    Homeland Security: Agency Plans, Implementation, and Challenges
    Regarding the National Strategy for Homeland Security (14-JAN-05,
    GAO-05-33).

    The National Strategy for Homeland Security sets forth a plan to
    improve homeland security through the cooperation of federal,
    state, local, and private sector organizations on an array of
    functions. These functions are organized into the six distinct
    "critical mission areas" of (1) intelligence and warning, (2)
    border and transportation security, (3) domestic
    counterterrorism, (4) protecting critical infrastructures and key
    assets, (5) defending against catastrophic threats, and (6)
    emergency preparedness and response. Within each of these mission
    areas, the strategy identifies "major initiatives" to be
    addressed. In all, the strategy cites 43 initiatives across the
    six mission areas. GAO reviewed the strategy's implementation to
    (1) determine whether its initiatives are being addressed by key
    departments' strategic planning and implementation activities,
    whether the initiatives have lead agencies identified for their
    implementation, and whether the initiatives were being
    implemented in fiscal year 2004 by such agencies and (2) identify
    ongoing homeland security challenges that have been reflected in
    GAO products since September 11, 2001, by both mission area and
    issues that cut across mission areas.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-05-33
        ACCNO:   A15676
      TITLE:     Homeland Security: Agency Plans, Implementation, and
    Challenges Regarding the National Strategy for Homeland Security
         DATE:   01/14/2005
      SUBJECT:   Agency missions
    	     Counterterrorism
    	     Domestic intelligence
    	     Emergency preparedness
    	     Interagency relations
    	     Intergovernmental relations
    	     National preparedness
    	     Strategic planning
    	     Private sector
    	     Border security
    	     Critical infrastructure
    	     Homeland security
    	     Transportation security
    	     National Strategy for Homeland Security

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-05-33

    United States Government Accountability Office

    GAO	Report to the Chairman, Subcommittee on National Security, Emerging
    Threats, and International Relations, Committee on Government Reform,
    House of Representatives

    January 2005

    HOMELAND SECURITY

    Agency Plans, Implementation, and Challenges Regarding the National Strategy for
                                   Homeland Security

    GAO-05-33

    Highlights of GAO-05-33, a report to the Chairman, Subcommittee on
    National Security, Emerging Threats, and International Relations,
    Committee on Government Reform, House of Representatives

    The National Strategy for Homeland Security sets forth a plan to improve
    homeland security through the cooperation of federal, state, local, and
    private sector organizations on an array of functions. These functions are
    organized into the six distinct "critical mission areas" of (1)
    intelligence and warning, (2) border and transportation security, (3)
    domestic counterterrorism, (4) protecting critical infrastructures and key
    assets, (5) defending against catastrophic threats, and (6) emergency
    preparedness and response. Within each of these mission areas, the
    strategy identifies "major initiatives" to be addressed. In all, the
    strategy cites 43 initiatives across the six mission areas.

    GAO reviewed the strategy's implementation to

    o  	determine whether its initiatives are being addressed by key
    departments' strategic planning and implementation activities, whether the
    initiatives have lead agencies identified for their implementation, and
    whether the initiatives were being implemented in fiscal year 2004 by such
    agencies and

    o  	identify ongoing homeland security challenges that have been reflected
    in GAO products since September 11, 2001, by both mission area and issues
    that cut across mission areas.

    January 2005

    HOMELAND SECURITY

    Agency Plans, Implementation, and Challenges Regarding the National Strategy for
    Homeland Security

    Key federal departments-Defense (DOD), Energy (DOE), Health and Human
    Services (HHS), Homeland Security (DHS), Justice (DOJ), and State-have
    addressed the strategy's 43 initiatives to some extent in their strategic
    planning and implementation activities. All 43 of the initiatives were
    included in some of the planning or implementation activities of at least
    one of these six departments. Most of the initiatives (42 of the 43) also
    had departments identified as the lead agencies for their implementation,
    which helps to ensure accountability for implementation. However, many of
    these 42 initiatives had multiple lead agencies, indicating that
    interagency coordination of roles and activities will be important,
    particularly on those initiatives involving domestic counterterrorism and
    critical infrastructure protection. All of the initiatives were being
    implemented in fiscal year 2004 by at least one department. While GAO
    determined that implementation was occurring, it did not assess the status
    or quality of the various departments' implementation of the initiatives.

    While departments have incorporated these initiatives into their planning
    and implementation activity, the United States faces significant
    challenges in fully implementing the strategy in a coordinated and
    integrated manner. Some of the most difficult challenges being confronted
    are those that cut across the various critical mission areas, such as
    balancing homeland security funding needs with other national
    requirements, improving risk management methods for resource allocation
    and investments, developing adequate homeland security performance
    measures, developing a national enterprise architecture for homeland
    security, and clarifying the roles and responsibilities among the levels
    of government and the private sector. GAO has also identified a large
    diversity of other challenges in each of the six critical mission areas
    since September 11.

    Proposed Fiscal Year 2005 Homeland Security Funding by Agency (budget
    authority in millions of dollars)

    www.gao.gov/cgi-bin/getrpt?GAO-05-33.

    To view the full product, including the scope Source: Office of Management
    and Budget.
    and methodology, click on the link above.
    For more information, contact Norman J.
    Rabkin (202) 512-3610 or rabkinn@gao.gov.

    Contents

    Letter 1

    Results in Brief 3
    Background 4
    Scope and Methodology 9
    Agency Plans, Implementation, and Challenges 10
    Concluding Observations 25
    Agency Comments and Our Evaluation 26

    Appendix I Objectives, Scope, and Methodology

    Appendix II Intelligence and Warning 30

    Definition and Major Initiatives 30
    Agencies with Major Roles in Intelligence and Warning 31
    Alignment of Department Activities with the Major Initiatives 33
    Challenges in Intelligence and Warning 36

    Appendix III Border and Transportation Security 42

    Definition and Major Initiatives 42
    Agencies with Major Roles in Border and Transportation Security 43
    Alignment of Department Activities with the Major Initiatives 46
    Challenges in Border and Transportation Security 48
    Border Security 49
    Transportation Security 55

    Appendix IV Domestic Counterterrorism 63

    Definition and Major Initiatives 63
    Agencies with Major Roles in Domestic Counterterrorism 64
    Alignment of Department Activities with the Major Initiatives 66
    Challenges in Domestic Counterterrorism 69

    Appendix V Protecting Critical Infrastructures and Key Assets 74

    Definition and Major Initiatives 74
    Agencies with Major Roles in Critical Infrastructure Protection 75
    Alignment of Department Activities with the Major Initiatives 77
    Challenges in Critical Infrastructure Protection 81

    Appendix VI Defending Against Catastrophic Threats 95

    Definition and Major Initiatives 95
    Agencies with Major Roles in Defending against Catastrophic

    Threats 96
    Alignment of Department Activities with the Major Initiatives 98
    Challenges in Defending Against Catastrophic Threats 102

    Appendix VII Emergency Preparedness and Response 107

    Definition and Major Initiatives 107
    Agencies with Major Roles in Emergency Preparedness and

    Response 108
    Alignment of Department Activities with the Major Initiatives 110
    Challenges in Emergency Preparedness and Response 114

    Appendix VIII	Crosscutting Issues 122
    Crosscutting Challenges 122

    Appendix IX Department Summary Across Critical Mission Areas 129

    Appendix X Homeland Security Presidential Directives

    Appendix XI	Comments from the Department of Defense 139
    GAO Comment 140

    Appendix XII	Comments From the Department of Health and
    Human Services 141

    GAO Comment 144

    Appendix XIII	Comments From the Department of Homeland
    Security 145

    GAO Comment 149

    Appendix XIV	Comments From the Department of Justice 150
    GAO Comments 164

    Appendix XV GAO Contacts and Staff Acknowledgments 165

    GAO Contacts 165 Staff Acknowledgments 168

    Related GAO Products

    Tables

    Table 1: Department Leadership, Planning, or Implementation Activity in
    the Intelligence and Warning Mission Area's Five Initiatives 12

    Table 2: Department Leadership, Planning, or Implementation Activity in
    the Border and Transportation Security Mission Area's Six Initiatives 14

    Table 3: Department Leadership, Planning, or Implementation Activity in
    the Domestic Counterterrorism Mission Area's Six Initiatives 16

    Table 4: Department Leadership, Planning, or Implementation Activity in
    the Critical Infrastructure Protection Mission Area's Eight Initiatives 18

    Table 5. Department Leadership, Planning, or Implementation Activity in
    the Defending Against Catastrophic Threats Mission Area's Six Initiatives
    20

    Table 6: Department Leadership, Planning, or Implementation Activity in
    the Emergency Preparedness and Response Mission Area's Twelve Initiatives
    22

    Table 7: Detailed Department Leadership and Planning/Implementation
    Activities in the Intelligence and Warning Mission Area's Five Initiatives
    34

    Table 8: Detailed Department Leadership and Planning/Implementation
    Activities in the Border and Transportation Mission Area's Six Initiatives
    46

    Table 9: Detailed Department Leadership and Planning/Implementation
    Activities in the Domestic Counterterrorism Mission Area's Six Initiatives
    67

    Table 10: Detailed Department Planning/Implementation Activities in the
    Protecting Critical Infrastructures and Key Assets Critical Mission Area's
    Eight Initiatives 78

    Table 11: Detailed Department Planning/Implementation Activities

    in the Defending Against Catastrophic Threats Mission

    Area's Six Initiatives 99 Table 12: Detailed Department
    Planning/Implementation Activities

    in the Emergency Preparedness and Response Mission

    Area's Twelve Initiatives 111 Table 13: Summary of Department Leads,
    Planning, and

    Implementation across the Six Critical Mission Areas of

    the National Strategy for Homeland Security 130

    Figures

    Figure 1: Proposed Fiscal Year 2005 Homeland Security Funding by Critical
    Mission Area 6 Figure 2: Proposed Fiscal Year 2005 Homeland Security
    Funding by Department 8 Figure 3: The Five Threat Levels of the Homeland
    Security Advisory System 31 Figure 4: Proposed Fiscal Year 2005 Homeland
    Security Funding for Intelligence and Warning 32

    Figure 5: U.S. Customs and Border Patrol Marine Officers on the Waters of
    the Rio Grande, along the United States and Mexico Border 43

    Figure 6: Proposed Fiscal Year 2005 Homeland Security Funding for Border &
    Transportation Security 45 Figure 7: An FBI Evidence Response Team in
    Action at the Scene of a Terrorism-Related Exercise 64 Figure 8: Proposed
    Fiscal Year 2005 Homeland Security Funding for Domestic Counterterrorism
    65 Figure 9: A U.S. Immigration and Customs Enforcement Helicopter Patrols
    the Skies over the Nation's Capital 75 Figure 10: Proposed Fiscal Year
    2005 Homeland Security Funding

    for Critical Infrastructure Protection 77 Figure 11: First Responders
    Practice Emergency Decontamination 96 Figure 12: Proposed Fiscal Year 2005
    Homeland Security Funding

    for Defending Against Catastrophic Threats 97 Figure 13: Hazardous
    Materials Response Unit in Action at an Exercise 108 Figure 14: Proposed
    Fiscal Year 2005 Homeland Security Funding for Emergency Preparedness 110

    Abbreviations

    APHIS Animal and Plant Health Inspection Service
    ATSA Aviation and Transportation Security Act
    CAPPS Computer-Assisted Passenger Prescreening Program
    CBP Customs and Border Patrol
    CBRN chemical, biological, radiological, or nuclear
    CIA Central Intelligence Agency
    CIP Critical Infrastructure Protection
    CSI container security initiative
    C-TPAT Customs-Trade Partnership against Terrorism
    CWC Chemical Weapons Convention
    DBT design basis threat
    DHS Department of Homeland Security
    DIA Defense Intelligence Agency
    DOD Department of Defense
    DOE Department of Energy
    DOJ Department of Justice
    EPA Environmental Protection Agency
    FBI Federal Bureau of Investigation
    FPS Federal Protective Service
    GAO Government Accountability Office
    GPRA Government Performance and Results Act
    GSA General Services Administration

    HHS Department of Health and Human Services
    HSAS Homeland Security Advisory System
    HSC Homeland Security Council
    HSPD Homeland Security Presidential Directive
    IAIP Information Analysis and Infrastructure Protection
    ICE Immigration and Customs Enforcement
    IT information technology
    MANPADS Man-Portable Air Defense System
    MTSA Maritime Transportation Security Act
    NIH National Institutes of Health
    NCR National Capital Region
    NMLS National Money Laundering Strategy
    NNSA National Nuclear Security Administration
    NRC Nuclear Regulatory Commission
    NSPD National Security Presidential Directive
    ODP Office of Domestic Preparedness
    OJP Office of Justice Programs
    OMB Office of Management and Budget
    PDD Presidential Decision Directive
    PSV post-shipment verification
    UAV unmanned aerial vehicle
    USDA United States Department of Agriculture
    USPS United States Postal Service
    US-VISIT United States Visitor and Immigrant Status Indicator
    VA Veterans Administration
    WMD weapons of mass destruction
    SSN Social Security Number
    TSA Transportation Security Act
    TTIC Terrorist Threat Integration Center

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed in
    its entirety without further permission from GAO. However, because this
    work may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this material
    separately.

    United States Government Accountability Office Washington, DC 20548

    January 14, 2005

    The Honorable Christopher Shays
    Chairman, Subcommittee on National Security, Emerging

    Threats, and International Relations Committee on Government Reform House
    of Representatives

    Dear Mr. Chairman:

    In an effort to increase homeland security following the September 11,
    2001, terrorist attacks on the United States, President Bush issued the
    National Strategy for Homeland Security in July 2002 and signed
    legislation creating the Department of Homeland Security (DHS) in November
    2002.1 The strategy sets forth overall objectives to prevent terrorist
    attacks within the United States, reduce America's vulnerability to
    terrorism, and minimize the damage and assist in the recovery from attacks
    that may occur. To accomplish these overall objectives, the strategy
    describes six critical mission areas and 43 initiatives. Since the
    strategy was issued, the President has also issued additional documents-
    known as Homeland Security Presidential Directives (or HSPDs)-that provide
    more detailed guidance on the mission areas and initiatives. The creation
    of DHS, which began operations in March 2003, represents a fusion of 22
    federal agencies to coordinate and centralize the leadership of many
    homeland security activities under a single department. In addition to
    DHS, the Departments of Defense (DOD), Energy (DOE), Health and Human
    Services (HHS), Justice (DOJ), and State play an important role in
    implementing the strategy. These six key departments represent 94 percent
    of proposed federal spending for homeland security in fiscal year 2005.

    With the strategy now more than 2 years old, and DHS more than a year old,
    you asked that we review the implementation of the strategy and organize
    our work by critical mission area. In response, we have

    o  	determined whether the initiatives in the strategy were being
    addressed by the key department's strategic planning and related
    activities;

    1Homeland Security Act of 2002, Pub.L. 107-296 (Nov. 25, 2002).

    whether the initiatives had "lead" agencies identified for their
    implementation, and whether multiple departments were implementing the
    initiatives in fiscal year 2004; and

    o  	identified homeland security challenges as reflected in our products
    since September 11, 2001, by both mission area and issues that cut across
    mission areas.

    This report establishes one framework from which to assess federal
    department implementation of the National Strategy for Homeland Security.
    Since agency homeland security activities are ongoing, this report is
    intended to identify a baseline from which to assess progress toward
    meeting homeland security objectives. In this report, we first provide the
    proposed fiscal year 2005 homeland security-related budget by mission area
    and department. Then, we discuss the homeland security planning and
    implementation activities of the six departments under review, as well as
    remaining homeland security challenges, by mission area. The appendixes
    that follow provide more detailed assessments of each of these sections
    and are also arranged by mission area. (See app. I for more information on
    the scope and methodology.) Further, this report should be considered in
    the context of several companion efforts to provide baseline information.
    In February 2004, we testified on the desired characteristics of national
    strategies and whether various strategies- including the National Strategy
    for Homeland Security-contained those desired characteristics.2 In March,
    we summarized strategic homeland security recommendations made by
    congressionally chartered commissions and us.3 We organized this analysis
    by critical mission area, as defined in the strategy. In July, we reported
    on our recommendations to DHS and the department's progress in
    implementing such recommendations.4 We organized this analysis by DHS
    directorate or division. In September, we compared 9/11 Commission
    recommendations with those of the National Strategy for Homeland Security
    and the National Strategy to Combat Terrorism. We also provided a
    preliminary analysis of department planning and implementation activities
    with

    2See GAO, Combating Terrorism: Evaluation of Selected Characteristics in
    National Strategies Related to Terrorism, GAO-04-408T (Washington, D.C.:
    Feb. 3, 2004).

    3See GAO, Homeland Security: Selected Recommendations from Congressionally
    Chartered Commissions and GAO, GAO-04-591 (Washington, D.C.: Mar. 31,
    2004).

    4See GAO, Status of Key Recommendations GAO Has Made to DHS and Its Legacy
    Agencies, GAO-04-865R (Washington, D.C.: July 2, 2004).

    Results in Brief

    respect to the six mission areas.5 Together, these baseline efforts are
    intended to aid congressional oversight of federal homeland security
    activities.

    Key federal departments have addressed the strategy's initiatives in their
    strategic planning and implementation activities. All 43 initiatives
    indicated in the strategy were included in the activities of at least one
    of the six departments we reviewed. For most of the initiatives (42 of
    43), the strategy or HSPDs identified lead agencies, thereby helping to
    ensure accountability for implementation. All 43 initiatives were being
    implemented in fiscal year 2004 by at least one department. Thirty-three
    of the 43 initiatives (77 percent) were being planned or implemented by 3
    or more departments. While we determined that implementation was
    occurring, we did not assess the status or quality of the various
    departments' implementation of the initiatives.

    While departments have incorporated these initiatives into their planning
    and implementation activity, the United States still faces significant
    challenges in implementing the strategy in a well coordinated and
    integrated manner. A review of our products since September 11, 2001,
    shows that some of the most difficult challenges being confronted are
    those that cut across the various critical mission areas. These challenges
    include

    o  balancing homeland security needs with other national requirements,

    o  	improving risk management methods for resource allocation and
    investments,

    o  developing adequate homeland security performance measures,

    o  	clarifying the roles and responsibilities among the levels of
    government and the private sector, and

    o  	developing a national blueprint-called an enterprise architecture-to
    help integrate different organization's efforts to improve homeland
    security.

    5See GAO, Homeland Security: Observations on the National Strategies
    Related to Terrorism, GAO-04-1075T (Washington, D.C.: Sept. 22, 2004).

    Background

    In addition to these and other crosscutting challenges, we have identified
    a large diversity of challenges related specifically to each of the six
    mission areas described in the strategy and provide details on them in the
    remainder of the report.

    We provided a draft of this report to DHS, DOD, DOE, DOJ, HHS, State, and
    the Homeland Security Council for comment. All except State and the
    Homeland Security Council provided comments, which generally consisted of
    technical comments that we incorporated as appropriate. None of the
    departments disagreed with the substance of the report.

    The National Strategy for Homeland Security sets out a plan to improve
    homeland security through the cooperation and partnering of federal,
    state, local, and private sector organizations on an array of functions.6
    The strategy organizes these functions into six critical mission areas:7

    o  	Intelligence and Warning involves the identification, collection,
    analysis, and distribution of intelligence information appropriate for
    preempting or preventing a terrorist attack.

    o  	Border and Transportation Security emphasizes the efficient and
    reliable flow of people, goods, and material across borders while
    deterring terrorist activity.

    o  	Domestic Counterterrorism focuses on law enforcement efforts to
    identify, halt, prevent, and prosecute terrorists in the United States.

    6There were several other related national strategies issued subsequent to
    the National Strategy for Homeland Security. These include the National
    Money Laundering Strategy, the National Security Strategy, the National
    Strategy to Combat Weapons of Mass Destruction, the National Strategy for
    Combating Terrorism, the National Strategy for the Physical Protection of
    Critical Infrastructure and Key Assets, and the National Strategy to
    Secure Cyberspace. For our analysis of all of these strategies, see
    GAO-04-408T.

    7The strategy also includes a discussion of "foundations," which we did
    not identify separately in our analysis. The strategy describes these
    foundations as unique American strengths that cut across all sectors of
    society, such as law, science and technology, information sharing and
    systems, and international cooperation. The discussion of these
    foundations overlaps with the six mission areas. For example, the
    initiative to improve international shipping security is covered by both
    the mission area of Border and Transportation Security as well as the
    foundation of international cooperation. To some extent, our discussion of
    crosscutting issues also acknowledges issues that cut across all sectors.

    o  	Protecting Critical Infrastructure and Key Assets stresses securing
    the nation's interconnecting sectors and important facilities, sites, and
    structures.

    o  	Defending Against Catastrophic Threats emphasizes the detection,
    deterrence, and mitigation of terrorist use of weapons of mass
    destruction.

    o  	Emergency Preparedness and Response highlights damage minimization and
    recovery from terrorist attacks.

    Since the strategy was issued in July 2002, the President has also issued
    12 HSPDs that provide additional guidance related to these mission areas.
    For example, HSPD-4 focuses on defending against catastrophic threats and
    HSPD-7 focuses on protecting critical infrastructure. These HSPDs provided
    some of the details that were not in the strategy, particularly with
    respect to agency roles and milestones. See appendix X for a complete list
    and description of these HSPDs.

    The strategy also identifies the major initiatives to be addressed within
    each of these six mission areas. For example, within the Intelligence and
    Warning mission area, 5 initiatives are indicated: (1) enhancing the
    analytic capabilities of the FBI; (2) building new capabilities through
    the Information Analysis and Infrastructure Protection Directorate of DHS;
    (3) implementing the Homeland Security Advisory System; (4) utilizing
    dual-use analysis to prevent attacks; and (5) employing "red team"
    techniques.8 Within the Border and Transportation Security mission area, 6
    initiatives are cited: (1) ensuring accountability in border and
    transportation security, (2) creating "smart borders", (3) increasing the
    security of international shipping containers, (4) implementing the
    Aviation and Transportation Security Act of 2001, (5) recapitalizing the
    U.S. Coast Guard, and (6) reforming immigration services. In all, the
    strategy cites 43 initiatives across the six mission areas. See appendix
    IX for a complete list of all the initiatives by mission area.

    The latest available funding data from the Office of Management and Budget
    (OMB) for the six mission areas is illustrated in figure 1.

    8Red-team techniques are those where the U.S. government would create a
    team that plays the role of terrorists in terms of identifying
    vulnerabilities and planning attacks.

    Figure 1: Proposed Fiscal Year 2005 Homeland Security Funding by Critical
    Mission Area

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Note: Budget authority in millions of dollars.

    The National Strategy for Homeland Security specifies a number of federal
    departments, as well as nonfederal organizations, that have important
    roles in implementing the mission areas and related initiatives. In terms
    of federal departments, DHS is intended to have a prominent role in
    implementing all of the mission areas. Other key federal departments
    specified in the strategy include, in alphabetical order, the Department
    of Defense, the Department of Energy, the Department of Health and Human
    Services, the Department of Justice, and the Department of State (State).
    These departments have their own strategic plans, which indicate how they
    will implement their homeland security programs (as well as other programs
    unrelated to homeland security). Together, DHS and these other five
    departments constitute 94 percent of the proposed $47.4 billion

    budget for homeland security-related activities in fiscal year 2005. OMB
    did not report funding for the Central Intelligence Agency (CIA) although
    it has activities related to the Intelligence and Warning mission area. As
    explained further in appendix II, we did not include the CIA in our
    analysis because of the lack of funding data and because the strategy
    provides little discussion of the agency. Figure 2 shows the proposed
    fiscal year 2005 funding for these departments as well as the proposed
    homeland security funding for all other agencies.

    Figure 2: Proposed Fiscal Year 2005 Homeland Security Funding by
    Department

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    Other agencies includes the Departments of Agriculture ($651 million),
    Veterans Affairs ($297 million), Transportation ($243 million), Commerce
    ($150 million), and Treasury ($87 million), as well as the National
    Science Foundation ($344 million), National Aeronautics and Space
    Administration ($207 million), Social Security Administration ($155
    million), Environmental Protection Agency ($97 million), U.S. Army Corps
    of Engineers ($84 million), General Services Administration ($80 million),
    and several smaller agencies. Additionally, OMB reported the Intelligence
    Community figure in aggregate; it did not break it out by individual
    departments (e.g., Central Intelligence Agency).

    The National Strategy for Homeland Security and the related HSPDs
    typically identify a specific federal department as being a "lead" agency
    for specific initiatives. However, the language varies in precision. In
    some cases, the documents use clear language to identify which department
    will lead efforts across the government. In other cases, the lead is more
    implied than stated. Sometimes, more than one department is identified as
    a lead agency-which can occur because some of the initiatives in the
    strategy are large in scope, and different departments lead different
    parts of the initiatives. The identification of lead agency is important
    in order to specify which agencies are accountable for the implementation
    of the

    initiatives, particularly if implementation requires the efforts of
    several different agencies exercising different statutory authorities. By
    clearly identifying the lead agency, the strategies and the HSPDs enable
    the federal, state, local, and private stakeholders to determine who is
    responsible and accountable for the implementation, and thus more
    effectively direct their inquiries and integrate their own actions,
    particularly where multiagency coordination is required. See appendix IX
    for a complete list of the initiatives and the departments identified as
    lead agencies.

    Congress, because of concerns about terrorism in recent years, chartered
    four commissions to examine terrorist threats and the government's
    response to such threats, as well as to make recommendations to federal,
    state, local, and private organizations. These national commissions
    included the following:

    o  	The Bremer Commission: the National Commission on Terrorism, chaired
    by Ambassador Paul Bremer, which issued its report in June 2000.

    o  	The Gilmore Commission: the Advisory Panel to Assess Domestic Response
    Capabilities for Terrorism Involving Weapons of Mass Destruction, chaired
    by Governor James S. Gilmore, III, which issued its final report in
    December 2003.

    o  	The Hart-Rudman Commission: the U.S. Commission on National
    Security/21st Century, chaired by Senators Gary Hart and Warren B. Rudman,
    which issued its final report in February 2001.

    o  	The 9/11 Commission: the National Commission on Terrorist Attacks upon
    the United States, chaired by Governor Thomas H. Kean, which issued its
    final report in July 2004.

    Scope and	To determine whether the key federal departments addressed
    strategy initiatives in their planning and implementation activity, we
    identified the

    Methodology 	43 major initiatives and the six key federal departments for
    review. We evaluated each department's high-level strategic planning
    documents related to homeland security to determine if they had planning
    or implementation activities related to each initiative. To satisfy the
    planning and implementation criteria, we generally required departments to
    provide documentary support for one such activity, per initiative. Where
    classified or undocumented activities were involved, we worked with
    department officials to verify the activity. We provided the results of
    our analyses to

    planning officials from the various departments for their verification.
    Additionally, we reviewed the language in the strategy and HSPDs to
    determine which departments had been identified as lead agencies in
    implementing the initiatives. In some cases, the leadership language was
    clear; in other cases, it was less precise or implied. We were then able
    to determine whether departments demonstrated planning or implementation
    activities in both lead and nonlead initiatives. Our analysis is
    necessarily a snapshot of activity as of particular points in time. The
    agencies reviewed provided us with information as to their planning and
    implementation as of various dates, including fiscal year 2004. We
    recognize that the agencies continue to plan and implement their
    strategies and programs and have and may continue to progress beyond the
    status portrayed in this analysis. Finally, our work did not assess the
    status or quality of the work being planned or implemented.

    To determine homeland security challenges facing the nation, we reviewed
    our reports issued since September 11. This included over 250 products
    cutting across the gamut of homeland security activities. We summarized
    and categorized the challenges by critical mission area and subtopic where
    appropriate (e.g., the Border and Transportation Security mission area was
    subdivided into border security and transportation security). While our
    summary is limited to challenges we identified, we have noted in the text
    where the congressionally chartered commissions have raised similar
    issues. We recognize that these commissions, Congress, the executive
    branch, and other organizations have identified additional challenges in
    each of the mission areas.

    We conducted our work between February and November 2004 in accordance
    with generally accepted government auditing standards. For more details on
    our objectives, scope, and methodology, see appendix I.

    The following sections provide summaries of each mission area, as well as
    issues that cut across all six mission areas. These summaries include an
    analysis of federal departments' strategic planning and implementation
    activities and the challenges faced by these departments and the nation as
    a whole.

    Agency Plans, Implementation, and Challenges

    Intelligence and Warning 	The strategy identifies five initiatives under
    the Intelligence and Warning mission area. All of the initiatives are
    covered by at least two departments planning or implementation activities
    (see table 1). Examples include DOJ and DOE activities to enhance the
    analytic capabilities of the Federal

    Bureau of Investigation (FBI); DHS, State, and DOE activities to utilize
    dual-use analysis to prevent attacks; and DHS, DOD, and DOE activities to
    employ red-team techniques.

    Four of the five initiatives have a department identified as a lead
    agency. Neither the strategy nor the HSPDs identified a lead agency on the
    fifth initiative, which relates to the employment of red-team techniques.
    According to DHS strategic planning officials, it is important that a
    number of agencies conduct red-team techniques to test their own specific
    programs, so no agency would necessarily have the overall lead. See
    appendix II for a more detailed discussion on the implications of not
    having an overall lead agency identified for red-team techniques. For this
    mission area, the lead agency specifications are clear (rather than
    implied), and there are no multiple leads on any of the initiatives.

    All five initiatives were being implemented in fiscal year 2004 as
    reported by two or more departments (see table 7). DHS and DOJ cited 2004
    implementation activity for each of the initiatives for which they were
    identified as lead agencies.

    Table 1: Department Leadership, Planning, or Implementation Activity in
    the Intelligence and Warning Mission Area's Five Initiatives

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix II for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation. As explained further in appendix II, we did not
    include CIA in our analysis because of the lack of funding data and
    because the strategy provides little discussion of the agency.

    Our work in the Intelligence and Warning mission area since 2001 has
    highlighted a number of challenges that need to be addressed. Many of
    these challenges are directly related to initiatives in this mission area.
    These challenges include

    o  	improving analysis capabilities at the FBI through better strategic
    information management,

    o  	developing productive information-sharing relationships among the
    federal government and state and local governments and the private sector,

    o  	overcoming the limitations in the sharing of classified national
    security information across sectors,

    o  	ensuring that the private sector receives better information on
    potential threats,

    o  	consolidating watch lists to promote better information and sharing,
    and

    o  maintaining a viable and relevant homeland security advisory system.

    These challenges are discussed in greater detail in appendix II. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

    Border and Transportation Security

    There are six initiatives under the Border and Transportation Security
    mission area. All of the initiatives are covered by at least two
    departments' planning or implementation activities (see table 2). Examples
    include DHS, DOD, HHS, State, and DOE activities to ensure accountability
    in border and transportation security; DHS, DOD, State, and DOE activities
    to increase the security of international shipping containers; and DHS,
    DOJ, and State activities to reform immigration services.

    All six initiatives have a department identified as a lead agency. One
    initiative (i.e., creating smart borders) has multiple lead agencies
    identified in the strategy and HSPDs. DHS is a lead on the most
    initiatives: a clear lead on two initiatives and an implied lead on four
    other initiatives.

    All six initiatives were being implemented in fiscal year 2004 as reported
    by one or more departments (see table 8). DHS and State cited 2004
    implementation activity in each of the initiatives for which they were
    identified as leads. DOJ had been identified as a lead agency with respect
    to creating smart borders and reforming immigration services, but with the
    transfer of the Immigration and Naturalization Service to DHS, DOJ
    officials indicated that the department was no longer serving as a lead on
    that initiative.

    Table 2: Department Leadership, Planning, or Implementation Activity in
    the Border and Transportation Security Mission Area's Six Initiatives

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix III for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation.

    Border and Transportation Security is another mission area where our work
    has indicated there are challenges to be addressed. Again, many of these
    challenges are directly related to initiatives in this mission area. These
    challenges include

    o  	striking an acceptable balance between security and the flow of
    commercial activity, travel, and tourism;

    o  	processing people at our nation's land ports of entry and determining
    the proper role of biometric technologies for security applications;

    o  	deploying the best available technologies for detecting radioactive
    and nuclear materials at U.S. ports of entry;

    o  	developing a clear and comprehensive policy on the use of visas as an
    antiterrorism tool and improving the management and oversight of programs
    to track visitors;

    o  	implementing an effective system to prescreen passengers prior to
    their arrival at the airport, as well as achieving and sustaining
    improvements in airline passenger and baggage screening; and

    o  	strengthening perimeter security at airports and countering the threat
    of hand-held missiles to commercial aviation.

    These and other challenges are discussed in greater detail in appendix
    III. Many of these challenges were also discussed by one or more of the
    Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions.

    Domestic Counterterrorism

    The Domestic Counterterrorism mission area has six initiatives. All of the
    initiatives are covered by at least one department's planning or
    implementation activities (see table 3). Examples include DHS, DOJ, DOD,
    HHS, and DOE activities to improve intergovernmental law enforcement
    coordination; DHS, DOJ, DOD, and State activities to facilitate
    apprehension of potential terrorists; and DHS, DOJ, and State activities
    to target and attack terrorist financing.

    Each of the six initiatives has a department that is identified as a lead
    agency. All indicated leads from the strategy and HSPDs are clear leads.
    For three of the six initiatives, multiple departments have been
    identified as leads.

    All 6 initiatives were being implemented in fiscal year 2004 as reported
    by one or more departments (see table 9). DOJ cited 2004 implementation
    activity on each of the six initiatives for which it was identified as a
    lead. DHS and State also cited implementation activity on all initiatives
    for which they were identified as lead agencies.

    Table 3: Department Leadership, Planning, or Implementation Activity in
    the Domestic Counterterrorism Mission Area's Six Initiatives

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix IV for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation.

    Domestic Counterterrorism is another mission area where our recent work
    has highlighted continuing challenges. These challenges threaten to
    undermine law enforcement agencies' ability to aggressively detect, deter,
    prevent, eradicate, and adjudicate terrorist activity. These challenges
    include

    o  	transforming the FBI from an investigative organization into a
    proactive entity focused on detecting and preventing terrorist activity,

    o  	modifying the FBI's related workforce and business practices to focus
    on counterterrorism and intelligence-related priorities,

    o  	improving interagency coordination to leverage existing law
    enforcement resources to investigate money laundering and terrorist
    financing,

    o  monitoring the use of alternate financing mechanisms by terrorists,

    o  	identifying and apprehending terrorists already present in the United
    States, and

    o  	recognizing counterfeit documentation and the use of identity fraud at
    U.S. borders and other security checkpoints.

    These challenges are discussed in greater detail in appendix IV. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

    Protecting Critical Infrastructures and Key Assets

    The strategy identifies eight initiatives under the Protecting Critical
    Infrastructures and Key Assets-commonly referred to as Critical
    Infrastructure Protection (CIP)- mission area. All of the initiatives are
    covered by at least four departments' planning or implementation
    activities (see table 4). Examples include DHS, DOJ, DOD, HHS, and DOE
    activities to unify America's infrastructure protection effort in DHS;
    DHS, DOD, HHS, and DOE activities to develop a national infrastructure
    protection plan and, all six departments' activities to secure cyberspace.

    Each of the eight initiatives has a department identified as a lead
    agency. In the case of five of the eight initiatives, the leads are clear;
    only in the case of three initiatives (i.e., enabling effective
    partnership with state and local governments and the private sector,
    securing cyberspace, and partnering with the international community to
    protect our transnational infrastructure) are there implied leads. For
    three of the eight initiatives, multiple lead agencies have been
    identified. For example, DOD, HHS, and DOE are all sector leads on the
    same initiative-building and maintaining a complete and accurate
    assessment of America's critical infrastructure and key assets. These
    departments have the sector leads as follows, DOD for defense industrial
    base, HHS for public health, and DOE for the energy sector.

    All eight initiatives were being implemented in fiscal year 2004 as
    reported by two or more departments (see table 10). DHS, DOD, HHS, State,
    and DOE cited implementation activity on all initiatives for which they
    were identified as lead agencies.

    Table 4: Department Leadership, Planning, or Implementation Activity in
    the Critical Infrastructure Protection Mission Area's Eight Initiatives

    DHS DOD State

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix V for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation.

    Our work related to CIP has identified several challenges. Overcoming the
    challenges presented in this mission area is made even more difficult
    because increasing the security of one type of target, such as aircraft or
    federal buildings, increases the possibility that terrorists may choose
    another type of target, such as trains or ports. The challenges include

    o  refining the federal government's role in managing CIP;

    o  	developing a comprehensive and coordinated national CIP plan that
    delineates the roles, defines interims objectives and milestones, sets
    time frames, and establishes performance measures;

    o  	developing productive information-sharing relationships within the
    federal government and among federal, state, and local governments and the
    private sector;

    o  	improving the federal government's capabilities to analyze incident,
    threat, and vulnerability information related to critical infrastructures
    and key assets;

    o  	improving the security of government facilities through a variety of
    methods, including better training and procedures to detect counterfeit
    documents and identity fraud; and

    o  	analyzing the strengths, interdependencies, and vulnerabilities of
    several specific industries, including the financial services sector, the
    shipping and postal system, drinking water, agriculture, the chemical
    industry, nuclear power plants, and nuclear weapons sites.

    These challenges are discussed in greater detail in appendix V. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

    Defending Against Catastrophic Threats

    There are six initiatives under the Defending against Catastrophic Threats
    mission area. All of the initiatives are covered by at least two
    departments' planning or implementation activities (see table 5). Examples
    include DHS, DOD, State, and DOE activities to prevent terrorist use of
    nuclear weapons through better sensors and procedures; DHS, DOD, HHS, and
    DOE activities to detect chemical and biological materials and attacks;
    and DHS, DOD, HHS, State, and DOE activities to harness the scientific
    knowledge and tools to counter terrorism.

    Each of the six initiatives has a department identified as a lead agency.
    On half the initiatives, multiple departments have been identified as
    leads. In the case of three initiatives, the leads are clear; in the case
    of the remaining three initiatives, several leads are implied.

    All six initiatives were being implemented in fiscal year 2004 as reported
    by one or more departments (see Table 11). DHS cited implementation
    activity in five of the six initiatives for which it was identified as a
    lead. It is not yet implementing the Select Agent Program. DOD, HHS,
    State, and DOE cited implementation activity on all the initiatives for
    which they were identified as the lead agency.

    Table 5. Department Leadership, Planning, or Implementation Activity in
    the Defending Against Catastrophic Threats Mission Area's Six Initiatives

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix VI for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation.

    The challenges the nation faces in defending itself against catastrophic
    threats-such as the terrorist use of chemical, biological, radiological,
    or nuclear (CBRN) weapons-are quite broad and could have devastating
    consequences if not effectively addressed. Our recent work in this mission
    area has highlighted challenges that include

    o  	strengthening efforts to keep weapons of mass destruction (WMD) and
    dual-use items (items having both commercial and military applications)
    out of the hands of terrorists,

    o  	controlling the sale of excess items that can be used to produce and
    deliver biological agents, and

    o  	designating lead agencies for setting priorities for information
    systems related to terrorism.

    These challenges are discussed in greater detail in appendix VI. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

    Emergency Preparedness and Response

    For the Emergency Preparedness and Response mission area, the strategy
    identifies 12 initiatives. All of the initiatives are covered by at least
    two departments' planning or implementation activities (see table 6).
    Examples include DHS, DOD, HHS, and DOE activities to create a national
    incident management system; DHS and HHS activities to enable seamless
    communications among all responders; and, DHS, DOD, HHS, and DOE
    activities to augment America's pharmaceutical and vaccine stockpiles.

    Each of the 12 initiatives has a department identified as a lead agency.
    For 3 of the 12 initiatives, multiple lead agencies have been identified.
    All leads, with three exceptions, are clear leads.

    All 12 initiatives were being implemented in fiscal year 2004 by two or
    more departments (see table 12). DHS, DOD and HHS cited implementation
    activity in 2004 for all initiatives for which they were identified as
    lead agencies.

    Table 6: Department Leadership, Planning, or Implementation Activity in
    the Emergency Preparedness and Response Mission Area's Twelve Initiatives

    DHS DOD State

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Source: GAO.

    Refer to appendix VII for more specific details regarding department
    planning and implementation activities, including a discussion of fiscal
    year 2004 implementation.

    Our recent work has shown that there are many challenges in the Emergency
    Preparedness and Response mission area regarding efforts to effectively
    minimize the damage and successfully recover from terrorist attacks. We
    identified the following challenges:

    o  	adopting an "all hazards" approach to emergency preparedness and
    response;

    o  	providing better governmental planning and coordination with regard to
    first responder issues;

    o  	preparing first responders for incidents involving catastrophic
    terrorism;

    o  restructuring the federal grant system for first responders;

    o  	strengthening public health in a variety of areas, including better
    information sharing, preparations for catastrophic terrorism such as
    bioterrorism, and more hospital equipment;

    o  	improving regional response planning involving multiple
    municipalities, states, and countries;

    o  establishing and implementing preparedness standards and measures;

    o  	ensuring adequate communications among first responders and with the
    public; and

    o  	defining the roles and responsibilities of DOD in defending the
    homeland and providing military support to civil authorities.

    These challenges are discussed in greater detail in appendix VII. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

                                  Crosscutting Issues

    Our recent work has also identified homeland security challenges that cut
    across the various mission areas. While it is important that the major
    mission challenges be individually addressed, it is equally important that
    these challenges be addressed from a comprehensive national homeland
    security perspective (i.e., some mission areas overlap, some challenges
    are common across mission areas, some corrective actions have
    ramifications, and there are both positive and negative challenges across
    mission area boundaries). Coordinated actions may substantially enhance
    multiple mission performance. The National Strategy for Homeland Security
    and the corresponding strategic plans of the agencies accountable for
    achieving the national strategy's objectives must address and resolve the
    sometimes competing issues among homeland security mission areas and
    between homeland security and other important national priorities and
    objectives. These crosscutting issues are often the most difficult to
    address. Some of these challenges that we have identified are
    governmentwide in nature-they cut across the federal, state, and local
    governments, and sometimes private sectors. Such governmentwide challenges
    that we have identified include

    o  	balancing homeland security needs with other national requirements by
    formulating realistic budget and resource plans that support the
    implementation of an efficient and effective homeland security program;

    o  	providing timely and transparent homeland security funding information
    that sets forth detailed information concerning the obligation of the
    funding provided;

    o  	improving risk management methods for resource allocation and
    investments by developing a commonly accepted framework and supporting
    tools to guide agency analysts in providing information to management;

    o  	establishing baseline performance goals and measures upon which to
    assess and improve prevention efforts, evaluate vulnerability reduction,
    and gauge responsiveness to damage and recovery needs at all levels of
    government;

    o  	clarifying the roles and responsibilities within and between the
    levels of government and the private sector through the development and
    implementation of an overarching framework and criteria to guide the
    process;

    o  	developing a national blueprint-called an enterprise architecture-to
    help integrate different organizations' efforts to improve homeland
    security; and

    o  	improving governmentwide information technology management through the
    consistent application of effective strategic planning and performance
    measurement practices.

    These challenges are discussed in greater detail in appendix VIII. Many of
    these challenges were also discussed by one or more of the Bremer,
    Gilmore, Hart-Rudman, and 9/11 Commissions.

    In addition to the challenges discussed earlier, DHS-as the department
    most responsible for Homeland Security-faces a number of challenges.
    Because of this, in January 2003, we designated the overall implementation
    and transformation of DHS as high-risk. 9 We gave it this designation for

    9See GAO, Major Management Challenges and Program Risks, Department of
    Homeland Security, GAO-03-102 (Washington, D.C.: Jan. 24, 2003).

    Concluding Observations

    three reasons. First, the size and complexity of the effort make the
    challenge especially daunting, requiring sustained attention and time to
    achieve the department's mission in an effective and efficient manner.
    Second, the components being merged into DHS already face a wide array of
    existing challenges that must be addressed. Finally, if DHS cannot
    effectively carry out its mission, it exposes the nation to potentially
    very serious consequences. We are currently in the process of reviewing
    the challenges faced by DHS and the progress it has made to address these
    challenges. The results of this review will be published in a forthcoming
    GAO report.

    All 43 initiatives of the National Strategy for Homeland Security were
    included in plans and implementation activities in fiscal year 2004 by at
    least one of the six key departments we reviewed. Further, 33 of the 43
    initiatives (77 percent) were being planned or implemented by at least
    three of the six departments. Additionally, we found that the strategy and
    HSPDs identified lead agencies for 42 of the 43 initiatives. For these 42
    initiatives where a lead had been identified, 13 initiatives had leads
    that were implied rather than clear. While DHS was identified as the lead
    for the most initiatives (37), there were multiple leads for 12 of these
    42 initiatives. Given the large number of initiatives being implemented by
    multiple agencies, the fact that some of the leads were implied rather
    than clear, and the fact that about a third of the initiatives had
    multiple leads, coordination across federal departments will be a key
    factor required for the successful implementation of the strategy. Such
    coordination would ensure that federal departments are working to support
    the lead agency, are complementing one anothers' leadership when there are
    multiple lead agencies, and are not unnecessarily duplicating one
    anothers' programs when there are multiple departments implementing the
    same initiatives.

    When implementing the strategy's initiatives, these federal departments
    face a number of challenges that cut across all the mission areas. In
    terms of resources, the nation must find the appropriate balance between
    homeland security and other priorities. Finding this balance will require
    an improved risk management framework for resource allocation and
    investments. It will also require an improved set of performance and
    results measures to gauge our progress. Further, finding that balance must
    take into consideration nonfederal resources, but the strategy and HSPDs
    have not in many cases defined the roles and responsibilities of the
    state, local, and private sectors. Finally, an enterprise architecture
    would help coordinate the larger effort across the myriad of organizations
    involved in implementing the strategy.

    Agency Comments
    and Our Evaluation

    One of the key challenges for the Congress is to provide oversight to
    ensure that federal departments are coordinating their activities as they
    attempt to implement the National Strategy for Homeland Security.

    We provided a draft of this report to DOD, DOE, DOJ, HHS, DHS, the State
    Department, and the Homeland Security Council for comment. We received
    written comments from DOD, HHS, DHS, and DOJ, which appear in appendixes
    XI -XIV respectively. In addition to providing their written comments,
    these departments and DOE provided technical comments, which we
    incorporated as appropriate. State and the Homeland Security Council
    declined to provide any comments on this report. DOD stated that the
    report was "a thorough and accurate report." DHS indicated our summation
    of the strategic planning, implementation, and leads of the six
    departments to be "particularly useful." DOE, DOJ, and HHS neither
    concurred nor disagreed with the report. In addition, agencies provided
    comments on the many GAO reports that cumulatively describe the range of
    implementation challenges featured in this capping report. These comments
    can be found in the appropriate reports, as cited in our footnotes and
    listed in the Related GAO Products section.

    As agreed with your office, unless you publicly announce its contents
    earlier, we plan no further distribution of this report until 30 days
    after its
    issue date. At that time, we will provide copies of this report to
    appropriate departments and interested congressional committees. We
    will also make copies available to others upon request. In addition, the
    report will be available at no charge on GAO's Web site at
    http://www.gao.gov.

    If you or your staff have any questions about this report, please contact
    me
    on 512-6787. Other contacts and staff acknowledgments are listed in
    appendix XV.

    Sincerely yours,

    Norman J. Rabkin
    Managing Director
    Homeland Security and Justice Issues

    Appendix I: Objectives, Scope, and Methodology

    The first objective focuses on the extent to which key federal departments
    with homeland security responsibilities address the 43 initiatives of the
    National Strategy for Homeland Security in their planning and
    implementation activities.

    We selected departments based on a review of their fiscal year 2005 budget
    requests for homeland security-related issues. The six departments with
    the largest budget requests were selected-together they account for 94
    percent of the fiscal year 2005 budget requests for homeland security. The
    six departments are the Departments of Defense (DOD), Energy (DOE), Health
    and Human Services (HHS), Homeland Security (DHS), Justice (DOJ), and
    State.

    We defined three time-oriented indicators to distinguish the timing of the
    departments' strategic planning or implementation activities with respect
    to each of the 43 initiatives of the six mission areas.

    o  	"Prior implementation" was defined as a departmental program or
    activity that occurred prior to fiscal year 2004.

    o  	"Recent planning" was defined as either (1) a program or activity
    specifically indicated by the participating department as being developed
    in its latest high-level planning documents (which include the
    department's strategic plan, annual plan, or performance plan) or (2) a
    program or activity, not listed in these planning documents, but indicated
    by department officials as being under development since July 2002 (when
    the strategy was issued).

    o  	"2004 implementation," in turn, was defined as a departmental program
    or activity that occurred during all, or part, of fiscal year 2004.

    A department could satisfy (a) neither of these indicators (demonstrating
    no strategic planning and implementation activities on a given initiative,
    within the prescribed time periods) or (b) combinations of one through
    three of these indicators, for each initiative (e.g., one department may
    have engaged in prior implementation that was carried over into fiscal
    year 2004 implementation; a second department may have engaged in recent
    planning, followed by 2004 implementation; and a third department may have
    only engaged in prior implementation, as its activity was completed or
    terminated.)

    Appendix I: Objectives, Scope, and Methodology

    We obtained and reviewed each department's latest strategic planning
    documents (i.e., their strategic plan, annual plan, and performance plan)
    to determine whether these documents provided specific information about
    the department's prior implementation and recent planning activities, with
    respect to each mission area initiative. We scored a department as
    engaging in prior implementation activity or recent planning if these
    documents demonstrated at least one such activity with respect to each
    initiative. We also reviewed the documents to determine if any programs or
    activities had been transferred to another department or agency. In some
    cases, this may account for prior implementation activity but no further
    planning or implementation activity.

    Since the latest departmental strategic documents do not sufficiently
    address fiscal year 2004 implementation activities, we contacted strategic
    planning officials at each the six departments and asked them to provide
    evidentiary support for their 2004 implementation activities, with respect
    to each relevant initiative. We scored a department as implementing
    activities on a given initiative if the department could demonstrate at
    least one such activity occurring during fiscal year 2004 with respect to
    that initiative. We also requested department strategic planning officials
    to review our findings regarding planning and implementation and to make
    any modifications or additions necessary. Evidentiary support was
    requested for any such change. Very few changes were provided across all
    six departments. Departments provided the data during fiscal year 2004. We
    did not verify the accuracy of the data or the progress of particular
    activities.

    In addition to identifying departmental engagement in planning and
    implementation activities, we also sought to determine departmental
    leadership responsibility on each initiative. To satisfy the leadership
    role, departments had to satisfy at least one of the following two
    indicators:

    o  leadership of the entire critical mission area initiative or

    o  	leadership in specific functional area(s) encompassed within that
    initiative.

    We identified departmental leadership roles on specific initiatives, based
    on a review of the provisions in the strategy and Homeland Security
    Presidential Directives (HSPD) one through 12. In only a few instances did
    a department indicate to us that subsequent legislation, regulation, or
    transfer of activities absolved them of their leadership roles. Because
    the language of the strategies and HSPDs was not always precise, we

    Appendix I: Objectives, Scope, and Methodology

    identified departments as either (a) "clear" (explicit) leads, (b)
    "implied" leads, or (c) no leads for each initiative. In the mission area
    tables, in both the letter and appendixes, departments with a clear lead
    on a given initiative are indicated by a hard-line box; departments with
    an implied lead on a given initiative are indicated by a broken-line box;
    departments not having any lead on a given initiative have no box
    designations. Drafts of this section of the report were submitted to the
    departments for their review.

    The second objective focuses on identifying the challenges the nation
    faces in homeland security implementation. This work is based exclusively
    on a review of challenges identified in GAO products issued since
    September 11, 2001. During this time period, we were able to identify over
    250 relevant GAO products related to homeland security. These, and others,
    can be found in our Related Products section at the end of the report. The
    challenges identified are arrayed throughout the report by mission area
    and subtopical area.

    We conducted our work between February and November 2004 in accordance
    with generally accepted government auditing standards.

                         Appendix II: Intelligence and Warning

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Intelligence and Warning mission area and discusses the agencies with
    major roles, their funding, and the alignment of their strategic plans and
    implementation activities with the initiatives, and a summary of the key
    challenges faced by the nation. This appendix presents baseline
    information that can be used by Congress to provide oversight and track
    accountability for the initiatives in the Intelligence and Warning mission
    area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six critical mission areas, the first of which is
    Intelligence and Warning. This mission area includes intelligence programs
    and warning systems that can detect terrorist activity before it manifests
    itself in an attack so that proper preemptive, preventive, and protective
    action can be taken. Specifically, this mission area is made up of efforts
    to identify, collect, analyze, and distribute source intelligence
    information or the resultant warnings from intelligence analysis.
    Activities in this mission area often dovetail into the mission areas of
    domestic counterterrorism and, in some cases, critical infrastructure
    protection, as agencies move to take immediate action or develop long-term
    protective measures based on threat or vulnerability information.1 Figure
    3 is an example of one of the initiatives found in the Intelligence and
    Warning mission area.

    The strategy identifies the following initiatives in the Intelligence and
    Warning mission area:

    o  enhancing the analytic capabilities of the FBI,

    o  	building new capabilities through the Information Analysis and
    Infrastructure protection Division of the Department of Homeland Security,

    o  implementing the Homeland Security Advisory System,

    o  utilizing dual-use analysis to prevent attacks, and

    o  employing red team techniques.

    1This definition is from the Office of Management and Budget's (OMB) 2003
    Report to Congress on Combating Terrorism (Washington, D.C.: Sept. 2003).

                         Appendix II: Intelligence and Warning

    Figure 3: The Five Threat Levels of the Homeland Security Advisory System

    Source: DHS.

    Of the six departments under review, the Department of Homeland Security
    and the Department of Justice have major roles in the Intelligence and
    Warning mission area. Within DHS, the Information Analysis and
    Infrastructure Protection Directorate (IAIP) analyzes terrorism-related
    threat information relevant to homeland security, associates threat
    analysis with infrastructures and people, and provides warnings and
    advisories to agencies, state and local governments, and select critical
    infrastructure owners and operators. The U.S. Secret Service, also a
    component of DHS, provides intelligence and advanced analysis for
    protective operations. The Department of Justice has two components
    involved in Intelligence and Warning activities-the Federal Bureau of
    Investigation (FBI) shares intelligence with other federal agencies, as
    well as with state and local authorities; while the Office of Justice
    Programs (OJP) funds counterterrorism training for senior law enforcement
    personnel at the state and local level.

    The Office of Management and Budget (OMB) reported that the total fiscal
    year 2005 funding request for the Intelligence and Warning mission area is
    $474 million, with the bulk of this funding going to DHS (61 percent),
    primarily for IAIP and the U.S. Secret Service. Other agencies with
    significant funding in this mission area include DOJ (19 percent),
    primarily for the FBI, and the Intelligence Community (15 percent) for the
    Terrorist

    Agencies with Major Roles in Intelligence and Warning

    Appendix II: Intelligence and Warning

    Threat Integration Center (TTIC).2 Figure 4 summarizes the fiscal year
    2005 budget request for the Intelligence and Warning mission area by
    agency.

    Figure 4: Proposed Fiscal Year 2005 Homeland Security Funding for
    Intelligence and Warning

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    "All other agencies" includes the Departments of Agriculture ($20 million)
    and Treasury ($.6 million), as well as the Intelligence Community
    Management Account ($72 million). OMB reported the Intelligence Community
    figure in aggregate; it did not break it out by individual agencies (e.g.,
    Central Intelligence Agency).

    OMB's reported data does not include funding for three departments that
    have activities under way in this mission area. These departments-
    Defense, State, and Energy-have either planning or implementation activity
    on specific initiatives, as discussed in the next section of this
    appendix. On the basis of our previous work, we have noted several

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004). OMB did not break the
    Intelligence Community spending down to the level of individual agencies.

                         Appendix II: Intelligence and Warning

    qualifications to OMB's figures to explain this discrepancy.3 According to
    OMB officials, there is not always a clear distinction between homeland
    security activities and other related activities. The OMB staff must make
    judgment calls about how to characterize funding by mission areas. For
    example, some homeland security activities have multiple purposes, so
    funding for these activities can be allocated among several accounts
    covering multiple mission areas. Moreover, some of the departments'
    activities, such as planning, coordination, or providing advice may
    support Intelligence and Warning activities, but are not included in the
    amounts shown.

    This appendix does not have any discussion of the Central Intelligence
    Agency (CIA) or the Intelligence Community as a whole, although they have
    activities related to the Intelligence and Warning mission area. There are
    two reasons for this omission. First, OMB's reported data do not include
    funding for the CIA. Second, the strategy itself is relatively silent on
    the CIA in terms of specific initiatives in this mission area. For
    example, the strategy only mentions the CIA once in the Intelligence and
    Warning mission area-the CIA was to provide intelligence analysts to
    assist the FBI enhance its analytic capabilities. Most of the initiatives
    in the strategy, as discussed in the next section, are led by DHS or DOJ.
    Similarly, there is little information on the Intelligence Community.
    While OMB reported data include $72 million in spending by the
    Intelligence Community Management Account, it does not break this amount
    out by specific departments or agencies. While the strategy mentions the
    Intelligence Community with respect to this mission area, it does not
    identify specific departments or agencies with specific initiatives. One
    potential reason for relatively little discussion of CIA and the
    Intelligence Community is the unclassified nature of the cost data and the
    strategy.

    This section provides more detailed information about the Intelligence and
    Warning mission area initiatives, and the departments involved in
    conducting activities related to these initiatives. This includes a
    discussion of specific departmental planning and implementation
    activities, lead agency designation, and implementation activities in
    fiscal year 2004, with respect to each initiative. The data are summarized
    in table 7.

    Alignment of Department Activities with the Major Initiatives

    3See GAO, Combating Terrorism: Funding Data Reported to Congress Should Be
    Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002).

                         Appendix II: Intelligence and Warning

    Table 7: Detailed Department Leadership and Planning/Implementation
    Activities in the Intelligence and Warning Mission Area's Five Initiatives

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

                                Summary of Departmental
                             Activities on the Initiatives

    All five Intelligence and Warning initiatives are being addressed in at
    least two of the key departments' planning and implementation activities
    (see table 7). For example, DHS, DOD, and DOE implemented Homeland
    Security Advisory System initiative activities during fiscal year 2004.
    More specifically, DHS implemented the system and issued advisories; DOD
    personnel interacted with DHS; and DOE aligned its security system and
    condition alert level to meet the Homeland Security Advisory System
    requirements of DHS. In addition, DHS, DOD, and DOE implemented new
    intelligence and warning capabilities through the IAIP initiative of DHS
    during fiscal year 2004. Specifically, DHS conducted assessments of
    critical infrastructures and key assets using the IAIP system; DOD worked
    in conjunction with DHS on the IAIP system; and DOE enacted a Safeguard
    and Security Program (using infrastructure information and analysis to
    gauge vulnerability assessments) and plays a role in disseminating threat
    information to energy sector industries.

    The Department of Health and Human Services (HHS) also has activities
    related to Intelligence and Warning, but these activities are not directly
    included under the initiatives as laid out by the strategy. For example
    HHS operates the Laboratory Response Network, the Epidemic Information

                         Appendix II: Intelligence and Warning

    Exchange, and the Food and Drug Administration's food inspection
    activities. In addition, it supports the DHS-managed BioWatch program.
    While the strategy does not list these as specific initiatives, they
    provide surveillance of infectious diseases and could provide early
    warning of a bioterrorism attack. For more on HHS's role, particularly
    with respect to bioterrorism, see appendix VI, on Defending against
    Catastrophic Threats.

    While we have identified department activities related to these
    initiatives, we did not determine the quality, status, or progress of such
    activities with respect to stated goals or targets within this mission
    area.

    Identification of Lead Agencies on the Initiatives

    For four of the five initiatives, a lead agency is identified either in
    the strategy or Homeland Security Presidential Directives (HSPDs). The one
    initiative where there was no lead identified was "the employment of
    redteam techniques." Red team techniques are techniques where the U.S.
    government would create a team (sometimes known as a red cell) to play the
    role of terrorists in terms of identifying vulnerabilities and planning
    attacks. Three departments (DHS, DOD, and DOE) had implemented activities
    related to this initiative. According to DHS strategic planning officials,
    it is important that a number of agencies conduct red-team techniques to
    test their own specific programs, so no agency would necessarily have the
    overall lead. However, terrorists are opportunistic and may purposefully
    plan attacks that take advantage of the seams between department programs
    or jurisdictions. Thus, there is some value in employing red-team
    techniques that look across federal departments, as well as across the
    state, local, and private sectors. Without an overall lead agency
    identified for this initiative, it is unclear which federal department
    will be accountable for employing red-team techniques at the interagency
    level against the nation as a whole.

    As shown in table 7, DHS is the lead on the most initiatives in this
    critical mission area-three out of the five initiatives (including
    building new capabilities through the Information Analysis and
    Infrastructure Protection Division, implementing the Homeland Security
    Advisory System, and utilizing dual-use analysis to prevent attacks). It
    is understandable that DHS would be the department with the most
    initiative leads given that DHS's strategic goals and objectives are to be
    directed toward preventing terrorist attacks in the United States and
    reducing America's vulnerability to terrorism-both of which require
    Intelligence and Warning system information to achieve their aims. The
    Department of Justice is a lead on one initiative, enhancing the analytic
    capabilities of the

                         Appendix II: Intelligence and Warning

    FBI. This, too, is understandable given that the FBI is an agency (or
    component) of DOJ.

    The strategy and HSPDs did not identify multiple leads on any of the five
    Intelligence and Warning initiatives (see table 7). In addition, these
    strategic documents clearly named all leads. DHS is named as a clear lead
    on three Intelligence and Warning initiatives; DOJ is identified as a
    clear lead on one initiative.

    Fiscal Year 2004 Implementation of the Initiatives

    Challenges in Intelligence and Warning

    In fiscal year 2004, implementation activity occurred with respect to each
    of the five Intelligence and Warning initiatives (see table 7). DHS
    implemented activity in each of the three initiatives for which it was
    identified as a lead. DOJ implemented activity in the one initiative for
    which it was named as the lead (enhancing the analytic capabilities of the
    FBI).

    Additionally, several of the departments under review implemented multiple
    Intelligence and Warning initiative activities for which they were not
    identified as a lead. During fiscal year 2004, DOE cited implementation
    activities in four of the five Intelligence and Warning initiatives for
    which it did not have a lead (prior to fiscal year 2004, it cited
    implementation activity with respect to three of the five initiatives.)
    DOD cited fiscal year 2004 implementation activities in 3 of 5 initiatives
    for which it did not have a lead. DHS cited planning and implementation
    activities during fiscal year 2004 on the one initiative for which it did
    not have lead responsibilities; and State cited both prior implementation
    and 2004 implementation activity on the one initiative for it was not
    cited as a lead in the strategy or HSPDs.

    With the element of surprise on their side, terrorists have the potential
    to do massive damage to an unwitting and unprepared target. It therefore
    follows that the United States must take appropriate action to develop and
    implement an effective Intelligence and Warning system that is capable of
    detecting planned terrorist activity, so that proper preemptive,
    preventive, and protective action can be taken. Our recent work in the
    Intelligence and Warning mission area has identified a number of
    challenges. These challenges include enhancing the analytical capabilities
    of the FBI, improving the coordination and mechanisms for sharing
    intelligence information across levels of government and the private
    sector, consolidating terrorist watch lists, and strengthening the
    homeland security advisory system.

                         Appendix II: Intelligence and Warning

    Enhancing the FBI's Analytical Capabilities

    The strategy has an initiative to enhance the FBI's analytic capabilities
    in order to address the agency's top priority-preventing terrorist
    attacks. The FBI is, therefore, "creating an analytical capability that
    can combine lawfully obtained domestic information with information
    lawfully derived from investigations, thus facilitating prompt
    investigation of possible terrorist activity within the United States." To
    accomplish this, the FBI has changed its priorities and accelerated
    modernization of its information technology (IT) systems. However, we
    reported in September 2003 that the FBI will be facing a number of
    challenges as it begins this modernization without having yet developed a
    modernization blueprint, commonly referred to as an enterprise
    architecture (a plan that defines how an organization operates today,
    intends to operate tomorrow, and intends to invest in IT systems to
    transition to this future state). 4 Architectures are essential to
    effectively managing such complex endeavors and are recognized as
    hallmarks of successful public and private organizations. The challenge
    for the FBI will be to make architecture development an institutional
    management priority; until this is accomplished and the architecture is
    developed and implemented, the FBI faces the challenge of ensuring systems
    currently being developed and deployed will be consistent with the
    yet-to-be-developed architecture. Our research and experience at federal
    agencies has shown that attempting a major modernization effort without a
    well-defined and enforceable architecture results in systems that are
    duplicative and not well integrated, are unnecessarily costly to operate
    and maintain, and do not effectively optimize mission performance.
    Additional challenges related to the FBI's transformation are contained in
    appendix IV, on domestic counterterrorism. The Bremer, Hart-Rudman,
    Gilmore, and 9/11 Commissions all made recommendations related to this
    challenge.

    Improving Intelligence Information Sharing

    According to the strategy, "homeland security intelligence and information
    must be fed instantaneously into the Nation's domestic anti-terrorism
    efforts, and "this effort must be structured to provide all pertinent
    homeland security intelligence and law enforcement information-from all
    relevant sectors including state and local law enforcement as well as
    federal agencies-to those able to take preventive or protective action."
    Since September 11, federal, state, and local governments have established
    initiatives to meet the challenge of sharing information to prevent

    4See GAO, Information Technology: FBI Needs an Enterprise Architecture to
    Guide Its Modernization Activities, GAO-03-959 (Washington, D.C.: Sept.
    25, 2003).

                         Appendix II: Intelligence and Warning

    terrorism. DHS has initiatives under way to enhance information sharing
    (including the development of a homeland security enterprise architecture
    to integrate sharing among federal, state, and local authorities). In
    addition, the FBI increased the number of its Joint Terrorism Task Forces,
    the Defense Intelligence Agency (DIA) entered into an information-sharing
    partnership with the state of California and the city of New York; and
    Massachusetts has established an antiterrorism network of state, local,
    and federal agencies. However, our August 2003 report5 noted that these
    initiatives, while beneficial for the partners, presented challenges
    because they (1) were not well coordinated, (2) rsked limiting
    participants' access to information, and (3) potentially duplicated the
    efforts of some key agencies at each level of government. We also found
    that despite various legislation, strategies, and initiatives, federal
    agencies, states, and cities did not consider the information sharing
    process to be effective. For example, information on threats, methods, and
    techniques of terrorists was not routinely shared, and the information
    that was shared was not perceived as timely, accurate, or relevant.
    Additionally, federal agencies were challenged by the inability of state
    or city governments to properly handle classified information and their
    lack of security clearances. The Gilmore and 9/11 Commissions made
    recommendations related to this challenge.

    Better Dissemination of Threat Information to the Private Sector

    The strategy discusses the need for threat-vulnerability integration,
    providing that "mapping terrorist threats and capabilities-both current
    and future-against specific facility and sectoral vulnerabilities will
    enable authorities to determine which organizations pose the greatest
    threat and which facilities are most at risk." However, in a March 2003
    report we noted that one of the nation's challenges is to develop and
    implement methods for effectively sharing information between government
    and the private sector. 6 For example, officials in several commercial
    industries have said that they need better threat information from law
    enforcement agencies, as well as better coordination among agencies
    providing threat information. Specifically, these officials stated that
    they did not receive

    5See GAO, Homeland Security: Efforts to Improve Information Sharing Need
    to Be Strengthened, GAO-03-760 (Washington, D.C.: Aug. 27, 2003).

    6See GAO, Homeland Security: Voluntary Initiatives Are Under Way at
    Chemical Facilities, but the Extent of Security Preparedness is Unknown,
    GAO-03-439 (Washington, D.C.: Mar. 14, 2003); Drinking Water: Experts'
    Views on How Future Federal Funding Can Best Be Spent to Improve Security,
    GAO-04-29 (Washington, D.C.: Oct. 31, 2003).

                         Appendix II: Intelligence and Warning

    sufficient specific threat information, and frequently received threat
    information from multiple government agencies. Similarly, DOJ observed
    that chemical facilities need more specific information about potential
    threats in order to design their security systems and protocols. Threat
    information also forms the foundations for some of the tools available to
    industry to assess facility vulnerabilities. Threat information is the
    foundation for hypothesizing about threat scenarios, which form the basis
    for determining site vulnerabilities. In reviewing security considerations
    involving commercial seaports, we found that similar challenges existed.
    Specifically, on the basis of visits to several of the commercial seaports
    designated by DOD as critical for use by the military for overseas
    deployments, we reported in October 2002 that although the organizations
    responsible for seaport security increased emphasis on security planning
    since September 11, there remained no single mechanism to analyze,
    coordinate, and disseminate threat information on a routine basis on the
    broad range of threats at each port. 7 Most threat information was
    coordinated on an informal basis, increasing the risk that threats-both
    traditional and nontraditional ones-may not be recognized or that threat
    information may not be communicated in a timely manner to all relevant
    organizations, including private sector organizations, at the ports. The
    Gilmore and 9/11 Commissions made recommendations related to this
    challenge.

    Consolidating Terrorist Watch Lists

    The strategy recognizes the need for "fully accessible sources of
    information related to suspected terrorists" through the establishment of
    a consolidated terrorism watch list. In April 2003 we reported that
    changing the federal government's diffused and nonstandard approach to
    developing and using terrorist watch lists-which are essential tools for
    performing, among other things, the nation's border security mission-
    involve addressing key management, technical, and legal challenges. 8 One
    of these challenges involves defining and implementing a new approach that
    overcomes individual agencies' unique culture and mission requirements.
    For example, a key reason for the varying extent to which watch list
    sharing is done involves cultural differences among the government and
    private sector agencies involved in securing our borders.

    7See GAO, Combating Terrorism: Actions Needed to Improve Force Protection
    for DOD Deployments through Domestic Seaports, GAO-03-15 (Washington,
    D.C.: Oct. 22, 2002).

    8See GAO, Information Technology: Terrorist Watch Lists Should Be
    Consolidated to Promote Better Integration and Sharing, GAO-03-322
    (Washington, D.C.: Apr. 15, 2003).

                         Appendix II: Intelligence and Warning

    Another challenge to be overcome involves the tendency of the watch lists
    to have overlapping but not identical sets of data, which makes their
    consolidation difficult. Additionally, the extent to which such sharing is
    accomplished electronically is constrained by fundamental differences in
    the watch lists' systems architecture (that is, the hardware, software,
    network, and data characteristics of the systems). Finally, while legal
    requirements have historically been another challenge to sharing, recent
    legislation has begun to address this barrier. For example, Congress
    passed the USA PATRIOT ACT, which has significantly changed the legal
    framework for information sharing when fully implemented, it should
    diminish the effect of existing legal barriers. 9 The 9/11 Commission made
    recommendations related to this challenge.

    Strengthening the Homeland Security Advisory System

    The strategy calls for the implementation of the Homeland Security
    Advisory System as a means of disseminating information regarding the risk
    of terrorist acts to federal, state, and local authorities; the private
    sector; and the American people. Utilizing five color-coded threat levels,
    the system was established by HSPD-3 in March 2002. However, in a March
    2004 testimony, we reported that DHS faces challenges in strengthening the
    advisory system and keeping it relevant and viable. For example, the
    system has generated questions concerning the quality and timeliness of
    the threat information being disseminated. 10 Specifically, DHS had not
    yet officially documented communication protocols for threat information
    and guidance to federal agencies and states, with the result that some
    federal agencies and states first learn about changes in the national
    threat level from the media. An additional challenge relates to the
    comprehensiveness of information provided with regard to actions to be
    taken in response to changes in the threat level. For example, public
    warnings did not include guidance on actions to be taken in response to a
    specific threat. Moreover, federal agencies responding to our inquiries
    indicated that an additional challenge involves their inability to
    determine appropriate protective measures to be implemented because of a
    lack of specific threat information. For example, federal agencies
    indicated to us that, particularly, region-, sector-, site-, or
    event-specific threat information-to the extent that it is available-would
    be helpful. Since the time of our

    9Pub. L. 107-56.

    10See GAO, Homeland Security: Risk Communication Principles May Assist in
    Refinement of the Homeland Security Advisory System, GAO-04-538T
    (Washington, D.C.: Mar. 16, 2004).

    Appendix II: Intelligence and Warning

    report, DHS has provided more specific warnings by both sector (e.g., the
    financial sector) and location (e.g., New York and Washington, D.C.). The
    Gilmore Commission made recommendations related to this challenge.

    Appendix III: Border and Transportation Security

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Border and Transportation Security mission area and discusses the agencies
    with major roles, their funding, the alignment of their strategic plans
    and implementation activities with the major initiatives, and a summary of
    the key challenges faced by the nation. This appendix presents baseline
    information that can be used by Congress to provide oversight and track
    accountability for the initiatives in the Border and Transportation
    Security mission area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six critical mission areas, the second of which is Border
    and Transportation Security. This mission area includes programs designed
    to fully integrate homeland security measures into existing domestic
    transportation systems and focuses on promoting the efficient and reliable
    flow of people, goods, and services across borders, while preventing
    terrorists from using transportation conveyances or systems to deliver
    implements of destruction. Activities in this mission area often dovetail
    into domestic counterterrorism as agencies take law enforcement action to
    address potential threats to the homeland that may originate along our
    borders or in our transportation systems. Also, because transportation is
    a critical infrastructure sector, this mission area is also closely
    related to the critical infrastructure protection mission area. For
    example, homeland security actions at seaports would involve activities in
    both mission areas.1 Figure 5 shows an example of the type of activities
    found in the Border and Transportation Security mission area.

    The strategy identifies the following major initiatives in the border and
    transportation mission area:

    o  ensuring accountability in border and transportation security,

    o  creating smart borders,

    o  increasing the security of international shipping containers,

    o  implementing the Aviation and Transportation Security Act of 2001,

    o  recapitalizing the U.S. Coast Guard, and

    o  reforming immigration services.

    1This definition is from OMB's 2003 Report to Congress on Combating
    Terrorism (Washington, D.C.: Sept. 2003).

    Appendix III: Border and Transportation Security

    Figure 5: U.S. Customs and Border Patrol Marine Officers on the Waters of
    the Rio Grande, along the United States and Mexico Border

    Source: U.S. Customs and Border Patrol.

    Of the six agencies under review, DHS and State have major roles in Border
    and Transportation Security. Within DHS, the U.S. Customs and Border
    Protection (CBP) conducts inspections at ports of entry to detect and
    prevent people and goods from entering the country illegally, while the
    Bureau of Immigration and Customs Enforcement (ICE) investigates and
    enforces laws against the unlawful presence of people and goods in the
    country; the Transportation Security Administration (TSA) performs some
    aviation security activities, while overseeing others, and coordinates the
    development of security measures for nonaviation modes of transportation;
    and the U.S. Coast Guard leads security activities at the nation's ports.
    State plays a role in this mission area through its administration of the
    visa program to ensure against travel into the United States by terrorists
    or others whose presence may undermine U.S. national security. Although
    not one of six agencies we reviewed, the Department of Agriculture (USDA)
    also has a role in border and transportation security. Specifically,
    USDA's Animal and Plant Health Inspection Service (APHIS) performs
    agricultural quarantine activities and risk analysis at U.S. ports of
    entry.

    Agencies with Major Roles in Border and Transportation Security

    Appendix III: Border and Transportation Security

    OMB reported that the total fiscal year 2005 funding request for border
    and transportation security is $17 billion, with the majority of this
    going to DHS (almost $16 billion, or 93 percent), largely for CBP, TSA,
    and the Coast Guard. Other DHS bureaus, as well as other agencies-such as
    USDA and State-have significant funding in this mission area as well.2
    Figure 6 summarizes the fiscal year 2005 budget request for the border and
    transportation security mission area by agency.

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004).

    Appendix III: Border and Transportation Security

    Figure 6: Proposed Fiscal Year 2005 Homeland Security Funding for Border &
    Transportation Security

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    "All other agencies" includes USDA ($169 million) and the Department of
    Transportation ($19 million).

    OMB's reported data do not include funding for three departments that have
    activities under way in this mission area. These departments-DOD, HHS, and
    DOE-have either planning or implementation activity on specific
    initiatives, as discussed in the next section of this appendix. On the
    basis of previous work, we have noted several qualifications to OMB's
    figures to explain this discrepancy.3 According to OMB officials, there is
    not always a clear distinction between homeland security activities and
    other related activities. OMB staff must make judgment calls about how to
    characterize funding by mission areas. For example, some homeland security
    activities have multiple purposes, and funding for these activities is
    comingled in accounts that can cover multiple mission areas. In

    3See GAO-03-170.

    Appendix III: Border and Transportation Security

    addition, some of the departments' activities, such as planning,
    coordination, or providing advice may support Border and Transportation
    Security activities but are not included in the amounts shown.

    Alignment of This section provides more detailed information about the
    Border and

    Transportation Security mission area initiatives and the departments
    Department Activities involved in conducting activities related to these
    initiatives. This includes with the Major a discussion of specific
    departmental planning and implementation

    activities, lead agency designations, and implementation activities in
    fiscal Initiatives year 2004, with respect to each initiative. The data
    are summarized in table

    8.

    Table 8: Detailed Department Leadership and Planning/Implementation
    Activities in the Border and Transportation Mission Area's Six Initiatives

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

    Summary of Departmental All six Border and Transportation Security
    initiatives are being addressed

    Activities on the Initiatives 	in at least two of the key departments'
    planning and implementation activities (see table 8). At least three
    departments cited activity in four of the six initiatives. For example,
    DHS, DOD, State, and DOE implemented

    Appendix III: Border and Transportation Security

    shipping container security initiative (CSI) activities in fiscal year
    2004. DHS deployed Customs and Border Protection officers to Malaysia to
    conduct CSI activity; DOD provided an intelligence perspective on
    container and port security vulnerabilities, aiding in the development and
    deployment of technologies; State engaged in diplomatic efforts with
    additional countries to conclude further CSI agreements; and DOE worked
    with Lithuania to install nuclear detection equipment at the Vilnius
    Airport, as well as other airports and other locations in other foreign
    countries. Additionally, DHS, HHS, and State demonstrated implementation
    activities in fiscal year 2004 with respect to creating smart borders. DHS
    developed, acquired, and deployed biometrically enabled, travel document
    reader technology, at air, sea, and land ports of entry; the Food and Drug
    Administration within HHS established guidance requiring the registration
    of domestic and foreign facilities that manufacture, process or hold food
    for consumption in the United States; and State deployed biometric
    collection capability to consular posts worldwide.

    All six departments have been engaged in Border and Transportation
    Security initiatives.

    While we have identified department activities relates to these
    initiatives, we did not determine the quality, status, or progress of such
    activities with respect to stated goals or targets within this mission
    area.

    Identification of Lead Agencies on the Initiatives

    For all six initiatives, a lead agency is identified either in the
    strategy or HSPDs. As shown in table 8, DHS is the lead on the most
    initiatives in the mission area-six of six initiatives. It is
    understandable that DHS would be the department with the most initiative
    leads, given that the initiatives (a) emphasize DHS's twin goals of
    preventing terrorist attacks and reducing border vulnerability; and (b)
    reflect a transfer of the Customs Service, Immigration and Naturalization
    Service, and Coast Guard to DHS. State is also identified as a lead on the
    initiative to create smart borders. Given the initiative's emphasis on
    visa issuance and consular office participation in detecting potential
    terrorists, it seems appropriate that State would be identified in a
    leadership capacity. DOJ had been identified as a lead agency with respect
    to two initiatives, creating smart borders and guarding America's critical
    infrastructure and key assets against "inside" threats. However, given the
    transfer of the Immigration and Naturalization Service and the National
    Infrastructure Protection Center programs to the Department of Homeland
    Security, DOJ officials indicated the department no longer serves as the
    lead on these two initiatives.

    Appendix III: Border and Transportation Security

    Creating smart borders is the only initiative for which there are multiple
    leads in the Border and Transportation Security area (see table 8). The
    two department leads in this initiative are DHS and State. Additionally,
    departmental documents show that DHS is a clear lead on two initiatives
    and an implied lead on three initiatives. State is a clear lead on its
    single initiative.

    Fiscal Year 2004 Implementation of the Initiatives

    Challenges in Border and Transportation Security

    In fiscal year 2004 implementation activity occurred with respect to all
    six Border and Transportation Security initiatives (see table 8). DHS
    implemented activity in all five initiatives for which it was identified
    as a lead. State implemented activity in the one initiative where it was
    designated a lead.

    Additionally, several of the departments under review implemented multiple
    Border and Transportation Security initiatives for which they were not
    identified as a lead agency in the strategy and HSPD. During fiscal year
    2004, DOD cited implementation activities in three initiatives for which
    it did not have any lead responsibilities (prior to fiscal year 2004, DOD
    cited planning/implementation activity with respect to four of the six
    initiatives). State cited fiscal year 2004 and prior year implementation
    activity on three initiatives, for which it was not identified as the
    lead; HHS cited 2004 implementation activity on two initiatives without
    lead responsibilities; and DOE cited both 2004 and prior implementation
    with respect to one initiative.

    DOJ has not demonstrated fiscal year implementation activity in any
    initiative within this critical mission area; a DOJ official indicated
    that this is due to program transfers. In accordance with the Homeland
    Security Act of 2002, DOJ transferred its Immigration and Naturalization
    Service programs to DHS.

    The strategy calls for ensuring the "efficient and reliable flow of
    people, goods, and services across borders, while preventing terrorists
    from using transportation conveyances or systems to deliver implements of
    destruction." Our recent work in the Border and Transportation Security
    mission area has identified a number of challenges. Among the challenges
    faced is striking a balance between increased border security with
    concerns for facilitating legitimate travel and the flow of goods, the
    need to address problems associated with processing people at the nation's
    ports of entry, training border security personnel to detect counterfeit
    documents and fictitious identities, determining the proper role for

    Appendix III: Border and Transportation Security

    biometric technologies for security applications, developing a clear and
    comprehensive visa process, and improving the management of key programs.
    The challenges that we have identified in ensuring that our transportation
    system is secure include implementing an effective system to prescreen
    airline passengers; achieving and sustaining improvements in airline
    passenger, baggage, and cargo screening; strengthening perimeter security
    and access controls at airports; adequately addressing rail and mass
    transit security issues; and recapitalizing the U.S. Coast Guard.

    Border Security

    Balancing Security Concerns with Economic Needs

    The strategy recognizes the long-standing challenge of balancing our
    nation's security and commercial needs and states that the "efficient flow
    of people, goods, and conveyances engaged in legitimate economic and
    social activities" must not be impeded. Primary responsibility for
    ensuring the balance between security and commercial needs falls on DHS's
    CBP. In a June 2003 testimony, we reported that CBP faces many challenges
    in trying to accomplish its mission. 4 Concerning the efficient flow of
    people, challenges include detecting false admissibility documents,
    unifying and enhancing inspector training, providing timely intelligence
    to the field, and successfully implementing the new entry-exit system.
    With respect to cargo, CBP has attempted to select and inspect the
    highest-risk incoming cargo while enabling legitimate cargo to be cleared
    in a timely manner. These efforts pose a range of challenges, from the
    availability of threat assessments and actionable intelligence to the
    capability of nonintrusive inspection technology to detect potentially
    harmful contraband. Additional challenges faced by CBP include the need to
    improve its trade compliance program and to successfully implement its new
    trade-processing information system. The Gilmore, Hart-Rudman, and 9/11
    Commissions made recommendations related to this challenge.

    Effectively Processing The strategy calls for DHS to "verify and process
    the entry of people in People at Land Ports of order to prevent the
    entrance of contraband, unauthorized aliens, and Entry potential
    terrorists." However, in a June 2003 testimony and an August

    4See GAO, Homeland Security: Challenges Facing the Department of Homeland
    Security in Balancing its Border Security and Trade Facilitation Missions,
    GAO-03-902T (Washington, D.C.: June 16, 2003).

    Appendix III: Border and Transportation Security

    2003 report, we indicated that CBP, the entity within DHS that is
    responsible for carrying out this task, faces several challenges at land
    ports of entry related to the determination of traveler admissibility and
    other vulnerabilities in the inspection process. 5 In 2003, we testified
    that CBP inspectors faced a variety of challenges at the ports, including
    the need to make quick decisions on whether to immediately admit a
    traveler into the country or refer the traveler for more intensive
    inspection. This task is made more challenging because (1) United States
    and certain Canadian citizens may enter this country without presenting a
    travel document if they make an oral claim of citizenship that satisfies
    the inspector and (2) travelers who are required to show an identity
    document can present a variety of documents, some of which can be easily
    counterfeited. In fact, in October 2003, we testified about the challenges
    posed by identity fraud and how counterfeit identification can be easily
    produced and used to create fraudulent identities. 6 We also identified
    other challenges for CBP at the borders, including ensuring that
    inspectors are adequately trained in conducting inspections and detecting
    fraudulent documents and challenges regarding the collection, analysis,
    and use of intelligence information in the field. The Gilmore,
    Hart-Rudman, and 9/11 Commissions made recommendations related to this
    challenge.

    Effectively Employing Biometric Technologies

    The strategy states that the "United States will require visitors to
    present travel documentation that includes biometric indicators." However,
    in a November 2002 report and in March and September 2003 testimonies, we
    reported that challenges exist in determining the proper role of biometric
    technologies for security applications. 7 The first challenge involves
    recognizing that the use of biometric technology not a panacea for the
    border security problem. Instead, it is just a piece of the overall
    decision support system that helps determine whether or not a person is
    allowed to enter the United States. For example, while biometrics may be
    useful in reducing document fraud, it may not have much effect on the
    ability of people to enter the United States through other than official
    ports of entry.

    5See GAO, Land Border Points of Entry: Vulnerabilities and Inefficiencies
    in the Inspections Process, GAO-03-1084R (Washington, D.C.: Aug. 18,
    2003); and GAO-03-902T.

    6See GAO, Counterfeit Identification Raises Homeland Security Concerns,
    GAO-04-133T (Washington, D.C.: Oct. 1, 2003).

    7See GAO, Information Security: Challenges in Using Biometrics,
    GAO-03-1137T (Washington, D.C.: Sept. 9, 2003); Technology Assessment:
    Using Biometrics for Border Security, GAO-03-174 (Washington, D.C.: Nov.
    15, 2002); and Border Security: Challenges in Implementing Border
    Technology, GAO-03-546T (Washington, D.C.: Mar. 12, 2003).

    Appendix III: Border and Transportation Security

    Another major challenge involves questions regarding the technical and
    operational effectiveness of biometric technologies in applications as
    large as border control. Additional challenges to be addressed include
    determining (1) the system's effect on existing border control procedures
    and people; (2) the costs and benefits of the system, including secondary
    costs resulting from changes in processes or personnel to accommodate the
    biometrics; and (3) the system's effect on privacy, convenience, the
    economy, and relations with other countries. The 9/11 Commission made
    recommendations related to this challenge.

    Deploying Effective Technologies for the Detection of Weapons of Mass
    Destruction

    The strategy states that the nation will "develop and deploy non-intrusive
    inspection technologies to ensure rapid and more thorough screening of
    goods and conveyances." We reported in October 2002,8 however, that
    challenges exist with regard to the acquisition and deployment of
    radiation detection equipment. In particular, we have concerns that DHS
    has not yet deployed the best available technologies for detecting
    radioactive and nuclear materials at U.S. border crossings and ports of
    entry. Specifically, we have found that CBP's primary radiation detection
    equipment- radiation pagers-have certain limitations and may be
    inappropriate for the task. For example, according to U.S. radiation
    detection vendors and DOE laboratory specialists, pagers are more
    effectively used in conjunction with other radiation detection equipment,
    such as portal monitors and radio isotope identifiers. A further challenge
    is the need for a comprehensive plan for installing and using radiation
    detection equipment at all U.S. border crossings and ports of entry. A
    comprehensive plan would address, among other things, vulnerabilities and
    risks; identify the complement of radiation detection equipment that
    should be used at each type of border entry point-air, rail, land, and
    sea-and whether the equipment could be immediately deployed; identify
    longer-term radiation detection needs; and develop measures to ensure that
    the equipment is adequately maintained. Finally, there is a challenge that
    goes beyond simply deploying equipment-personnel must be effectively
    trained in radiation science, the proper use of the detection equipment,
    and how to identify and respond to alarms.

    Using Visas as an The strategy calls on DHS to "build an immigration
    services organization Antiterrorism Tool that administers immigration laws
    in an efficient, expeditious, fair, and

    8See GAO, Customs Service: Acquisition and Deployment of Radiation
    Detection Equipment, GAO-03-235T (Washington, D.C.: Oct. 17, 2002).

    Appendix III: Border and Transportation Security

    humane manner" while ensuring "that foreign visitors comply with entry
    conditions." In carrying out its goal of reforming our nation's
    immigration services, DHS faces a number of challenges.

    The first involves the development of a clear policy on how to balance
    national security concerns with the desire to facilitate legitimate travel
    when issuing visas. Specifically, we reported in October 2002 that this
    process should be strengthened for use as an antiterrorism tool. 9 We also
    identified the need for more coordination and information sharing to
    realize the full potential of the visa process. In addition, there is a
    need for more human resources and more training for consular officers.

    An additional challenge concerns the lack of a governmentwide policy on
    the interagency visa revocation process. This process is an important tool
    for preventing potential terrorists from entering the country and
    identifying potential terrorists who have already entered. However, we
    testified in June 2003 that weaknesses in the process we first identified
    in June 2003 have not been eliminated, especially those related to the
    timely transmission of information among government agencies. 10 Our
    review of visas revoked for terrorism concerns from October through
    December 2002 showed that delays occurred in screening names of suspected
    terrorists for visa holders, transmitting recommendations to revoke
    individuals' visas, revoking visas after receiving recommendations to do
    so, and posting lookouts. We also found delays in notifying immigration
    officials of the need to investigate individuals with revoked visas who
    may be in the country and in initiating field investigations of those
    individuals. Finally, challenges exist because of unresolved legal and
    policy issues regarding the removal of individuals from the United States
    based solely on their visa revocation. For example, there needs to be
    clear, comprehensive policies governing visa processes and procedures so
    that all agencies involved agree on the level of security screening for
    foreign nationals both at our consulates abroad and at ports of entry.

    A third challenge concerns the Visa Waiver Program. This involves
    discussing the process established by the Departments of Justice and State
    for determining whether a country is eligible to participate in the
    program.

    9See GAO, Border Security: Visa Process Should Be Strengthened as an
    Antiterrorism Tool, GAO-03-132NI (Washington, D.C.: Oct. 21, 2002).

    10See GAO, Border Security: New Policies and Procedures Are Needed to Fill
    Gaps in the Visa Revocation Process, GAO-03-1013T (Washington, D.C.: June
    18, 2003).

    Appendix III: Border and Transportation Security

    For example, one of the laws passed since the terrorist attacks of
    September 11, requires participating countries to issue passports that
    contain biometric identifiers, such as fingerprints. However, it is
    unclear whether these requirements will be fully implemented by the
    deadlines called for in the law. In our November 2002 report,11 we also
    pointed out that the national security challenges created by eliminating
    the Visa Waiver Program are difficult to determine, but that doing so
    could affect U.S. relations with other countries, U.S. tourism, and State
    Department resources abroad. For example, if the program were eliminated,
    we estimated that the department's initial costs to process the additional
    workload would range between $739 million and $1.28 billion, and annual
    recurring costs would likely range between $522 million and $810 million.
    It could take 2 to 4 years or longer to put the necessary people and
    facilities in place to handle the increased workload, according to State
    officials.

    An additional challenge involves reducing the time taken to adjudicate
    visas for science students and scholars. Specifically, we reported in
    February 200412 that the time it takes to adjudicate a visa for a science
    student or scholar depends largely on whether an applicant must undergo a
    security check that is designed to protect against sensitive technology
    transfers. We took a random sample of these security checks for science
    students and scholars sent from posts abroad between April and June 2003
    and found it took an average of 67 days for security checks to be
    processed and for State to notify the post. Officials from the State
    Department and FBI acknowledged there have been lengthy waits, but
    reported having measures under way that they believe will improve the
    process. However, additional challenges remain, such as interoperability
    issues between State's and FBI's computer systems.

    Finally, a challenge exists in balancing national security concerns with
    the expeditious processing of visa applications. Specifically, we
    reviewed13 the visa operations at U.S. posts in Canada and provided
    information on the perceptions of consular staff that adjudicate U.S.
    visas regarding the

    11See GAO, Border Security: Implications of Eliminating the Visa Waiver
    Program, GAO-03-38 (Washington, D.C.: Nov. 22, 2002).

    12See GAO, Border Security: Improvements Needed to Reduce Time Taken to
    Adjudicate Visas for Science Students and Scholars, GAO-04-371
    (Washington, D.C.: Feb. 26, 2004).

    13See GAO, Visa Operations at U.S. Posts in Canada, GAO-04-708R
    (Washington, D.C.: May 18, 2004).

    Appendix III: Border and Transportation Security

    importance of national security in the visa process, including impediments
    that could interfere with efforts to make security a top priority in visa
    processing. Consular officers and managers at U.S. posts in Canada said
    that despite rising workloads and increasingly labor-intensive
    visaprocessing requirements, they were placing an emphasis on security in
    visa operations. Some officers reported that new post-September 11
    processing requirements for visas could reduce the time available for
    faceto-face interviews. While most officers believed that they had enough
    time to screen applicants carefully for possible security risks, some of
    the newer officers at posts in Canada expressed concern about their
    ability to remain vigilant if the workload increased.

    The Bremer and 9/11 Commissions made recommendations related to the
    challenges found in this section.

    Improving the US-VISIT Program

    Integral to the effort to reform immigration services and the strategy's
    call for a "border of the future," is the implementation of the United
    States Visitor and Immigrant Status Indicator (US-VISIT) program, which is
    designed to collect, maintain, and share information, including biometric
    identifiers, on selected nationals who travel to the United States. We
    testified in March 200414 that this implementation is challenging because
    of the type of program it is and the way it is being managed. US-VISIT is
    to perform a critical, multifaceted mission, its scope is large and
    complex, it must meet a demanding implementation schedule, and its
    potential cost is enormous. One critical aspect of the program's mission
    is to prevent the entry of persons who pose a threat to the United States.
    DHS estimated that the program would cost $7.2 billion through fiscal year
    2014, but this estimate did not include all costs and underestimated some
    others. In addition, several factors related to the program's management
    increase the risk of not delivering mission value commensurate with costs
    or not delivering defined program capabilities on time and within budget.
    Also, the requirements for interim facilities at high-volume land ports of
    entry are not only demanding, they are based on assumptions that, if
    altered, could significantly affect facility plans. Despite these
    challenges, the first increment was deployed at the beginning of 2004.
    DHS's fiscal year 2004 US-VISIT expenditure plan and related documentation
    at least partially satisfies all conditions imposed by Congress. US-VISIT
    largely met its

    14See GAO, Homeland Security: Risks Facing Key Border and Transportation
    Security Program Need to Be Addressed, GAO-04-569T (Washington, D.C.: Mar.
    18, 2004).

    Appendix III: Border and Transportation Security

    commitments for implementing an initial operating capability in early
    January 2004, including the deployment of entry capability to 115 air and
    14 seaports of entry. However, challenges remain because DHS has not
    employed rigorous, disciplined management controls typically associated
    with successful programs. More specifically, testing of the initial phase
    of the implemented system was not well managed and was completed after the
    system became operational. In addition, multiple test plans were developed
    during testing, and only the final test plan, completed after testing,
    included all required content. Such controls, while significant for the
    initial phases of US-VISIT, are even more critical for the later phases,
    as the size and complexity of the program will only increase. Finally, as
    we reported in May 2004,15 DHS's plans for future US-VISIT resource needs
    at the land ports of entry are based on questionable assumptions, making
    future resource needs uncertain. The 9/11 Commission made recommendations
    related to this challenge.

    Transportation Security

    Effectively Prescreening Aviation Passengers

    Developing an effective system to prescreen passengers before they even
    arrive at the airport is one of the challenges alluded to in the
    strategy's discussion of the implementation of the Aviation and
    Transportation Security Act (ATSA) of 2001. DHS's solution to this
    challenge was the development of the Computer-Assisted Passenger
    Prescreening Program (CAPPS II), which was designed to identify passengers
    requiring additional security attention. As we said in a February 2004
    report and in a March 2004 testimony,16 key activities in the development
    of this program have been delayed or not addressed. We also identified
    three additional challenges TSA faces that may impede the success of CAPPS
    II. These challenges are developing the international cooperation needed
    to obtain passenger data, managing the possible expansion of the program's
    mission beyond its original purpose, and ensuring that identity theft
    cannot be

    15See GAO, Homeland Security: First Phase of Visitor and Immigration
    Status Program Operating, but Improvements Needed, GAO-04-586 (Washington,
    D.C.: May 11, 2004).

    16See GAO, Aviation Security: Challenges Delay Implementation of
    Computer-Assisted Passenger Prescreening System, GAO-04-504T (Washington,
    D.C.: Mar. 17, 2004); and Aviation Security: Computer-Assisted Passenger
    Prescreening System Faces Significant Implementation Challenges,
    GAO-04-385 (Washington, D.C.: Feb. 12, 2004).

    Appendix III: Border and Transportation Security

    used to negate the security benefits of the system. Recently the
    Transportation Security Administration scrapped the CAPPS II program and
    created a follow-on program called Secure Flight, which could face many of
    the same challenges we identified. The 9/11 Commission made
    recommendations related to this challenge.

    Improving Airline Passenger and Baggage Screening

    Another of the challenges alluded to in the strategy's discussion of ATSA
    is the effective and efficient screening of passengers and baggage. This
    has been a long-standing concern, and although significant actions have
    been taken, we testified in February and March 2004 that challenges in
    achieving and sustaining improvements remain. 17 For example, while TSA
    met its mandate to establish a federal screener workforce by November
    2002, it continues to face challenges in hiring and deploying passenger
    and baggage screeners. Additionally, while TSA is making progress in
    measuring the performance of passenger screeners, it has collected limited
    performance data related to its baggage screening operations. Moreover,
    testing of screeners has identified weaknesses in their ability to detect
    threat objects, while essential training is hampered by staffing shortages
    and a lack of adequate technical capability to access online training
    programs. Still another challenge involves deploying and leveraging
    screening equipment and technologies. For example, TSA continues to face
    operational and funding challenges in its efforts to achieve a mandate to
    screen all baggage using explosive detection systems. The 9/11 Commission
    made recommendations related to this challenge.

    Strengthening Airport Perimeter Security and Access Controls

    Another key requirement of ATSA, as discussed in the strategy, is the
    "protection of critical infrastructure assets," including airports. In
    June 200418 we reported that while TSA has begun evaluating the security
    of airport perimeters and access controls, the agency has not yet
    determined how the results will be used to address the challenges faced.
    Specifically, these challenges include addressing concerns with perimeter
    and access control security that have been raised in compliance
    inspections and

    17GAO, Aviation Security: Challenges Exist in Stabilizing and Enhancing
    Passenger and Baggage Screening Operations, GAO-04-440T (Washington, D.C.:
    Feb. 12, 2004); and Aviation Security: Private Screening Contractors Have
    Little Flexibility to Implement Innovative Approaches, GAO-04-505T
    (Washington, D.C.: Apr. 22, 2004).

    18See GAO, Aviation Security: Further Steps Needed to Strengthen the
    Security of Commercial Airport Perimeters and Access Controls, GAO-04-728
    (Washington, D.C.: June 4, 2004).

    Appendix III: Border and Transportation Security

    vulnerability assessments; setting priorities for funding airport security
    needs, developing a plan for implementing new technologies to meet
    security needs, and implementing certain mandated actions to reduce the
    security threats posed by airport workers.

    Countering Threats Posed by Hand-Held Missiles

    Another consideration for ensuring the security of our aviation system
    involves the issue of aircraft protection, specifically countering the
    threats posed by Man-Portable Air Defense Systems (MANPADS). These
    handheld missile systems have been used by terrorists against commercial
    aircraft.

    In January 2004, we reported19 that DHS faces significant challenges in
    adapting a military counter-MANPADS system to commercial aircraft, such as
    establishing system requirements, developing technology and design to
    sufficient maturity, and setting reliable cost estimates. Our work on the
    best practices of product developers in government and industry has found
    that such challenges can be successfully overcome by using a
    knowledge-based approach.

    Additionally, in a May 2004 report,20 we found that further improvements
    are needed in U.S. efforts to keep MANPADS out of the hands of terrorists.
    Although the State Department made important progress in 2003 to control
    the global proliferation of MANPADS, its ability to assess further
    progress is limited because multilateral forums have no mechanisms to
    monitor members' implementation of commitments. DOD has sold thousands of
    Stinger missiles (a U.S. MANPADS) to 17 countries and Taiwan, but DOD
    agencies responsible for end-use monitoring are not required to maintain
    records on the number and destination of Stinger sales. In addition, DOD
    officials overseas use inconsistent practices when inspecting Stinger
    inventories because DOD lacks procedures for conducting these inspections.
    For example, DOD has no requirements for DOD organizations responsible for
    end-use monitoring to keep records on the number and destinations of these
    Stingers.

    19See GAO, The Department of Homeland Security Needs to Fully Adopt a
    Knowledge
    based Approach to Its Counter-MANPADS Development Program, GAO-04-341R
    (Washington, D.C.: Jan. 30, 2004).

    20See GAO, Nonproliferation: Further Improvements Needed in U.S. Efforts
    to Counter
    Treats from Man-Portable Air Defense Systems, GAO-04-519 (Washington,
    D.C.:
    May 12, 2004).

    Appendix III: Border and Transportation Security

    Effectively Addressing Rail and Mass Transit Security Issues

    The strategy recognizes "the importance of security for all forms of
    transportation." As we testified21 in March and September 2003, certain
    characteristics of mass transit systems make them inherently vulnerable to
    terrorist attacks and a challenge to secure. By design, mass transit
    systems are open (i.e., have multiple access points and, in some case, no
    barriers) so that they can move large numbers of people quickly. In
    contrast, the aviation system is housed in closed and controlled locations
    with few entry points. The openness of mass transit systems can leave them
    vulnerable because transit officials cannot monitor or control who enters
    or leaves the systems. In addition, other characteristics of some transit
    systems-high ridership, expensive infrastructure, economic importance, and
    location (e.g., large metropolitan areas or tourist destinations)-also
    make them attractive targets because of the potential for mass casualties
    and economic damage. Moreover, some of these same characteristics make
    mass transit systems difficult to secure. For example, the number of
    riders that pass through a mass transit system-especially during peak
    hours-makes some security measures, such as metal detectors, impractical.
    In addition, the multiple access points along extended routes make the
    costs of securing each location prohibitive.

    Further complicating transit security is the challenge faced by transit
    agencies in balancing security concerns with accessibility, convenience,
    and affordability. Because transit riders often could choose another means
    of transportation, such as personal automobile, transit agencies must
    compete for riders. To remain competitive, transit agencies must offer
    convenient, inexpensive, and high-quality service. Therefore, security
    measures that limit accessibility, cause delays, increase fares, or
    otherwise cause inconvenience could push people away from mass transit and
    back into their cars.

    The size and diversity of the freight rail system make it a challenge to
    adequately secure. The freight rail system's extensive infrastructure
    crisscrosses the nation and extends beyond our borders to move millions of
    tons of freight each day. There are over 100,000 miles of rail in the
    United States. The extensiveness of the infrastructure creates an infinite
    number of targets for terrorists. In addition, protecting freight rail
    assets from attack is made more difficult because of the tremendous
    variety of

    21See GAO, Transportation Security: Post-September 11th Initiatives and
    Long-Term Challenges, GAO-03-616T (Washington, D.C.: Mar. 31, 2003), and
    Transportation Security: Federal Action Needed to Enhance Security
    Efforts, GAO-03-1154T (Washington, D.C.: Sept. 9, 2003).

                    Appendix III: Border and Transportation Security

    freight hauled by railroads. For example, railroads carry freight as
    diverse as dry bulk (grain) and hazardous materials.22 The transport of
    hazardous materials is of particular concern because serious incidents
    involving these materials have the potential to cause widespread
    disruption or injury. In 2001, over 83 million tons of hazardous materials
    were shipped by rail in the United States across the rail network, which
    extends through every major city as well as thousands of small
    communities. The 9/11 Commission made recommendations related to this
    challenge.

    Effectively Implementing the Maritime Transportation Security Act

    The strategy calls for "targeted improvements in the areas of maritime
    domain awareness, command and control systems, and shore-side facilities."
    In response to concerns regarding port security, Congress passed the
    Maritime Transportation Security Act (MTSA), mandating specific security
    preparations for America's maritime ports. Passed in November 2002, MTSA
    imposed an ambitious schedule of requirements on a number of federal
    agencies. MTSA called for a comprehensive security framework-one that
    included planning, personnel security, and careful monitoring of vessels
    and cargo. Agencies responsible for implementing the security provisions
    of MTSA and have made progress in meeting their requirements. However, in
    a September 2003 testimony, we identified challenges that merit attention
    and further oversight. 23

    The main security-related challenge involves the implementation of a
    vessel identification system. MTSA called for the development of an
    automatic identification system. Coast Guard implementation calls for a
    system that would allow port officials and other vessels to determine the
    identity and position of vessels entering or operating within the harbor
    area. Such a system would provide an "early warning" of an unidentified
    vessel or a vessel that was in a location where it should not be. To
    implement the system effectively, however, requires considerable landbased
    equipment and other infrastructure that is not currently available in

    22Federal hazardous material transportation law defines a hazardous
    material as a substance or material that the Secretary of Transportation
    has determined is capable of posing an unreasonable risk to health,
    safety, and property when transported in commerce (49 U.S.C. S: 5103). It
    includes hazardous substances such as ammonia, hazardous wastes from
    chemical manufacturing processes, and elevated temperature materials such
    as molten aluminum.

    23See GAO, Maritime Security: Progress Made in Implementing Maritime
    Transportation Security Act, but Concerns Remain, GAO-03-1155T
    (Washington, D.C.: Sept. 9, 2003).

    Appendix III: Border and Transportation Security

    many ports. As a result, for the foreseeable future, the system will be
    available in less than half of the 25 busiest U.S. ports.

    Challenges also exist regarding the proposed approach for meeting MTSA's
    requirement that the Secretary of DHS approve security plans for all
    vessels operating in U.S. waters. Vessel security plans include taking
    such steps as responding to assessed vulnerabilities, designating security
    officers, conducting training and drills, and ensuring that appropriate
    preventive measures will be taken against security incidents. To implement
    this MTSA requirement, the Coast Guard has stated, in general, that it is
    not the Coast Guard's intent to individually approve vessel security plans
    for foreign vessels. The Coast Guard provides that it will deem a
    flag-state approval of a vessel security plan to constitute the
    MTSA-required approval of MTSA vessel security plans. However, MTSA does
    not mention any role for foreign nations in the required approval of
    vessel security plans, and some concerns have been raised about the
    advisability of allowing flag states-some with a history of lax
    regulation-to ensure the security of vessels traveling to the United
    States.

    Another security-related challenge involves the Coast Guard's efforts to
    address MTSA's security planning requirements through a series of security
    assessments of individual ports. Security assessments are intended to be
    in-depth examinations of security threats, vulnerabilities, consequences,
    and conditions throughout a port, including not just transportation
    facilities but also factories and other installations that pose potential
    security risks. The Coast Guard had begun these assessments before MTSA
    was passed and decided to continue the process, changing it as needed to
    meet MTSA planning requirements, which include developing area security
    plans based on the evaluation of specific facilities throughout the port.
    Issues were found in the scope and quality of the assessments and their
    usefulness to port stakeholders. The Gilmore Commission made
    recommendations related to this challenge.

    Improving Container The strategy states that "containers are an
    indispensable but vulnerable

    Cargo Security	link in the chain of global trade" and has an initiative to
    "increase the security of international shipping containers." As we stated
    in our July 2003 report,24 CBP has taken steps to address the challenge of
    terrorist

    24See GAO, Container Security: Expansion of Key Customs Programs Will
    Require
    Greater Attention to Critical Success Factors, GAO-03-770 (Washington,
    D.C.:
    July 25, 2003).

    Appendix III: Border and Transportation Security

    threats to oceangoing cargo containers through a targeting strategy. CBP
    faces continuing challenges in targeting containers for inspections. CBP
    needs upon which to target containers for inspection. CBP does not have a
    national system for reporting and analyzing inspection statistics, and the
    data are generally not readily available by risk level (e.g., low, medium,
    high), were not uniformly reported, were difficult to interpret, and were
    incomplete. Further, we testified in March 2004, space limitations and
    safety concerns about inspection equipment constrain some ports in their
    utilization of screening equipment, which has affected the efficiency of
    examinations. 25 The Gilmore Commission made recommendations related to
    this challenge.

    Directly related to the challenge of improving cargo container security
    are the challenges associated with the CBP's implementation of its
    Container Security Initiative, which allows CBP officials to screen for
    high-risk containers at key overseas ports, and its Customs-Trade
    Partnership against Terrorism (C-TPAT), which is designed to improve
    global supply chain security in the private sector. Both of these programs
    were launched quickly in an effort to secure ocean containers bound for
    the United States. However, a number of challenges must be overcome if
    these programs are going to accomplish the desired outcome and achieve
    longterm effectiveness. One of the these challenges is the development of
    human capital plans that clearly describe how CSI and C-TPAT will recruit,
    train, and retain staff to meet their growing demands as they expand to
    other countries and implement new program elements. Another challenge
    involves the expansion of efforts already initiated to develop performance
    measures for CSI and C-TPAT that include outcome-oriented indicators.
    Finally, strategic plans must be developed that clearly lay out CSI and
    C-TPAT goals, objectives, and detailed implementation strategies.

    Recapitalizing the U.S. Coast Guard

    The continued recapitalization of the U.S. Coast Guard is specifically
    called for in the homeland security strategy. In 2002, the Coast Guard
    began its largest and most complex recapitalization challenge in its
    history, the Integrated Deepwater System program. As part of the Deepwater
    program, the Coast Guard is estimated to spend about $17 billion over 20
    years to replace or modernize its fleet of cutters, aircraft, and
    communications equipment used for missions generally beyond 50

    25See GAO, Homeland Security: Summary of Challenges Faced in Targeting
    Oceangoing Cargo Containers for Inspection, GAO-04-557T (Washington, D.C.:
    Mar. 31, 2004)

    Appendix III: Border and Transportation Security

    miles from shore. Just 3 years into the program, the Coast Guard has
    already experienced management challenges. In March 2004,26 we reported
    that key components needed for the Coast Guard to manage the program and
    oversee the system integrator's performance have not been effectively
    implemented. For example, we reported that the Coast Guard's integrated
    product teams have struggled to effectively collaborate and accomplish
    their missions, and management has not measured the extent of competition
    among suppliers or held the system integrator accountable for taking steps
    to increase competition in order to control future costs. In addition, in
    June 2004,27 we expressed concern that the Coast Guard had not updated
    Deepwater's original 2002 acquisition schedule. We noted that maintaining
    a current acquisition schedule for programs of similar scope- such as
    those of the Department of Defense-is a fundamental and necessary
    practice. The Coast Guard's lack of an updated acquisition schedule makes
    it difficult to determine the degree to which the program is on track with
    its original schedule, lessens the Coast Guard's ability to monitor the
    contractor's performance, and may prevent the Department of Homeland
    Security and Congress from basing budget decisions on accurate
    information. As the Deepwater program matures, paying increased attention
    to address these outstanding program management and contractor oversight
    concerns will help the Coast Guard better meet current and future
    management challenges. The Gilmore Commission made recommendations related
    to this challenge.

    26See GAO, Contract Management: Coast Guard's Deepwater Program Needs
    Increased Attention to Management and Contract Oversight, GAO-04-380
    (Washington, D.C.: Mar. 9, 2004).

    27See GAO, Coast Guard: Deepwater Program Acquisition Schedule Update
    Needed, GAO-04-695, (Washington, D.C.: June 9, 2004)

                         Appendix IV: Domestic Counterterrorism

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Domestic Counterterrorism mission area and discusses the federal funding
    allocated, the agencies with major roles and the alignment of their
    strategic plans and implementation activities with the major initiatives,
    and a summary of the challenges faced by the nation. This appendix
    presents baseline information that can be used by Congress to provide
    oversight and track accountability for the initiatives in the Domestic
    Counterterrorism mission area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six mission areas, the third of which is Domestic
    Counterterrorism. This mission area includes the efforts of the nation's
    law enforcement agencies in identifying, halting, preventing, and
    prosecuting terrorists in the United States. Included in this mission area
    is the pursuit of individuals directly involved in terrorist activity, as
    well as their sources of support-the people and organizations that
    knowingly fund or provide material support or resources to the terrorists.
    It should be noted that this mission area is closely related to the
    Intelligence and Warning mission area in that activities that develop the
    basis for law enforcement action occur in that mission area and are
    carried out in this one.1 Figure 7 shows an example of the type of
    activities carried out in the Domestic Counterterrorism mission area.

    The strategy identifies the following major initiatives in the domestic
    counterterrorism mission area:

    o  improving intergovernmental law enforcement coordination,

    o  facilitating apprehension of potential terrorists,

    o  continuing ongoing investigations and prosecutions,

    o  	completing FBI restructuring to emphasize prevention of terrorist
    attacks,

    o  targeting and attacking terrorist financing, and

    o  tracking foreign terrorists and bring them to justice.

    1This definition is based on that used by OMB in its 2003 Report to
    Congress on Combating Terrorism (Washington, D.C.: Sept. 2003).

                         Appendix IV: Domestic Counterterrorism

    Figure 7: An FBI Evidence Response Team in Action at the Scene of a
    Terrorism-Related Exercise

    Source: GAO.

    Of the six departments under review, DOJ and DHS have major roles in
    Domestic Counterterrorism. Within DOJ, the FBI works to detect and prevent
    terrorist acts through analysis and fieldwork to identify terrorists,
    their supporters, and materials that may be used to perpetrate a terrorist
    act, to include terrorist financing; tracks foreign terrorists and keeps
    them from entering the United States; and leads the multi-agency Joint
    Terrorism Task Forces (JTTF). In addition, DOJ's 94 United States
    Attorneys lead the Anti-Terrorism Advisory Councils, which enhance
    cooperation and information sharing among federal, state, and local law
    enforcement; first responders; industry; academia; and others. Within DHS,
    ICE, working with other law enforcement agencies, enforces laws related to
    the illegal presence of people and goods within the United States; detains
    those suspected of immigration-related violations and removes those
    convicted of immigration-related violations; and pursues criminal aliens,
    cases of identity theft or benefit fraud, human trafficking, money
    laundering, and other violations of such laws.

    Agencies with Major Roles in Domestic Counterterrorism

    Appendix IV: Domestic Counterterrorism

    OMB reported that the total fiscal year 2005 funding request for the
    domestic counterterrorism mission area is just over $3.4 billion. DOJ
    accounts for $1.9 billion (57 percent) of these funds, primarily for the
    FBI. DHS accounts for another $1.4 billion (41 percent) of the funding
    request, mostly for ICE.2 Figure 8 summarizes the fiscal year 2005 budget
    request for the domestic counterterrorism mission area by agency.

    Figure 8: Proposed Fiscal Year 2005 Homeland Security Funding for Domestic
    Counterterrorism

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    "All other agencies" includes the Departments of Transportation ($21
    million) and Treasury ($46 million), as well as the Social Security
    Administration ($4 million).

    OMB's reported data do not include funding for four departments that have
    activities under way in this mission area. These departments- Defense,
    Energy, Health and Human Services, and State-have either planning or
    implementation activity on specific initiatives, as discussed in

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004).

                         Appendix IV: Domestic Counterterrorism

    the next section of this appendix. On the basis of our previous work, we
    have noted several qualifications to OMB's figures to explain this
    discrepancy.3 According to OMB officials, there is not always a clear
    distinction between homeland security activities and other related
    activities. The OMB staff must make judgment calls about how to
    characterize funding by mission areas. For example, some homeland security
    activities have multiple purposes ,and funding for these activities is
    allocated to different accounts that can cover multiple mission areas. In
    addition, some of the departments' activities, such as planning,
    coordination, or providing advice, may support Domestic Counterterrorism
    activities but are not included in the amounts shown.

    Alignment of This section provides more detailed information about the
    Domestic

    Counterterrorism critical mission area initiatives, and the departments
    Department Activities involved in conducting activities related to these
    initiatives. This includes with the Major a discussion of specific
    departmental planning and implementation

    activities, lead agency designations, and implementation activities in
    fiscalInitiatives year 2004, with respect to each initiative. The data are
    summarized in table

    9.

    3See GAO, Combating Terrorism: Funding Data Reported to Congress Should Be
    Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002).

                         Appendix IV: Domestic Counterterrorism

    Table 9: Detailed Department Leadership and Planning/Implementation
    Activities in the Domestic Counterterrorism Mission Area's Six Initiatives

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

                                Summary of Departmental
                             Activities on the Initiatives

    All six Domestic Counterterrorism initiatives are being addressed in the
    key departments' planning and implementation activities. As shown in table
    9, at least one department cited activity in each of the six initiatives.
    At least four departments cited activity in three of the six initiative
    areas. For example, DHS, DOJ, DOD, and State implemented activities in the
    initiative, facilitating the apprehension of potential terrorists, during
    fiscal year 2004. DHS's ICE operated the Student and Exchange Visitor
    Information System computer network to identify and track nonimmigrants,
    foreign students, and exchange visitors while in the United States; DOJ's
    FBI continued to make improvements in the Integrated Automated Fingerprint
    Identification System; DOD expanded maritime interception and intelligence
    operations; and State bolstered the security of nations at high risk of
    terrorist transit by developing and installing Terrorist Interdiction
    Program software at their borders and training immigration officials in
    its use. Additionally, DHS, DOJ, and State demonstrated implementation
    activities in fiscal year 2004 related to targeting and attacking
    terrorist financing. DHS implemented Cornerstone, a comprehensive economic
    security program, targeting alternative

                         Appendix IV: Domestic Counterterrorism

    financing mechanisms that terrorists use to earn, move, and store funds.
    DOJ brought to bear several units and task forces to address terrorist
    financing and conducted criminal and intelligence investigations and
    prosecutions with respect to charities and banking; State cited diplomatic
    efforts to encourage countries to ratify and implement United Nations
    Security Council Resolution 1373, targeting terrorists' financing.

    All six departments have been engaged in Domestic Counterterrorism
    initiatives. In contrast with DHS and DOJ, HHS only addressed a single
    initiative in this mission area (i.e., improving intergovernmental law
    enforcement coordination.) This limited initiative participation is
    understandable, given that the Domestic Counterterrorism mission area is
    primarily directed toward law enforcement. This is not a primary mission
    for HHS.

    While we have identified department activities related to these
    initiatives, we did not determine the quality, status, or progress of such
    activities with respect to stated goals or targets within this mission
    area.

    Identification of Lead Agencies on the Initiatives

    For all six initiatives, a lead agency is identified either in the
    strategy or the Homeland Security Presidential Directives. As shown in
    table 9, DOJ is a lead on the most initiatives-all six mission area
    initiatives. It is understandable for DOJ to have lead roles in each of
    these six initiatives given that the Domestic Counterterrorism critical
    mission area is primarily directed toward law enforcement-related
    initiatives (e.g., improving intergovernmental law enforcement
    coordination, facilitating the apprehension of potential terrorists,
    continuing ongoing investigations and prosecutions, and tracking foreign
    terrorists and bringing them to justice).

    Additionally, DHS is a lead on three of the six initiatives (i.e.,
    facilitating the apprehension of potential terrorists, continuing ongoing
    investigations and prosecutions, and tracking foreign terrorists and
    bringing them to justice); and State is a lead on one of six initiatives
    (facilitating the apprehension of potential terrorists). Three of the
    departments under review have not been identified as a lead on any
    Domestic Counterterrorism initiatives (DOD, HHS, and DOE) by the strategy
    and HSPDs since their missions are not primarily directed toward law
    enforcement.

    The strategy and HSPDs identified multiple leads on three initiatives (see
    table 9). DHS, DOJ, and State are all leads on the initiative,
    facilitating the apprehension of potential terrorists; DHS and DOJ are
    both leads on the

                         Appendix IV: Domestic Counterterrorism

    remaining two initiatives (continuing ongoing investigations and
    prosecutions and tracking foreign terrorists and bringing them to
    justice). In addition, department strategic planning/implementation
    documents demonstrated that all identified leads in this mission area are
    clear leads.

    Fiscal Year 2004 Implementation of the Initiatives

    Challenges in Domestic Counterterrorism

    In fiscal year 2004 implementation activity occurred with respect to each
    of the six initiatives (see table 9). DOJ implemented activity in 2004 on
    all 6 initiatives for which it was the lead; it also engaged in prior
    implementation in each of these six initiatives. DHS implemented prior and
    2004 activity in each of the three initiatives for which it was identified
    as a lead (see illustrations above); and State cited both prior and fiscal
    year 2004 activity in the single initiative for which it was identified as
    a lead.

    Additionally, several of the departments under review implemented multiple
    Domestic Counterterrorism initiatives for which they were not identified
    as a lead agency either in the strategy or in HSPDS. During fiscal year
    2004, DOE cited implementation activities in two Counterterrorism
    initiatives, for which it was not identified as a lead (prior to fiscal
    year 2004, it conducted implementation activities in these same two
    initiatives.) DOD cited 2004 implementation activities in two of the six
    initiatives, without lead identification; and DHS and State both cited
    fiscal year 2004 implementation activities in two initiatives for which
    they were not identified as leads.

    The attacks of September 11, and the catastrophic loss of life and
    property that resulted have redefined the mission of federal, state, and
    local law enforcement authorities. Accordingly, while organizations like
    the FBI continue to investigate and prosecute criminal activity, they are
    now assigning highest priority to preventing and interdicting terror
    activity within the United States. Our recent work in the Domestic
    Counterterrorism mission area has identified a number of challenges. These
    challenges include the need to transform the workforce and business
    practices of the FBI in order to focus on counterterrorism and
    intelligencerelated priorities; attaining the level of interagency
    coordination necessary to leverage existing law enforcement resources for
    investigating money laundering and terrorist financing; developing
    databases for the collection and dissemination of alien information; and
    ensuring that law enforcement and other officials have the necessary
    training and expertise to detect counterfeit identification documents and
    identity fraud.

                         Appendix IV: Domestic Counterterrorism

    Transforming the FBI to Focus on Counterterrorism

    The strategy sets forth the nation's highest law enforcement objective as
    the prevention of terrorist attacks-a significant shift from pre-9/11
    objectives. In order to focus the mission of the federal law enforcement
    community on prevention, in March 2004, we reported4 that it is necessary
    for the federal government to restructure the FBI and other federal law
    enforcement agencies, reallocating certain resources and energies to the
    new prevention efforts. While the FBI has made significant progress in its
    transformation, it continues to face challenges in transforming its
    workforce and business practices to focus on counterterrorism and
    intelligence-related priorities. Additional challenges continue in the
    areas of human capital management and information technology, as well as
    in the intelligence and language services areas. The 9/11 Commission made
    recommendations related to this challenge.

    Effectively Investigating Terrorist Financing

    The strategy provides that a "cornerstone" of the nation's domestic
    "counterterrorism effort involves a concerted interagency effort to target
    and interdict the financing of terrorist organizations and operations."
    Although terrorist financing is generally characterized by different
    motives than money laundering-a process by which the monetary proceeds
    from criminal activities are transformed into funds and assets that appear
    to have come from legitimate sources-the techniques used to obscure the
    origin of funds and their ultimate use are often quite similar. Therefore,
    Treasury, law enforcement agencies, other federal investigators,
    prosecutors, and financial regulators often employ similar measures and
    techniques in trying to detect and prevent both money laundering and
    terrorist financing.

    In September 2003,5 we reported that the annual National Money Laundering
    Strategy (NMLS)-which was required by 1998 federal

    4See GAO, FBI Transformation: FBI Continues to Make Progress in Its
    Efforts to Transform and Address Priorities, GAO-04-578T (Washington,
    D.C.: Mar. 23, 2004); FBI Reorganization: Progress Made in Efforts to
    Transform, but Major Challenges Continue, GAO-03-759T (Washington, D.C.:
    June 18, 2003); Information Technology: FBI Needs an Enterprise
    Architecture to Guide Its Modernization Activities, GAO-03-959
    (Washington, D.C.: Sept. 25, 2003); FBI Reorganization: Initial Steps
    Encouraging but Broad Transformation Needed, GAO-02-865T (Washington,
    D.C.: June 21, 2002); Foreign Languages: Workforce Planning Could Help
    Address Staffing and Proficiency Shortfalls, GAO-02-514T (Washington,
    D.C.: Mar. 12, 2002); and Foreign Languages: Human Capital Approach Needed
    to Correct Staffing and Proficiency Shortfalls, GAO-02-375 (Washington,
    D.C.: Jan. 31, 2002).

    5See GAO, Combating Money Laundering: Opportunities Exist to Improve the
    National Strategy, GAO-03-813 (Washington, D.C.: Sept. 26, 2003).

                         Appendix IV: Domestic Counterterrorism

    legislation-has had mixed results in guiding the efforts of law
    enforcement in the fight against money laundering and, more recently,
    terrorist financing. For example, although expected to have a central role
    in coordinating law enforcement efforts, interagency task forces created
    specifically to address money laundering and related financial crimes
    generally had not yet been structured and operating as intended and had
    not reached their expectations for leveraging investigative resources or
    creating investigative synergies. Also, most of the NMLS initiatives
    designed to enhance interagency coordination of money laundering
    investigations had not yet achieved their expectations. While the annual
    NMLS has fallen short of expectations, federal law enforcement agencies
    recognize the challenge of developing and using interagency coordination
    mechanisms to leverage existing resources to investigate money laundering
    and terrorist financing.

    Additionally, regarding investigative efforts against sources of terrorist
    financing, our February 20046 report noted that a memorandum of agreement
    signed in May 2003 by the Attorney General and the Secretary of Homeland
    Security represents a partnering commitment by two of the nation's law
    enforcement agencies-the FBI and ICE, a component of DHS. Since the
    agreement was signed, progress has been made in waging a coordinated
    campaign against sources of terrorist financing. Continued progress will
    depend largely on the ability of the agencies to overcome the challenges
    associated with establishing and maintaining effective interagency
    relationships and meeting various other operational and organizational
    challenges, such as ensuring that the financial crimes expertise and other
    investigative competencies of both agencies are appropriately and
    effectively utilized.

    The Bremer, Hart-Rudman, and 9/11 Commissions made recommendations related
    to the challenges presented in this section.

    Monitoring Alternative In addition to the challenge presented by
    interagency coordination issues,

    Financing Mechanisms 	challenges exist in the monitoring of terrorists'
    use of alternative financing mechanisms. As we recommended in November
    2003, the FBI, which leads terrorist financing investigations and
    maintains case data, should systematically collect and analyze data on
    terrorists' use of alternative

    6See GAO, Investigations of Terrorist Financing, Money Laundering, and
    Other Financial Crimes, GAO-04-464R (Washington, D.C.: Feb. 20, 2004).

                         Appendix IV: Domestic Counterterrorism

    financing mechanisms. 7 Alternative financing mechanisms are outside the
    mainstream financial system and include the use of commodities
    (cigarettes, counterfeit goods, illicit drugs, etc.), bulk cash,
    charities, and informal banking systems to earn, move, and store assets.
    Cutting off terrorists' funding is an important means of disrupting their
    operations. As initial U.S. and foreign government deterrence efforts
    focused on terrorists' use of the formal banking or mainstream financial
    systems, terrorists may have been forced to increase their use of various
    alternative financing mechanisms. When agencies inform the FBI that an
    investigation has a terrorist component, the FBI opens a terrorism case.
    However, the FBI's data analysis programs do not designate the source of
    funding (i.e., specific charity, commodity, etc.) Without such data, the
    FBI will be challenged to conduct systematic analysis of trends and
    patterns focusing on alternative financing mechanisms from its case data.
    Without such an assessment, the FBI does not have analyses that could aid
    in assessing risk and prioritizing efforts. In response to our
    recommendation, the FBI conducted a onetime survey of its field offices to
    gather information about terrorist financing investigations since October
    2001. Additionally, the FBI has instructed its field offices to update
    some of this information when new terrorist financing investigations are
    initiated. FBI officials told us that information from the surveys was
    entered into a database, and they believe that this database enables them
    to track information on alternative methods of terrorist financing and
    identify emerging trends, patterns, and funding sources. However, we have
    not evaluated the quality of the information provided. In addition, the
    FBI has not indicated how it has used this capability to perform an
    analysis of terrorist financing investigations. The Bremer, Hart-Rudman,
    and 9/11 Commissions also made recommendations related to this challenge.

                                Detecting Identity Fraud

    The strategy has an initiative to "coordinate suggested minimum standards
    for state driver's licenses." In September and October 2003,8 we testified
    about the challenges to homeland security posed by identity fraud and how
    counterfeit identification can be easily produced and used to create
    fraudulent identities. Specifically, we conducted tests over the past
    several

    7See GAO, Terrorist Financing: U.S. Agencies Should Systematically Assess
    Terrorists' Use of Alternative Financing Mechanisms, GAO-04-163
    (Washington, D.C.: Nov. 14, 2003).

    8See GAO, Counterfeit Identification Raises Homeland Security Concerns,
    GAO-04-133T (Washington, D.C.: Oct. 1, 2003); Security Breaches at Federal
    Buildings in Atlanta, Georgia, GAO-02-668T (Washington, D.C.: Apr. 30,
    2002).

    Appendix IV: Domestic Counterterrorism

    years that demonstrate how counterfeit identification documents can be
    used to obtain genuine state driver's licenses. In conducting these tests,
    we created fictitious identities and counterfeit identification documents
    using off-the-shelf computer graphic software that is available to any
    purchaser. These documents were then used to fraudulently obtain genuine
    driver's licenses in other states. Our work identified three basic
    challenges: (1) government officials and others generally did not
    recognize that the documents we presented were counterfeit; (2) many
    government officials were not alert to the possibility of identity fraud,
    and some failed to follow security procedures; and (3) identity
    verification procedures are inadequate. The weaknesses we found during
    this investigation clearly show that border inspectors need to have the
    means to verify the identity and authenticity of the documents that are
    presented to them. In addition, government officials who review
    identification need additional training in recognizing counterfeit
    documents. Further, these officials also need to be more vigilant when
    reviewing identification documents to the possibility of identification
    fraud. As we reported in October 2003,9 directly related to the issue of
    detecting counterfeit documents and fictitious identities, is the
    importance of having sound practices for avoiding the improper issuance of
    Social Security numbers (SSNs) and ensuring the identity of those who
    receive them. Although originally created as a means of tracking worker
    earnings, the SSN has become a national identifier that is central to a
    range of transactions and services associated with American life,
    including obtaining a driver's license, opening a bank account, and
    establishing credit. Accordingly, SSNs are key pieces of information in
    creating false identities. In prior work we recommended that the Social
    Security Administration verify the documents of all SSN applicants and
    reassess its policies for issuing replacement cards, which allowed an
    individual to obtain up to 52 per year. The recently passed Intelligence
    Reform and Terrorism Prevention Act of 2004 has specific provisions to
    address our recommendations. Additionally, the 9/11 Commission made
    recommendations related to this challenge.

    9See GAO, Social Security Administration: Actions Taken to Strengthen
    Procedures for Issuing Social Security Numbers to Noncitizens, but Some
    Weaknesses Remain, GAO-04-12 (Washington, D.C.: Oct. 15, 2003).

                            Appendix V: Protecting Critical
                             Infrastructures and Key Assets

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Protecting Critical Infrastructures and Key Assets mission area and
    discusses the agencies with major roles, their funding, the alignment of
    their strategic plans and implementation activities with the major
    initiatives, and a summary of the challenges faced by the nation. This
    appendix provides baseline information that can be used by Congress to
    provide oversight and track accountability for the initiatives in the
    Protecting Critical Infrastructures and Key Assets mission area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six mission areas, the fourth of which is protecting
    critical infrastructures and key assets. This mission area-commonly
    referred to as Critical Infrastructure Protection (CIP)-includes programs
    that improve protection of the interconnecting sectors that make up the
    nation's critical infrastructure. The sectors are agriculture, banking and
    finance, chemical and hazardous materials, emergency services, defense
    industrial base, energy, food, government, information technology and
    telecommunications, postal and shipping, public health and health care,
    transportation, and drinking water and water treatment systems. Programs
    associated with the physical or cyber security of federal assets also
    belong in this mission area. Finally, programs designed to protect the
    nation's key assets-unique facilities, sites, and structures whose
    disruption or destruction could have significant consequences-are also
    included in this mission area.1 In addition to the homeland security
    strategy, the National Strategy for the Physical Protection of Critical
    Infrastructures and Key Assets and the National Strategy to Secure
    Cyberspace provide detailed discussions of Critical Infrastructure
    Protection. Figure 9 shows an example of the type of activities carried
    out in the Critical Infrastructure Protection mission area.

    The homeland security strategy identifies the following major initiatives
    in the critical infrastructure protection mission area:

    o  	unifying America's infrastructure protection effort in the Department
    of Homeland Security,

    o  	building and maintaining a complete and accurate assessment of
    America's critical infrastructure and key assets,

    1This definition is from OMB's 2003 Report to Congress on Combating
    Terrorism (Washington, D.C.: Sept. 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    o  	enabling effective partnership with state and local governments and
    the private sector,

    o  developing a national infrastructure protection plan,

    o  securing cyberspace,

    o  	harnessing the best analytic and modeling tools to develop effective
    protective solutions,

    o  	guarding America's critical infrastructure and key assets against
    "inside" threats, and

    o  	partnering with the international community to protect our
    transnational infrastructure.

    Figure 9: A U.S. Immigration and Customs Enforcement Helicopter Patrols
    the Skies over the Nation's Capital

    Source: U.S. Immigration and Customs Enforcement.

    Agencies with Major Of the six departments under review, DHS, DOD, DOE,
    and DOJ have

    major roles in Critical Infrastructure Protection. DHS has primaryRoles in
    Critical responsibility for emergency services, government, information
    and Infrastructure telecommunications, transportation, chemicals, and
    postal and shipping

    sectors. Examples of specific functions performed by DHS include the
    Protection protection of federally owned or leased properties throughout
    the country by the Federal Protective Service, the Secret Service's role
    in coordinating

    Appendix V: Protecting Critical Infrastructures and Key Assets

    site security plans at designated special security events, and the
    National Cyber Response Coordination Group's role as a coordinating body
    for cyber emergencies of national scope. DOD is active in this mission
    area, primarily in areas of physical security of military and
    military-related activities, installations, and personnel. DOE's role
    involves the development and implementation of policies and procedures for
    safeguarding the nation's power plants, research labs, weapons production
    facilities, and cleanup sites from terrorists. DOJ, primarily through work
    done by the FBI and the Computer Crime and Intellectual Property Section
    of the Criminal Division, is active in this mission area in preventing,
    where possible, the exploitation of the Internet, computer systems, or
    networks as the principal instruments or targets of terrorist
    organizations.

    OMB reported that the total fiscal year 2005 funding request for the
    critical infrastructure protection mission area is $14 billion. DOD has
    the largest share of this funding ($7.6 billion, or 54 percent) for
    programs focusing on physical security and improving the military's
    ability to prevent or mitigate the consequences of attacks against its
    personnel and installations. DHS accounts for $2.6 billion (18 percent) of
    2005 funding. A total of 26 other agencies report funding to protect their
    own assets and to work with states, localities, and the private sector to
    reduce vulnerabilities in their areas of expertise.2 Figure 10 summarizes
    the fiscal year 2005 budget request for the CIP mission area by agency.

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    Figure 10: Proposed Fiscal Year 2005 Homeland Security Funding for
    Critical Infrastructure Protection

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    "All other agencies" includes USDA ($166 million) and the Department of
    Transportation ($189 million), as well as the National Aeronautics and
    Space Administration ($207 million), the National Science Foundation ($317
    million), the Social Security Administration ($151 million), and several
    others ($866 million). Total does not add up to 100 because of rounding.

    This section provides more detailed information about the CIP mission area
    initiatives and the departments involved in conducting activities related
    to these initiatives. This includes a discussion of specific departmental
    planning and implementation activities, lead agency designations, and
    implementation activities in fiscal year 2004, with respect to each
    initiative. The data are summarized in table 10.

    Alignment of Department Activities with the Major Initiatives

             Appendix V: Protecting Critical Infrastructures and Key Assets

    Table 10: Detailed Department Planning/Implementation Activities in the
    Protecting Critical Infrastructures and Key Assets Critical Mission Area's
    Eight Initiatives

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

                                Summary of Departmental
                             Activities on the Initiatives

    All eight CIP initiatives are being addressed by key departments' planning
    and implementation activities. At least three departments (DHS, DOD, and
    HHS) cited activity in each of the eight initiatives (see table 10). For
    example, DHS, HHS, State, and DOE each implemented activities in fiscal
    year 2004 with respect to guarding America's critical infrastructure and
    key assets against inside threats. DHS started the Transportation Worker
    Identification Credential program to enhance access security across the
    nation's transportation system; the Food and Drug Administration within
    HHS, issued guidance to the food industry that suggested preventive
    measures, including employee background checks, which could increase the
    security of food while under an establishment's control; State developed
    diplomatic agreements with Mexico and Canada to permit background checks
    of truck drivers; and DOE conducted selected polygraph examinations and
    financial disclosures of those working in the

             Appendix V: Protecting Critical Infrastructures and Key Assets

    energy field. Additionally, DHS, DOJ, DOD, HHS, State, and DOE each
    demonstrated implementation activities in fiscal year 2004 with respect to
    securing cyberspace. For example, DHS's Information Analysis and
    Infrastructure Protection Directorate refined, updated, and monitored the
    implementation of a national plan to protect physical and cyber critical
    infrastructures; DOJ operated a Special Technologies and Applications
    Section within the Cyber Division to support counterterrorism,
    counterintelligence, and criminal investigations involving computer
    intrusions; DOD prepared a departmentwide plan for CIP and physical and
    cyber assets; HHS's Centers for Disease Control and Prevention issued a
    fiscal year 2004 cyber security plan that includes activities and metrics;
    State took steps to strengthen the network's intrusion and detection
    capabilities; and DOE drafted a comprehensive Critical Infrastructure
    Plan, including plans for securing cyberspace.

    All six departments have been engaged in CIP initiatives. While we have
    identified department activities related to these initiatives, we did not
    determine the quality, status, or progress of such activities with respect
    to stated goals or targets within this critical mission area.

    Identification of Lead Agencies on the Initiatives

    For all eight initiatives, a lead agency was identified either in the
    homeland security strategy or HSPDs. As shown in table 10, DHS is a lead
    on all eight initiatives. It seems appropriate that DHS would be the
    department with the most initiative leads, given that the "national
    vision" put forth in the strategy calls for DHS "to work with the federal
    departments and agencies, state and local governments, and the private
    sector to implement a comprehensive national plan to protect critical
    infrastructure and key assets." It also seems appropriate that State would
    have a lead on matters of international critical infrastructure
    protection, given its overseas mission (partnering with the international
    community to protect our transnational infrastructure). The four remaining
    departments each have a lead on one mission area initiative. DOD, HHS, and
    DOE are all leads on the same initiative-building and maintaining a
    complete and accurate assessment of America's critical infrastructure and
    key assets. These departments have the sector leads as follows: DOD for
    defense industrial base, HHS for public health, and DOE for the energy
    sector. DOJ has a leading role in securing cyberspace, owing to its
    investigative and prosecutorial role in reducing threats in cyberspace.

    In all, the homeland security strategy and HSPDs identified multiple leads
    on three of the eight mission area initiatives. The five initiative
    exceptions that do not have multiple leads are unifying America's
    infrastructure

             Appendix V: Protecting Critical Infrastructures and Key Assets

    protection effort in DHS, enabling effective partnership with state and
    local governments and the private sector, developing a national
    infrastructure protection plan, harnessing the best analytic and modeling
    tools to develop effective protective solutions, and guarding America's
    critical infrastructure and key assets against inside threats. DOD, HHS,
    and DOE are identified as clear leads on a single initiative; DHS is
    identified as a clear lead on six of its eight initiative leads; and DOJ
    and State are implied leads on the single initiatives they lead.

    DOJ had been identified as a lead agency with respect to enabling
    effective partnerships with state and local governments and the private
    sector. However, given the transfer of the National Infrastructure
    Protection Center programs to the Department of Homeland Security, DOJ
    officials indicated that the department no longer serves as a lead on that
    initiative.

    Fiscal Year 2004 Implementation of the Initiatives

    In fiscal year 2004, implementation activity occurred with respect to all
    eight initiatives (see table 10). DHS implemented activity in all eight
    initiatives for which it was identified as a lead; DOJ, DOD, HHS, State,
    and DOE implemented activity in fiscal year 2004 in each of the
    initiatives for which they had been identified as a lead.

    Additionally, several of the departments under review implemented multiple
    CIP initiatives for which they were not identified as a lead in the
    strategy and HSPD. During fiscal year 2004, HHS cited implementation
    activity on six mission area initiatives for which it is was not given a
    lead role (it cited prior implementation on one of these initiatives); DOE
    cited 2004 implementation activity on six initiatives for which it is not
    the lead (with prior implementation on five); DOJ cited 2004
    implementation activity on two initiatives for which it was not a lead
    (with prior implementation on four); and State cited 2004 and prior
    implementation on two initiatives, for which it was not identified as a
    lead.

    Our analysis further indicates that three departments transferred
    programs, systems, or centers to the newly formed DHS, within this
    critical mission area. DOJ transferred the Key Asset Identification
    program, a component of the National Infrastructure Protection Center, to
    DHS. In accordance with the Homeland Security Act of 2002, DOD transferred
    the National Communication System. DOE transferred the National
    Infrastructure Simulation and Analysis Center and some related programs
    oriented toward protecting key infrastructure facilities and their
    components.

    Appendix V: Protecting Critical Infrastructures and Key Assets

    Challenges in Critical Infrastructure Protection

    As the National Strategy for Homeland Security points out, "protecting
    America's critical infrastructures and key assets is a formidable
    challenge" because "our open and technologically complex society presents
    an almost infinite array of potential targets, and our critical
    infrastructure changes as rapidly as the marketplace." In fact, the
    mission area is so diverse that two additional strategies-the National
    Strategy for the Physical Protection of Critical Infrastructures and Key
    Assets and the National Strategy to Secure Cyberspace-were issued to
    supplement the homeland security strategy. Our recent work in the CIP
    mission area has identified a number of challenges. These challenges
    include those related to the federal government's role in managing CIP.
    Among these are developing a comprehensive and coordinated national CIP
    plan that delineates the roles and responsibilities of federal and
    nonfederal CIP entities, defines interims objectives and milestones, sets
    time frames for achieving objectives, and establishes performance
    measures. In addition to identifying the challenges related to the overall
    management of CIP, our work has identified numerous challenges within
    specific infrastructure sectors. Included here are improving the security
    of government facilities; implementing better training and procedures to
    detect counterfeit documents and identity fraud; analyzing the strengths,
    interdependencies, and vulnerabilities of the financial services sector
    and developing strategies for responses to terrorist events; improving the
    safety and security of the postal system; strengthening security with
    regard to drinking water utilities; addressing the terrorist threat to
    agriculture and food; and addressing security issues with regard to
    chemical plants, nuclear power plants, and nuclear weapons sites.

    Effectively Managing Critical Infrastructure Protection

    The homeland security strategy specifically calls for the development of a
    "national infrastructure protection plan." The challenges identified in
    this mission area include those related to the federal government's role
    in managing CIP. To ensure the coverage of the critical infrastructure
    sectors identified in the homeland security strategy, HSPD-73 designated a
    sectorspecific agency for each sector. This agency is responsible for
    infrastructure protection activities within its assigned area and for
    coordinating and collaborating with other relevant agencies-as well as

    3In December 2003, the President issued HSPD-7, which established a
    national policy for federal departments and agencies to identify and
    prioritize critical infrastructure and key resources and to protect them
    from terrorist attacks. It superseded Presidential Decision Directive 63
    and defines responsibilities for DHS, sector-specific agencies (formerly
    referred to as sector liaisons) and other departments and agencies.

    Appendix V: Protecting Critical Infrastructures and Key Assets

    state and local governments, and the private sector-to carry out its
    mission. In addition, DHS's Information Analysis and Infrastructure
    Protection Directorate (IAIP) has the responsibility to (1) develop a
    comprehensive national CIP plan consistent with the Homeland Security Act
    of 2002; (2) recommend CIP measures in coordination with other federal
    agencies and in cooperation with state and local government agencies and
    authorities, the private sector, and other entities; and (3) disseminate,
    as appropriate, information analyzed by the department both within DHS and
    to other federal agencies and private sector entities. Regarding the
    national CIP plan, according to HSPD-7, it is to be produced by December
    2004 and outline national goals, objectives, milestones, and key
    initiatives. IAIP is also tasked with coordinating with other federal
    agencies to administer the Homeland Security Advisory System to provide
    specific warning information along with advice on appropriate protective
    measures and countermeasures.

    Over the last several years, we have reviewed various aspects of federal
    and private sector CIP efforts and issued numerous related reports. In an
    April 2004 testimony,4 we made numerous recommendations related to the
    federal CIP efforts, including issues involving the functions and
    responsibilities transferred to DHS, that represent challenges to DHS and
    other federal agencies. Among these challenges are

    o  	developing a comprehensive and coordinated national CIP plan that
    delineates roles and responsibilities of federal and nonfederal CIP
    entities, defines interim objectives and milestones, sets time frames for
    achieving objectives, and establishes performance measures;

    o  	developing fully productive information-sharing relationships within
    the federal government and among the federal government and state and
    local governments and the private sector; and.

    o  	improving the federal government's capabilities to analyze incident,
    threat, and vulnerability information obtained from numerous sources and
    share appropriate, timely warnings and other information concerning both
    cyber and physical threats to federal entities, state and local
    governments, and the private sector.

    4See GAO, Critical Infrastructure Protection: Establishing Effective
    Information Sharing with Infrastructure Sectors, GAO-04-699T (Washington,
    D.C.: Apr. 21, 2004).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    The Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions all made recommendations
                  related to the challenges presented in this section.

                                 Improving Security at
                                 Government Facilities

    The homeland security strategy identifies government operations as a
    critical infrastructure sector. In addition, the National Strategy for the
    Physical Protection of Critical Infrastructures and Key Assets, which
    provides guidance in implementing the Homeland Security Strategy, states
    that the General Services Administration (GSA) is the principal agency
    responsible for the management of federal government facilities.
    Additional departments and agencies are similarly involved in the
    management of federally owned or operated facilities, including DOD and
    the Department of Veterans Affairs (VA). Furthermore, a challenge
    identified in the strategy is that most government organizations occupy
    buildings that are also used by a variety of nongovernmental tenants, such
    as shops and restaurants where the public is able to move about freely.
    The strategy also states that private owners of these properties may not
    want or have the ability to modify their procedures to accommodate the
    increased or special security countermeasures required by their federal
    tenants, such as installing surveillance cameras in lobbies, redesigning
    entry points to restrict the flow of traffic, or setting up x-ray machines
    and metal detectors at these entrances. To overcome protection challenges
    associated with government facilities, DHS plans to

    o  	develop a process to screen nonfederal tenants and visitors entering
    private sector facilities that house federal organizations,

    o  determine the criticality and vulnerability of government facilities,

    o  	develop long-term construction standards for facilities requiring
    specialized security measures, and

    o  	implement new technological security measures at federally occupied
    facilities.

    In part because of the challenges associated with protecting government
    facilities, we designated federal real property as a high-risk area in
    January 2003.5 As the government's security efforts intensify, the
    government will be faced with important questions regarding the level of
    security needed to adequately protect federal facilities and how the
    security community should proceed. Furthermore, real property managers
    will have to

    5See GAO, High-Risk Series: Federal Real Property, GAO-03-122 (Washington,
    D.C.: Jan. 1, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    dedicate significant staff time and other human capital resources to
    security issues and thus may have less time to manage other problems.
    Another broader effect is the impact that increased security will have on
    the public's access to government offices and other assets. Debate arose
    in the months after September 11, and continues to this day on the
    challenge of providing the proper balance between public access and
    security.

    Finally, as we testified in April 2002 and again in September 2003,6 an
    additional challenge to ensuring the proper security of federal buildings
    is the ease with which counterfeit identification or identity fraud can be
    used to breach security. Our work identified three basic challenges in
    this regard: (1) government officials and others generally did not
    recognize that the documents we presented were counterfeit; (2) many
    government officials were not alert to the possibility of identity fraud,
    and some failed to follow security procedures; and (3) identity
    verification procedures are inadequate. The weaknesses we found during
    these investigations clearly show those government officials who review
    identification need additional training in recognizing counterfeit
    documents. Further, these officials also need to be more vigilant when
    searching for identification fraud.

    Both the Gilmore and 9/11 Commissions made recommendations related to the
    challenges discussed above.

    Addressing Issues Involving the Federal Protective Service

    As the agency with primary responsibility for carrying out the protection
    of thousands of federal facilities, the Federal Protective Service (FPS),
    which transferred from the GSA to DHS in March 2003, plays a critical role
    in the federal government's defense against terrorism. However, in July
    2004, we reported that FPS faces significant challenges in carrying out
    its responsibilities. 7 One challenge involves the agency's expanding
    mission and increased responsibility. FPS already has responsibility for
    securing approximately 8,800 GSA government-occupied facilities and plans
    to take on additional DHS facilities. It may also seek authority to
    protect other federal facilities. Additionally, the agency's mission has
    expanded to include other homeland security functions, such as supporting
    efforts to apprehend foreign nationals suspected of illegal activity. In
    light of these

    6See GAO-02-668T and Counterfeit Identification and Identification Fraud
    Raise Security Concerns, GAO-03-1147T (Washington, D.C.: Sept. 9, 2003)

    7See GAO, Homeland Security: Transformation Strategy Needed to Address
    Challenges Facing the Federal Protective Service, GAO-04-537 (Washington,
    D.C.: July 14, 2004).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    changes, however, it does not have a transformation strategy to address
    its expanding mission as well as the other challenges it is facing. Among
    these other challenges are resolving issues related to the agency's
    funding and the transfer of its mission-support functions to DHS.

    Addressing Vulnerabilities of the Financial Services Sector

    As stated in the homeland security strategy, the financial services sector
    is essential to sustaining the economy of the United States. Accordingly,
    the entities and networks that constitute the U.S. financial system are
    among the critical infrastructure that face increasing threats from
    terrorist and other disruptions. Transactions involving trillions of
    dollars occur in the U.S. financial markets annually. After the
    large-scale impact on market participants that resulted from the September
    11 attacks, law enforcement and other government organizations reported
    that key institutions and communications networks that support the
    financial markets have been specifically identified as targets.

    As we reported in February 2003, and September 2004, the government
    entities responsible for key financial market participants have begun to
    take actions to ensure that financial institutions are taking steps to
    minimize disruptions from terrorist attacks, but challenges remain. 8 For
    example, although banking and securities regulators have issued standards
    for the financial market participants that perform key roles in the
    clearance and settlement process through which the payments and ownership
    transfers resulting from securities trading are made, these regulators had
    not conducted a formal analysis of the readiness of financial market
    participants to better ensure that trading in critical U.S. financial
    markets could also resume smoothly and in a timely manner after a major
    disaster.9 Among the challenges that these regulators face is that
    thousands of entities are active in the financial markets, and they must
    ensure that sufficient numbers take adequate steps to allow fair and
    orderly trading to resume. Ensuring sufficient actions are taken by the

    8See GAO, Financial Market Preparedness: Improvements Made, but More
    Action Needed to Prepare for Wide-Scale Disasters, GAO-04-984 (Washington,
    D.C.: Sept. 27, 2004); Potential Terrorist Attacks: Additional Actions
    Needed to Better Prepare Critical Financial Market Participants,
    GAO-03-251 (Washington, D.C.: Feb. 12, 2003); and Potential Terrorist
    Attacks: Additional Actions Needed to Better Prepare Critical Financial
    Market Participants, GAO-03-414 (Washington, D.C.: Feb. 12, 2003).

    9Interagency Paper on Sound Practices to Strengthen the Resilience of the
    U.S. Financial System. Board of Governors of the Federal Reserve, Office
    of the Comptroller of the Currency, and the Securities Exchange Commission
    (Washington, D.C.: Apr. 8, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    private sector organizations that participate in the financial markets is
    also a challenge for securities r, and thus the extent to which they
    implement business continuity plans that would allow them to resume
    activities is a business decision.

    Another challenge facing the financial sector is implementing the
    strategy-developed by industry representatives under the sponsorship of
    the U.S. Department of the Treasury-that discusses additional efforts
    necessary to identify, assess, and respond to sectorwide threats. For
    example, the sector is expected to analyze its infrastructure's strengths,
    interdependencies, and vulnerabilities and develop strategies for
    responses to events. However, we reported in January 2003 that the
    financial services sector has not developed specific interim objectives;
    10 detailed tasks, time frames, or responsibilities for implementation; or
    a process for monitoring progress. Without completing such steps, a
    greater risk exists that the financial sector's efforts will be less
    focused, efficient, and effective.

    Improving Postal and Shipping Security

    Another critical infrastructure sector identified in the homeland security
    strategy is postal and shipping. In our May 2003 testimony,11 we reported
    that one of the challenges faced in this sector is that it is particularly
    vulnerable to being used as a means of delivering terrorist attacks. For
    example, anthrax was sent through the mail in October 2001, resulting in
    the death of five people, including two postal workers in Washington,
    D.C., and potentially exposed hundreds more to this lethal substance.
    Moreover, use of the mail as a vehicle for transmitting anthrax or similar
    weapons threatens the nation's mail stream and places the American public
    at risk. To help address this challenge, DHS has a role in mail security
    as part of its overall homeland security mission, in support of the two
    agencies that

    10See GAO, Critical Infrastructure Protection: Efforts of the Financial
    Services Sector to Address Cyber Threats, GAO-03-173 (Washington, D.C.:
    Jan. 30, 2003).

    11GAO, Diffuse Security Threats: USPS Air Filtration Systems Need More
    Testing and Cost Benefit Analysis before Implementation, GAO-02-838
    (Washington, D.C.: Aug. 22, 2002); U.S. Postal Service: Better Guidance Is
    Needed to Improve Communication Should Anthrax Contamination Occur in the
    Future, GAO-03-316 (Washington, D.C.: Apr. 7, 2003); U.S. Postal Service:
    Issues Associated with Anthrax Testing at the Wallingford Facility,
    GAO-03-787T (Washington, D.C.: May 19, 2003); U.S. Postal Service: Clear
    Communication with Employees Needed before Reopening the Brentwood
    Facility. GAO-04-205T (Washington, D.C.: Oct. 23, 2003); and Federal Mail
    Screening: Better Postal Service Communication with Agencies Needed to
    Enhance Federal Mail Security in the Washington, D.C., Area, GAO-04-286RNI
    (Washington, D.C.: Dec. 31, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    have key roles-the United States Postal Service (USPS) and GSA. Under the
    Homeland Security Act of 2002, DHS is responsible for, among other things,
    protecting certain buildings, grounds, and property owned or secured by
    the federal government and identifying and assessing current and future
    threats to the homeland. In addition, the National Strategy for the
    Physical Protection of Critical Infrastructures and Key Assets states DHS
    has a role in determining the criticality and vulnerability of government
    facilities, including federal mail centers. Following the anthrax attacks,
    USPS established increased security procedures to protect mail destined
    for federal agencies in the Washington, D.C., area, including the
    irradiation of mail. At the same time, federal agencies have taken various
    steps to increase the security of their mail centers in order to protect
    federal workers and buildings from possible exposure to anthrax and other
    types of dangerous material, such as explosives. In our December 2003
    review of mail security in the executive branch, we determined that a lack
    of information from USPS on mail security incidents, as well as on mail
    security policies and practices, reduced the ability of federal agencies
    to make well-informed decisions regarding mail practices or their future
    plans for mail screening. In addition, we found that agencies' fear of
    cross-contamination influenced their decision to implement practices which
    were not recommended by the USPS or other government and industry sources
    of mail-screening information. USPS and GSA have recognized that agencies
    need more information and have taken steps in the right direction. We
    recommended that USPS and GSA further work together as appropriate to
    establish mechanisms for providing federal agencies with USPS mail
    security policies and procedures, the risks associated with various
    classes of mail and the rationales behind these assessments, and USPS's
    future plans in federal mail security, and include DHS as appropriate in
    addressing these recommendations.

    Strengthening Drinking Water Security

    The homeland security strategy also identifies water as a critical
    infrastructure sector. Damage or destruction of drinking water systems by
    terrorists could disrupt not only the availability of safe drinking water,
    but also the delivery of vital services that depend on these water
    supplies, such as fire suppression. In our October 2003 report,12 we
    identified several key physical assets within this sector that are highly
    vulnerable to terrorist attacks. Specifically, the distribution system,
    source water

    12See GAO, Drinking Water: Experts' Views on How Future Federal Funding
    Can Best Be Spent to Improve Security, GAO-04-29 (Washington, D.C.: Oct.
    31, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    supplies, critical information systems, and chemicals stored on-site that
    are used in the treatment process have been identified as potential
    targets of terrorism. Additionally, our work has identified vulnerability
    challenges that may involve multiple system components or even an entire
    drinking water system. Chief among these challenges are (1) a lack of
    redundancy in vital systems, which increases the likelihood that an attack
    could render a system inoperable; and (2) the difficulty many systems face
    because of a lack of information on the most serious threats to which they
    are exposed.

    Additional challenges relate to the criteria for determining how federal
    funds should be allocated among drinking water systems to improve their
    security, and the methods for distributing those funds, as well as
    specific activities the federal government should support to improve
    drinking water security. With regard to the allocation of federal funds,
    our work indicates that utilities serving high-density areas deserve at
    least a high priority for federal funding. Other utilities warranting
    priority are those serving critical assets, such as military bases,
    national icons, and key academic institutions. Regarding specific
    security-enhancing activities most deserving of federal support, we found
    that challenges that must be overcome include implementing physical and
    technological upgrades to improve security; researching and developing
    technologies to prevent, detect, or respond to an attack (particularly
    near-real-time monitoring technologies); providing education and training
    to support simulation exercises; conducting specialized training and
    multidisciplinary consulting teams; and strengthening key relationships
    between water utilities and other agencies that may have key roles in an
    emergency response.

    Addressing Agriculture and Food Supply Security

    Another critical infrastructure sector identified in the homeland security
    strategy is the nation's food supply. While our food supply is generally
    safe and plentiful, each year tens of millions of Americans become ill and
    thousands die from eating unsafe food. The current federal food safety
    system is challenged by its fragmentation, which results in inefficient,
    inconsistent, and overlapping programs and operations. We have long
    recommended the establishment of a single food safety agency to administer
    a uniform, risk-based inspection system. Since the terrorist attacks of
    September 11, ensuring the security of our food-that is, protecting it
    from deliberate contamination-has become an added challenge for the
    federal agencies responsible for protecting the food and agriculture
    sectors of our economy.

    Appendix V: Protecting Critical Infrastructures and Key Assets

    As we have reported in numerous reports and testimonies over the last
    decade, 13 our fragmented federal food safety system hampers the
    efficiency and effectiveness of food safety efforts. Federal agencies have
    overlapping oversight responsibilities, which result in inefficient use of
    inspection resources and enforcement. This system is now further
    challenged by the realization that American farms and food are vulnerable
    to deliberate contamination. Fundamental changes are needed to improve the
    effectiveness and efficiency of the federal food safety system and to
    protect the nation's food supply from acts of deliberate contamination.

    One challenge involves the fact that bioterrorism attacks could be
    directed at many different targets in the farm-to-table continuum,
    including crops, livestock, and food products in the processing and
    distribution chain. For example, experts believe that terrorists would
    attack livestock and crops if their primary intent were to cause severe
    economic dislocation. On the other hand, if their motives were to harm
    humans, they could decide to contaminate finished food products. While
    agencies have taken steps to better protect the food supply, for the most
    part, the nation must still rely on the current food safety system to
    respond to bioterrorism acts against it.14 An additional challenge relates
    to the broad authority that agencies have to regulate the safety of the
    U.S. food supply but not the security of it. As a result, federal agencies
    are beginning to explore the extent to which food processors are
    voluntarily implementing security measures to protect against deliberate
    contamination.15 Finally, a challenge involves protecting against animal
    diseases that could be accidentally-or deliberately- introduced into the
    country. Certain animal disease can be devastating to the agricultural
    economy while others, such as mad cow disease, can be transmitted to
    humans. Our recent work has raised serious questions about security at
    DHS's Plum Island Animal Disease Center, which is responsible for
    developing strategies to protect the nation against animal

    13See GAO, Federal Food Safety and Security System: Fundamental
    Restructuring is Needed to Address Fragmentation and Overlap, GAO-04-588T
    (Washington, D.C.: Mar. 30, 2004).

    14See GAO, Bioterrorism: A Threat to Agriculture and the Food Supply,
    GAO-04-259T (Washington, D.C.: Nov. 19, 2003).

    15See GAO, Food-Processing Security: Voluntary Efforts Are Under Way, but
    Federal Agencies Cannot Assess Their Implementation, GAO-03-342
    (Washington, D.C.: Feb. 14, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    diseases.16 In particular, we had concerns about the adequacy of the
    facility's controls of dangerous pathogens.17

    The Gilmore Commission made recommendations related to the challenges
    presented in this section.

    Addressing Chemical Plant Security

    Although the chemical industry is identified in the homeland security
    strategy as a critical infrastructure sector, we reported in March 2003
    that the federal government has not comprehensively assessed the
    industry's vulnerability to terrorist attacks. 18 As a result, federal,
    state, and local entities are challenged by a lack of comprehensive
    information on the vulnerabilities faced by the sector. An additional
    challenge concerns the fact that no federal laws explicitly require all
    chemical facilities to take security actions to safeguard their facilities
    against a terrorist attack. Moreover, while federal laws require some
    facilities to take security precautions, federal requirements do not
    address security at all facilities that produce, use, or store hazardous
    chemicals.

    Although the chemical industry has undertaken a number of voluntary
    initiatives to address security concerns at chemical facilities, the
    extent of participation in voluntary initiatives is unclear. The chemical
    industry faces significant challenges in preparing its facilities against
    terrorist attack, including ensuring that facilities obtain adequate
    threat information, determining the appropriate security measures given
    the level of risk, and ensuring that all facilities that house hazardous
    chemicals address security concerns.

    16 USDA's Plum Island Animal Disease Center was transferred to DHS in June
    of 2003. Although USDA still administers research and diagnostic programs
    on the island, DHS and USDA also conduct joint research supporting efforts
    to reduce the effects of an attack on agriculture. DHS is responsible for
    the security and management of the facility. Located off the northeast
    coast of Long Island, New York, the center is the only place in the United
    States where certain highly infectious foreign animal diseases, such as
    foot and mouth disease, are studied.

    17See GAO, Combating Bioterrorism: Actions Needed to Improve Security at
    Plum Island Animal Disease Center, GAO-03-847 (Washington, D.C.: Sept. 19,
    2003).

    18See GAO, Homeland Security: Voluntary Initiatives Are Under Way at
    Chemical Facilities, but the Extent of Security Preparedness Is Unknown,
    GAO-03-439 (Washington, D.C.: Mar. 14, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    DHS and the Environmental Protection Agency (EPA) have taken steps to
    identify high-risk facilities, develop appropriate information-sharing
    mechanisms, and develop a legislative proposal to require chemical
    facilities to expeditiously assess their vulnerability to terrorist
    attacks and, where necessary, require these facilities to take corrective
    action. Legislation is now before Congress that, if enacted, would direct
    DHS, or DHS and EPA, to require chemical facilities to address these
    challenges.19

    Challenge: Addressing Nuclear Power Plant Security

    Another critical infrastructure sector identified in the homeland security
    strategy is energy. Among the possible terrorist targets within this
    sector are the nation's nuclear power plants-104 facilities containing
    radioactive fuel and waste. The Nuclear Regulatory Commission (NRC)
    oversees security of these facilities through an inspection program
    designed to verify the plants' compliance with security requirements.
    However, in September 2003,20 we reported that NRC faces challenges in
    ensuring that its oversight programs are effective in safeguarding these
    facilities and the surrounding communities. Specifically, three aspects of
    its security inspection program reduced NRC's effectiveness in this area.
    First, NRC's inspectors often used a process that minimized the
    significance of security problems found in annual inspections by
    classifying them as "non-cited violations" if the problem had not been
    identified frequently in the past or if the problem had no direct,
    immediate, or adverse consequences at the time it was identified. By
    making extensive use of these non-cited violations for serious problems,
    NRC may overstate the level of security at a power plant and reduce the
    likelihood that needed improvements are made. Second, NRC does not have a
    routine, centralized process for collecting, analyzing, and disseminating
    security inspections to identify problems that may be common to plants or
    to provide lessons learned in resolving security problems. Such a
    mechanism may help plants improve their security. Third, although NRC's
    force-on-force exercises can demonstrate how well a nuclear power plant
    might defend itself against a real-life threat, several weaknesses in how
    NRC conducts these exercises limited their usefulness. Weaknesses included
    using (1) more personnel to defend the plant during these exercises than
    would be available on a

    19See GAO, Homeland Security: Federal Action Needed to Address Security
    Challenges at Chemical Facilities, GAO-04-482T (Washington, D.C.: Feb. 23,
    2004).

    20See GAO, Nuclear Regulatory Commission: Oversight of Security at
    Commercial Nuclear Power Plants Needs to Be Strengthened, GAO-03-752
    (Washington, D.C.: Sept. 4, 2003).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    normal day, (2) attacking forces that are not trained in terrorist
    tactics, and (3) unrealistic weapons (rubber guns) that do not simulate
    actual gunfire. We also found that NRC made only limited use of some
    available improvements that would make force-on-force exercises more
    realistic and provide a more useful training experience. Finally, even if
    NRC strengthens its inspection program, commercial nuclear power plants
    face legal challenges in ensuring plant security. First, federal law
    generally prohibits guards at these plants from using automatic weapons,
    even though terrorists are likely to be using them. Second, state laws
    vary regarding the permissible use of deadly force and the authority to
    arrest and detain intruders, and we found that guards are unsure about the
    extent of their authorities and may hesitate or fail to act if the plant
    is attacked.

    Effectively Securing Nuclear Weapons Sites

    The homeland security strategy identifies the defense industrial base as a
    critical infrastructure sector. Within this sector, DOE has responsibility
    for sites containing nuclear weapons or the materials used in making
    nuclear weapons. A terrorist attack on one of these sites could have
    devastating consequences for the site and its surrounding communities. In
    ensuring that these sites are adequately prepared to defend themselves
    against the higher terrorist threats present in a post-September 11,
    world, DOE faces significant challenges. Among the challenges identified
    in our April 2004 report21 are the development of a new design basis
    threat (DBT), a classified document that identifies, among other things,
    the potential size and capabilities of terrorist forces. While the May
    2003 DBT identified a larger terrorist threat than did the 1999 DBT,22
    further analysis by DOE, in response to GAO's April 2004 report, resulted
    in a 2004 DBT that has been refined and more closely identified with the
    terrorist parameters reflected in the intelligence community's postulated
    threat. An additional challenge involves the fact that National Nuclear
    Security Administration (NNSA) has not been fully effective in managing
    its safeguards and security program. As a result, NNSA has had difficulty
    in providing fully effective oversight to ensure that its contractors are
    properly protecting its critical

    21See GAO, Nuclear Security: DOE Needs to Resolve Significant Issues
    before It Fully Meets the New Design Basis Threat, GAO-04-623 (Washington,
    D.C.: Apr. 27, 2004).

    22See GAO, Nuclear Security: DOE Must Address Significant Issues to Meet
    the Requirements of the New Design Basis Threat, GAO-04-701T (Washington,
    D.C.: Apr. 27, 2004).

             Appendix V: Protecting Critical Infrastructures and Key Assets

    facilities and materials from individuals seeking to inflict damage.23
    Finally, although both DOE and NNSA have made progress in implementing
    security initiatives, both agencies could benefit from clarifying the
    roles and authorities of various security offices and developing methods
    for evaluating program effectiveness and improvement.24

    Improving Security at DOD Installations

    The homeland security strategy discusses critical infrastructure as "those
    systems and assets so vital to the United States that their destruction or
    incapacity would have a debilitating impact on security." As DOD
    installations are an essential element of the national defense
    establishment, it follows that their security is equally essential.
    However, we have found that DOD faces challenges in safeguarding its
    installations and personnel from terrorist attacks. Specifically, in
    August 2004,25 we reported that although DOD has taken several steps and
    committed significant resources to immediately begin installation
    preparedness improvements, it lacks a comprehensive approach that
    incorporates results-oriented management principles to guide improvement
    initiatives in the most efficient and effective manner. A major challenge
    DOD faces is the lack of a single organization or entity with the
    responsibility and authority to integrate and manage the installation
    preparedness improvement efforts of numerous DOD organizations engaged in
    efforts to improve installation preparedness. Additional challenges to be
    overcome include DOD's difficulty in developing departmentwide standards
    and

    23GAO, Nuclear Security: NNSA Needs to Better Manage Its Safeguards and
    Security Program, GAO-03-471 (Washington, D.C.: May 30, 2003).

    24GAO, Nuclear Security: Lessons to Be Learned from Implementing NNSA's
    Security Enhancements, GAO-02-358 (Washington, D.C.: Mar. 29, 2002).

    25GAO, Combating Terrorism: DOD Efforts to Improve Installation
    Preparedness Can Be Enhanced with Clarified Responsibilities and
    Comprehensive Planning, GAO-04-855 (Washington, D.C.: Aug. 12, 2004).

    Appendix V: Protecting Critical Infrastructures and Key Assets

    concepts of operations for installation preparedness and in preparing a
    comprehensive plan for installation preparedness.

    Appendix VI: Defending Against Catastrophic Threats

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Defending Against Catastrophic Threats mission area and discusses the
    agencies with major roles, their funding, the alignment of their strategic
    plans and implementation activities with the major initiatives, and a
    summary of the challenges faced by the nation. This appendix presents
    baseline information that can be used by Congress to provide oversight and
    track accountability for the initiatives in the Defending Against
    Catastrophic Threats mission area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six mission areas, the fifth of which is Defending Against
    Catastrophic Threats. This mission area includes homeland security
    programs that involve protecting against, detecting, deterring, or
    mitigating terrorist use of weapons of mass destruction, including
    understanding terrorists' efforts to gain access to the expertise,
    technology, and materials needed to build chemical, biological,
    radiological, and nuclear (CBRN) weapons. In addition, this mission area
    includes planning and activities related to decontaminating buildings,
    facilities, or geographic areas after a catastrophic event. This mission
    area dovetails into Border and Transportation Security, Critical
    Infrastructure Protection, and Emergency Preparedness and Response as
    detection technologies are fielded and integrated into broader processes.1
    Figure 11 shows an example of the type of activities carried out in the
    Defending Against Catastrophic Threats mission area.

    The strategy identifies the following major initiatives in the Defending
    Against Catastrophic Threats mission area:

    o  	preventing terrorist use of nuclear weapons through better sensors and
    procedures;

    o  detecting chemical and biological materials and attacks;

    o  improving chemical sensors and decontamination techniques;

    o  developing broad-spectrum vaccines, antimicrobials, and antidotes;

    o  harnessing the scientific knowledge and tools to counter terrorism; and

    o  implementing the Select Agent Program.

    1This definition is from OMB's 2003 Report to Congress on Combating
    Terrorism (Washington, D.C.: Sept. 2003).

    Appendix VI: Defending Against Catastrophic Threats

    Figure 11: First Responders Practice Emergency Decontamination

    Source: GAO.

    Of the six departments under review, DHS and HHS have major roles in
    Defending Against Catastrophic Threats. DHS's Science and Technology
    Directorate develops and tests technologies and systems to detect CBRN
    materials and high explosives, develops and tests forensic methods to
    analyze CBRN materials and high explosives, and prioritizes measures to
    address catastrophic threats through research and modeling. HHS's National
    Institutes of Health (NIH) conducts basic and applied research related to
    likely bioterrorism agents; designs and tests diagnostics, therapies, and
    vaccines; and maintains laboratory capacity and provides expert assistance
    to address bioterrorism and other threats. Other organizations involved in
    this mission area include DOD, which performs research and development
    related to chemical and biological threats; the Department of Commerce,
    which is working to improve export control of weapons, materials that may
    be used to construct weapons, and other technologies; and the National
    Science Foundation, which is working to improve security and control of
    nuclear fuels.

    OMB reported that the total 2005 funding request for Defending Against
    Catastrophic Threats is just over $3.3 billion. The agencies with the most

    Agencies with Major Roles in Defending against Catastrophic Threats

    Appendix VI: Defending Against Catastrophic Threats

    funding are HHS ($1.9 billion, or 57 percent), largely for research at
    NIH, and in DHS's Directorate of Science and Technology ($886 million, or
    26 percent).2 Figure 12 summarizes the fiscal year 2005 budget request for
    the Defending against Catastrophic Threats mission area by agency.

    Figure 12: Proposed Fiscal Year 2005 Homeland Security Funding for
    Defending Against Catastrophic Threats

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    "All other agencies" includes USDA ($227 million) and the Department of
    Commerce ($66 million) as well as the National Science Foundation ($27
    million) and the Nuclear Regulatory Commission ($16 million).

    OMB's reported data do not include funding for two departments that have
    activities under way in this mission area. These departments-DOE and
    State-have either planning or implementation activity on specific

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004).

                  Appendix VI: Defending Against Catastrophic Threats

    initiatives, as discussed in the next section of this appendix. On the
    basis of our previous work, we have noted several qualifications to OMB's
    figures to explain this discrepancy.3 According to OMB officials, there is
    not always a clear distinction between homeland security activities and
    other related activities. OMB staff must make judgment calls about how to
    characterize funding by mission areas. For example, some homeland security
    activities have multiple purposes and funding for these activities is
    allocated to different accounts that can cover multiple mission areas. In
    addition, some of the departments' activities, such as planning,
    coordination, or providing advice may support Defending Against
    Catastrophic Defense activities but are not included in the amounts shown.

    In this section, we provide more detailed information about the Defending
    Against Catastrophic Threats mission area initiatives and the departments
    involved in conducting activities related to these initiatives. This
    includes a discussion of specific departmental planning/implementation
    activities, agency leads, and implementation activities during fiscal year
    2004, with respect to each initiative. The data are summarized in table
    11.

    Alignment of Department Activities with the Major Initiatives

    3See GAO, Combating Terrorism: Funding Data Reported to Congress Should be
    Improved, GAO-03-170 (Washington, D.C.: Nov. 26, 2002).

                  Appendix VI: Defending Against Catastrophic Threats

    Table 11: Detailed Department Planning/Implementation Activities in the
    Defending Against Catastrophic Threats Mission Area's Six Initiatives

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

                                Summary of Departmental
                             Activities on the Initiatives

    All six Defending Against Catastrophic Threats initiatives are being
    addressed in key departments' planning and implementation activities. As
    shown in table 11, at least two departments cited activity in each of the
    six initiatives. At least four departments cited activity in four of the
    six initiatives. For example, DHS, DOD, State, and DOE implemented
    activities in fiscal year 2004 to prevent terrorist use of nuclear weapons
    through better sensors and procedures. DHS's Science and Technology
    Directorate provided leadership in directing, funding, and coordinating
    research, development, testing, and evaluation and procurement of
    technology and systems to prevent the importation of chemical, biological,
    and radiological nuclear and related weapons; DOD activities addressed the
    clandestine transportation of weapons of mass destruction, including
    nuclear devices, via the Container Security and Proliferation Security
    Initiatives; State pursued diplomatic efforts in fiscal year 2004 to
    ensure compliance with existing multilateral treaties, strengthening
    verification and compliance procedures, and strengthening the
    International Atomic Energy Agency; and DOE worked with DOD to secure
    Iraqi radiological

    Appendix VI: Defending Against Catastrophic Threats

    and nuclear materials, as well as continued research at Los Alamos
    National Laboratory on radiological and nuclear countermeasures.
    Additionally, DHS, DOE, and HHS demonstrated fiscal year 2004
    implementation activities oriented toward improving chemical sensors and
    decontamination techniques. With regard to sensors, DHS's Homeland
    Security Advanced Research Projects Agency approved multiple chemical
    sensor technology contracts, and HHS continued to increase the number of
    toxic substances that can be readily measured by Rapid Toxic Screen
    testing. With regard to decontamination, DOE, through a national
    laboratory, developed a decontamination countermeasure for biological and
    chemical agents.

    The only department that did not have activities related to Defending
    Against Catastrophic Threats initiatives is DOJ. This is understandable,
    given that Justice is concerned with identifying, capturing, and
    prosecuting individuals involved in terrorist activity rather than
    developing and improving sensors, vaccines, antimicrobials, antidotes, and
    decontamination techniques and procedures.

    Identification of Lead Agencies in the Initiatives

    For all six initiatives, a lead agency is identified either in the
    strategy or HSPDs. As shown in table 11, DHS is a lead on all six
    initiatives. It seems appropriate that DHS would be the department with
    the most leads, given that the strategy's "national vision" calls for that
    department to "unify much of the federal government's efforts to develop
    and implement scientific and technological counter-measures against human,
    animal, and plant diseases that could be used as terrorist weapons" and
    "sponsor and establish national priorities for research, development, and
    testing to develop new vaccines, antidotes, diagnostics, therapies and
    other technologies against chemical, biological, radiological, or nuclear
    terrorism." HHS is also a lead on two initiatives, both oriented toward
    the public health safety of the nation (improving chemical sensors and
    decontamination techniques and developing broad spectrum vaccines,
    antimicrobials, and antidotes). More specifically, DOD, State, and DOE are
    all leads on the same single initiative (preventing terrorist use of
    nuclear weapons through better sensors and procedures).

    The strategy and HSPDs identified multiple leads on three of the six
    Defending Against Catastrophic Threats initiatives (see table 11). DHS,
    DOD, State, and DOE are all leads on one initiative, preventing terrorist
    use of weapons through better sensors and procedures; and DHS and HHS are
    both leads on two initiatives (improving chemical sensors and
    decontamination techniques and developing broad-spectrum vaccines,

                  Appendix VI: Defending Against Catastrophic Threats

    antimicrobials, and antidotes.) More specifically, with respect to the
    latter initiative, DHS identifies needs and coordinates activities rather
    than actually developing the vaccines, antimicrobials, and antidotes. The
    initiative is broadly defined to cover each of these areas. In addition,
    departmental strategic planning and implementation documents show that DHS
    is a clear lead on four of the six initiatives; and DOD, HHS, State, and
    DOE are implied leads on all their initiatives.

    Fiscal Year 2004 Implementation of the Initiatives

    In fiscal year 2004, implementation activity occurred with respect to all
    six of the Defending Against Catastrophic Threats initiatives (see table
    11). DHS implemented activity in five of the six initiatives for which it
    was identified as a lead by either the strategy or HSPDs. HHS implemented
    activity in both initiatives for which it was identified as a lead; State,
    DOD, and DOE each implemented activity in the single initiative for which
    they are leads.

    Additionally, several of the departments under review implemented multiple
    Defending Against Catastrophic Threats initiatives for which they were not
    identified as a lead in the strategy or HSPDs. During fiscal year 2004,
    HHS and DOE cited implementation activities (as well as prior
    implementation activities) in three and four initiatives, respectively,
    for which they were not a lead; State cited implementation and prior
    implementation activities in two initiatives for which it was not a lead.
    DOD conducted prior implementation activities in three initiatives for
    which it was not a lead.

    In accordance with the Homeland Security Act of 2002, several departments
    transferred some of their programs and centers to the newly created DHS.
    In the case of DOE, the nuclear smuggling programs and activities that had
    previously been within the proliferation detection program were
    transferred to DHS; DOE's chemical and biological national security and
    supporting programs were transferred; activities of the nonproliferation
    and verification research and development program and nuclear activities
    associated with assessment, detection, and cooperation regarding
    international materials and protection were all transferred to DHS. In the
    case of DOD, functions of the National Bio-Weapons Defense Analysis
    Center, including related functions of the Secretary of Defense, were also
    transferred to DHS.

    Appendix VI: Defending Against Catastrophic Threats

    Challenges in Defending Against Catastrophic Threats

    The expertise, technology, and material needed to build the most deadly
    weapons known to mankind-including chemical, biological, radiological, and
    nuclear weapons-are proliferating. The consequences of a terrorist attack
    using these types of weapons could be far more devastating than those
    suffered on September 11, in that such an attack could cause a large
    numbers of casualties, mass psychological disruption, and widespread
    contamination, and could overwhelm local medical capabilities. Our recent
    work in the Defending Against Catastrophic Threats mission area has
    identified a number of challenges. These challenges include the
    strengthening of efforts involving the nonproliferation of weapons of mass
    destruction, dangerous weapons systems and materials, and dual-use items;
    the control of the sale of excess items that can be used to produce and
    deliver biological agents; and the designation of lead agencies for
    setting priorities for information systems related to bioterrorism.

    Strengthening Nonproliferation Efforts

    The strategy declares that one of the nation's top priorities is to keep
    weapons of mass destruction out of the hands of terrorists. We have issued
    a number of reports concerning U.S. efforts to more effectively control
    and limit the spread of weapons of mass destruction, dangerous weapons
    systems and materials, and dual-use items. United States efforts in this
    regard are designed to prevent sensitive items from reaching persons,
    entities, or countries involved in terrorism or the proliferation of
    weapons of mass destruction and the vehicles to deliver them.

    We testified in March 2004 that the Departments of Commerce (Commerce),
    State, and Defense need to enhance their programs in this area. 4
    Specifically, we found that the United States faces a growing threat from
    the international proliferation of cruise missile and unmanned aerial
    vehicle (UAV) technology, challenging the tools the U.S. government has
    traditionally used. Multilateral export control regimes have expanded
    their lists of controlled items, but key countries of concern are not
    members. Some of these countries are also on the State Department's list
    of state sponsors of terrorism. In addition, U.S. efforts to control U.S.
    exports of dual-use items are hindered by a gap in U.S. export control
    authority. U.S. companies can sell certain dual-use items to foreign
    buyers, even if the exporter knows the buyer plans to use the items to
    build cruise missiles or UAVs. Finally, the United States seldom uses its
    end-use monitoring

    4See GAO, Nonproliferation: Improvements Needed for Controls on Exports of
    Cruise Missiles and Unmanned Aerial Vehicles, GAO-04-493T (Washington,
    D.C.: Mar. 9, 2004).

    Appendix VI: Defending Against Catastrophic Threats

    program to verify compliance with conditions placed on the use of cruise
    missiles.

    With regard to export controls over items that could be employed by
    terrorists, we found that post-shipment verification (PSV) provides
    limited assurance that dual-use items are being properly used.
    Specifically, we reviewed Commerce's efforts to conduct PSV checks to
    ensure that dualuse items and technologies arrive at their intended
    destination and are used for the purpose stated in the export license. We
    reported, in February 2004,5 that Commerce conducted relatively few
    post-shipment verification checks. For example, PSV checks were completed
    on only 6 percent of dual-use items exported to countries of potential
    proliferation concern. We also identified three key challenges in the PSV
    process itself. First, PSVs do not confirm compliance license conditions
    because U.S. officials frequently do not check license compliance, they
    often lack the technical training to assess compliance, and end-users may
    not be aware of the license conditions they are supposed to be abiding by.
    Second, some countries of concern limit the U.S. government's access.
    Third, PSV results have only limited impact on Commerce's future licensing
    decisions. Commerce generally agreed with our recommendation to address
    these challenges and indicated it had taken steps to strengthen the PSV
    process.

    In March 2004,6 we reported that another area of proliferation raising
    potential terrorism concerns involves delays in implementing the Chemical
    Weapons Convention (CWC). CWC bans chemical weapons and requires their
    destruction by 2007, with possible extension to 2012. CWC has played an
    important role in reducing the risks posed by chemical weapons. However,
    CWC's nonproliferation goals have proven more challenging than originally
    anticipated. First, the destruction of chemical weapons will likely take
    longer and cost more than originally anticipated. Even with significant
    international assistance, Russia may not be able to destroy its declared
    chemical weapons stockpile until 15 years beyond the extended CWC
    deadline. Second, technical advancements in the chemical industry and the
    increasing number of dual-use commercial facilities worldwide challenge
    the CWC's ability to deter and detect proliferation. Third, many CWC
    member states have not yet adopted national laws to

    5See GAO, Export Controls: Post-Shipment Verification Provides Limited
    Assurance That Dual-Use Items Are Being Properly Used, GAO-04-357
    (Washington, D.C.: Feb. 11, 2004).

    6See GAO, Delays in Implementing the Chemical Weapons Convention Raise
    Concerns about Proliferation, GAO-04-361 (Washington, D.C.: Mar. 31,
    2004).

    Appendix VI: Defending Against Catastrophic Threats

    fully implement the CWC or have not submitted complete and accurate
    declarations of their CWC-related activities.

    The Bremer, Gilmore, Hart-Rudman, and 9/11 commissions made
    recommendations related to the challenges presented in this section.

    Controlling the Sale of Biological Production Equipment

    Another challenge related to keeping weapons of mass destruction out of
    the hands of terrorists involves the ability of terrorists to readily
    obtain equipment that can be used to make biological agents. We have
    previously reported7 that many items needed to establish a laboratory for
    making biological warfare agents were being sold on the Internet to the
    public from DOD's excess property inventory for pennies on the
    dollar-making them both easy and economical to obtain. Although production
    of biological warfare agents requires a high degree of expertise, public
    sales of these DOD excess items increase the risk that terrorists could
    obtain and use them to produce and deliver biological agents within the
    United States. To prove this point, we created a fictitious company and
    purchased over the Internet key excess DOD biological equipment items and
    related protective clothing necessary to produce and disseminate
    biological warfare agents. Additionally, our investigation of several
    buyers of the biological equipment items found that they exported them to
    countries, such as the Philippines, Egypt, and the United Arab Emirates,
    for transshipment to other countries-some of which may be prohibited from
    receiving exports of similar trade-security-controlled items. Finally, the
    possibility that anthrax and other biological agents could have fallen
    into the wrong hands because of poor controls at laboratories handling
    biological agents calls for an assessment of the challenge to national
    security posed by public sales of excess biological laboratory equipment
    and protective clothing. While it should be noted that our work to date
    has focused on DOD sales, we found that these same types of items are
    available from other sources, indicating a much broader problem. The
    Bremer, Gilmore, Hart-Rudman, and 9/11 Commissions made recommendations
    related to this challenge.

    7See GAO, DOD Excess Property: Risk Assessment Needed on Public Sales of
    Equipment That Could Be Used to Make Biological Agents, GAO-04-15NI
    (Washington, D.C.: Nov. 19, 2003).

                  Appendix VI: Defending Against Catastrophic Threats

    Effective Implementation of Emerging Information Technologies

    The strategy calls for the development of a national system to detect
    biological and chemical attacks that will include "a public health
    surveillance system to monitor public and private databases for indicators
    of biological or chemical attack." One of the challenges we identified in
    a May 2003 report8 is that there are six federal agencies with key roles
    in bioterrorism preparedness and response. Within these six agencies, we
    identified 72 information systems and supporting technologies, as well as
    12 other information technology initiatives, with about 74 percent of
    these currently operational. Of the 72 information systems identified, 34
    are surveillance systems, 18 are supporting technologies, 10 are
    communication systems, and 10 are detection systems. In planning or
    operating each of these information systems and IT initiatives, the extent
    of coordination or interaction among the lead and other related government
    agencies covered a wide range. There was no one entity or coordinating
    body to set priorities for information systems, supporting technologies,
    and other IT initiatives.

    Within the public health sector, the implementation of emerging
    information technologies could help to strengthen agencies' technological
    capabilities to support the nation's ability to prepare for and respond to
    bioterrorism and other public health emergencies. Agencies identified
    several activities to research, develop, and implement emerging
    technologies, and these activities are generally initiated to meet
    agencies' specific needs. However, challenges exist that may hinder the
    public health community from benefiting from the implementation of
    emerging information technologies. These challenges include (1) the
    likelihood that emerging technologies have not been in use long enough for
    the developers to identify all areas of standardization, or for the
    technologies to have evolved to the point that they are interoperable with
    other existing technologies within public health; (2) the likelihood that
    the use of emerging technologies may change an organization's existing
    business model and thereby introduce a significant level of risk by
    disrupting existing business practices; and (3) the lack of a clearly
    defined mechanism for continuing research and development for emerging
    technologies once the results are turned over to the public sector.

    8See GAO, Bioterrorism: Information Technology Strategy Could Strengthen
    Federal Agencies' Abilities to Respond to Public Health Emergencies,
    GAO-03-139 (Washington, D.C.: May 30, 2003).

    Appendix VI: Defending Against Catastrophic Threats

    The Gilmore Commission made recommendations with regard to this challenge.

    Safeguarding Military Installations

    As DOD installations are an essential element of the nation's national
    defense establishment, it follows that their security is equally
    essential. However, we reported in August 2004 that DOD faces challenges
    in safeguarding its installations and personnel in the United States and
    overseas from terrorist attacks involving chemical, biological,
    radiological, and nuclear weapons and high explosives. 9 Specifically, we
    found that improving the preparedness of military installations is a
    challenging and complex task that will require a significant allocation of
    resources; involve numerous organizations within the department; and
    necessitate the coordination with other federal agencies, civilian
    organizations, and foreign host governments. Although DOD has taken
    several steps and committed significant resources to immediately begin
    installation preparedness improvements, it faces significant challenges
    and lacks a comprehensive approach that incorporates results-oriented
    management principles to guide improvement initiatives in the most
    efficient and effective manner. One major challenge DOD faces is the lack
    of a single organization or entity with the responsibility and authority
    to oversee and integrate the installation preparedness improvement efforts
    of various DOD organizations. Additional challenges to be overcome include
    the evolving or unclear responsibilities of key organizations and
    assignment of responsibility to update DOD's installation preparedness
    plans.

                                    9See GAO-04-855.

    Appendix VII: Emergency Preparedness and Response

    Definition and Major Initiatives

    This appendix sets forth the definition and major initiatives of the
    Emergency Preparedness and Response mission area and discusses the
    agencies with major roles, their funding, the alignment of their strategic
    plans and implementation activities with the major initiatives, and a
    summary of the challenges faced by the nation. This appendix presents
    baseline information that can be used by Congress to provide oversight and
    track accountability for the initiatives in the Emergency Preparedness and
    Response mission area.

    The National Strategy for Homeland Security categorizes homeland security
    activities into six mission areas, the sixth of which is Emergency
    Preparedness and Response. This mission area includes programs that
    prepare to minimize the damage and recover from any future terrorist
    attacks that may occur despite our best efforts at prevention. Included
    here are programs that help to plan, equip, train, and practice the needed
    skills of the varied and necessary first responders-including police
    officers, firefighters, emergency medical providers, public works
    personnel, and emergency management officials. Finally, this mission area
    includes activities to consolidate federal response plans and activities
    to build a national system for incident management in cooperation with
    state and local government.1 Figure 13 shows an example of the types of
    activities carried out in the Emergency Preparedness and Response mission
    area.

    The strategy identifies the following major initiatives in the Emergency
    Preparedness and Response mission area:

    o  	integrating separate federal response plans into a single
    all-discipline incident management plan;

    o  creating a national incident management system;

    o  improving tactical counterterrorist capabilities;

    o  enabling seamless communication among all responders;

    o  preparing health care providers for catastrophic terrorism;

    o  augmenting America's pharmaceutical and vaccine stockpiles;

    o  	preparing for chemical, biological, radiological, and nuclear
    decontamination;

    o  planning for military support to civil authorities;

    o  building the Citizen Corps;

    1This definition is from OMB's 2003 Report to Congress on Combating
    Terrorism (Washington, D.C.: Sept. 2003).

                   Appendix VII: Emergency Preparedness and Response

    o  	implementing the first responder initiative of the fiscal year 2003
    budget;

    o  building a national training and evaluation system; and

    o  enhancing the victim support system.

    Figure 13: Hazardous Materials Response Unit in Action at an Exercise

    Source: GAO.

    Of the six departments under review, the Department of Homeland Security
    and the Department of Health and Human Services have major roles in
    Emergency Preparedness and Response. DHS's activities include the
    development and implementation of the National Response Plan and the
    National Incident Management System, maintaining the National Disaster
    Medical System and Urban Search and Rescue Teams, and supporting state and
    local first responders through a wide-range of programs. HHS's activities
    are centered on preparing the nation's health care providers for
    catastrophic terrorism by, among other things, maintaining the Strategic
    National Stockpile and other emergency preparedness and response assets.
    In addition to DHS and HHS, several other agencies-including the
    Department of Defense, which maintains weapons of mass destruction (WMD)
    response teams to support civil authorities; and the Department of Energy,
    which maintains radiological and nuclear response capabilities-are
    involved in Emergency Preparedness and Response.

    Agencies with Major Roles in Emergency Preparedness and Response

    Appendix VII: Emergency Preparedness and Response

    The Office of Management and Budget reported that the total fiscal year
    2005 funding request for the Emergency Preparedness and Response mission
    area is just over $8.8 billion. DHS receives the largest share of this
    funding ($5.9 billion, or 68 percent), mostly for preparedness and grant
    assistance to state and local first responders and Project Bioshield. HHS
    also receives a significant amount of this funding ($2.2 billion, or 25
    percent) for assisting states and localities in upgrading their public
    health capacity. A total of 18 other federal agencies receive emergency
    preparedness and response funding, with a number of these maintaining
    specialized response assets that may be called upon in select
    circumstances.2 Examples of these agencies include DOD, which maintains
    WMD response teams to support civil authorities; DOE, which maintains
    radiological and nuclear response capabilities; and the Environmental
    Protection Agency, which maintains chemical, biological, radiological, and
    nuclear response teams.3 Figure 14 summarizes the fiscal year 2005 budget
    request for the emergency preparedness and response mission area by
    agency.

    2OMB, Analytical Perspectives, Budget of the United States Government,
    Fiscal Year 2005 (Washington, D.C.: Feb. 2004).

    3OMB, 2003 Report to Congress on Combating Terrorism (Washington, D.C.:
    Sept. 2003).

                   Appendix VII: Emergency Preparedness and Response

    Source: GAO, based on OMB, Analytical Perspectives, Budget of the United
    States Government, Fiscal Year 2005.

    Notes: Budget authority in millions of dollars.

    " All other agencies" includes the Departments of Agriculture ($69
    million), Veterans Affairs ($33 million), Commerce ($25 million), Treasury
    ($16 million), Transportation ($14 million), Labor ($10 million), Interior
    ($4 million) and Education ($1 million), as well as EPA ($30 million), and
    several others.

    This section provides more detailed information about the Emergency
    Preparedness and Response mission area initiatives and the departments
    involved in conducting activities related to these initiatives. This
    includes a discussion of specific departmental planning/implementation
    activities, lead agency designations, and department implementation
    activities in fiscal year 2004, with respect to each initiative. The data
    are summarized in table 12.

    Alignment of Department Activities with the Major Initiatives

                   Appendix VII: Emergency Preparedness and Response

    DHS DOJ DOD HHS State DOE

    o

                     PI = Prior implementation to fiscal year 2004

    Indicates the department has planning and/or implementation activity
    related to this initiative

    Department CLEARLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    Department IMPLICITLY identified as lead agency based on our review of
    Homeland Security Strategy and HSPDs

    RP = Recent planning
    04 = Fiscal year 2004 implementation

                                      Source: GAO.

    Summary of Departmental All 12 Emergency Preparedness and Response
    initiatives are being

    Activities on the Initiatives 	addressed in key departments' planning and
    implementation activities. As shown in table 12, at least two departments
    cited activity in each of the 12 initiatives. At least four departments
    cited activity in 7 of the 12 initiatives. For example, DHS, DOD, HHS, and
    DOE each cited implementation activities in fiscal year 2004 with respect
    to creating a national incident management plan. DHS Federal Emergency
    Management Agency worked on a comprehensive National Incident Management
    System that

    Appendix VII: Emergency Preparedness and Response

    incorporates federal, state, tribal, and local government personnel,
    agencies, and regional authorities; DOD participated in the planning of
    the National Incident Management System; HHS issued continuing guidance to
    assist state and local jurisdictions in preparation for joining the
    National Incident Management System; and DOE implemented an agreement to
    release departmental emergency response assets to DHS as requested in
    support of DHS's national incident management role. Additionally, DHS and
    HHS implemented activities in fiscal year 2004 toward creating seamless
    communication among all responders. DHS established an office to oversee
    interoperability efforts, contracts have been awarded to develop
    interoperability communication technologies, and the DHS Science and
    Technology Directorate is leading the RAPIDCOM initiative (under SAFECOM,
    a federal governmentwide program to achieve communication
    interoperability), and HHS (through its Centers for Disease Control and
    Prevention) increased the percentage of health departments with
    interoperable, redundant communication systems and high-speed Internet
    access, and has raised the number of jurisdictions having access to the
    Epidemic Information Exchange.

    All departments have implemented several initiatives in fiscal year 2004
    related to the Emergency Preparedness and Response critical mission area,
    with one exception: State has implemented activity with respect to only
    one initiative (improving tactical counterterrorist capabilities).

    Identification of Lead Agencies on the Initiatives

    For all 12 initiatives, a lead agency is identified either in the strategy
    or the Homeland Security Presidential Directives. DHS is the lead on the
    most initiatives in this mission area-11 of the 12 initiatives, the single
    exception being the initiative to augment America's pharmaceutical and
    vaccine stockpiles. It seems appropriate that DHS would be the department
    with the most leads given that the strategy's "national vision" calls for
    DHS to "consolidate federal response plans and build a national system for
    incident management" and "ensure that leaders at all levels of government
    have complete incident awareness and can communicate with and command all
    appropriate response personnel."

    Additionally, HHS is a lead on 3 of the 12 initiatives-augmenting
    America's pharmaceutical and vaccine stockpiles; preparing for chemical,
    biological, radiological, and nuclear decontamination; and building a
    national training and evaluation system. DOD is a lead on 1 of the 12
    initiatives within this mission area-planning for military support to
    civil authorities. Three departments have not been identified as a lead on
    any initiatives in this mission area: DOJ, State, and DOE.

    Appendix VII: Emergency Preparedness and Response

    The strategy and HSPDs identified multiple leads on 2 initiatives (see
    table 12). DHS and DOD are both leads on planning for military support to
    civil authorities; and DHS and HHS are leads on building a national
    training and evaluation system. In addition, 10 of the 11 DHS leads are
    clear, and the single DOD lead is clear. HHS lead is clear with respect to
    augmenting America's pharmaceutical and vaccine stockpiles and implied
    with respect to building a normal training and evaluation system and
    preparing for chemical, biological, radiological, and nuclear
    decontamination. (We included HHS as an implicit lead on the latter
    initiative since the department was an implicit lead on the closely
    related initiative, "improving chemical sensors and decontamination
    techniques" in the Defending against Catastrophic Threat mission area.)

    Fiscal Year 2004 Implementation of the Initiatives

    In fiscal year 2004 implementation activity occurred with respect to each
    of the 12 Emergency Preparedness and Response initiatives (see table 12).
    DHS implemented activity in 2004 on all 11 initiatives for which it was
    identified as a lead. DOD implemented prior and 2004 activities in the one
    area where it was the lead (planning for military support to civil
    authorities), and HHS implemented prior and 2004 activities in its two
    lead areas (augmenting America's pharmaceutical and vaccine stockpiles and
    building a national training and evaluation system).

    Additionally, several of the departments under review implemented multiple
    Emergency Preparedness and Response initiatives for which they were not
    identified as a lead in either the strategy or HSPDs. During fiscal year
    2004, DHS cited implementation activities in the single initiative for
    which it was not identified as a lead-augmenting America's pharmaceutical
    and vaccine stockpiles. HHS cited 2004 implementation activities in 7
    initiatives for which it was not a lead. Similarly, DOE cited
    implementation activities in 6 initiatives for which it was not identified
    as a lead in the strategies or HSPDs; and DOJ and DOD both cited fiscal
    year 2004 implementation activities in 3 initiatives for which they were
    not leads, respectively.

    DOJ's role in the Emergency Preparedness and Response mission area has
    been modified because of program transfers. DOJ's Office of Domestic
    Preparedness (ODP) had provided grant funding to assist state and local
    emergency response agencies (with respect to law enforcement, fire,
    hazardous materials, emergency medical services, emergency management, and
    public health) to enhance their capabilities to respond to threats posed
    by terrorist use of weapons of mass destruction. This program was
    transferred to DHS.

    Appendix VII: Emergency Preparedness and Response

    Challenges in Emergency Preparedness and Response

    Our recent work in the Emergency Preparedness and Response mission area
    has identified a number of challenges that must be overcome if the nation
    is to effectively minimize the damage and successfully recover from future
    terrorist attacks that may occur despite its best efforts at preventing
    them. One challenge involves the adoption of an "all-hazards" approach to
    emergency preparedness and response. Addressing this challenge would
    ensure that the nation is better prepared for terrorist events while
    simultaneously better preparing itself to deal with natural disasters.
    Another challenge involves providing better governmental planning and
    coordination with regard to first responder issues. An example of the
    challenge faced here concerns the National Capital Region (NCR), where
    there exists no coordinated regionwide plan for first responder
    priorities. Other challenges with regard to first responders include
    better preparing them to respond to incidents involving catastrophic
    terrorism and restructuring the federal grant system. An additional
    challenge involves improving public health communications and information
    sharing. An example of this challenge is the lack of a coordinated review
    process that ensures that communications projects complement one another.
    Additional challenges include better preparing health care providers to
    respond to incidents involving bioterrorism; improving regional response
    planning involving multiple municipalities; ensuring that hospitals have
    the medical equipment necessary for large influxes of patients; ensuring
    adequate communications among responders and with the public, and defining
    the roles and responsibilities of DOD in defending the homeland and
    providing military support to civil authorities.

    Adopting an All-hazards Approach

    The strategy calls for the creation of "a fully integrated national
    emergency response system that is adaptable enough to deal with any
    terrorist attack, no matter how unlikely or catastrophic, as well as all
    manner of natural disasters." This all-hazards approach to emergency
    preparedness and response has been embodied in a number of documents,
    including HSPD-5 and HSPD-8; the National Incident Management System; and
    the National Response Plan. In our May, June, and July 2004 reports,4 we
    pointed out

    4See GAO, Homeland Security: Management of First Responder Grants in the
    National Capital Region Reflects the Need for Coordinated Planning and
    Performance Goals, GAO-04-433 (Washington, D.C.: May 28, 2004); Homeland
    Security: Coordinated Planning and Standards Needed to Better Manage First
    Responder Grants in the National Capital Region, GAO-04-904T (Washington,
    D.C.: June 24, 2004); and Homeland Security: Federal Leadership and
    Intergovernmental Coordination Required to Achieve First Responder
    Interoperable Communications, GAO-04-740 (Washington, D.C.: July 20,
    2004).

    Appendix VII: Emergency Preparedness and Response

    that the challenges the nation's emergency responders face in adapting an
    all-hazards approach include (1) identifying the types of emergencies-
    e.g., hurricane or truck bomb attack-for which they should be prepared and
    the requirements-e.g., incident management plans and procedures,
    equipment, and training-for responding effectively to these different
    types of emergencies; (2) assessing current capabilities against those
    requirements; (3) developing and implementing effective, coordinated plans
    among multiple first responder disciplines and jurisdictions to close the
    gap between current capabilities and established requirements; and (4)
    defining the roles and responsibilities of federal, state, and local
    governments and private entities in defining requirements, assessing
    capabilities, and developing and implementing coordinated plans to enhance
    first responder capabilities. The Gilmore and 9/11 commissions made
    recommendations with regard to this challenge.

    Improving Intergovernmental Planning and Coordination

    The strategy emphasizes a shared national responsibility-involving all
    levels of government-in responding to a serious emergency, such as a
    terrorist incident. However, in May 2004 we reported that a major
    challenge involves a lack of coordination in preparing for, responding to,
    and recovering from terrorist and other emergency incidents. 5 In
    particular, our work indicates that there has been a lack of regional
    planning and coordination for developing first responder preparedness,
    defining preparedness goals, identifying spending priorities, and
    expending funds. For example, our review of the first responders grants in
    the National Capital Region (NCR) found that there was no coordinated
    regionwide plan for establishing first responder performance goals, needs,
    and priorities and assessing benefits of expenditures to enhance first
    responder capabilities. As a result, NCR faces several challenges in
    organizing and implementing efficient and effective regional preparedness
    programs, including the lack of a coordinated strategic plan for enhancing
    NCR preparedness, performance standards, a central source of data on funds
    available and the purposes for which they are spent.

    We found similar challenges related to regional coordination in our April
    2003 bioterrorism work.6 The strategy calls for state and local
    governments to "sign mutual aid agreements to facilitate cooperation with
    their

    5See GAO-04-433.

    6See GAO, Bioterrorism: Preparedness Varied across State and Local
    Jurisdictions, GAO-03-373 (Washington, D.C.: Apr. 7, 2003).

    Appendix VII: Emergency Preparedness and Response

    neighbors in time of emergency." Such agreements are particularly
    important because although the response to a terrorist incident (such as a
    bioterrorism attack) would occur at the local level, it could spread
    across local, state, and even national boundaries. We found that health
    care officials were challenged by a lack of regional coordination between
    the states and with neighboring countries. Specifically, states tend to
    organize their planning on a regional basis, assigning local areas to
    particular regions within the state. Additionally, we found that border
    states varied with regard to the intensity of their coordination efforts
    with Canada and Mexico. The Gilmore, Hart-Rudman, and 9/11 commissions
    made recommendations with regard to this challenge.

    Overcoming Fragmentation of the Federal Grant System

    The strategy acknowledges that the federal grant system for first
    responders is highly fragmented. In September 2003,7 we testified that
    this fragmentation leads to challenges in the coordination and integration
    of services, as well as in planning at state and local levels. There are
    many different grant programs that can be used by first responders to
    address preparedness activities. However, in April 2003,8 we testified
    that substantial differences exist in the types of recipients and the
    allocation methods for grants addressing similar purposes. For example,
    some grants go directly to local first responders, such as firefighters,
    while others go to state emergency management agencies or directly to
    state fire marshals. The allocation methods differ as well-some are
    formula grants, while others involve discretionary decisions by federal
    agency officials on a project basis. Grant requirements vary as well. For
    example, DHS's Assistance to Firefighters Grant has a maintenance of
    effort requirement, while the State Fire Training Systems Grant has no
    similar requirement. Several alternatives might be employed to overcome
    problems fostered by this fragmentation, including consolidating grant
    programs, establishing performance partnerships between federal agencies
    and state and local governments, and waiving federal funding restrictions
    and program requirements. The Gilmore and 9/11 commissions made
    recommendations with regard to this challenge.

    7See GAO, Homeland Security: Reforming Federal Grants to Better Meet
    Outstanding Needs, GAO-03-1146T (Washington, D.C.: Sept. 3, 2003).

    8See GAO, Federal Assistance: Grant System Continues to Be Highly
    Fragmented, GAO-03-718T (Washington, D.C.: Apr. 29, 2003).

    Appendix VII: Emergency Preparedness and Response

    Improving Communications and Information Sharing

    The strategy has an initiative to enable seamless communications among all
    first responders and public health entities. However, in our August and
    November 2003 reports,9 we stated that insufficient collaboration among
    federal, state, and local governments creates a challenge for sharing
    public health information and developing interoperable communications for
    first responders. For example, states and cities implemented many
    initiatives to improve information sharing, but these initiatives were not
    well coordinated and risked creating partnerships that limited access to
    information and created duplicative efforts. Another challenge involves
    the lack of effective, collaborative, interdisciplinary, and
    intergovernmental planning for interoperable communications. For instance,
    the federal and state governments lack a coordinated grant review process
    to ensure that funds are used for communication projects that complement
    each other and add to overall statewide and national interoperability
    capacity. Moreover, we testified in April 200410 that the Wireless Public
    Safety Interoperable Communications Program, or SAFECOM, has had very
    limited progress in achieving communication interoperability among all
    entities at all levels of government and has not achieved the level of
    collaboration necessary. Finally, in our October 2002 report11 on public
    health preparedness, we reported that challenges exist in ensuring
    communication among responders and with the public. For example, during
    the anthrax incidents of 2001, local officials identified communication
    among responders and with the public as a challenge, both in terms of
    having the necessary communication channels and in terms of making the
    necessary information available for distribution. The 9/11 Commission made
    recommendations with regard to this challenge.

    9See GAO, Homeland Security: Efforts to Improve Information Sharing Need
    to Be Strengthened, GAO-03-760, (Washington, D.C.: Aug. 27, 2003); and
    Homeland Security: Challenges in Achieving Interoperable Communications
    for First Responders, GAO-04-231 (Washington, D.C.: Nov. 6, 2003).

    10See GAO, Project SAFECOM: Key Cross-Agency Emergency Communications
    Effort Requires Stronger Collaboration, GAO-04-494 (Washington, D.C.:
    Apr.16, 2004).

    11See GAO, Bioterrorism: Public Health Response to Anthrax Incidents of
    2001, GAO-04-152 (Washington, D.C.: Oct. 15, 2003).

                   Appendix VII: Emergency Preparedness and Response

    Better Preparing Health Care Providers for Catastrophic Terrorism

    The strategy has an initiative to "prepare health care providers for
    catastrophic terrorism." However, in April 2003,12 we reported that many
    local areas and their supporting agencies may not be adequately prepared
    to respond to such an event. Specifically, while many state and local
    officials reported varying levels of preparedness to respond to a
    bioterrorist attack, they reported that challenges existed because of
    deficiencies in capacity, communication, and coordination elements
    essential to preparedness and response (such as workforce shortages,
    inadequacies in disease surveillance and laboratory systems, and a lack of
    regional coordination and compatible communications systems). Some of
    these challenges, such as those involving coordination efforts and
    communication systems, were being addressed more readily, whereas others,
    such as infrastructure and workforce issues, were more resourceintensive
    and, therefore, more difficult to address. Generally, we found that cities
    with more experience in dealing with public health emergencies were
    generally better prepared for a bioterrorist attack than other cities,
    although challenges remain in every city. An additional challenge reported
    to us by state and local officials concerned the lack of adequate guidance
    from the federal government on what it means to be prepared for
    bioterrorism. These officials said that they needed specific standards
    (such as how large an area a response team should be responsible for) to
    indicate what they should be doing to be adequately prepared. Finally,
    state officials indicated that a challenge to be overcome involved the
    lack of sharing of best practices information. These officials stated that
    while each jurisdiction might need to adapt procedures to its own
    circumstances, time could be saved and needless duplication of effort
    avoided if better mechanisms existed for sharing strategies across
    jurisdictions. The Gilmore, Hart-Rudman, and 9/11 commissions made
    recommendations with regard to this challenge.

    Improving Response The strategy recognizes that "a major act of biological
    terrorism would

    Capabilities 	almost certainly overwhelm existing state, local, and
    privately owned health care capabilities." In fact, in May 2003 we
    testified that while the efforts of public health agencies and health care
    organizations to increase their preparedness for major public health
    threats has increased, significant challenges remain. 13 Specifically, we
    found that there are gaps

    12See GAO-03-373.

    13See GAO, SARS Outbreak: Improvements to Public Health Capacity Are
    Needed for Responding to Bioterrorism and Emerging Infectious Diseases,
    GAO-03-769T (Washington, D.C.: May 7, 2003).

    Appendix VII: Emergency Preparedness and Response

    in disease surveillance systems and laboratory capacity, and the number of
    personnel trained for disease detection is insufficient. Additionally,
    most emergency departments across the country lack the capacity to respond
    to large-scale infectious disease outbreaks. For example, although most
    hospitals across the country reported participating in basic planning
    activities for large-scale infectious disease outbreaks, few have acquired
    the medical equipment resources-such as ventilators-that would be required
    in such an event. Further, because most emergency departments already
    routinely experience some degree of overcrowding, they may not be able to
    handle the sudden influx of patients that would occur during a large-scale
    terrorist incident or infectious disease outbreak. The Gilmore Commission
    made recommendations with regard to this challenge.

    Adequately Equipping Hospitals for Large Influxes of Patients

    The strategy states that DHS, working with HHS and VA, will help hospitals
    "expand their surge capacity to care for large numbers of patients in a
    mass-casualty incident." However, in August 2003 we reported14 that a
    challenge to be overcome involved the fact that the medical equipment
    available for response to such an incident varies greatly among hospitals.
    Additionally, many hospitals reported that they did not have the capacity
    to respond to the large increase in the number of patients that would be
    likely to result from a bioterrorist incident with mass casualties. For
    example, if a large number of patients with severe respiratory problems
    associated with anthrax or botulism were to arrive at a hospital, a
    comparable number of ventilators would be required to treat them. However,
    half of the hospitals we reviewed had, per 100 staffed beds, fewer than
    six ventilators, three or fewer personal protective equipment suites,
    fewer than four isolation beds, or the ability to handle fewer than six
    patients per hour through a 5-minute decontamination shower. Overcoming
    this challenge is particularly difficult because bioterrorism preparedness
    is expensive, and hospitals are reluctant to create capacity that is not
    needed on a routine basis and may never be needed at a particular
    facility. Related to this challenge, HSPD-10 stated that HHS "in
    coordination with other appropriate federal departments and agencies, is
    the principal federal agency responsible for coordinating all
    federal-level assets activated to support and augment the state and local

    14See GAO, Hospital Preparedness: Most Urban Hospitals Have Emergency
    Plans but Lack Certain Capacities for Bioterrorism Response, GAO-03-924
    (Washington, D.C.: Aug. 6, 2003).

    Appendix VII: Emergency Preparedness and Response

    medical and public health response to mass casualty events." The Gilmore
    Commission made recommendations with regard to this challenge.

                                 Establishing Emergency
                                 Preparedness Standards

    Although the strategy discusses benchmarks, standards, and other
    performance measures for emergency preparedness, we have found that there
    is not yet a comprehensive set of preparedness standards for assessing
    first responder capacities, identifying gaps in those capacities, and
    measuring progress in achieving performance goals. Additionally, in June
    2004, we testified15 that state and local officials were concerned about
    the lack of specific standards for determining preparedness, and these
    officials noted that specific benchmarks would help them determine whether
    they were adequately prepared to respond to a bioterrorism incident.
    Moreover, in our past work on interoperable communications,16 we discussed
    the need to establish national interoperability performance goals and
    standards. Finally, we have reported on the lack of reliable information
    on existing federal, state, and local capabilities for combating terrorism
    and the need to develop a comprehensive inventory of existing
    capabilities. Without standards linked to such capabilities, it will be a
    challenge to assess preparedness gaps and efforts to address the gaps
    without information on existing capabilities. The Gilmore Commission made
    recommendations with regard to this challenge.

    Defining DOD's Homeland Security Roles and Missions

    The strategy called for a review of the authority for military assistance
    in domestic security. One of the reasons for this review is that federal
    law places some restrictions on military personnel performing law
    enforcement functions with the United States-functions that might be
    needed in a terrorist incident. 17 Another reason for this review is that
    DOD's primary mission is to deter and prevent aggression abroad and fight
    to win if these measures fail. This is accomplished through military
    presence and power projection. However, the federal government's view

    15See GAO, Homeland Security: Coordinated Planning and Standards Needed to
    Better Manage First Responder Grants in the National Capital Region,
    GAO-04-904T (Washington, D.C.: June 24, 2004).

    16See GAO-04-231T.

    17 The 1878 Posse Comitatus Act prohibits the direct use of federal
    military troops in domestic civilian law enforcement, except where
    authorized by the Constitution or acts of Congress. Congress has expressly
    authorized the use of the military in certain situations such as to assist
    with terrorist incidents involving weapons of mass destruction.

    Appendix VII: Emergency Preparedness and Response

    of the defense of U.S. territory has changed since September 11. As a
    result, DOD has adjusted its strategic and operational focus to encompass
    not only traditional military concerns posed by hostile states overseas
    but also asymmetric threats directed at our homeland by both terrorists
    and hostile states. In a July 2003 report,18 we noted that DOD faces
    challenges in balancing its domestic and overseas missions with a renewed
    emphasis on homeland defense. Moreover, current operations both home and
    abroad are stressing military forces, as shown in personnel tempo data.
    Complicating the situation is the fact that some units are not well
    structured for their domestic missions, cannot practice the varied skills
    needed to maintain combat proficiency while performing domestic missions,
    and receive little training value from their assigned domestic duties.
    Therefore military force readiness may erode and future personnel
    retention problems may develop, if action is not taken to address these
    challenges. The Gilmore and 9/11 commissions made recommendations with
    regard to this challenge.

    18See GAO, Homeland Defense: DOD Needs to Assess the Structure of U.S.
    Forces for Domestic Military Missions, GAO-03-670 (Washington, D.C.: July
    11, 2003).

                           Appendix VIII: Crosscutting Issues

    Crosscutting Challenges

    This appendix describes challenges in implementing the National Strategy
    for Homeland Security that are crosscutting-they cut across the six
    critical mission areas. Many of them also cut across the federal, state,
    local and private sectors. Because this appendix is not based on any
    critical mission area (as defined in the strategy), it does not include
    information on major initiatives, agencies with major roles, funding by
    department, or alignment of department plans with major initiatives.

    Our recent work has identified a number of challenges to ensuring the
    security of the homeland that are not confined to a specific mission area.
    These challenges are governmentwide in nature and include balancing
    homeland security funding needs with other national requirements,
    providing timely and transparent homeland security funding information,
    improving risk management methods for resource allocation and investments,
    expanding agency use of performance measures that link costs to outcomes,
    establishing baseline performance goals and measures upon which to assess
    and improve preparedness, developing and implementing national standards,
    clarifying roles and responsibilities within and between the levels of
    government and the private sector, developing a national enterprise
    architecture, and improving information technology management
    governmentwide.

    In addition to the challenges discussed above, DHS-as the department most
    responsible for Homeland Security-faces a number of other challenges.
    Because of this, in January 2003 we designated the overall implementation
    and transformation of DHS as high-risk. 1 We gave it this designation for
    three reasons. First, the size and complexity of the effort make the
    challenge especially daunting, requiring sustained attention and time to
    achieve the department's mission in an effective and efficient manner.
    Second, the components being merged into DHS already face a wide array of
    existing challenges that must be addressed. Finally, if DHS cannot
    effectively carry out its mission, it exposes the nation to potentially
    very serious consequences. We are currently in the process of reviewing
    the challenges faced by DHS, the progress it has made in addressing these
    challenges, and its continued high-risk designation. The results of this
    review will be published in a forthcoming GAO report.

    1See GAO, Major Management Challenges and Program Risks, Department of
    Homeland Security, GAO-03-102 (Washington, D.C.: Jan. 24, 2003).

                           Appendix VIII: Crosscutting Issues

    Balancing Homeland Security with Other National Budget Needs

    The strategy notes that "the national effort to enhance homeland security
    will yield tremendous benefits and entail substantial financial and other
    costs." In April 2002 and September 2003, we reported that, among other
    things, the federal government must address the challenge of formulating
    realistic budget and resource plans that support and will sustain
    implementation of an efficient and effective homeland security program and
    that provide sufficient guidance to federal, state, local and private
    sector entities to create concurrent and compatible strategic plans and
    investments. 2 In this regard, extensive resources that have already been
    designated for homeland security, along with those resources currently
    being proposed, clearly reflect a large and rapidly growing federal role
    involving direct spending and assistance to others. While a robust
    homeland security program is critical to the nation's protection and
    prosperity, the challenge will be to develop it in a manner that is
    targeted to areas of greatest need and avoids wasteful, unfocused, or
    "hitchhiker" spending. Moreover, the new commitments will compete with and
    increase the pressure on other important priorities within the budget. As
    our long-term budget simulation notes, known demographic trends and rising
    health care costs will place unprecedented pressures on our longrange
    fiscal position. A fundamental review of existing programs and operations
    can create much-needed fiscal flexibility by weeding out programs that are
    outdated, poorly targeted, or inefficiently designed and managed. An
    additional challenge with regard to balancing homeland security funding
    with other national requirements involves the role of both the executive
    and legislative branches of government in ensuring optimum performance and
    appropriate accountability of our homeland security activities and program
    expenditures. The 9/11 Commission made recommendations related to this
    challenge.

    Providing Timely and Transparent Budget Information

    The strategy reflects that "it is important to reprioritize spending to
    meet our homeland security needs, and not simply to permit unchecked
    overall growth in federal outlays." To examine homeland security as a
    crosscutting governmentwide function, Section 889 of the Homeland Security
    Act of 2002 requires that the President's budget include a funding
    analysis covering all federal homeland security activities-not just those

    2See GAO, Homeland Security: Responsibility and Accountability for
    Achieving National Goals, Statement of David M. Walker, Comptroller
    General of the United States, GAO-02-627T (Washington, D.C.: Apr. 11,
    2002); and Truth and Transparency: The Federal Government's Financial
    Condition and Fiscal Outlook (Washington, D.C.: Sept. 17, 2003).

                           Appendix VIII: Crosscutting Issues

    carried out in DHS. As we reported in November 2002,3 agencies provide
    information that distinguishes funding for homeland security from
    combating terrorism and other federal activities at a level of detail that
    OMB describes as sufficient to analyze government spending on homeland
    security. OMB has made a number of improvements to its annual Report to
    Congress on Combating Terrorism.4 For the first time, the annual report
    issued in September 2003 aggregated funding information by the critical
    mission areas in the National Strategy for Homeland Security.
    Additionally, by releasing this year's analysis with the President's
    fiscal year 2005 budget, OMB has made this crosscutting presentation a
    timely complement to individual budget proposals and a resource for
    congressional budget deliberations. Despite these positive changes,
    congressional decision makers still face challenges in using this
    information to make sound decisions on appropriations. Specifically, a key
    element to understanding spending for homeland security is missing-that
    is, how much of the funding provided has been obligated. Without
    obligation information, it is impossible to know (1) whether funds are
    being used to implement programs (e.g., orders placed, contracts awarded,
    and services received); (2) how much funding from prior years is still
    available to potentially offset new needs or priorities; (3) whether the
    rate of spending for a program is slower than anticipated; or (4) what the
    level of effort or commitment is in a particular mission area for a given
    year or over time.

    Improving Risk Management Methods for Resource Allocation and Investment

    The strategy states that "we must carefully weigh the benefit of each
    homeland security endeavor and only allocate resources where the benefit
    of reducing risk is worth the amount of additional cost." We have long
    advocated a risk management approach to guide the allocation of resources
    and investments for improving homeland security.5 Additionally,

    3GAO, Combating Terrorism: Funding Data Reported to Congress Should Be
    Improved, GAO-03-170 (Washington, D.C.: November 26, 2002).

    4Consistent with the requirements of Fiscal Year 1998 National Defense
    Authorization Act, the annual Report to Congress on Combating Terrorism
    details governmentwide spending to combat terrorism. Starting with the
    fiscal year 2005 President's budget, in compliance with the Homeland
    Security Act of 2002, this information will be transmitted with the
    President's buget.

    5See GAO, Homeland Security: Key Elements of a Risk Management Approach,
    GAO-02-150T (Washington, D.C.: Oct. 12, 2001); and Homeland Security: A
    Risk Management Approach Can Guide Preparedness Efforts, GAO-02-208T
    (Washington, D.C.: Oct. 31, 2001).

                           Appendix VIII: Crosscutting Issues

    OMB has identified various tools it considers useful in planning, such as
    benefit-cost analysis, capital budgeting, and regulatory decision making.6
    Such tools are difficult to apply to homeland security expenditures even
    when such application is encouraged in the homeland security strategy.7 A
    challenge to the central management of the budget is to develop and adopt
    a framework and supporting tools to inform cost allocations in a risk
    management process. Although OMB asked the public in 2002 for suggestions
    on how to adjust standard tools to the homeland security setting,8 a
    vacuum currently exists in which benefits of homeland security investments
    are often not quantified and are almost never valued in monetary terms.9
    As OMB guidance is relatively silent on acceptable treatments of
    nonquantifiable benefits,10 there is a lack of criteria to guide agency
    analysts in developing information to inform management. The Gilmore and
    9/11 commissions made recommendations on the need for risk management.

    Establishing Baseline Performance Goals and Measures

    While the strategy discusses creating benchmarks and performance measures,
    it does not provide a baseline set of performance goals and measures upon
    which to assess and improve preparedness. The Government Performance and
    Results Act of 1993 (GPRA) required federal agencies to develop strategic
    plans with long-term, outcomeoriented goals and objectives, annual goals
    linked to achieving the longterm goals, and annual reports on the results
    achieved. In July 2002,11 we testified that because of lack of performance
    goals and measures in the homeland security strategy, the nation does not
    have a comprehensive set of performance goals and measures upon which to
    assess and improve prevention efforts, vulnerability reduction, and
    responsiveness to damage and recovery needs at all levels of government.
    Thus the nation faces a challenge to establish clear goals and performance
    measures to ensure

    6OMB Circulars A-11 and A-94.

    7OMB, Office of Information and Regulatory Affairs, Informing Regulatory
    Decisions: 2003 Report to Congress on the Costs and Benefits of Federal
    Regulations and Unfunded Mandates on State, Local, and Tribal Entities
    (Washington, D.C.: Sept. 2003).

    8OMB, 2003 Report to Congress on Combating Terrorism (Washington, D.C.:
    Sept. 2003).

    9OMB Circular A-11.

    10OMB Circular A-94.

    11See GAO, Homeland Security: Critical Design and Implementation Issues,
    GAO-02-957T (Washington, D.C.: July 17, 2002).

                           Appendix VIII: Crosscutting Issues

    both a successful and a fiscally responsible preparedness effort. We
    identified strategic planning as one of the critical success factors for
    new organizations. For example, as part of its implementation phase, we
    noted that DHS should engage in strategic planning through the involvement
    of stakeholders, assessment of internal and external environments, and an
    alignment of activities, core processes, and resources to support
    missionrelated outcomes. We are currently reviewing DHS's first strategic
    plan to, among other things, assess the extent to which it reflects GPRA
    requirements and supports the strategy. The 9/11 Commission made
    recommendations related to this challenge.

    Clarifying Government and Private Sector Roles and Responsibilities

    According to the strategy, "the responsibility for providing homeland
    security is shared between federal, state and local governments, and the
    private sector." In April 2002,12 we testified, however, that the
    appropriate roles and responsibilities within and between the levels of
    governments and with the private sector are evolving and need to be
    clarified. New threats are prompting a reassessment and shifting of
    long-standing roles and responsibilities. These shifts have been occurring
    on a piecemeal and ad hoc basis without the benefit of an overarching
    framework and criteria to guide the process. The homeland security
    strategy recognizes the challenge posed by a complex structure of
    overlapping federal, state, and local governments-our country has more
    than 87,000 jurisdictions-but its initiatives often do not provide a
    baseline set of performance goals and measures upon which to assess and
    improve preparedness. Thus, the nation does not yet have a comprehensive
    set of performance goals and measures upon which to assess and improve
    prevention efforts, vulnerability reduction, and responsiveness to damage
    and recovery needs at all levels of government. Given the need for a
    highly integrated approach to the homeland security challenge, national
    performance goals and measures for strategy initiatives that involve both
    federal and nonfederal actors may best be developed in a collaborative way
    involving all levels of government and the private sector. Standards are
    one tool the homeland security strategy emphasizes in areas such as
    training, equipment, and communications. The 9/11 Commission made
    recommendations related to this challenge.

    12See GAO, Homeland Security: Responsibility and Accountability for
    Achieving National Goals, GAO-02-627T (Washington, D.C.: Apr. 11, 2002).

                           Appendix VIII: Crosscutting Issues

    Developing a National Enterprise Architecture for Homeland Security

    The strategy points out that mobilizing and organizing the nation to
    secure it from terrorist attacks is "an exceedingly complex mission that
    requires coordinated and focused effort from our entire society." The
    development of a national enterprise architecture could assist in
    transforming the various organizations involved in homeland security, as
    well as their supporting systems, in a way that eliminates duplication,
    promotes interoperability, reduces costs, and optimizes mission
    performance. An enterprise architecture is a blueprint that defines, both
    in logical terms (including interrelated business processes and business
    rules, integrated functions, applications, systems, users, work locations,
    and information needs and flows) and in technical terms (including
    hardware, software, data, communications, and security) how an
    organization operates today, how it will operate in the future, and a road
    map for the transition.

    DHS intends to incrementally develop a national enterprise architecture
    for homeland security. In August 2004,13 we reported that DHS's initial
    enterprise architecture provided a partial basis upon which to build
    future versions that can be made applicable beyond the department itself.
    However, it was missing most of the content necessary to be considered a
    well-defined architecture. Moreover, the content in this version was not
    systematically derived from a DHS or national corporate business strategy;
    rather, it was more the result of an amalgamation of the existing
    architectures that several of DHS's predecessor agencies already had,
    along with their respective portfolios of system investment projects. Such
    a development approach is not consistent with recognized architecture
    development best practices. DHS officials agreed with our content
    assessment of their initial architecture, stating that it is largely a
    reflection of what could be done without a departmental strategic plan to
    drive architectural content and with limited resources and time. Since our
    report was published, DHS has developed the next version or increment of
    its enterprise architecture, with the intent of developing future versions
    or increments that extend horizontally to include, for example, state and
    local government homeland security entities. The 9/11 Commission made
    recommendations related to this challenge.

    13See GAO, Homeland Security: Efforts Under Way to Develop Enterprise
    Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6,
    2004).

                           Appendix VIII: Crosscutting Issues

    Improving Governmentwide Information Technology Management

    The strategy states that "every government official performing every
    homeland security mission depends upon information and information
    technology." However, in January 2004,14 we reported that challenges are
    faced throughout the federal government with regard to information
    technology management-including the consistent application of IT strategic
    planning and performance measurement practices. Specifically, we have
    found that agencies generally have IT strategic plans and goals, but that
    these goals are not always linked to specific performance measures that
    are tracked. Additionally, while agencies largely have IT investment
    management boards, we found no agency had the practices associated with
    control fully in place. These practices are important ingredients for
    ensuring effective strategic planning and investment management, and they,
    in turn, make it more likely that the billions of dollars in government IT
    investments will be wisely spent. Finally, our experience with federal
    agencies has shown that attempts to modernize IT environments without
    blueprints-models simplifying the complexities of how agencies operate
    today, how they will operate in the future, and how they will get
    there-often result in unconstrained investment and systems that are
    duplicative and ineffective. Enterprise architectures, as described in our
    report, offer such blueprints. The 9/11 Commission made recommendations
    related to this challenge.

    14 See GAO, Information Technology Management: Governmentwide Strategic
    Planning, Performance Measurement, and Investment Management Can Be
    Further Improved, GAO-04-49 (Washington, D.C.: Jan. 12, 2004).

    Appendix IX: Department Summary Across Critical Mission Areas

    This appendix provides a summary analysis across all the six mission
    areas. It includes information on whether all 43 initiatives are being
    covered, how frequently departments are cited with lead responsibilities,
    whether they are implementing programs related to these initiatives in
    fiscal year 2004, and where such implementation efforts are concentrated.
    As stated earlier, we used the National Strategy for Homeland Security and
    Homeland Security Presidential Directives 1 through 12 to determine lead
    agencies with respect to each initiative. The "clear" and "implied" leads,
    discussed in the methodology section, are denoted by solid and dashed line
    boxes, respectively.

             Appendix IX: Department Summary Across Critical Mission Areas

    Table 13: Summary of Department Leads, Planning, and Implementation across
    the Six Critical Mission Areas of the National Strategy for Homeland
    Security

    DHS DOJ DOD HHS State DOE

    Indicates the department has planning and/or implementation activity
    related to this initiative Department CLEARLY identified as lead agency
    based on our review of Homeland Security Strategy and HSPDs Department
    IMPLICITLY identified as lead agency based on our review of Homeland
    Security Strategy and HSPDs PI = Prior implementation to fiscal year 2004
    RP = Recent planning
    04 = Fiscal year 2004 implementation

    Source: GAO. Continued on next page

    Appendix IX: Department Summary Across Critical Mission Areas

    DHS DOJ DOD HHS State DOE

    Indicates the department has planning and/or implementation activity
    related to this initiative Department CLEARLY identified as lead agency
    based on our review of Homeland Security Strategy and HSPDs Department
    IMPLICITLY identified as lead agency based on our review of Homeland
    Security Strategy and HSPDs PI = Prior implementation to fiscal year 2004
    RP = Recent planning 04 = Fiscal year 2004 implementation Source: GAO.
    Continued on next page

    Appendix IX: Department Summary Across Critical Mission Areas

    DHS DOJ DOD HHS State DOE

    Indicates the department has planning and/or implementation activity
    related to this initiative Department CLEARLY identified as lead agency
    based on our review of Homeland Security Strategy and HSPDs Department
    IMPLICITLY identified as lead agency based on our review of Homeland
    Security Strategy and HSPDs PI = Prior implementation to fiscal year 2004
    RP = Recent planning 04 = Fiscal year 2004 implementation Source: GAO.

    The strategy identifies 43 initiatives across the six mission areas. All
    43 initiatives have been addressed through department planning or
    implementation activities. Each initiative has been addressed by at least
    two departments under review, with a single exception (Justice is the only
    department involved in planning/implementing activities to complete the
    FBI's restructuring process to emphasize the prevention of terrorist
    attacks). A total of 33 initiatives have been addressed by three or more
    departments under review; 9 initiatives have been addressed by five or
    more departments.

    Appendix IX: Department Summary Across Critical Mission Areas

    All initiatives have identified leads, with one exception (the
    Intelligence and Warning initiative, "employment of red-team techniques").
    The strategy and HSPDs intended DHS to be the prominent department on
    matters related to homeland security. This is reflected in DHS being
    identified as a lead on 37 of the 43 initiatives, spanning all six
    critical mission areas. DOJ is identified as a lead department on 8 of the
    43 initiatives, including all 6 initiatives cited under the Domestic
    Counterterrorism mission area-the mission area most specifically related
    to criminal justice matters. (DOJ had been identified as a lead agency
    with respect to two initiatives, creating smart borders and guarding
    America's critical infrastructure and key assets against inside threats.
    However, given the transfer of the Immigration and Naturalization Service
    and the National Infrastructure Protection Center programs to the
    Department of Homeland Security, DOJ officials indicated the department no
    longer serves as a lead on these 2 initiatives). HHS is identified as a
    lead on 6 of the 43 initiatives. (HHS has no lead responsibilities with
    respect to the Intelligence and Warning, Border and Transportation
    Security, and Domestic Counterterrorism mission areas.) State is cited as
    a lead on 4 initiatives, spanning all the critical mission areas with the
    exception of Intelligence and Warning and Emergency Preparedness and
    Response. DOD has been cited in the homeland security strategy and HSPDs
    as a lead on 3 initiatives (excluding the Intelligence and Warning, Border
    and Transportation Security, and Domestic Counterterrorism mission areas).
    DOE is a lead department on 2 initiatives, encompassing just two critical
    mission areas: Protecting Critical Infrastructures and Key Assets and
    Defending against Catastrophic Threats.

    The six departments under review have implemented activities on several
    initiatives during fiscal year 2004, for which they have been identified
    as leads. DHS cited implementation activities in 36 of the 37 initiatives
    for which it was identified as a lead (the one exception being the Select
    Agent Program). HHS, DOD, DOE, DOJ, and State cited implementation
    activities in fiscal year 2004 on each of their lead areas. In total, one
    or more departments cited implementation activities in fiscal year 2004 on
    all 43 initiatives.

    When considering departmental implementation activities during fiscal year
    2004, irrespective of lead, we find that DHS documented activities in 40
    of the 43 initiatives, spanning all six critical mission areas. DOE
    documented fiscal year 2004 implementation activities in 25 of the 43
    initiatives, also spanning all six critical mission areas. HHS identified
    2004 activities in 24 of the 43 initiatives, covering five of the six
    mission areas (the exception: Intelligence and Warning). DOD cited 2004
    implementation

    Appendix IX: Department Summary Across Critical Mission Areas

    activities in 17 of the 43 initiatives, covering all six mission areas.
    State demonstrated 2004 activities in 15 of the 43 initiatives, spanning
    all six mission areas; and DOJ identified 2004 activities in 13 of the 43
    initiatives, covering four of the six mission areas (the exceptions:
    Border and Transportation Security and Defending against Catastrophic
    Threats).

    Appendix X: Homeland Security Presidential Directives

    This appendix describes, in chronological order, the presidential
    directives that, in conjunction with the National Strategy for Homeland
    Security and certain other national strategies, form the foundation for
    the federal government's efforts to protect the nation against terrorist
    attack and ensure the security of the homeland. These documents set forth
    agencies' roles and responsibilities for responding to potential or actual
    terrorist threats or incidents as well as the processes and mechanisms by
    which the federal government mobilizes and deploys resources and
    coordinates assistance to state and local authorities, the public, and the
    private sector.

    Homeland Security Presidential Directive-1

    HSPD-1 was issued on October 29, 2001. It established the Homeland
    Security Council (HSC) and charged it with ensuring that all homeland
    security-related activities carried out by the executive agencies and
    departments are properly coordinated and with promoting the effective
    development and implementation of all homeland security policies. In
    addition to describing the organization and operation of the HSC, it set
    forth the composition and duties of the HSC Principals Committee (the
    senior interagency forum under the HSC for homeland security issues) and
    the HSC Deputies Committee (the senior sub-Cabinet interagency forum for
    consideration of policy issues affecting homeland security). It also
    discussed the formation of the 11 HSC Policy Coordination Committees to
    serve as the main day-to-day forum for interagency coordination of
    homeland security policy.

    Homeland Security Presidential Directive-2

    HSPD-2, also issued on October 29, 2001, set forth U.S. national policy
    for combating terrorism through the application of enhanced immigration
    policies designed to aggressively prevent the entry into the country of
    aliens who engage in or support terrorist activity and to identify,
    locate, detain, prosecute, and deport any such aliens already residing in
    the United States. This directive established the Foreign Terrorist
    Tracking Task Force to ensure federal agency coordination and directed the
    (1) development and implementation of multiyear plans to enhance the
    investigative and intelligence analysis capabilities of the INS and
    Customs Service; (2) implementation of measures to end the abuse of
    student visas and prohibit certain international students from receiving
    education and training in sensitive areas; (3) initiation of negotiations
    with Canada and Mexico to ensure maximum possible compatibility of
    immigration, customs, and visa policies; and (4) study of the use of
    advanced technologies for data sharing and enforcement efforts.

    Appendix X: Homeland Security Presidential Directives

    Homeland Security Presidential Directive-3

    Issued on March 11, 2002, HSPD-3 established the Homeland Security
    Advisory System (HSAS) as a comprehensive and effective means for ensuring
    the rapid dissemination of information regarding the risk of terrorist
    acts to federal, state, and local authorities and to the general public.
    It describes the HSAS as a system that provides warnings in the form of a
    set of graduated threat levels that increase as the risk of an attack
    rises and goes on to explain that for each threat level there would be a
    corresponding set of protective measures that would be implemented.
    According to HSPD-3, the HSAS is intended to create a common vocabulary,
    context, and structure for an ongoing national dialogue about the nature
    of the terrorist threat and the actions that can be taken in response to
    it.

    Homeland Security Presidential Directive-4

    Issued in December 2002, HSPD-4 is the unclassified version of the
    National Strategy to Combat Weapons of Mass Destruction. This directive
    promulgates the nation's resolve to combat weapons of mass destruction
    through the application of new technologies, increased emphasis on
    intelligence collection and analysis, the strengthening of alliance
    relationships, and the establishment of new partnerships with former
    adversaries. Further, HSPD-4 sets forth the three principal pillars upon
    which the strategy will rest-counterproliferation to combat WMD use;
    strengthened nonproliferation to combat WMD proliferation; and consequence
    management to respond to WMD use. The classified version of this HSPD is
    NSPD-17.

    Homeland Security Presidential Directive-5

    HSPD-5, issued on February 28, 2003, is concerned with the management of
    domestic terrorist attacks, major disasters, and other emergency
    incidents. It calls for the establishment of a single, comprehensive
    national incident management system in order to ensure that all levels of
    government across the nation have the capability to work together
    efficiently and effectively, using a national approach to domestic
    incident management. HSPD-5 further states that with regard to domestic
    incidents, the federal government will treat crisis management and
    consequence management as a single, integrated function, rather than as
    two separate functions. HSPD-5 is considered to be a companion to HSPD8,
    which was issued in December 2003.

    Homeland Security Issued on September 16, 2003, HSPD-6 set forth the
    policy of the United

    Presidential Directive-6 	States with regard to the integration and use of
    screening information. It directed the Attorney General to establish an
    organization to consolidate

                 Appendix X: Homeland Security Presidential Directives

    the government's approach to terrorism screening and provide for the
    appropriate and lawful use of terrorist information in screening
    processes. HSPD-6 further directed that the heads of executive departments
    and agencies provide-to the extent permitted by law-the Terrorist Threat
    Integration Center with all appropriate terrorist information in their
    possession, custody, or control on an ongoing basis.

    Homeland Security HSPD-7 was issued on December 17, 2003, and established
    a national

    Presidential Directive-7 	policy for federal departments and agencies to
    identify and prioritize United States critical infrastructure and key
    resources and to protect them from terrorist attacks. It set forth the
    roles and responsibilities of the Secretary of Homeland Security,
    sector-specific federal agencies, and other departments, agencies, and
    offices in critical infrastructure protection. It should be noted that
    HSPD-7 superseded an earlier presidential directive on critical
    infrastructure protection (PDD 63).

    Homeland Security Presidential Directive-8

    This directive was also issued on December 17, 2003. It established
    policies to strengthen the nation's preparedness to prevent and respond to
    potential or actual terrorist attacks, major disasters, and other
    emergencies by requiring a national domestic all-hazards preparedness
    goal, establishing mechanisms for improved delivery of federal
    preparedness assistance to state and local governments, and outlining
    actions to strengthen the preparedness capabilities of federal, state, and
    local entities. HSPD-8 is a companion to HSPD-5, which had been issued
    earlier in the year.

    Homeland Security HSPD-9, issued on January 30, 2004, established a
    national policy to

    Presidential Directive-9 	defend the agriculture and food system of the
    United States against terrorist attacks, major disasters, and other
    emergencies. It set forth the roles and responsibilities of the
    Secretaries of Homeland Security, Agriculture, and Health and Human
    Services and the Administrator of the Environmental Protection Agency in
    ensuring the safety and security of the nation's food supply.

    Homeland Security HSPD-10 was issued on April 28, 2004, under the title
    "Biodefense for the

    Presidential Directive-10 	21st Century." It set forth a blueprint-based
    on a comprehensive evaluation of the nation's biological defense
    capabilities-for the nation's future biodefense program that fully
    integrates the sustained efforts of the national and homeland security,
    medical, public health, intelligence,

                 Appendix X: Homeland Security Presidential Directives

    diplomatic, and law enforcement communities. HSPD-10 describes the pillars
    of the national biodefense program as threat awareness, prevention and
    protection, surveillance and detection, and response and recovery.
    Finally, it provided that specific direction to departments and agencies
    for implementing the biodefense program is contained in a classified
    version of the HSPD, NSPD-33.

    Homeland Security Presidential Directive-11

    Issued on August 27, 2004, HSPD-11 builds on HSPD-6 in setting forth the
    nation's policy with regard to comprehensive terrorist-related screening
    procedures. Specifically, it states that terrorist-related screening will
    be enhanced through (1) the adoption of comprehensive, coordinated
    procedures that detect, identify, track, and interdict people, cargo,
    conveyances, and other entities that pose a threat to homeland security
    and (2) the implementation of a comprehensive and coordinated approach to
    terrorist-related screening-in immigration, law enforcement, intelligence,
    counterintelligence, and protection of the border, transportation systems,
    and critical infrastructure-that supports homeland security.

    Homeland Security HSPD-12, also issued on August 27, 2004, directs the
    establishment of a

    Presidential Directive-12 	common identification standard for federal
    employees and contractors. Specifically, HSPD-12 states that the policy of
    the United States is to enhance security, increase government efficiency,
    reduce identity fraud, and protect personal privacy through the
    establishment of a mandatory, governmentwide standard for secure and
    reliable forms of identification issued by the federal government.

    Appendix XI: Comments from the Department of Defense

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    Appendix XI: Comments from the Department of Defense

    GAO Comment 	We incorporated the point indicated in the DOD letter and
    responded to technical comments where appropriate throughout the report.

    Appendix XII: Comments From the Department of Health and Human Services

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    Appendix XII: Comments From the Department of Health and Human Services
    Appendix XII: Comments From the Department of Health and Human Services

        Appendix XII: Comments From the Department of Health and Human Services

    GAO Comment 	We incorporated the technical comments where appropriate
    throughout the report.

    Appendix XIII: Comments From the Department of Homeland Security

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    Appendix XIII: Comments From the Department of Homeland Security Appendix
    XIII: Comments From the Department of Homeland Security Appendix XIII:
    Comments From the Department of Homeland Security

            Appendix XIII: Comments From the Department of Homeland Security

    GAO Comment 	In addition to making the changes indicated in the enclosure,
    we incorporated the technical comments where appropriate throughout the
    report.

    Appendix XIV: Comments From the Department of Justice

    Note: GAO comments supplementing those in the report text appear at the
    end of this appendix.

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    Appendix XIV: Comments From the Department of Justice

    GAO Comments	In addition to the letter reprinted in this appendix, we
    included the enclosure containing the recent accomplishments of the
    Federal Bureau of Investigation. We did not solicit this type of
    information from any participating department nor its components, during
    this engagement. Nor did we conduct the necessary audit to verify the
    validity of the findings. In addition to providing the letter and
    enclosure, the department provided technical comments. We incorporated the
    technical comments where appropriate throughout the report.

    Appendix XV: GAO Contacts and Staff Acknowledgments

                                      GAO Contacts

    Intelligence and Warning 	FBI Law Enforcement Issues
    Laurie E. Ekstrand, (202) 512-2758

    FBI Information Technology and Watch List Issues
    Randolph C. Hite, (202) 512-6256

    DHS Homeland Security Advisory System Issues
    William O. Jenkins, Jr., (202) 512-8757

    Threat Information Sharing Issues
    Henry L. Hinton, (202) 512-6599

    Border and Transportation
    Security

    Border, Customs and Immigration Issue Richard M. Stana, (202) 512-8816

    Visa Issues
    Jess T. Ford, (202) 512-4268

    Travel Document Counterfeiting and Fraud
    Robert J. Cramer, (202) 512-7227

    Border Radiation Detection Issues
    Eugene E. Aloise, (202) 512-6870

    Biometrics Technology Issues
    Keith A. Rhodes, (202) 512-3938

    Border Information Technology Issues
    David A. Powner, (202) 512-9286

    Aviation Security Issues
    Cathleen A. Berrick, (202) 512-3404

    Surface Transportation Security Issues
    Cathleen A. Berrick, (202) 512-3404

    Maritime Security Issues
    Margaret T. Wrightson, (415) 904-2200

    Appendix XV: GAO Contacts and Staff Acknowledgments

    U.S. Coast Guard Issues
    Margaret T. Wrightson, (415) 904-2200

    Domestic
    Counterterrorism

    FBI Law Enforcement Issues Laurie E. Ekstrand, (202) 512-2758

    Money Laundering Issues
    Richard M. Stana, (202) 512-8816

    International Terrorist Financing Issues
    Loren Yager, (202) 512-4347

    Identification Counterfeiting and Fraud
    Robert J. Cramer, (202) 512-7227

    Social Security Number Fraud Issues
    Barbara D. Bovbjerg, (202) 512-5491

    Protecting Critical
    Infrastructures and Key
    Assets

    National Critical Infrastructure Protection Issues Robert F. Dacey, (202)
    512-3317

    Cybersecurity Issues
    Robert F. Dacey, (202) 512-3317

    Protecting Government Buildings
    Mark L. Goldstein, (202) 512-6670

    Federal Protective Service Issues
    Mark L. Goldstein, (202) 512-6670

    Defense Installation Protection Issues
    Janet A. St. Laurent, (202) 512-4402

    Financial Services Sector Security Issues
    Thomas J. McCool, (202) 512-8678

    Postal and Shipping Safety and Security Issues
    Katherine A. Siggerud, (202) 512-6570

    Appendix XV: GAO Contacts and Staff Acknowledgments

    Nuclear Power and Weapons Security Issues
    Robin M. Nazzaro, (202) 512-6246

    Water Utilities Security Issues
    Robin M. Nazzaro, (202) 512-6246

    Agricultural Sector Security Issues
    Larry Dykman, (202) 512-9692

    Chemical Plants Security Issues
    John B. Stephenson, (202) 512-6225

    Defending Against
    Catastrophic Threats

    Nonproliferation Issues (Department of Energy) Eugene E. Aloise, (202)
    512-6870

    Nonproliferation Issues (Department of State)
    Joseph A. Christoff, (202) 512-8979

    Sales of Potentially Harmful Excess DOD Materials
    Robert J. Cramer, (202) 512-7227

    Bioterrorism Preparedness Issues
    Janet Heinrich, (202) 512-7250

    Bioterrorism Information Technology Issues
    David A. Powner, (202) 512-9286

    Defense Role in Weapons of Mass Destruction
    Sharon L. Pickup, (202) 512-9619

    Research and Development Issues
    Eugene E. Aloise, (202) 512-6870

    Emergency Preparedness First Responder Emergency Preparedness Issues
    and Response William O. Jenkins, (202) 512-8757

    Public Health Preparedness Issues
    Janet Heinrich, (202) 512-7250

    Defense Support to Civilian Agencies
    Davi M. D'Agostino, (202) 512-5431

                  Appendix XV: GAO Contacts and Staff Acknowledgments

    Crosscutting Issues

    Staff Acknowledgments

    National Strategy Issues
    Norman J. Rabkin, (202) 512-8777

    Strategic Planning and Results Issues
    Bernice Steinhardt, (202) 512-6534

    Human Capital Management Issues
    Christopher J. Mihm, (202) 512-3236

    Budget Issues
    Paul L. Posner, (202) 512-9573

    Risk Management and Resource Allocation
    Scott R. Farrow, (202) 512-6669

    Information Technology Issues
    Randolph C. Hite, (202) 512-6256

    Acquisition Management
    Katherine V. Schinasi, (202) 512-4841

    The following persons made key contributions to this report: Stephen L.
    Caldwell, Jared A. Hermalin, Wayne A. Ekblad, and Ricardo A. Marquez. In
    addition, numerous other individuals across GAO made contributions
    regarding the challenges faced in implementing the National Strategy for
    Homeland Security.

    Related GAO Products

                                Intelligence and Warning

    Intelligence Reform: Human Capital Considerations Critical to 9/11
    Commission's Proposed Reforms. GAO-04-1084T. Washington, D.C.: September
    14, 2004.

    Information Technology: Foundational Steps Being Taken to Make Needed FBI
    Systems Modernization Management Improvements. GAO-04-842. Washington,
    D.C.: September 10, 2004.

    Homeland Security: Communication Protocols and Risk Communication
    Principles Can Assist in Refining the Advisory System. GAO-04-682.
    Washington, D.C.: June 25, 2004.

    FBI Transformation: Human Capital Strategies May Assist the FBI in Its
    Commitment to Address Its Top Priorities. GAO-04-817T. Washington, D.C.:
    June 3, 2004.

    Security Clearances: FBI Has Enhanced Its Process for State and Local Law
    Enforcement Officials. GAO-04-596. Washington, D.C.: April 30, 2004.

    FBI Transformation: FBI Continues to Make Progress in Its Efforts to
    Transform and Address Priorities. GAO-04-578T. Washington, D.C.: March 23,
    2004.

    Homeland Security: Risk Communication Principles May Assist in Refinement
    of the Homeland Security Advisory System. GAO-04-538T. Washington, D.C.:
    March 16, 2004.

    Homeland Security Advisory System: Preliminary Observations Regarding
    Threat Level Increases from Yellow to Orange. GAO-04-453R. Washington,
    D.C.: February 26, 2004.

    Drinking Water: Experts' Views on How Future Federal Funding Can Best Be
    Spent to Improve Security. GAO-04-29. Washington, D.C.: October 31, 2003.

    Homeland Security: Efforts to Improve Information Sharing Need to be
    Strengthened. GAO-03-760. Washington, D.C.: August 27, 2003.

    Post-Hearing Questions from the May 8, 2003, Hearing on Barriers to
    Information Sharing at the Department of Homeland Security. GAO-03-985R.
    Washington, D.C.: July 7, 2003.

    Related GAO Products

    Homeland Security: Information Sharing Responsibilities, Challenges, and
    Key Management Issues. GAO-03-715T. Washington, D.C.: May 8, 2003.

    Information Technology: Terrorist Watch Lists Should Be Consolidated to
    Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.:
    April 15, 2003.

    Combating Terrorism: Actions Needed to Improve Force Protection for DOD
    Deployment through Domestic Seaports. GAO-03-15. Washington, D.C.: October
    22, 2002

    Homeland Security: Information Sharing Activities Face Continued
    Management Challenges. GAO-02-1122T. Washington, D.C.: September 23, 2002.

    Border and Transportation Security

    Port Security: Planning Needed to Develop and Operate Maritime Worker
    Identification Card Program. GAO-05-106. Washington, D.C.: December 10,
    2004.

    Aviation Security: Preliminary Observations on TSA's Progress to Allow
    Airports to Use Private Passenger and Baggage Screening. GAO-05-126.
    Washington, D.C.: November 19, 2004.

    General Aviation Security: Increased Federal Oversight Is Needed, but
    Continued Partnership with the Private Sector is Critical to Long-Term
    Success. GAO-05-144. Washington, D.C.: November 10, 2004.

    Homeland Security: Management Challenges Remain in Transforming
    Immigration Programs. GAO-05-81. Washington, D.C.: October 14, 2004.

    Immigration Enforcement: DHS Has Incorporated Immigration Enforcement
    Objectives and Is Addressing Future Planning Requirements. GAO-05-66.
    Washington, D.C.: October 8, 2004.

    Maritime Security: Better Planning Needed to Help Ensure an Effective Port
    Security Assessment Program. GAO-04-1062. Washington, D.C.: September 30,
    2004.

    Transportation Security R&D: TSA and DHS Are Researching and Developing
    Technologies, but Need to Improve R&D Management. GAO-04-890. Washington,
    D.C.: September 30, 2004.

    Related GAO Products

    Social Security Numbers: Use Is Widespread and Protections Vary in Private
    and Public Sectors. GAO-04-1099T. Washington, D.C.: September 28, 2004.

    Border Security: Joint, Coordinated Actions by State and DHS Needed to
    Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington,
    D.C.: September 9, 2004.

    Border Security: State Department Rollout of Biometric Visas on Schedule,
    but Guidance Is Lagging. GAO-04-1001. Washington, D.C.: September 9, 2004.

    Maritime Security: Partnering Could Reduce Federal Costs and Facilitate
    Implementation of Automatic Vessel Identification System. GAO-04-868.
    Washington, D.C.: July 23, 2004.

    Border Security: Additional Actions Needed to Eliminate Weaknesses in the
    Visa Revocation Process. GAO-04-795. Washington, D.C.: July 13, 2004.

    Maritime Security: Substantial Work Remains to Translate New Planning
    Requirements into Effective Port Security. GAO-04-838. Washington, D.C.:
    June 30, 2004.

    Homeland Security: Performance of Information Systems to Monitor Foreign
    Students and Exchange Visitors Has Improved but Issues Remain. GAO-04-690.
    Washington, D.C.: June 18, 2004.

    Border Security: Agencies Need to Better Coordinate Their Strategies and
    Operations on Federal Lands. GAO-04-590. Washington, D.C.: June 16, 2004.

    Aviation Security: Further Steps Needed to Strengthen the Security of
    Commercial Airport Perimeters and Access Controls. GAO-04-728. Washington,
    D.C.: June 4, 2004.

    Homeland Security: First Phase of Visitor and Immigration Status Program
    Operating, but Improvements Needed. GAO-04-586. Washington, D.C.: May 11,
    2004.

    Aviation Security: Private Security Screening Contractors Have Little
    Flexibility to Implement Innovative Approaches. GAO-04-505T. Washington,
    D.C.: April 22, 2004.

    Related GAO Products

    Coast Guard: Key Management and Budget Challenges for Fiscal Year 2005 and
    Beyond. GAO-04-636T. Washington, D.C.: April 7, 2004.

    Homeland Security: Summary of Challenges Faced in Targeting Oceangoing
    Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March 31,
    2004.

    Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail
    Security, but Significant Challenges Remain. GAO-04-598T. Washington,
    D.C.: March 23, 2004.

    Border Security: Improvements Needed to Reduce Time Taken to Adjudicate
    Visas for Science Students and Scholars. GAO-04-371. Washington, D.C.:
    February 25, 2004.

    Border Security: Improvements Needed to Reduce Time Taken to Adjudicate
    Visas for Science Students and Scholars. GAO-04-443T. Washington, D.C.:
    February 25, 2004.

    Coast Guard Programs: Relationship between Resources Used and Results
    Achieved Needs to Be Clearer. GAO-04-432. Washington, D.C.: March 22,
    2004.

    Aviation Security: Computer-Assisted Passenger Prescreening System Faces
    Significant Implementation Challenges. GAO-04-385. Washington, D.C.:
    February 12, 2004.

    The Department of Homeland Security Needs to Fully Adopt a Knowledge-based
    Approach to Its Counter-MANPADS Development Program. GAO-04-341R.
    Washington, D.C.: January 30, 2004.

    Department of Homeland Security, Bureau of Customs and Border Protection:
    Required Advance Electronic Presentation of Cargo Information.
    GAO-04-319R. Washington, D.C.: December 18, 2003.

    Homeland Security: Preliminary Observations on Efforts to Target Security
    Inspections of Cargo Containers. GAO-04-325T. Washington, D.C.: December
    16, 2003.

    Posthearing Questions Related to Aviation and Port Security. GAO-04-315R.
    Washington, D.C.: December 12, 2003.

    Related GAO Products

    Aviation Security: Efforts to Measure Effectiveness and Strengthen
    Security Programs. GAO-04-285T. Washington, D.C.: November 20, 2003.

    Aviation Security: Efforts to Measure Effectiveness and Address
    Challenges. GAO-04-232T. Washington, D.C.: November 5, 2003.

    Homeland Security: Overstay Tracking Is a Key Component of a Layered
    Defense. GAO-04-170T. Washington, D.C.: October 16, 2003.

    Airport Passenger Screening: Preliminary Observations on Progress Made and
    Challenges Remaining. GAO-03-1173. Washington, D.C.: September 24, 2003.

    Homeland Security: Risks Facing Key Border and Transportation Security
    Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September 19,
    2003.

    Maritime Security: Progress Made in Implementing Maritime Transportation
    Security Act, but Concerns Remain. GAO-03-1155T. Washington, D.C.:
    September 9, 2003.

    Land Border Ports of Entry: Vulnerabilities and Inefficiencies in the
    Inspections Process. GAO-03-1084R. Washington, D.C.: August 18, 2003.

    Container Security: Expansion of Key Customs Programs Will Require Greater
    Attention to Critical Success Factors. GAO-03-770. Washington, D.C.: July
    25, 2003.

    Border Security: New Policies and Increased Interagency Coordination
    Needed to Improve Visa Process. GAO-03-1013T. Washington, D.C.: July 15,
    2003.

    Border Security: New Policies and Procedures Are Needed to Fill Gaps in
    the Visa Revocation Process. GAO-03-798. Washington, D.C.: June 18, 2003.

    Border Security: New Policies and Procedures Are Needed to Fill Gaps in
    the Visa Revocation Process. GAO-03-908T. Washington, D.C.: June 18, 2003.

    Homeland Security: Challenges Facing the Department of Homeland Security
    in Balancing Its Border Security and Trade Facilitation Missions.
    GAO-03-902T. Washington, D.C.: June 16, 2003.

    Related GAO Products

    Transportation Security: Federal Action Needed to Address Security
    Challenges. GAO-03-843. Washington, D.C.: June 30, 2003.

    Counterfeit Documents Used to Enter the United States from Certain Western
    Hemisphere Countries Not Detected. GAO-03-713T. Washington, D.C.: May 13,
    2003.

    Transportation Security Research: Coordination Needed in Selecting and
    Implementing Infrastructure Vulnerability Assessments. GAO-03-502.
    Washington, D.C.: May 1, 2003.

    Coast Guard: Challenges during the Transition to the Department of
    Homeland Security. GAO-03-594T. Washington, D.C.: April 1, 2003.

    Transportation Security: Post-September 11th Initiatives and Long-Term
    Challenges. GAO-03-616T. Washington, D.C.: April 1, 2003.

    Homeland Security: Challenges to Implementing the Immigration Interior
    Enforcement Strategy. GAO-03-660T. Washington, D.C.: April 10, 2003.

    Border Security: Challenges in Implementing Border Technology.
    GAO-03-546T. Washington, D.C.: March 12, 2003.

    Coast Guard: Comprehensive Blueprint Needed to Balance and Monitor
    Resource Use and Measure Performance for All Missions. GAO-03-544T.
    Washington, D.C.: March 12, 2003.

    Homeland Security: Challenges Facing the Coast Guard as It Transitions to
    the New Department. GAO-03-467T. Washington, D.C.: February 12, 2003.

    Weaknesses in Screening Entrants into the United States. GAO-03-438T.
    Washington, D.C.: January 30, 2003.

    Aviation Safety: Undeclared Air Shipments of Dangerous Goods and DOT's
    Enforcement Approach. GAO-03-22. Washington, D.C.: January 10, 2003.

    Mass Transit: Federal Action Could Help Transit Agencies Address Security
    Challenges. GAO-03-263. Washington, D.C.: December 13, 2002.

    Related GAO Products

    Border Security: Implications for Eliminating the Visa Waiver Program.
    GAO-03-38. Washington, D.C.: November 22, 2002.

    Homeland Security: INS Cannot Locate Many Aliens because It Lacks Reliable
    Address Information. GAO-03-188. Washington, D.C.: November 21, 2002.

    Technology Assessment: Using Biometrics for Border Security. GAO-03-174.
    Washington, D.C.: November 15, 2002.

    Coast Guard: Strategy Needed for Setting and Monitoring Levels of Effort
    for All Missions. GAO-03-155. Washington, D.C.: November 12, 2002.

    Border Security: Visa Process Should Be Strengthened as an Antiterrorism
    Tool. GAO-03-132NI. Washington, D.C.: October 21, 2002.

    Customs Service: Acquisition and Deployment of Radiation Detection
    Equipment. GAO-03-235T. Washington, D.C.: October 17, 2002.

    Mass Transit: Challenges in Securing Transit Systems. GAO-02-1075T.
    Washington, D.C.: September 18, 2002.

    Port Security: Nation Faces Formidable Challenges in Making New
    Initiatives Successful. GAO-02-993T. Washington, D.C.: August 5, 2002.

    Combating Terrorism: Preliminary Observations on Weaknesses in Force
    Protection for DOD Deployments through Domestic Seaports. GAO-02-955TNI.
    Washington, D.C.: July 23, 2002.

    Aviation Security: Vulnerabilities in, and Alternatives for, Preboard
    Screening Security Operations. GAO-01-1171T. Washington, D.C.: September
    25, 2001.

    Aviation Security: Weaknesses in Airport Security and Options for
    Assigning Screening Responsibilities. GAO-01-1165T. Washington, D.C.:
    September 21, 2001.

    Aviation Security: Terrorist Acts Demonstrate Urgent Need to Improve
    Security at the Nation's Airports. GAO-01-1162T. Washington, D.C.:
    September 20, 2001.

                                  Related GAO Products

    Aviation Security: Terrorist Acts Illustrate Severe Weaknesses in Aviation
    Security. GAO-01-1166T. Washington, D.C.: September 20, 2001.

    Domestic Counterterrorism

    FBI Transformation: Data Inconclusive on Effects of Shift to
    Counterterrorism-Related Priorities on Traditional Crime Enforcement.
    GAO-04-1036. Washington, D.C.: August 31, 2004.

    Combating Terrorism: Federal Agencies Face Continuing Challenges in
    Addressing Terrorist Financing and Money Laundering. GAO-04-501T.
    Washington, D.C.: March 4, 2004.

    Investigations of Terrorist Financing, Money Laundering, and Other
    Financial Crimes. GAO-04-464R. Washington, D.C.: February 20, 2004.

    Terrorist Financing: U.S. Agencies Should Systematically Assess
    Terrorists' Use of Alternative Financing Mechanisms. GAO-04-163.
    Washington, D.C.: November 14, 2003.

    Combating Money Laundering: Opportunities Exist to Improve the National
    Strategy. GAO-03-813. Washington, D.C.: September 26, 2003.

    FBI Reorganization: Progress Made in Efforts to Transform, but Major
    Challenges Continue. GAO-03-759T. Washington, D.C.: June 18, 2003.

    Information Technology: FBI Needs an Enterprise Architecture to Guide Its
    Modernization Activities. GAO-03-959. Washington, D.C.: September 25,
    2003.

    FBI Reorganization: Initial Steps Encouraging, but Broad Transformation
    Needed. GAO-02-865T. Washington, D.C.: June 21, 2002.

    Foreign Languages: Workforce Planning Could Help Address Staffing and
    Proficiency Shortfalls. GAO-02-514T. Washington, D.C.: March 12, 2002.

    Foreign Languages: Human Capital Approach Needed to Correct Staffing and
    Proficiency Shortfalls. GAO-02-375. Washington, D.C.: January 31, 2002.

    Homeland Security: Justice Department's Project to Interview Aliens after
    September 11, 2001. GAO-03-459. Washington, D.C.: April 11, 2003.

    Related GAO Products

    Critical Infrastructure Protection

    Homeland Security: Further Actions Needed to Coordinate Federal Agencies'
    Facility Protection Efforts and Promote Key Practices.

    GAO-05-49. Washington, D.C.: November 30, 2004.

    U.S. Postal Service: Physical Security Measures Have Increased at Some
    Core Facilities, but Security Problems Continue. GAO-05-48. Washington,
    D.C.: November 16, 2004.

    Financial Market Preparedness: Improvements Made, but More Action Needed
    to Prepare for Wide-Scale Disasters. GAO-04-984. Washington, D.C.:
    September 27, 2004.

    Drinking Water: Experts' Views on How Federal Funding Can Best Be Spent to
    Improve Security. GAO-04-1098T. Washington, D.C.: September 30, 2004.

    Nuclear Regulatory Commission: Preliminary Observations on Efforts to
    Improve Security at Nuclear Power Plants. GAO-04-1064T. Washington, D.C.:
    September 14, 2004.

    U.S. Postal Service: Better Guidance Is Needed to Ensure an Appropriate
    Response to Anthrax Contamination. GAO-04-239. Washington, D.C.: September
    9, 2004.

    Combating Terrorism: DOD Efforts to Improve Installation Preparedness Can
    Be Enhanced with Clarified Responsibilities and Comprehensive Planning.
    GAO-04-855. Washington, D.C.: August 9, 2004.

    Public Key Infrastructure: Examples of Risk and Internal Control
    Objectives Associated with Certification Authorities. GAO-04-1023R.
    Washington, D.C.: August 10, 2004.

    Homeland Security: Transformation Strategy Needed to Address Challenges
    Facing the Federal Protective Service. GAO-04-537. Washington, D.C.: July
    14, 2004.

    Information Security: Agencies Need to Implement Consistent Processes in
    Authorizing Systems for Operation. GAO-04-376. Washington, D.C.: June 28,
    2004.

    Critical Infrastructure Protection: Improving Information Sharing with
    Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.

    Related GAO Products

    National Nuclear Security Administration: Key Management Structure and
    Workforce Planning Issues Remain as NNSA Conducts Downsizing. GAO-04-545.
    Washington, D.C.: June 25, 2004.

    Nuclear Security: Several Issues Could Impede Ability of DOE's Office of
    Energy, Science, and Environment to Meet the May 2003 Design Basis Threat.
    GAO-04-894T. Washington, D.C.: June 22, 2004.

    Information Security: Information System Controls at the Federal Deposit
    Insurance Corporation. GAO-04-630. Washington, D.C.: May 28, 2004.

    Posthearing Questions Related to Fragmentation and Overlap in the Federal
    Food Safety System. GAO-04-832R. Washington, D.C.: May 26, 2004.

    Terrorism Insurance: Effects of Terrorism Risk Insurance Act of 2002.
    GAO-04-720T. Washington, D.C.: April 28, 2004.

    Nuclear Security: DOE Needs to Resolve Significant Issues before It Fully
    Meets the New Design Basis Threat. GAO-04-623. Washington, D.C.: April 27,
    2004.

    Terrorism Insurance: Implementation of the Terrorism Risk Insurance Act of
    2002. GAO-04-307. Washington, D.C.: April 23, 2004.

    Critical Infrastructure Protection: Establishing Effective Information
    Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.: April
    21, 2004.

    Homeland Security: Federal Action Needed to Address Security Challenges at
    Chemical Facilities. GAO-04-482T. Washington, D.C.: February 23, 2004.

    Posthearing Questions from the September 17, 2003, Hearing on
    "Implications of Power Blackouts for the Nation's Cybersecurity and
    Critical Infrastructure Protection: The Electric Grid, Critical
    Interdependencies, Vulnerabilities, and Readiness". GAO-04-300R.
    Washington, D.C.: December 8, 2003.

    Security: Counterfeit Identification Raises Homeland Security Concerns.
    GAO-04-133T. Washington, D.C.: October 1, 2003.

    Related GAO Products

    Nuclear Regulatory Commission: Oversight of Security at Commercial Nuclear
    Power Plants Needs to Be Strengthened. GAO-03-752. Washington, D.C.:
    September 4, 2003.

    Nuclear Security: DOE Faces Security Challenges in the Post September 11,
    2001, Environment. GAO-03-896TNI. Washington, D.C.: June 24, 2003.

    Nuclear Security: NNSA Needs to Better Manage Its Safeguards and Security
    Program. GAO-03-471. Washington, D.C.: May 30, 2003.

    Homeland Security: EPA's Management of Clean Air Act Chemical Facility
    Data. GAO-03-509R. Washington, D.C.: March 14, 2003.

    Homeland Security: Voluntary Initiatives Are Under Way at Chemical
    Facilities, but the Extent of Security Preparedness Is Unknown. GAO-03439.
    Washington, D.C.: March 14, 2003.

    Potential Terrorist Attacks: Additional Actions Needed to Better Prepare
    Critical Financial Market Participants. GAO-03-414. Washington, D.C.:
    February 12, 2003.

    Potential Terrorist Attacks: More Actions Needed to Better Prepare
    Critical Financial Markets. GAO-03-468T. Washington, D.C.: February 12,
    2003.

    Potential Terrorist Attacks: Additional Actions Needed to Better Prepare
    Critical Financial Market Participants. GAO-03-251. Washington, D.C.:
    February 12, 2003.

    High-Risk Series: Protecting Information Systems Supporting the Federal
    Government and the Nation's Critical Infrastructures. GAO-03-121.
    Washington, D.C.: January 1, 2003.

    Information Security: Progress Made, but Challenges Remain to Protect
    Federal Systems and the Nation's Critical Infrastructures. GAO-03-564T.
    Washington, D.C.: April 8, 2003.

    Critical Infrastructure Protection: Significant Homeland Security
    Challenges Need to Be Addressed. GAO-02-918T. Washington, D.C.: July 9,
    2002.

    Combating Terrorism: Actions Needed to Guide Services' Antiterrorism
    Efforts at Installations. GAO-03-14. Washington, D.C.: November 1, 2002.

    Related GAO Products

    Homeland Security: Department of Justice's Response to Its Congressional
    Mandate to Assess and Report on Chemical Industry Vulnerabilities.
    GAO-03-24R. Washington, D.C.: October 10, 2002.

    Building Security: Interagency Security Committee Has Had Limited Success
    in Fulfilling Its Responsibilities. GAO-02-1004. Washington, D.C.:
    September 17, 2002.

    Chemical Safety: Emergency Response Community Views on the Adequacy of
    Federally Required Chemical Information. GAO-02-799. Washington, D.C.:
    July 31, 2002.

    Information Security: Corps of Engineers Making Improvements, but
    Weaknesses Continue. GAO-02-589. Washington, D.C.: June 10, 2002.

    Security Breaches at Federal Buildings in Atlanta, Georgia. GAO-02668T.
    Washington, D.C.: April 30, 2002.

    National Preparedness: Technologies to Secure Federal Buildings.
    GAO-02-687T. Washington, D.C.: April 25, 2002.

    Diffuse Security Threats: Technologies for Mail Sanitation Exist, but
    Challenges Remain. GAO-02-365. Washington, D.C.: April 23, 2002.

    Terrorism Insurance: Rising Uninsured Exposure to Attacks Heightens
    Potential Economic Vulnerabilities. GAO-02-472T. Washington, D.C.:
    February 27, 2002.

    Critical Infrastructure Protection: Significant Challenges in Safeguarding
    Government and Privately Controlled Systems from Computer-Based Attacks.
    GAO-01-1168T. Washington, D.C.: September 26, 2001.

    Combating Terrorism: Actions Needed to Improve DOD Antiterrorism Program
    Implementation and Management. GAO-01-909. Washington, D.C.: September 19,
    2001.

    Critical Infrastructure Protection: Significant Challenges in Protecting
    Federal Systems and Developing Analysis and Warning Capabilities.
    GAO-01-1132T. Washington, D.C.: September 12, 2001.

                                  Related GAO Products

    Defending against Catastrophic Threats

    Nuclear Nonproliferation: DOE Needs to Consider Options to Accelerate the
    Return of Weapons-Usable Uranium from Other Countries to the United States
    and Russia. GAO-05-57. Washington, D.C.: November 19, 2004.

    Nuclear Nonproliferation: DOE Needs to Take Action to Further Reduce the
    Use of Weapons-Usable Uranium in Civilian Nuclear Reactors. GAO-04-807.
    Washington, D.C.: July 30, 2004.

    Department of State: Nonproliferation, Anti-terrorism, Demining, and
    Related Programs Follow Legal Authority, but Some Activities Need
    Reassessment. GAO-04-521. Washington, D.C.: April 30, 2004.

    Nonproliferation: Improvements Needed for Controls on Exports of Cruise
    Missile and Unmanned Aerial Vehicle Technology. GAO-04-493T. Washington,
    D.C.: March 9, 2004.

    Missile Defense: Actions Being Taken to Address Testing Recommendations,
    but Updated Assessment Needed. GAO-04-254. Washington, D.C.: February 26,
    2004.

    Weapons of Mass Destruction: Defense Threat Reduction Agency Addresses
    Broad Range of Threats, but Performance Reporting Can Be Improved.
    GAO-04-330. Washington, D.C.: February 13, 2004.

    Nonproliferation: Strategy Needed to Strengthen Multilateral Export
    Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002.

    Chemical and Biological Defense: DOD Should Clarify Expectations for
    Medical Readiness. GAO-02-219T. Washington, D.C.: November 7, 2001.

    Chemical and Biological Defense: DOD Needs to Clarify Expectations in
    Medical Readiness. GAO-02-38. Washington, D.C.: October 19, 2001.

    Combating Terrorism: Considerations for Investing Resources in Chemical
    and Biological Preparedness. GAO-02-162T. Washington, D.C.: October 17,
    2001.

    Bioterrorism: Review of Public Health Preparedness Programs. GAO-02-149T.
    Washington, D.C.: October 10, 2001.

    Bioterrorism: Public Health and Medical Preparedness. GAO-02-141T.
    Washington, D.C.: October 9, 2001.

    Related GAO Products

    Bioterrorism: Coordination and Preparedness. GAO-02-129T. Washington,
    D.C.: October 5, 2001.

    Bioterrorism: Federal Research and Preparedness Activities. GAO-01-915.
    Washington, D.C.: September 28, 2001.

    Emergency Preparedness and Response

    Effective Regional Coordination Can Enhance Emergency Preparedness.
    GAO-04-1009. Washington, D.C.: September 15, 2004.

    Infectious Disease Preparedness: Federal Challenges in Responding to
    Influenza Outbreaks. GAO-04-1100T. Washington, D.C.: September 28, 2004.

    Homeland Security: Federal Leadership Needed to Facilitate Interoperable
    Communications between First Responders. GAO-04-1057T. Washington, D.C.:
    September 8, 2004.

    September 11: Health Effects in the Aftermath of the World Trade Center
    Attack. GAO-04-1068T. Washington, D.C.: September 8, 2004.

    HHS's Efforts to Promote Health Information Technology and Legal Barriers
    to Its Adoption. GAO-04-991R. Washington, D.C.: August 13, 2004.

    Health Care: National Strategy Needed to Accelerate the Implementation of
    Information Technology. GAO-04-947T. Washington, D.C.: July 14, 2004.

    Homeland Security: Coordinated Planning and Standards Needed to Better
    Manage First Responder Grants in the National Capital Region. GAO-04-904T.
    Washington, D.C.: June 24, 2004.

    Homeland Security: Management of First Responder Grants in the National
    Capital Region Reflects the Need for Coordinated Planning and Performance
    Goals. GAO-04-433. Washington, D.C.: May 28, 2004.

    Homeland Security: DHS Needs a Strategy to Use DOE's Laboratories for
    Research on Nuclear, Biological, and Chemical Detection and Response
    Technologies. GAO-04-653. Washington, D.C.: May 24, 2004.

    Emergency Preparedness: Federal Funds for First Responders. GAO-04-788T.
    Washington, D.C.: May 13, 2004.

    Related GAO Products

    National Emergency Grants: Labor Is Instituting Changes to Improve Award
    Process, but Further Actions Are Required to Expedite Grant Awards and
    Improve Data. GAO-04-496. Washington, D.C.: April 16, 2004.

    Project SAFECOM: Key Cross-Agency Emergency Communications Effort Requires
    Stronger Collaboration. GAO-04-494. Washington, D.C.: April 16, 2004.

    Public Health Preparedness: Response Capacity Improving, but Much Remains
    to Be Accomplished. GAO-04-458T. Washington, D.C.: February 12, 2004.

    HHS Bioterrorism Preparedness Programs: States Reported Progress but Fell
    Short of Program Goals for 2002. GAO-04-360R. Washington, D.C.: February
    10, 2004.

    Smallpox Vaccination: Review of the Implementation of the Military
    Program. GAO-04-215R. Washington, D.C.: December 1, 2003.

    Homeland Security: Challenges in Achieving Interoperable Communications
    for First Responders. GAO-04-231T. Washington, D.C.: November 6, 2003.

    September 11: Overview of Federal Disaster Assistance to the New York City
    Area. GAO-04-72. Washington, D.C.: October 31, 2003.

    U.S. Postal Service: Clear Communication with Employees Needed before
    Reopening the Brentwood Facility. GAO-04-205T. Washington, D.C.: October
    23, 2003.

    Bioterrorism: Public Health Response to Anthrax Incidents of 2001.
    GAO-04-152. Washington, D.C.: October 15, 2003.

    Infectious Diseases: Gaps Remain in Surveillance Capabilities of State and
    Local Agencies. GAO-03-1176T. Washington, D.C.: September 24, 2003.

    Homeland Security: Reforming Federal Grants to Better Meet Outstanding
    Needs. GAO-03-1146T. Washington, D.C.: September 3, 2003.

    Hospital Preparedness: Most Urban Hospitals Have Emergency Plans but Lack
    Certain Capacities for Bioterrorism Response. GAO-03-924. Washington,
    D.C.: August 6, 2003.

    Related GAO Products

    Severe Acute Respiratory Syndrome: Established Infectious Disease Control
    Measures Helped Contain Spread, but a Large-Scale Resurgence May Pose
    Challenges. GAO-03-1058T. Washington, D.C.: July 30, 2003.

    Homeland Defense: DOD Needs to Assess the Structure of U.S. Forces for
    Domestic Military Missions. GAO-03-670. Washington, D.C.: July 11, 2003.

    U.S. Postal Service: Issues Associated with Anthrax Testing at the
    Wallingford Facility. GAO-03-787T. Washington, D.C.: May 19, 2003.

    SARS Outbreak: Improvements to Public Health Capacity Are Needed for
    Responding to Bioterrorism and Emerging Infectious Diseases. GAO-03-769T.
    Washington, D.C.: May 7, 2003.

    Smallpox Vaccination: Implementation of National Program Faces Challenges.
    GAO-03-578. Washington, D.C.: April 30, 2003.

    Homeland Defense: Preliminary Observations on How Overseas and Domestic
    Missions Impact DOD Forces. GAO-03-677T. Washington, D.C.: April 29, 2003.

    Infectious Disease Outbreaks: Bioterrorism Preparedness Efforts Have
    Improved Public Health Response Capacity, but Gaps Remain. GAO-03-654T.
    Washington, D.C.: April 9, 2003.

    Bioterrorism: Preparedness Varied across State and Local Jurisdictions.
    GAO-03-373. Washington, D.C.: April 7, 2003.

    Homeland Security: CDC's Oversight of the Select Agent Program.
    GAO-03-315R. Washington, D.C.: November 22, 2002.

    Homeland Security: New Department Could Improve Coordination, but
    Transferring Control of Certain Public Health Programs Raises Concerns.
    GAO-02-954T. Washington, D.C.: July 16, 2002.

    Homeland Security: New Department Could Improve Biomedical R&D
    Coordination but May Disrupt Dual-Purpose Efforts. GAO-02-924T.
    Washington, D.C.: July 9, 2002.

    Homeland Security: New Department Could Improve Coordination but May
    Complicate Public Health Priority Setting. GAO-02-883T. Washington, D.C.:
    June 25, 2002.

    Related GAO Products

    Combating Terrorism: Intergovernmental Cooperation in the Development of a
    National Strategy to Enhance State and Local Preparedness. GAO-02-550T.
    Washington, D.C.: April 2, 2002.

    Combating Terrorism: Enhancing Partnerships through a National
    Preparedness Strategy. GAO-02-549T. Washington, D.C.: March 28, 2002.

    Combating Terrorism: Critical Components of a National Strategy to Enhance
    State and Local Preparedness. GAO-02-548T. Washington, D.C.: March 25,
    2002.

    Combating Terrorism: Intergovernmental Partnership in a National Strategy
    to Enhance State and Local Preparedness. GAO-02-547T. Washington, D.C.:
    March 22, 2002.

    Combating Terrorism: Key Aspects of a National Strategy to Enhance State
    and Local Preparedness. GAO-02-473T. Washington, D.C.: March 1, 2002.

    Bioterrorism: The Centers for Disease Control and Prevention's Role in
    Public Health Protection. GAO-02-235T. Washington, D.C.: November 15,
    2001.

    Homeland Security: A Risk Management Approach Can Guide Preparedness
    Efforts. GAO-02-208T. Washington, D.C.: October 31, 2001.

    Anthrax Vaccine: Changes to the Manufacturing Process. GAO-02-181T.
    Washington, D.C.: October 23, 2001.

    Homeland Security: Need to Consider VA's Role in Strengthening Federal
    Preparedness. GAO-02-145T. Washington, D.C.: October 15, 2001.

    Crosscutting Issues	Homeland Security: Further Action Needed to Promote
    Successful Use of Special DHS Acquisition Authority. GAO-05-136.
    Washington, D.C.: December 15, 2004.

    Information Technology: Major Federal Networks That Support Homeland
    Security Functions. GAO-04-375. Washington, D.C.: September 17, 2004.

    Homeland Security: Observations on the National Strategies Related to
    Terrorism. GAO-04-1075T. Washington, D.C.: September 22, 2004

    Related GAO Products

    Homeland Security: Efforts Under Way to Develop Enterprise Architecture,
    but Much Work Remains. GAO-04-777. Washington, D.C.: August 6, 2004.

    Department of Homeland Security: Formidable Information and Technology
    Management Challenge Requires Institutional Approach. GAO-04-702.
    Washington, D.C.: August 27, 2004.

    9/11 Commission Report: Reorganization, Transformation, and Information
    Sharing. GAO-04-1033T. Washington, D.C.: August 3, 2004.

    Human Capital: Building on the Current Momentum to Transform the Federal
    Government. GAO-04-976T. Washington, D.C.: July 20, 2004.

    Financial Management: Department of Homeland Security Faces Significant
    Financial Management Challenges. GAO-04-774. Washington, D.C.: July 19,
    2004.

    Status of Key Recommendations GAO Has Made to DHS and Its Legacy Agencies.
    GAO-04-865R. Washington, D.C.: July 2, 2004.

    Department of Homeland Security: Financial Management Challenges.
    GAO-04-945T. Washington, D.C.: July 8, 2004.

    The Chief Operating Officer Concept and Its Potential Use as a Strategy to
    Improve Management at the Department of Homeland Security. GAO-04-876R.
    Washington, D.C.: June 28, 2004.

    Human Capital: DHS Faces Challenges in Implementing Its New Personnel
    System. GAO-04-790. Washington, D.C.: June 18, 2004.

    Information Technology: Homeland Security Should Better Balance Need for
    System Integration Strategy with Spending for New and Enhanced Systems.
    GAO-04-509. Washington, D.C.: May 21, 2004.

    Additional Posthearing Questions Related to the Proposed Department of
    Homeland Security Human Capital Regulations. GAO-04-617R. Washington,
    D.C.: April 30, 2004.

    Transfer of Budgetary Resources to the Department of Homeland Security.
    GAO-04-329R. Washington, D.C.: April 30, 2004.

    Related GAO Products

    Reserve Forces: Observations on Recent National Guard Use in Overseas and
    Homeland Missions and Future Challenges. GAO-04-670T. Washington, D.C.:
    April 29, 2004.

    Human Capital: Opportunities to Improve Federal Continuity Planning
    Guidance. GAO-04-384. Washington, D.C.: April 20, 2004.

    Combating Terrorism: Evaluation of Selected Characteristics in National
    Strategies Related to Terrorism. GAO-04-408T. Washington, D.C.: February
    3, 2004.

    Homeland Security: Information Sharing Responsibilities, Challenges, and
    Key Management Issues. GAO-03-1165T. Washington, D.C.: September 17, 2003.

    Department of Homeland Security: Challenges and Steps in Establishing
    Sound Financial Management. GAO-03-1134T. Washington, D.C.: September 10,
    2003.

    Combating Terrorism: Observations on National Strategies Related to
    Terrorism. GAO-03-519T. Washington, D.C.: March 3, 2003.

    Major Management Challenges and Program Risks: A Governmentwide
    Perspective. GAO-03-95. Washington, D.C.: January 1, 2003.

    Major Management Challenges and Program Risks: Department of Homeland
    Security. GAO-03-102. Washington, D.C.: January 1, 2003.

    Major Management Challenges and Program Risks: Department of Justice.
    GAO-03-105. Washington, D.C.: January 1, 2003.

    Major Management Challenges and Program Risks: Federal Emergency
    Management Agency. GAO-03-113. Washington, D.C.: January 1, 2003.

    Combating Terrorism: Funding Data Reported to Congress Should Be Improved.
    GAO-03-170. Washington, D.C.: November 26, 2002.

    Highlights of a GAO Forum on Mergers and Transformation: Lessons Learned
    for a Department of Homeland Security and Other Federal Agencies.
    GAO-03-293SP. Washington, D.C.: November 14, 2002.

    Homeland Security: Management Challenges Facing Federal Leadership.
    GAO-03-260. Washington, D.C.: December 20, 2002.

    Related GAO Products

    Homeland Security: Effective Intergovernmental Coordination Is Key to
    Success. GAO-02-1013T. Washington, D.C.: August 23, 2002.

    Homeland Security: Effective Intergovernmental Coordination Is Key to
    Success. GAO-02-1012T. Washington, D.C.: August 22, 2002.

    Homeland Security: Effective Intergovernmental Coordination Is Key to
    Success. GAO-02-1011T. Washington, D.C.: August 20, 2002.

    Homeland Security: Critical Design and Implementation Issues. GAO-02-957T.
    Washington, D.C.: July 17, 2002.

    Homeland Security: Title III of the Homeland Security Act of 2002.
    GAO-02-927T. Washington, D.C.: July 9, 2002.

    Homeland Security: Intergovernmental Coordination and Partnership Will Be
    Critical to Success. GAO-02-901T. Washington, D.C.: July 3, 2002.

    Homeland Security: Intergovernmental Coordination and Partnership Will Be
    Critical to Success. GAO-02-900T. Washington, D.C.: July 2, 2002.

    Homeland Security: Intergovernmental Coordination and Partnership Will Be
    Critical to Success. GAO-02-899T. Washington, D.C.: July 1, 2002.

    Homeland Security: New Department Could Improve Coordination but May
    Complicate Priority Setting. GAO-02-893T. Washington, D.C.: June 28, 2002.

    Homeland Security: Proposal for Cabinet Agency Has Merit, but
    Implementation Will be Pivotal to Success. GAO-02-886T. Washington, D.C.:
    June 25, 2002.

    Homeland Security: Key Elements to Unify Efforts Are Underway, but
    Uncertainty Remains. GAO-02-610. Washington, D.C.: June 7, 2002.

    National Preparedness: Integrating New and Existing Technology and
    Information Sharing into an Effective Homeland Security Strategy.
    GAO-02-811T. Washington, D.C.: June 7, 2002.

    Homeland Security: Responsibility and Accountability for Achieving
    National Goals. GAO-02-627T. Washington, D.C.: April 11, 2002.

    Related GAO Products

    National Preparedness: Integration of Federal, State, Local, and Private
    Sector Efforts Is Critical to an Effective National Strategy for Homeland
    Security. GAO-02-621T. Washington, D.C.: April 11, 2002.

    Homeland Security: Progress Made; More Direction and Partnership Sought.
    GAO-02-490T. Washington, D.C.: March 12, 2002.

    Homeland Security: Challenges and Strategies in Addressing Short-and
    Long-Term National Needs. GAO-02-160T. Washington, D.C.: November 7, 2001.

    Homeland Security: Key Elements of a Risk Management Approach.
    GAO-02-150T. Washington, D.C.: October 12, 2001.

    Homeland Security: A Framework for Addressing the Nation's Efforts.
    GAO-01-1158T. Washington, D.C.: September 21, 2001.

    Combating Terrorism: Selected Challenges and Related Recommendations.
    GAO-01-822. Washington, D.C.: September 20, 2001.

    GAO's Mission

    Obtaining Copies of GAO Reports and Testimony

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting its
    constitutional responsibilities and to help improve the performance and
    accountability of the federal government for the American people. GAO
    examines the use of public funds; evaluates federal programs and policies;
    and provides analyses, recommendations, and other assistance to help
    Congress make informed oversight, policy, and funding decisions. GAO's
    commitment to good government is reflected in its core values of
    accountability, integrity, and reliability.

    The fastest and easiest way to obtain copies of GAO documents at no cost
    is through GAO's Web site (www.gao.gov). Each weekday, GAO posts newly
    released reports, testimony, and correspondence on its Web site. To have
    GAO e-mail you a list of newly posted products every afternoon, go to
    www.gao.gov and select "Subscribe to Updates."

    Order by Mail or Phone 	The first copy of each printed report is free.
    Additional copies are $2 each. A check or money order should be made out
    to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
    Orders for 100 or more copies mailed to a single address are discounted 25
    percent. Orders should be sent to:

    U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
    D.C. 20548

    To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
    512-6061

    To Report Fraud, Contact:

    Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

    E-mail: fraudnet@gao.govFederal Programs Automated answering system: (800)
    424-5454 or (202) 512-7470

    Gloria Jarmon, Managing Director, JarmonG@gao.gov (202)
    512-4400Congressional U.S. Government Accountability Office, 441 G Street
    NW, Room 7125 Relations Washington, D.C. 20548

    Public Affairs 	Susan Becker, Acting Manager, BeckerS@gao.gov (202)
    512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
    Washington, D.C. 20548

                                     RECYCLED PAPER
    *** End of document. ***