards are also accepted.

    Orders for 100 or more copies to be mailed to a single address are
    discounted 25 percent.

    Orders by mail:

    U. S. General Accounting Office P. O. Box 37050 Washington, DC 20013

    Orders by visiting:

    Room 1100 700 4 th St., NW (corner of 4 th and G Sts. NW) Washington, DC
    20013

    Orders by phone:

    (202) 512- 6000 fax: (202) 512- 6061 TDD (202) 512- 2537

    Each day, GAO issues a list of newly available reports and testimony. To
    receive facsimile copies of the daily list or any list from the past 30
    days, please call (202) 512- 6000 using a touchtone phone. A recorded menu
    will provide information on how to obtain these lists.

    Orders by Internet

    For information on how to access GAO reports on the Internet, send an e-
    mail message with ?info? in the body to:

    Info@ www. gao. gov or visit GAO?s World Wide Web home page at: http:// www.
    gao. gov

    Contact one:

     Web site: http:// www. gao. gov/ fraudnet/ fraudnet. htm

     E- mail: fraudnet@ gao. gov

     1- 800- 424- 5454 (automated answering system) Ordering Information

    To Report Fraud, Waste, and Abuse in Federal Programs
    *** End of document. ***