    Department of Homeland Security: Progress Report on
    Implementation of Mission and Management Functions
    (17-AUG-07, GAO-07-454).

    The Department of Homeland Security's (DHS) recent 4 year
    anniversary provides an opportunity to reflect on the progress
    DHS has made since its establishment. DHS began operations
    in March 2003 with the mission to prevent terrorist attacks
    within the United States, reduce vulnerabilities, minimize
    damages from attacks, and aid in recovery efforts. GAO has
    reported that the creation of DHS was an enormous management
    challenge and that the size, complexity, and importance of
    the effort made the challenge especially daunting and critical
    to the nation's security. Our prior work on mergers and
    acquisitions found that successful transformations of large
    organizations, even those faced with less strenuous
    reorganizations than DHS, can take at least 5 to 7 years to
    achieve. GAO was asked to report on DHS's progress in
    implementing its mission and management areas and challenges DHS
    faces. This report also discusses key themes that have affected
    DHS's implementation efforts.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-07-454
        ACCNO:   A75749
      TITLE:     Department of Homeland Security: Progress Report on
    Implementation of Mission and Management Functions
         DATE:   08/17/2007
      SUBJECT:   Agency missions
                 Federal agency reorganization
                 GAO High Risk Series
                 Homeland security
                 Information management
                 Interagency relations
                 Internal controls
                 Performance measures
                 Program evaluation
                 Program management
                 Risk management
                 Strategic information systems planning
                 Strategic planning

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-07-454

    This text file was formatted by the U.S. Government Accountability
    Office (GAO) to be accessible to users with visual impairments, as part
    of a longer term project to improve GAO products' accessibility. Every
    attempt has been made to maintain the structural and data integrity of
    the original printed product. Accessibility features, such as text
    descriptions of tables, consecutively numbered footnotes placed at the
    end of the file, and the text of agency comment letters, are provided
    but may not exactly duplicate the presentation or format of the printed
    version. The portable document format (PDF) file is an exact electronic
    replica of the printed version. We welcome your feedback. Please E-mail
    your comments regarding the contents or accessibility features of this
    document to Webmaster@gao.gov.

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed
    in its entirety without further permission from GAO. Because this work
    may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this
    material separately.

    Report to Congressional Requesters:
    United States Government Accountability Office:
    GAO:

    August 2007:

    Department Of Homeland Security:
    Progress Report on Implementation of Mission and Management Functions:
    Homeland Security Progress Report:

    GAO-07-454:

    GAO Highlights:

    Highlights of GAO-07-454, a report to congressional requesters.

    Why GAO Did This Study:

    The Department of Homeland Security�s (DHS) recent 4 year anniversary
    provides an opportunity to reflect on the progress DHS has made since
    its establishment. DHS began operations in March 2003 with the mission
    to prevent terrorist attacks within the United States, reduce
    vulnerabilities, minimize damages from attacks, and aid in recovery
    efforts. GAO has reported that the creation of DHS was an enormous
    management challenge and that the size, complexity, and importance of
    the effort made the challenge especially daunting and critical to the
    nation�s security. Our prior work on mergers and acquisitions
    found that successful transformations of large organizations, even
    those faced with less strenuous reorganizations than DHS, can take at
    least 5 to 7 years to achieve. GAO was asked to report on DHS�s
    progress in implementing its mission and management areas and
    challenges DHS faces. This report also discusses key themes that have
    affected DHS�s implementation efforts.

    How GAO Did This Study:

    To assess DHS�s progress, GAO identified performance expectations for
    each mission and management area based on legislation, homeland
    security presidential directives, DHS and component agencies� strategic
    plans, and other sources.

    GAO analyzed these documents to identify responsibilities for DHS and
    obtained and incorporated feedback from DHS officials on the
    performance expectations. On the basis of GAO�s and the DHS Office of
    Inspector General�s (IG) prior work and updated information provided by
    DHS, GAO determined the extent to which DHS has taken actions to
    generally achieve each performance expectation. An assessment of
    generally achieved indicates that DHS has taken actions to satisfy most
    elements of the expectation, and an assessment of generally not
    achieved indicates that DHS has not yet taken actions to satisfy most
    elements of the expectation. An assessment of generally not achieved
    may be warranted even where DHS has put forth substantial effort to
    satisfy some but not most elements of an expectation. In cases when we
    or the DHS IG have not completed work upon which to base an assessment
    or the information DHS provided did not enable us to clearly determine
    the extent to which DHS has achieved the performance expectation, we
    indicated no assessment made. Our assessment of DHS�s progress relative
    to each performance expectation is not meant to imply that DHS should
    have fully achieved the performance expectation by the end of its
    fourth year. On the basis of this analysis, GAO determined whether DHS
    has made limited, modest, moderate, or substantial progress in each
    mission and management area. The assessments of progress do not
    reflect, nor are they intended to reflect, the extent to which DHS�s
    actions have made the nation more secure in each area.

    What GAO Found:

    At the time of its creation in 2003 as one of the largest federal
    reorganizations in the last several decades, we designated the
    implementation and transformation of DHS as a high-risk area due to the
    magnitude of the challenges it confronted in areas vital to the
    physical and economic well being of the nation. After 4 years into its
    overall integration effort, DHS has attained some level of progress in
    all of its mission and management areas. The rate of progress, however,
    among these areas varies, as shown in the table below.

    Summary of Assessments of DHS�s Progress in Mission and Management
    Areas:

    Mission/management area: Border security;
    Number of performance expectations: 12;
    Number of expectations generally achieved: 5;
    Number of expectations generally not achieved: 7;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Modest.

    Mission/management area: Immigration enforcement;
    Number of performance expectations: 16;
    Number of expectations generally achieved: 8;
    Number of expectations generally not achieved: 4;
    Number of expectations not assessed: 4;
    Overall assessment of progress: Moderate.

    Mission/management area: Immigration services;
    Number of performance expectations: 14;
    Number of expectations generally achieved: 5;
    Number of expectations generally not achieved: 9;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Modest.

    Mission/management area: Aviation security;
    Number of performance expectations: 24;
    Number of expectations generally achieved: 17;
    Number of expectations generally not achieved: 7;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Moderate.

    Mission/management area: Surface transportation security;
    Number of performance expectations: 5;
    Number of expectations generally achieved: 3;
    Number of expectations generally not achieved: 2;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Moderate.

    Mission/management area: Maritime security;
    Number of performance expectations: 23;
    Number of expectations generally achieved: 17;
    Number of expectations generally not achieved: 4;
    Number of expectations not assessed: 2;
    Overall assessment of progress: Substantial.

    Mission/management area: Emergency preparedness and response;
    Number of performance expectations: 24;
    Number of expectations generally achieved: 5;
    Number of expectations generally not achieved: 18;
    Number of expectations not assessed: 1;
    Overall assessment of progress: Limited.

    Mission/management area: Critical infrastructure protection;
    Number of performance expectations: 7;
    Number of expectations generally achieved: 4;
    Number of expectations generally not achieved: 3;
    Number of expectations not assessed: 9;
    Overall assessment of progress: Moderate.

    Mission/management area: Science and technology;
    Number of performance expectations: 6;
    Number of expectations generally achieved: 1;
    Number of expectations generally not achieved: 5;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Limited.

    Mission/management area: Acquisition management;
    Number of performance expectations: 3;
    Number of expectations generally achieved: 1;
    Number of expectations generally not achieved: 2;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Modest.

    Mission/management area: Financial management;
    Number of performance expectations: 7;
    Number of expectations generally achieved: 2;
    Number of expectations generally not achieved: 5;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Modest.

    Mission/management area: Human capital management;
    Number of performance expectations: 8;
    Number of expectations generally achieved: 2;
    Number of expectations generally not achieved: 6;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Limited.

    Mission/management area: Information technology management;
    Number of performance expectations: 13;
    Number of expectations generally achieved: 2;
    Number of expectations generally not achieved: 8;
    Number of expectations not assessed: 3;
    Overall assessment of progress: Limited.

    Mission/management area: Real property management;
    Number of performance expectations: 9;
    Number of expectations generally achieved: 6;
    Number of expectations generally not achieved: 3;
    Number of expectations not assessed: 0;
    Overall assessment of progress: Moderate.

    Mission/management area: Total;
    Number of performance expectations: 171;
    Number of expectations generally achieved: 78;
    Number of expectations generally not achieved: 83;
    Number of expectations not assessed: 10;
    Overall assessment of progress:

    Source: GAO analysis.

    Definitions:

    Substantial progress: DHS has taken actions to generally achieve more
    than 75 percent of the identified performance expectations.
    Moderate progress: DHS has taken actions to generally achieve more than
    50 percent but 75 percent or less of the identified performance
    expectations.

    Modest progress: DHS has taken actions to generally achieve more than
    25 percent but 50 percent or less of the identified performance
    expectations.

    Limited progress: DHS has taken actions to generally achieve 25 percent
    or less of the identified performance expectations.

    What GAO Recommends:

    While this report contains no new recommendations, in past products,
    GAO has made approximately 700 recommendations to DHS designed to
    strengthen departmental operations. DHS has implemented some of these
    recommendations, has taken actions to address others, and has taken
    other steps to strengthen its mission and management activities.
    In its comments on a draft of this report, DHS took issues with our
    methodology and disagreed with our assessments for 42 of 171
    performance expectations. DHS�s five general concerns were with (1)
    perceived alteration of standards used to judge progress; (2) our
    binary approach to assess the performance expectations; (3) perceived
    changes in criteria after DHS provided additional information; (4)
    consistent application of our methodology; and (5) differences in the
    priority of performance expectations. We believe that we have fully
    disclosed and consistently applied our methodology and that it provides
    a sound basis for this progress report.

    Contents:

    Letter:

    Scope and Methodology:

    Results in Brief:

    Background:

    DHS Has Made Varying Levels of Progress in Implementing its Core
    Mission and Management Functions, but Has Faced Difficulties in Its
    Implementation Efforts:

    Cross-cutting Issues Have Hindered DHS's Implementation Efforts:

    Concluding Observations:

    Agency Comments and Our Evaluation:

    Appendix I: Key GAO Contacts for DHS Mission and Management Areas:

    Appendix II: Comments from the Department of Homeland Security:

    Appendix III: GAO Contact and Staff Acknowledgments:

    Related GAO Products:

    Tables:

    Table 1: Summary of Our Assessments for DHS's Border Security
    Performance Expectations:

    Table 2: Summary of Our Assessments for DHS's Immigration Enforcement
    Performance Expectations:

    Table 3: Summary of Our Assessments for DHS's Immigration Services
    Performance Expectations:

    Table 4: Summary of Our Assessments for DHS's Aviation Security
    Performance Expectations:

    Table 5: Summary of Our Assessments for DHS's Surface Transportation
    Security Performance Expectations:

    Table 6: Summary of Our Assessments for DHS's Maritime Security
    Performance Expectations:

    Table 7: Summary of Our Assessments for DHS's Emergency Preparedness
    and Response Performance Expectations:

    Table 8: Summary of Our Assessments for DHS's Critical Infrastructure
    and Key Resources Protection Performance Expectations:

    Table 9: Summary of Our Assessments for DHS's Science and Technology
    Performance Expectations:

    Table 10: Summary of Our Assessments for DHS's Acquisition Management
    Performance Expectations:

    Table 11: Summary of Our Assessments for DHS's Financial Management
    Performance Expectations:

    Table 12: Summary of Our Assessments for DHS's Human Capital Management
    Performance Expectations:

    Table 13: Summary of Our Assessments for DHS's Information Technology
    Management Performance Expectations:

    Table 14: Summary of Our Assessments for DHS's Real Property Management
    Performance Expectations:

    Table 15: DHS Budget Authority for Fiscal Years 2004 through 2007 in
    Thousands of Dollars, as Reported by DHS as of January 2007:

    Table 16: Performance Expectations and Progress Made in Border
    Security:

    Table 17: Performance Expectations and Assessment of DHS Progress in
    Border Security:

    Table 18: Performance Expectations and Progress Made in Immigration
    Enforcement:

    Table 19: Performance Expectations and Assessment of DHS Progress in
    Immigration Enforcement:

    Table 20: Performance Expectations and Progress Made in Immigration
    Services:

    Table 21: Performance Expectations and Assessment of DHS Progress in
    Immigration Services:

    Table 22: Performance Expectations and Progress Made in Aviation
    Security:

    Table 23: Performance Expectations and Assessment of DHS Progress in
    Aviation Security:

    Table 24: Performance Expectations and Progress Made in Surface
    Transportation Security:

    Table 25: Performance Expectations and Assessment of DHS Progress in
    Surface Transportation Security:

    Table 26: Performance Expectations and Progress Made in Maritime
    Security:

    Table 27: Performance Expectations and Assessment of DHS Progress in
    Maritime Security:

    Table 28: Performance Expectations and Progress Made in Emergency
    Preparedness and Response:

    Table 29: Performance Expectations and Assessment of DHS Progress in
    Emergency Preparedness and Response:

    Table 30: Performance Expectations and Progress Made in Critical
    Infrastructure and Key Resources Protection:

    Table 31: Performance Expectations and Assessment of DHS Progress in
    Critical Infrastructure and Key Resources Protection:

    Table 32: Performance Expectations and Progress Made in Science and
    Technology:

    Table 33: Performance Expectations and Assessment of DHS Progress in
    Science and Technology:

    Table 34: Performance Expectations and Progress Made in Acquisition
    Management:

    Table 35: Performance Expectations and Assessment of DHS Progress in
    Acquisition Management:

    Table 36: Performance Expectations and Progress Made in Financial
    Management:

    Table 37: Performance Expectations and Assessment of DHS Progress in
    Financial Management:

    Table 38: Performance Expectations and Progress Made in Human Capital
    Management:

    Table 39: Performance Expectations and Assessment of DHS Progress in
    Human Capital Management:

    Table 40: Performance Expectations and Progress Made in Information
    Technology Management:

    Table 41: Performance Expectations and Assessment of DHS Progress in
    Information Technology Management:

    Table 42: Performance Expectations and Progress Made in Real Property
    Management:

    Table 43: Performance Expectations and Assessment of DHS Progress in
    Real Property Management:

    Figures:

    Figure 1: Example of Performance Expectations for Border Security:

    Figure 2: Selected Key Events That Have Affected Department of Homeland
    Security Implementation:

    Abbreviations:

    CBP: U.S. Customs and Border Protection:
    DHS: Department of Homeland Security:
    DNDO: Domestic Nuclear Detection Office:
    EDS: explosive detection system:
    ETD: explosive trace detection:
    FEMA: Federal Emergency Management Agency:
    GPRA: Government Performance and Results Act:
    ICE: U.S. Immigration and Customs Enforcement:
    IG: Inspector General:
    INS: U.S. Immigration and Naturalization Service:
    OMB: Office of Management and Budget:
    SBI: Secure Border Initiative:
    TSA: Transportation Security Administration:
    USCIS: U.S. Citizenship and Immigration Services:
    US-VISIT: United States Visitor and Immigrant Status Indicator
    Technology:

    United States Government Accountability Office:
    Washington, DC 20548:

    August 17, 2007:

    The Honorable Joseph I. Lieberman:
    Chairman:
    The Honorable Susan M. Collins:
    Ranking Member:
    Committee on Homeland Security and Governmental Affairs:
    United States Senate:

    The Honorable Bennie G. Thompson:
    Chairman:
    Committee on Homeland Security:
    House of Representatives:

    The Department of Homeland Security (DHS) recently passed its 4 year
    anniversary, and this anniversary provides an opportunity to reflect on
    the progress it has made since its establishment, determine challenges
    the department has faced in implementing its mission and management
    areas, and identify issues that will be important for the department to
    address as it moves forward. Pursuant to the Homeland Security Act of
    2002, DHS began operations in March 2003 with missions that include
    preventing terrorist attacks from occurring within the United States,
    reducing U.S. vulnerability to terrorism, minimizing the damages from
    attacks that occur, and helping the nation recover from any attacks.
    Over the past 4 years, the department has initiated and continued the
    implementation of various policies and programs to address these
    missions as well as its nonhomeland security functions.[Footnote 1] In
    particular, DHS has implemented programs to secure the border and
    administer the immigration system; strengthen the security of the
    transportation sector; and defend against, prepare for, and respond to
    threats and disasters. DHS has also taken actions to integrate its
    management functions and to transform its component agencies into an
    effective cabinet department.

    We have evaluated many of DHS's programs and management functions since
    the department's establishment. We have issued over 400 products on
    major departmental programs in the areas of border security and
    immigration; transportation security; defense against, preparedness
    for, and response to threats and disasters; and the department's
    management functions--including acquisition, financial, human capital,
    information technology, and real property management. In November 2006,
    we provided congressional leadership with a list of government
    programs, functions, and activities that warrant further congressional
    oversight. Among the issues included were border security and
    immigration enforcement, security of transportation modes,
    preparedness and response for catastrophic threats, and DHS
    implementation and transformation.[Footnote 2] We have also reported on
    broad themes that have underpinned DHS's implementation efforts,
    including agency transformation, strategic planning and results
    management, risk management, information sharing, and partnerships and
    coordination. We have made about 700 recommendations to DHS on ways to
    improve its operations and address these key themes, such as to develop
    performance measures and set milestones for key programs, allocate
    resources based on assessments of risk, and develop and implement
    internal controls to help ensure program effectiveness. DHS has
    implemented some of these recommendations, taken actions to address
    others, and taken other steps to strengthen its mission activities and
    facilitate management integration. However, we have reported that the
    department still has much to do to ensure that it conducts its missions
    efficiently and effectively while simultaneously preparing to address
    future challenges that face the department and the nation.

    In 2003, we designated the implementation and transformation of DHS as
    high-risk because it represented an enormous undertaking that would
    require time to achieve in an effective and efficient manner.[Footnote
    3] Additionally, the components merged into DHS already faced a wide
    array of existing challenges, and any DHS failure to effectively carry
    out its mission could expose the nation to potentially serious
    consequences. The area has remained on our high-risk list since
    2003.[Footnote 4] Most recently, in our January 2007 high-risk update,
    we reported that although the department had made some progress
    transforming its 22 agencies into an effective, integrated
    organization, DHS had not yet developed a comprehensive management
    integration strategy and its management systems and functions--
    especially related to acquisition, financial, human capital, and
    information management--were not yet fully integrated and wholly
    operational. We also noted that DHS faces a number of challenges to
    effectively carry out its program activities and enhance partnerships
    with private and public sector entities to leverage resources. We
    concluded that this array of management and programmatic challenges
    continues to limit DHS's ability to fulfill its homeland security roles
    in an effective, risk-based way. Furthermore, in 2005 we designated
    information sharing for homeland security as high-risk,[Footnote 5] and
    in 2006 we identified the National Flood Insurance Program as high-
    risk.[Footnote 6] In 2003 we expanded the scope of the high-risk area
    involving federal information security, which was initially designated
    as high-risk in 1997, to include the protection of the nation's
    computer-reliant critical infrastructure. We identified information
    sharing for homeland security as high-risk because of the lack of
    strategic plans; established processes, procedures, and mechanisms; and
    incentives for sharing information. We identified the National Flood
    Insurance Program as high-risk because it was highly unlikely that the
    program would generate sufficient revenues to repay funds borrowed from
    the Treasury to cover claims during catastrophic loss years and because
    of concerns related to the program's financial resources, compliance
    with mandatory purchase requirements, and the costly impact of
    repetitive loss properties. We expanded the scope of the federal
    information security high-risk area to include the protection of the
    nation's computer-reliant critical infrastructure because, as the focal
    point of federal efforts, DHS had not yet completely fulfilled any of
    its key responsibilities for enhancing cyber security.

    In designating the implementation and transformation of DHS as high-
    risk, we noted that the creation of DHS was an enormous management
    challenge.[Footnote 7] The size, complexity, and importance of the
    effort made the challenge especially daunting and incomparably critical
    to the nation's security. We noted that building an effective
    department would require consistent and sustained leadership from top
    management to ensure the needed transformation of disparate agencies,
    programs, and missions into an integrated organization. Our prior work
    on mergers and acquisitions, undertaken before the creation of DHS,
    found that successful transformations of large organizations, even
    those faced with less strenuous reorganizations than DHS, can take 5 to
    7 years to achieve. We reported that in successful transformations,
    organizations undergo a change of their cultures to become more
    results-oriented, client-and customer-oriented, and collaborative in
    nature. To successfully transform, an organization must fundamentally
    reexamine its processes, organizational structures, and management
    approaches. Organizational changes such as these are complex and cannot
    be accomplished overnight. In the case of DHS, it will likely take at
    least several more years for the department to complete its
    transformation efforts. We also have recommended that Congress continue
    to monitor whether it needs to provide additional leadership
    authorities to the DHS Under Secretary for Management or create a Chief
    Operating Officer/Chief Management Officer position that could help
    elevate, integrate, and institutionalize DHS's management initiatives.
    The Implementing Recommendations of the 9/11 Commission Act of 2007,
    enacted in August 2007, designates the Under Secretary for Management
    as the Chief Management Officer and principal advisor on management-
    related matters to the Secretary.[Footnote 8] Under the Act, the Under
    Secretary is responsible for developing a transition and succession
    plan for the incoming Secretary and Under Secretary to guide the
    transition of management functions to a new administration. The Act
    further authorizes the incumbent Under Secretary as of November 8, 2008
    (after the next presidential election), to remain in the position until
    a successor is confirmed to ensure continuity in the management
    functions of DHS.

    You asked us to review our past work on DHS and provide an assessment
    of DHS's progress and challenges during its first 4 years. This report
    addresses the following questions: (1) What progress has DHS made in
    implementing key mission and core management functions since its
    inception, and what challenges has the department faced in its
    implementation efforts? (2) What key themes have affected DHS's
    implementation of its mission and management functions?[Footnote 9]

    DHS's major mission and management areas include border security;
    immigration enforcement; immigration services; aviation security;
    surface transportation security; maritime security; emergency
    preparedness and response; critical infrastructure and key resources
    protection; science and technology; and acquisition, financial, human
    capital, information technology, and real property management. This
    report also identifies the key cross-cutting themes that have affected
    the department's efforts to implement its mission and management areas.
    These key themes include agency transformation, strategic planning and
    results management, risk management, information sharing, and
    partnerships and coordination.

    Scope and Methodology:

    This report is based primarily on work that we and the DHS Office of
    Inspector General (IG) have completed since the establishment of DHS in
    March 2003 and updated information and documentation provided by the
    department in March 2007 through July 2007. To determine the progress
    DHS has made in implementing various mission and management areas, we
    first identified key areas. To identify these mission and management
    areas, we analyzed the critical mission areas for homeland security
    identified in legislation, the National Strategy for Homeland Security,
    the goals and objectives set forth in the DHS Strategic Plan and
    homeland security presidential directives, and areas identified in our
    reports along with studies conducted by the DHS IG and other
    organizations and groups, such as the National Commission on Terrorist
    Attacks upon the United States (9-11 Commission) and the Century
    Foundation. We analyzed these documents to identify common mission and
    management areas and discussed the areas we identified with our subject
    matter experts[Footnote 10] and DHS officials.[Footnote 11] The mission
    and management areas we identified are:

    1. Border security:

    2. Immigration enforcement:

    3. Immigration services:

    4. Aviation security:

    5. Surface transportation security:

    6. Maritime security:

    7. Emergency preparedness and response:

    8. Critical infrastructure and key resources protection:

    9. Science and technology:

    10. Acquisition management:

    11. Financial management:

    12. Human capital management:

    13. Information technology management:

    14. Real property management:

    To determine the level of progress made by DHS in each mission and
    management area, we identified performance expectations for each area.
    We define performance expectations as a composite of the
    responsibilities or functions--derived from legislation, homeland
    security presidential directives and executive orders, DHS planning
    documents, and other sources--that the department is to achieve or
    satisfy in implementing efforts in its mission and management areas.
    The performance expectations are not intended to represent performance
    goals or measures for the department.[Footnote 12] Figure 1 provides an
    example of performance expectations for the border security mission
    area:

    Figure 1: Example of Performance Expectations for Border Security:

    DHS Mission and Management Areas:

    1. Border security: Performance Expectations: Implement a biometric
    entry system to prevent unauthorized border crossers from entering the
    United States through ports of entry; Implement a biometric exit system
    to collect information on border crossers leaving the United States
    through ports of entry; Develop a program to detect and identify
    illegal border crossings between ports of entry; Implement a program to
    detect and identify illegal illegal border crossings between ports of
    entry.
    2. Immigration enforcement:
    3. Immigration services:
    4. Aviation security:
    5. Surface transportation security:
    6. Maritime security:
    7. Emergency preparedness and response:
    8. Critical infrastructure and key resources protection:
    9. Science and technology:
    10. Acquisition management:
    11. Financial management:
    12. Human capital management:
    13. Information technology management:
    14. Real property management:

    [See PDF for image]

    [End of figure]

    We primarily focused the performance expectations on DHS's homeland
    security-related functions. We generally did not identify performance
    expectations related to DHS's nonhomeland security functions, although
    we did identify some performance expectations that relate to these
    functions. We also did not apply a weight to the performance
    expectations we developed for DHS, although qualitative differences
    between the expectations exist. We recognize that these expectations
    are not time bound, and DHS will take actions to satisfy these
    expectations over a sustained period of time. Therefore, our assessment
    of DHS's progress relative to each performance expectation refers to
    the progress made by the department during its first 4 years. Our
    assessment of DHS's progress relative to each performance expectation
    is not meant to imply that DHS should have fully achieved the
    performance expectation by the end of its fourth year.

    To identify the performance expectations, we examined responsibilities
    set for the department by Congress, the Administration, and department
    leadership. In doing so, we reviewed homeland security-related
    legislation, such as the Intelligence Reform and Terrorism Prevention
    Act of 2004,[Footnote 13] the Homeland Security Act of 2002,[Footnote
    14] the Maritime Transportation Security Act of 2002,[Footnote 15] the
    Enhanced Border Security and Visa Entry Reform Act of 2002,[Footnote
    16] and the Aviation and Transportation Security Act.[Footnote 17] We
    also reviewed DHS appropriations acts and accompanying conference
    reports for fiscal years 2004 through 2006. We did not consider
    legislation enacted since September 2006 in developing the performance
    expectations. To identify goals and measures set by the Administration,
    we reviewed relevant homeland security presidential directives and
    executive orders. For the goals and measures set by the department, we
    analyzed the DHS Strategic Plan, Performance Budget Overviews,
    Performance and Accountability Reports, and component agencies'
    strategic plans. For management areas, we also examined effective
    practices identified in our prior reports.[Footnote 18] We analyzed
    these documents to identify common or similar responsibilities for DHS
    mission and management areas and synthesized the responsibilities
    identified in the various documents to develop performance expectations
    for DHS. We obtained and incorporated feedback from our subject matter
    experts on these performance expectations. We also provided the
    performance expectations to DHS for review and incorporated DHS's
    feedback.

    Based primarily on our prior work and DHS IG work, as well as updated
    information provided by DHS between March and June 2007, we examined
    the extent to which DHS has taken actions to achieve the identified
    performance expectations in each area and make a determination as to
    whether DHS has achieved the key elements of each performance
    expectation based on the criteria listed below:

    * Generally achieved: Our work has shown that DHS has taken actions to
    satisfy most of the key elements of the performance expectation but may
    not have satisfied all of the elements.

    * Generally not achieved: Our work has shown that DHS has not yet taken
    actions to satisfy most of the key elements of the performance
    expectation but may have taken steps to satisfy some of the elements.

    * No assessment made: Neither we nor the DHS IG have completed work
    and/or the information DHS provided did not enable us to clearly assess
    DHS's progress in achieving the performance expectation. Therefore, we
    have no basis for making an assessment of the extent to which DHS has
    taken actions to satisfy the performance expectation.[Footnote 19]

    An assessment of "generally achieved" indicates that DHS has taken
    sufficient actions to satisfy most elements of the expectation;
    however, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken actions
    to satisfy most elements of the performance expectation. An assessment
    of "generally not achieved" may be warranted even where DHS has put
    forth substantial effort to satisfy some but not most elements of an
    expectation. In cases when we or the DHS IG have not completed work
    upon which to base an assessment of DHS actions to satisfy a
    performance expectation and/or the information DHS provided did not
    enable us to clearly determine the extent to which DHS has achieved the
    performance expectation, we indicated "no assessment made." We analyzed
    the extent of our work, the DHS IG's work, and DHS's updated
    information and conferred with our subject matter experts to determine
    whether the work and information were sufficient for a making a
    determination of generally achieved or generally not achieved.

    Between March and June 2007, we obtained updated information from DHS
    and met with program officials to discuss DHS's efforts to implement
    actions to achieve the performance expectations in each mission and
    management area. We incorporated DHS's additional information and
    documentation into the report and, to the extent that DHS provided
    documentation verifying its efforts, considered them in making our
    assessments of DHS's progress.

    For each performance expectation, an analyst on our staff reviewed our
    relevant work, DHS IG reports, and updated information and
    documentation provided by DHS, including information received during
    meetings with DHS officials. On the basis of this review, the analyst
    made a determination that either DHS generally achieved the performance
    expectation or generally did not achieve the performance expectation,
    or the analyst identified that no determination could be made because
    neither we nor the DHS IG had completed work and DHS did not provide us
    with updated information and documentation. A second analyst then
    reviewed each determination to reach concurrence on the assessment for
    each performance expectation by reviewing the first analyst's summary
    of our reports, relevant DHS IG reports, and DHS's updated information
    and documentation. In cases when the first and second analyst
    disagreed, the two analysts reviewed and discussed the assessments and
    relevant documents to reach concurrence. Then, our subject matter
    experts reviewed the summary of our reports, relevant DHS IG reports,
    and DHS's updated information and documentation to reach concurrence on
    the assessment for each performance expectation.

    To develop criteria for assessing DHS's progress in each mission and
    management area, we analyzed criteria used for ratings or assessments
    in our prior work, in DHS IG reports, and in other reports and studies,
    such as those conducted by the 9-11 Commission and the Century
    Foundation. We also reviewed our past work in each mission and
    management area and obtained feedback from our subject matter experts
    and DHS officials on these criteria. Based on this analysis, we
    developed the following criteria for assessing DHS's progress in each
    mission and management area:

    * Substantial progress: DHS has taken actions to generally achieve more
    than 75 percent of the identified performance expectations.

    * Moderate progress: DHS has taken actions to generally achieve more
    than 50 percent but 75 percent or less of the identified performance
    expectations.

    * Modest progress: DHS has taken actions to generally achieve more than
    25 percent but 50 percent or less of the identified performance
    expectations.

    * Limited progress: DHS has taken actions to generally achieve 25
    percent or less of the identified performance expectations.

    After making a determination as to whether DHS has generally achieved
    or generally not achieved the identified performance expectations, we
    added up the number of performance expectations that we determined DHS
    has generally achieved. We divided this number by the total number of
    performance expectations for each mission and management area,
    excluding those performance expectations for which we could not make an
    assessment. Based on the resulting percentage, we identified DHS's
    overall progress in each mission and management area, as (1)
    substantial progress, (2) moderate progress, (3) modest progress, or
    (4) limited progress. Our subject matter experts reviewed the overall
    assessments of progress we identified for DHS in each mission and
    management area.

    Our assessments of the progress made by DHS in each mission and
    management area are based on the performance expectations we
    identified. The assessments of progress do not reflect, nor are they
    intended to reflect, the extent to which DHS's actions have made the
    nation more secure in each area. For example, in determining that DHS
    has made modest progress in border security, we are not stating or
    implying that the border is modestly more secure than it was prior to
    the creation of DHS. In addition, we are not assessing DHS's progress
    against a baseline in each mission and management area. We also did not
    consider DHS component agencies' funding levels or the extent to which
    funding levels have affected the department's ability to carry out its
    missions. We also did not consider the extent to which competing
    priorities and resource demands have affected DHS's progress in each
    mission and management area relative to other areas, although competing
    priorities and resource demands have clearly affected DHS's progress in
    specific areas.

    In addition, because we and the DHS IG have completed varying degrees
    of work (in terms of the amount and scope of reviews completed) for
    each mission and management area, and because different DHS components
    and offices provided us with different amounts and types of
    information, our assessments of DHS's progress in each mission and
    management area reflect the information available for our review and
    analysis and are not necessarily equally comprehensive across all 14
    mission and management areas. For example, as a result of the post-
    September 11, 2001, focus on aviation, we have conducted more reviews
    of aviation security, and our methodology identified a much larger
    number of related performance expectations than for the department's
    progress in surface transportation security. Further, for some
    performance expectations, we were unable to make an assessment of DHS's
    progress because (1) we had not conducted work in that area, (2) the
    DHS IG's work in the area was also limited, and (3) the supplemental
    information provided by DHS was insufficient to form a basis for our
    analysis. Most notably, we were unable to make an assessment for four
    performance expectations in the area of immigration enforcement. This
    affected our overall assessment of DHS's progress in that area as there
    were fewer performance expectations to tally in determining the overall
    level of progress.

    We conducted our work for this report from September 2006 through July
    2007 in accordance with generally accepted government auditing
    standards.

    Results in Brief:

    At the time of its creation in 2003 as one of the largest federal
    reorganizations in the last several decades, we designated the
    implementation and transformation of DHS as a high-risk area due to the
    magnitude of the challenges it confronted in areas vital to the
    physical and economic well being of the nation. After 4 years into its
    overall integration effort, DHS has attained some level of progress in
    all of its major mission and management areas. The rate of progress,
    however, among these areas varies.

    * DHS's border security mission includes detecting and preventing
    terrorists and terrorist weapons from entering the United States;
    facilitating the orderly and efficient flow of legitimate trade and
    travel; interdicting illegal drugs and other contraband; apprehending
    individuals who are attempting to enter the United States illegally;
    inspecting inbound and outbound people, vehicles, and cargo; and
    enforcing pertinent laws of the United States at the border. As shown
    in table 1, we identified 12 performance expectations for DHS in the
    area of border security and found that DHS has generally achieved 5 of
    them and has generally not achieved 7 others.

    Table 1: Summary of Our Assessments for DHS's Border Security
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 5.

    Performance expectation: Implement a biometric entry system to prevent
    unauthorized border crossers from entering the United States through
    ports of entry;
    Performance expectation: Develop a program to detect and identify
    illegal border crossings between ports of entry;
    Performance expectation: Develop a strategy to detect and interdict
    illegal flows of cargo, drugs, and other items into the United States;
    Performance expectation: Provide adequate training for all border
    related employees;
    Performance expectation: Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's border
    security mission.

    Performance expectation: Generally not achieved; Total: 7.

    Performance expectation: Implement a biometric exit system to collect
    information on border crossers leaving the United States through ports
    of entry;
    Performance expectation: Implement a program to detect and identify
    illegal border crossings between ports of entry;
    Performance expectation: Implement a strategy to detect and interdict
    illegal flows of cargo, drugs and other items into the United States;
    Performance expectation: Implement effective security measures in the
    visa issuance process;
    Performance expectation: Implement initiatives related to the security
    of certain documents used to enter the United States;
    Performance expectation: Ensure adequate infrastructure and facilities;
    Performance expectation: Leverage technology, personnel, and
    information to secure the border.

    Overall assessment of progress: Modest.

    Source: GAO analysis.

    [End of table]

    * DHS's immigration enforcement mission includes apprehending,
    detaining, and removing criminal and illegal aliens; disrupting and
    dismantling organized smuggling of humans and contraband as well as
    human trafficking; investigating and prosecuting those who engage in
    benefit and document fraud; blocking and removing employers' access to
    undocumented workers; and enforcing compliance with programs to monitor
    visitors. As shown in table 2, we identified 16 performance
    expectations for DHS in the area of immigration enforcement and found
    that DHS has generally achieved 8 of them and has generally not
    achieved 4 others. For 4 performance expectations, we could not make an
    assessment.

    Table 2: Summary of Our Assessments for DHS's Immigration Enforcement
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 8.

    Performance expectation: Develop a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States;
    Performance expectation: Assess and prioritize the use of alien
    detention resources to prevent the release of aliens subject to
    removal;
    Performance expectation: Develop a program to allow for the secure
    alternative detention of noncriminal aliens;
    Performance expectation: Develop a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed;
    Performance expectation: Develop a comprehensive strategy to interdict
    and prevent trafficking and smuggling of aliens into the United States;
    Performance expectation: Develop a law enforcement strategy to combat
    criminal alien gangs in the United States and cross-border criminal
    activity;
    Performance expectation: Develop a program to screen and respond to
    local law enforcement and community complaints about aliens who many be
    subject to removal;
    Performance expectation: Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's immigration
    enforcement mission.

    Performance expectation: Generally not achieved; Total: 4.

    Performance expectation: Implement a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States;
    Performance expectation: Ensure the removal of criminal aliens;
    Performance expectation: Implement a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed;
    Performance expectation: Implement a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States.

    Performance expectation: No assessment made; Total: 4.

    Performance expectation: Implement a program to allow for the secure
    alternative detention of noncriminal aliens;
    Performance expectation: Implement a law enforcement strategy to combat
    criminal alien gangs in the United States and cross-border criminal
    activity;
    Performance expectation: Disrupt and dismantle mechanisms for money
    laundering and financial crimes;
    Performance expectation: Provide training, including foreign language
    training, and equipment for all immigration enforcement personnel to
    fulfill the agency's mission.

    Overall assessment of progress: Moderate.

    Source: GAO analysis.

    [End of table]

    * DHS's immigration services mission includes administering immigration
    benefits and working to reduce immigration benefit fraud. As shown in
    table 3, we identified 14 performance expectations for DHS in the area
    of immigration services and found that DHS has generally achieved 5 of
    them and has generally not achieved 9 others.

    Table 3: Summary of Our Assessments for DHS's Immigration Services
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 5.

    Performance expectation: Institute process and staffing reforms to
    improve application processes;
    Performance expectation: Establish online access to status information
    about benefit applications;
    Performance expectation: Establish revised immigration application
    fees based on a comprehensive fee study;
    Performance expectation: Communicate immigration-related information
    to other relevant agencies;
    Performance expectation: Create an office to reduce immigration benefit
    fraud.

    Performance expectation: Generally not achieved; Total: 9.

    Performance expectation: Eliminate the benefit application backlog and
    reduce application completion times to 6 months;
    Performance expectation: Establish a timetable for reviewing the
    program rules, business processes, and procedures for immigration
    benefit applications;
    Performance expectation: Institute a case management system to manage
    applications and provide management information;
    Performance expectation: Develop new programs to prevent future
    backlogs from developing;
    Performance expectation: Establish online filing for benefit
    applications;
    Performance expectation: Capture biometric information on all benefits
    applicants;
    Performance expectation: Implement an automated background check system
    to track and store all requests for applications;
    Performance expectation: Establish training programs to reduce fraud in
    the benefits process;
    Performance expectation: Implement a fraud assessment program to reduce
    benefit fraud.

    Overall assessment of progress; Total: Modest.

    Source: GAO analysis.

    [End of table]

    * DHS's aviation security mission includes strengthening airport
    security; providing and training a screening workforce; prescreening
    passengers against terrorist watch lists; and screening passengers,
    baggage, and cargo. As shown in table 4, we identified 24 performance
    expectations for DHS in the area of aviation security and found that
    DHS has generally achieved 17 of them and has generally not achieved 7
    others.

    Table 4: Summary of Our Assessments for DHS's Aviation Security
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 17.

    Performance expectation: Implement a strategic approach for aviation
    security functions;
    Performance expectation: Ensure the screening of airport employees
    against terrorist watch lists;
    Performance expectation: Hire and deploy a federal screening workforce;
    Performance expectation: Develop standards for determining aviation
    security staffing at airports;
    Performance expectation: Establish standards for training and testing
    the performance of airport screener staff;
    Performance expectation: Establish a program and requirements to allow
    eligible airports to use a private screening workforce;
    Performance expectation: Train and deploy federal air marshals on high-
    risk flights;
    Performance expectation: Establish standards for training flight and
    cabin crews;
    Performance expectation: Establish a program to allow authorized flight
    deck officers to use firearms to defend against any terrorist or
    criminal acts;
    Performance expectation: Establish policies and procedures to ensure
    that individuals known to pose, or suspected of posing, a risk or
    threat to security are identified and subjected to appropriate action;
    Performance expectation: Develop and implement processes and procedures
    for physically screening passengers at airport checkpoints;
    Performance expectation: Develop and test checkpoint technologies to
    address vulnerabilities;
    Performance expectation: Deploy explosive detection systems (EDS) and
    explosive trace detection (ETD) systems to screen checked baggage for
    explosives;
    Performance expectation: Develop a plan to deploy in-line baggage
    screening equipment at airports;
    Performance expectation: Pursue the deployment and use of in-line
    baggage screening equipment at airports;
    Performance expectation: Develop a plan for air cargo security;
    Performance expectation: Develop and implement procedures to screen air
    cargo.

    Performance expectation: Generally not achieved; Total: 7.

    Performance expectation: Establish standards and procedures for
    effective airport perimeter security;
    Performance expectation: Establish standards and procedures to
    effectively control access to airport secured areas;
    Performance expectation: Establish procedures for implementing
    biometric identifier systems for airport secured areas access control;
    Performance expectation: Develop and implement an advanced prescreening
    system to allow DHS to compare domestic passenger information to the
    Selectee List and No Fly List;
    Performance expectation: Develop and implement an international
    passenger prescreening process to compare passenger information to
    terrorist watch lists before aircraft departure;
    Performance expectation: Deploy checkpoint technologies to address
    vulnerabilities;
    Performance expectation: Develop and implement technologies to screen
    air cargo.

    Overall assessment of progress: Moderate.

    Source: GAO analysis.

    [End of table]

    * DHS's surface transportation security mission includes establishing
    security standards and conducting assessments and inspections of
    surface transportation modes, which include passenger and freight rail;
    mass transit; highways, including commercial vehicles; and pipelines.
    As shown in table 5, we identified 5 performance expectations for DHS
    in the area of surface transportation security and found that DHS has
    generally achieved 3 of them and has generally not achieved 2.

    Table 5: Summary of Our Assessments for DHS's Surface Transportation
    Security Performance Expectations:

    Performance expectation: Generally achieved; Total: 3.

    Performance expectation: Develop and adopt a strategic approach for
    implementing surface transportation security functions;
    Performance expectation: Conduct threat, criticality, and
    vulnerability assessments of surface transportation assets;
    Performance expectation: Administer grant programs for surface
    transportation security.

    Performance expectation: Generally not achieved; Total: 2.

    Performance expectation: Issue standards for securing surface
    transportation modes;
    Performance expectation: Conduct compliance inspections for surface
    transportation systems.

    Overall assessment of progress: Moderate.

    Source: GAO analysis.

    [End of table]

    * DHS's maritime security responsibilities include port and vessel
    security, maritime intelligence, and maritime supply chain security. As
    shown in table 6, we identified 23 performance expectations for DHS in
    the area of maritime security and found that DHS has generally achieved
    17 of them and has generally not achieved 4 others. For 2 performance
    expectations, we could not make an assessment.

    Table 6: Summary of Our Assessments for DHS's Maritime Security
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 17.

    Performance expectation: Develop national plans for maritime security;
    Performance expectation: Develop national plans for maritime response;
    Performance expectation: Develop national plans for maritime recovery;
    Performance expectation: Develop regional (port-specific) plans for
    security;
    Performance expectation: Develop regional (port-specific) plans for
    response;
    Performance expectation: Ensure port facilities have completed
    vulnerability assessments and developed security plans;
    Performance expectation: Ensure that vessels have completed
    vulnerability assessments and developed security plans;
    Performance expectation: Exercise security, response, and recovery
    plans with key maritime stakeholders to enhance security, response, and
    recovery efforts;
    Performance expectation: Implement a port security grant program to
    help facilities improve their security capabilities;
    Performance expectation: Establish operational centers to monitor
    threats and fuse intelligence and operations at the regional/port
    level;
    Performance expectation: Collect information on incoming ships to
    assess risks and threats;
    Performance expectation: Develop a vessel-tracking system to improve
    intelligence and maritime domain awareness on vessels in U.S. waters;
    Performance expectation: Collect information on arriving cargo for
    screening purposes;
    Performance expectation: Develop a system for screening and inspecting
    cargo for illegal contraband;
    Performance expectation: Develop a program to work with foreign
    governments to inspect suspicious cargo before it leaves for U.S.
    ports;
    Performance expectation: Develop a program to work with the private
    sector to improve and validate supply chain security;
    Performance expectation: Develop an international port security program
    to assess security at foreign ports.

    Performance expectation: Generally not achieved; Total: 4.

    Performance expectation: Develop regional (port-specific) plans for
    recovery;
    Performance expectation: Implement a national facility access control
    system for port secured areas;
    Performance expectation: Develop a long-range vessel-tracking system to
    improve maritime domain awareness;
    Performance expectation: Develop a program to screen incoming cargo for
    radiation.

    Performance expectation: No assessment made; Total: 2.

    Performance expectation: Develop a national plan to establish and
    improve maritime; intelligence;
    Performance expectation: Develop standards for cargo containers to
    ensure their physical security.

    Overall assessment of progress: Substantial.

    Source: GAO analysis.

    [End of table]

    * DHS's emergency preparedness and response mission includes preparing
    to minimize the damage and recover from terrorist attacks and
    disasters; helping to plan, equip, train, and practice needed skills of
    first responders; and consolidating federal response plans and
    activities to build a national, coordinated system for incident
    management. As shown in table 7, we identified 24 performance
    expectations for DHS in the area of emergency preparedness and response
    and found that DHS has generally achieved 5 of them and has generally
    not achieved 18 others. For 1 performance expectation, we could not
    make an assessment.

    Table 7: Summary of Our Assessments for DHS's Emergency Preparedness
    and Response Performance Expectations:

    Performance expectation: Generally achieved; Total: 5.

    Performance expectation: Establish a program for conducting emergency
    preparedness exercises;
    Performance expectation: Develop a national incident management system;
    Performance expectation: Provide grant funding to first responders in
    developing and implementing interoperable communications capabilities;
    Performance expectation: Administer a program for providing grants and
    assistance to state and local governments and first responders;
    Performance expectation: Allocate grants based on assessment factors
    that account for population, critical infrastructure, and other risk
    factors.

    Performance expectation: Generally not achieved; Total: 18.

    Performance expectation: Establish a comprehensive training program for
    national preparedness;
    Performance expectation: Conduct and support risk assessments and risk
    management capabilities for emergency preparedness;
    Performance expectation: Ensure the capacity and readiness of disaster
    response teams;
    Performance expectation: Coordinate implementation of a national
    incident management system;
    Performance expectation: Establish a single, all-hazards national
    response plan;
    Performance expectation: Coordinate implementation of a single, all-
    hazards response plan;
    Performance expectation: Develop a complete inventory of federal
    response capabilities;
    Performance expectation: Develop a national, all-hazards preparedness
    goal;
    Performance expectation: Develop plans and capabilities to strengthen
    nationwide recovery efforts;
    Performance expectation: Develop the capacity to provide needed
    emergency assistance and services in a timely manner;
    Performance expectation: Provide timely assistance and services to
    individuals and communities in response to emergency events;
    Performance expectation: Implement a program to improve interoperable
    communications among federal, state, and local agencies;
    Performance expectation: Implement procedures and capabilities for
    effective interoperable communications;
    Performance expectation: Increase the development and adoption of
    interoperability communications standards;
    Performance expectation: Develop performance goals and measures to
    assess progress in developing interoperability;
    Performance expectation: Provide guidance and technical assistance to
    first responders in developing and implementing interoperable
    communications capabilities;
    Performance expectation: Provide assistance to state and local
    governments to develop all-hazards plans and capabilities;
    Performance expectation: Develop a system for collecting and
    disseminating lessons learned and best practices to emergency
    responders.

    Performance expectation: No assessment made; Total: 1.

    Performance expectation: Support citizen participation in national
    preparedness efforts.

    Overall assessment of progress: Limited.

    Source: GAO analysis.

    [End of table]

    * DHS's critical infrastructure and key resources protection activities
    include developing and coordinating implementation of a comprehensive
    national plan for critical infrastructure protection, developing
    partnerships with stakeholders and information sharing and warning
    capabilities, and identifying and reducing threats and vulnerabilities.
    As shown in table 8, we identified 7 performance expectations for DHS
    in the area of critical infrastructure and key resources protection and
    found that DHS has generally achieved 4 of them and has generally not
    achieved 3 others.

    Table 8: Summary of Our Assessments for DHS's Critical Infrastructure
    and Key Resources Protection Performance Expectations:

    Performance expectation: Generally achieved; Total: 4.

    Performance expectation: Develop a comprehensive national plan for
    critical infrastructure protection;
    Performance expectation: Develop partnerships and coordinate with other
    federal agencies, state and local, governments, and the private sector;
    Performance expectation: Identify and assess threats and
    vulnerabilities for critical infrastructure;
    Performance expectation: Support efforts to reduce threats and
    vulnerabilities for critical infrastructure.

    Performance expectation: Generally not achieved; Total: 3.

    Performance expectation: Improve and enhance public/private
    information sharing involving attacks, threats, and vulnerabilities;
    Performance expectation: Develop and enhance national analysis and
    warning capabilities for critical infrastructure;
    Performance expectation: Provide and coordinate incident response and
    recovery planning efforts for critical infrastructure.

    Overall assessment of progress: Moderate.

    Source: GAO analysis.

    [End of table]

    * DHS's science and technology efforts include coordinating the federal
    government's civilian efforts to identify and develop countermeasures
    to chemical, biological, radiological, nuclear, and other emerging
    terrorist threats. As shown in table 9, we identified 6 performance
    expectations for DHS in the area of science and technology and found
    that DHS has generally achieved 1 of them and has generally not
    achieved 5 others.

    Table 9: Summary of Our Assessments for DHS's Science and Technology
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 1.

    Performance expectation: Coordinate with and share homeland security
    technologies with federal, state, local, and private sector entities.

    Performance expectation: Generally not achieved; Total: 5.

    Performance expectation: Develop a plan for departmental research,
    development, testing, and evaluation activities;
    Performance expectation: Assess emerging chemical, biological,
    radiological, and nuclear threats and homeland security
    vulnerabilities;
    Performance expectation: Coordinate research, development, and testing
    efforts to identify and develop countermeasures to address chemical,
    biological, radiological, nuclear, and other emerging terrorist
    threats;
    Performance expectation: Coordinate deployment of nuclear, biological,
    chemical, and radiological detection capabilities and other
    countermeasures;
    Performance expectation: Assess and evaluate nuclear, biological,
    chemical, and radiological detection capabilities and other
    countermeasures.

    Overall assessment of progress: Limited.

    Source: GAO analysis.

    [End of table]

    * DHS's acquisition management efforts include managing the use of
    contracts to acquire goods and services needed to fulfill or support
    the agency's missions, such as information systems, new technologies,
    aircraft, ships, and professional services. As shown in table 10, we
    identified 3 performance expectations for DHS in the area of
    acquisition management and found that DHS has generally achieved 1 of
    them and has generally not achieved 2 others.

    Table 10: Summary of Our Assessments for DHS's Acquisition Management
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 1.

    Performance expectation: Assess and organize acquisition functions to
    meet agency needs.

    Performance expectation: Generally not achieved; Total: 2.

    Performance expectation: Develop clear and transparent policies and
    processes for all acquisitions;
    Performance expectation: Develop an acquisition workforce to implement
    and monitor acquisitions.

    Overall assessment of progress: Modest.

    Source: GAO analysis.

    [End of table]

    *DHS's financial management efforts include consolidating or
    integrating component agencies' financial management systems. As shown
    in table 11, we identified 7 performance expectations for DHS in the
    area of financial management and found that DHS has generally achieved
    2 of them and has generally not achieved 5 others.

    Table 11: Summary of Our Assessments for DHS's Financial Management
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 2.

    Performance expectation: Designate a department Chief Financial Officer
    who is appointed by the President and confirmed by the Senate;
    Performance expectation: Prepare corrective action plans for internal
    control weaknesses.

    Performance expectation: Generally not achieved; Total: 5.

    Performance expectation: Subject all financial statements to an annual
    financial statement audit;
    Performance expectation: Obtain an unqualified financial statement
    audit opinion;
    Performance expectation: Substantially comply with federal financial
    management system requirements, applicable federal accounting
    standards, and the U.S. Standard General Ledger at the transaction
    level;
    Performance expectation: Obtain an unqualified opinion on internal
    control over financial reporting;
    Performance expectation: Correct internal control weaknesses.

    Overall assessment of progress: Modest.

    Source: GAO analysis.

    [End of table]

    * DHS's key human capital management areas include pay, performance
    management, classification, labor relations, adverse actions, employee
    appeals, and diversity management. As shown in table 12, we identified
    8 performance expectations for DHS in the area of human capital
    management and found that DHS has generally achieved 2 of them and has
    generally not achieved 6 others.

    Table 12: Summary of Our Assessments for DHS's Human Capital Management
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 2.

    Performance expectation: Develop a results-oriented strategic human
    capital plan;
    Performance expectation: Create a comprehensive plan for training and
    professional development.

    Performance expectation: Generally not achieved; Total: 6.

    Performance expectation: Implement a human capital system that links
    human capital planning to overall agency strategic planning;
    Performance expectation: Develop and implement processes to recruit and
    hire employees who possess needed skills;
    Performance expectation: Measure agency performance and make strategic
    human capital decisions;
    Performance expectation: Establish a market-based and more performance-
    oriented pay system;
    Performance expectation: Seek feedback from employees to allow for
    their participation in the decision-making process;
    Performance expectation: Implement training and development programs in
    support of DHS's mission and goals.

    Overall assessment of progress: Limited.

    Source: GAO analysis.

    [End of table]

    * DHS's information technology management efforts include developing
    and using an enterprise architecture, or corporate blueprint, as an
    authoritative frame of reference to guide and constrain system
    investments; defining and following a corporate process for informed
    decision making by senior leadership about competing information
    technology investment options; applying system and software development
    and acquisition discipline and rigor when defining, designing,
    developing, testing, deploying, and maintaining systems; establishing a
    comprehensive, departmentwide information security program to protect
    information and systems; having sufficient people with the right
    knowledge, skills, and abilities to execute each of these areas now and
    in the future; and centralizing leadership for extending these
    disciplines throughout the organization with an empowered Chief
    Information Officer. As shown in table 13, we identified 13 performance
    expectations for DHS in the area of information technology management
    and found that DHS has generally achieved 2 of them and has generally
    not achieved 8 others. For 3 performance expectations, we could not
    make an assessment.

    Table 13: Summary of Our Assessments for DHS's Information Technology
    Management Performance Expectations:

    Performance expectation: Generally achieved; Total: 2.

    Performance expectation: Organize roles and responsibilities for
    information technology under the Chief Information Officer;
    Performance expectation: Develop policies and procedures to ensure
    protection of sensitive information.

    Performance expectation: Generally not achieved; Total: 8.

    Performance expectation: Develop a strategy and plan for information
    technology management;
    Performance expectation: Develop measures to assess performance in the
    management of information technology;
    Performance expectation: Implement a comprehensive enterprise
    architecture;
    Performance expectation: Develop a process to effectively manage
    information technology investments;
    Performance expectation: Implement a process to effectively manage
    information technology investments;
    Performance expectation: Develop policies and procedures for effective
    information systems development and acquisition;
    Performance expectation: Implement policies and procedures for
    effective information systems development and acquisition;
    Performance expectation: Implement policies and procedures to
    effectively safeguard sensitive information.

    Performance expectation: No assessment made; Total: 3.

    Performance expectation: Strategically manage information technology
    human capital;
    Performance expectation: Develop a comprehensive enterprise
    architecture;
    Performance expectation: Provide operational capabilities for
    information technology infrastructure and applications.

    Overall assessment of progress: Limited.

    Source: GAO analysis.

    [End of table]

    * DHS's responsibilities for real property management are specified in
    Executive Order 13327, "Federal Real Property Asset Management," and
    include establishment of a senior real property officer, development of
    an asset inventory, and development and implementation of an asset
    management plan and performance measures. As shown in table 14, we
    identified 9 performance expectations for DHS in the area of real
    property management and found that DHS has generally achieved 6 of them
    and has generally not achieved 3 others.

    Table 14: Summary of Our Assessments for DHS's Real Property Management
    Performance Expectations:

    Performance expectation: Generally achieved; Total: 6.

    Performance expectation: Establish a Senior Real Property Officer who
    actively serves on the Federal Real Property Council;
    Performance expectation: Complete and maintain a comprehensive
    inventory and profile of agency real property;
    Performance expectation: Provide timely and accurate information for
    inclusion in the governmentwide real property inventory database;
    Performance expectation: Develop an Office of Management and Budget-
    approved asset management plan;
    Performance expectation: Establish an Office of Management and Budget-
    approved 3-year rolling timeline with certain deadlines by which the
    agency will address opportunities and determine its priorities as
    identified in the asset management plan;
    Performance expectation: Establish real property performance measures.

    Performance expectation: Generally not achieved; Total: 3.

    Performance expectation: Demonstrate steps taken toward implementation
    of the asset management plan;
    Performance expectation: Use accurate and current asset inventory
    information and real property performance measures in management
    decision making;
    Performance expectation: Ensure the management of agency property
    assets is consistent with the agency's overall strategic plan, the
    agency asset management plan, and the performance measures.

    Overall assessment of progress: Moderate.

    Source: GAO analysis.

    [End of table]

    A variety of cross-cutting themes have affected DHS's efforts to
    implement its mission and management functions. These key themes
    include agency transformation, strategic planning and results
    management, risk management, information sharing, and partnerships and
    coordination.

    * In past work, we reported on the importance of integration and
    transformation in helping DHS ensure that it can implement its mission
    and management functions. We designated the implementation and
    transformation of DHS as a high-risk area in 2003 and continued that
    designation in our 2005 and 2007 updates. As of May 2007, we reported
    that DHS had yet to submit a corrective action plan to the Office of
    Management and Budget. We reported that the creation of DHS is an
    enormous management challenge and that DHS faces a formidable task in
    its transformation efforts as it works to integrate over 170,000
    federal employees from 22 component agencies. We noted that it can take
    a minimum of 5 to 7 years until organizations complete their
    transformations.

    * We have identified strategic planning and the development and use of
    outcome-based performance measures as two of the key success factors
    for the management of any organization. DHS issued a departmentwide
    strategic plan that met most of the required elements for a strategic
    plan and is planning to issue an updated plan. However, we have
    reported that some component agencies have had difficulties in
    developing outcome-based goals and measures for assessing program
    performance. For example, in August 2005 we reported that U.S.
    Immigration and Customs Enforcement (ICE) had not yet developed outcome
    goals and measures for its worksite enforcement program, and in March
    2006 we reported that U.S. Citizenship and Immigration Services (USCIS)
    had not yet established performance goals and measures to assess its
    benefit fraud activities. We have also noted that DHS faces inherent
    challenges in developing outcome-based goals and measures to assess the
    affect of its efforts on strengthening homeland security.

    * We have also reported on the importance of using a risk management
    approach to set homeland security priorities and allocate resources
    accordingly. The National Strategy for Homeland Security and DHS's
    strategic plan have called for the use of risk-based decisions to
    prioritize DHS's resource investments, and risk management has been
    widely supported by the President, Congress, and the Secretary of
    Homeland Security as a management approach for homeland security. In
    past work we found that while some DHS component agencies, such as the
    Coast Guard and the Transportation Security Administration (TSA), have
    taken steps to apply risk-based decision making in implementing some of
    their mission functions, other components have not utilized such an
    approach. For example, we reported that DHS has not applied a risk
    management approach in deciding whether and how to invest in specific
    capabilities for preparing for and responding to catastrophic threats.

    * In 2005 we designated information sharing for homeland security as
    high-risk. We recently reported that more than 5 years after September
    11, 2001, the nation still lacked an implemented set of governmentwide
    policies and processes for sharing terrorism-related information and
    the area remained high-risk. However, we noted that the federal
    government has issued a strategy for how it will put in place the
    overall framework and policies for sharing information with critical
    partners and that DHS has taken actions to implement its information
    sharing responsibilities. For example, DHS has implemented an
    information system to share homeland security information and has
    supported the efforts of states and localities to create information
    "fusion" centers. We have reported that DHS faces challenges in
    continuing to develop productive information sharing relationships with
    federal agencies, state and local governments, and the private sector.

    * We have also reported on the important role that DHS plays in
    partnering and coordinating its homeland security efforts with federal,
    state, local, private sector, and international stakeholders. The
    National Strategy for Homeland Security underscores the importance of
    DHS partnering with other stakeholders, as the majority of the
    strategy's initiatives are intended to be implemented by three or more
    federal agencies. Our prior work has shown that, among other things,
    successful partnering and coordination involve collaborating and
    consulting with stakeholders to develop goals, strategies, and roles.
    DHS has taken steps to strengthen partnering frameworks and
    capabilities. For example, DHS has formed a working group to coordinate
    the federal response to cyber incidents of national significance.
    However, we have also reported on difficulties faced by DHS in its
    partnership efforts. For example, DHS faced challenges in coordinating
    with its emergency preparedness and response partners in the wake of
    Hurricanes Katrina and Rita due to, among other things, unclear
    designations of partners' roles and responsibilities.

    Given DHS's dominant role in securing the homeland, it is critical that
    the department's mission and management programs are operating as
    efficiently and effectively as possible. DHS has taken important
    actions to secure the border and transportation sectors and to prepare
    for and respond to disasters. DHS has had to undertake these missions
    while also working to transform itself into a fully functioning cabinet
    department--a difficult task for any organization. As DHS moves
    forward, it will be important for the department to continue to develop
    more measurable goals to guide implementation efforts and to enable
    better accountability of its progress toward achieving desired
    outcomes. It will also be important for DHS to continually reassess its
    mission and management goals, measures, and milestones to evaluate
    progress made, identify past and emerging obstacles, and examine
    alternatives to address those obstacles and effectively implement its
    missions.

    In its comments on a draft of this report, DHS took issues with our
    methodology and disagreed with our assessments for 42 of 171
    performance expectations. DHS's five general issues were (1)
    perceptions that we altered our standards used to judge the
    department's progress; (2) concerns with the binary approach we used to
    assess the performance expectations; (3) concerns regarding perceived
    changes in criteria after DHS provided additional information; (4)
    concerns with consistency in our application of the methodology; and
    (5) concerns regarding our treatment of performance expectations as
    having equal weight. With regard to the first issue, as we communicated
    to DHS, we did not change our criteria; rather we made a change in
    language to better convey the intent behind the performance
    expectations that DHS achieve them instead of merely taken actions that
    apply or relate to them. Second, regarding our use of a binary standard
    to judge whether or not DHS generally met each of 171 performance
    expectations, we acknowledge the limitations of this standard, but
    believe it is appropriate for this review given the administration has
    generally not established quantitative goals and measures for the 171
    expectations, which are necessary to systematically assess where along
    a spectrum of progress DHS stood in achieving each performance
    expectation. We applied a scale to assess different levels of progress
    made by DHS for its overall mission and management areas. With regard
    to the third issue, what DHS perceives as a change in criteria for
    certain performance expectations is not a change in criteria but simply
    the process by which we disclosed our preliminary assessment to DHS,
    analyzed additional documents and information from DHS, and updated
    and, in some cases revised, our assessments based on this additional
    input. Fourth, regarding concerns with consistency in our methodology
    application, our core team of GAO analysts and managers reviewed all
    inputs from GAO staff to ensure consistent application of our
    methodology, criteria, and analytical process. Finally, regarding
    concerns with our treatment of performance expectations as having equal
    weight, we acknowledge that differences exist between expectations, but
    we did not weight the performance expectations because congressional,
    departmental and others' views on the relative priority of each
    expectation may be different and we did not believe it was appropriate
    to substitute our judgment for theirs.

    With regard to DHS's disagreement with our assessments for 42 of the
    performance expectations, DHS generally contends that (1) we expected
    DHS to have achieved an entire expectation in cases when that ultimate
    achievement will likely take several more years, and (2) we did not
    adequately use or appropriately interpret additional information DHS
    provided. In general, we believe that it is appropriate, after pointing
    out the expectation for a multiyear program and documenting the
    activities DHS has actually accomplished to date, to reach a conclusion
    that DHS has not yet fully implemented the program. We also believe we
    have appropriately used the documents DHS has provided us. In some
    cases, the information and documents DHS provided were not relevant to
    the specific performance expectation; in these situations we did not
    discuss them in our assessment. In other cases, the information did not
    convince us that DHS had achieved the performance expectation as stated
    or as we had interpreted it. In the assessment portion of each
    performance expectation, we have described how we applied the
    information DHS provided to the performance expectation and describe
    the level of progress DHS has made.

    Overall, we appreciate DHS's concerns and recognize that in a broad-
    based endeavor such as this, some level of disagreement is inevitable,
    especially at any given point in time. However, we have been as
    transparent as possible regarding our purpose, methodology, and
    professional judgments.

    Background:

    In July 2002, President Bush issued the National Strategy for Homeland
    Security. The strategy set forth overall objectives to prevent
    terrorist attacks within the United States, reduce America's
    vulnerability to terrorism, and minimize the damage and assist in the
    recovery from attacks that may occur. The strategy set out a plan to
    improve homeland security through the cooperation and partnering of
    federal, state, local, and private sector organizations on an array of
    functions. The National Strategy for Homeland Security specified a
    number of federal departments, as well as nonfederal organizations,
    that have important roles in securing the homeland. In terms of federal
    departments, DHS was assigned a prominent role in implementing
    established homeland security mission areas.

    In November 2002, the Homeland Security Act of 2002 was enacted into
    law, creating DHS. This act defined the department's missions to
    include preventing terrorist attacks within the United States; reducing
    U.S. vulnerability to terrorism; and minimizing the damages, and
    assisting in the recovery from, attacks that occur within the United
    States. The act also specified major responsibilities for the
    department, including to analyze information and protect
    infrastructure; develop countermeasures against chemical, biological,
    radiological, and nuclear, and other emerging terrorist threats; secure
    U.S. borders and transportation systems; and organize emergency
    preparedness and response efforts.

    DHS began operations in March 2003. Its establishment represented a
    fusion of 22 federal agencies to coordinate and centralize the
    leadership of many homeland security activities under a single
    department.[Footnote 20] According to data provided to us by DHS, the
    department's total budget authority was about $39 billion in fiscal
    year 2004, about $108 billion in fiscal year 2005, about $49 billion in
    fiscal year 2006, and about $45 billion in fiscal year 2007.[Footnote
    21] The President's fiscal year 2008 budget submission requests
    approximately $46 billion for DHS. Table 15 provides information on
    DHS's budget authority, as reported by DHS, for each fiscal year from
    2004 though 2007.

    Table 15: DHS Budget Authority for Fiscal Years 2004 through 2007 in
    Thousands of Dollars, as Reported by DHS:

    DHS component agency/program: Departmental Operations;
    Fiscal year 2004 budget authority: $394,435;
    Fiscal year 2005 budget authority: $527,257;
    Fiscal year 2006 budget authority: $610,473;
    Fiscal year 2007 budget authority: $626,123.

    DHS component agency/program: Analysis and Operations;
    Fiscal year 2004
    budget authority:
    Fiscal year 2005 budget authority:
    Fiscal year 2006 budget authority: $252,940;
    Fiscal year 2007 budget authority: $299,663.

    DHS component agency/program: DHS IG;
    Fiscal year 2004 budget authority: $80,318;
    Fiscal year 2005 budget authority: $97,317;
    Fiscal year 2006 budget authority: $84,187;
    Fiscal year 2007 budget authority: 98,685.

    DHS component agency/program: U.S. Secret Service;
    Fiscal year 2004 budget authority: $1,334,128;
    Fiscal year 2005 budget authority: $1,375,758;
    Fiscal year 2006 budget authority: $1,423,489;
    Fiscal year 2007 budget authority: $1,479,158.

    DHS component agency/program: U.S. Customs and Border Protection (CBP);
    Fiscal year 2004 budget authority: $5,994,287;
    Fiscal year 2005 budget authority: $6,520,698;
    Fiscal year 2006 budget authority: $7,970,695;
    Fiscal year 2007 budget authority: $9,344,781.

    DHS component agency/program: U.S. Visitor and Immigrant Status
    Indicator Technology (US-VISIT)[A];
    Fiscal year 2004 budget authority: $328,053;
    Fiscal year 2005 budget authority: $340,000;
    Fiscal year 2006 budget authority: $336,600;
    Fiscal year 2007 budget authority: $362,494.

    DHS component agency/program: U.S. Immigration and Customs Enforcement
    (ICE);
    Fiscal year 2004 budget authority: $3,669,615;
    Fiscal year 2005 budget authority: $4,244,228;
    Fiscal year 2006 budget authority: $4,206,443;
    Fiscal year 2007 budget authority: $4,726,641.

    DHS component agency/program: U.S. Citizenship and Immigration Services
    (USCIS);
    Fiscal year 2004 budget authority: $1,549,733;
    Fiscal year 2005 budget authority: $1,775,000;
    Fiscal year 2006 budget authority: $1,887,850;
    Fiscal year 2007 budget authority: $1,985,990.

    DHS component agency/program: Transportation Security Administration
    (TSA);
    Fiscal year 2004 budget authority: $4,578,043;
    Fiscal year 2005 budget authority: $5,405,375;
    Fiscal year 2006 budget authority: $6,167,014;
    Fiscal year 2007 budget authority: $6,329,291.

    DHS component agency/program: U.S. Coast Guard;
    Fiscal year 2004 budget authority: $7,097,405;
    Fiscal year 2005 budget authority: $7,853,427;
    Fiscal year 2006 budget authority: $8,782,689;
    Fiscal year 2007 budget authority: $8,729,152.

    DHS component agency/program: National Protection and Programs
    Directorate/Preparedness Directorate[A];
    Fiscal year 2004 budget authority:
    Fiscal year 2005 budget authority:
    Fiscal year 2006 budget authority: $678,395;
    Fiscal year 2007 budget authority: $618,577.

    DHS component agency/program: Counter-Terrorism Fund;
    Fiscal year 2004 budget authority: $9,941;
    Fiscal year 2005 budget authority: $8,000;
    Fiscal year 2006 budget authority: $1,980;
    Fiscal year 2007 budget authority:

    DHS component agency/program: Federal Emergency Management Agency
    (FEMA);
    Fiscal year 2004 budget authority: $8,378,109;
    Fiscal year 2005 budget authority: $74,031,032;
    Fiscal year 2006 budget authority: $11,175,544;
    Fiscal year 2007 budget authority: $5,223,503.

    DHS component agency/program: FEMA: Office of Grant Programs[B];
    Fiscal year 2004 budget authority: $4,013,182;
    Fiscal year 2005 budget authority: $3,984,846;
    Fiscal year 2006 budget authority: $3,377,737;
    Fiscal year 2007 budget authority: $3,393,000.

    DHS component agency/program: Science and Technology Directorate;
    Fiscal year 2004 budget authority: $912,751;
    Fiscal year 2005 budget authority: $1,115,450;
    Fiscal year 2006 budget authority: $1,487,075;
    Fiscal year 2007 budget authority: $973,109.

    DHS component agency/program: Domestic Nuclear Detection Office;
    Fiscal year 2004 budget authority:
    Fiscal year 2005 budget authority:
    Fiscal year 2006 budget authority:
    Fiscal year 2007 budget authority: $480,968.

    DHS component agency/program: Border and Transportation Security
    Directorate[A];
    Fiscal year 2004 budget authority: $8,058;
    Fiscal year 2005 budget authority: $9,617;
    Fiscal year 2006 budget authority:
    Fiscal year 2007 budget authority:

    DHS component agency/program: Federal Law Enforcement Training Center;
    Fiscal year 2004 budget authority: $191,643;
    Fiscal year 2005 budget authority: $226,807;
    Fiscal year 2006 budget authority: $304,534;
    Fiscal year 2007 budget authority: $275,279.

    DHS component agency/program: Information Analysis and Infrastructure
    Protection Directorate[A];
    Fiscal year 2004 budget authority: $834,348;
    Fiscal year 2005 budget authority: $887,108;
    Fiscal year 2006 budget authority: [Empty];
    Fiscal year 2007 budget authority: [Empty].

    DHS component agency/program: Total;
    Fiscal year 2004 budget authority: $39,374,049;
    Fiscal year 2005 budget authority: $108,401,920[C];
    Fiscal year 2006 budget authority: $48,747,645;
    Fiscal year 2007 budget authority: $44,946,414.

    Source: DHS.

    Note: Data are rounded to the nearest thousand. Fiscal year 2007
    amounts are as of January 31, 2007. The data reflect total budget
    authority amounts as reported to us by DHS. The amounts include annual
    and supplemental appropriations, rescissions, amounts reprogrammed or
    transferred, fee estimates, and mandatory amounts. The amounts do not
    reflect carryover or rescissions of unobligated balances.

    [A] The Border and Transportation Security Directorate, the Information
    Analysis and Infrastructure Protection Directorate, and the US-VISIT
    program are legacy organizations within DHS. The functions of these
    organizations have been realigned through DHS reorganizations. In
    particular, in March 2007 US-VISIT was reorganized under the National
    Protection and Programs Directorate. The Border and Transportation
    Security Directorate included U.S. Customs and Border Protection, U.S.
    Immigration and Customs Enforcement, the Transportation Security
    Administration, and the Federal Law Enforcement Training Center.

    [B] The Office of Grant Programs has undergone several realignments. It
    was previously known as the Office of Grants and Training in the
    Preparedness Directorate, the Office of State and Local Government
    Coordination and Preparedness, and the Office for Domestic
    Preparedness.

    [C] The FEMA Fiscal Year 2005 Amount Includes About $45 Billion In
    Supplemental Funding For Hurricane Katrina.]

    [End of table]

    Since creating and issuing its first strategic plan, the department has
    undergone several reorganizations. Most notably, in July 2005, DHS
    announced the outcome of its Second-Stage Review, an internal study of
    the department's programs, policies, operations, and structures. As a
    result of this review, the department realigned several component
    agencies and functions. In particular, the Secretary of Homeland
    Security established a Directorate of Policy to coordinate
    departmentwide policies, regulations, and other initiatives and
    consolidated preparedness activities in one directorate, the
    Directorate for Preparedness. In addition, the Secretary established a
    new Office of Intelligence and Analysis and the Office of
    Infrastructure Protection composed of analysts from the former
    Information Analysis and Infrastructure Protection directorate. The
    Office of Infrastructure Protection was placed in the Directorate for
    Preparedness. The fiscal year 2007 DHS appropriations act provided for
    the further reorganization of functions within the department by, in
    particular, realigning DHS's emergency preparedness and response
    responsibilities.[Footnote 22]

    In addition to these reorganizations, a variety of factors have
    affected DHS's efforts to implement its mission and management
    functions. These factors include both domestic and international
    events, such as Hurricanes Katrina and Rita, and major homeland
    security-related legislation. Figure 2 provides a timeline of key
    events that have affected DHS's implementation.

    Figure 2: Selected Key Events That Have Affected Department of Homeland
    Security Implementation:

    [See PDF for image]

    [End of figure]

    DHS Has Made Varying Levels of Progress in Implementing its Core
    Mission and Management Functions, but Has Faced Difficulties in Its
    Implementation Efforts:

    Based on the performance expectations we identified, DHS has made
    progress in implementing its mission and management functions, but
    various challenges have affected its efforts. Specifically, DHS has
    made limited progress in the areas of emergency preparedness and
    response; science and technology; and human capital and information
    technology management. We found that DHS has made modest progress in
    the areas of border security; immigration services; and acquisition and
    financial management. We also found that DHS has made moderate progress
    in the areas of immigration enforcement, aviation security, surface
    transportation security; critical infrastructure and key resources
    protection, and real property management, and that DHS has made
    substantial progress in the area of maritime security.

    DHS Has Made Modest Progress in Border Security:

    The United States shares a 5,525 mile border with Canada and a 1,989
    mile border with Mexico, and all goods and people traveling to the
    United States must be inspected at air, land, or sea ports of entry. In
    2006, more than 400 million legal entries were made to the United
    States--a majority of all border crossings were at land border ports of
    entry. Within DHS, CBP is the lead agency responsible for implementing
    the department's border security mission. Specifically, CBP's two
    priority missions are (1) detecting and preventing terrorists and
    terrorist weapons from entering the United States, and (2) facilitating
    the orderly and efficient flow of legitimate trade and travel. CBP's
    supporting missions include interdicting illegal drugs and other
    contraband; apprehending individuals who are attempting to enter the
    United States illegally; inspecting inbound and outbound people,
    vehicles, and cargo; enforcing laws of the United States at the border;
    protecting U.S. agricultural and economic interests from harmful pests
    and diseases; regulating and facilitating international trade;
    collecting import duties; and enforcing U.S. trade laws. Within CBP,
    the United States Border Patrol is responsible for border security
    between designated official ports of entry, and CBP's Office of Field
    Operations enforces trade, immigration, and agricultural laws and
    regulations by securing the flow of people and goods into and out of
    the country, while facilitating legitimate travel and trade at U.S.
    ports of entry.

    As shown in table 16, we identified 12 performance expectations for DHS
    in the area of border security and found that overall DHS has made
    modest progress in meeting those expectations. Specifically, we found
    that DHS has generally achieved 5 of its performance expectations and
    has generally not achieved 7 of its performance expectations.

    Table 16: Performance Expectations and Progress Made in Border
    Security:

    Performance expectation: 1. Implement a biometric entry system to
    prevent unauthorized border crossers from entering the United States
    through ports of entry;
    Assessment: Generally achieved.

    Performance expectation: 2. Implement a biometric exit system to
    collect information on border crossers leaving the United States
    through ports of entry;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop a program to detect and identify
    illegal border crossings between ports of entry;
    Assessment: Generally achieved.

    Performance expectation: 4. Implement a program to detect and identify
    illegal border crossings between ports of entry;
    Assessment: Generally not achieved.

    Performance expectation: 5. Develop a strategy to detect and interdict
    illegal flows of cargo, drugs, and other items into the United States;
    Assessment: Generally achieved.

    Performance expectation: 6. Implement a strategy to detect and
    interdict illegal flows of cargo, drugs and other items into the United
    States;
    Assessment: Generally not achieved.

    Performance expectation: 7. Implement effective security measures in
    the visa issuance process;
    Assessment: Generally not achieved.

    Performance expectation: 8. Implement initiatives related to the
    security of certain documents used to enter the United States;
    Assessment: Generally not achieved.

    Performance expectation: 9. Provide adequate training for all border
    related employees;
    Assessment: Generally achieved.

    Performance expectation: 10. Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's border
    security mission;
    Assessment: Generally achieved.

    Performance expectation: 11. Ensure adequate infrastructure and
    facilities;
    Assessment: Generally not achieved.

    Performance expectation: 12. Leverage technology, personnel, and
    information to secure the border;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 5;
    Assessment: Generally not achieved: 7;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 17 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of border security and our assessment of whether DHS has taken
    steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 17: Performance Expectations and Assessment of DHS Progress in
    Border Security:

    Performance expectation: 1. Implement a biometric entry system to
    prevent unauthorized border crossers from entering the United States
    through ports of entry;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. According to DHS,
    the entry portion of US-VISIT has been deployed at 154 of 170 land
    ports of entry, 115 airports, and 14 seaports, as of December 2006.
    With regard to 14 of the 16 land ports of entry where US-VISIT was not
    installed, CBP and US-VISIT program office officials told us there was
    no operational need for US-VISIT because visitors who are required to
    be processed into US-VISIT are, by regulation, not authorized to enter
    the United States at these locations. We reported that US-VISIT needs
    to be installed at the remaining 2 ports of entry in order to achieve
    full implementation as required by law, but both of these locations
    present significant challenges to installation of US-VISIT. These ports
    of entry do not currently have access to appropriate communication
    transmission lines to operate US-VISIT. CBP officials told us that,
    given this constraint, they determined that they could continue to
    operate as before. CBP officials told us that having US-VISIT biometric
    entry capability generally improved their ability to process visitors
    required to enroll in US-VISIT because it provided them additional
    assurance that visitors are who they say they are and automated the
    paperwork associated with processing the I-94 arrival/departure form.
    For more information, see Border Security: US-VISIT Program Faces
    Strategic, Operational, and Technological Challenges at Land Ports of
    Entry, GAO-07-248;
    Assessment: Generally achieved.

    Performance expectation: 2. Implement a biometric exit system to
    collect information on border crossers leaving the United States
    through ports of entry;
    Summary of findings: GAO findings: DHS has faced challenges in
    deploying a biometric exit system at ports of entry. Legislation
    required US-VISIT to collect biometric exit data from all individuals
    who are required to provide biometric entry data, but did not set a
    specific deadline for this requirement. Although US-VISIT had set a
    December 2007 deadline for implementing exit capability at the 50
    busiest land ports of entry, US-VISIT has since determined that
    implementing an exit capability by this date is no longer feasible. A
    new date for exit implementation has not been set. In March 2007, we
    reported that DHS has devoted considerable time and resources toward
    establishing an operational exit capability. Over the last 4 years, it
    has committed over $160 million to pilot test and evaluate an exit
    solution at 12 air, 2 sea, and 5 land ports of entry. Despite this
    considerable investment of time and resources, the US-VISIT program
    still does not have either an operational exit capability or a viable
    exit solution to deploy to all air, sea, and land ports of entry. With
    regard to air and sea ports of entry, we reported that although US-
    VISIT has pilot tested a biometric exit capability for these ports of
    entry, it has not been available at all ports. A pilot test in 2004
    through 2005 identified issues that limited the operational
    effectiveness of the solution, such as the lack of traveler compliance
    with the processes. According to program officials, US-VISIT is now
    developing a plan for deploying a comprehensive, affordable exit
    solution at all ports of entry. However, no time frame has been
    established for this plan being approved or implemented. There are
    interrelated logistical, technological, and infrastructure constraints
    that have precluded DHS from achieving this mandate, and there are cost
    factors related to the feasibility of implementation of such a
    solution. With regard to land ports of entry, for example, we reported
    that the major constraint to performing biometric verification upon
    exit at this time, in the US-VISIT Program Office's view, is that the
    only proven technology available would necessitate mirroring the
    processes currently in use for US-VISIT at entry. The US-VISIT Program
    Office concluded in January 2005 that the mirror-imaging solution was
    "an infeasible alternative for numerous reasons, including but not
    limited to, the additional staffing demands, new infrastructure
    requirements, and potential trade and commerce impacts." US-VISIT
    officials stated that they believe that technological advances over the
    next 5 to 10 years will make it possible to utilize alternative
    technologies that provide biometric verification of persons exiting the
    country without major changes to facility infrastructure and without
    requiring those exiting to stop and/or exit their vehicles, thereby
    precluding traffic backup, congestion, and resulting delays. For more
    information, see GAO-07-248 and Homeland Security: US-VISIT Program
    Faces Operational, Technological and Management Challenges, GAO-07-
    632T.

    DHS updated information: Between March and June 2007, DHS told
    us that, it expected that further land exit testing may be conducted in
    fiscal year 2008. DHS reported that it provided an exit strategy to
    Congress in the spring of 2007; Our assessment: We conclude that DHS
    has generally not achieved this performance expectation. Although DHS
    is continuing to explore various possibilities for implementing an exit
    capability, the department has not yet implemented a biometric exit
    system at land, air, and sea ports of entry.

    Assessment: Generally not achieved.

    Performance expectation: 3. Develop a program to detect and identify
    illegal border crossings between ports of entry;
    Summary of findings: GAO findings: DHS has made progress toward
    developing a program to detect illegal border crossings between ports
    of entry. In February 2007, we reported that the Secure Border
    Initiative is a comprehensive, multiyear program established in
    November 2005 by the Secretary of Homeland Security to secure U.S.
    borders and reduce illegal immigration. The Secure Border Initiative's
    mission is to promote border security strategies that help protect
    against and prevent terrorist attacks and other transnational crimes.
    Elements of the Secure Border Initiative will be carried out by several
    organizations within DHS. One element of the Secure Border Initiative
    is SBInet, the program within CBP responsible for developing a
    comprehensive border protection system. SBInet is responsible for
    leading the effort to ensure that the proper mix of personnel, tactical
    infrastructure, rapid response capability, and technology is deployed
    along the border. According to DHS, the SBInet solution is to include a
    variety of sensors, communications systems, information technology,
    tactical infrastructure (roads, barriers, and fencing), and command and
    control capabilities to enhance situational awareness of the responding
    officers. The solution is also to include the development of a common
    operating picture that provides uniform data, through a command center
    environment, to all DHS agencies and is interoperable with stakeholders
    external to DHS. We have ongoing work to further assess the Secure
    Border Initiative. For more information, see GAO-07-248 and Secure
    Border Initiative: SBInet Expenditure Plan Needs to Better Support
    Oversight and Accountability, GAO-07-309.

    DHS updated information: According to updated information provided by
    DHS between March and May 2007, the Secure Border Initiative program is
    in place, with a Program Management Office and governance structure,
    system integrator, and funding. In September 2006, the SBInet contract
    was awarded. CBP has been designated as the DHS executive agent for the
    SBInet program and has established a Program Management Office to
    oversee SBInet. With regard to other border security initiatives, DHS
    noted that Operation Streamline, launched in December 2005, is a
    coordinated effort among CBP, ICE, and the Department of Justice to
    create a zero-tolerance zone for illegal entries in the Del Rio Border
    Patrol sector.
    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has made progress in developing a strategy
    to detect and identify illegal border crossings between ports of entry-
    -namely the Secure Border Initiative--and has developed other
    initiatives to detect and deter illegal border crossings.

    Assessment: Generally achieved.

    Performance expectation: 4. Implement a program to detect and identify
    illegal border crossings between ports of entry;
    Summary of findings: GAO and DHS IG findings: DHS has not yet fully
    implemented a program to effectively detect and identify illegal border
    crossings between ports of entry. In past work, we and the DHS IG
    identified challenges in implementing earlier border security programs
    designed to detect and deter illegal border crossings. For example, in
    February 2006 the DHS IG reported that initiatives using technology,
    such as unmanned aerial vehicles and remote video surveillance, had
    failed to consistently demonstrate the predicted force multiplier
    effect for border security. More recently, we reported that although
    DHS has published some information on various aspects of the Secure
    Border Initiative and SBInet, it remains unclear how SBInet will be
    linked, if at all, to US-VISIT so that the two systems can share
    technology, infrastructure, and data across programs. In addition, we
    reported that according to DHS, work on the northern border for the
    Secure Border Initiative is not projected to begin before fiscal year
    2009. We have ongoing work to further assess the Secure Border
    Initiative. For more information, see GAO-07-309; GAO-07-248; Border
    Security: Key Unresolved Issues Justify Reevaluation of Border
    Surveillance Technology Program, GAO-06-295; and Border Security:
    Agencies Need to Better Coordinate Their Strategies and Operations on
    Federal Lands, GAO-04-590. Also, see Department of Homeland Security
    Office of the Inspector General, A Review of Remote Surveillance
    Technology Along U.S. Land Borders, OIG-06-15 (Washington, D.C.:
    December 2005).

    DHS updated information: DHS provided evidence of SBInet progress,
    including the award of four task orders as of May 2007. At the end of
    fiscal year 2006, DHS reported that 75 miles of fence were constructed
    and a total of 370 miles are planned to be constructed by the end of
    calendar year 2008. CBP also plans to establish 200 miles of vehicle
    barriers by the end of calendar year 2008, with 67 miles completed.
    Further, DHS has established a Miles of Effective Control goal. The
    goal is to gain effective control of the entire southwest border by
    2013. According to DHS, effective control indicates that defense-in-
    depth capabilities in the area are robust enough to (1) detect illegal
    entries; (2) identify and classify the entries; (3) efficiently and
    effectively respond; and (4) bring events to a satisfactory law
    enforcement resolution. As of March 2007, DHS reported that it had 392
    miles under effective control, and the goal for the end of calendar
    year 2008 is 642 miles. DHS stated that SBInet Technology Coverage goal
    is to cover 387 miles of the border completed by the end of calendar
    year 2008 in the Tucson and Yuma sectors. With regard to Operation
    Streamline, CBP reported that beginning with a 5-mile stretch of the
    border, the initiative now spans the entire 210 mile Del Rio Sector
    Border. DHS also noted that National Guard resources have been deployed
    to the border to enhance capabilities under Operation Jumpstart. As of
    February 28, 2007, DHS reported that nearly 46,000 aliens were
    apprehended and more than 520 vehicles were seized through Operation
    Jumpstart. Additionally, CBP plans to add 6,000 Border Patrol agents by
    the end of calendar year 2008. In fiscal year 2007, DHS plans to
    increase its Border Patrol presence between ports of entry by hiring,
    training, and deploying 1,500 additional agents.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. The Secure Border Initiative and SBInet are in
    the early phases of implementation, and DHS has taken actions to
    implement the initiative, particularly in awarding four task orders
    under SBInet. However, these contracts have only recently been awarded,
    and it is unclear what progress contractors have made in implementing
    the activities specified in the task orders. Moreover, DHS reported
    that it has effective control of 380 miles of the border as of March
    2007, but the U.S. land border encompasses more than 6,000 miles, and
    DHS does not expect to begin work on the northern border until fiscal
    year 2009. Although DHS has only recently begun to implement SBInet,
    which is a multi-year program, DHS and its legacy components
    implemented programs to secure the border between ports of entry prior
    to the Secure Border Initiative and SBInet. We and the DHS IG reported
    on challenges faced by DHS in implementing programs that pre-dated the
    Secure Border Initiative and SBInet.

    Assessment: Generally not achieved.

    Performance expectation: 5. Develop a strategy to detect and interdict
    illegal flows of cargo, drugs, and other items into the United States;
    Summary of findings: GAO findings: DHS has taken steps to develop a
    strategic approach for interdicting illegal flows of cargo, drugs, and
    other items into the United States.[A] For example, according to DHS,
    in August 2006 DHS and the Department of Justice submitted a National
    Southwest Border Counternarcotics Strategy and Implementation Plan to
    the International Drug Control Policy Coordinating Committee. This
    document identified the major goals, objectives, and resource
    requirements for closing gaps in U.S. and Mexico counternarcotics
    capabilities along the southwest border. DHS has also taken steps to
    plan for the deployment of radiation portal monitors at ports of entry.
    For more information, see Combating Nuclear Smuggling: DHS Has Made
    Progress Deploying Radiation Detection Equipment at U.S. Ports-of-
    Entry, but Concerns Remain, GAO-06-389; Prescription Drugs: Strategic
    Framework Would Promote Accountability and Enhance Efforts to Enforce
    the Prohibitions on Personal Importation, GAO-05-372; and Cigarette
    Smuggling: Federal Law Enforcement Efforts and Seizures Increasing,
    GAO-04-641.

    DHS updated information: According to updated information
    provided by DHS, the CBP Office of Field Operations developed a
    comprehensive strategic plan entitled Securing America's Borders at the
    Ports of Entry that defines CBP's national strategy specifically at all
    air, land, and sea ports of entry. This plan was finalized and
    published in September 2006 concurrent with the development of the
    Secure Border Initiative. According to DHS, it complements the national
    strategy for gaining operational control of the borders between ports
    of entry and addresses the specific security concerns and required
    actions that are the direct responsibility of the Office of Field
    Operations. Programs under the auspices of the Office of Field
    Operations that support enhanced detection and interdiction of illegal
    flows of contraband and harmful substances into the United States
    include the National Targeting Center for Cargo; the Automated
    Targeting System; the Customs Trade Partnership Against Terrorism; the
    Container Security Initiative; the Secure Freight Initiative; and
    deployment of radiation portal monitors, large-scale, non-intrusive
    inspection technology, and canine enforcement teams. Additionally,
    according to the Office of Counternarcotics, in March 2006, the
    National Southwest Border Counternarcotics Strategy was approved by the
    International Drug Control Policy Coordinating Committee. This document
    identified the major goals, objectives, and recommendations for closing
    gaps in U.S. and Mexico counternarcotics capabilities along the
    southwest border.

    Our assessment: We conclude that DHS has generally
    achieved this performance expectation. DHS has made progress in
    developing a strategy to implement its various programs for detecting
    and interdicting illegal flows of cargo, drugs, and other items into
    the United States. With regard to flows of illegal drugs in particular,
    the National Southwest Border Counternarcotics Strategy has been
    approved by the International Drug Control Policy Coordinating
    Committee.

    Assessment: Generally achieved.

    Performance expectation: 6. Implement a strategy to detect and
    interdict illegal flows of cargo, drugs, and other items into the
    United States.

    Summary of findings: GAO findings: We have identified challenges in
    DHS's efforts to interdict flows of illegal goods into the United
    States.[B] DHS has implemented the Container Security Initiative to
    allow CBP officials to target containers at foreign seaports so that
    any high-risk containers maybe inspected prior to their departure for
    the United States. We have identified challenges in implementation of
    the program, including staffing imbalances that, in the past, impeded
    CBP's targeting of containers. DHS has also implemented the Customs-
    Trade Partnership Against Terrorism, a voluntary program design to
    improve the security of international supply chain through which CBP
    officials work in partnership with private companies to review supply
    chain security plans. Our work has identified a number of challenges in
    implementation of the Customs-Trade Partnership Against Terrorism,
    including that CBP's standard for validation is hard to achieve and,
    given that the program is voluntary, there are limits on how intrusive
    CBP can be in its validations. With regard to radiation portal
    monitors, we reported as of December 2005, DHS had completed deployment
    of portal monitors at two categories of entry--a total of 61 ports of
    entry--and had begun work on two other categories; overall, however,
    progress had been slower than planned. According to DHS officials, the
    slow progress resulted from a late disbursal of funds and delays in
    negotiating deployment agreements with seaport operators. Further, we
    noted the expected cost of the program was uncertain because DHS's
    plans to purchase newer, more advanced equipment were not yet
    finalized, and we projected that the program's final cost would be much
    higher than CBP anticipated at the time of our review. In 2006, we
    reported on the results of our investigation of potential security
    weaknesses associated with the installation of radiation detection
    equipment at ports of entry. As part of this investigation, we deployed
    two teams of investigators to the field to make simultaneous border
    crossings at the northern and southern borders in an attempt to
    transport radioactive sources into the United States. The radiation
    portal monitors properly signaled the presence of radioactive material
    when our two teams of investigators conducted simultaneous border
    crossings. Our investigators' vehicles were inspected in accordance
    with most of the CBP policy at both the northern and southern borders.
    However, our investigators, using counterfeit documents, were able to
    enter the United States with the radioactive sources in the trunks of
    their vehicles. In 2005 we also reported that inspection and
    interdiction efforts at international mail branches and express carrier
    facilities had not prevented a reported substantial volume of
    prescription drugs from being illegally imported from foreign Internet
    pharmacies into the United States. We acknowledged that CBP and other
    agencies, including ICE, the Food and Drug Administration, and the Drug
    Enforcement Administration, had taken a step in the right direction by
    collaborating to establish a task force designed to address challenges
    that we identified, but nonetheless, an unknown number of illegal drugs
    entered the country each day. In addition, in 2004 we noted that CBP
    reported that the number of cigarette seizures by CBP and ICE increased
    dramatically, from 12 total seizures in 1998 to 191 seizures in 2003.
    CBP attributed this increase to better intelligence and better
    inspections--based on electronic methods such as its Automated
    Targeting System. For more information, see GAO-06-389; GAO-05-372; GAO-
    04-641; Border Security: Investigators Transported Radioactive Sources
    Across Our Nation's Borders at Two Locations, GAO-06-940T; and Maritime
    Security: Observations on Selected Aspects of the SAFE Port Act, GAO-07-
    754T.

    DHS updated information: DHS provided updated information related to
    its implementation of a strategy to detect and interdict illegal flows
    of cargo, drugs, and other items into the United States. In general,
    the Strategic Plan on Securing America's Borders at the Ports of Entry,
    which defines CBP's national strategy at all air, land, and sea ports
    of entry, outlines programs designed to achieve border security
    objectives. CBP's Office of Field Operations has developed a formal
    implementation process to execute the Securing America's Borders at the
    Ports of Entry strategic plan that includes regular senior executive
    participations, steering committee oversight, and the creation of
    Securing America's Borders at the Ports of Entry Implementation
    Division to provide ongoing oversight and coordination of a
    comprehensive development schedule for the Office of Field Operations'
    high priority programs. More specifically, DHS has several programs in
    place to help detect and interdict illegal flows of cargo, drugs, and
    other items into the United States. These programs include the National
    Targeting Center for Cargo, the Automated Targeting System, the Customs-
    Trade Partnership Against Terrorism, the Container Security Initiative,
    deployment of radiation portal monitors, large-scale non-intrusive
    inspection technology, canine enforcement programs, and the Secure
    Freight Initiative.[C] With regard to the National Targeting Center for
    Cargo, CBP reported that this center expands CBP's
    capability to do cargo shipment targeting to provide ports of entry
    with immediate analysis capabilities. With regard to radiation portal
    monitors, as of March 9, 2007, CBP has deployed 966 radiation portal
    monitors to ports of entry. According to CBP, these radiation portal
    monitor deployments provide CBP with the capability to screen
    approximately 91 percent of containerized cargo and 88 percent of
    personally owned vehicles entering the United States. With regard to
    non-intrusive technology, CBP reported deploying about 189 systems and
    is scheduled to have 224 large-scale systems deployed by the end of
    fiscal year 2009. CBP's canine enforcement teams are assigned to 73
    ports of entry and more than 300 detector dog teams were trained in
    fiscal year 2006. DHS provided us with other sensitive data on the
    outputs of its efforts, which we considered in making our assessment.
    Furthermore, according to the Office of Counternarcotics, the
    Implementation Plan for the National Southwest Border Counternarcotics
    Strategy includes recommendations on funding and resource requirements
    and estimated timelines for implementing the National Southwest Border
    Counternarcotics Strategy in fiscal years 2008 through 2011. In
    addition, in fiscal year 2007, DHS plans to increase its Border Patrol
    presence between ports of entry by hiring, training, and deploying
    1,500 additional agents.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken actions to implement various
    programs to detect and interdict illegal flows of goods into the United
    States. For example, DHS has deployed radiation portal monitors and
    large scale non-intrusive detection systems at ports of entry and has
    developed the Container Security Initiative and Customs-Trade
    Partnership Against Terrorism Program. However, we have reported on
    challenges in implementation efforts associated with these programs.
    Moreover, CBP's Securing America's Borders at the Ports of Entry plan
    is still in the early stages of implementation, but once implemented,
    will help CBP detect and interdict illegal flows of goods into the
    United States. Further, the Implementation Plan for the National
    Southwest Border Counternarcotics Strategy has only recently been
    developed. In addition, we considered the sensitive data provided by
    DHS on the outputs of its efforts as well as our prior work in making
    our assessment.

    Assessment: Generally not achieved.

    Performance expectation: 7. Implement effective security measures in
    the visa issuance process.

    Summary of findings: GAO findings: DHS has made progress but still
    faces challenges in its efforts to implement effective security
    measures as part of the visa issuance process.[D] In 2005 we reported
    that DHS had not yet expanded the Visa Security Program as it planned.
    The Visa Security Program is DHS's program to oversee the assigning of
    visa security officers to locations overseas to review visa
    applications. In prior work we reported that DHS had begun supplying
    Visa Security Officers to the U.S. embassy and consulate in Saudi
    Arabia. According to DHS, the Department of State's consular officials,
    and the deputy chief of mission in Saudi Arabia, the Visa Security
    Officers strengthened visa security at these posts. Visa Security
    Officers offer law enforcement and immigration experience and have
    access to and experience using information from law enforcement
    databases, which are not readily available to consular officers. DHS
    planned to expand the Visa Security Program to additional posts
    throughout fiscal years 2005 and 2006, but faced various difficulties
    in its efforts to expand. For example, chiefs of mission at the posts
    chosen for expansion in fiscal year 2005 delayed approval of DHS's
    requests. Embassy and Department of State officials attributed the
    delays to questions about the program's goals, objectives, and staffing
    requirements, as well as DHS's plans to coordinate with existing law
    enforcement and border security staff and programs at post at that
    time. For more information, see Border Security: Actions Needed to
    Strengthen Management of Department of Homeland Security's Visa
    Security Program, GAO-05-801.

    DHS updated information: Since the time of our review, DHS has made
    progress in expanding the Visa Security Program to additional posts;
    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although the department has made some progress
    in expanding the Visa Security Program, the department has reported
    facing similar challenges to those that we previously identified in its
    expansion and implementation efforts and did not provide us with
    evidence that it has fully addressed those challenges.

    Assessment: Generally not achieved.

    Performance expectation: 8. Implement initiatives related to the
    security of certain documents used to enter the United States;
    Summary of findings: GAO findings: DHS has various initiatives related
    to the security of documents used to enter the United States but has
    faced difficulties in implementing these initiatives.[E] With regard to
    the Western Hemisphere Travel Initiative, we reported in May 2006 on
    challenges faced by DHS in implementation. This initiative is DHS's
    program to implement requirements for U.S. citizens and citizens of
    Bermuda, Canada, and Mexico to show a passport or other documents that
    the Secretary of Homeland Security deems sufficient to show identity
    and citizenship to CBP officers when those individuals enter the United
    States from certain countries in North, Central, or South America. We
    reported that alternative programs or documents, such as frequent
    traveler programs and driver's licenses with enhanced security
    features, had various challenges and using them in lieu of a passport
    would not easily resolve the management issues faced by DHS. We
    reported that once decisions are made on what documents will be needed,
    DHS and the Department of State will face challenges in program
    implementation and management. Major challenges would remain in
    developing (1) an implementation plan, (2) budget estimates, (3)
    awareness programs for the public, (4) training programs for DHS staff,
    (5) bilateral coordination with Canada, and (6) a common understanding
    of how the Travel Initiative links to the overall strategy for securing
    the nation's borders. Falling short in any of these areas may hinder
    the ability of the agencies to achieve their goal of improving security
    while facilitating commerce and tourism. According to DHS officials,
    they have formed working groups to take action in each of these areas,
    but much more work remains in developing plans and approaches that
    improve the likelihood of program success; With regard to the Visa
    Waiver Program, the program enables citizens of 27 countries to travel
    to the United States for tourism or business for 90 days or less
    without obtaining a visa. In July 2004, we reported that DHS
    established a Visa Waiver Program Oversight Unit, which completed
    security assessments of the 27 countries that participate in the Visa
    Waiver Program. DHS also submitted a report to Congress summarizing the
    assessment findings. However, we identified several problems with the
    2004 review process, as key stakeholders were not consulted during
    portions of the process, the review process lacked clear criteria and
    guidance to make key judgments, and the final reports were untimely.
    Furthermore, the monitoring unit could not effectively achieve its
    mission to monitor and report on ongoing law enforcement and security
    concerns in visa waiver countries due to insufficient resources. In
    September 2006 we testified that while DHS had taken some actions to
    mitigate the program's risks, the department faced difficulties in
    further mitigating these risks. In particular, the department had not
    established time frames and operating procedures regarding timely
    stolen passport reporting--a program requirement since 2002.
    Furthermore, DHS sought to require the reporting of lost and stolen
    passport data to the United States and the International Criminal
    Police Organization, but it had not issued clear reporting guidelines
    to participating countries; With regard to the Immigration Advisory
    Program, this pilot program is designed to increase the level of
    scrutiny given to the travel documents of certain high-risk passengers
    before they board international flights traveling to the United States.
    Under this program, CBP assigns officers to selected foreign airports
    where they utilize an automated risk-targeting system that identifies
    passengers as potentially high-risk--including passengers who do not
    need a visa to travel to the United States. CBP officers then
    personally interview some of these passengers and evaluate the
    authenticity and completeness of these passengers' travel documents.
    CBP has reported several successes through the Immigration Advisory
    Program pilot. According to CBP documents, from the start of the
    program in June 2004 through February 2006, Immigration Advisory
    Program teams made more than 700 no-board recommendations for
    inadmissible passengers and intercepted approximately 70 fraudulent
    travel documents. However, in May 2007 we reported that CBP had not
    taken all of the steps necessary to fully learn from its pilot sites in
    order to determine whether the program should be made permanent and the
    number of sites that should exist. These steps are part of a risk
    management approach to developing and evaluating homeland security
    programs; In addition, in prior work our agents have attempted to
    enter the United States using fictitious documents. Our periodic tests
    since 2002 clearly showed that CBP officers were unable to effectively
    identify counterfeit driver's licenses, birth certificates, and other
    documents. Specifically, in 2003 our agents were able to easily enter
    the United States from Canada and Mexico using fictitious names and
    counterfeit driver's licenses and birth certificates. Later in 2003 and
    2004, we continued to be able to successfully enter the United States
    using counterfeit identification at land border crossings, but were
    denied entry on one occasion. In 2006, the results of our work
    indicated that CBP officers at the nine land border crossings we tested
    at that time did not detect the counterfeit identification we used. At
    the time of our review, CBP agreed that its officers were not able to
    identify all forms of counterfeit identification presented at land
    border crossings and fully supported the Western Hemisphere Travel
    Initiative that will require all travelers to present a passport before
    entering the United States. We did not assess whether this initiative
    would be effective in preventing terrorists from entering the United
    States or whether it would fully address the vulnerabilities shown by
    our work. We have ongoing work assessing the Western Hemisphere Travel
    Initiative and the use of fraudulent travel documents. For more
    information, see GAO-07-248; Border Security: Stronger Actions Needed
    to Assess and Mitigate Risks of the Visa Waiver Program, GAO-06-854;
    Observations on Efforts to Implement the Western Hemisphere Travel
    Initiative on the U.S. Border with Canada, GAO-06-741R; Border
    Security: Consular Identification Cards Accepted within United States,
    but Consistent Federal Guidance Needed, GAO-04-881; Aviation Security:
    Efforts to Strengthen International Passenger Prescreening Are Under
    Way, but Planning and Implementation Issues Remain, GAO-07-346; and
    Border Security: Continued Weaknesses in Screening Entrants into the
    United States, GAO-06-976T.

    DHS updated information: According to updated information provided by
    DHS, CBP has undertaken a variety of efforts associated with the
    security of documents used to enter the United States. These efforts
    include implementation of the Western Hemisphere Travel Initiative in
    the air environment; enhancements to the Visa Waiver Program; increased
    access to lost and stolen passport information from multiple sources;
    introduction of the Fraudulent Documents Analysis Unit, which issues
    notices to the field regarding detection of fraudulent documents; and
    training of carrier agents overseas in documentary requirements and
    fraudulent document detection. With regard to the Western Hemisphere
    Travel Initiative, since January 23, 2007, all U.S. citizens and
    nonimmigrant aliens from Canada, Bermuda and Mexico entering the United
    States from within the Western Hemisphere at air ports of entry are
    required to present a valid passport. CBP has reported more than 99
    percent compliance with these requirements at air ports of entry. DHS
    stated that the department is working toward implementation of the
    Western Hemisphere Travel Initiative for travelers entering the United
    States through land and sea ports of entry, and in June 2007 announced
    the Notice of Proposed Rulemaking for the land and sea portions. U.S.
    and Canadian citizens entering the United States from within the
    Western Hemisphere at land and sea ports currently may make a verbal
    declaration of citizenship or present a myriad of forms and documents
    to enter the country such as birth certificates and drivers' licenses.
    On June 8, 2007, because of delays in processing applications for U.S.
    passports, U.S. citizens traveling to Canada, Mexico, the Caribbean,
    and Bermuda who have applied for but not yet received passports can
    temporarily enter and depart from the United States by air with a
    government issued photo identification and Department of State official
    proof of application for a passport through September 30, 2007. With
    regard to fraudulent documents, CBP reported that it has electronic
    copies of all U.S.-issued travel and citizenship documents, with the
    exception of U.S.-issued passports, which CBP is working to gain access
    to with the Department of State. When travelers apply for admission at
    a port of entry, CBP officers are to scan the document presented by the
    travelers to help minimize the risk of photograph substitution on the
    documents and the use of canceled travel documents. Over 4,400 CBP
    officers have access to the Department of State Consolidated Consular
    Database, which allows officers to view unique visa information. During
    2006, CBP stated that it provided ports of entry with the highest rate
    of fraudulent document interceptions with comprehensive document
    examination workstations to better equip them with the ability to
    examine questioned documents presented for entry to the United States.
    According to CBP, workstations have been deployed at 11 ports of entry,
    where the equipment improves the ability of officers to thoroughly
    inspect documents to detect forgeries. CBP reported that its Fraudulent
    Document Analysis Unit received 40,362 fraudulent documents from the
    ports of entry during fiscal year 2006. Of this number, there were
    7,252 passports from 84 countries, the majority of which were issued by
    Mexico and the United States. CBP also reported that it has deployed
    ePassport readers to 200 primary inspection lanes at the 33 largest
    airports to enhance document verification. With regard to lost and
    stolen passports, DHS reported that it has a real-time interface with
    the State Department that provides data on all lost or stolen passports
    reported to the State Department, both United States and foreign. CBP
    noted that the programs mentioned above are used in conjunction with
    US-VISIT fingerprinting of non-U.S. citizens and resident aliens to
    provide a biometric authentication of the document-bearers' identity
    and verification of documents' validity. With regard to the Immigration
    Advisory Program, DHS has issued a strategic plan for fiscal years 2007
    through 2012.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken actions related to the security
    of certain documents used to enter the country by, for example,
    implementing the Western Hemisphere Travel Initiative at air ports of
    entry. However, we have reported on management challenges faced by DHS
    with regard to the Western Hemisphere Travel Initiative and, although
    the requirement for implementing the initiative is not until 2009, we
    reported that the Departments of Homeland Security and State have a
    long way to go to implement their proposed plans, and the time to get
    the job done has been slipping by. We have also reported on risks and
    challenges faced by DHS with regard to the Visa Waiver Program, such as
    the timely reporting of stolen passports, and DHS did not provide us
    with evidence that it has taken actions to fully address these risks
    and challenges. Furthermore, while DHS has made progress in deploying
    document examination workstations and ePassport readers to lanes at
    ports of entry, DHS did not provide us with evidence that it has yet
    determined proposed locations for deploying additional workstations. In
    addition, DHS has not yet fully used a risk management approach in
    implementing its Immigration Advisory Program.

    Assessment: Generally not achieved.

    Performance expectation: 9. Provide adequate training for all border
    related employees; Summary of findings: GAO findings: DHS has taken
    steps to provide training to border security personnel. In September
    2005, we reported that the creation of CBP within DHS merged border
    inspection functions at U.S. ports of entry, which had previously been
    performed by three separate agencies. We reported that the "One Face at
    the Border," initiative created the positions of CBP officer and CBP
    agriculture specialist and combined aspects of three former inspector
    functions. CBP created a series of training courses to provide former
    U.S. Customs and former Immigration and Naturalization Service officers
    with the knowledge and skills necessary to carry out the
    responsibilities of this new position. In addition, CBP officers
    received training to meet CBP's new mission priority of terrorism
    prevention. Because agricultural inspections were more specialized, CBP
    officers received training sufficient to enable them to identify
    potential agricultural threats, make initial regulatory decisions, and
    determine when to make referrals to CBP agriculture specialists. We
    reported that CBP emphasized on-the-job training in an effort not to
    place officers on the job without direct supervisory and tutorial
    backup. CBP's main strategy to prepare for field delivery of training
    was to provide extensive train-the-trainer courses so that trainers
    could return to their field sites and instruct officers there. We
    reported that change had not come about without challenges, as many
    officers were reported to have resisted changes to their
    responsibilities, mainly related to the difficulties in learning a new
    set of procedures and laws. Officials noted that there has been an
    enormous amount of required training for CBP officers, and it could
    sometimes be overwhelming. For former officers, in addition to
    completing an extensive cross-training schedule and new training
    related to terrorism prevention, there were many other required courses
    related to their mission. We reported that although staffing challenges
    may ultimately have been relieved with trained officers able to perform
    dual inspections, officials noted that it had been extremely difficult
    to take staff off-line to complete the "One Face at the Border"
    training. In March 2007, we reported that Border Patrol's basic
    training program exhibited attributes of an effective training program.
    However, we also reported while Border Patrol officials were confident
    that the academy could accommodate the large influx of new trainees
    anticipated over the next 2 years, they have expressed concerns over
    the sectors' ability to provide sufficient field training. For example,
    officials were concerned with having a sufficient number of experienced
    agents available in the sectors to serve as field training officers and
    first-line supervisors. We reported that the Border Patrol is
    considering several alternatives to improve the efficiency of basic
    training delivery and to return agents to the sectors more quickly. For
    example, the Border Patrol is pilot-testing a proficiency test for
    Spanish that will allow those who pass the test to shorten their time
    at the academy by about 30 days. However, we concluded that the Border
    Patrol's plan to hire an unprecedented number of new agents over the
    next 2 years could strain the sectors' ability to provide adequate
    supervision and training. Moreover, the field training new agents
    receive has not been consistent from sector to sector, a fact that has
    implications for how well agents perform their duties. To ensure that
    these new agents become proficient in the safe, effective, and ethical
    performance of their duties, it will be extremely important that new
    agents have the appropriate level of supervision and that the Border
    Patrol has a standardized field training program. For more information,
    see Department of Homeland Security: Strategic Management of Training
    Important for Successful Transformation, GAO-05-888 and Homeland
    Security: Information on Training New Border Patrol Agents, GAO-07-
    540R.

    DHS updated information: In May 2007, DHS provided us with updated
    information on its efforts to provide training for border security
    personnel. Specifically, CBP reported that it has implemented a plan to
    hire and train 3,900 Border Patrol agents in fiscal year 2007; 4,800
    agents in fiscal year 2008; and 850 agents in the first quarter of
    fiscal year 2009. CBP, working with the Federal Law Enforcement
    Training Center, reported making various modifications to the Border
    Patrol basic training program to accommodate the volume of new
    trainees. CBP also reported that it is designing its post-Academy
    training to align with the new Academy program and to use the 2-year
    Federal Career Intern Program. In addition, CBP has an annual call for
    training and uses a National Training Plan and a Training Advisory
    Board to determine ongoing basic and advanced training requirements.
    Post-Academy training for Border Patrol Agents includes a structured
    academic program with two pass or fail probationary exams, and Border
    Patrol local offices provide agents with area-specific training through
    the Border Patrol Field Training Program. Post-Academy training for CBP
    officers working at ports of entry feature classroom, online, and on-
    the-job experiences linked to the job that the individual CBP officer
    will perform in his or her home duty post. According to CBP, CBP
    provides in-depth, task-based training to CBP officers that address
    tasks that the CBP officer will be called on to perform. In addition,
    CBP provides "cross-training" to officers from the former U.S.
    Immigration and Naturalization Service or Customs Services based on
    operational requirements.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. CBP has established and implemented programs
    for training its border security personnel. With regard to basic
    training, we previously reported that Border Patrol's basic training
    program exhibited attributes of an effective training program. CBP also
    uses a National Training Plan and a Training Advisory Board to
    determine training requirements. However, in prior work we reported on
    various challenges in CBP's provision and adequacy of field-based
    training. For example, with regard to Border Patrol agents, we reported
    that the field training new agents receive has not been consistent from
    sector to sector, which has implications for how well agents perform
    their duties. In addition, we identified concerns regarding CBP's
    capacity to provide training to the projected large influx of new
    Border Patrol agents over the next 2 years.

    Assessment: Generally achieved.

    Performance expectation: 10. Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's border
    security mission.

    Summary of findings: GAO findings: CBP has taken actions to develop
    staffing plans for hiring and allocating human capital resources to
    fulfill the agency's border security mission. In July 2005 we reported
    that CBP had taken steps to increase management flexibility in
    assigning staff to inspection functions and improve staff allocation in
    an effort to minimize passenger wait times and ensure the most
    efficient use of existing staff at airports. We reported that CBP had
    introduced its "One Face at the Border" program to increase staffing
    flexibility so that staff could conduct different types of inspections
    within airports. We also reported that CBP was developing a national
    staffing model to more systematically allocate existing staff levels at
    airports nationwide, however, the model did not address weaknesses
    identified in Customs' and U.S. Immigration and Naturalization
    Service's staffing models in our and the Department of Justice
    Inspector General's previous audit work. In February 2006, we reported
    that for program acquisitions like the America's Shield Initiative to
    be successful, DHS needed to, among other things, have adequate staff
    to fill positions that have clearly defined roles and responsibilities
    and that it had not fully staffed the America's Shield Initiative
    program office. One criticism we had of the former U.S. Immigration and
    Naturalization Service was that because of staffing shortages, mission
    staff often had to assume administrative or other functions as a
    collateral duty. One effect of assigning mission staff to
    administrative work was that they were not spending all of their time
    on duties needed to accomplish the program's mission and thus were not
    reaching the full potential of the program position. In 2005 we found
    that this was a problem in some offices. Some officials we contacted in
    CBP said they had to use mission staff in this way because they did not
    have enough administrative support to compensate for the realignment of
    administrative staff to shared services, the addition of mission
    personnel that came as a result of mergers of some programs in the
    transition, and hiring freezes. As a result, officers, adjudicators,
    and investigators in some field offices were taking on administrative
    work full-time or as a collateral duty. For more information, see GAO-
    06-295 and Homeland Security: Management Challenges Remain in
    Transforming Immigration Programs, GAO-05-81.

    DHS updated information: In May 2007, DHS provided us with data on
    CBP's fiscal year 2007 hiring projections and documentation of its
    staffing models for various positions within CBP, such as CBP officers
    and Border Patrol agents. Information on these staffing models is
    sensitive; Our assessment: We conclude that DHS has generally achieved
    this performance expectation. DHS has developed staffing models and
    plans for border security personnel.

    Assessment: Generally achieved.

    Performance expectation: 11. Ensure adequate infrastructure and
    facilities.

    Summary of findings: GAO findings: DHS has not yet satisfactorily
    ensured that CBP inspectors and Border Patrol have adequate
    infrastructure and facilities to support their activities. CBP Field
    Operations maintains programs at 20 field operations offices and 327
    ports of entry, of which 15 are pre-clearance stations in Canada and
    the Caribbean. Border Patrol agents are assigned to patrol more than
    6,000 miles of the nation's land borders and are coordinated through 20
    sectors. CBP's facilities and tactical infrastructure portfolio
    consisted of CBP-owned and leased facilities and real estate; temporary
    structures, such as modular buildings for rapid deployment and
    temporary base camps; and other tactical infrastructure, such as
    fences, lights, and barriers. Additionally, CBP owned and maintained a
    motor vehicle fleet; a variety of aircraft including fixed wing
    aircraft, helicopters, and unmanned aerial vehicles; and different
    types of marine vessels such as hovercrafts, airboats, and high-speed
    interceptors. Further, the agency acquired different types of scanning
    and detection equipment, such as large-scale x-ray and gamma-imaging
    systems, nuclear and radiological detection equipment, as well as a
    variety of portable and hand-held devices. In February 2007, we
    reported that CBP's capital planning process was evolving and not yet
    mature. Although the agency has established a review and approval
    framework that required documentation to (1) describe how a proposed
    capital project supports the agency's strategic goals and (2) identify
    the mission need and gap between current and required capabilities, we
    were unable to verify implementation of these practices due to a lack
    of non-information technology examples. Additionally, we reported that
    CBP has not developed a comprehensive, agencywide, long-term capital
    plan, although it produced several documents that included some
    elements of such a plan. For land ports of entry, CBP implemented a
    capital investment planning process to ensure that facility and real
    property funding is allocated in a manner that supports critical
    facility projects. CBP piloted the capital investment planning process
    and the strategic resource assessments on the land port of entry. In
    December 2006, we reported that with regard to US-VISIT going forward,
    DHS plans to introduce changes and enhancements to US-VISIT at land
    ports of entry, including a transition from digitally scanning 2
    fingerprints to 10. While such changes are intended to further enhance
    border security, deploying them may have an impact on aging and space-
    constrained land ports of entry facilities because they could increase
    inspection times and adversely affect port of entry operations.
    Moreover, our previous work showed that the US-VISIT program office had
    not taken necessary steps to help ensure that US-VISIT entry capability
    operates as intended. For example, in February 2006 we reported that
    the approach taken by the US-VISIT program office to evaluate the
    impact of US-VISIT on land port of entry facilities focused on changes
    in I-94 processing time at 5 ports of entry and did not examine other
    operational factors, such as US-VISIT's impact on physical facilities
    or work force requirements. As a result, program officials did not
    always have the information they needed to anticipate problems that
    occurred, such as problems processing high volumes of visitors in space
    constrained facilities. For more information please see GAO-07-248 and
    Federal Capital: Three Entities' Implementation of Capital Planning
    Principles is Mixed. GAO-07-274.

    DHS updated information: In May 2007, DHS provided updated information
    outlining steps it has and is taking to improve land ports of entry
    inspection and Border Patrol facilities so they effectively meet
    mission requirements. CBP plans to extend the methodology piloted on
    land ports of entry to air and sea ports of entry by the end of 2007.
    According to DHS, its fiscal year 2007 to 2011 Construction Spending
    Plan includes a rapid response component to address urgent facility
    requirements for the 6,000 new Border Patrol agents who will be
    deployed between fiscal year 2007 and December 2008 as well as the
    existing facility gap for 3,400 currently deployed agents. According to
    DHS, the focus of the rapid response effort is the Border Patrol
    Stations, which will accommodate the vast majority of new agents.
    Border Patrol sector headquarters, checkpoints, horse stables, and
    remote processing facilities are included in CBP's investment strategy,
    but not in the rapid response solutions since they are minimally
    affected by the increase in deployment.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. According to DHS, there is an existing
    facility gap for 3,400 currently deployed Border Patrol agents, and
    although DHS is planning a rapid response to a legislative mandate
    requiring a large staffing increase by the end of 2008, DHS has not yet
    sufficiently increased infrastructure and facilities. Furthermore, as
    we previously reported, DHS's capital investment planning process is
    not yet mature and has only been piloted at the land ports of entry. In
    addition, with regard to US-VISIT, we reported on various
    infrastructure-related difficulties which could affect effective
    implementation of the program.

    Assessment: Generally not achieved.

    Performance expectation: 12. Leverage technology, personnel, and
    information to secure the border.

    Summary of findings: GAO and DHS IG findings: DHS has worked to
    leverage its resources to secure the border, but has faced challenges
    in doing so. For example, CBP's Interagency Border Inspection System
    has sought to improve screening of travelers entering the United States
    at ports of entry by utilizing terrorist information that the National
    Terrorist Screening Center gathers and consolidates. The DHS IG
    reported, though, that the name-based watch lists that this system
    utilizes had been prone to repeated false hits for the same individual
    on different trips, a situation that results in CBP officers conducting
    secondary inspections of the travelers every time they enter the United
    States, an inefficient use of the officers' time. In addition, in
    December 2006 we reported that DHS has not yet articulated how US-VISIT
    is to strategically fit with other land-border security initiatives and
    mandates, and thus cannot ensure that these programs work in harmony to
    meet mission goals and operate cost effectively. We noted that agency
    programs need to properly fit within a common strategic context
    governing key aspects of program operations, such as what functions are
    to be performed, what facility or infrastructure changes will be needed
    to ensure that they operate in harmony and as intended, and what
    standards govern the use of technology. We reported that until
    decisions on DHS's border security initiatives are made, it remains
    unclear how programs will be integrated with US-VISIT, if at all--
    raising the possibility that CBP would be faced with managing differing
    technology platforms and border inspection processes at each land port
    of entry. We reported that knowing how US-VISIT is to work in concert
    with other border security and homeland security initiatives and what
    facility or facility modifications might be needed could help Congress,
    DHS, and others better understand what resources and tools are needed
    to ensure success. For more information, see GAO-07-248 and Terrorist
    Watch List Screening: Efforts to Help Reduce Adverse Effects on the
    Public, GAO-06-1031. Also, see Department of Homeland Security Office
    of Inspector General, Review of CBP Actions Taken to Intercept
    Suspected Terrorists at U.S. Ports of Entry, OIG-06-43 (Washington,
    D.C.: June 2006).

    DHS updated information: In April 2007, DHS reported that its
    interagency Border Inspection System and US-VISIT are well integrated
    at air, sea and land border ports. According to CBP, CBP officers at
    these ports of entry are able to screen travelers against both
    biographic and biometric watch lists in addition to verifying
    identities and travel documents. CBP reported that false hits on watch
    lists have been addressed with an enhancement that allows port
    personnel to identify the subjects if false hits in the system to
    prevent hits on subsequent trips. US-VISIT and other border and port
    systems utilize the same architecture and infrastructure to minimize
    costs and promote information sharing. Additionally, DHS stated that
    the Secure Border Initiative Strategic Plan is bringing clarity of
    mission, effective coordination of DHS assets, and greater
    accountability to the work of DHS in securing the nation's borders.
    Moreover, according to DHS, Operation Streamline, launched in December
    2005, is a coordinated effort among CBP, ICE, and the Department of
    Justice to create a zero tolerance zone for illegal entries in the Del
    Rio Office of Border Patrol sector. Beginning with a 5 mile stretch of
    the border, Operation Streamline now spans the entire 210 mile Del Rio
    Sector Border.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although DHS has taken some actions to
    leverage technology, personnel, and information to secure the border,
    such as using watch lists, more work remains. For example, it is still
    unclear how US-VISIT will work with other border security initiatives,
    including the Secure Border Initiative. While the Secure Border
    Strategic Plan provides some information on how the various border
    security initiatives relate, the plan does not fully describe how these
    initiatives will interact once implemented. In addition, the further
    development and implementation of SBInet will be key to DHS efforts in
    achieving this performance expectation, but SBInet is still in the
    early phases of implementation.

    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [A] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in developing a strategy to detect and
    interdict illegal flows of goods in the country. This performance
    expectation is focused on DHS's roles and responsibilities in
    developing a strategy for detecting and interdicting illegal flows of
    goods into the United States.

    [B] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in detecting and interdicting illegal
    flows of goods in the country. This performance expectation is focused
    on DHS's roles and responsibilities in implementing a strategy for
    detecting and interdicting illegal flows of goods into the United
    States. We address cargo security in the context of maritime security
    in a later section of this report.

    [C] We address those programs related to maritime cargo security, for
    example the Customs-Trade Partnership Against Terrorism and the
    Container Security Initiative, in a later section of this report.

    [D] In addition to DHS, other agencies, such as the Department of
    State, have a role to play in implementing effective security measures
    in the visa issuance process. This performance expectation is focused
    on DHS's roles and responsibilities in implementing effective security
    measures in the visa issuance process--namely the Visa Security
    Program.

    [E] Other agencies, such as the Department of State, have
    responsibilities for enhancing the security of documents used to enter
    the United States.

    [End of table]

    DHS Has Made Moderate Progress in Immigration Enforcement:

    DHS is responsible for enforcing U.S. immigration laws. Immigration
    enforcement includes apprehending, detaining, and removing criminal and
    illegal aliens; disrupting and dismantling organized smuggling of
    humans and contraband as well as human trafficking; investigating and
    prosecuting those who engage in benefit and document fraud; blocking
    and removing employers' access to undocumented workers; and enforcing
    compliance with programs to monitor visitors. Within DHS, ICE is
    primarily responsible for immigration enforcement efforts. In
    particular, ICE's Office of Investigations is responsible for enforcing
    immigration and customs laws and its Office of Detention and Removal
    Operations is responsible for processing, detaining, and removing
    aliens subject to removal from the United States.

    As shown in table 18, we identified 16 performance expectations for DHS
    in the area of immigration enforcement, and we found that overall DHS
    has made moderate progress in meeting those expectations.[Footnote 23]
    Specifically, we found that DHS has generally achieved 8 of the
    performance expectations and has generally not achieved 4 other
    performance expectations.[Footnote 24] For 4 performance expectations,
    we could not make an assessment. In meeting its performance
    expectations, ICE faced budget constraints that significantly affected
    its overall operations during fiscal year 2004. For example, ICE was
    faced with a hiring freeze in fiscal year 2004 that affected its
    ability to recruit, hire, and train personnel. Over the past 2 years,
    ICE has reported taking actions to strengthen its immigration
    enforcement functions and has, for example, hired and trained
    additional personnel to help fulfill the agency's mission.

    Table 18: Performance Expectations and Progress Made in Immigration
    Enforcement:

    Performance expectation: 1. Develop a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States.
    Assessment: Generally achieved.

    Performance expectation: 2. Implement a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States.
    Assessment: Generally not achieved.

    Performance expectation: 3. Ensure the removal of criminal aliens.
    Assessment: Generally not achieved.

    Performance expectation: 4. Assess and prioritize the use of alien
    detention resources to prevent the release of aliens subject to
    removal.
    Assessment: Generally achieved.

    Performance expectation: 5. Develop a program to allow for the secure
    alternative detention of noncriminal aliens.
    Assessment: Generally achieved.

    Performance expectation: 6. Implement a program to allow for the secure
    alternative detention of noncriminal aliens.
    Assessment: No assessment made.

    Performance expectation: 7. Develop a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed.
    Assessment: Generally achieved.

    Performance expectation: 8. Implement a prioritized worksite
    enforcement strategy to ensure that only authorized workers are
    employed.
    Assessment: Generally not achieved.

    Performance expectation: 9. Develop a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States.
    Assessment: Generally achieved.

    Performance expectation: 10. Implement a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States.
    Assessment: Generally not achieved.

    Performance expectation: 11. Develop a law enforcement strategy to
    combat criminal alien gangs in the United States and cross-border
    criminal activity.
    Assessment: Generally achieved.

    Performance expectation: 12. Implement a law enforcement strategy to
    combat criminal alien gangs in the United States and cross-border
    criminal activity.
    Assessment: No assessment made.

    Performance expectation: 13. Disrupt and dismantle mechanisms for money
    laundering and financial crimes.
    Assessment: No assessment made.

    Performance expectation: 14. Develop a program to screen and respond to
    local law enforcement and community complaints about aliens who many be
    subject to removal.
    Assessment: Generally achieved.

    Performance expectation: 15. Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's immigration
    enforcement mission.
    Assessment: Generally achieved.

    Performance expectation: 16. Provide training, including foreign
    language training, and equipment for all immigration enforcement
    personnel to fulfill the agency's mission.
    Assessment: No assessment made.

    Performance expectation: Total;
    Assessment: Generally achieved: 8;
    Assessment: Generally not achieved: 4;
    Assessment: No assessment made: 4.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 19 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of immigration enforcement and our assessment of whether DHS
    has taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 19: Performance Expectations and Assessment of DHS Progress in
    Immigration Enforcement:

    Performance expectation: 1. Develop a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States.

    Summary of findings: GAO and DHS IG findings: DHS has taken actions to
    develop programs to help ensure the timely identification and removal
    of noncriminal aliens subject to removal from the United States. In
    June 2003, ICE established the Compliance Enforcement Unit to reduce
    the number of aliens who had violated the terms of certain types of
    visas and were residing in the United States. According to the DHS IG,
    the National Security Entry-Exit Registration System, the Student and
    Exchange Visitor System, and the United States Visitor and Immigrant
    Status Indicator Technology identify visa violators. These three
    systems are designed to track a specific segment of the nonimmigrant
    population and provide ICE with information concerning visa overstays.
    The DHS IG reported that when compliance violations were identified,
    enforcement actions must identify, locate, and apprehend violators.
    Once apprehended, violators must be detained, adjudicated, and removed.
    We have ongoing work assessing DHS guidelines for removing aliens from
    the United States who are subject to removal. For more information, see
    Department of Homeland Security Office of Inspector General, Review of
    the Immigration and Customs Enforcement's Compliance Enforcement Unit,
    OIG-05-50 (Washington, D.C: September 2005); Detention and Removal of
    Illegal Aliens, OIG-06-33 (Washington, D.C.: April 2006); An Assessment
    of United States Immigration and Customs Enforcement's Fugitive
    Operations Teams, OIG-07-34 (Washington, D.C.: March 2007); and Review
    of U.S. ICE's Detainee Tracking Process, OIG-07-08 (Washington, D.C.:
    November 2006).

    DHS updated information: In March, April, and May 2007, ICE provided
    updated information on its efforts to ensure the timely identification
    and removal of aliens subject to removal from the United States. ICE
    established the National Fugitive Operations Program in fiscal year
    2003 to reduce the number of fugitive aliens in the United States and
    established the Fugitive Operations Support Center in June 2006 to aid
    in accounting for and reporting on the U.S. fugitive alien population,
    reviewing cases in ICE's Deportable Alien Control System, developing
    targeted field operational initiatives, assessing national absconder
    data, and providing comprehensive leads and other support to field
    offices. ICE reported establishing fiscal year goals for the Fugitive
    Operations Teams located throughout its field offices. Each field
    office, based on the number of teams located within its area of
    operational responsibility, is expected to arrest 1,000 fugitive
    targets and targets' associates. Furthermore, the Fugitive Operations
    Support Center has a goal of eliminating another 26,000 fugitive cases
    annually as a result of data integrity updates to ICE's Deportable
    Alien Control System.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation as DHS has taken actions to develop a program
    to ensure the timely identification and removal of aliens subject to
    removal from the United States.

    Assessment: Generally achieved.

    Performance expectation: 2. Implement a program to ensure the timely
    identification and removal of noncriminal aliens subject to removal
    from the United States.

    Summary of findings: GAO and DHS IG findings: Various factors have
    affected DHS's efforts to identify and remove noncriminal aliens
    subject to removal from the United States in a timely manner. According
    to the DHS IG, in recent years the number of "other than Mexican"
    aliens that DHS has apprehended has been rising, and such aliens have
    consumed more ICE resources because they cannot simply be returned over
    the border. In April 2006, the DHS IG found that Detention and Removal
    Operations was unable to ensure the departure from the United States of
    all removable aliens. In April 2006, the DHS IG reported that of the
    774,112 illegal aliens apprehended during the prior 3 years, 280,987
    (36 percent) were released largely due to a lack of personnel, bed
    space, and funding needed to detain illegal aliens while their
    immigration status was being adjudicated. The DHS IG noted that their
    release presented a significant risk due to the inability of CBP and
    ICE to verify the identity, country of origin, and terrorist or
    criminal affiliation of many of the aliens being released. Further, the
    DHS IG reported that the declining personnel and bed space level was
    occurring when the number of illegal aliens apprehended was increasing.
    The DHS IG stated that even though the Detention and Removal Operations
    had received additional funding and enhanced its Fugitive Operations
    Program, it was unlikely that many of the released aliens would ever be
    removed. ICE has encountered trouble deporting other than Mexican
    aliens because it has to first obtain travel documents from the aliens'
    countries of origin in order to repatriate them, and some countries
    have been unwilling to issue these documents. The DHS IG found that
    this unwillingness on the part of the countries of origin to issue
    travel documents created a "mini-amnesty" program for some aliens and
    also encouraged aliens to enter the United States illegally if they
    knew that their countries did not cooperate. DHS reported that it was
    working with the Department of State to address travel documents and
    related issues preventing or impeding the repatriation of aliens,
    particularly to Central and South American countries. However, the DHS
    IG reported that these efforts had yet to fully address the potential
    national security and public safety risks associated with DHS's
    inability to remove tens of thousands of illegal aliens. In addition,
    in March 2007, the DHS IG reported on DHS's National Fugitive
    Operations Program. The purpose of the program is to identify, locate,
    apprehend, and remove aliens--both criminal and noncriminal--who have
    unexecuted final orders of removal. This program analyzes data
    contained in various systems, such as the Student and Exchange Visitor
    Information System that contains information on international students
    and exchange visitors, to identify those who may have violated their
    terms of entry or who might otherwise pose a threat to national
    security. The DHS IG found that the backlog of fugitive aliens
    increased despite Fugitive Operation Teams' efforts and that the teams'
    efforts were hampered by insufficient detention capacity; database
    limitations; and inadequate working space. Additionally, the DHS IG
    reported that the removal rate of fugitive aliens apprehended by the
    teams could not be determined. The DHS IG noted that progress had been
    made in staffing the teams and that the teams had effective
    partnerships with federal, state, and local agencies. We have ongoing
    work assessing DHS guidelines for removing aliens from the United
    States who are subject to removal. For more information, see Department
    of Homeland Security Office of Inspector General, Detention and Removal
    of Illegal Aliens, OIG-06-33 (Washington, D.C.: April 2006); An
    Assessment of United States Immigration and Customs Enforcement's
    Fugitive Operations Teams, OIG-07-34 (Washington, D.C.: March 2007);
    and Review of U.S. ICE's Detainee Tracking Process, OIG-07-08
    (Washington, D.C.: November 2006).

    DHS updated information: In March, April, and May 2007, ICE provided
    data on the results of its efforts to implement a program to ensure the
    timely identification and removal of aliens subject to removal from the
    United States. According to DHS, under the Secure Border Initiative,
    DHS has ended "catch and release" of non-Mexican nationals apprehended
    at or near U.S. borders. DHS stated that it remains committed to a
    "catch and return" regime, ensuring that no alien is released due to
    lack of detention capacity in fiscal years 2006 and 2007. DHS also
    reported that the average length of time spent in detention by an alien
    during removal proceedings has generally decreased from about 41.5 days
    in fiscal year 2002 to about 33.7 days as of August 31, 2006. However,
    ICE reported that during the first 5 months of fiscal year 2007, the
    average length of stay increased to 38.5 days. ICE officials noted that
    various factors can affect the average length of stay, such as the
    unwillingness of foreign countries to issue travel documents and the
    type of proceeding in which an alien is placed (e.g., expedited removal
    or a full hearing).[A] ICE also stated that increased use of electronic
    travel documents and video teleconferencing have helped reduce delays
    that have contributed to longer periods of detention. ICE officials
    noted that decisions by foreign countries to refuse or delay issuance
    of travel documents are outside the control of DHS, and ICE has
    stationed a full-time liaison officer at the Department of State to
    help improve relations with the Department of State and foreign
    countries. ICE reported that it has improved relations with Central
    American countries in particular regarding the issuance of travel
    documents and noted, for example, that El Salvador, Guatemala, and
    Honduras--which are among the countries with the highest number of
    removals from the United States--have agreed to use ICE's Electronic
    Travel Document System. With regard to its National Fugitive Operations
    Program, ICE reported that at the end of fiscal year 2006, it had
    deployed 50 Fugitive Operations Teams nationwide and noted that 75 such
    teams have been fully funded for fiscal year 2007. Additional
    information reported by ICE on its effort to identify and remove
    criminal aliens from the United States is provided under the next
    performance expectation; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. DHS has undertaken
    efforts to ensure the timely identification of aliens subject to
    removal from the United States and provided us with data on its
    efforts, including data on the number of removable aliens arrested. DHS
    also provided us with data on the average length of time spent in
    detention by aliens during removal proceedings. While the average
    length of stay has generally decreased over time, DHS still faces
    difficulties in ensuring the removal of all aliens subject to removal
    from the United States in a timely manner. First, the average length of
    stay for an alien in detention between October 2006 and the end of
    February 2007 has increased from the fiscal year 2006 level; it remains
    to be seen whether the average of length of stay in fiscal year 2007
    will increase, decrease, or stay the same as the fiscal year 2006
    level. Second, the DHS IG reported that DHS has faced difficulties in
    removing aliens from the United States because of the unwillingness of
    some countries to provide the necessary travel documents, a
    circumstance that may be outside of DHS's control but that DHS has
    implemented efforts to help address, such as negotiating memoranda of
    understanding with foreign countries. DHS has finalized memorandum of
    understanding with three countries, and is working with other countries
    to expand use of the Electronic Travel Document System. Nevertheless,
    as previously suggested by the DHS IG, these efforts may not yet fully
    address the potential national security and public safety risks
    associated with DHS's inability to remove tens of thousands of illegal
    aliens. Third, DHS has faced challenges in identifying aliens for
    removal from the United States and, according to the DHS IG, the
    fugitive alien population appears to be growing at a rate that exceeds
    Fugitive Operations Teams' ability to apprehend.

    Assessment: Generally not achieved.

    Performance expectation: 3. Ensure the removal of criminal aliens.

    Summary of findings: GAO and DHS IG findings: Our work and the DHS IG's
    work have shown that DHS has faced difficulties in its efforts to
    ensure the removal of criminal aliens from the United States. In
    October 2004 we reported that although the legacy U.S. Immigration and
    Naturalization Service was to identify and remove criminal aliens as
    they came out of federal and state prison systems, it had failed to
    identify all removable imprisoned criminal aliens. Some who were
    released from prison committed and were convicted of new felonies. At
    that time, ICE Detention and Removal Operations officials, who took
    over the program from the Immigration and Naturalization Service,
    stated that they were taking steps to ensure the departure of all
    removable aliens. For example, they established fugitive operations
    teams. In April 2006, the DHS IG also reported that the expansion of
    the Criminal Alien Program, which identifies and processes criminal
    aliens incarcerated in federal, state, and local correctional
    institutions and jails who have no legal right to remain in the United
    States after serving out their sentence, would create more demands for
    the Detention and Removal Operations to detain, process, and remove
    illegal aliens. The DHS IG concluded that DHS and ICE needed to ensure
    that any planned increase in the Detention and Removal Operations'
    ability to identify and remove criminal aliens be accompanied by a
    comparable increase in support personnel, detention bed space,
    equipment, infrastructure, and funding to ensure the timely removal of
    criminal aliens from the United States. Besides the lack of bed space,
    the DHS IG reported that the Detention and Removal Operations' ability
    to detain and remove illegal aliens with final orders of removal was
    affected by (1) the propensity of illegal aliens to disobey orders to
    appear in immigration court; (2) the penchant of released illegal
    aliens with final orders to abscond; (3) the practice of some countries
    to block or inhibit the repatriation of its citizens; and (4) two U.S.
    Supreme Court decisions that mandate the release of criminal and other
    high-risk aliens 180 days after the issuance of the final removal order
    except in "Special Circumstances." The DHS IG reported that,
    collectively, the bed space, personnel, and funding shortages, coupled
    with the other factors, had created an unofficial "mini-amnesty"
    program for criminal and other high-risk aliens. For more information,
    see Immigration Enforcement: DHS Has Incorporated Immigration
    Enforcement Objectives and Is Addressing Future Planning Requirements,
    GAO-05-66. Also, see Department of Homeland Security Office of
    Inspector General, Detention and Removal of Illegal Aliens, OIG-06-33
    (Washington, D.C.: April 2006); An Assessment of United States
    Immigration and Customs Enforcement's Fugitive Operations Teams, OIG-
    07-34 (Washington, D.C.: March 2007); and Review of U.S. ICE's Detainee
    Tracking Process, OIG-07-08 (Washington, D.C.: November 2006); DHS
    updated information: During March, April, and May 2007, ICE provided
    updated information on its efforts to ensure the removal of criminal
    aliens from the United States. According to ICE, there are no data on
    the universe of aliens incarcerated in state and local jails who are
    amenable to removal proceedings. This is because prisons and jails
    utilize independent booking software that tracks place of birth in
    different ways. Additionally, information on place of birth is not
    sufficient to determine whether an individual is an alien subject to
    removal from the United States. According to ICE, while it does not
    know the exact number of incarcerated criminal aliens subject to
    removal at this time, there are approximately 158,000 incarcerated
    criminal aliens with immigration detainers within the Enforcement
    Operational Immigration Records system, ICE's administrative case
    management system. In June 2006 and in support of its Criminal Alien
    Program, ICE established the National Detection Enforcement and
    Processing Offenders by Remote Technology Center in Chicago, Illinois
    to help in the screening, interviewing, and removal processing of
    criminal aliens in federal detention facilities throughout the United
    States to help ensure that these criminal aliens are deported rather
    than released into the community upon completion of their federal
    sentences. ICE reported that this center has screened more than 9,200
    incarcerated criminal aliens, issued nearly 7,000 charging documents,
    and located nearly 1,000 alien absconders. Moreover, ICE reported that
    it has finalized agreements with nine local law enforcement agencies to
    work with these agencies to take into custody and remove aliens
    convicted of crimes at the state and local level. Using these
    partnerships and other measures, ICE reported that as of March 2007,
    its Criminal Alien Program has provided coverage for 1,674 of the 4,828
    federal, state, and local jails and prisons nationwide, including for
    all 114 Bureau of Prisons federal detention facilities. ICE reported
    that for fiscal year 2007 it has set a target of removing 90,000 aliens
    from U.S. prisons and jails and, for fiscal year 2007, is on pace to
    double the approximately 60,000 charging documents it issued through
    the Criminal Alien Program in fiscal year 2006. ICE plans to expand
    coverage of the Criminal Alien Program to 3,400 covered facilities by
    fiscal year 2009. According to ICE, each Criminal Alien Program team is
    expected to process 1,800 new administrative cases per year. ICE also
    reported that from October 1, 2006, through March 31, 2007, it has
    removed more than 17,000 Bureau of Prison non-U.S. citizen inmates. If
    the bureau releases a similar number in fiscal year 2007 as it released
    in fiscal year 2006 (about 26,600, according to ICE), ICE reported that
    it is on track to remove all removable aliens released from the Bureau
    of Prisons in fiscal year 2007. Overall, ICE projects that in fiscal
    year 2007, it will process for removal more than 120,000 removable
    aliens located in prisons and jails nationwide; Our assessment: We
    conclude that DHS has generally not achieved this performance
    expectation. Although DHS has made progress in removing criminal aliens
    from the United States, much more work remains. For example, DHS has
    taken actions to expand its Criminal Alien Program to remove criminal
    aliens subject to removal from the United States after they complete
    their sentences in federal, state, and local correctional institutions
    and jails. However, ICE has not yet expanded the Criminal Alien Program
    or taken actions to ensure coverage of all federal, state, and local
    correctional institutions and jails. ICE has reached agreements with
    only nine local law enforcement agencies to remove aliens convicted of
    crimes at the state or local level. As a result, ICE may not be able to
    fully ensure the removal of criminal aliens from facilities that are
    not covered through the Criminal Alien Program or agreements with local
    law enforcement agencies. Moreover, the DHS IG reported that ICE faces
    a variety of challenges in its efforts to expand the Criminal Alien
    Program, and DHS did not provide us with evidence that it has yet
    addressed these challenges;
    Assessment: Generally not achieved.

    Performance expectation: 4. Assess and prioritize the use of alien
    detention resources to prevent the release of aliens subject to
    removal;
    Summary of findings: GAO and DHS IG findings: DHS has taken actions to
    assess and prioritize use of alien detention and removal resources. In
    November 2005, the DHS IG reported that the separation of CBP's
    apprehension components from Detention and Removal Operations created
    challenges in national coordination because the two are part of
    different agencies that pursued different sets of priorities and each
    has its own planning process. The DHS IG noted that Detention and
    Removal Operations prepared detention bed space and staff needs
    projections without the benefit of CBP apprehension and arrest
    projections, while CBP developed its future apprehension initiatives
    without the benefit of insight into Detention and Removal Operations'
    future processing capability. In an effort to achieve better efficiency
    and effectiveness, ICE and CBP negotiated a memorandum of understanding
    between Border Patrol agents and ICE investigators, although employees
    of both agencies noted persisting coordination problems in the
    apprehension and detention process. Other factors that increased the
    number of aliens that the Detention and Removal Operations have
    detained include the rising number of aliens that require mandatory
    detention and Detention and Removal Operations' improved ability to
    identify criminal aliens who are incarcerated in correctional
    institutions and jails and who will be subject to removal upon release
    from jail. The DHS IG also found that ICE has worked to improve
    strategic planning for detention resources, and the ICE Detention and
    Removal Operations issued a strategic plan in 2003 called "Endgame."
    This plan includes specific objectives for optimizing the means for
    detaining illegal aliens, including (1) ensuring sufficient and
    appropriate bed space is available based on detention category,
    characteristic, and condition of release; (2) enhancing partnerships
    with other federal detention agencies for better use of their
    resources, to include facilities and training; and (3) developing a
    National Custody Management Plan promoting the effective utilization of
    available bed space and alternative detention settings. The plan
    identified several significant challenges, many beyond DHS's control,
    including the number of aliens to remove, limited resources, political
    will, foreign governments, and nonremovable aliens. The DHS IG reported
    that, for these reasons, DHS needed to intensify its efforts to provide
    ICE with the resources and interagency support needed to overcome these
    challenges. For more information, see Department of Homeland Security
    Office of Inspector General, An Assessment of the Proposal to Merge
    Customs and Border Protection with Immigration and Customs Enforcement,
    OIG-06-04 (Washington, D.C.: November 2005); ICE's Compliance with
    Detention Limits for Aliens with a Final Order of Removal from the
    United States, OIG-07-28 (Washington, D.C.: February 2007); Treatment
    of Immigration Detainees Housed at Immigration and Customs Enforcement
    Facilities, OIG-07-01 (Washington, D.C.: December 2006); Review of U.S.
    ICE's Detainee Tracking Process, OIG-07-08 (Washington, D.C.: November
    2006); and Detention and Removal of Illegal Aliens, OIG-06-33
    (Washington, D.C.: April 2006).

    DHS updated information: In March 2007, ICE provided updated
    information on efforts to assess and prioritize use of alien detention
    and removal resources. According to ICE, successful enforcement
    strategies and the requirement to manage within ICE's operational
    budget have resulted in a situation where Detention and Removal
    Operations has exceeded its funded bed space level and therefore must
    apply rigorous criteria to determine which apprehended aliens are
    detained. According to DHS, ICE detains all aliens who pose a threat to
    community safety or national security, and those required to be
    detained under the nation's immigration laws. In fiscal year 2006, ICE
    added 7,000 beds in facilities along the southern border, and in the
    first quarter of fiscal year 2007 added 2,000 beds. In order to ensure
    the availability of bed space in the future, ICE introduced a formal
    capacity planning program designed to provide advance notice of future
    bed space requirements and collaborated with apprehending entities to
    obtain apprehension forecasts to project short and long term needs. The
    Detention Operations Coordination Center, established in July 2006,
    coordinates the transfer of detainees from field offices with a
    shortage of detention space to those with available beds. ICE also
    reported that the detainee transportation system has been restructured
    to increase in-flight service routes for longer, more cost effective
    flights. ICE reported that as it creates models to determine detention
    capacity needs, Detention and Removal Operations is taking account of
    the capacity needs of CBP and ICE and is working with the U.S. Bureau
    of Prisons, U.S. Citizenship and Immigration Services, and the
    Departments of Justice and State to develop a more efficient detention
    and removal system.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. While the availability of detention space
    depends on resources, DHS has taken actions to assess and prioritize
    the use of alien detention resources to prevent the release of aliens
    subject to removal by increasing bed space, relocating detainees, and
    better coordinating with relevant agencies. DHS has also taken actions
    to develop and implement a capacity planning program to identify future
    bed space requirements and has established priorities for bed space
    needs.

    Assessment: Generally achieved.

    Performance expectation: 5. Develop a program to allow for the secure
    alternative detention of noncriminal aliens.

    Summary of findings: GAO findings: DHS has made progress in developing
    programs to allow secure alternatives to detention. In October 2004, we
    reported that Detention and Removal Operations planned to use the
    results of its pilot programs (e.g., electronic monitoring and home
    visits of nondetained aliens) to determine which efforts intended to
    prevent nondetained aliens from fleeing while in immigration
    proceedings would merit additional funding.

    DHS updated information: In March 2007, ICE provided updated
    information on its Intensive Supervision Appearance Program and its
    Electronic Monitoring Program. According to ICE, under the Intensive
    Supervision Appearance Program, established in June 2004 and only
    available to aliens not subject to mandatory detention, all
    participants must agree to comply with the conditions of their release.
    Case specialists are then assigned a limited caseload of participants
    and are responsible for monitoring those participants in the community
    by using tools such as electronic monitoring (bracelets), home visits,
    work visits, and reporting by telephone. The Electronic Monitoring
    Program is a reporting and case management tool for aliens released
    from custody that utilizes telephone reporting and electronic devices,
    such as radio frequency and Global Positioning System technology, to
    identify a nondetained alien's location and help ensure the alien's
    appearance at scheduled hearings and, as appropriate, the alien's
    scheduled removal. Last, DHS is conducting research on piloting a
    program that would utilize a kiosk-type hardware like the US-VISIT
    program to which an alien could report monthly. Instead of reporting to
    a deportation officer, the alien would scan his fingerprint and have
    his photo taken at the kiosk, which would be linked to appropriate
    databases.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has developed two programs that allow for
    the secure alternative detention of noncriminal aliens--the Intensive
    Supervision Appearance program and the Electronic Monitoring Program--
    and is exploring other alternatives to detention for noncriminal
    aliens.

    Assessment: Generally achieved.

    Performance expectation: 6. Implement a program to allow for the secure
    alternative detention of noncriminal aliens.

    Summary of findings: GAO findings: We have not conducted work on DHS's
    efforts to provide for the secure alternative detention of noncriminal
    aliens.

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to provide alternatives to detention. ICE
    reported that under its Intensive Supervision Appearance Program there
    has been an 82 percent court appearance rate, as compared to 61 percent
    for the general nondetained population and that 47 percent of program-
    enrolled aliens who received final removal orders were confirmed to
    have left the United States compared to 13 percent of aliens in the
    nondetained general population believed to have compiled with removal
    orders. According to ICE, since the inception of the Electronic
    Monitoring Program in 2003, the program has been used by almost 9,100
    aliens and is currently used by 6,500 aliens. ICE noted that the number
    of aliens who have participated in these programs has been relatively
    small and that only certain aliens are eligible to be detained through
    these programs. ICE noted that no limit exists on the total number of
    aliens who can be monitored under the program. Furthermore, ICE noted
    that it is working to improve its alternative to detention programs by,
    for example, exploring additional supervision technologies and
    developing a memorandum of understanding with the Executive Office for
    Immigration Review to fast-track alternative-to-detention participants
    through the immigration hearing process. In addition, ICE reported that
    it is planning to expand its programs for secure alternative detention
    to increase programs' capacity to allow for a total detained population
    of 10,500 aliens.

    Our assessment: We cannot assess of the extent to which DHS has
    generally achieved this performance expectation. We have not completed
    work related to DHS's effort to implement a program for
    secure alternatives to detention, and while DHS provided us with some
    information on its implementation efforts, we are unable to assess
    DHS's progress in achieving this performance expectation based on this
    information.

    Assessment: No assessment made.

    Performance expectation: 7. Develop a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed.

    Summary of findings: GAO findings: Our work has shown that DHS has
    taken actions to develop a prioritized worksite enforcement program. As
    part of the Secure Border Initiative, in April 2006 ICE announced a new
    interior enforcement strategy to target employers of unauthorized
    aliens, immigration violators, and criminal networks. As we testified
    in June 2006, under this strategy, ICE has planned to target employers
    who knowingly employ unauthorized workers by bringing criminal charges
    against them. For more information, see Immigration Enforcement:
    Weaknesses Hinder Employment Verification and Worksite Enforcement
    Efforts, GAO-06-895T and Immigration Enforcement: Weaknesses Hinder
    Employment Verification and Worksite Enforcement Efforts, GAO-05-813.
    DHS updated information: In March 2007, ICE provided updated
    information on its worksite enforcement program. Specifically, ICE
    reported that its worksite enforcement strategy includes (1) critical
    infrastructure protection, (2) criminal investigations of egregious
    employer violators, and (3) enhanced employer compliance and outreach
    through implementation of the ICE Mutual Agreement between Government
    and Employers. As part of its critical infrastructure protection
    efforts, ICE has undertaken enforcement actions to remove unauthorized
    workers from critical infrastructure sites, as those unauthorized
    workers may pose a threat to sensitive facilities. ICE has also engaged
    in criminal investigations targeting unscrupulous employers for
    significant criminal violations and has sought to prosecute employers'
    managers who knowingly hire unauthorized workers. ICE has also
    announced the first nine charter members of the ICE Mutual Agreement
    between Government and Employers, a program designed to build
    cooperative relationships between the federal government and businesses
    to strengthen hiring practices and reduce the employment of
    unauthorized workers. Through the program, ICE seeks to encourage
    industry compliance through enhanced employer training and education.
    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has developed a prioritized worksite
    enforcement strategy focused on critical infrastructure protection and
    egregious employers and has provided employers with a tool for enhanced
    training and education on compliance with laws prohibiting the
    employment of unauthorized workers.

    Assessment: Generally achieved.

    Performance expectation: 8. Implement a prioritized worksite
    enforcement strategy to ensure that only authorized workers are
    employed.

    Summary of findings: GAO findings: Our work has shown that DHS has
    faced challenges in implementing a prioritized worksite enforcement
    strategy. In August 2005 and June 2006 we reported that worksite
    enforcement was one of various immigration enforcement programs that
    competed for resources among ICE responsibilities and that worksite
    enforcement had been a relatively low priority. We reported that
    competing needs for resources and difficulties in proving that
    employers knowingly hired unauthorized workers hindered ICE's worksite
    enforcement efforts. In addition, ICE officials stated that the lack of
    sufficient detention space limited the effectiveness of worksite
    enforcement efforts. We also noted that the availability and use of
    fraudulent documents made it difficult for ICE agents to prove that
    employers knowingly hired unauthorized workers. We reported that the
    number of notices of intent to fine issued to employers for improperly
    completing paperwork or knowingly hiring unauthorized workers generally
    declined between fiscal years 1999 and 2004. We also reported that the
    percentage of ICE agent work-years spent on worksite enforcement
    generally decreased between fiscal years 1999 and 2003. In addition, we
    reported that ICE lacked outcome goals and measures that hindered its
    ability to effectively assess the results of its worksite enforcement
    efforts. For example, we noted that until ICE fully develops outcome
    goals and measures, it may not be able to determine the extent to which
    its critical infrastructure protection efforts have resulted in the
    elimination of unauthorized workers' access to secure areas of critical
    infrastructure sites, one possible goal that ICE may use for its
    worksite enforcement program. For more information, see GAO-06-895T and
    GAO-05-813.

    DHS updated information: In March 2007, ICE provided updated
    information on its worksite enforcement implementation efforts. ICE
    reported that during fiscal year 2006 it initiated about 1,200 worksite
    enforcement investigations, seized property and assets valued at
    approximately $1.7 million at the time of the initial enforcement
    action, and made 716 criminal arrests, a substantial increase over
    criminal arrests made in previous fiscal years. ICE reported that
    during fiscal year 2006 criminal fines, forfeitures, and payments in
    lieu of forfeiture yielded more than $2.5 million. ICE reported that it
    obtained criminal and civil judgments totaling $26.7 million as a
    result of its worksite enforcement efforts for the first quarter of
    fiscal year 2007. With regard to the third prong of ICE's worksite
    enforcement strategy--the ICE Mutual Agreement between Government and
    Employers--as of January 2007, ICE had nine employers as members.[B]
    One requirement for participation in this program is that member
    employers enroll in the Employment Eligibility Verification system,
    which allows participating employers to electronically verify the work
    authorization status of newly hired employees. ICE reported that it
    does not yet have systems in place to measure the effectiveness and
    success of its program. ICE reported that it does not collect data on
    program effectiveness because it would require the law enforcement
    agency to collect data from a wide range of agencies that are
    responsible for carrying out the specific law enforcement mission. ICE
    reported that it uses its law enforcement statistics (e.g., numbers of
    arrests, indictments, convictions, seizures, and forfeitures);
    consequences resulting from closed cases (e.g., indictments and
    convictions); and risk assessments to assess efficiency and
    effectiveness of its efforts. With regard to the consequences resulting
    from closed cases, ICE noted that a measure of success is if an
    investigation results in an indictment and a conviction. ICE reported
    that it measures the quality of cases and focuses its efforts on those
    cases that are the highest priority for protecting the United States.
    With regard to risk assessments, ICE reported that it conducts threat,
    vulnerability, and consequences assessments of customs and immigration
    systems to determine the greatest risks for exploitation by terrorists
    and other criminals and to determine the optimal application of
    resources to ensure the maximum contribution to national security and
    public safety. ICE reported that additional time is needed to afford
    its programs the opportunity to mature into an outcome-based system.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken actions to implement its
    worksite enforcement strategy and, among other things, has conducted
    more worksite enforcement investigations and made more criminal arrests
    in fiscal year 2006 in comparison to prior fiscal years. However,
    millions of unauthorized workers face little likelihood of confronting
    ICE worksite enforcements actions. Moreover, DHS did not provide us
    with evidence on the extent to which its efforts have contributed to
    the achievement of ICE's desired outcomes for its worksite enforcement
    program and on the extent to which ICE has developed outcome goals and
    measures for its worksite enforcement program. We previously reported,
    without these goals and measures, it may be difficult for ICE to fully
    determine whether its worksite enforcement program is achieving its
    desired outcomes. With regard to the ICE Mutual Agreement between
    Government and Employers, the third prong of ICE's worksite enforcement
    strategy, we have previously identified weaknesses in one of the
    program's key requirements--participation in the Employment Eligibility
    Verification program. These weaknesses include the program's inability
    to identify document fraud, DHS delays in entering information into its
    databases, and some employer noncompliance with program. DHS has
    undertaken some efforts to address these weakness, but they would have
    to be fully addressed to help ensure the efficient and effective
    operation of an expanded program.

    Assessment: Generally not achieved.

    Performance expectation: 9. Develop a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States.

    Summary of findings: GAO findings: In prior work we reported that as of
    April 2005, ICE had not yet finalized a national strategy for combating
    alien smuggling.[C] For more information, see Combating Alien
    Smuggling: Opportunities Exist to Improve the Federal Response, GAO-05-
    305.

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to develop a strategy to combat human
    smuggling and trafficking. For example, the Secure Border Initiative is
    a comprehensive, multiyear program established by the Secretary of
    Homeland Security to secure U.S. borders and reduce illegal
    immigration. The Secure Border Initiative includes DHS's efforts to
    identify and dismantle smuggling organizations. According to DHS, the
    Human Smuggling and Trafficking Center is an important component of
    DHS's strategy to combat alien smuggling. Additionally, ICE reported
    that, in 2006, it initiated its Trafficking in Persons Strategy to
    target criminal organizations and individuals engaged in human
    trafficking worldwide. The Trafficking in Persons Strategy focuses on
    building partnerships and collaboration with other DHS agencies,
    foreign governments, nongovernmental organizations, the Department of
    Justice Civil Rights Division, and federal, state, and local law
    enforcement.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has made progress toward developing a
    comprehensive strategy to interdict and prevent trafficking and
    smuggling of aliens into the United States by, for
    example, establishing the Human Smuggling and Trafficking Center and
    the Trafficking in Persons Strategy.

    Assessment: Generally achieved.

    Performance expectation: 10. Implement a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States.

    Summary of findings: GAO findings: Our work has shown that DHS has
    faced challenges in implementing its antismuggling and trafficking
    mission.[D] In May 2005 we reported that ICE and CBP--two DHS
    components with antismuggling missions--signed a memorandum of
    understanding in November 2004 to address their respective roles and
    responsibilities, including provisions to ensure proper and timely
    sharing of information and intelligence. However, we reported that
    there was no mechanism in place for tracking the number and the results
    of referrals or leads made by CBP to ICE for investigation. Without
    such a mechanism, there may have been missed opportunities for
    identifying and developing cases on large or significant alien-
    smuggling organizations. CBP and ICE officials acknowledged that
    establishing a tracking mechanism would have benefits for both
    agencies. Such a mechanism would help ICE ensure that appropriate
    action is taken on the referrals. Also, CBP could continue to pursue
    certain leads if ICE--for lack of available resources or other reasons-
    -could not take action on the referrals. For more information, see GAO-
    05-305.

    DHS updated information: In March 2007, DHS provided updated
    information on its antismuggling and trafficking efforts. With regard
    to smuggling, CBP established its Office of Alien Smuggling
    Interdiction to set guidelines for the development and maintenance of a
    program to address human smuggling incidents. This office is also
    intended to institutionalize information sharing within CBP on migrant
    smuggling, trafficking in persons, and clandestine terrorist travel.
    CBP noted that the office is still a work in progress, and CBP has
    established various goals and associated time frames for completing
    these goals. With regard to human trafficking, ICE reported that in
    fiscal year 2006 it opened nearly 300 human trafficking investigations
    and made about 180 arrests as a result of human trafficking
    investigations. ICE reported that since 2005 it has hosted or
    participated in training sessions on human trafficking and has
    collaborated with nongovernmental organizations that provide services
    to human trafficking victims. In addition, ICE reported on various
    initiatives to share information with CBP regarding human smuggling and
    trafficking. As previously discussed, ICE reported that it does not yet
    have systems in place to measure the effectiveness and success of its
    program. ICE reported that it does not collect data on program
    effectiveness because doing so would require the law enforcement agency
    to collect data from a wide range of agencies that are responsible for
    carrying out the specific law enforcement mission. ICE reported that it
    uses its law enforcement statistics (e.g., numbers of arrests,
    indictments, convictions, seizures, and forfeitures); consequences
    resulting from closed cases (e.g., indictments and convictions); and
    risk assessments to assess efficiency and effectiveness of its efforts.
    ICE reported that in May 2007, the ICE Offices of Investigations and
    International Affairs issued a joint memorandum to field offices
    providing guidance in accomplishing the component of the human
    trafficking strategy and requiring quarterly outreach reports and
    annual assessments. According to ICE, these quarterly reports and
    annual assessments will be used to monitor future progress in
    antitrafficking efforts.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. In prior work, we noted that effectiveness of
    a strategy for smuggling depends partly on having clearly defined roles
    and responsibilities for those agencies with antismuggling missions.
    CBP and ICE largely addressed this point in signing a memorandum of
    understanding and undertaking other information sharing initiatives.
    However, coordination between these two agencies and implementation of
    antismuggling efforts could be enhanced by development and use of a
    mechanism for sharing information. In addition, as part of its efforts
    to implement its antismuggling and trafficking strategy, DHS has
    identified the importance of performance evaluation but has not yet
    developed outcome goals and measures to assess the extent to which its
    efforts are achieving desired outcomes and has only recently initiated
    efforts to obtain quarterly reports and annual assessments from field
    offices. Until DHS has developed a mechanism to better share
    information among the responsible agencies and the ability to evaluate
    the outcomes of its efforts, DHS will not have a comprehensive strategy
    in place. In addition, although CBP has established goals for its
    Office of Alien Smuggling Interdiction, the majority of these goals
    have target time frames later than May 2007, or CBP noted that time
    frames are ongoing.

    Assessment: Generally not achieved.

    Performance expectation: 11. Develop a law enforcement strategy to
    combat criminal alien gangs in the United States and cross-border
    criminal activity.

    Summary of findings: GAO findings: We have not completed work on DHS
    efforts to combat criminal alien gangs.[E].

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to combat alien gangs. According to ICE, one
    of the goals of the Secure Border Initiative is to identify and remove
    immigration violators who are criminal aliens at large in the United
    States. ICE stated that it will use the additional resources in the
    proposed fiscal year 2008 budget to enhance ICE's anti-gang initiative--
    Operation Community Shield--and increase the number of transnational
    gang members that are identified, arrested, and removed from the United
    States. Operation Community Shield, a national law enforcement
    initiative, partners ICE with other federal, state, and local law
    enforcement. Additionally, ICE participates in the National Gang
    Targeting, Enforcement, and Coordination Center, a multi-agency
    national anti-gang enforcement targeting center, and in regular policy
    coordination meetings at the National Security Council concerning
    international organized crime. As a participant in the National
    Security Council Policy Coordination Committee meetings, ICE is
    assisting in the development of a strategy to combat transnational
    gangs in the United States, Mexico, and Central America.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has initiated various efforts, such as
    Operation Community Shield, in developing a strategy for combating
    criminal alien gangs. ICE has also worked with other agencies and
    groups to develop a strategy to combat alien gangs.

    Assessment: Generally achieved.

    Performance expectation: 12. Implement a law enforcement strategy to
    combat criminal alien gangs in the United States and cross-border
    criminal activity.

    Summary of findings: GAO findings: We have not completed work on DHS
    efforts to combat criminal alien gangs.[F].

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to combat criminal alien gangs. Operation
    Community Shield was initiated by ICE in February 2005 to combat
    violent transnational street gangs and expanded to include all criminal
    and prison gangs. Under Operation Community Shield, ICE identifies
    violent gangs and develops intelligence on their membership; deters,
    disrupts, and dismantles gang operations by tracing and seizing their
    cash, weapons, and other assets; criminally prosecutes or removes gang
    members from the United States; partners with other law enforcement
    agencies at the federal, state and local levels to develop a force
    multiplier effect for gang investigations; and conducts outreach to
    boost public awareness about gangs. In March 2007, ICE reported that
    since its inception in February 2005, Operation Community Shield has
    resulted in the arrests of more than 4,000 gang members and associates.
    Additionally, ICE stated that it will provide staffing positions to
    identified high-threat gang areas based on the current transnational
    threat at the time the positions and funding are received. Given the
    mobility of transnational gangs, ICE will make a determination on the
    placement of resources in specific areas needing staffing based on
    tactical intelligence and other operational considerations. As
    previously discussed, ICE reported that it does not yet have systems in
    place to measure the effectiveness and success of its program, but uses
    its law enforcement statistics (e.g., numbers of arrests, indictments,
    convictions, seizures, and forfeitures); consequences resulting from
    closed cases (e.g., indictments and convictions); and risk assessments
    to assess efficiency and effectiveness of its efforts.

    Our assessment: We cannot make an assessment of the extent to which DHS
    has generally achieved this performance expectation. We have not
    completed work related to DHS's effort to combat criminal alien gangs,
    and while DHS provided us with some information on its implementation
    efforts, we are unable to assess DHS's progress in achieving this
    performance expectation based on the information DHS provided.
    Specifically, DHS did not provide us with information that would
    clearly enable us to assess the extent to which DHS's efforts to
    implement a strategy to combat alien gangs have resulted in desired
    outcomes.

    Assessment: No assessment made.

    Performance expectation: 13. Disrupt and dismantle mechanisms for money
    laundering and financial crimes.

    Summary of findings: GAO findings: We have not completed work related
    to ICE's ability to disrupt and dismantle mechanisms for money
    laundering and financial crimes.[G].

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to combat money laundering and financial
    crimes. With regard to a strategy for money laundering, ICE reported
    that it was a major contributor to the 2005 U.S. Money Laundering
    Threat Assessment produced by an interagency group to assess the
    progress that the United States had made in combating money laundering,
    evaluating the changing environment, and identifying areas that require
    further attention. ICE was also active in preparing the 2006 and 2007
    National Money Laundering Strategies that addressed the findings and
    recommendations in the earlier report and set out goals, strategies,
    and specific actions for agencies to follow. The 2007 National Money
    Laundering Strategy noted that to measure the effectiveness of U.S.
    enforcement measures, ICE will compile investigative data. To support
    investigations with a potential nexus to terrorism and other financial
    crimes investigations, in July 2003, ICE launched Operation
    Cornerstone, an outreach program designed to identify and eliminate
    systemic vulnerabilities in financial systems that could be exploited
    by individuals, criminal organizations, and terrorists. ICE reported
    conducting more than 4,000 outreach presentations that have resulted in
    over 275 criminal investigations and $3 million seized since its
    establishment. With regard to bulk cash smuggling, ICE reported that
    the launch of Operation Firewall in August 2005, and its subsequent
    expansion in fiscal years 2006 and 2007, helped combat bulk cash
    smuggling. ICE reported that since its inception, Operation Firewall
    has resulted in the seizure of more than $76 million and the arrest of
    more than 200 suspects. ICE noted that the November 2004 establishment
    of Trade Transparency Units created cooperative international
    investigative efforts to identify and eliminate trade-based money
    laundering system, which supports the trafficking of drugs, people, and
    other contraband as well as terrorism. ICE also reported that it
    launched the Unlicensed Money Service Business/Informal Value Transfer
    System to prevent terrorists and other criminals from moving illicit
    funds through unlicensed money service businesses. Overall, in fiscal
    year 2006, ICE reported conducting nearly 4,000 financial
    investigations that resulted in more than 1,200 arrests and the seizure
    of more than $137 million in suspected illicit proceeds. As previously
    discussed, ICE reported that it does not yet have systems in place to
    prove that it has disrupted and dismantled mechanisms for money
    laundering and financial crimes. ICE reported that it uses its law
    enforcement statistics (e.g., numbers of arrests, indictments,
    convictions, seizures, and forfeitures); consequences resulting from
    closed cases (e.g., indictments and convictions); and risk assessments
    to assess efficiency and effectiveness of its efforts.

    Our assessment: We cannot make an assessment of the extent to which DHS
    has generally achieved this performance expectation. We have not
    completed work related to DHS efforts to disrupt and dismantle
    mechanisms for money laundering and financial crimes. Although DHS
    provided us with some information on its implementation efforts, we are
    unable to assess DHS's progress in achieving this performance
    expectation based on the information DHS provided. Specifically, DHS
    did not provide us with information that would clearly enable us to
    assess the extent to which DHS's efforts to disrupt and dismantle
    mechanisms for money laundering and financial crimes have resulted in
    desired outcomes.

    Assessment: No assessment made.

    Performance expectation: 14. Develop a program to screen and respond to
    local law enforcement and community complaints about aliens who may be
    subject to removal.

    Summary of findings: GAO findings: We have not completed work related
    to ICE programs for screening and responding to local law enforcement
    and community complaints about aliens who may be subject to removal.

    DHS updated information: In March 2007, ICE provided updated
    information on its efforts to work with state and local law enforcement
    agencies. ICE reported that it in 2006 it initiated a pilot program,
    called the Law Enforcement Agency Response, in Phoenix, Arizona, to
    provide full-time response to local law enforcement agencies' requests
    for immigration-related assistance. As of March 2007, ICE reported that
    this program unit has received nearly 400 requests for assistance. ICE
    is studying the feasibility of continuing the pilot program and
    expanding it to other locations. In addition, ICE has established
    memoranda of agreement with 21 law enforcement agencies to provide
    training and assistance to state and local police and correctional
    personnel in the enforcement of federal immigration laws. ICE reported
    that as a result of these efforts, in fiscal year 2006 more than 6,000
    individuals were arrested and, as of March 2007, more than 4,000
    individuals have been arrested during fiscal year 2007 for violating
    misdemeanor and felony state and local laws. According to ICE, its Law
    Enforcement Support Center also provides information to law enforcement
    agencies relating to foreign nationals suspected of criminal activity
    and immigration status information of foreign nationals under arrest or
    investigation. Further, the Forensic Document Laboratory provides
    assistance to federal, state, tribal, local, and foreign authorities in
    making authenticity determinations of travel and identity documents.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has developed a number of programs to
    screen and respond to local law enforcement and community complaints
    about aliens who may be subject to removal. Additionally DHS has
    provided field guidance directing an enhanced response to state and
    local requests for information.

    Assessment: Generally achieved.

    Performance expectation: 15. Develop staffing plans for hiring and
    allocating human capital resources to fulfill the agency's immigration
    enforcement mission.

    Summary of findings: GAO and DHS IG findings: Since the transfer of
    responsibilities to DHS in March 2003, ICE has faced resource and
    financial management challenges that affected its ability to fully
    address all of its competing priorities. For example, ICE was faced
    with a hiring freeze in fiscal year 2004, which affected its ability to
    recruit, hire, and train personnel. Moreover, in June 2006 we reported
    that ICE did not yet have a formal risk management process for
    prioritizing and allocating its limited resources. Rather ICE primarily
    relied on the judgment of staff in major field offices in addition to
    national programs developed in headquarters. For more information, see
    Information on Immigration Enforcement and Supervisory Promotions in
    the Department of Homeland Security's Immigration and Customs
    Enforcement and Customs and Border Protection, GAO-06-751R.

    DHS updated information: In March 2007, ICE provided updated
    information on its human capital functions. ICE reported that it has
    developed comprehensive staffing plans for all of the agency's critical
    positions in support of ICE's immigration enforcement mission and
    provided us with the operational assumptions underlying the staffing
    models. ICE also reported streamlining its hiring process and noted
    meeting all of its 2006 hiring goals. ICE reported (1) establishing
    preliminary guidance to provide ICE leadership and program managers
    with a framework for hiring and funding decisions and (2) implementing
    a workforce planning initiative to examine interdependencies and
    relationships among component programs. ICE stated that it has a hiring
    plan for supplemental, enhancement, and attrition hiring and that it is
    currently filling these positions. As of April 10, 2007, ICE reported
    that it has hired 1,213 employees in key occupations with 892 remaining
    for this fiscal year. ICE noted that Detention and Removal Operations
    is currently working toward hiring to its authorized and funded level
    for positions of 6,762 and that approximately 5,222 positions are
    filled with 1,540 vacancies. Due to the number of vacancies, Detention
    and Removal Operations stated that it is striving to achieve a hiring
    goal that would ensure that at least 90 percent of its field and 85
    percent of its headquarters vacancies are filled by the end of fiscal
    year 2007.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has provided information outlining its
    current staffing allocations and the operational basis of staffing
    models and has created initiatives to facilitate hiring and staffing.
    ICE staffing models are taken into consideration when requesting funds
    in the budget.

    Assessment: Generally achieved.

    Performance expectation: 16. Provide training, including foreign
    language training, and equipment for all immigration enforcement
    personnel to fulfill the agency's mission.

    Summary of findings: GAO findings: We have not completed work on DHS's
    provision of training for immigration enforcement personnel.

    DHS updated information: In March and April 2007, ICE provided updated
    information on its training efforts. ICE reported that its ICE-D Basic
    Law Enforcement Training Program is an 18.5-week basic law enforcement
    training program that provides newly hired Detention and Removal
    Operations employees with entry-level training in law, tactical
    physical techniques, firearms, and operational training. ICE also
    reported that the Federal Law Enforcement Training Center has added a 5-
    week Spanish language immersion course that became part of the ICE-D
    program in April 2007. According to ICE, in November 2006 ICE offered a
    4-hour instructor-led course on Alien Smuggling/Victims of Trafficking,
    but is in the process of developing a more balanced course that is not
    just focused on the southern border. ICE also offers other training
    courses. See Department of Homeland Security Office of the Inspector
    General, A Review of Immigration and Customs Enforcement Discipline
    Procedures, OIG-06-57 (Washington, D.C.: August 2006).

    Our assessment: We cannot make an assessment of the extent to which DHS
    has generally achieved this performance expectation. We have not
    completed work related to DHS's effort to provide training and
    equipment to immigration enforcement personnel. While DHS provided us
    with some information on its training efforts, we are unable to assess
    DHS's progress in achieving this performance expectation based on the
    information DHS provided. Specifically, DHS did not provide us with
    information that would clearly enable us to assess the extent to which
    DHS has provided training, beyond basic training, for all immigration
    enforcement personnel.

    Assessment: No assessment made.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken a sufficient number of actions to satisfy most elements of the
    expectation. However, an assessment of "generally achieved" does not
    signify that no further action is required of DHS or that functions
    covered by the expectation cannot be further improved or enhanced.
    Conversely, "generally not achieved" indicates that DHS has not yet
    taken a sufficient number of actions to satisfy most elements of the
    performance expectation. An assessment of "generally not achieved" may
    be warranted even where DHS has put forth substantial effort to satisfy
    some but not most elements of an expectation. In cases when we or the
    DHS IG have not completed work upon which to base an assessment of DHS
    actions to satisfy a performance expectation, and/or the information
    DHS provided did not enable us to clearly determine the extent to which
    DHS has achieved the performance expectation, we indicated "no
    assessment made."

    [A] Under expedited removal, aliens apprehended within 100 miles of the
    border and within 14 days of entry who do not have documents, or who
    have false documents, can be removed from the United States without a
    hearing before an immigration judge.

    [B] The other two prongs of ICE's worksite enforcement strategy are
    critical infrastructure protection and criminal investigations of
    egregious employer violators.

    [C] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in developing a strategy for antismuggling
    and trafficking. This performance expectation is focused on DHS's roles
    and responsibilities.

    [D] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play antismuggling and trafficking efforts.
    This performance expectation is focused on DHS's roles and
    responsibilities.

    [E] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in developing a strategy for combating
    alien gangs. This performance expectation is focused on DHS's roles and
    responsibilities.

    [F] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in combating criminal alien gangs. This
    performance expectation is focused on DHS's roles and responsibilities.

    [G] In addition to DHS, other agencies, such as the Department of
    Justice, have a role to play in disrupting and dismantling mechanisms
    for money laundering and financial crimes. This performance expectation
    is focused on DHS's roles and responsibilities.

    [End of table]

    DHS Has Made Modest Progress in Providing Immigration Services:

    USCIS is the agency within DHS that is responsible for processing
    millions of immigration benefit applications received each year for
    various types of immigration benefits, determining whether applicants
    are eligible to receive immigration benefits, and detecting suspicious
    information and evidence to refer for fraud investigation and possible
    sanctioning by other DHS components or external agencies. USCIS
    processes applications for about 50 types of immigration benefits with
    a goal of ensuring that processing of benefits applications takes place
    within a 6 month time frame. USCIS has introduced new initiatives to
    modernize business practices and upgrade information technology
    infrastructure to transform its current, paper-based data systems into
    a digital processing resource to enhance customer service, prevent
    future backlogs of immigration benefit applications, and improve
    efficiency with expanded electronic filing.

    As shown in table 20, we identified 14 performance expectations for DHS
    in the area of immigration services and found that overall DHS has made
    modest progress in meeting those expectations. Specifically, we found
    that DHS has generally achieved 5 performance expectations and has
    generally not achieved 9 others.

    Table 20: Performance Expectations and Progress Made in Immigration
    Services:

    Performance expectation: 1. Eliminate the benefit application backlog
    and reduce application completion times to 6 months.
    Assessment: Generally not achieved.

    Performance expectation: 2. Institute process and staffing reforms to
    improve application processes.
    Assessment: Generally achieved.

    Performance expectation: 3. Establish a timetable for reviewing the
    program rules, business processes, and procedures for immigration
    benefit applications.
    Assessment: Generally not achieved.

    Performance expectation: 4. Institute a case management system to
    manage applications and provide management information.
    Assessment: Generally not achieved.

    Performance expectation: 5. Develop new programs to prevent future
    backlogs from developing.
    Assessment: Generally not achieved.

    Performance expectation: 6. Establish online access to status
    information about benefit applications.
    Assessment: Generally achieved.

    Performance expectation: 7. Establish online filing for benefit
    applications.
    Assessment: Generally not achieved.

    Performance expectation: 8. Establish revised immigration application
    fees based on a comprehensive fee study.
    Assessment: Generally achieved.

    Performance expectation: 9. Capture biometric information on all
    benefits applicants.
    Assessment: Generally not achieved.

    Performance expectation: 10. Implement an automated background check
    system to track and store all requests for applications.
    Assessment: Generally not achieved.

    Performance expectation: 11. Communicate immigration-related
    information to other relevant agencies;
    Assessment: Generally achieved.

    Performance expectation: 12. Establish training programs to reduce
    fraud in the benefits process.
    Assessment: Generally not achieved.

    Performance expectation: 13. Create an office to reduce immigration
    benefit fraud.
    Assessment: Generally achieved.

    Performance expectation: 14. Implement a fraud assessment program to
    reduce benefit fraud.
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 5;
    Assessment: Generally not achieved: 9;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 21 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of immigration services and our assessment of whether DHS has
    taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 21: Performance Expectations and Assessment of DHS Progress in
    Immigration Services:

    Performance expectation: 1. Eliminate the benefit application backlog
    and reduce application completion times to 6 months.

    Summary of findings: GAO and DHS IG findings: DHS has made significant
    progress in reducing the number of immigration benefit applications
    pending adjudication and has prioritized pending applications in a
    reasonable manner. However, USCIS cannot yet ensure that it has
    eliminated the backlog and reduced application completion time to 6
    months primarily because (1) a large number of applications are still
    pending before the agency, many of which USCIS stated are of lower
    priority in its backlog elimination efforts, and (2) USCIS does not yet
    have a case management system for tracking applications it receives to
    determine whether applications are processed within 6 months of
    receipt. In addition, USCIS has yet to demonstrate that it has overcome
    long-standing technology problems. With respect to an immigration
    benefit application, the term backlog, as defined by statute, means the
    period of time in excess of 180 days (6 months) that such application
    has been pending before USCIS. USCIS, using its operational definition
    of backlog, measures the volume of its backlog as the number of
    applications pending before the agency in excess of the number of
    applications received in the most recent 6 months. USCIS then subtracts
    from this number all applications pending where either benefits would
    not be immediately available even if the applications were granted or
    further adjudication of the application depends on action by another
    agency or the applicant; USCIS stated that by consistently completing
    more applications than are filed each month, the agency should
    gradually reduce its pending workload of applications to a level at
    which it can complete all incoming applications within the workload
    targets established for each application type. Eventually, according to
    the agency's backlog elimination plan, as long as USCIS is processing
    more applications than it is receiving, there should be no backlog.
    However, we reported that under USCIS's definition of backlog, the
    agency cannot guarantee that every applicant requesting a benefit will
    receive a decision within 6 months of filing. Moreover, although
    USCIS's data showed a significant decrease in the backlog from January
    2004 through June 2005, we reported that the sharp drop in the backlog
    was due to USCIS's decision in July 2004 to remove from its backlog
    count those 1.15 million cases for which an immigration visa was not
    immediately available and a benefit therefore could not be provided. In
    September 2005, the DHS IG noted that removal of some applications from
    the backlog, as well as other backlog reduction efforts such as the
    hiring of temporary staff, may have benefited the agency in the short-
    term. However, the DHS IG reported that these actions would not resolve
    the long-standing processing and information technology problems that
    contributed to the backlog in the first place and that, until these
    problems were addressed, USCIS would not be able to apply its resources
    to meet mission and customer needs effectively; In our previous work,
    we noted that USCIS's automated systems were not complete and reliable
    enough to determine how long it actually takes to process specific
    benefit applications or to determine the exact size of its backlog.
    USCIS has identified requirements for transforming its information
    technology systems to address deficiencies in its capabilities, but
    these transformation efforts have not yet been fully developed or
    implemented. We reported that until USCIS develops this capability, it
    cannot assure Congress that it has successfully eliminated the backlog,
    and it will not be able to provide accurate information about the
    actual number of applications that have been pending in excess of 180
    days or the actual amount of time they have been pending. For more
    information, see Immigration Benefits: Improvements Needed to Address
    Backlogs and Ensure Quality of Adjudications, GAO-06-20. Also, see
    Department of Homeland Security Office of Inspector General, U.S.
    Citizenship and Immigration Services' Progress in Modernizing
    Information Technology, OIG-07-11 (Washington, D.C.: November 2006) and
    USCIS Faces Challenges in Modernizing Information Technology, OIG-05-41
    (Washington, D.C.: September 2005).

    DHS updated information: In March through June 2007, DHS provided
    updated information on its backlog. In January 2004, USCIS had
    approximately 3.8 million applications backlogged pending adjudication,
    including applications that, according to USCIS, if granted would not
    provide the applicant or petitioner with an immediate immigration
    benefit or were pending as a result of delays outside of USCIS's
    control. Based on an analysis of data provided in USCIS's Backlog
    Elimination Plan Update for the fourth quarter of fiscal year 2006, as
    of September 2006, USCIS had a total of about 1.0 million backlogged
    applications, including applications that, according to USCIS, if
    granted would not provide the applicant or petitioner with an immediate
    immigration benefit or were pending as a result of delays outside of
    USCIS's control. As a subset of this 1.0 million, USCIS reported that
    the backlog under its control was less then 10,000. Specifically, for
    each application type, USCIS removed from the calculated backlog the
    total number of pending applications that, even if the application were
    granted, the ultimate benefit sought would not be immediately available
    due to annual numerical caps set by statute. As reported in the USCIS
    Backlog Elimination Plan updates, certain applications and petitions
    were removed from the backlog count because (1) the benefit was not
    immediately available to the applicant or beneficiary; (2) USCIS was
    waiting for applicants or petitioners to respond to requests for
    information; (3) applicants were afforded the opportunity to retake
    naturalization tests; or (4) USCIS was waiting for actions from outside
    federal agencies, such as Federal Bureau of Investigation name checks.
    USCIS has previously acknowledged that there may be some applications
    that have been pending more than 6 months and reported to us that the
    agency cannot determine the precise composition of the total
    applications pending adjudication as of September 2006 because such
    data are not available for all applications within USCIS; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. USCIS has made significant progress in
    reducing the number of applications pending adjudication and processing
    times for adjudicating applications. However, USCIS's method of
    calculating its backlog leaves the possibility of individual
    applications pending for longer than 6 months, so long as in the
    aggregate the number of pending applications on any given date does not
    exceed the number received in the previous 6 months. USCIS has
    acknowledged that some applications received in fiscal years 2005 and
    2004, or even earlier, may still be pending. Moreover, USCIS removed
    from its backlog calculation any pending applications for which a
    benefit would not be immediately available, even if the application
    were granted, or that were awaiting action outside of USCIS. While
    giving such applications lower priority is a reasonable approach to
    backlog reduction and is useful for workload analysis, those
    applications--1 million as of September 2006--are still awaiting
    adjudication. For example, about 750,000 of these applications are
    those for which a benefit would not be immediately available even if
    granted, according to USCIS. Adjudicating these applications would let
    applicants or their beneficiaries know their eligibility for benefits,
    however, and could prevent future delays if large numbers of these
    benefits suddenly became immediately available due to a statutory
    increase in the caps, as happened when a 2005 law eliminated the annual
    cap on asylum beneficiaries. Additionally, DHS's current data systems
    cannot produce backlog information based on the date of the filing of a
    benefit application, which contributes to USCIS's difficulty in
    measuring its backlog consistent with the statutory definition, upon
    which the performance expectation is in part based, and in providing
    information on whether it is processing applications within 6 months of
    receipt. USCIS has not yet demonstrated that it has overcome long-
    standing technology problems which, according to the DHS IG,
    contributed to the backlog in the first place. Without information on
    whether individual applications have been pending for more than 6
    months, we cannot verify that USCIS has eliminated its backlog and
    reduced application completion time to 6 months.

    Assessment: Generally not achieved.

    Performance expectation: 2. Institute process and staffing reforms to
    improve application processes.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. We reported that
    in fiscal year 2002 USCIS committed about 70 percent of its backlog
    reduction funds to employing about 1,100 temporary adjudicator staff
    and authorizing overtime. In May 2005, USCIS finalized a staffing
    allocation model to address how many and where staff were needed to
    better match projected workloads. On the basis of this model, USCIS
    determined it had to retain the temporary adjudicators currently on
    hand (about 1,100) through the end of fiscal year 2006 and fill
    vacancies to increase its level of permanent adjudicator staff by 27
    percent (about 460) to maintain productivity and prevent future
    backlogs through fiscal year 2007. Additionally, USCIS's staffing model
    addressed how many and where staff were needed to better match
    projected workloads. USCIS officials said that the need for future
    staffing adjustments could be offset by future efficiencies gained
    during its transition to more robust information technology
    capabilities. We reported that reflection in its planning processes and
    documents of expected gains as a result of new technologies should
    improve USCIS's ability to make strategic staffing decisions. In
    addition, we reported that USCIS issued guidance and regulations to
    streamline processes, including clarifying guidance to adjudicators
    about requests for additional evidence and notices of intent to deny,
    and establishing greater flexibility in setting the length of validity
    of the employment authorization document. For more information, see GAO-
    06-20;
    Assessment: Generally achieved.

    Performance expectation: 3. Establish a timetable for reviewing the
    program rules, business processes, and procedures for immigration
    benefit applications;
    Summary of findings: GAO and DHS IG findings: DHS has not yet
    established a timetable for reviewing program rules, processes, and
    procedures for immigration benefits applications. In November 2006, the
    DHS IG reported that USCIS had undertaken a structured approach to
    address process challenges through its business transformation program
    and established cross-functional teams with dedicated management
    participation and generated several strategic level plans to provide a
    business-centric vision and guidance for implementing technical
    solutions. The DHS IG reported that the accomplishments to date were
    steps in the right direction for both business and information
    technology modernization, but that USCIS remained entrenched in a cycle
    of continual planning, with limited progress toward achieving its long-
    term transformation goals. Obtaining the funding needed to support
    implementation of the business transformation program was a continual
    concern. The DHS IG reported that establishing a clearly defined
    transformation strategy, including the funding plans, goals, and
    performance measures needed to manage its execution, is fundamental.
    Linking information technology objectives to this transformation
    strategy and ensuring sufficient internal and external stakeholder
    involvement in information technology and process improvement
    initiatives also would be key. The DHS IG reported that until USCIS
    addresses these issues, it would not be in a position to either
    effectively manage existing workloads or handle the potentially
    dramatic increase in immigration benefits processing workloads that
    could result from proposed immigration reform legislation. For more
    information, see Department of Homeland Security Office of Inspector
    General, U.S. Citizenship and Immigration Services' Progress in
    Modernizing Information Technology, OIG-07-11 (Washington, D.C.:
    November 2006).

    DHS updated information: According to updated information provided by
    USCIS in March and April 2007, the USCIS Transformation Program Office
    will prepare its detailed timetable for reviewing program rules,
    business processes, and procedures for each benefit category once it
    receives and awards the contract for information technology services.
    USCIS reported analyzing over 50 existing transactions and grouped them
    into lines of business--the adjudication of citizenship benefit
    applications, immigrant benefit applications, humanitarian benefit
    applications, and non-immigrant benefit applications. USCIS has
    incorporated a timetable for incrementally implementing each of the
    lines of business in its transformation expenditure plan. USCIS plans
    to transform benefit adjudication for citizenship benefits by October
    2008; immigrant benefits by October 2010; humanitarian benefits by
    October 2011; and non-immigrant benefits by October 2012. USCIS
    reported that the Transformation Spend Plan has been approved by the
    Office of Management and the Budget and that the plan's transmittal to
    Congress should occur shortly. According to the tentative schedule,
    USCIS plans to transform its paper-based process into an electronic end-
    to-end adjudicative process.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. USCIS has made progress in meeting this
    performance expectation, but has not yet established a detailed
    timetable for reviewing program rules, processes, and procedures for
    immigration benefits applications. USCIS officials noted that the
    agency will prepare its detailed timetable for reviewing program rules,
    business processes, and procedures for each benefit category once it
    receives and awards the contract for information technology services.
    Until USCIS establishes such a timetable, it has not yet achieved this
    performance expectation.

    Assessment: Generally not achieved.

    Performance expectation: 4. Institute a case management system to
    manage applications and provide management information.

    Summary of findings: GAO findings: DHS has not yet instituted a case
    management system for managing applications and providing management
    information. In November 2005, we reported that USCIS cannot readily
    determine the number of applications that have been pending for more
    than 6 months from the data management systems it is currently using to
    manage its backlog elimination efforts. However, USCIS has identified
    the technology improvements necessary to develop this capability. Since
    fiscal year 2002, the agency has invested about 2 percent ($10.5
    million) of its funds allocated for backlog elimination for technology
    improvements. We reported that among the critical elements of USCIS's
    planned technology modernization efforts was a new case management
    system that should provide the agency with the capability to produce
    management reports on the age of all pending benefit applications. We
    reported that an integrated case management system is a tool that will
    be used by USCIS staff in processing benefits and adjudicating cases.
    USCIS reported that system development began during fiscal year 2006 as
    part of the agency's transformation efforts. In November 2005, we
    reported that USCIS was assembling the system requirements and
    conducting surveys of industry best practices. In addition, USCIS
    reviewed a cost-benefit analysis to evaluate alternative implementation
    strategies for the new integrated case management system. USCIS
    anticipated that its current case management systems would be
    decommissioned by fiscal year 2011. We reported that USCIS did not
    expect these systems to be fully deployed before fiscal year 2010. For
    more information, see GAO-06-20.

    DHS updated information: According to USCIS, a case management system
    to manage applications and provide management information will be
    incorporated in the Secure Information Management Service, for which
    the first increment pilot was deployed in July 2007. This increment
    will include forms related to USCIS's citizenship function. Three
    additional increments will address the functions of immigrant,
    asylum/refugee, and nonimmigrant. USCIS noted that development of its
    case management system is tied to transformation that began in fiscal
    year 2006.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although USCIS is planning to pilot the first
    phase of its Secure Information Management Service, USCIS does not yet
    have a case management system that provides reliable information on its
    application processing and backlog.

    Assessment: Generally not achieved.

    Performance expectation: 5. Develop new programs to prevent future
    backlogs from developing.

    Summary of findings: GAO findings: DHS has taken actions to examine and
    test new programs to prevent future backlogs, but these programs are
    still in the pilot stages. In 2005 we reported that in response to
    recommendations made in the USCIS Ombudsman's 2004 annual report, USCIS
    conducted a number of pilot projects designed to reduce benefit
    application processing times and was considering adopting several
    practices it determined to be successful. We reported that the agency
    studied the processing of two types of applications during the pilots:
    (1) applications to replace permanent resident cards (form I-90) and
    (2) applications to register permanent residence or adjust status (form
    I-485). First, during the period March 2004 through November 2004,
    USCIS conducted a pilot program designed to reduce processing time for
    applications for permanent resident cards. The pilot, conducted in the
    Los Angeles area, allowed for electronically filed permanent resident
    cards to be processed at application support centers, where applicants
    have their initial contact with the agency and have their photographs
    and fingerprints taken. During the pilot, average processing times were
    reduced from over 8 months to about 2 weeks. USCIS's Performance
    Management Division recommended that USCIS implement the pilot
    nationwide. Second, beginning in March 2004 and May 2004 respectively,
    USCIS conducted pilot programs in the New York and Dallas district
    offices that focused on testing new processes for adjudicating family-
    based applications for adjustments of status within 90 days. Each
    sought to streamline and accelerate application processing by shifting
    aspects of processing responsibility from the National Benefits Center,
    a central processing hub for certain benefit applications, to the
    district offices. Using elements of processes tested in the Dallas and
    New York pilot projects, USCIS has implemented up-front processing at
    three district offices�San Diego, San Antonio, and Buffalo--that did
    not have a backlog of adjustment of status applications when
    implemented. USCIS anticipates expanding the number of offices on a
    quarterly basis as they become current in their processing so that
    applicants with pending applications are not disadvantaged. The pilot
    in Dallas will also continue as long as USCIS determines that
    additional information may be gleaned and until the district office
    becomes current in processing applications. In March 2004, a third
    adjustment of status pilot for employment-based applications was
    implemented at the California service center. The focus was to
    adjudicate within 75 days petitions for immigrant workers with advanced
    degrees concurrently with the associated applications for adjustment of
    status. Ultimately, USCIS deemed the pilot inefficient and adverse to
    the service center backlog elimination goals because resources were
    diverted from addressing backlogged cases. For more information, see
    GAO-06-20.

    DHS updated information: According to information provided by DHS in
    March, April, and May 2007, in September of 2006, USCIS expanded its
    District Office Rapid Adjudication Pilot program by extending that
    program in Dallas, the office of origin, and by including field offices
    located in El Paso and Oklahoma City. USCIS noted that for applicants
    within the jurisdiction of these offices, the pilot program makes it
    mandatory that adjustment of status applications be filed in person
    rather than by mail, after the applicant has scheduled an appointment
    using InfoPass. According to USCIS, the pilot is slated to run through
    September 21, 2007. Additionally, USCIS stated that it is monitoring
    the adjustment of status workflow in three identified offices, Buffalo,
    San Antonio, and San Diego, which are currently within a 90-day
    processing time frame. Under the "90-Day Office" process, processing is
    initiated on the application at the National Benefits Center. To date,
    USCIS noted that it has not captured sufficient statistical data to
    assess the effects of expanding the Dallas pilot to El Paso and
    Oklahoma City. Moreover, it has yet been able to assess whether the
    process in the Dallas pilot or the "90-Day Office" process is more
    likely to result in better customer service, administrative efficiency,
    and national security. USCIS issued a final rule in May 2007 to adjust
    the Immigration and Naturalization Benefit Application and Petition
    Schedule. According to USCIS, this rule will help ensure that the
    agency has the resources necessary to prevent backlogs from developing
    by providing a stable source of revenue to support staff and technology
    to meet USCIS's goal of at least a 20 percent reduction in processing
    times by the end of fiscal year 2009.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although USCIS has explored reducing
    processing times through a number of programs, these programs are still
    in the pilot stages. In some cases, USCIS ended the pilot programs
    because they were inefficient or did not meet program goals. In other
    cases, USCIS has not yet fully assessed the results of its pilot
    programs to determine the extent to which the programs could be
    implemented on a national basis. Moreover, USCIS has not yet
    demonstrated that it has addressed its long-standing technology
    challenges, which have contributed to backlog development. In addition,
    USCIS reported that its revisions to the Immigration and Naturalization
    Benefit Application and Petition Schedule will help it ensure that
    future backlogs do not develop. However, at the time of this review,
    the extent to which these revisions will help to prevent the
    development of future backlogs is unknown.

    Assessment: Generally not achieved.

    Performance expectation: 6. Establish online access to status
    information about benefit applications.

    Summary of findings: GAO findings and assessment: DHS has established
    online access to status information about benefits applications. In
    June 2005, we reported that private attorneys, paralegals, and other
    representatives can use the USCIS Internet Web site to check the status
    of their clients' immigration cases using a USCIS receipt number. Under
    the system, USCIS also notifies the representatives via e-mail when a
    case status changes; for example, when actions are taken, such as the
    approval or denial of an application. As of April 2005, over 300,000
    customers, attorneys, and other representatives had used this system.
    For more information, see Immigration Services: Better Contracting
    Practices Needed at Call Centers, GAO-05-526.

    Assessment: Generally achieved.

    Performance expectation: 7. Establish online filing for benefit
    applications.

    Summary of findings: GAO findings: On November 1, 2006, USCIS announced
    a new Web portal to serve as a "one-stop shop" for all information
    about U.S. immigration and citizenship. According to DHS, the new site
    should facilitate downloading of petitions and applications, filing
    applications electronically, and signing up online for appointments.

    DHS updated information: In March and April 2007, DHS provided updated
    information on its efforts to establish online filing for benefit
    applications. In fiscal year 2006, USCIS reported that of the 5,953,490
    forms filed, a total of 350,838 were filed online. According to updated
    information provided by DHS in April 2007, eight forms are available
    online for e-filing, and other forms are available on the USCIS Web
    site for downloading, completing, and mailing to the appropriate
    Service Center. According to USCIS, the Secure Information Management
    Service, with the citizenship increment released in July 2007, will
    serve as the foundation for the paperless, account-based case
    processing environment, and subsequent releases of the immigration,
    asylum/refugee, and nonimmigration increments will result in additional
    online e-filing capabilities. In addition, USCIS stated that while it
    may be feasible to automate additional forms and make them available
    electronically, USCIS transformation will fundamentally reengineer e-
    filing, increase data integrity, and increase operational efficiency.

    Our assessment: Until USCIS expands its online filing capabilities and
    further defines requirements and capabilities and implements those
    capabilities through its Secure Information Management Service, we
    conclude that DHS has generally not achieved this performance
    expectation. Although DHS has established online filing for eight types
    of applications, there are other types of applications for which online
    filing is not yet available. Moreover, USCIS plans to expand its online
    filing capabilities through its Secure Information Management Service,
    but this service is still in the development stages and has not yet
    been implemented.

    Assessment: Generally not achieved.

    Performance expectation: 8. Establish revised immigration application
    fees based on a comprehensive study.

    Summary of findings: GAO findings: USCIS issued a proposed rule to
    adjust immigration benefit fees and issued the final rule in May 2007.
    As required under the Homeland Security Act of 2002, we reviewed the
    USCIS's funding to determine whether in the absence of appropriated
    funds USCIS was likely to derive sufficient funds from fees to carry
    out its functions. In January 2004, we concluded that USCIS fees were
    not sufficient to fully fund USCIS's operations, in part because (1)
    the fee schedule was based on an outdated fee study that did not
    include all costs of USCIS's operations and (2) costs had increased
    since that study was completed due to an additional processing
    requirement and other actions. We reported that although fees were not
    sufficient, there were insufficient data to determine the full extent
    of the shortfall. A fundamental problem was that USCIS has not had a
    system to track the status of each application as it moves through the
    process. Accordingly, USCIS did not have information on the extent to
    which work on applications in process remained to be finished. In
    addition, USCIS did not know the current cost of each step to process
    each application. The effect was that USCIS knew neither the cost to
    process new applications nor the cost to complete pending applications.
    Further because DHS was still determining how administrative and
    overhead functions would be carried out and the related costs
    allocated, USCIS did not know what future administrative and overhead
    costs would be. For the 3-year period from fiscal year 2001 through
    2003, USCIS reported operating costs exceeded available fees by almost
    $460 million, thus creating the need for appropriated funds. USCIS
    projected that this situation would remain in fiscal year 2004. We
    reported that absent actions to increase fees, reduce processing costs
    and times, or both, as well as to improve the timeliness and
    completeness of fee schedule updates, USCIS would continue to need
    appropriated funds to avoid even greater increases in the backlog of
    pending applications. We recommended that in order to determine the
    cost to process new and pending applications, USCIS should perform a
    comprehensive fee study to determine the cost to process new
    immigration applications and determine the cost to eliminate the
    backlog of pending applications. For more information, see Immigration
    Application Fees: Current Fees Are Not Sufficient to Fund U.S.
    Citizenship and Immigration Services' Operations, GAO-04-309R.

    DHS updated information: On February 1, 2007, USCIS issued a Proposed
    Rule for the Adjustment of the Immigration and Naturalization Benefit
    Applications and Petition Fee Schedule and issued the final rule in May
    2007. Based on a 2004 GAO recommendation, USCIS conducted a
    comprehensive review of its resources and activities for the first time
    in 10 years, employing the Activity Based Costing methodology to
    determine the full costs of immigration benefit applications and in
    which USCIS fees are based on the complexity of the work. In updated
    information provided by DHS in March and April 2007, USCIS stated that
    the new fee structure ensures appropriate funding to meet customer
    service needs and national security requirements and modernizes an
    outdated business infrastructure. According to DHS, the fiscal year
    2008 President's budget reflects that 99 percent of USCIS funding would
    be derived from fee collections. The remaining 1 percent, $30 million,
    is requested as an appropriation to support the Employment Eligibility
    Verification program. According to USCIS, a number of problems caused
    the present day funding gap, including (1) the failure of fees to
    reflect the actual cost of doing business, (2) the loss of significant
    appropriated funding for backlog reduction, (3) the need for payment of
    additional fees because of processing delays, (4) reliance on money
    from temporary programs to fund operating costs, (5) reallocation of
    funds from their intended purpose to cover base operations, and (6)
    insufficient funds to provide for additional, costly security
    requirements. USCIS indicated that additional funding was necessary to
    enhance the security and integrity of the immigration system, improve
    service delivery, and modernize business infrastructure.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. In following up on our prior recommendations,
    we found that USCIS has conducted a comprehensive review of its
    resources and activities and determined that the current fees did not
    reflect current processes or recover the full cost of services being
    provided. USCIS employed an activity-based costing methodology to
    determine the full costs of immigration benefit applications. As a
    result of its comprehensive fee review, USCIS published a proposed rule
    in February 2007 in the Federal Register and a final rule in May 2007
    to increase the immigration and naturalization benefit application
    fees.

    Assessment: Generally achieved.

    Performance expectation: 9. Capture biometric information on all
    benefits applicants.

    Summary of findings: GAO and DHS IG findings: DHS does not yet have the
    capabilities in place to capture and store biometric information on all
    benefits applicants. In 2006 we reported that USCIS was developing
    various systems for capturing and storing biometric information
    including the Biometric Storage System, which would allow USCIS to
    store biometrics information for verification of identity and for
    future form submissions. USCIS planned to expand biometric storage
    capacity to allow storage of biometric information for all USCIS
    customers, allowing information to be resubmitted for subsequent
    security checks. The system would capture 10 prints for Federal Bureau
    of Investigation fingerprint checks and image sets (photograph, press-
    prints, and signatures). Senior officials told the DHS IG that USCIS's
    use of biometrics had been constrained by the capacity of application
    support centers to collect the data. In addition, the DHS IG reported
    in November 2005 that USCIS collected photographs with many
    applications but did not have a system for automated, facial
    recognition screening. For more information, see GAO-06-20. Also, see
    Department of Homeland Security Office of Inspector General, A Review
    of U.S. Citizenship and Immigration Services' Alien Security Checks,
    OIG-06-06 (Washington, D.C.: November 2005).

    DHS updated information: According to DHS officials, the Biometric
    Storage System is in the design phase. According to the Biometric
    Storage System Project Management Plan, the system is intended to
    facilitate the deterrence, detection, and pursuit of immigration
    benefit fraud and promote identification and communication of
    immigration-related information to partners in support of the DHS
    Strategic Plan. In developing the system, USCIS plans to leverage
    existing capabilities already being developed by other components in
    the immigration and border management enterprise. USCIS plans to share
    Biometric Storage System data with the US-VISIT biometric repository
    called IDENT. This should enable data sharing and provide USCIS
    information about applicants with a record in IDENT. USCIS estimated
    that the first phase of Biometric Storage System, which will replace
    existing outdated biometrics infrastructure with a foundation for the
    new system, would begin in the first quarter of fiscal year 2008. At
    that time, USCIS plans to have access to limited biometrics data
    available to the intra-agency community--ICE, CBP, and USCIS--on a view-
    only basis. USCIS reported that although the Biometric Storage System
    is not yet in place, the agency shares biometric information with US-
    VISIT and the Federal Bureau of Investigation, for example.

    Our assessment: Until the Biometric Storage System is more fully
    developed and implemented, we conclude that DHS has generally not
    achieved this performance expectation. DHS has not yet deployed its
    Biometric Storage System, but plans to implement the first phase of the
    system in 2008.

    Assessment: Generally not achieved.

    Performance expectation: 10. Implement an automated background check
    system to track and store all requests for applications.

    Summary of findings: GAO findings: DHS has not yet implemented an
    automated background check system to track and store all requests for
    applications. In 2006 we reported that USCIS's Background Check Service
    system automated and managed the submission of all security checks
    including name and fingerprints from the Federal Bureau of
    Investigation and the Interagency Border Inspection System. We noted
    that the Background Check Service system was intended to track and
    store security check responses in a centralized system and that USCIS
    was preparing to initiate the testing and implementation phase, but
    USCIS had to first select a hosting and production facility for the
    system. For more information, see GAO-06-20.

    DHS updated information: In March, April, and June 2007, USCIS provided
    us with updated information on its efforts to develop and implement its
    Background Check Service. According to USCIS, the schedule for
    deploying the Background Check Service has changed from May 2007 to
    December 2007 because USCIS moved the Background Check Service to a new
    location and encountered problems at the new center. According to
    USCIS, there were several firewall issues and other communication
    problems, but the problems are being worked on by the contractor.

    Our assessment: Until DHS more fully develops and implements its
    Background Check Service, we conclude that DHS has generally not
    achieved this performance expectation. DHS has worked toward deployment
    of the first phase of its Background Check Service, but has pushed back
    its target time frame for deploying the first phase until December 2007.

    Assessment: Generally not achieved.

    Performance expectation: 11. Communicate immigration related
    information to other relevant agencies.

    Summary of findings: GAO findings: DHS has taken some actions to share
    immigration information for enforcement and fraud prevention purposes.
    In 2006 we reported that USCIS had three major projects under way to
    improve its ability to receive and share data within the agency as well
    as with other agencies as part of its information technology
    transformation. First, the data layer/repository project was intended
    to present users with a consolidated system to access information from
    63 USCIS systems rather than the situation where users had to log onto
    separate systems to obtain data. This capability would be available to
    adjudicators and, eventually, to external users. Second, the software
    updates project was intended to upgrade, among other things, USCIS's
    desktop and software capabilities, USCIS's servers and network, and
    USCIS's capability to support the new electronic processes. Third, the
    e-adjudication pilot project was intended to allow paperless
    (electronic) adjudication for certain immigration forms. USCIS could
    not provide a completion date for the data layer and e-adjudication
    pilots due, in part, to uncertainty regarding future funding. USCIS
    expected to complete full implementation for its information technology
    transformation by fiscal year 2010. With regard to US-VISIT, we
    reported that the program intended to collect, maintain, and share
    information on certain foreign nationals who enter and exit the United
    States and facilitate information sharing and coordination within the
    immigration and border management community. For more information, see
    Taxpayer Information: Options Exist to Enable Data Sharing between IRS
    and USCIS but Each Presents Challenges, GAO-06-100 and GAO-06-20.

    DHS updated information: According to updated information provided by
    DHS in March, April, and May 2007, in fiscal year 2006 USCIS launched
    the Integrated Digitization Document Management Program to convert
    existing paper-based A-files and related documents into a digitized
    format; ensure that data are accurately captured electronically from
    paper A files; and provide storage, discovery, and electronic delivery
    of digitized files. USCIS stated that the last function was released in
    June 2007. USCIS has entered into a number of memoranda of
    understanding that outline agreements on immigration-related
    information sharing with other federal agencies and foreign
    governments. In addition, immigration information is shared though
    others programs, such as US-VISIT. US-VISIT, for example, provides for
    the sharing of biometric and biographic-related information between DHS
    components, and the Departments of Justice and State. USCIS, CBP, and
    ICE have also entered into memoranda of understanding with other
    federal agencies and foreign governments to enhance information
    sharing.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has taken some actions to develop and
    launch systems to facilitate information sharing with other agencies,
    such as by allowing for the electronic delivery of files and
    information. Moreover, USCIS has completed memoranda of understanding
    with other agencies.

    Assessment: Generally achieved.

    Performance expectation: 12. Establish training programs to reduce
    fraud in the benefits process.

    Summary of findings: GAO findings: DHS has made progress in
    establishing training programs to reduce fraud in the benefits process,
    but more work remains. In 2006 we reported that adjudicators at USCIS
    service centers and district offices that we visited received some
    fraud-related information or training subsequent to their initial hire.
    We reported that USCIS initial adjudicator training provided
    approximately 4 hours of fraud-related training that focused primarily
    on detecting fraudulent documents. However, USCIS headquarters
    officials responsible for field operations told us that there was no
    standard training regarding fraud trends and that fraud-related
    training varied across field offices. Our interviews indicated that the
    frequency and method for distributing ongoing information about fraud
    detection was not uniform across the service centers and district
    offices we visited. For more information, see Immigration Benefits:
    Additional Controls and a Sanctions Strategy Could Enhance DHS's
    Ability to Control Benefit Fraud, GAO-06-259.

    DHS updated information: In March and April 2007, DHS provided updated
    information outlining its training programs to reduce fraud in the
    benefits process. With regard to adjudication officers, the Office of
    Fraud Detection and National Security has created an hour anti-fraud
    module that is provided to adjudicators attending immigration officer
    basic training, journeyman Immigration Officer training, and
    supervisory adjudications training. USCIS has also developed training
    for specific areas with a past history of fraud. For example, USCIS has
    provided Religious Worker anti-fraud training to 145 officers at the
    California Service Center where adjudication of religious worker
    petitions is centralized. With regard to Office of Fraud Detection and
    National Security Officers, during a basic 3-week national security and
    anti-fraud course at the Federal Law Enforcement Training Center,
    instruction is provided to these officers on such areas as Fraud
    Detection and National Security anti-fraud standard operating
    procedures, practical training on USCIS and other government systems,
    interviewing techniques, national security reporting, Headquarters
    Fraud Detection and National Security intelligence processes, legal
    issues, and report writing. Additionally, all Immigration Officers and
    Intelligence Research Specialists must attend the Fraud Detection and
    National Security Data System training, which serves as the case
    management system for all fraud and national security related work
    conducted by the Office of Fraud Detection and National Security, as
    part of the basic 3-week course and will continue to be provided
    ongoing training as systems evolve through the use of formal
    correspondence, informal conference calls, e-newsletters.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. USCIS has initiated a number training programs
    focused on detecting fraud in the benefits process. However, the intent
    of this performance expectation is not only that DHS has anti-fraud
    training programs, but also that these programs are delivered to
    individuals according to their roles and responsibilities for
    adjudicating applications. DHS did not provide us with evidence on the
    extent to which it has taken actions to ensure that its anti-fraud
    training courses have been distributed and implemented appropriately
    across all field offices, a key concern we identified in our prior
    work. In addition, DHS did not provide us with evidence that it has
    taken actions to ensure that all staff receive the anti-fraud training
    appropriate to their roles and responsibilities in adjudicating certain
    types of applications.

    Assessment: Generally not achieved.

    Performance expectation: 13. Create an office to reduce immigration
    benefit fraud.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. USCIS established
    the Fraud Detection and National Security office to enhance its fraud
    control efforts by serving as its focal point for addressing
    immigration benefit fraud. Established in 2003, Fraud Detection and
    National Security is intended to combat fraud and foster a positive
    control environment by pursuing objectives to develop, coordinate, and
    lead the national antifraud operations for USCIS; oversee and enhance
    policies and procedures pertaining to the enforcement of law
    enforcement background checks on those applying for immigration
    benefits; identify and evaluate vulnerabilities in the various
    policies, practices, and procedures that threaten the legal immigration
    process; recommend solutions and internal controls to address these
    vulnerabilities; and act as the primary USCIS conduit and liaison with
    ICE, CBP, and other members of the law enforcement and intelligence
    community. For more information, see GAO-06-259;
    Assessment: Generally achieved.

    Performance expectation: 14. Implement a fraud assessment program to
    reduce benefit fraud;
    Summary of findings: GAO findings: DHS has taken steps to implement a
    fraud assessment program, but much more work remains. In 2006 we
    reported that the Office of Fraud Detection and National Security,
    established in 2003, outlined a strategy for detecting immigration
    benefit fraud, and undertook two assessments in a series of fraud
    assessments to identify the extent and nature of fraud for certain
    immigration benefits. A complimentary effort is USCIS's plan to develop
    automated fraud analysis tools. USCIS has hired a contractor to develop
    the Fraud Detection and National Security, an automated capability to
    screen incoming applications against known fraud indicators, such as
    multiple applications received from the same person. According to the
    Office of Fraud Detection and National Security, it planned to deploy
    an initial data analysis capability by the third quarter of fiscal year
    2006 and release additional data analyses capabilities at later dates
    but could not predict when these latter capabilities would be achieved.
    However, according to a Fraud Detection and National Security
    operations manager, the near and midterm plans were not aimed at
    providing a full data-mining capability. In the long term, USCIS
    planned to integrate these data analyses tools for fraud detection into
    a new application management system being developed as part of USCIS's
    efforts to transform its business processes for adjudicating
    immigration benefits, which includes developing the information
    technology needed to support these business processes. Also, in the
    long term, according to the Fraud Detection and National Security
    Office Director, a new USCIS application management system would
    ideally include fraud filters to screen applications and remove
    suspicious applications from the processing stream before they are seen
    by adjudicators. For more information, see GAO-06-259.

    DHS updated information: According to USCIS, the purpose of the benefit
    fraud assessment is to use statistically valid methods to determine the
    amount, percentage, and type of fraud in benefit applications to aid
    USCIS in its efforts to develop anti-fraud strategies, establish
    priorities for planning purposes, and identify fraud patterns and
    linkages for referral to ICE. In updated information provided by USCIS
    in April 2007, USCIS reported that it has completed benefit fraud
    assessments for the I-140 Immigrant Petition for Alien Workers, I-90
    Application to Replace a Permanent Resident Card, and Religious Worker
    applications. USCIS reported that it is analyzing data from other
    assessments of the I-129 H1B Employment-based, I-130 Marriage-based, I-
    130 Yemeni-specific Family-based, and 1-589 Asylum applications and
    expect final reports on these assessments to be issued by the end of
    fiscal year 2007. USCIS also reported that it is conducting an
    assessment for I-129 L-1A Employment-based application. USCIS reported
    that as a result of these assessments, it now has baseline data and can
    focus on developing a more comprehensive benefit fraud assessment
    strategy. In fiscal year 2008, USCIS intends to issue a roadmap
    outlining the visa categories for which it will conduct benefit fraud
    assessments in the future. In addition, USCIS officials stated that
    development work for the Fraud Detection and National Security Program
    Data Systems' initial analytical capabilities was completed in the
    first quarter of fiscal year 2007. USCIS indicated that development
    delays for the initial analytical capabilities were encountered due to
    budgetary, contractual, and performance issues. Full implementation of
    the initial capability was delayed until the second quarter of fiscal
    year 2007 due to hardware acquisition issues. According to USCIS,
    procurement activities are underway to award the next development
    contract with a plan that includes a contract award in early third
    quarter of fiscal year 2007 with the implementation of follow-on
    analytical capabilities early in the first quarter of fiscal year 2008.
    USCIS stated that this procurement was briefly delayed due to an
    evaluation of another case management software application. A final
    decision was made in February 2007 to move forward with the development
    of Fraud Detection and National Security Data System.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has completed fraud assessments for three
    types of immigration benefits--having completed two at the time of our
    March 2006 report--and expects to issue final reports on four
    additional assessments later in fiscal year 2007. However, USCIS has
    not yet fully developed a comprehensive strategy for conducting benefit
    fraud assessments. Until DHS does so and demonstrates successful
    application of a strategy and approach for conducting fraud assessment,
    we conclude that DHS has generally not achieved this performance
    expectation. In addition, DHS has taken actions to develop a data
    system to identify fraud through automated analysis tools. However,
    this data analysis capability has not yet been fully implemented.

    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Moderate Progress in Securing the Aviation Sector:

    DHS has implemented a variety of programs to help secure the aviation
    sector. Within the department, TSA is the primary agency with
    responsibility for aviation security efforts. TSA was established in
    2001 with the mission to protect the transportation network while also
    ensuring the free movement of people and commerce. Since its inception,
    TSA has focused much of its efforts on aviation security and has
    developed and implemented a variety of programs and procedures to
    secure commercial aviation. For example, TSA has undertaken efforts to
    strengthen airport security; provide and train a screening workforce;
    prescreen passengers against terrorist watch lists; and screen
    passengers, baggage, and cargo. TSA has implemented these efforts in
    part to meet numerous mandates for strengthening aviation security
    placed on the agency following the September 11, 2001, terrorist
    attacks. These mandates set priorities for the agency and guided TSA's
    initial efforts to enhance aviation security. In addition to TSA, CBP,
    and DHS's Science and Technology Directorate play roles in securing
    commercial aviation. In particular, CBP has responsibility for
    conducting passenger prescreening--or the matching of passenger
    information against terrorist watch lists--for international flights
    operating to or from the United States, as well as inspecting inbound
    air cargo upon its arrival in the United States. The Science and
    Technology Directorate is responsible for the research and development
    of aviation security technologies.

    As shown in table 22, we identified 24 performance expectations for DHS
    in the area of aviation security, and we found that overall DHS has
    made moderate progress in meeting those expectations. Specifically, we
    found that DHS has generally achieved 17 performance expectations and
    has generally not achieved 7 performance expectations.

    Table 22: Performance Expectations and Progress Made in Aviation
    Security:

    Performance expectation: 1. Implement a strategic approach for aviation
    security functions.
    Assessment: Generally achieved.

    Performance expectation: 2. Establish standards and procedures for
    effective airport perimeter security.
    Assessment: Generally not achieved.

    Performance expectation: 3. Establish standards and procedures to
    effectively control access to airport secured areas.
    Assessment: Generally not achieved.

    Performance expectation: 4. Establish procedures for implementing
    biometric identifier systems for airport secured areas access control.
    Assessment: Generally not achieved.

    Performance expectation: 5. Ensure the screening of airport employees
    against terrorist watch lists.
    Assessment: Generally achieved.

    Performance expectation: 6. Hire and deploy a federal screening
    workforce.
    Assessment: Generally achieved.

    Performance expectation: 7. Develop standards for determining aviation
    security staffing at airports.
    Assessment: Generally achieved.

    Performance expectation: 8. Establish standards for training and
    testing the performance of airport screener staff.
    Assessment: Generally achieved.

    Performance expectation: 9. Establish a program and requirements to
    allow eligible airports to use a private screening workforce.
    Assessment: Generally achieved.

    Performance expectation: 10. Train and deploy federal air marshals on
    high-risk flights.
    Assessment: Generally achieved.

    Performance expectation: 11. Establish standards for training flight
    and cabin crews.
    Assessment: Generally achieved.

    Performance expectation: 12. Establish a program to allow authorized
    flight deck officers to use firearms to defend against any terrorist or
    criminal acts.
    Assessment: Generally achieved.

    Performance expectation: 13. Establish policies and procedures to
    ensure that individuals known to pose, or suspected of posing, a risk
    or threat to security are identified and subjected to appropriate
    action.
    Assessment: Generally achieved.

    Performance expectation: 14. Develop and implement an advanced
    prescreening system to allow DHS to compare domestic passenger
    information to the Selectee List and No Fly List.
    Assessment: Generally not achieved.

    Performance expectation: 15. Develop and implement an international
    passenger prescreening process to compare passenger information to
    terrorist watch lists before aircraft departure.
    Assessment: Generally not achieved.

    Performance expectation: 16. Develop and implement processes and
    procedures for physically screening passengers at airport checkpoints.
    Assessment: Generally achieved.

    Performance expectation: 17. Develop and test checkpoint technologies
    to address vulnerabilities.
    Assessment: Generally achieved.

    Performance expectation: 18. Deploy checkpoint technologies to address
    vulnerabilities.
    Assessment: Generally not achieved.

    Performance expectation: 19. Deploy explosive detection systems (EDS)
    and explosive trace detection (ETD) systems to screen checked baggage
    for explosives.
    Assessment: Generally achieved.

    Performance expectation: 20. Develop a plan to deploy in-line baggage
    screening equipment at airports;
    Assessment: Generally achieved.

    Performance expectation: 21. Pursue the deployment and use of in-line
    baggage screening equipment at airports.
    Assessment: Generally achieved.

    Performance expectation: 22. Develop a plan for air cargo security.
    Assessment: Generally achieved.

    Performance expectation: 23. Develop and implement procedures to screen
    air cargo.
    Assessment: Generally achieved.

    Performance expectation: 24. Develop and implement technologies to
    screen air cargo.
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 17;
    Assessment: Generally not achieved: 7;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 23 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of aviation security and our assessment of whether DHS has
    taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 23: Performance Expectations and Assessment of DHS Progress in
    Aviation Security:

    Performance expectation: 1. Implement a strategic approach for aviation
    security functions:

    Summary of findings: GAO findings: DHS has adhered to a strategic
    approach for implementing its aviation security functions, governed
    largely by legislative requirements. TSA, which has responsibility for
    securing all modes of transportation, has also taken steps to ensure
    that it implements its aviation security functions in a strategic
    manner. For example, in April 2006, we reported that TSA has spent
    billions of dollars and implemented a wide range of initiatives to
    strengthen the key components of its passenger and checked baggage
    screening systems--people, processes, and technology. These components
    are interconnected and are critical to the overall security of
    commercial aviation. For more information, see Aviation Security:
    Enhancements Made in Passenger and Checked Baggage Screening, but
    Challenges Remain, GAO-06-371T.

    DHS updated information: In March 2007, the National Strategy on
    Aviation Security and its six supporting plans were released. The six
    supporting plans are Aviation Transportation System Security, Aviation
    Operational Threat Response, Aviation Transportation System Recovery,
    Aviation Domain Surveillance and Intelligence Integration, Domestic
    Outreach, and International Outreach. According to TSA, an Interagency
    Implementation Working Group was established under TSA leadership in
    January 2007 to initiate implementation efforts for the 112 actions
    specified in the supporting plans.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation, as DHS has taken a strategic approach to
    implementing its aviation security functions, and the National Strategy
    on Aviation Security has been issued.

    Assessment: Generally achieved.

    Performance expectation: 2. Establish standards and procedures for
    effective airport perimeter security.

    Summary of findings: GAO findings: In June 2004, we reported on TSA's
    efforts to strengthen the security of airport perimeters (such as
    airfield fencing and access gates), the adequacy of controls
    restricting unauthorized access to secured areas (such as building
    entryways leading to aircraft), and security measures pertaining to
    individuals who work at airports. At the time of our review, we found
    TSA had begun evaluating commercial airport security but had not yet
    implemented a number of congressionally mandated requirements. We
    reported that TSA had begun evaluating the security of airport
    perimeters, but had not yet determined how the results of these
    evaluations could be used to make improvements to the nation's airport
    system as a whole. Specifically, we found that TSA had begun conducting
    regulatory compliance inspections, covert testing of selected security
    procedures, and vulnerability assessments at selected airports. These
    evaluations, though not yet complete at the time of our report,
    identified perimeter security concerns. In addition, we reported that
    TSA intended to compile baseline data on security vulnerabilities to
    enable it to conduct a systematic analysis of airport security
    vulnerabilities on a nationwide basis. TSA said such an analysis was
    essential since it would allow the agency to determine minimum
    standards and the adequacy of security policies and help the agency and
    airports better direct limited resources. Nonetheless, at the time of
    our review, TSA had not yet developed a plan that prioritized its
    assessment efforts, provided a schedule for completing these
    assessments, or described how assessment results would be used to help
    guide agency decisions on what, if any, security improvements were
    needed. We are conducting follow-on work in this area. For more
    information, see Aviation Security: Transportation Security
    Administration Has Made Progress in Managing a Federal Security
    Workforce and Ensuring Security at U.S. Airports, but Challenges
    Remain, GAO-06-597T and Aviation Security: Further Steps Needed to
    Strengthen the Security of Commercial Airport Perimeters and Access
    Controls, GAO-04-728.

    DHS updated information: In April and July 2007, DHS provided us with
    updated sensitive information on efforts to secure airport perimeters.
    This information described TSA's plans to assess technology being used
    to enhance perimeter security, as well as a summary of TSA's policies
    and procedures related to perimeter security. DHS also provided us with
    updated sensitive information on its efforts to enhance security
    procedures for gate screening, aircraft cabin searches, and security
    measures for personnel identification media.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. While DHS has taken actions to enhance
    perimeter security, DHS did not provide us with evidence that these
    actions provide for effective airport perimeter security and thus
    satisfy the intent of this performance expectation. DHS also did not
    provide information or documentation that it had addressed all of the
    relevant requirements established in the Aviation and Transportation
    Security Act and our 2004 recommendations related to (1) identifying
    security weaknesses of the commercial airport system as a whole, (2)
    prioritizing funding to address the most critical needs, or (3)
    reducing the risks posed by airport workers. Until DHS demonstrates how
    the security efforts it has undertaken have strengthened commercial
    airport perimeters security, it will be difficult for it to justify its
    resources needs and clearly identify progress made in the area.

    Assessment: Generally not achieved.

    Performance expectation: 3. Establish standards and procedures to
    effectively control access to airport secured areas.

    Summary of findings: GAO findings and DHS IG findings: In June 2004 we
    reported that TSA had begun evaluating the controls that limit access
    into secured airport areas, but had not completed actions to ensure
    that all airport workers employed in these areas were vetted prior to
    being hired and trained. We also reported that TSA had begun evaluating
    the security of the controls that limited access into secured airport
    areas, but had not yet determined how the results of these evaluations
    could be used to make improvements to the nation's airport system as a
    whole. Specifically, we found that TSA had begun conducting regulatory
    compliance inspections, covert testing of selected security procedures,
    and vulnerability assessments at selected airports. These evaluations-
    -though not completed at the time of our report--identified access
    control security concerns. For example, TSA identified instances where
    airport operators failed to comply with existing security requirements.
    In addition, we reported that TSA intended to compile baseline data on
    security vulnerabilities to enable it to conduct a systematic analysis
    of airport security vulnerabilities on a nationwide basis. TSA said
    such an analysis was essential since it would allow the agency to
    determine minimum standards and the adequacy of security policies and
    help the agency and airports better direct limited resources.
    Nonetheless, at the time of our review, TSA had not yet developed a
    plan that prioritized its assessment efforts, provided a schedule for
    completing these assessments, or described how assessment results would
    be used to help guide agency decisions on what, if any, security
    improvements were needed. More recently, in March 2007, the DHS IG
    reported the results of its access control testing at 14 domestic
    airports of various sizes nationwide. As a result of more than 600
    access control tests, the DHS IG identified various recommendations to
    enhance the overall effectiveness of controls that limit access to
    airport secured areas. We are conducting follow-on work in this area.
    For more information, see GAO-06-597T and GAO-04-728. See also
    Department of Homeland Security Office of Inspector General, Audit of
    Access to Airport Secured Areas (Unclassified Summary), OIG-07-35
    (Washington, D.C., March 15, 2007).

    DHS updated information: In March, April, and July 2007, DHS provided
    us with updated information on its efforts to establish standards and
    procedures for effective access control of airport secured areas. TSA
    reported that its Aviation Direct Access Screening Program was piloted
    in March 2006 and disseminated to Federal Security Directors in August
    2006 to provide for random screening of airport and airline employees
    and employees' property and vehicles as they enter secure areas of
    airports. Transportation security officers screen for the presence of
    explosives, incendiaries, weapons, and other items of interest as well
    as improper airport identification. TSA reported that the Aviation
    Direct Access Screening Program was reissued in March 2007 to include
    boarding gate screening and aircraft cabin searches and to mandate
    participation for airports nationwide. TSA also reported that it
    verifies the identification of individuals present in airport secured
    areas and assists operators and air carriers in performance of security
    responsibilities. DHS also provided us with updated sensitive
    information on its efforts to enhance security procedures for gate
    screening, aircraft cabin searches, and security measures for personnel
    identification media, as well as a description of TSA's plans to assess
    technology being used to enhance access controls and a summary of TSA's
    access control policies and procedures.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken actions to establish procedures
    for access control of airport secured areas. However, DHS did not
    provide us with evidence that these actions provide for effective
    access control for airport secured areas and thus satisfy the intent of
    this performance expectation. Additionally, DHS did not provide
    information or documentation that it had addressed all of the relevant
    requirements established in the Aviation and Transportation Security
    Act and our 2004 recommendations related to (1) identifying security
    weaknesses of the commercial airport system as a whole, (2)
    prioritizing funding to address the most critical needs, or (3)
    reducing the risks posed by airport workers. The recent assessment by
    the DHS OIG identified continuing weaknesses in TSA's procedures to
    prevent unauthorized individuals from access to secured airport areas.
    Until DHS demonstrates how the security efforts it has undertaken have
    strengthened the security of airport access controls, it will be
    difficult for it to justify its resource needs and clearly identify
    progress in this area.

    Assessment: Generally not achieved.

    Performance expectation: 4. Establish procedures for implementing
    biometric identifier systems for airport secured areas access control.

    Summary of findings: GAO findings: In June 2004, we reported that TSA
    had begun efforts to evaluate the effectiveness of security-related
    technologies, such as biometric identification systems. However, we
    reported that TSA had not developed a plan for implementing new
    technologies or balancing the costs and effectiveness of these
    technologies with the security needs of individual airports and the
    commercial airport system as a whole. In September 2005, TSA issued a
    guidance package for biometrics for airport access control. This
    guidance was primarily directed at airport operators who own and
    operate access control systems at airports and manufacturers of
    biometric devices who would need to submit their devices for
    qualification, including performance testing, in order to be
    potentially placed on a TSA biometric Qualified Products List. The
    guidance package includes information on technical and operational
    requirements and standards, implementation guidance, and a plan for
    biometric qualified products list.

    DHS updated information: DHS did not provide us with updated
    information on its efforts to establish procedures for implementing
    biometric identifier systems.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although TSA issued a guidance package, we
    reported in April 2007 that DHS and industry stakeholders continue to
    face difficult challenges in ensuring that the biometric access control
    technologies will work effectively in the maritime environment where
    the Transportation Worker Identification Credential program (DHS's
    effort to develop biometric access control systems to verify the
    identity of individuals accessing secure transportation areas) is being
    initially tested. Because of the challenges in implementing the system
    in the maritime environment, DHS has not yet determined how and when it
    will implement a biometric identification system for access controls at
    commercials airports. We have initiated ongoing work to further assess
    DHS's efforts to establish procedures for implementing biometric
    identifier systems for airport secured areas access control.

    Assessment: Generally not achieved.

    Performance expectation: 5. Ensure the screening of airport employees
    against terrorist watch lists.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as it has worked
    to ensure the screening of airport employees against terrorist watch
    lists. We reported that TSA requires most airport workers who perform
    duties in secured and sterile areas to undergo a fingerprint-based
    criminal history records check. TSA further requires airport operators
    to compare applicants' names against the No Fly List and Selectee List.
    Once workers undergo this review, they are granted access to airport
    areas in which they perform duties. For more information, see GAO-06-
    597T and GAO-04-728.

    Assessment: Generally achieved.

    Performance expectation: 6. Hire and deploy a federal screening
    workforce.

    Summary of findings: GAO findings: DHS has hired and deployed a federal
    screening workforce at airports. TSA initially deployed over 50,000
    screeners (now called transportation security officers) at over 440
    commercial airports nationwide. However, TSA has experienced staffing
    shortages, and we reported that to accomplish its security mission, TSA
    needs a sufficient number of passenger and checked baggage
    transportation security officers trained and certified in the latest
    screening procedures and technology. We reported in February 2004 that
    staffing shortages and TSA's hiring process had hindered the ability of
    some Federal Security Directors to provide sufficient resources to
    staff screening checkpoints and oversee screening operations at their
    checkpoints without using additional measures such as overtime. TSA has
    taken action to address some of these staffing challenges by, for
    example, developing a model to determine the most appropriate
    allocation of transportation security officers among airports and
    implementing human capital initiatives to address hiring and retention
    challenges. For more information, see GAO-06-597T; Airport Passenger
    Screening: Preliminary Observations on Progress Made and Challenges
    Remaining, GAO-03-1173; and Aviation Security: TSA's Staffing
    Allocation Model Is Useful for Allocating Staff among Airports, but Its
    Assumptions Should Be Systematically Reassessed, GAO-07-299.

    DHS updated information: In March 2007, DHS reported that TSA deployed
    a pay-for-performance system, called Performance Accountability and
    Standards System, for transportation security officers, lead and
    supervisory transportation security officers, and screening managers.
    TSA also reported that it has developed a local, decentralized hiring
    process to give Federal Security Directors more control over aspects of
    hiring.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. We have not yet fully evaluated TSA's pay-for-
    performance system or its hiring process. However, DHS has hired and
    deployed a federal screening workforce at airports.

    Assessment: Generally achieved.

    Performance expectation: 7. Develop standards for determining aviation
    security staffing at airports.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation as DHS has
    developed standards for determining aviation security staffing levels.
    In June 2005, TSA submitted its report on aviation security staffing
    standards to Congress. Known as the Staffing Allocation Model, these
    standards are intended to provide an objective measure for determining
    staffing levels for transportation security officers, while staying
    within the congressionally mandated limit of 45,000 full-time
    equivalent screeners. In February 2007, we reported that TSA's Staffing
    Allocation Model is intended to provide a sufficient number of
    transportation security officers--or screeners--to perform passenger
    and checked baggage screening through built-in assumptions, which are
    designed to ensure the necessary levels of security and to minimize
    wait times, along with multiple monitoring mechanisms to assess the
    sufficiency of the model's outputs. However, we identified concerns
    with some of the fiscal year 2006-model assumptions. Further, although
    TSA officials stated that they plan to conduct an annual review of
    select assumptions, and based changes to the fiscal year 2007 model on
    such a review, TSA does not have a mechanism in place for prioritizing
    its review and for ensuring that all assumptions are periodically
    validated to help ensure that they reflect operating conditions. We
    reported that TSA risks basing its staffing allocations on assumptions
    that do not reflect operating conditions if periodic validations are
    not conducted. For more information, see GAO-06-597T; Aviation
    Security: Progress Made in Systematic Planning to Guide Key Investment
    Decisions, but More Work Remains, GAO-07-448T; and GAO-07-299;
    Assessment: Generally achieved.

    Performance expectation: 8. Establish standards for training and
    testing the performance of airport screener staff;
    Summary of findings: GAO findings: DHS has established standards for
    training and testing airport transportation security officers. For
    example, TSA introduced an Online Learning Center that made self-guided
    courses available over the Internet. In December 2005, TSA reported
    completing enhanced explosives detection training for over 18,000
    transportation security officers. TSA also implemented and strengthened
    efforts to collect performance data on the effectiveness of screening
    operations. For example, TSA increased its use of covert testing to
    assess the performance of screening operations. However, we identified
    concerns with transportation security officers' access to online
    training. In May 2005, we also noted that TSA had not yet begun to use
    data from local covert testing to identify training and performance
    needs because of difficulties in ensuring that local covert testing was
    implemented consistently nationwide, although TSA is taking some
    actions to address this issue. In April 2007, we reported that TSA
    monitors transportation security officers' compliance with passenger
    checkpoint screening standard operating procedures through its
    performance accountability and standards system and through local and
    national covert testing. According to TSA officials, the agency
    developed the performance accountability and standards system in
    response to our 2003 report that recommended that TSA establish a
    performance management system that makes meaningful distinctions in
    employee performance and in response to input from TSA airport staff on
    how to improve passenger and checked baggage screening measures. This
    system is used by TSA to measure transportation security officers'
    compliance with passenger checkpoint screening procedures. We have
    ongoing work assessing TSA's covert testing program, which we will
    complete later this year. For more information, see GAO-597T; Aviation
    Security: Screener Training and Performance Measurement Strengthened,
    but More Work Remains, GAO-05-457; and GAO-07-448T.

    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to train and test the performance of airport
    screener staff. TSA reported that its Aviation Screening Assessment
    Program, which is to be implemented at all airports this year, is
    intended to use local screening workforce and Bomb Appraisal Officers
    to perform covert testing of passenger and baggage screening
    capabilities. TSA reported that the program is intended to measure
    screening performance using standardized test scenarios. In addition,
    TSA reported that it is implementing Improvised Explosive Devices
    Checkpoint Screening Drills in which transportation security officers
    will be routinely exposed to simulated items, without warning.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation, as DHS has established standards for training
    and testing for airport transportation security officers.

    Assessment: Generally achieved.

    Performance expectation: 9. Establish a program and requirements to
    allow eligible airports to use a private screening workforce.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as DHS has taken
    actions to establish a program that allows eligible airports to use
    private screeners. In March 2006, we reported that TSA created the
    Screening Partnership Program to allow all commercial airports an
    opportunity to apply to TSA for permission to use qualified private
    screening contractors and private sector screeners. We noted that TSA
    developed performance goals and began drafting related measures and
    targets to assess the performance of private screening contractors
    under the Screening Partnership Program in the areas of security,
    customer service, costs, workforce management, and innovation. However,
    we noted that as TSA moved forward with this program, it had
    opportunities to strengthen the management and oversight of the
    program, including providing clear guidance to program applicants on
    their roles and responsibilities at airports where a privatized
    screener workforce operates and identifying the underlying reasons for
    the small number of program applicants. For more information, see
    Aviation Security: Progress Made to Set Up Program Using Private-Sector
    Airport Screeners, but More Work Remains, GAO-06-166 and Aviation
    Security: Preliminary Observations on TSA's Progress to Allow Airports
    to Use Private Passenger and Baggage Screening Services, GAO-05-126;
    Assessment: Generally achieved.

    Performance expectation: 10. Train and deploy federal air marshals on
    high-risk flights;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as DHS has trained
    and deployed federal air marshals on flights deemed high-risk. To carry
    out its mission, the Federal Air Marshal Service deploys federal air
    marshals on board flights either destined for or originating in the
    United States. Deployed to passenger flights, federal air marshals
    dress in plain clothes to blend in with other passengers and perform
    their duties discreetly in an effort to avoid drawing undue attention
    to themselves. We have ongoing work assessing the Federal Air Marshal
    Service program. For more information, see Aviation Security: Federal
    Air Marshal Service Could Benefit from Improved Planning and Controls,
    GAO-06-203;
    Assessment: Generally achieved.

    Performance expectation: 11. Establish standards for training flight
    and cabin crews;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as it has
    established standards for training flight and cabin crews. In September
    2005, we reported that TSA enhanced guidance and standards for flight
    and cabin crew member security training with input from stakeholders.
    Specifically, TSA revised the guidance and standards to include
    additional training elements required by law and to improve the
    organization and clarity of the guidance and standards. TSA also took
    steps to strengthen its efforts to oversee air carriers' flight and
    cabin crew security training to ensure they were complying with the
    required guidance and standards. For example, in January 2005, TSA
    added staff with expertise in designing training programs to review air
    carriers' crew member security training curriculums and developed a
    standard form for staff to use to conduct their reviews. TSA also
    developed an advanced voluntary self-defense training program with
    input from stakeholders and implemented the program in December 2004.
    However, we noted that TSA had not established strategic goals and
    performance measures for assessing the effectiveness of the training
    because it considered its role in the training program as regulatory.
    We also noted that TSA lacked adequate controls for monitoring and
    reviewing air carriers' crew member security training, including
    written procedures for conducting and documenting these reviews. For
    more information, see Aviation Security: Flight and Cabin Crew Member
    Security Training Strengthened, but Better Planning and Internal
    Controls Needed, GAO-05-781;
    Assessment: Generally achieved.

    Performance expectation: 12. Establish a program to allow authorized
    flight deck officers to use firearms to defend against any terrorist or
    criminal acts;
    Summary of findings: GAO and DHS IG findings: According to the DHS IG,
    TSA's Federal Flight Deck Officer program is to select, train,
    deputize, arm with handguns, and supervise volunteer airline pilots and
    other flight deck crew members for the purpose of defending the flight
    decks of passenger and cargo aircraft. The IG reported in December
    2006, they surveyed a sample of federal flight deck officers to
    identify pilot concerns about the Federal Flight Deck Officer program.
    Pilot concerns included not being given time off to attend training,
    the remote location of the training and the amount of time needed to
    get to the training site, TSA's weapons carriage policy, and the type
    of credentials used to identify federal flight deck officers. These
    concerns may have dissuaded pilots from participating in the program,
    thus reducing the number of federal flight deck officers. In December
    2005, management of the Federal Flight Deck Officer program was
    assigned to TSA's Office of Law Enforcement-Federal Air Marshal
    Service. This office established focus groups to foster communications
    among the federal flight deck officer community, the airline industry,
    and professional associations, and to address federal flight deck
    officer operational concerns. Also, the office management established a
    federal flight deck officer working group to assess recommendations on
    proposals concerning federal flight deck officer credentials and
    badges, checkpoint requirements, weapons issues (including transport,
    storage, and qualifications), communications protocols, training, and
    industry liaison. While TSA has now trained and deputized federal
    flight deck officers and has addressed various procedural and process
    issues, the DHS IG concluded that more needed to be accomplished to
    maximize the use of federal flight deck officers on international and
    domestic flights. TSA continues to work with federal flight deck
    officers, Federal Security Directors, and industry to improve Federal
    Flight Deck Officer program effectiveness. For more information, see
    Department of Homeland Security Office of Inspector General,
    Improvements Needed in TSA's Federal Flight Deck Officer Program, OIG-
    07-14 (Washington, D.C.: December 2006).

    DHS updated information: In March 2007, DHS reported that it has
    implemented a Federal Flight Deck Officer program for all-cargo
    aircraft operators and noted that this program provides training to
    pilots, program management, resources, and equipment to protect the
    aircraft.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. The DHS IG reported that TSA has established
    and is working to improve the Federal Flight Deck Officer Program.
    However, the DHS IG also reported that a variety of challenges have
    affected the program, including the amount of time and location of
    training, the weapons carriage policy, and type of credentials used to
    identify federal flight deck officers.

    Assessment: Generally achieved.

    Performance expectation: 13. Establish policies and procedures to
    ensure that individuals known to pose, or suspected of posing, a risk
    or threat to security are identified and subjected to appropriate
    action.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. TSA ensures that
    all passengers on domestic flights are checked against the Selectee
    List and No Fly List. Passenger prescreening is used to identify
    passengers who may pose a higher risk to aviation security than other
    passengers and therefore should receive additional and more thorough
    security scrutiny. Air carriers check passenger information against
    government supplied watch lists that contain the names of individuals
    who, for certain reasons, are either not allowed to fly (the No Fly
    List) or pose a higher than normal risk and therefore require
    additional security attention (the Selectee List). Passengers on the No
    Fly List are denied boarding passes and are not permitted to fly unless
    cleared by law enforcement officers. Passengers who are on the Selectee
    List are issued boarding passes, and they and their baggage undergo
    additional security measures. For more information, see Aviation
    Security: Secure Flight Development and Testing Under Way, but Risks
    Should Be Managed as System Is Further Developed, GAO-05-356;
    Assessment: Generally achieved.

    Performance expectation: 14. Develop and implement an advanced
    prescreening system to allow DHS to compare domestic passenger
    information to the Selectee List and No Fly List;
    Summary of findings: GAO findings: DHS is developing an advanced
    passenger prescreening system called Secure Flight. However, TSA has
    faced challenges in developing and implementing Secure Flight and has
    not yet completed its development efforts. In 2006 we reported that TSA
    had not conducted critical activities in accordance with best practices
    for large-scale information technology programs and had not followed a
    disciplined life cycle approach in developing Secure Flight, in which
    all phases of the project are defined by a series of orderly steps and
    the development of related documentation. We also found that while TSA
    had taken steps to implement an information security management program
    for protecting Secure Flight information and assets, its efforts were
    incomplete, based on federal standards and industry best practices. In
    addition, in 2006 we reported that prior to TSA's rebaselining effort
    of Secure Flight, several oversight reviews of the program had been
    conducted that raised questions about program management, including the
    lack of fully defined requirements. In January 2007, TSA reported that
    it has completed its rebaselining efforts, which included reassessing
    program goals and capabilities and developing a new schedule and cost
    estimates. However, we have not yet assessed TSA's progress in
    addressing past problems. In February 2007, we reported that as TSA
    moves forward with Secure Flight, it will need to employ a range of
    program management disciplines, which we previously found missing, to
    control program cost, schedule, performance, and privacy risks. We have
    ongoing work reviewing DHS's efforts to develop and implement Secure
    Flight, including progress made during its rebaselining efforts. For
    more information, see Aviation Security: Management Challenges Remain
    for the Transportation Security Administration's Secure Flight Program,
    GAO-06-864T; Aviation Security: Transportation Security Administration
    Did Not Fully Disclose Uses of Personal Information during Secure
    Flight Program Testing in Initial Privacy Notes, but Has Recently Taken
    Steps to More Fully Inform the Public, GAO-05-864R; and Aviation
    Security: Secure Flight Development and Testing Under Way, but Risks
    Should Be Managed as System Is Further Developed, GAO-05-356; DHS
    updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop and implement Secure Flight. DHS
    reported that as a result of its rebaselining efforts, government
    controls were developed to implement Secure Flight, and DHS provided
    information on Secure Flight's technical and system engineering
    management plans and requirements, concept of operations, risk
    assessments, and privacy issues. DHS reported that it plans to begin
    parallel operations with the first groups of domestic aircraft
    operators in the first quarter of fiscal year 2009 and to take over
    full responsibility for watch list matching in fiscal year 2010; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS is continuing efforts to develop the
    Secure Flight program, but has not yet completed its development
    efforts and has not yet implemented the program;
    Assessment: Generally not achieved.

    Performance expectation: 15. Develop and implement an international
    passenger prescreening process to compare passenger information to
    terrorist watch lists before aircraft departure;
    Summary of findings: GAO findings: DHS has not yet implemented
    enhancements to its passenger prescreening process for passengers on
    international flights departing from or bound to the United States. We
    recently reported that the existing identity-matching component of
    DHS's process involves separate matching activities conducted by air
    carriers (prior to a flight's departure and pursuant to TSA
    requirements) and by CBP (generally after a flight's departure). We
    reported that as with domestic passenger prescreening, air carriers
    conduct an initial match of self-reported passenger name record data
    against the No Fly List and Selectee List before international flight
    departures. CBP's process, in effect, supplements the air carrier
    identity-matching for international flights by comparing additional
    passenger information collected from passports (this information
    becomes part of Advanced Passenger Information System data), against
    the No Fly List and Selectee List and other government databases. Under
    current federal regulations for CBP's prescreening of passengers on
    international flights, air carriers are required to provide the U.S.
    government with passenger name record data as well as Advanced
    Passenger Information System data to allow the government to conduct,
    among other things, identity matching procedures against the No Fly
    List and Selectee List--which typically occur just after or at times
    just before the departure of international flights traveling to or from
    the United States, respectively. To address a concern that the federal
    government's identity matching may not be conducted in a timely manner,
    in 2004, Congress mandated that DHS issue a proposed rule requiring
    that the U.S. government's identity-matching process occur before the
    departure of international flights. CBP published this proposed rule in
    July 2006 and, if implemented, it would allow the U.S. government to
    conduct passenger prescreening in advance of flight departure, and
    would eliminate the need for air carriers to continue performing an
    identity-matching function for international flights. For more
    information, see GAO-07-448T and Aviation Security: Efforts to
    Strengthen International Passenger Prescreening Are Under Way, but
    Planning and Implementation Issues Remain, GAO-07-346; DHS updated
    information: In March 2007, TSA reported that it was working with CBP
    to combine the predeparture Advance Passenger Information System and
    Secure Flight into one DHS solution; Our assessment: We conclude that
    DHS has generally not achieved this performance expectation. We
    identified various problems with DHS's implementation of the
    international prescreening process and made recommendations to help
    address some of those concerns. In addition, while efforts to define
    functional requirements and operations are underway for aligning
    international and domestic passenger prescreening, full implementation
    of an integrated system will not occur for several years, as Secure
    Flight is not yet operational for domestic passenger prescreening;
    Assessment: Generally not achieved.

    Performance expectation: 16. Develop and implement processes and
    procedures for physically screening passengers at airport checkpoints;
    Summary of findings: GAO findings: DHS has developed and implemented
    processes and procedures for screening passengers at checkpoints.
    Passenger screening is a process by which authorized TSA personnel
    inspect individuals and property to deter and prevent the carriage of
    any unauthorized explosives, incendiary, weapon, or other dangerous
    item onboard an aircraft or into a sterile area. Authorized TSA
    personnel must inspect individuals for prohibited items at designated
    screening locations. The passenger-screening functions are X-ray
    screening of property, walk-through metal detector screening of
    individuals, hand-wand or pat-down screening of individuals, physical
    search of property and trace detection for explosives, and behavioral
    observation. We have also reported that TSA has developed processes and
    procedures for screening passengers at security checkpoints, balancing
    security needs with efficiency and customer service considerations. TSA
    has also revised these policies and procedures to generally improve the
    efficiency, effectiveness, and clarity of the procedures, but could
    improve the evaluation of procedures before they are implemented. In
    April 2007, we reported that standard operating procedures
    modifications were proposed based on the professional judgment of TSA
    senior-level officials and program-level staff. In some cases, TSA
    tested proposed modifications at selected airports to help determine
    whether the changes would achieve their intended purpose. However, we
    reported that TSA's data collection and analyses could be improved to
    help TSA determine whether proposed procedures that are operationally
    tested would achieve their intended purpose. We also reported that
    TSA's documentation on proposed modifications to screening procedures
    was not complete. We noted that without more complete documentation,
    TSA may not be able to justify key modifications to passenger screening
    procedures to Congress and the traveling public. For more information,
    see Aviation Security: Risk, Experience, and Customer Concerns Drive
    Changes to Airline Passenger Screening Procedures, but Evaluation and
    Documentation of Proposed Changes Could Be Improved, GAO-07-634;
    Aviation Security: TSA's Change to Its Prohibited Items List Has Not
    Resulted in Any Reported Security Incidents, but the Impact of the
    Change on Screening Operations Is Inconclusive, GAO-07-623R; GAO-03-
    1173; and GAO-06-371T.

    DHS updated information: In March 2007, DHS reported that it trained
    tens of thousands of transportation security officers and took various
    regulatory actions to address concerns regarding liquids and gels
    carried aboard aircraft. DHS reported that TSA worked with technical
    experts and counterparts in other countries to harmonize security
    procedures. TSA also reported making changes to the Prohibited Items
    List to allow transportation security officers to focus on detecting
    high-risk threats which have the ability to cause catastrophic damage,
    such as improvised explosive devices. Moreover, TSA provided
    information on two recent initiatives intended to strengthen the
    passenger checkpoint screening process. TSA's Screening Passenger by
    Observation Technique program is a behavior observation and analysis
    program designed to provide TSA Behavior Detection Officers with a
    nonintrusive means of identifying potentially high-risk individuals who
    exhibit behaviors indicative of inordinate levels of stress, fear,
    and/or deception that could indicate possible terrorist or criminal
    activity. TSA reported that this program is implemented using a threat-
    based strategy and is based on other behavioral analysis programs used
    by law enforcement and security personnel. In addition, TSA's Travel
    Document Checker program replaces current travel document checkers with
    transportation security officers who have access to sensitive security
    information on the threat posture of the aviation industry and check
    for fraudulent documents.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation, as DHS has developed and implemented processes
    and procedures for screening passengers at airport checkpoints.

    Assessment: Generally achieved.

    Performance expectation: 17. Develop and test checkpoint technologies
    to address vulnerabilities.

    Summary of findings: GAO findings: DHS has undertaken efforts to
    develop and test checkpoint technologies to address vulnerabilities
    that may be exploited by identified threats such as improvised
    explosive devices. For example, TSA recently placed increased focus on
    the threats posed by liquid explosives and has been developing
    technology to automatically detect liquid explosives in bottles. TSA
    has also been modifying commercial-off-the-shelf technologies to
    mitigate threats posed by passengers bearing improvised explosive
    devices. However, these machines do not automatically detect
    explosives. For example, TSA is modifying a whole body image to screen
    passengers for explosives, plastics, and metals otherwise obfuscated by
    clothing. The machine uses x-ray backscatter technology to produce an
    image that transportation security officers interpret. We are currently
    reviewing DHS and TSA's efforts to develop and test technologies and
    will be reporting on these efforts later this year. For more
    information, see GAO-06-371T.

    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop and test checkpoint technologies.
    TSA reported that it is exploring portable explosive detection system
    units and explosive trace portals at various airport locations and is
    operationally testing a whole body imaging system. TSA also reported
    that it is planning to pilot test a cast and prosthetics screening
    technology and an automated explosives detection system for carry-on
    baggage. TSA also reported that, in partnership with the Science and
    Technology Directorate, it is assessing the capabilities of advanced x-
    ray technologies to provide enhanced capabilities in the detection of
    improvised explosives devices in carry-on items.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has reported taking actions to develop and
    test checkpoint technologies. The full extent of DHS's efforts is the
    focus of an ongoing GAO review scheduled for completion later this year.

    Assessment: Generally achieved.

    Performance expectation: 18. Deploy checkpoint technologies to address
    vulnerabilities.

    Summary of findings: GAO findings: DHS has not yet deployed checkpoint
    technologies to address key existing vulnerabilities. For example, in
    July 2006, TSA provided us with information that 97 explosives trace
    portal machines had been installed at over 37 airports. This new
    technology uses puffs of air to help detect the presence of explosives
    on individuals. However, DHS identified problems with these machines
    and has halted their deployment. DHS's fiscal year 2007 budget request
    stated that TSA expected that 434 explosives trace portal machines
    would be in operation throughout the country by September 2007. TSA is
    also developing backscatter technology, but limited progress has been
    made in fielding this technology at airport passenger screening
    checkpoints. We are currently reviewing TSA's technology development
    and deployment efforts and will be reporting on these efforts later
    this year. For more information, see GAO-06-371T.

    DHS updated information: DHS reported in March 2007 that extensive
    deployment of new technologies will not be realized for another 2
    years.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has faced challenges and delays in
    deploying checkpoint technologies to effectively address
    vulnerabilities, and TSA has reported that deployment of new
    technologies is likely 2 years away.

    Assessment: Generally not achieved.

    Performance expectation: 19. Deploy EDS and ETD systems to screen
    checked baggage for explosives.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as TSA has
    deployed EDS and ETD systems at the nation's airports. From November
    2001 through June 2006, TSA procured and installed about 1,600 EDS
    machines and about 7,200 ETD machines to screen checked baggage for
    explosives at over 400 commercial airports. TSA made progress in
    fielding EDS and ETD equipment at the nation's airports, placing this
    equipment in a stand-alone mode--usually in airport lobbies--to conduct
    the primary screening of checked baggage for explosives, due to
    congressional mandates to field the equipment quickly and limitations
    in airport design. For more information, see Aviation Security: TSA
    Oversight of Checked Baggage Screening Procedures Could Be
    Strengthened, GAO-06-869 and GAO-06-371T.

    Assessment: Generally achieved.

    Performance expectation: 20. Develop a plan to deploy in-line baggage
    screening equipment at airports.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    a plan to deploy in-line baggage screening equipment at airports, based
    in part on a recommendation we made. The plan is aimed at increasing
    security through deploying more EDS machines, lowering program life-
    cycle costs, minimizing impacts on TSA and airport and airline
    operations, and providing a flexible security infrastructure. In March
    2005, we reported that at nine airports where TSA had agreed to help
    fund the installation of in-line EDS systems, TSA estimated that
    screening with in-line EDS machines could save the federal government
    about $1.3 billion over 7 years. In February 2006, TSA reported that
    many of the initial in-line EDS systems did not achieve the anticipated
    savings. However, recent improvements in the design of the in-line EDS
    systems and EDS screening technology offer the opportunity for higher-
    performance and lower-cost screening systems. Screening with in-line
    EDS systems may also result in security benefits by reducing the need
    for TSA to use alternative screening procedures, such as screening with
    explosives detection canines and physical bag searches, which involve
    trade-offs in security effectiveness. For more information, see GAO-06-
    869; GAO-06-371T; and GAO-07-448T.

    Assessment: Generally achieved.

    Performance expectation: 21. Pursue the deployment and use of in-line
    baggage screening equipment at airports.

    Summary of findings: GAO findings: Despite delays in the widespread
    deployment of in-line systems due to the high upfront capital
    investment required, DHS is pursuing the deployment and use of in-line
    explosives detection equipment and is seeking creative financing
    solutions to fund the deployment of these systems. TSA determined that
    recent improvements in the design of the in-line EDS systems and EDS
    screening technology offer the opportunity for higher performance and
    lower cost screening systems. Screening with in-line EDS systems could
    also result in security benefits by reducing congestion in airport
    lobbies and reducing the need for TSA to use alternative screening
    procedures, such as screening with explosives detection canines and
    physical bag searches. TSA's use of these procedures, which are to be
    used only when volumes of baggage awaiting screening pose security
    vulnerabilities or when TSA officials determine that there is a
    security risk associated with large concentrations of passengers in an
    area, has involved trade-offs in security effectiveness. TSA has begun
    to systematically plan for the optimal deployment of checked baggage
    screening systems, but resources have not been made available by
    Congress to fund the installation of in-line EDS machines on a large-
    scale basis. TSA reported that as of June 2006, 25 airports had
    operational in-line EDS systems and an additional 24 airports had in-
    line systems under development. In May 2006, TSA reported that under
    current investment levels, installation of optimal checked baggage
    screening systems would not be completed until approximately 2024. For
    more information, see GAO-06-869 and GAO-06-371T.

    DHS updated information: In March 2007, DHS reported that it is working
    with its airport and air carrier stakeholders to improve checked
    baggage screening solutions and to look creatively at in-line baggage
    screening system solutions to enhance security and free up lobby space
    at airports.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has undertaken efforts to deploy and use
    in-line baggage screening equipment, but challenges exist to deploying
    in-line systems due to the high costs of the systems and questions
    regarding how the systems will be funded.

    Assessment: Generally achieved.

    Performance expectation: 22. Develop a plan for air cargo security.

    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    a strategic plan for domestic air cargo security and has taken actions
    to use risk management principles to guide investment decisions related
    to air cargo bound for the United States from a foreign country,
    referred to as inbound air cargo, but these actions are not yet
    complete. With regard to domestic air cargo, we reported that TSA
    completed an Air Cargo Strategic Plan in November 2003 that outlined a
    threat-based risk management approach to securing the nation's air
    cargo transportation system. TSA's plan identified strategic objectives
    and priority actions for enhancing air cargo security based on risk,
    cost, and deadlines. With regard to inbound air cargo, in April 2007,
    we reported that TSA and CBP have taken some preliminary steps to use
    risk management principles to guide their investment decisions related
    to inbound air cargo, as advocated by DHS, but most of these efforts
    are in the planning stages. We reported that although TSA completed a
    risk-based strategic plan to address domestic air cargo security, it
    has not developed a similar strategy for addressing inbound air cargo
    security, including how best to partner with CBP and international air
    cargo stakeholders. Further, TSA has identified the primary threats
    associated with inbound air cargo, but has not yet assessed which areas
    of inbound air cargo are most vulnerable to attack and which inbound
    air cargo assets are deemed most critical to protect. TSA plans to
    assess inbound air cargo vulnerabilities and critical assets--two
    crucial elements of a risk-based management approach--but has not yet
    established a methodology or time frame for how and when these
    assessments will be completed. Without such assessments, we reported
    that TSA may not be able to appropriately focus its resources on the
    most critical security needs. We recommended that TSA more fully
    develop a risk-based strategy to address inbound air cargo security,
    including establishing goals and objectives for securing inbound air
    cargo and establishing a methodology and time frames for completing
    assessments of inbound air cargo vulnerabilities and critical assets
    that can be used to help prioritize the actions necessary to enhance
    security. For more information, see Aviation Security: Federal Action
    Needed to Strengthen Domestic Air Cargo Security, GAO-06-76, and
    Aviation Security: Federal Efforts to Secure U.S.-Bound Air Cargo Are
    in the Early Stages and Could Be Strengthened, GAO-07-660.

    Assessment: Generally achieved.

    Performance expectation: 23. Develop and implement procedures to screen
    air cargo.

    Summary of findings: GAO findings: DHS has taken actions to develop and
    implement procedures for screening domestic air cargo.[A] With regard
    to domestic air cargo, air carriers are responsible for implementing
    TSA security requirements that include measures related to the
    acceptance, handling, and inspection of cargo; training of employees in
    security and cargo inspection procedures; testing employee proficiency
    in cargo inspection; and access to cargo areas and aircraft, and TSA
    inspects carriers' compliance. We reported in October 2005 that TSA had
    significantly increased the number of domestic air cargo inspections
    conducted of air carrier and indirect air carrier compliance with
    security requirements. We also reported that TSA exempted certain cargo
    from random inspection because it did not view the exempted cargo as
    posing a significant security risk. However, airline industry
    stakeholders told us that while the rationale for exempting certain
    types of cargo from random inspection was understandable, the
    exemptions may have created potential security risks and
    vulnerabilities. Partly on the basis of a recommendation we made, TSA
    is evaluating existing exemptions to determine whether they pose a
    security risk and has reduced some exemptions that were previously
    allowed. We also noted that TSA had not developed performance measures
    to determine to what extent air carriers and indirect air carriers were
    complying with security requirements and had not analyzed the results
    of inspections to systematically target future inspections on those
    entities that pose a higher security risk to the domestic air cargo
    system. We have reported that without these performance measures and
    systematic analyses, TSA would be limited in its ability to effectively
    target its workforce for future inspections and fulfill its oversight
    responsibilities for this essential area of aviation security. With
    regard to inbound air cargo, in April 2007, we reported that TSA issued
    its air cargo security rule in May 2006, which included a number of
    provisions aimed at enhancing the security of inbound air cargo. For
    example, the final rule acknowledged that TSA amended its security
    directives and programs to triple the percentage of cargo inspected on
    domestic and foreign passenger aircraft. To implement the requirements
    contained in the air cargo security rule, TSA drafted revisions to its
    existing security programs for domestic and foreign passenger air
    carriers and created new security programs for domestic and foreign all-
    cargo carriers. However, we reported that TSA requirements continue to
    allow inspection exemptions for certain types of inbound air cargo
    transported on passenger air carriers. We reported that this risk was
    further heightened because TSA has limited information on the
    background of and security risk posed by foreign shippers whose cargo
    may fall within these exemptions. TSA officials stated that the agency
    is holding discussions with industry stakeholders to determine whether
    additional revisions to current air cargo inspection exemptions are
    needed. We also reported that TSA inspects domestic and foreign
    passenger air carriers with service to the United States to assess
    whether the air carriers are complying with air cargo security
    requirements, such as inspecting a certain percentage of air cargo. We
    reported, however, that TSA did not currently inspect all air carriers
    transporting cargo into the United States. While TSA's compliance
    inspections provide useful information, the agency has not developed an
    inspection plan that includes performance goals and measures to
    determine to what extent air carriers are complying with security
    requirements. For more information, see GAO-06-76 and GAO-07-660.

    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop and implement procedures for
    screening air cargo. DHS noted that because the Aviation and
    Transportation Security Act set specific milestones for screening cargo
    and baggage carried on passenger aircraft, TSA focused initially on
    passenger aircraft. DHS issued the Air Cargo Security Requirements
    Final Rule in May 2006 that requires airports that currently maintain a
    Security Identification Display Area to expand the area to air cargo
    operating areas. At airports where a Security Identification Display
    Area is nonexistent but all-cargo operations occur, TSA requires
    aircraft operators to incorporate other security measures, such as
    security threat assessments for all persons with unescorted access to
    cargo, into their programs. TSA also reported that as of March 2007, it
    had 300 inspectors dedicated solely to oversight of the air cargo
    supply chain. During 2006, TSA reported that inspectors conducted more
    than 31,000 compliance reviews of air carriers and freight
    consolidators and have conducted covert testing of the domestic air
    cargo supply chain. TSA also reported that it is developing an air
    cargo risk-based targeting system to assess the risk of cargo to be
    moved on all aircraft operating within the United States.

    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has developed and implemented procedures
    to screen domestic and inbound air cargo. Furthermore, TSA has
    significantly increased the number of domestic air cargo inspections
    conducted of air carrier and indirect air carrier compliance with
    security requirements. However, as we previously reported, TSA
    requirements continue to allow inspection exemptions for certain types
    of inbound air cargo transported on passenger air carriers, which could
    create security vulnerabilities, and TSA has limited information on the
    background of and security risk posed by foreign shippers whose cargo
    may fall within these exemptions.

    Assessment: Generally achieved.

    Performance expectation: 24. Develop and implement technologies to
    screen air cargo.

    Summary of findings: GAO findings: DHS has not yet developed and
    implemented technologies needed to screen air cargo. TSA's plans for
    enhancing air cargo security include developing and testing air cargo
    inspection technology. However, these planned enhancements may pose
    operational, financial, and technological challenges to the agency and
    air cargo industry stakeholders. In October 2005 we reported that TSA
    had completed a pilot program focused on testing the applicability of
    EDS technology to inspect individual pieces of air cargo, referred to
    as break bulk cargo. Although EDS is an approved method for inspecting
    passenger baggage, it had not been tested by TSA to determine its
    effectiveness in inspecting air cargo. According to TSA officials, TSA
    must review the results of its EDS pilot test before the agency would
    determine whether to certify EDS for inspecting air cargo. According to
    TSA officials, the agency has also been pursuing multiple technologies
    to automate the detection of explosives in the types and quantities
    that would cause catastrophic damage to an aircraft in flight. TSA
    planned to develop working prototypes of these technologies by
    September 2006 and complete operational testing by 2008. TSA
    acknowledged that full development of these technologies may take 5 to
    7 years. In April 2007, we reported that DHS has taken some steps to
    incorporate new technologies into strengthening the security of air
    cargo, which will affect both domestic and inbound air cargo. However,
    we reported that TSA and DHS's Science and Technology Directorate were
    in the early stages of evaluating available aviation security
    technologies to determine their applicability to the domestic air cargo
    environment. TSA and the Science and Technology Directorate are seeking
    to identify and develop technologies that can effectively inspect and
    secure air cargo with minimal impact on the flow of commerce. According
    to TSA officials, there is no single technology capable of efficiently
    and effectively inspecting all types of air cargo for the full range of
    potential terrorist threats, including explosives and weapons of mass
    destruction. Accordingly, TSA, together with the Science and Technology
    Directorate, is conducting a number of pilot programs that are testing
    a variety of different technologies that may be used separately or in
    combination to inspect and secure air cargo. These pilot programs seek
    to enhance the security of air cargo by improving the effectiveness of
    air cargo inspections through increased detection rates and reduced
    false alarm rates, while addressing the two primary threats to air
    cargo identified by TSA--hijackers on an all-cargo aircraft and
    explosives on passenger aircraft. TSA anticipates completing its pilot
    tests by 2008, but has not yet established time frames for when it
    might implement these methods or technologies for the inbound air cargo
    system. According to DHS and TSA officials, further testing and
    analysis will be necessary to make determinations about the
    capabilities and costs of these technologies when employed for
    inspecting inbound air cargo at foreign locations. For more
    information, see GAO-06-76 and GAO-07-660.

    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop and implement air cargo screening
    technologies. TSA reported that new technologies to physically screen
    air cargo will not be available in the near term. TSA reported that it
    is using and improving existing technologies to screen air cargo. For
    example, TSA reported increasing the use of canine teams and stated
    that these teams dedicate about 25 percent of their time of air cargo
    security activities.

    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS focused initial aviation security efforts
    on fulfilling congressional mandates related to passenger and baggage
    screening and has faced challenges in its efforts to develop and
    implement air cargo screening technologies. In prior work, we reported
    that TSA has taken actions to develop technologies for screening air
    cargo, but had not yet tested the effectiveness of various technologies
    in inspecting air cargo. We also reported that full development of
    technologies for screening air cargo may be years away.

    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken a
    sufficient number of actions to satisfy most elements of the
    performance expectation. An assessment of "generally not achieved" may
    be warranted even where DHS has put forth substantial effort to satisfy
    some but not most elements of an expectation. In cases when we or the
    DHS IG have not completed work upon which to base an assessment of DHS
    actions to satisfy a performance expectation, and/or the information
    DHS provided did not enable us to clearly determine the extent to which
    DHS has achieved the performance expectation, we indicated "no
    assessment made."

    [A] The terms "inspecting" and "screening" have been used
    interchangeably by TSA to denote some level of examination of a person
    or good, which can entail a number of different actions, including
    manual physical inspections to ensure that cargo does not contain
    weapons, explosives, or stowaways, or inspections using nonintrusive
    technologies that do not require the cargo to be opened in order to be
    inspected. For this and the subsequent performance expectation, we use
    the term "screen" to refer to this broad range of activities. However,
    in our April 2007 report that is referenced in this performance
    expectation's associated findings section, the term "screening" was
    used when referring to TSA or CBP efforts to apply a filter to analyze
    cargo related information to identify cargo shipment characteristics or
    anomalies for security risks. The term "inspection" was used to refer
    only to air carrier, TSA, or CBP efforts to examine air cargo through
    physical searches and the use of nonintrusive technologies.

    [End of table]

    DHS Has Made Moderate Progress in Securing Surface Transportation
    Modes:

    DHS has undertaken various initiatives to secure surface transportation
    modes, and within the department, TSA is primarily responsible for
    surface transportation security efforts. Since its creation following
    the events of September 11, 2001, TSA has focused much of its efforts
    and resources on meeting legislative mandates to strengthen commercial
    aviation security. However, TSA has more recently placed additional
    focus on securing surface modes of transportation, which includes
    establishing security standards and conducting assessments and
    inspections of surface transportation modes such as passenger and
    freight rail; mass transit; highways, including commercial vehicles;
    and pipelines. Although TSA has primary responsibility within the
    department for surface transportation security, the responsibility for
    securing rail and other transportation modes is shared among federal,
    state, and local governments and the private sector. For example, with
    regard to passenger rail security, in addition to TSA, DHS's Office of
    Grant Programs provides grant funds to rail operators and conducts risk
    assessments for passenger rail agencies. Within the Department of
    Transportation, the Federal Transit Administration and Federal Railroad
    Administration have responsibilities for passenger rail safety and
    security. In addition, public and private passenger rail operators are
    also responsible for securing their rail systems.

    As shown in table 24, we identified five performance expectations for
    DHS in the area of surface transportation security, and we found that
    overall DHS has made moderate progress in meeting those performance
    expectations. Specifically, we found that DHS has generally achieved
    three of these performance expectations and has generally not achieved
    two others.

    Table 24: Performance Expectations and Progress Made in Surface
    Transportation Security:

    Performance expectation: 1. Develop and adopt a strategic approach for
    implementing surface transportation security functions.
    Assessment: Generally achieved.

    Performance expectation: 2. Conduct threat, criticality, and
    vulnerability assessments of surface transportation assets.
    Assessment: Generally achieved.

    Performance expectation: 3. Issue standards for securing surface
    transportation modes.
    Assessment: Generally not achieved.

    Performance expectation: 4. Conduct compliance inspections for surface
    transportation systems.
    Assessment: Generally not achieved.

    Performance expectation: 5. Administer grant programs for surface
    transportation security.
    Assessment: Generally achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 3;
    Assessment: Generally not achieved: 2;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 25 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of surface transportation security and our assessment of
    whether DHS has taken steps to satisfy most of the key elements of the
    performance expectation (generally achieved) or has not taken steps to
    satisfy most of the performance expectation's key elements (generally
    not achieved).

    Table 25: Performance Expectations and Assessment of DHS Progress in
    Surface Transportation Security:

    Performance expectation: 1. Develop and adopt a strategic approach for
    implementing surface transportation security functions;
    Summary of findings: GAO findings: DHS has developed a strategic
    approach for securing surface transportation modes, which include mass
    transit, passenger rail, freight rail, commercial vehicles, pipelines,
    and related infrastructure such as roads and highways. In the past we
    have reported that TSA had not issued the Transportation Sector
    Specific Plan or supporting plans for securing all modes of
    transportation, in accordance with DHS's National Infrastructure
    Protection Plan and a December 2006 executive order. We reported that
    until TSA issued the sector-specific plan and supporting plans, it
    lacked a clearly communicated strategy with goals and objectives for
    securing the transportation sector. In addition, in March 2007, we
    testified that as of September 2005, DHS had begun developing, but had
    not yet completed a framework to help federal agencies and the private
    sector develop a consistent approach for analyzing and comparing risks
    to transportation and other critical sectors. For more information, see
    Passenger Rail Security: Enhanced Leadership Needed to Prioritize and
    Guide Security Efforts, GAO-07-225T and Passenger Rail Security:
    Federal Strategy and Enhanced Coordination Needed to Prioritize and
    Guide Security Efforts, GAO-07-583T; DHS updated information: In May
    2007, DHS issued the sector-specific plan for transportation systems
    and supporting annexes for surface transportation assets, and reported
    taking actions to adopt the strategic approach outlined by the plan.
    The Transportation Systems Sector-Specific Plan and its supporting
    modal implementation plans and appendixes establish a strategic
    approach based on the National Infrastructure Protection Plan and
    Executive Order 13416, Strengthening Surface Transportation Security.
    The Transportation Systems Sector-Specific Plan describes the security
    framework that is intended to enable sector stakeholders to make
    effective and appropriate risk-based security and resource allocation
    decisions. The key efforts to be undertaken according to the plan
    include the (1) identification of assets, systems, networks and
    functions to be protected; (2) assessment of risks; (3) prioritization
    of risk management options; (4) development and implementation of
    security programs; (5) measurement of progress; (6) assessment and
    prioritization of research and development investments; and (7)
    management and coordination of sector responsibilities, including the
    sharing of information. In addition, during the course of our ongoing
    work assessing mass transit, freight rail, commercial vehicles, and
    highway infrastructure, we identified that DHS has begun to implement
    some of the security initiatives outlined in the sector-specific plan
    for transportation systems and supporting annexes; Our assessment: We
    conclude that DHS has generally achieved this performance expectation
    because TSA has issued the Transportation Sector-Specific Plan and
    supporting plans, a significant step in its efforts to develop and
    adopt a strategic approach for surface transportation security
    functions. While DHS has issued a strategy for securing all
    transportation modes, and has demonstrated that it has begun to take
    actions to implement the goals and objectives outlined in the strategy,
    we have not yet analyzed the overall quality of the plan or supporting
    modal annexes, the extent to which efforts outlined in the plans and
    annexes were implemented, or the effectiveness of identified security
    initiatives. The four performance expectations in the surface
    transportation security mission area discussed below are generally
    related to DHS's implementation of the strategy. In addition, we
    recognize that the acceptance of DHS's approach by federal, state,
    local, and private sector stakeholders is crucial to its successful
    implementation. However, we have not assessed the extent to which the
    plan and supporting modal annexes were coordinated with or adopted by
    these stakeholders. We will continue to assess DHS' efforts to
    implement its strategy for securing surface transportation modes as
    part of our ongoing reviews of mass transit, freight rail, commercial
    vehicles, and highway infrastructure security;
    Assessment: Generally achieved.

    Performance expectation: 2. Conduct threat, criticality, and
    vulnerability assessments of surface transportation assets;
    Summary of findings: GAO findings: DHS has taken actions to conduct
    threat, criticality, and vulnerability assessments of some surface
    transportation assets, particularly passenger and freight rail, but has
    not provided us with evidence that it has completed assessments in
    other surface transportation modes. In 2005, we reported that DHS and
    TSA conducted threat and vulnerability assessments of passenger rail
    systems. More recently, we testified that TSA had reported completing
    an overall threat assessment for mass transit, passenger, and freight
    rail modes and had conducted criticality assessments of nearly 700
    passenger rail stations. In addition, in March 2007 we testified that
    DHS's Office of Grants and Training, now called the Office of Grant
    Programs, developed and implemented a risk assessment tool to help
    passenger rail operators better respond to terrorist attacks and
    prioritize security measures. Passenger rail operators must have
    completed a risk assessment to be eligible for financial assistance
    through the fiscal year 2007 Transit Security Grant Program, which
    includes funding for passenger rail. To receive grant funding, rail
    operators are also required to have a security and emergency
    preparedness plan that identifies how the operator intends to respond
    to security gaps identified by risk assessments. As of February 2007,
    DHS had completed or planned to conduct risk assessments of most
    passenger rail operators. According to rail operators, DHS's risk
    assessment process enabled them to prioritize investments on the basis
    of risk and allowed them to target and allocate resources toward
    security measures that will have the greatest impact on reducing risk
    across their rail systems. However, TSA has not provided us with
    evidence that it has yet conducted threat and vulnerability assessments
    of all surface transportation assets, which may adversely affect its
    ability to adopt a risk-based approach for prioritizing security
    initiatives within and across all transportation modes. Until threat,
    criticality, and vulnerability assessments have been coordinated and
    completed, and until TSA determines how to use the results of these
    assessments to analyze and characterize risk, it may not be possible to
    effectively prioritize passenger rail assets and guide investment
    decisions about protecting them. TSA has reported conducting additional
    risk assessments in rail and other transportation modes since the
    issuance of our September 2005 report. We will review these assessments
    and other TSA efforts to secure surface transportation modes in our
    ongoing and planned work related to passenger and freight rail, highway
    infrastructure, and commercial vehicle security. For more information,
    see GAO-07-225T; Passenger Rail Security: Enhanced Federal Leadership
    Needed to Prioritize and Guide Security Efforts, GAO-06-181T; and
    Passenger Rail Security: Enhanced Federal Leadership Needed to
    Prioritize and Guide Security Efforts, GAO-05-851; DHS updated
    information: In March and April 2007, and as part of ongoing work
    assessing freight rail, commercial vehicles, and highway
    infrastructure, DHS provided us with updated information on its efforts
    to conduct threat, criticality, and vulnerability assessments for
    surface transportation assets. With regard to threat assessments, DHS
    receives and uses threat information as part of its surface
    transportation security efforts. TSA's Office of Intelligence provides
    annual intelligence summaries, periodic updates, and other current
    intelligence briefings to the rest of TSA. The annual assessments are
    shared with TSA stakeholders, and TSA provided us copies for all
    transportation modes. With regard to criticality assessments, DHS has
    conducted such assessments for some surface transportation modes. For
    example, TSA has conducted Corporate Security Reviews with 38 state
    Department of Transportation highway programs. For commercial vehicles,
    TSA has conducted 32 Corporate Security Reviews with large motor
    carriers, in an industry with over one million firms. It has also
    completed a pilot program with the state of Missouri to supplement the
    state's regular safety inspections of trucking firms with Corporate
    Security Reviews. TSA reports that over 1,800 Corporate Security
    Reviews have been completed in Missouri as part of this program. In
    addition, the National Protection and Programs Directorate
    Infrastructure Protection conducts highway infrastructure assessments
    that look at tier one and tier two critical highway infrastructure. The
    National Protection and Programs Directorate completed 54 highway
    infrastructure assessments performed from 2004 through May 2007. With
    regard to vulnerability assessments, DHS has conducted such assessments
    for surface transportation modes. For example, TSA reported that its
    Security Analysis and Action Program utilizes several different tools
    to identify vulnerabilities based on specific scenarios, such as an
    improvised explosive device on a passenger train. The purpose of the
    program is to gather information, identify generally accepted best
    practices, and benchmark existing security operations in comparison to
    established industry security practices. According to TSA, among other
    things, the Security Analysis and Action Program creates a baseline for
    future multimodal security assessments, develops a road map for future
    passenger rail security evaluations, and helps prioritize security
    countermeasures and emergency response enhancement needs based on
    threats and risks. For freight rail, we found that TSA has conducted
    vulnerability assessments of High Threat Urban Area rail corridors
    where toxic inhalation hazard shipments are transported. TSA reported
    that these corridor assessments provide site-specific mitigation
    strategies and lessons learned as well as tactics that can be modified
    for use at the corporate or national level. Furthermore, TSA reported
    that its Visible Intermodal Prevention and Protection Teams are
    deployed randomly to prepare for emergency situations in which TSA
    assets would be invited to assist a local transit agency. According to
    TSA, these teams allow TSA and local entities to develop templates that
    can be implemented in emergency situations and to supplement existing
    security resources. As of March 20, 2007, TSA reported that 50 Visible
    Intermodal Prevention and Protection team exercises have been conducted
    at various mass transit and passenger rail systems since December 2005.
    In addition, TSA reported that through its Pipeline Security Division,
    it has conducted 63 Corporate Security Reviews, on-site reviews of
    pipeline companies' security planning. The goals of these reviews are
    to develop knowledge of security planning and execution at pipeline
    sites; establish and maintain working relationships with pipeline
    security personnel; and identify and share security practices; Our
    assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has taken actions to conduct threat,
    criticality, and vulnerability assessments in surface transportation
    sectors, but we have not yet reviewed the quality of many of these
    assessments. DHS uses threat assessments and information as part of its
    surface transportation security efforts and has used criticality
    assessments to help prioritize its efforts. DHS has also conducted
    vulnerability assessment of assets within surface transportation modes,
    particularly for mass transit, freight rail, and highway
    infrastructure. However, with regard to High Threat Urban Area rail
    corridor assessments, DHS has not yet fully designated those corridors
    for which it plans to conduct future assessments. Moreover, for
    commercial vehicles and highway infrastructure, DHS has not yet
    completed all planned vulnerability assessments;
    Assessment: Generally achieved.

    Performance expectation: 3. Issue standards for securing surface
    transportation modes;
    Summary of findings: GAO findings: DHS has initiated efforts to develop
    security standards for surface transportation modes, but DHS did not
    provide us with information on its efforts beyond passenger and freight
    rail. In 2006, TSA was planning to issue security standards for all
    modes of transportation. TSA planned to issue only a limited number of
    standards--that is, standards will be issued only when assessments of
    the threats, vulnerabilities, and criticality indicate that the level
    of risk is too high or unacceptable. TSA has developed security
    directives and security action items--recommended measures for
    passenger rail operators to implement in their security programs to
    improve both security and emergency preparedness--for passenger rail
    and issued a proposed rule in December 2006 on passenger and freight
    rail security requirements. For more information, see GAO-07-225T; GAO-
    06-181T; and GAO-05-851; DHS updated information: In April 2007, and as
    part of ongoing work, DHS provided us with updated information on TSA's
    efforts to issue standards for securing surface transportation modes.
    According to DHS, TSA uses field activities to assess compliance with
    security directives and implementation of noncompulsory security
    standards and protective measures with the objective of a broad-based
    enhancement of passenger rail and rail transit security. Through the
    Baseline Assessment for Security Enhancement inspectors review
    implementation by mass transit and passenger rail systems of the 17
    Security and Emergency Management Action Items (security action items)
    that TSA and the Federal Transit Administration jointly developed, in
    coordination with the Mass Transit Sector Coordinating Council. This
    initiative aims to elevate security posture throughout the mass transit
    and passenger rail mode by implementation of baseline security measures
    adaptable to the operating circumstances of any system. TSA also
    reported that in December 2006, it issued a notice of proposed
    rulemaking on new security measures for freight rail carriers designed
    to ensure 100 percent positive handoff of toxic inhalation hazard
    shipments that enter high threat urban areas and establish security
    protocols for custody transfers of toxic inhalation hazard rail cars in
    high-threat urban areas. TSA also reported that its High Threat Urban
    Area rail corridor assessments supported the development of the
    Recommended Security Action Items for the Rail Transportation of Toxic
    Inhalation Materials issued by DHS and the Department of Transportation
    in June 2006; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS has taken actions to develop
    and issue surface transportation security standards for passenger and
    freight rail modes. However, DHS did not provide us with evidence of
    its efforts to develop and issue security standards for all surface
    transportation modes or a rationale or explanation why standards may
    not be needed for other modes;
    Assessment: Generally not achieved.

    Performance expectation: 4. Conduct compliance inspections for surface
    transportation systems;
    Summary of findings: GAO findings: DHS has made progress in conducting
    compliance inspections, particularly in hiring and deploying
    inspectors, but inspectors' roles and missions have not yet been fully
    defined. TSA officials stated the agency has hired 100 surface
    transportation inspectors whose stated mission is to, among other
    duties, monitor and enforce compliance with TSA's rail security
    directives. However, some passenger rail operators have expressed
    confusion and concern about the role of TSA's inspectors and the
    potential that TSA inspections could be duplicative of other federal
    and state rail inspections. TSA rail inspector staff stated that they
    were committed to avoiding duplication in the program and communicating
    their respective roles to rail agency officials. According to TSA,
    since the initial deployment of surface inspectors, these inspectors
    have developed relationships with security officials in passenger rail
    and transit systems, coordinated access to operations centers,
    participated in emergency exercises, and provided assistance in
    enhancing security. However, the role of inspectors in enforcing
    security directives has not been fully defined. We will continue to
    assess TSA's compliance efforts during follow-on reviews of surface
    transportation modes For more information, see GAO-07-225T; GAO-06-
    181T; and GAO-05-851; DHS updated information: In March and April
    2007, and as part of ongoing reviews, DHS provided us with updated
    information on its efforts to conduct compliance inspections for
    surface transportation systems. For example, with regard to freight
    rail, TSA reported visiting terminal and railroad yards to measure
    implementation of 7 of 24 recommended security action items for the
    rail transportation of toxic inhalation hazard materials. TSA reported
    that during the end of 2006, its inspectors visited about 150
    individual railroad facilities. Through its Surface Transportation
    Security Inspection program, TSA reported that its inspectors conduct
    inspections of key facilities for rail and transit systems to assess
    transit systems' implementation of core transit security fundamentals
    and comprehensive security action items; conduct examinations of
    stakeholder operations, including compliance with security directives;
    identify security gaps; and develop effective practices. TSA noted that
    its field activities also assess compliance with security directives
    and implementation of noncompulsory security standards and protective
    measures. For example, TSA reported that through the Baseline
    Assessment for Security Enhancements program, inspectors review mass
    transit and passenger rail systems' implementation of the 17 Security
    and Emergency Management Action Items jointly developed by TSA and the
    Federal Transit Administration. The program is a means to establish
    baseline security program data applicable to all surface mass transit
    systems. TSA also noted that it deploys inspectors to serve as federal
    liaisons to mass transit and passenger rail system operations centers
    and provide other security support and assistance in periods of
    heightened alert or in response to security incidents; Our assessment:
    We conclude that DHS has generally not achieved this performance
    expectation. DHS has taken steps to conduct compliance inspections for
    surface transportation systems and has made progress in hiring and
    deploying inspectors. Although DHS has deployed inspectors to conduct
    compliance inspections and carry out other security activities in the
    mass transit (mass transit includes passenger rail) and freight rail
    modes, DHS did not provide us with evidence that it has conducted
    compliance inspections for other surface transportation modes or
    information on whether the department believes compliance inspections
    are needed for other modes. Moreover, we reported that the role of
    inspectors in enforcing security requirements has not been fully
    defined, and DHS did not provide us with documentation on its efforts
    to better define these roles;
    Assessment: Generally not achieved.

    Performance expectation: 5. Administer grant programs for surface
    transportation security;
    Summary of findings: GAO findings: In March 2007, we reported that the
    DHS Office of Grants and Training, now called the Office of Grant
    Programs, has used various programs to fund passenger rail security
    since 2003. Through the Urban Area Security Initiative grant program,
    the Office of Grants and Training has provided grants to urban areas to
    help enhance their overall security and preparedness level to prevent,
    respond to, and recover from acts of terrorism. In 2003 and 2004, $65
    million and $50 million, respectively, were provided to rail transit
    agencies through the Urban Area Security Initiative program. In
    addition, the 2005 DHS appropriations action provided $150 million for
    intercity passenger rail transportation, freight rail, and transit
    security grants. In fiscal year 2006, $150 million was appropriated,
    and in fiscal year 2007 $175 million was appropriated for the same
    purposes. The Office of Grants and Training used this funding to build
    on the work under way through the Urban Area Security Initiative
    program and create and administer new programs focused specifically on
    transportation security, including the Transit Security Grant Program
    and the Intercity Passenger Rail Security Grant Program. During fiscal
    year 2006, the Office of Grants and Training provided $110 million to
    passenger rail transit agencies through the Transit Security Grant
    Program and about $7 million to Amtrak through the Intercity Passenger
    Rail Security Grant Program. During fiscal year 2007, the Office of
    Grants and Training plans to distribute $156 million for rail and bus
    security grants and $8 million to Amtrak. In January 2007, the Office
    of Grants and Training reported that the Intercity Passenger Rail
    Security Program had been incorporated into the Transit Security Grant
    Program. We reported that although the Office of Grants and Training
    has distributed hundreds of millions of dollars in grants to improve
    passenger rail security, issues have surfaced about the grant process.
    For example, we reported that as DHS works to refine its risk
    assessment methodologies, develop better means of assessing proposed
    investments using grant funds, and align grant guidance with the
    implementation of broader emergency preparedness goals, such as
    implementation of the National Preparedness Goal, it has annually made
    changes to the guidance for the various grants it administers. These
    changes include changes in the eligibility for grants. As a result of
    these annual changes, awardees and potential grant recipients must
    annually review and understand new information on the requirements for
    grant applications including justification of their proposed use of
    grant funds. We also reported that funds awarded through the Transit
    Security Grant Program can be used to supplement funds received from
    other grant programs. However, allowable uses are not clearly defined.
    For example, Transit Security Grant Program funds can be used to create
    canine teams but cannot be used to maintain these teams--that is, the
    grant funds cannot be used for food, medical care, and other such
    maintenance costs for the dogs on the team. Grant recipients have
    expressed a need for clear guidance on the allowable use of grants and
    how they can combine funds from more than one grant to fund and
    implement specific projects. In addition, some industry stakeholders
    have raised concerns regarding DHS's current grant process, noting that
    there are time delays and other barriers in grant funding reaching
    owners and operators of surface transportation assets. We will be
    assessing grants for mass transit as part of our ongoing work. For more
    information, see GAO-06-181T and Passenger Rail Security: Federal
    Strategy and Enhanced Coordination Needed to Prioritize and Guide
    Security Efforts, GAO-07-583T; DHS updated information: In March 2007,
    DHS provided us with updated information on its grant programs for
    surface transportation security. For example, TSA considers various
    factors in Transit Security Grant Program proposals, including the
    enhancement of capabilities to (1) deter, detect, and respond to
    terrorist attacks employing improvised explosive devices; (2) mitigate
    high-consequence risks identified in individual transit system risk
    assessments; (3) implement technology for detection of explosives and
    monitoring for suspicious activities; (4) improve coordination with law
    enforcement and emergency responders; and (5) expand security training
    and awareness among employees and passengers. TSA reported using the
    Transit Security Grant Program to drive improvements in areas such as
    training for key personnel, drills, exercises, and public awareness and
    preparedness; Our assessment: We conclude that DHS has generally
    achieved this performance expectation. DHS has developed and
    administered grant programs for various surface transportation modes.
    However, some industry stakeholders have raised concerns regarding
    DHS's current grant process, such as time delays and other barriers in
    the provision of grant funding. We have not yet assessed DHS's
    provision of grant funding or the extent to which DHS monitors use of
    the funds. A recent legislative proposal would have the Department of
    Transportation, rather than DHS, distribute grant funds for specified
    surface transportation security purposes;
    Assessment: Generally achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Substantial Progress in Maritime Security:

    DHS has undertaken various programs to secure the maritime sector. In
    general, these maritime security programs fall under one of three
    areas�port and vessel security, maritime intelligence, and maritime
    supply chain security. Within DHS, various component agencies are
    responsible for maritime security efforts, including the Coast Guard,
    CBP, TSA, and the Domestic Nuclear Detection Office. The Coast Guard is
    responsible for port facility inspections and has lead responsibility
    in coordinating maritime information sharing efforts. CBP is
    responsible for addressing the threat posed by terrorist smuggling of
    weapons in oceangoing containers. TSA is responsible for the
    implementation of the transportation worker identification credential
    program. The Domestic Nuclear Detection Office is responsible for
    acquiring and supporting the deployment of radiation detection
    equipment, including portal monitors, within the United States.

    As shown in table 26, we identified 23 performance expectations for DHS
    in the area of maritime security, and we found that overall DHS has
    made substantial progress in meeting those expectations. Specifically,
    we found that DHS has generally achieved 17 performance expectations
    and has generally not achieved 4 others. For 2 performance
    expectations, we did not make an assessment.

    Table 26: Performance Expectations and Progress Made in Maritime
    Security:

    Performance expectation: 1. Develop national plans for maritime
    security;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop national plans for maritime
    response;
    Assessment: Generally achieved.

    Performance expectation: 3. Develop national plans for maritime
    recovery;
    Assessment: Generally achieved.

    Performance expectation: 4. Develop regional (port-specific) plans for
    security;
    Assessment: Generally achieved.

    Performance expectation: 5. Develop regional (port-specific) plans for
    response;
    Assessment: Generally achieved.

    Performance expectation: 6. Develop regional (port-specific) plans for
    recovery;
    Assessment: Generally not achieved.

    Performance expectation: 7. Ensure port facilities have completed
    vulnerability assessments and developed security plans;
    Assessment: Generally achieved.

    Performance expectation: 8. Ensure that vessels have completed
    vulnerability assessments and developed security plans;
    Assessment: Generally achieved.

    Performance expectation: 9. Exercise security, response, and recovery
    plans with key maritime stakeholders to enhance security, response, and
    recovery efforts;
    Assessment: Generally achieved.

    Performance expectation: 10. Implement a national facility access
    control system for port secured areas;
    Assessment: Generally not achieved.

    Performance expectation: 11. Implement a port security grant program to
    help facilities improve their security capabilities;
    Assessment: Generally achieved.

    Performance expectation: 12. Develop a national plan to establish and
    improve maritime intelligence;
    Assessment: No assessment made.

    Performance expectation: 13. Establish operational centers to monitor
    threats and fuse intelligence and operations at the regional/port
    level;
    Assessment: Generally achieved.

    Performance expectation: 14. Collect information on incoming ships to
    assess risks and threats;
    Assessment: Generally achieved.

    Performance expectation: 15. Develop a vessel-tracking system to
    improve intelligence and maritime domain awareness on vessels in U.S.
    waters;
    Assessment: Generally achieved.

    Performance expectation: 16. Develop a long-range vessel-tracking
    system to improve maritime domain awareness;
    Assessment: Generally not achieved.

    Performance expectation: 17. Collect information on arriving cargo for
    screening purposes;
    Assessment: Generally achieved.

    Performance expectation: 18. Develop a system for screening and
    inspecting cargo for illegal contraband;
    Assessment: Generally achieved.

    Performance expectation: 19. Develop a program to screen incoming cargo
    for radiation;
    Assessment: Generally not achieved.

    Performance expectation: 20. Develop a program to work with foreign
    governments to inspect suspicious cargo before it leaves for U.S.
    ports;
    Assessment: Generally achieved.

    Performance expectation: 21. Develop a program to work with the private
    sector to improve and validate supply chain security;
    Assessment: Generally achieved.

    Performance expectation: 22. Develop standards for cargo containers to
    ensure their physical security;
    Assessment: No assessment made.

    Performance expectation: 23. Develop an international port security
    program to assess security at foreign ports;
    Assessment: Generally achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 17;
    Assessment: Generally not achieved: 4;
    Assessment: No assessment made: 2.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 27 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of maritime security and our assessment of whether DHS has
    taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 27: Performance Expectations and Assessment of DHS Progress in
    Maritime Security:

    Performance expectation: 1. Develop national plans for maritime
    security;
    Summary of findings: GAO findings: The President and the Secretaries of
    Homeland Security, Defense, and State approved the supporting plans for
    National Strategy for Maritime Security in October 2005. The National
    Strategy for Maritime Security has eight supporting plans that are
    intended to address the specific threats and challenges of the maritime
    environment. The supporting plans are the National Plan to Achieve
    Domain Awareness; the Global Maritime Intelligence Integration Plan;
    the Maritime Operational Threat Response Plan; the International
    Outreach and Coordination Strategy; the Maritime Infrastructure
    Recovery Plan; the Maritime Transportation System Security Plan; the
    Maritime Commerce Security Plan; and the Domestic Outreach Plan. In
    addition, in September 2005, the Coast Guard issued Maritime Sentinel.
    Maritime Sentinel provides a framework for the Coast Guard's Ports,
    Waterways and Coastal Security program, setting out the Coast Guard's
    mission and goals in that area. Our review of Maritime Sentinel showed
    that the plan is results-oriented with outcome-based goals but that it
    needs to better describe the human capital resources necessary to
    achieve them; DHS updated information: In March and April 2007, DHS
    provided us with updated information on its efforts to develop national
    plans for maritime security. DHS reported that the Coast Guard has
    issued a number of plans supporting or relating to maritime security;
    Our assessment: Based on our review of Maritime Sentinel and updated
    information DHS provided, we conclude that that DHS has generally
    achieved this expectation;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop national plans for maritime
    response;
    Summary of findings: GAO findings: DHS has developed a national plan
    for response in conjunction with the Department of Defense. We have
    reported that the Maritime Operational Threat Response Plan establishes
    roles and responsibilities for responding to marine terrorism to help
    resolve jurisdictional issues among responding agencies. For more
    information, see Homeland Security: Process for Reporting Lessons
    Learned from Seaport Exercises Needs Further Attention, GAO-05-170; DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to develop national plans for
    maritime response. For example, DHS reported that the Maritime
    Operational Threat Response Plan is a strategic plan that addresses the
    full range of maritime threats including terrorism, piracy, drug
    smuggling, migrant smuggling, weapons of mass destruction
    proliferation, maritime hijacking, and fisheries incursions. DHS stated
    that this interagency national plan supersedes Presidential Directive-
    27 (in the maritime domain only) for addressing nonmilitary incidents
    of national security significance and has been successfully exercised
    numerous times among agencies, including actual effective threat
    resolution. DHS further stated that the Maritime Operational Threat
    Response Plan is a national-level process to achieve consistently
    coordinated action and desired outcomes that directly support National
    Security Presidential Directive-41/Homeland Security Presidential
    Directive-13; Our assessment: We conclude that DHS has generally
    achieved this performance expectation as DHS has developed the Maritime
    Operational Threat Response Plan, which details agency responsibilities
    during incidents of marine terrorism;
    Assessment: Generally achieved.

    Performance expectation: 3. Develop national plans for maritime
    recovery;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as DHS has
    developed the Maritime Infrastructure Recovery Plan, and the plan
    establishes a framework for maritime recovery. In April 2006, DHS
    released the Maritime Infrastructure Recovery Plan. The Maritime
    Infrastructure Recovery Plan is intended to facilitate the restoration
    of maritime commerce after a terrorist attack or natural disaster and
    reflects the disaster management framework outlined in the National
    Response Plan. The Maritime Infrastructure Recovery Plan addresses
    issues that should be considered by ports when planning for natural
    disasters. However, it does not set forth particular actions that
    should be taken at the port level, leaving those determinations to be
    made by the port operators themselves. For more information, see Port
    Risk Management: Additional Federal Guidance Would Aid Ports in
    Disaster Planning and Recovery, GAO-07-412;
    Assessment: Generally achieved.

    Performance expectation: 4. Develop regional (port-specific) plans for
    security;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    regional (port-specific) plans for security. The Coast Guard led
    efforts to conduct a security assessment of each of the nation's
    seaports and develop a security plan for each seaport zone. Under
    regulations implementing the Maritime Transportation Security Act, a
    Coast Guard Captain of the Port must develop an area plan in
    consultation with an Area Maritime Security Committee. These committees
    are typically composed of members from federal, local, and state
    governments; law enforcement agencies; maritime industry and labor
    organizations; and other port stakeholders that may be affected by
    security policies. In April 2007 we reported that implementing
    regulations for the Maritime Transportation Security Act specified that
    area plans include, among other things, operational and physical
    security measures in place at the port under different security levels,
    details of the security incident command and response structure,
    procedures for responding to security threats including provisions for
    maintaining operations in the port, and procedures to facilitate the
    recovery of the marine transportation system after a security incident.
    A Coast Guard Navigation and Vessel Inspection Circular provided a
    common template for area plans and specified the responsibilities of
    port stakeholders under the plans. Currently, 46 area plans are in
    place at ports around the country. For more information, see Maritime
    Security: Observations on Selected Aspects of the SAFE Port Act, GAO-
    07-754T; Coast Guard: Observations on Agency Performance, Operations
    and Future Challenges, GAO-06-448T; Maritime Security: Enhancements
    Made, but Implementation and Sustainability Remain Key Challenges, GAO-
    05-448T; and Maritime Security: Better Planning Needed to Help Ensure
    an Effective Port Security Assessment Program, GAO-04-1062;
    Assessment: Generally achieved.

    Performance expectation: 5. Develop regional (port-specific) plans for
    response;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    regional (port-specific) plans for response. We have reported that the
    Captain of the Port is responsible for establishing both spill and
    terrorism response plans. In doing so, the Captain of the Port must
    identify local public and private port stakeholders who will develop
    and revise separate plans for marine spills of oil and hazardous
    materials and for terrorism response. Both plans call for coordinated
    implementation with other plans, such as the response and security
    plans developed by specific facilities or vessels. At the port level,
    effectively integrating spill and terrorism emergency responses
    requires all plans to operate in unison--the port spill response plan
    and the port terrorism response plan, as well as facility and vessel
    response plans;
    Assessment: Generally achieved.

    Performance expectation: 6. Develop regional (port-specific) plans for
    recovery;
    Summary of findings: GAO findings: DHS has generally not developed
    regional (port-specific) plans for recovery. We have reported that
    guidance in the Maritime Infrastructure Recovery Plan suggests that
    ports develop priorities for bringing vessels into port after a
    closure. Additionally, port terrorism response plans must include a
    section on crisis management and recovery to ensure the continuity of
    port operations; DHS updated information: In April 2007, DHS provided
    us with updated information on its efforts to develop regional (port-
    specific) plans for recovery. DHS reported that the Coast Guard and CBP
    have developed protocols for recovery and resumption of trade. DHS
    stated that these protocols are currently being discussed with other
    federal agencies for coordination purposes and with the private sector
    to ensure that federal activities facilitate private sector recovery
    efforts. DHS also reported that Coast Guard headquarters is preparing
    guidance for field units for including recovery in their plans for
    creating Maritime Transportation System Recovery Units at the local
    (sector) level. Further, DHS reported that several ports have included
    recovery as part of their area plans, such as all ports in the Coast
    Guard's Atlantic Area, the Ports of Los Angeles and Long Beach, and San
    Francisco. DHS stated that the level of detail in these plans varies
    but noted that many are working to enhance the section on recovery and
    resumption of trade. DHS added that these plans are developing as all-
    hazard plans to include both natural and man-made incidents; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. Our prior work has shown that work remains in
    DHS's efforts to develop regional (port-specific) plans for recovery;
    Assessment: Generally not achieved.

    Performance expectation: 7. Ensure port facilities have completed
    vulnerability assessments and developed security plans;
    Summary of findings: GAO findings: DHS has taken steps to ensure that
    port facilities have completed vulnerability assessments and developed
    security plans. Maritime Transportation Security Act implementing
    regulations require designated owners or operators of maritime
    facilities to identify vulnerabilities and develop security plans for
    their facilities. In May 2005 we reported that the Coast Guard had
    reviewed and approved the security plans of the over 3,000 facilities
    that were required to identify their vulnerabilities and take action to
    reduce them. Six months after July 1, 2004, the date by which the
    security plans were to be implemented, the Coast Guard reported that it
    had completed on-site inspections of all facilities to ensure the plans
    were being implemented as approved. In April 2007 we reported that
    Coast Guard guidance calls for the Coast Guard to conduct on-site
    facility inspections to verify continued compliance with security plans
    on an annual basis. A Security and Accountability for Every (SAFE) Port
    Act amendment to the Maritime Transportation Security Act requires the
    Coast Guard to conduct at least two inspections of each facility
    annually, and it required that one of these inspections be unannounced.
    We are currently conducting a review of the Coast Guard's efforts for
    ensuring facilities' compliance with various Maritime Transportation
    Security Act requirements. For more information, see GAO-07-754T; GAO-
    05-448T; and Maritime Security: Substantial Work Remains to Translate
    New Planning Requirements into Effective Port Security, GAO-04-838;
    DHS updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to ensure that port facilities have
    completed vulnerability assessments and developed security plans. DHS
    reported that its Alternative Security Program allows for participants
    to use templates pre-approved by the Coast Guard for developing their
    security plans. Facilities that use these plans then undergo security
    plan verifications, as required by the Maritime Transportation Security
    Act; Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has made progress in ensuring that port
    facilities have completed vulnerability assessments and developed
    security plans;
    Assessment: Generally achieved.

    Performance expectation: 8. Ensure that vessels have completed
    vulnerability assessments and developed security plans;
    Summary of findings: GAO findings: DHS has made progress in ensuring
    that vessels have done vulnerability assessments and developed security
    plans. In May 2005 we reported that the Coast Guard had reviewed and
    approved the security plans of the more than 9,000 vessels that were
    required to identify their vulnerabilities and take action to reduce
    them. Six months after July 1, 2004, the date by which the security
    plans were to be implemented, the Coast Guard reported that it had
    completed on-site inspections of thousands of vessels to ensure the
    plans were being implemented as approved. For more information, see
    Maritime Security: Substantial Work Remains to Translate New Planning
    Requirements into Effective Port Security, GAO-04-838 and GAO-05-448T;
    DHS updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to ensure that vessels have
    completed vulnerability assessments and developed security plans. DHS
    reported that the Coast Guard completed security plan verifications for
    all inspected U.S.-flagged vessels by July 2005. DHS further reported
    that to date, the Coast Guard has completed security plan verifications
    on 98 percent of uninspected U.S.-flagged vessels regulated in
    accordance with the Maritime Transportation Security Act. DHS noted
    that uninspected vessels are not required to undergo security plan
    verifications exams by regulation but stated the Coast Guard was
    committed to the goal of encouraging all vessel owners of uninspected
    vessels to undergo such examinations on a voluntary basis by the end of
    2006; Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has taken steps to ensure that vessels
    have completed vulnerability assessments and developed security plans;
    Assessment: Generally achieved.

    Performance expectation: 9. Exercise security, response, and recovery
    plans with key maritime stakeholders to enhance security, response, and
    recovery efforts;
    Summary of findings: GAO findings: DHS has generally exercised
    security, response, and recovery plans (at least at the regional level)
    with key stakeholders. The Coast Guard has primary responsibility for
    such testing and evaluation in the nation's ports and waterways, and as
    part of its response, it has added multi-agency and multicontingency
    terrorism exercises to its training program. These exercises vary in
    size and scope and are designed to test specific aspects of the Coast
    Guard's terrorism response plans, such as communicating with state and
    local responders, raising maritime security levels, or responding to
    incidents within the port. For each exercise the Coast Guard conducts,
    an after-action report detailing the objectives, participants, and
    lessons learned must be produced. We reported in January 2005 on the
    issues identified in port security exercises. For example, we found
    that 59 percent of the exercises raised communications issues, and 28
    percent raised concerns with participants' knowledge about who has
    jurisdiction or decision-making authority. In April 2007, we reported
    that the Coast Guard had conducted a number of exercises of its area
    plans over the past several years. For example, in fiscal year 2004,
    the Coast Guard conducted 85 port-based terrorism exercises that
    addressed a variety of possible scenarios. In August 2005, the Coast
    Guard and TSA initiated the Port Security Training Exercise Program--an
    exercise program designed to involve the entire port community,
    including public governmental agencies and private industry, and
    intended to improve connectivity of various surface transportation
    modes and enhance area plans. Between August 2005 and October 2007, the
    Coast Guard expects to conduct Port Security Training Exercise Program
    exercises for 40 area committees and other port stakeholders. For more
    information, see GAO-07-754T and Homeland Security: Process for
    Reporting Lessons Learned from Seaport Exercises Needs Further
    Attention, GAO-05-170; DHS updated information: In March and April
    2007, DHS provided us with updated information on its efforts to
    exercise security, response, and recovery plans with key maritime
    stakeholders to enhance security, response, and recovery efforts. DHS
    reported that for each exercise the Coast Guard conducts, an after-
    action report detailing the objectives, participants, and lessons
    learned must be produced within 21 days for non-contract-supported
    exercises and within 81 days for contract-supported exercises; Our
    assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has made progress in exercising security,
    response, and recovery plans with key maritime stakeholders to enhance
    security, response, and recovery efforts;
    Assessment: Generally achieved.

    Performance expectation: 10. Implement a national facility access
    control system for port secured areas;
    Summary of findings: GAO and DHS IG findings: While DHS has taken steps
    to provide for an effective national facility access control system at
    ports, significant challenges remain. In September 2006 we identified
    several major challenges DHS and industry stakeholders face in
    addressing problems identified during Transportation Worker
    Identification Credential program testing and ensuring that key
    components of the Transportation Worker Identification Credential
    program can work effectively in the maritime sector, such as ensuring
    that the access control technology required to operate the
    Transportation Worker Identification Credential program, such as
    biometric card readers, works effectively in the maritime sector.
    Further, stakeholders at all 15 Transportation Worker Identification
    Credential testing locations we visited told us that TSA did not
    effectively communicate and coordinate with them regarding any problems
    that arose during testing at their facility. In July 2006 the DHS IG
    found that significant security vulnerabilities existed relative to the
    Transportation Worker Identification Credential prototype systems,
    documentation, and program management. Further, the DHS IG reported
    that the Transportation Worker Identification Credential prototype
    systems were vulnerable to various internal and external security
    threats and that security-related issues identified could threaten the
    confidentiality, integrity, and availability of sensitive
    Transportation Worker Identification Credential data. In April 2007 we
    testified that DHS had made progress toward implementing the
    Transportation Worker Identification Credential. We reported, for
    example, that DHS had issued a rule that sets forth the requirements
    for enrolling and issuing cards to workers in the maritime sector and
    developed a schedule for enrolling worker and issuing Transportation
    Worker Identification Credential cards at ports; In April 2007 we
    reported that the SAFE Port Act contained a requirement for
    implementing the first major phase of the Transportation Worker
    Identification Credential program by mid-2007. More specifically, it
    required DHS to implement Transportation Worker Identification
    Credential at the 10 highest risk ports by July 1, 2007; conduct a
    pilot program to test various aspects relating to Transportation Worker
    Identification Credential security card readers including access
    control technologies in the maritime environment; issue regulations
    requiring Transportation Worker Identification Credential card readers
    based on the findings of the pilot; and periodically report to Congress
    on the status of the program. DHS is taking steps to address these
    requirements, such as establishing a rollout schedule for enrolling
    workers and issuing Transportation Worker Identification Credential
    cards at ports and conducting a pilot program to test Transportation
    Worker Identification Credential access control technologies. However,
    we identified a number of challenges. For example, while DHS reports
    taking steps to address contract planning and oversight problems, the
    effectiveness of these steps will not be clear until implementation of
    the Transportation Worker Identification Credential program begins.
    Additionally, significant challenges remain in enrolling about 770,000
    persons at about 3,500 facilities in the Transportation Worker
    Identification Credential program. Sufficient communication and
    coordination to ensure that all individuals and organizations affected
    by the Transportation Worker Identification Credential program are
    aware of their responsibilities will require concerted effort on the
    part of DHS and the enrollment contractor. Further DHS and industry
    stakeholders need to address challenges regarding Transportation Worker
    Identification Credential access control technologies to ensure that
    the program is implemented effectively. Without fully testing all
    aspects of the technology, DHS may not be able ensure that the
    Transportation Worker Identification Credential access control
    technology can meet the requirements of the system. For more
    information, see GAO-07-754T; Transportation Security: TSA Has Made
    Progress in Implementing the Transportation Worker Identification
    Credential Program, but Challenges Remain, GAO-07-681T; Transportation
    Security: DHS Should Address Key Challenges before Implementing the
    Transportation Worker Identification Credential Program, GAO-06-982;
    Maritime Security: Enhancements Made, But Implementation and
    Sustainability Remain Key Challenges, GAO-05-448T; and Port Security:
    Better Planning Needed to Develop and Operate Maritime Worker
    Identification Card Program, GAO-05-106. Also, see Department of
    Homeland Security Office of Inspector General, DHS Must Address
    Significant Security Vulnerabilities Prior to TWIC Implementation
    (Redacted), OIG-06-47 (Washington, D.C.: July 2006); DHS updated
    information: In March 2007, DHS provided us with updated information on
    its efforts to implement a national facility access control system for
    port secured areas. DHS reported that the Coast Guard is moving forward
    with TSA and its contractor to begin enrollments in the Transportation
    Worker Identification Credential program. DHS stated that Version 1 of
    the Transportation Worker Identification Credential will contain all of
    the required biometric information and that a second Notice of Proposed
    Rulemaking will be published in February 2008 to address the technical
    requirements for readers that will be used at facilities and aboard
    vessels. DHS stated that in the meantime, a field test of card reader
    technology is scheduled for the Long Beach/Los Angeles port complex
    beginning in July 2007 and that this activity is in compliance with the
    timeline established in the SAFE Port Act. Further, DHS stated that the
    Coast Guard will request legislation requiring all persons who are
    deemed to need unescorted access to the secure areas of regulated
    vessels and facilities possess a valid Transportation Worker
    Identification Credential. DHS also reported that the Coast Guard is
    consolidating a number of merchant mariner licenses and documents into
    a single Merchant Mariner Credential. This consolidation is described
    in a supplemental notice of proposed rulemaking that was published in
    the Federal Register simultaneously with the Transportation Worker
    Identification Credential final rule on January 25, 2007, which will
    result in an effective date of March 26, 2007; Our assessment: We
    conclude that DHS has generally not achieved this performance
    expectation. Although DHS has taken some actions to implement a
    national facility access control system for port secured areas, more
    work is needed for the department to achieve this performance
    expectation. As our previous work demonstrated, DHS faces a number of
    problems in implementing the Transportation Worker Identification
    Credential, such as ensuring that access control technology meets
    system requirements and ensuring sufficient communication and
    coordination so that all individuals and organizations affected by the
    Transportation Worker Identification Credential program are aware of
    their responsibilities. Further, while DHS reported a number of actions
    it has taken to meet this expectation, it did not provide us with
    documentation for some aspects of its efforts. For example, DHS did not
    provide us with documentation showing that it is making progress in
    starting enrollments;
    Assessment: Generally not achieved.

    Performance expectation: 11. Implement a port security grant program to
    help facilities improve their security capabilities;
    Summary of findings: GAO and DHS IG findings and our assessment: We
    conclude that DHS has generally achieved this performance expectation.
    The port security grant program provides assistance to nonfederal
    stakeholders for making security improvements at the nation's ports.
    During fiscal years 2002 through 2004, grants from the program totaled
    about $560 million and covered such concerns as more fencing, cameras,
    and communications equipment. For fiscal year 2005, the appropriations
    act for DHS provided $150 million for port security grants. For fiscal
    year 2006 the DHS appropriations act provided $175 million for the port
    security grant program, and in fiscal year 2007 the appropriations act
    provided $210 million for the program. While DHS has made progress in
    applying risk management to the port security grant program, it faces
    challenges in strengthening its approach, as demonstrated in part by
    its experience in awarding past grants. For example, DHS has
    established overall goals for the grant program but faces challenges in
    setting specific and measurable program objectives, in part because
    this effort hinges on similar action by other federal agencies. In
    February 2006 the DHS IG reported that DHS had improved the
    administration and effectiveness of the most recent round of port
    security grants, which totaled $142 million for 132 projects. For
    example, the DHS IG reported that DHS had directed funds to the
    nation's 66 highest risk ports using a risk-based formula and tiering
    process and had instituted a new funding allocation model. However, the
    DHS IG also found several challenges, identifying, for example, 20
    projects that reviewers determined did not meet national security
    priorities but were funded nonetheless. In its fiscal year 2006
    Performance and Accountability Report, DHS reported that a risk-based
    grant allocation process was completed in the third quarter of fiscal
    year 2006 and was a critical component of the process by which
    allocations were determined for the Port Security Grant Program. For
    more information, see Risk Management: Further Refinements Needed to
    Assess Risks and Prioritize Protective Measures at Ports and Other
    Critical Infrastructure, GAO-06-91. Also, see Department of Homeland
    Security Office of Inspector General, Follow Up Review of the Port
    Security Grant Program, OIG-06-24 (Washington, D.C.: February 2006,
    Revised) and Department of Homeland Security Office of Inspector
    General, Review of the Port Security Grant Program, OIG-05-10
    (Washington, D.C.: January 2005);
    Assessment: Generally achieved.

    Performance expectation: 12. Develop a national plan to establish and
    improve maritime intelligence;
    Summary of findings: GAO findings: We generally have not conducted work
    on DHS's efforts to develop a national plan to establish and improve
    maritime intelligence, and as a result we cannot make an assessment of
    the extent to which DHS has taken actions to address this performance
    expectation; DHS updated information: In March and May 2007, DHS
    provided us with updated information on its efforts to develop a
    national plan to establish and improve maritime intelligence. DHS
    reported that the President approved the Global Maritime Intelligence
    Integration Plan in October 2005 in support of the National Strategy
    for Maritime Security; Our assessment: We did not make an assessment of
    DHS's progress in achieving this performance expectation. While DHS
    reported that the President approved the Global Maritime Intelligence
    Integration Plan, we were not able to determine the extent to which the
    plan has established and improved maritime intelligence;
    Assessment: No assessment made.

    Performance expectation: 13. Establish operational centers to monitor
    threats and fuse intelligence and operations at the regional/port
    level;
    Summary of findings: GAO findings: DHS has established operational
    centers to monitor threats and fuse intelligence and operations at the
    regional/port level. In April 2005, we reported that the Coast Guard
    had two Maritime Intelligence Fusion Centers, located on each coast,
    that receive intelligence from, and provide intelligence to, the Coast
    Guard Intelligence Coordination Center. Maritime Intelligence Fusion
    Centers also provide actionable intelligence to Coast Guard commanders
    at the district and port levels and share that analysis with
    interagency partners. Another approach at improving information sharing
    and port security operations involves interagency operational centers--
    command centers that bring together the intelligence and operational
    efforts of various federal and nonfederal participants. In April 2007,
    we reported that three ports currently have such centers, which are
    designed to have a unified command structure that can act on a variety
    of incidents ranging from possible terrorist attacks to search and
    rescue and environmental response operations. Several new interagency
    operational centers are about to come on line, but in continuing the
    expansion, DHS may face such challenges as creating effective working
    relationships and dealing with potential coordination problems. We also
    reported that the Coast Guard has the authority to create area
    committees--composed of federal, state, local, and industry members--
    that help to develop the area plan for the port. Area committees serve
    as forums for port stakeholders, facilitating the dissemination of
    information through regularly scheduled meetings, issuance of
    electronic bulletins, and sharing key documents. As of June 2006, the
    Coast Guard had organized 46 area committees. Each has flexibility to
    assemble and operate in a way that reflects the needs of its port area,
    resulting in variations in the number of participants, the types of
    state and local organizations involved, and the way in which
    information is shared. The Coast Guard also reported that it had
    implemented a maritime monitoring system--known as the Common Operating
    Picture system--that fuses data from different sources. According to
    the Coast Guard, this system is the primary tool for Coast Guard
    commanders in the field to attain maritime domain awareness. For more
    information, see GAO-07-754T; Maritime Security: Information sharing
    Efforts Are Improving, GAO-06-933T; Maritime Security: New Structures
    Have Improved Information Sharing, but Security Clearance Processing
    Requires Further Attention, GAO-05-394; and GAO-05-448T; DHS updated
    information: In March 2007, DHS provided us with updated information on
    its efforts to establish operational centers to monitor threats and
    fuse intelligence and operations at the regional/port level. DHS
    reported that at the port level, it is using pre-existing, primarily
    Coast Guard, command centers to foster information sharing and
    coordination of the operations of various federal and nonfederal
    participants. However, DHS noted that in most locations, these efforts
    are hampered by the limitations of pre-9/11 technology and physical
    space constraints; Our assessment: We conclude that DHS has generally
    achieved this performance expectation. The Coast Guard established two
    regional Maritime Intelligence Fusion Centers, one on each coast.
    Further, the Coast Guard, with local federal port security
    stakeholders, has established three interagency operational centers
    with several new centers scheduled to come on line, and as of June
    2006, the Coast Guard had organized 46 area committees;
    Assessment: Generally achieved.

    Performance expectation: 14. Collect information on incoming ships to
    assess risks and threats;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has taken
    steps to collect information on incoming ships to assess risks and
    threats. This includes information relating to, for example, crew,
    passengers, and cargo. In March 2004, we reported that the Coast Guard
    had extended the former 24-hour notice of arrival prior to entering a
    United States port to 96 hours. The information provided with the
    notice of arrival includes details on the crew, passengers, cargo, and
    the vessel itself. This increase in notice has enabled the Coast Guard
    to screen more vessels in advance of arrival and allows additional time
    to prepare for boardings. For more information, see Coast Guard
    Programs: Relationship between Resources Used and Results Achieved
    Needs to Be Clearer, GAO-04-432;
    Assessment: Generally achieved.

    Performance expectation: 15. Develop a vessel-tracking system to
    improve intelligence and maritime domain awareness on vessels in U.S.
    waters;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has made
    progress in developing a vessel-tracking system to improve
    intelligence/maritime domain awareness on vessels in U.S. waters. The
    Nationwide Automatic Identification System uses a device aboard a
    vessel to transmit an identifying signal to a receiver located at the
    seaport and other ships in the area. This signal gives seaport
    officials and other vessels nearly instantaneous information and
    awareness about a vessel's identity, position, speed, and course. The
    Coast Guard intends to provide Nationwide Automatic Identification
    System coverage to meet maritime domain awareness requirements in all
    navigable waters of the United States and farther offshore. As of May
    2005, the Coast Guard had Nationwide Automatic Identification System
    coverage in several seaports and coastal areas. For more information,
    see GAO-05-448T and Maritime Security: Partnering Could Reduce Federal
    Costs and Facilitate Implementation of Automatic Vessel Identification
    System, GAO-04-868;
    Assessment: Generally achieved.

    Performance expectation: 16. Develop a long-range vessel-tracking
    system to improve maritime domain awareness;
    Summary of findings: GAO findings: While DHS has taken steps to develop
    a long-range vessel-tracking system, more work remains. In May 2005 we
    testified that the Coast Guard was working with the International
    Maritime Organization to develop functional and technical requirements
    for long-range tracking out to 2,000 nautical miles and had proposed an
    amendment to the International Convention for Safety of Life at Sea for
    this initiative. The International Maritime Organization adopted
    amendments for the long-range identification and tracking of ships in
    May 2006. We have also reported that a recently passed International
    Maritime Organization requirement calls for most commercial vessels,
    including tankers, to begin transmitting identification and location
    information on or before December 31, 2008, to Safety of Life at Sea
    contracting governments under certain specified circumstances. This
    will allow the vessels to be tracked over the course of their voyages.
    Under this requirement, information on the ship's identity, location,
    date, and time of the position will be made available to the ship's
    flag state, the ship's destination port state, and any coastal state
    within 1,000 miles of the ship's route. For more information, see GAO-
    05-448T; DHS updated information: In March, April, and June 2007, DHS
    provided us with updated information on its efforts to develop a long-
    range vessel-tracking system to improve maritime domain awareness. DHS
    reported that it has classified and unclassified means available to
    perform long-range tracking. DHS stated that unclassified systems,
    including the Nationwide Automatic Identification System, are currently
    in the process of being fielded. DHS reported that the Nationwide
    Automatic Identification System, when implemented, will provide
    automatic identification system coverage from commercial satellites in
    all U.S. waters and up to 2,000 miles offshore. DHS stated that it
    expects initial capability in 2007. DHS also stated that it purchases
    tracking data from commercial sources in places where those
    capabilities are not currently fielded by the United States Coast
    Guard. DHS reported that work is in progress to establish a system
    through the International Maritime Organization that will provide an
    unclassified global tracking capability by 2008 as a part of an
    existing International Maritime Organization convention and give the
    United States a system that is compatible and interoperable with the
    Global maritime community. DHS reported that the Coast Guard will need
    to establish the capability to receive signals and interact with the
    International Maritime Organization's international data center and
    that the Coast Guard has funded various studies and demonstrations to
    address the implementation of long-range-tracking. Further, DHS
    reported that the Coast Guard has developed rule-making language that
    supports the International Maritime Organization rules regarding
    implementation of long-range tracking under the recently approved
    Safety of Life at Sea Chapter V. DHS stated that the proposed rule-
    making is in final development and is expected to be published for
    comment later this year; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. DHS has some
    vessel-tracking capabilities and is working with the International
    Maritime Organization to develop a long-range vessel-tracking system.
    However, DHS did not provide evidence that it has developed a long-
    range vessel-tracking system out to 2,000 nautical miles;
    Assessment: Generally not achieved.

    Performance expectation: 17. Collect information on arriving cargo for
    screening purposes;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS collects
    information on arriving cargo for screening purposes.[A] Pursuant to
    federal law, CBP required ocean carriers to electronically transmit
    cargo manifests to CBP's Automated Manifest System 24 hours before the
    cargo is loaded on a ship at a foreign port. In March 2004 we reported
    that according to CBP officials we contacted, although no formal
    evaluations had been done, the 24-hour rule was beginning to improve
    both the quality and timeliness of manifest information. CBP officials
    acknowledged, however, that although improved, manifest information had
    not always provided accurate or reliable data for targeting purposes.
    For more information see Container Security: A Flexible Staffing Model
    and Minimum Equipment Requirements Would Improve Overseas Targeting and
    Inspection Efforts, GAO-05-557 and 04-577T;
    Assessment: Generally achieved.

    Performance expectation: 18. Develop a system for screening and
    inspecting cargo for illegal contraband;
    Summary of findings: GAO and DHS IG findings and our assessment: We
    conclude that DHS has generally achieved this performance expectation.
    DHS has developed a system for screening incoming cargo for illegal
    contraband--called the Automated Targeting System.[B] However, our
    previous work has identified a number of challenges to the
    implementation of this program. CBP employs its Automated Targeting
    System computer model to review documentation on all arriving
    containers and help select or target containers for additional
    scrutiny. The Automated Targeting System was originally designed to
    help identify illegal narcotics in cargo containers, but was modified
    to help detect all types of illegal contraband used by smugglers or
    terrorists. In addition, CBP has a program, called the Supply Chain
    Stratified Examination, which supplements the Automated Targeting
    System by randomly selecting additional containers to be physically
    examined. We identified a number of challenges to the implementation of
    the Automated Targeting System. For example, in March 2006 we testified
    that CBP did not yet have key controls in place to provide reasonable
    assurance that the Automated Targeting System was effective at
    targeting oceangoing cargo containers with the highest risk of
    containing smuggled weapons of mass destruction. Further, we reported
    that while CBP strove to refine the Automated Targeting System to
    include intelligence information it acquires and feedback it receives
    from its targeting officers at the seaports, it was not able to
    systematically adjust the system for inspection results. In November
    2006, the DHS IG reported that national Automatic Targeting System
    performance measures were still being developed to determine the
    effectiveness of the Automatic Targeting System oceangoing container
    targeting system. The DHS IG also found that that CBP did not use all
    intelligence/information sources available for targeting purposes. In
    April 2007 we reported CBP faced the challenge of implementing the
    program while internal controls are being developed. CBP's vital
    mission does not allow it to halt its screening efforts while it puts
    these controls in place, and CBP thus faces the challenge of ensuring
    that it inspects the highest-risk containers even though it lacks
    information to optimally allocate inspection resources. For more
    information, see GAO-07-754T; Cargo Container Inspections: Preliminary
    Observations on the Status of Efforts to Improve the Automated
    Targeting System, GAO-06-591T; and Homeland Security: Summary of
    Challenges Faced in Targeting Oceangoing Cargo Containers for
    Inspection, GAO-04-557T. Also, see Department of Homeland Security
    Office of Inspector General, Audit of Targeting Oceangoing Cargo
    Containers (Unclassified Summary), OIG-07-09 (Washington, D.C.:
    November 2006) and Department of Homeland Security Office of Inspector
    General, Audit of Targeting Oceangoing Cargo Containers (Unclassified
    Summary), OIG-05-26 (Washington, D.C.: July 2005);
    Assessment: Generally achieved.

    Performance expectation: 19. Develop a program to screen incoming cargo
    for radiation;
    Summary of findings: GAO findings: While DHS has taken steps to develop
    a program to screen incoming cargo for radiation, challenges remain.[C]
    As of December 2005, DHS had deployed 670 of 3,034 radiation portal
    monitors--about 22 percent of the portal monitors DHS plans to deploy.
    As of February 2006, CBP estimated that with these deployments CBP had
    the ability to screen about 62 percent of all containerized shipments
    entering the United States, and roughly 77 percent of all private
    vehicles. Within these total percentages, CBP could screen 32 percent
    of all containerized seaborne shipments; 90 percent of commercial
    trucks and 80 percent of private vehicles entering from Canada; and
    approximately 88 percent of all commercial trucks and 74 percent of all
    private vehicles entering from Mexico. However, in March 2006 we
    reported that the deployment of portal monitors had fallen behind
    schedule, making DHS's goal of deploying 3,034 by 2009 unlikely.
    Further, in October 2006 we reviewed DHS's cost-benefit analysis for
    the deployment and purchase of $1.2 billion worth of new portal
    monitors. We found that DHS's cost-benefit analysis did not provide a
    sound analytical basis for the decision to purchase and deploy new
    portal monitor technology. For example, DHS did not use the results of
    its own performance tests in its cost-benefit analysis and instead
    relied on assumptions of the new technology's anticipated performance
    level. Further, the department's analysis did not include all of the
    major costs and benefits required by DHS guidelines. Finally, DHS used
    questionable assumptions in estimating the costs of current portal
    monitors. In March 2007 we reported that DHS has not yet collected a
    comprehensive inventory of testing information on commercially
    available polyvinyl toluene portal monitors. Such information--if
    collected and used--could improve the Domestic Nuclear Detection
    Office's understanding of how well portal monitors detect different
    radiological and nuclear materials under varying conditions. In turn,
    this understanding would assist the Domestic Nuclear Detection Office's
    future testing, development, deployment, and purchases of portal
    monitors. Further, while DHS is improving its efforts to provide
    technical and operational information about radiation portal monitors
    to state and local authorities, some state representatives with whom we
    spoke, particularly those from states with less experience conducting
    radiation detection programs, would like to see the Domestic Nuclear
    Detection Office provide more prescriptive advice on what types of
    radiation detection equipment to deploy and how to use it. For more
    information, see Combating Nuclear Smuggling: DHS's Decision to Procure
    and Deploy the Next Generation of Radiation Detection Equipment Is Not
    Supported by Its Cost-Benefit Analysis, GAO-07-581T;Combating Nuclear
    Smuggling: DNDO Has Not Yet Collected Most of the National
    Laboratories' Test Results on Radiation Portal Monitors in Support of
    DNDO's Testing and Development Program, GAO-07-347R; Combating Nuclear
    Smuggling: DHS's Cost-Benefit Analysis to Support the Purchase of New
    Radiation Detection Portal Monitors Was Not Based on Available
    Performance Data and Did Not Fully Evaluate All the Monitors' Costs and
    Benefits, GAO-07-133R; and Combating Nuclear Smuggling: DHS Has Made
    Progress Deploying Radiation Detection Equipment at U.S. Ports-of-
    Entry, but Concerns Remain, GAO-06-389; DHS updated information: In
    March and April 2007, DHS provided us with updated information on its
    efforts to develop a program to screen incoming cargo for radiation.
    DHS reported that the Coast Guard continues to develop the procedures
    and capabilities for detecting chemical, biological, radiological,
    nuclear and high-yield explosive threats in the maritime environment.
    DHS reported that through these efforts, the Coast Guard has partnered
    with the Domestic Nuclear Detection Office and reported that it
    partnered with the Federal Bureau of Investigation, Department of
    Energy, and Department of Defense. DHS stated that the Coast Guard
    maintains three dedicated response teams, on call 365 days a year, to
    respond to and mitigate various environmental incidents. DHS reported
    that the Coast Guard has distributed personal radiation detectors,
    hand-held isotope identifiers, and radiation sensor backpacks to the
    field, and continues to pursue procurement of additional equipment
    through a joint acquisition strategy with Domestic Nuclear Detection
    Office. Further, DHS as of March 9, 2007, CBP had deployed 966
    radiation portal monitors. DHS stated that these deployments provide
    CBP with the capability to screen approximately 91 percent of
    containerized cargo and 88 percent of personally owned vehicles
    entering the United States. DHS further stated that within these
    totals, CBP could screen about 89 percent of seaborne containerized
    cargo; 91 percent of commercial trucks and about 81 percent of
    personally owned vehicles arriving from Canada; and 96 percent of
    commercial trucks and 91 percent of personally owned vehicles arriving
    from Mexico; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. In our prior work, we reported
    that DHS was unlikely to reach its 2009 goal for radiation portal
    deployment. We also reported that in conducting its cost-benefit
    analysis of the decision to purchase and deploy new portal monitor
    technology, DHS did not include all of the major costs and benefits
    required by DHS guidelines and did not use the results of its own
    performance tests. The department instead relied on assumptions of the
    new technology's anticipated performance level. The lack of adequate
    means for acquiring technology is a major impediment to the development
    and implementation of the program;
    Assessment: Generally not achieved.

    Performance expectation: 20. Develop a program to work with foreign
    governments to inspect suspicious cargo before it leaves for U.S.
    ports;
    Summary of findings: GAO findings: DHS has developed a program to work
    with foreign governments to inspect suspicious cargo before leaving for
    U.S. ports. Announced in January 2002, the Container Security
    Initiative program was implemented to allow CBP officials to target
    containers at foreign seaports so that any high-risk containers may be
    inspected prior to their departure for U.S. destinations. The Security
    and Accountability for Every Port Act, which took effect in October
    2006, codified the Container Security Initiative. CBP first solicited
    the participation of the 20 foreign ports that shipped the highest
    volume of ocean containers to the United States. These top 20 ports are
    located in 14 countries and regions and shipped a total of 66 percent
    of all containers that arrived in U.S. seaports in 2001. CBP has since
    expanded the Container Security Initiative to strategic ports, which
    may ship lesser amounts of cargo to the United States but may also have
    terrorism or geographical concerns. We identified a number of
    challenges to the Container Security Initiative. For example, in April
    2005 we reported that staffing imbalances were impeding CBP from
    targeting all containers shipped from Container Security Initiative
    ports before they leave for the United States. However, we reported
    that CBP had been unable to staff the Container Security Initiative
    teams at the levels called for in the Container Security Initiative
    staffing model because of diplomatic and practical considerations. In
    terms of diplomatic considerations, the host government may limit the
    overall number of U.S. government employees to be stationed in the
    country and may restrict the size of the Container Security Initiative
    team. In terms of practical considerations, the host governments may
    not have enough workspace available for Container Security Initiative
    staff and may thus restrict the size of the Container Security
    Initiative team. The U.S. Department of State would also have to agree
    to the size of the Container Security Initiative teams, a decision that
    has to be balanced with the mission priorities of the embassy, the
    programmatic and administrative costs associated with increases in
    staffing, and security issues related to the number of Americans posted
    overseas. We reported that as a result of these staff imbalances, 35
    percent of U.S.-bound shipments from Container Security Initiative
    ports were not targeted and were therefore not subject to inspection
    overseas. We also reported the existence of limitations in one data
    source Container Security Initiative teams use for targeting high-risk
    containers. In April 2007 we reported that the number of seaports that
    participate in the program had grown to 50, with plans to expand to a
    total of 58 ports by the end of this fiscal year. We also identified
    several challenges to the Container Security Initiative. For example,
    we reported that there are no internationally recognized minimum
    technical requirements for the detection capability of nonintrusive
    inspection equipment used to scan containers. Consequently, host
    nations at Container Security Initiative seaports use various types of
    nonintrusive inspection equipment, and the detection capabilities of
    such equipment can vary. Further, we reported that some containers
    designated as high-risk did not receive an inspection at the Container
    Security Initiative seaport. Containers designated as high-risk by
    Container Security Initiative teams that are not inspected overseas
    (for a variety of reasons) are supposed to be referred for inspection
    upon arrival at the U.S. destination port. However, CBP officials noted
    that between July and September 2004, only about 93 percent of
    shipments referred for domestic inspection were inspected at a U.S.
    seaport. According to CBP, it is working on improvements in its ability
    to track such containers to ensure that they are inspected. We have
    ongoing work to further assess the Container Security Initiative. For
    more information, see GAO-07-754T; Homeland Security: Key Cargo
    Security Programs Can Be Improved, GAO-05-466T; Container Security: A
    Flexible Staffing Model and Minimum Equipment Requirements Would
    Improve Overseas Targeting and Inspection Efforts, GAO-05-557; Homeland
    Security: Summary of Challenges Faced in Targeting Oceangoing Cargo
    Containers for Inspection, GAO-04-557T; and Container Security:
    Expansion of Key Customs Programs Will Require Greater Attention to
    Critical Success Factors, GAO-03-770. DHS updated information: In March
    and April 2007, DHS provided us with updated information on its efforts
    to develop a program to work with foreign governments to inspect
    suspicious cargo before it leaves for U.S. ports. DHS reported that in
    April 2005 the Container Security Initiative began implementing
    revisions to the Container Security Initiative staffing model to have
    optimal levels of staff at Container Security Initiative ports to
    maximize the benefits of targeting and inspection activities, in
    conjunction with host nation customs officials, and to increase its
    staff at the National Targeting Center in the United States to
    complement the work of targeters overseas. DHS stated that this enabled
    Container Security Initiative ports to review and screen 100 percent of
    manifest information for containers destined to the United States; Our
    assessment: We conclude that DHS has generally achieved this
    performance expectation. The department has developed a program to work
    with foreign governments to inspect suspicious cargo before it leaves
    for U.S. ports. DHS has developed the Container Security Initiative,
    and the program allows CBP officials to target containers at foreign
    seaports for inspection. However, our previous work has identified a
    number of challenges to the implementation of this program, such as the
    detection capabilities of host nations' inspection equipment.
    Assessment: Generally achieved.

    Performance expectation: 21. Develop a program to work with the private
    sector to improve and validate supply chain security;
    Summary of findings: GAO findings: DHS has developed a program to work
    with the private sector to improve and validate supply chain security,
    but some challenges remain. Initiated in November 2001, the Customs-
    Trade Partnership Against Terrorism is a voluntary program designed to
    improve the security of the international supply chain while
    maintaining an efficient flow of goods. Under the Customs-Trade
    Partnership Against Terrorism, CBP officials work in partnership with
    private companies to review their supply chain security plans to
    improve members' overall security. In return for committing to making
    improvements to the security of their shipments by joining the program,
    Customs-Trade Partnership Against Terrorism members may receive
    benefits that result in reduced scrutiny of their shipments. The
    Security and Accountability For Every Port Act, which took effect in
    October 2006, codified the program. In April 2007, we reported that
    since the inception of the Customs-Trade Partnership Against Terrorism,
    CBP has certified 6,375 companies, and as of March 2007, it had
    validated the security of 3,950 of them (61.9 percent). We also
    reported that while CBP initially set a goal of validating all
    companies within their first 3 years as Customs-Trade Partnership
    Against Terrorism members, the program's rapid growth in membership
    made the goal unachievable. CBP then moved to a risk-based approach to
    selecting members for validation, considering factors such as the
    company having foreign supply chain operations in a known terrorist
    area or involving multiple foreign suppliers. CBP further modified its
    approach to selecting companies for validation to achieve greater
    efficiency by conducting "blitz" operations to validate foreign
    elements of multiple members' supply chains in a single trip. Blitz
    operations focus on factors such as Customs-Trade Partnership Against
    Terrorism members within a certain industry, supply chains within a
    certain geographic area, or foreign suppliers to multiple Customs-Trade
    Partnership Against Terrorism members. Risks remain a consideration,
    according to CBP, but the blitz strategy drives the decision of when a
    member company will be validated. However, we identified a number of
    challenges to Customs-Trade Partnership Against Terrorism. For example,
    CBP's standard for validations--to ensure that members' security
    measures are reliable, accurate and effective--is hard to achieve.
    Since the Customs-Trade Partnership Against Terrorism is a voluntary
    rather than a mandatory program, there are limits on how intrusive CBP
    can be in its validations. Further, challenges developing Customs-Trade
    Partnership Against Terrorism outcome-based performance measures
    persist because of difficulty measuring deterrent effect. CBP has
    contracted with the University of Virginia for help in developing
    useful measures. We have ongoing work to further assess the Customs-
    Trade Partnership Against Terrorism program. For more information, see
    GAO-07-754T; Homeland Security: Key Cargo Security Programs Can Be
    Improved, GAO-05-466T; Cargo Security: Partnership Program Grants
    Importers Reduced Scrutiny with Limited Assurance of Improved Security,
    GAO-05-404; and Container Security: Expansion of Key Customs Programs
    Will Require Greater Attention to Critical Success Factors, GAO-03-
    770; DHS updated information: In March and April 2007, DHS provided us
    with updated information on its efforts to develop a program to work
    with the private sector to improve and validate supply chain security.
    For example, DHS reported that the Customs-Trade Partnership Against
    Terrorism program now has a Web based portal system that allows data
    storage and statistical tracking of all participants and also allows
    for reports to be run ensuring that performance goals are being met.
    DHS also stated that the Customs-Trade Partnership Against Terrorism
    reached its full staffing level of 156 Supply Chain Security
    Specialists in December of 2006; Our assessment: We conclude that DHS
    has generally achieved this performance expectation. The department has
    developed a program to work with the private sector to improve and
    validate supply chain security. Through the Customs-Trade Partnership
    Against Terrorism, DHS officials work in partnership with private
    companies to improve members' overall security. However, our previous
    work has identified a number of challenges to the implementation of
    this program. For example, because the Customs-Trade Partnership
    Against Terrorism is a voluntary program, CBP is limited in how
    intrusive its validations can be, and CBP also faces challenges in
    developing outcome-based performance measures for the program;
    Assessment: Generally achieved.

    Performance expectation: 22. Develop standards for cargo containers to
    ensure their physical security;
    Summary of findings: GAO findings and assessment: We generally have not
    conducted work on DHS's efforts to develop standards to better secure
    containers, and as a result we cannot make an assessment of the extent
    to which DHS has taken actions to address this performance expectation;
    Assessment: No assessment made.

    Performance expectation: 23. Develop an international port security
    program to assess security at foreign ports;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    a program to assess security at foreign ports. However, our previous
    work has identified a number of challenges to the implementation of
    this program. To help secure the overseas supply chain, the Maritime
    Transportation Security Act required the Coast Guard to develop a
    program to assess security measures in foreign ports and, among other
    things, recommend steps necessary to improve security measures in their
    ports. In April 2007, we reported that the Coast Guard established this
    program, called the International Port Security Program, in April 2004.
    Under this program, the Coast Guard and host nations review the
    implementation of security measures in the host nations' ports against
    established security standards, such as the International Maritime
    Organization's International Ship and Port Facility Security Code.
    Coast Guard teams have been established to conduct country visits,
    discuss security measures implemented, and collect and share best
    practices to help ensure a comprehensive and consistent approach to
    maritime security in ports worldwide. The conditions of these visits,
    such as timing and locations, are negotiated between the Coast Guard
    and the host nation. Coast Guard officials also make annual visits to
    the countries to obtain additional observations on the implementation
    of security measures and ensure deficiencies found during the country
    visits are addressed. As of April 2007, the Coast Guard reported that
    it has visited 86 countries under this program and plans to complete 29
    more visits by the end of fiscal year 2007. We are currently conducting
    a review of the Coast Guard's international enforcement programs, such
    as the International Port Security Program. Although this work is still
    in process and not yet ready to be included in this assessment, we have
    completed a more narrowly scoped review required under the Security and
    Accountability For Every Port Act regarding security at ports in the
    Caribbean Basin. As part of this work, we looked at the efforts made by
    the Coast Guard in the region under the program and the Coast Guard's
    findings from the country visits it made in the region. In this review
    we found a number of challenges concerning program implementation. For
    example, for the countries in this region for which the Coast Guard had
    issued a final report, the Coast Guard reported that most had
    "substantially implemented the security code," while one country that
    was just recently visited was found to have not yet implemented the
    code and will be subject to a reassessment. At the facility level, the
    Coast Guard found several facilities needing improvements in areas such
    as access controls, communication devices, fencing, and lighting.
    Because our review of the Coast Guard's International Port Security
    Program is still ongoing, we have not yet reviewed the results of the
    Coast Guard's findings in other regions of the world. While our larger
    review is still not complete, Coast Guard officials have told us they
    face challenges in carrying out this program in the Caribbean Basin.
    These challenges include ensuring sufficient numbers of adequately
    trained personnel and addressing host nation sovereignty issues. For
    more information, see GAO-07-754T and GAO-05-448T;
    Assessment: Generally achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [A] The terms "inspecting" and "screening" have been used
    interchangeably to denote some level of examination of a person or
    good, which can entail a number of different actions, including manual
    physical inspections to ensure that cargo does not contain weapons,
    explosives, or stowaways, or inspections using noninstrusive
    technologies that do not require the cargo to be opened in order to be
    inspected. However, for this performance expectation, we use the term
    "inspect" to refer to this broad range of activities and "screening" to
    refer to an assessment of the security risk posed by a container based
    on available information.

    [B] The terms "inspecting" and "screening" have been used
    interchangeably to denote some level of examination of a person or
    good, which can entail a number of different actions, including manual
    physical inspections to ensure that cargo does not contain weapons,
    explosives, or stowaways, or inspections using noninstrusive
    technologies that do not require the cargo to be opened in order to be
    inspected. However, for this performance expectation, we use the term
    "inspect" to refer to this broad range of activities and "screening" to
    refer to an assessment of the security risk posed by a container based
    on available information.

    [C] The terms "inspecting" and "screening" have been used
    interchangeably to denote some level of examination of a person or
    good, which can entail a number of different actions, including manual
    physical inspections to ensure that cargo does not contain weapons,
    explosives, or stowaways, or inspections using noninstrusive
    technologies that do not require the cargo to be opened in order to be
    inspected. For this performance expectation, we use the terms "screen"
    and "inspect" to refer to this broad range of activities.

    [End of table]

    DHS Has Made Limited Progress in Its Emergency Preparedness and
    Response Efforts:

    Several federal legislative and executive provisions support
    preparation for and response to emergency situations. The Robert T.
    Stafford Disaster Relief and Emergency Assistance Act (the Stafford
    Act)[Footnote 25] primarily establishes the programs and processes for
    the federal government to provide major disaster and emergency
    assistance to state, local, and tribal governments; individuals; and
    qualified private nonprofit organizations. FEMA, within DHS, has
    responsibility for administering the provisions of the Stafford Act.
    FEMA's emergency preparedness and response efforts include programs
    that prepare to minimize the damage and recover from terrorist attacks
    and disasters; help to plan, equip, train, and practice needed skills
    of first responders; and consolidate federal response plans and
    activities to build a national, coordinated system for incident
    management. DHS's emergency preparedness and response efforts have been
    affected by DHS reorganizations and, in the wake of the 2005 Gulf Coast
    hurricanes, reassessments of some initiatives, such as the National
    Response Plan and its Catastrophic Incident Supplement. DHS is
    undergoing its second reorganization of its emergency preparedness and
    response programs in about 18 months. The first reorganization was
    initiated by the Secretary of Homeland Security in the summer of 2005
    and created separate organizations within DHS responsible for
    preparedness and for response and recovery. The second reorganization
    was required by the fiscal year 2007 DHS appropriations act and largely
    took effect on April 1, 2007.

    As shown in table 28, we identified 24 performance expectations for DHS
    in the area of emergency preparedness and response and found that
    overall DHS has made limited progress in meeting those performance
    expectations. In particular, we found that DHS has generally achieved 5
    performance expectations and has generally not achieved 18 others. For
    1 performance expectation, we did not make an assessment.

    Table 28: Performance Expectations and Progress Made in Emergency
    Preparedness and Response:

    Performance expectation: 1. Establish a comprehensive training program
    for national preparedness;
    Assessment: Generally not achieved.

    Performance expectation: 2. Establish a program for conducting
    emergency preparedness exercises;
    Assessment: Generally achieved.

    Performance expectation: 3. Conduct and support risk assessments and
    risk management capabilities for emergency preparedness;
    Assessment: Generally not achieved.

    Performance expectation: 4. Ensure the capacity and readiness of
    disaster response teams;
    Assessment: Generally not achieved.

    Performance expectation: 5. Develop a national incident management
    system; Assessment:
    Generally achieved.

    Performance expectation: 6. Coordinate implementation of a national
    incident management system; Assessment:
    Assessment: Generally not achieved.

    Performance expectation: 7. Establish a single, all-hazards national
    response plan;
    Assessment: Generally not achieved.

    Performance expectation: 8. Coordinate implementation of a single, all-
    hazards response plan;
    Assessment: Generally not achieved.

    Performance expectation: 9. Develop a complete inventory of federal
    response capabilities;
    Assessment: Generally not achieved.

    Performance expectation: 10. Develop a national, all-hazards
    preparedness goal;
    Assessment: Generally not achieved.

    Performance expectation: 11. Support citizen participation in national
    preparedness efforts;
    Assessment: No assessment made.

    Performance expectation: 12. Develop plans and capabilities to
    strengthen nationwide recovery efforts;
    Assessment: Generally not achieved.

    Performance expectation: 13. Develop the capacity to provide needed
    emergency assistance and services in a timely manner;
    Assessment: Generally not achieved.

    Performance expectation: 14. Provide timely assistance and services to
    individuals and communities in response to emergency events;
    Assessment: Generally not achieved.

    Performance expectation: 15. Implement a program to improve
    interoperable communications among federal, state, and local agencies;
    Assessment: Generally not achieved.

    Performance expectation: 16. Implement procedures and capabilities for
    effective interoperable communications; Assessment:
    Generally not achieved.

    Performance expectation: 17. Increase the development and adoption of
    interoperability communications standards;
    Generally not achieved.

    Performance expectation: 18. Develop performance goals and measures to
    assess progress in developing interoperability;
    Assessment: Generally not achieved.

    Performance expectation: 19. Provide grant funding to first responders
    in developing and implementing interoperable communications
    capabilities;
    Assessment: Generally achieved.

    Performance expectation: 20. Provide guidance and technical assistance
    to first responders in developing and implementing interoperable
    communications capabilities;
    Assessment: Generally not achieved.

    Performance expectation: 21. Provide assistance to state and local
    governments to develop all-hazards plans and capabilities;
    Assessment: Generally not achieved.

    Performance expectation: 22. Administer a program for providing grants
    and assistance to state and local governments and first responders;
    Assessment: Generally achieved.

    Performance expectation: 23. Allocate grants based on assessment
    factors that account for population, critical infrastructure, and other
    risk factors;
    Assessment: Generally achieved.

    Performance expectation: 24. Develop a system for collecting and
    disseminating lessons learned and best practices to emergency
    responders;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 5;
    Assessment: Generally not achieved: 18;
    Assessment: No assessment made: 1.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 29 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of emergency preparedness and response and our assessment of
    whether DHS has taken steps to satisfy most of the key elements of the
    performance expectation (generally achieved) or has not taken steps to
    satisfy most of the performance expectation's key elements (generally
    not achieved).

    Table 29: Performance Expectations and Assessment of DHS Progress in
    Emergency Preparedness and Response:

    Performance expectation: 1. Establish a comprehensive training program
    for national preparedness;
    Summary of findings: GAO and DHS IG findings: DHS has developed and
    implemented various training programs, but it is unclear how these
    programs contribute or link to a comprehensive training program for
    national preparedness. In July 2005, we reported that according to
    DHS's National Training and Exercises and Lessons Learned
    Implementation Plan, DHS intended to implement a system to develop and
    maintain state and local responders' all-hazards capabilities. The goal
    of this system was to provide integrated national programs for
    training, exercise, and lessons learned that would reorient existing
    initiatives at all government levels in order to develop, achieve, and
    sustain the capabilities required to achieve the National Preparedness
    Goal. As part of this system, DHS intended to implement a national
    training program including providing criteria for accreditation of
    training courses, a national directory of accredited training
    providers, and a National Minimum Qualification Standards Guide. In
    March 2006, the DHS IG reported that FEMA provided regular training for
    emergency responders at the federal, state, and local levels; managed
    the training and development of FEMA employees internally; and provided
    disaster-specific training through the Disaster Field Training
    Operations cadre. FEMA's Training Division increased the size and
    number of classes it delivered, even as budgets decreased. The DHS IG
    found that courses provided by the Emergency Management Institute were
    one of FEMA's primary interactions with state and local emergency
    managers and responders. However, the DHS IG reported that the ability
    of Emergency Management Institute classes to improve emergency
    management during a hurricane was not quantifiable with available
    measurements. The DHS IG reported that employee development lacked the
    resources and organizational alignment to improve performance.
    Specifically, the DHS IG reported that FEMA had no centralized and
    comprehensive information on employee training. FEMA used several
    incompatible systems, including databases operated by the Employee
    Development branch, Emergency Management Institute, Disaster Field
    Training Operations cadre, and information technology security.
    Additional classes, including classes provided at conferences, classes
    provided by state or local entities, and leadership training courses,
    were not consistently tracked. The DHS IG reported that FEMA regional
    training managers maintained records on their own, drawing from each of
    these systems. The DHS IG concluded that not only was this process
    inefficient and susceptible to error, it also complicated efforts to
    monitor employee development of mission-critical skills and
    competencies. For more information, see Statement by Comptroller
    General David M. Walker on GAO's Preliminary Observations Regarding
    Preparedness and Response to Hurricanes Katrina and Rita, GAO-06-365R
    and Homeland Security: DHS's Efforts to Enhance First Responders' All-
    Hazards Capabilities Continue to Evolve, GAO-05-652. Also, see
    Department of Homeland Security Office of Inspector General, A
    Performance Review of FEMA's Disaster Management Activities in Response
    to Hurricane Katrina, OIG-06-32 (Washington, D.C.: March 2006); DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to establish a comprehensive
    training program for national preparedness. DHS has developed a series
    of training programs on the National Response Plan and the National
    Incident Management System to improve national preparedness. In
    particular, DHS reported that more than 100 Office of Grants and
    Training-supported courses are available to emergency responders and
    that in fiscal year 2006, there were more than 336,000 participants in
    Office of Grants and Training courses. DHS has also developed and
    implemented a Multi-Year Training and Exercise Plan designed to guide
    states in linking training and exercise activities. According to DHS,
    states identify priorities in their state strategies, translate them
    into target capabilities that they need to build, and then attend a
    workshop in which they build a schedule for training and exercises to
    address the capabilities. DHS reported that course content in the
    National Training Program is being aligned to target capabilities so
    that there is a direct link between the capabilities a state needs to
    build and the courses that its responders need to take to build those
    skills. In addition, DHS reported that the U.S. Fire Administration's
    National Fire Academy and FEMA's Emergency Management Institute have
    coordinated to develop a curriculum for first responder training across
    federal, state, local, and tribal governments and that in fiscal year
    2006, more than 26,000 and 13,000 students attended training at the
    National Fire Academy and the Emergency Management Institute,
    respectively. DHS noted that with the re-creation of the National
    Integration Center in FEMA's new National Preparedness Directorate,
    FEMA will be coordinating development of a comprehensive national
    training strategy to ensure course curriculum is consistent among
    training facilities and to avoid duplication or overlap; Our
    assessment: Until DHS issues a comprehensive national training
    strategy, we conclude that DHS has generally not achieved this
    performance expectation. Although DHS has developed and implemented a
    variety of training programs related to national preparedness,
    specifically on the National Response Plan and National Incident
    Management System, DHS did not provide us with evidence on how these
    various programs have contributed to the establishment of a
    comprehensive, national training program. Moreover, DHS reported that
    it is working to develop a comprehensive national training strategy,
    but did not provide us with a target time frame for completing and
    issuing the national strategy;
    Assessment: Generally not achieved.

    Performance expectation: 2. Establish a program for conducting
    emergency preparedness exercises;
    Summary of findings: GAO and DHS IG findings: DHS has taken actions to
    establish a program for conducting emergency preparedness exercises,
    but much more work remains. In July 2005 we reported that as part of
    its plan for national training, exercises, and lessons learned, DHS
    intended to establish a national exercise program. This program was
    intended to reorient the existing National Exercise Program to
    incorporate the capabilities-based planning process and provide
    standardized guidance and methodologies to schedule, design, develop,
    execute, and evaluate exercises at all levels of government. This
    program was also intended to provide requirements for the number and
    type of exercises that communities of varying sizes should conduct to
    meet the National Preparedness Goal. In March 2006, the DHS IG reported
    on the long-term deterioration in FEMA's exercise program. The DHS IG
    reported that emergency management exercises were developed to test and
    validate existing programs, policies, plans, and procedures to address
    a wide range of disasters to which FEMA must respond. There were
    numerous types of exercises, ranging from tabletop exercises, where
    participants discussed actions and responses, to command post
    exercises, where specific aspects of a situation were exercised, to
    large-scale exercises, which involved multiple entities and a
    significant planned event with activation of personnel and resources.
    Further, the DHS IG reported that FEMA no longer had a significant role
    in the development, scope, and conduct of state exercises, though FEMA
    personnel maintained a presence at state events. FEMA participated in
    exercises administered by other agencies, but those exercises limited
    FEMA's ability to choose which plans, objectives, and relationships to
    test. For more information, see GAO-06-365R and GAO-05-652. Also, see
    Department of Homeland Security Office of Inspector General, A
    Performance Review of FEMA's Disaster Management Activities in Response
    to Hurricane Katrina, OIG-06-32 (Washington, D.C.: March 2006); DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to establish a program for
    conducting emergency preparedness exercises. DHS has developed a
    Homeland Security Exercise Evaluation Program that, according to DHS,
    has been adopted by every major federal agency involved in emergency
    preparedness. This program provides a standardized methodology for
    exercise design, development, conduct, evaluation, and improvement
    planning and provides guidance and doctrine for exercises that are
    conducted with homeland security grant funding. According to DHS, all
    exercise grant recipients are mandated to comply with Homeland Security
    Exercise Evaluation Program guidelines. DHS reported that for exercises
    for which the department collected and analyzed information in fiscal
    year 2006, 33 out of 48 Direct Support Exercises were compliant with
    the Homeland Security Exercise Evaluation Program and 40 out of 110
    state or locally funded grant exercises were compliant. DHS noted that
    it has not evaluated regional and national exercises' compliance with
    the Homeland Security Exercise Evaluation Program. DHS has also
    developed a Homeland Security Exercise Evaluation Program Toolkit,
    which is an online system that walks users through scheduling,
    planning, evaluating, and tracking corrective actions from an exercise.
    DHS has also developed the Corrective Action Program to track and
    monitor corrective actions following exercises and the National
    Exercise Schedule to facilitate the scheduling and synchronization of
    national, federal, state, and local exercises. In addition, DHS
    reported that the National Exercise Program charter was approved by the
    Homeland Security Council, and DHS reported that the National Exercise
    Program Implementation Plan has been approved by the President and is
    scheduled to be released shortly; Our assessment: We conclude that DHS
    has generally achieved this performance expectation. The National
    Exercise Program charter has been established and approved. Moreover,
    DHS has developed and begun to implement the Homeland Security Exercise
    Evaluation Program. This program provides standardized guidance and
    methodologies for scheduling, developing, executing, and evaluating
    emergency preparedness exercises;
    Assessment: Generally achieved.

    Performance expectation: 3. Conduct and support risk assessments and
    risk management capabilities for emergency preparedness;
    Summary of findings: GAO findings: DHS has taken actions to support
    efforts to conduct risk assessments and develop risk management
    capabilities for emergency preparedness, but much more work remains. In
    July 2005 we reported that, according to DHS's Assessment and Reporting
    Implementation Plan, DHS intended to implement an assessment and
    reporting system to collect preparedness data to inform decision makers
    at all levels on the capabilities of the federal government, states,
    local jurisdictions, and the private sector. According to the plan, DHS
    intended to collect data from all governmental recipients of direct
    funding, using states to collect data from local jurisdictions and
    using federal regulatory agencies and other appropriate sources to
    collect private sector data. According to DHS, aggregating these data
    at all levels would provide information needed to allocate resources,
    execute training and exercises, and develop an annual status report on
    the nation's preparedness. The purpose of the assessment and reporting
    system was to provide information about the baseline status of national
    preparedness and to serve as the third stage of DHS's capability-based
    planning approach to ensure that state and local first responder
    capabilities fully support the National Preparedness Goal. For more
    information, see Homeland Security: Applying Risk Management Principles
    to Guide Federal Investments, GAO-07-386T and GAO-05-652; DHS updated
    information: In March 2007, DHS provided us with updated information on
    its efforts to conduct and support risk assessments and risk management
    capabilities for emergency preparedness. In particular, in April 2007,
    DHS established the new Office of Risk Management and Analysis to serve
    as the DHS Executive Agent for national-level risk management analysis
    standards and metrics; develop a standardized approach to risk; develop
    an approach to risk management to help DHS leverage and integrate risk
    expertise across components and external stakeholders; assess DHS risk
    performance to ensure programs are measurably reducing risk; and
    communicate DHS risk management in a manner that reinforces the risk-
    based approach; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS did not provide us with
    documentation on its efforts to actually conduct risk assessments and
    support risk management capabilities specifically for emergency
    preparedness. Moreover, DHS has only recently established the new
    Office of Risk Management and Analysis, and this office's effect on
    DHS's efforts to support risk management capabilities for emergency
    preparedness is not yet known;
    Assessment: Generally not achieved.

    Performance expectation: 4. Ensure the capacity and readiness of
    disaster response teams;
    Summary of findings: GAO and DHS IG findings: DHS has faced challenges
    in ensuring the capacity and readiness of emergency response teams. In
    our work reviewing the response to Hurricane Katrina, we reported that
    while there were aspects that worked well, it appeared that logistics
    systems for critical resources were often totally overwhelmed by the
    hurricane, with critical resources apparently not available, properly
    distributed, or provided in a timely manner. We also reported that the
    magnitude of the affected population in a major catastrophe calls for
    greater capabilities for disaster response. In March 2006, the DHS IG
    reported that, historically, FEMA has established a 72-hour time period
    as the maximum amount of time for emergency response teams to arrive on
    scene. However, the DHS IG concluded that it was unclear whether this
    was responsive to the needs of a state and the needs of disaster
    victims. The DHS IG reported that a 72-hour response time did not meet
    public expectations, as was vividly demonstrated by media accounts
    within 24 hours after landfall of Hurricane Katrina. The DHS IG noted
    that shorter time periods, such as 60 hours, 48 hours, or even 12
    hours, had been mentioned. However, to meet this level of expectation,
    several factors had to be addressed. According to the DHS IG, once
    strategic performance measures and realistic expectations were
    established, other actions could be taken to support those response
    goals. For more information, see GAO-06-365R. Also, see Department of
    Homeland Security Office of Inspector General, A Performance Review of
    FEMA's Disaster Management Activities in Response to Hurricane Katrina,
    OIG-06-32 (Washington, D.C.: March 2006); DHS updated information: In
    March and May 2007, DHS provided us with updated information on its
    efforts to ensure the capacity and readiness of disaster response
    teams. DHS reported that FEMA has completed efforts to identify and
    categorize more than 100 resources, including teams and pieces of
    equipment, which are then grouped into eight disciplines, such as law
    enforcement resources, emergency medical services, and search and
    rescue resources. DHS also provided information on its various disaster
    response teams currently in use. DHS's Emergency Response Teams-
    National are to be deployed in response to incidents of national
    significance and major disasters to coordinate disaster response
    activities, coordinate and deploy key national response assets and
    resources, provide situational awareness, and maintain connectivity
    with DHS operations centers and components. DHS's Emergency Response
    Teams-Advanced are designed to be deployed in the early phases of an
    incident to work directly with states to assess disaster impact, gain
    situational awareness, help coordinate disaster response, and respond
    to specific state requests for assistance. DHS's Rapid Needs Assessment
    Teams are small regional teams that are designed to collect disaster
    information to determine more specific disaster response requirements.
    In addition, Federal Incident Response Support Teams are designed to
    serve as the forward component of Emergency Response Teams-Advanced to
    provide preliminary on-scene federal management in support of the local
    Incident or Area Commander. DHS has established readiness indicators
    for the Federal Incident Response Support Teams and Urban Search and
    Rescue teams have their own indicators, but FEMA officials stated that
    they have not yet developed readiness indicators for other types of
    response teams. DHS reported that its Federal Incident Response Teams
    were tested during Tropical Storm Ernesto and other events, such as
    tornadoes. In addition, FEMA reported that it is developing a concept
    for new rapidly deployable interagency incident management teams
    designed to provide a forward federal presence to facilitate managing
    the national response for catastrophic incidents, called National
    Incident Management and Regional Incident Management Teams; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. Although DHS provided us with documentation on
    its various response teams and efforts taken to strengthen teams'
    readiness and capacity, DHS did not provide us with concrete evidence
    to demonstrate that response teams' readiness and capacity have
    improved since Hurricanes Katrina and Rita. Although DHS has tested its
    response team capabilities in several small-scale disasters, they have
    not been tested in a large-scale disaster. In addition, DHS did not
    provide us with documentation of the results of exercises, tests, or
    after-action reports on the small-scale disasters in which the response
    teams have been used that would indicate enhancements in teams'
    readiness and capacity. Moreover, DHS has not yet developed readiness
    indicators for its disaster responses teams other than Urban Search and
    Rescue and Federal Incident Response Support Teams;
    Assessment: Generally not achieved.

    Performance expectation: 5. Develop a national incident management
    system;
    Summary of findings: GAO findings: DHS has developed a national
    incident management system. The National Incident Management System is
    a policy document that defines roles and responsibilities of federal,
    state, and local first responders during emergency events. The intent
    of the system described in the document is to establish a core set of
    concepts, principles, terminology, and organizational processes to
    enable effective, efficient, and collaborative emergency event
    management at all levels. These concepts, principles, and processes are
    designed to improve the ability of different jurisdictions and first
    responder disciplines to work together in various areas--command,
    resource management, training, and communications. For more
    information, see Catastrophic Disasters: Enhanced Leadership,
    Capabilities, and Accountability Controls Will Improve the
    Effectiveness of the Nation's Preparedness, Response, and Recovery
    System, GAO-06-618 and GAO-05-652; DHS updated information: In March
    and April 2007, DHS provided us with updated information on efforts to
    further develop the National Incident Management System. DHS reported
    that the National Incident Management System has been undergoing review
    and revision by federal, state, and local government officials; tribal
    authorities; and nongovernmental and private sector authorities.
    According to DHS, the National Incident Management System document is
    under review pending release of the revised National Response Plan, now
    the National Response Framework. The current version of the National
    Incident Management System document remains in effect during the 2007
    hurricane season; Our assessment: We conclude that DHS has generally
    achieved this performance expectation. DHS has developed the National
    Incident Management System, and the system defines the roles and
    responsibilities of various entities during emergency events;
    Assessment: Generally achieved.

    Performance expectation: 6. Coordinate implementation of a national
    incident management system;
    Summary of findings: GAO findings: Much more work remains for DHS to
    effectively coordinate implementation of the National Incident
    Management System. Drawing on our prior work identifying key practices
    for helping to enhance and sustain collaboration among federal
    agencies, key practices for collaboration and coordination include,
    among other things, defining and articulating a common outcome;
    establishing mutually reinforcing or joint strategies to achieve the
    outcome; identifying and addressing needs by leveraging resources;
    agreeing upon agency roles and responsibilities; establishing
    compatible policies, procedures, and other means to operate across
    agency boundaries; developing mechanisms to monitor, evaluate, and
    report the results of collaborative efforts; and reinforcing agency
    accountability for collaborative efforts through agency plans and
    reports. Homeland Security Presidential Directive 5 requires all
    federal departments and agencies to adopt and use the system in their
    individual preparedness efforts, as well as in support of all actions
    taken to assist state and local governments. However, in our work on
    Hurricane Katrina, we reported on examples of how an incomplete
    understanding of the National Incident Management System roles and
    responsibilities led to misunderstandings, problems, and delays. In
    Louisiana, for example, some city officials were unclear about federal
    roles. In Mississippi, we were told that county and city officials were
    not implementing the National Incident Management System because they
    did not understand its provisions. For more information, see GAO-06-618
    and GAO-05-652; DHS updated information: In March and April 2007, DHS
    provided us with updated information on efforts to coordinate
    implementation of the National Incident Management System. DHS reported
    that in March 2004, it established the National Incident Management
    System Integration Center to coordinate implementation of the system.
    This center issues compliance guidelines to state and local responders
    annually and collects data on efforts to coordinate implementation of
    the National Incident Management System. DHS reported that more than 1
    million state and local responders have taken training following
    guidelines established by the center for National Incident Management
    System compliance and that about 5.4 million students have received
    National Incident Management System-required training through the
    Emergency Management Institute as of February 2007. DHS also reported
    that the center, in conjunction with the Emergency Management
    Institute, released seven new National Incident Management System
    training programs in fiscal year 2006, including courses on multiagency
    coordination, public information systems, and resource management,
    among others. DHS has also developed sample National Incident
    Management System-compliant tabletop, functional, and command post
    exercises for use by federal, state, and local government agencies in
    testing system policies, plans, procedures, and resources in emergency
    operations plans. In addition, the National Incident Management System
    specifies 34 requirements that state and local governments must meet to
    be compliant with the system, and as of October 1, 2006, all federal
    preparedness assistance administered by DHS became contingent on
    states' compliance with the system, including federal funding through
    the DHS Emergency Management Performance Grants, Homeland Security
    Grant Program, and Urban Area Security Initiative. DHS reported that
    during fiscal years 2005 and 2006, National Incident Management System
    requirements, including the completion of training, were based on a
    self-certification process. For fiscal year 2007, DHS reported that the
    self-certification process will not be used; rather DHS provided states
    a specific set of metrics for implementation of the National Incident
    Management System, and states are required to report on the
    establishment of these measurements; Our assessment: We conclude that
    DHS has generally not achieved this performance expectation. In fiscal
    years 2005 and 2006, states self-certified that they had met National
    Incident Management System requirements, and DHS has not fully verified
    the extent to which states were compliant with system requirements
    during those years. DHS has provided states with a specific set of
    metrics for fiscal year 2007, but the extent to which these metrics
    will enhance DHS's ability to monitor states' compliance with the
    National Incident Management System is not yet known. In addition,
    although DHS has taken actions, such as issuing compliance guidelines,
    providing training, developing sample exercises, and collecting data on
    implementation of the National Incident Management System, DHS did not
    provide us with documentation demonstrating how these actions have
    contributed to DHS's effective coordination of implementation of the
    system. For example, DHS did not provide us with documentation on how
    these training and exercise programs have contributed to ensuring
    effective coordination of National Incident Management System
    implementation;
    Assessment: Generally not achieved.

    Performance expectation: 7. Establish a single, all-hazards national
    response plan;
    Summary of findings: GAO findings: DHS has established a single all-
    hazards national response plan, but the plan is undergoing revision. In
    December 2004, DHS issued the National Response Plan, which was
    intended to be an all-discipline, all-hazards plan establishing a
    single, comprehensive framework for the management of domestic
    incidents where federal involvement is necessary. The National Response
    Plan is applicable to incidents that go beyond the state and local
    levels and require a coordinated federal response, and the plan,
    operating within the framework of the National Incident Management
    System, provides the structure and mechanisms for national-level policy
    and operational direction for domestic incident management. The plan
    also includes a Catastrophic Incident Annex, which describes an
    accelerated, proactive national response to catastrophic incidents. DHS
    revised the National Response Plan following Hurricane Katrina, but we
    reported that these revisions did not fully address, or they raised
    new, challenges faced in implementing the plan. For more information,
    see GAO-06-618; DHS updated information: In March 2007, DHS provided
    us with updated information on efforts to establish an all-hazards
    national response plan. DHS reported that the National Response Plan is
    currently undergoing review and revision by federal, state, and local
    government officials; tribal authorities; and nongovernmental and
    private sector officials. According to DHS, this review includes all
    major components of the National Response Plan, including the base
    plan, Emergency Support Functions, annexes, and the role of the
    Principal Federal Official, Federal Coordinating Officer, and Joint
    Field Office Structure. A Catastrophic Planning Work Group is examining
    the Catastrophic Incident Annex and Supplement. DHS noted that this
    review is being conducted in four phases, with the first phase focused
    on prioritization of key issues, the second phase focused on the
    rewriting process, the third phase focused on releasing the revised
    documents, and the fourth phase focused on providing a continuous cycle
    of training, exercises, and periodic reviews. DHS reported that, as of
    March 2007, it was in the rewriting phase and has gathered input on key
    issues from internal and external stakeholders, after-action reports,
    Hurricane Katrina reports, and other resources. According to DHS, the
    revised document is renamed the National Response Framework and was
    released to internal stakeholders for review at the end of July 2007.
    Based on the review, edits and updates will be made to the document
    prior to its anticipated release on August 20, 2007 for a 30 day public
    comment period. DHS reported that the current version of the National
    Response Plan document remains in effect during the 2007 hurricane
    season; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS issued the National Response
    Plan and a limited post-Katrina revision in May 2006, but we and others
    have identified concerns with those revisions. DHS also recognized the
    need for a more in-depth, substantive review and revision of the plan
    and expects to issue the latest revision in August 2007. DHS has
    acknowledged that some complex issues have taken more time than
    expected to assess and resolve. The changes made to the plan may affect
    roles and responsibilities under the plan and federal, state, and local
    agencies' training, exercises, and implementation plans. Until the
    National Response Plan and its annexes and Catastrophic Supplement are
    completed and distributed to all those with roles and responsibilities
    under the plan, federal agencies and others that have new or amended
    responsibilities under the revised plan cannot complete their
    implementation plans and the agreements needed to make the National
    Response Plan, its annexes, and supplements fully operational;
    Assessment: Generally not achieved.

    Performance expectation: 8. Coordinate implementation of a single, all-
    hazards response plan;
    Summary of findings: GAO and DHS IG findings: Much more work remains
    for DHS to effectively coordinate implementation of the National
    Response Plan. Drawing on our prior work identifying key practices for
    helping to enhance and sustain collaboration among federal agencies,
    key practices for collaboration and coordination include, among other
    things, defining and articulating a common outcome; establishing
    mutually reinforcing or joint strategies to achieve the outcome;
    identifying and addressing needs by leveraging resources; agreeing upon
    agency roles and responsibilities; establishing compatible policies,
    procedures, and other means to operate across agency boundaries;
    developing mechanisms to monitor, evaluate, and report the results of
    collaborative efforts; and reinforcing agency accountability for
    collaborative efforts through agency plans and reports. In March 2006,
    the DHS IG reported on FEMA's disaster management activities in the
    wake of Hurricane Katrina. The DHS IG reported that during the
    response, several significant departures from National Response Plan
    protocols occurred: (1) DHS's actions to apply National Response Plan
    protocols for Incidents of National Significance and catastrophic
    incidents were ambiguous; (2) DHS defined a new, operational role for
    the Principal Federal Officer by assigning the officer both Federal
    Coordinating Officer and Disaster Recovery Manager authorities; and (3)
    the Interagency Incident Management Group took an operational role not
    prescribed in the National Response Plan. As a backdrop to these
    changes, the DHS IG reported that FEMA had not yet developed or
    implemented policies and training for roles and responsibilities
    necessary to supplement the National Response Plan. In reviewing DHS's
    response to Hurricanes Katrina and Rita, we also identified numerous
    weaknesses in efforts to implement the plan. For example, in the
    response to Hurricane Katrina, we reported in September 2006 that there
    was confusion regarding roles and responsibilities under the plan. DHS
    revised the National Response Plan following Hurricane Katrina, but we
    reported that these revisions did not fully address, or they raised
    new, challenges faced in implementing the plan. For more information,
    see GAO-06-618. Also, see Department of Homeland Security Office of
    Inspector General, A Performance Review of FEMA's Disaster Management
    Activities in Response to Hurricane Katrina, OIG-06-32 (Washington,
    D.C.: March 2006); DHS updated information: In March 2007, DHS provided
    us with updated information on efforts to coordinate implementation of
    the National Response Plan. DHS reported that it developed and released
    training programs to support the National Response Plan and that this
    training has been required as a condition of certification of National
    Incident Management System compliance by state and local governments.
    DHS also reported that it is revising the National Response Framework
    and intends to release the revised plan in August 2007; Our assessment:
    We conclude that DHS has generally not achieved this performance
    expectation. DHS did not provide us with documentation on how its
    training programs have contributed overall to the department's efforts
    to coordinate implementation of the National Response Plan and could
    not demonstrate to us that the department has made progress in
    improving its ability to coordinate plan implementation since Hurricane
    Katrina. As we previously stated, the revised National Response Plan
    may require changes in federal, state, and local agencies' training,
    exercises, and implementation plans. It is also unclear how the revised
    plan will be implemented by states and first responders during the
    coming hurricane season, given that these entities will not have had an
    opportunity to train and practice under the revised version of the
    plan. We are concerned that if the revisions are not completed prior to
    the beginning of the 2007 hurricane season, it is unlikely that the
    changes resulting from these revisions could be effectively implemented
    for the 2007 hurricane season;
    Assessment: Generally not achieved.

    Performance expectation: 9. Develop a complete inventory of federal
    response capabilities;
    Summary of findings: GAO findings: DHS has undertaken efforts related
    to development of an inventory of federal response capabilities, but
    did not provide us with evidence on the extent to which its efforts
    have resulted in the development of a complete inventory. In July 2005
    we reported that DHS began the first stage of the capabilities-based
    planning process identifying concerns using 15 National Planning
    Scenarios that were developed by the Homeland Security Council. As it
    moved to the step in the process of developing a sense of preparedness
    needs and potential capabilities, DHS created a list of tasks that
    would be required to manage each of the 15 National Planning Scenarios.
    Then, in consultation with federal, state, and local emergency response
    stakeholders, it consolidated the list to eliminate redundancies and
    create a Universal Task List of over 1,600 discrete tasks. Next, DHS
    identified target capabilities that encompassed these critical tasks.
    From this universe of potential tasks, DHS worked with stakeholders to
    identify a subset of about 300 critical tasks that must be performed
    during a large-scale event to reduce loss of life or serious injuries,
    mitigate significant property damage, or are essential to the success
    of a homeland security mission. The final step of the first stage of
    DHS's planning process was to decide on goals, requirements, and
    metrics. To complete this step, DHS, working with its stakeholders,
    developed a Target Capabilities List that identified 36 capabilities
    needed to perform the critical tasks for the events illustrated by the
    15 scenarios. In December 2005, DHS issued an updated version of the
    Target Capabilities List. For more information, see GAO-05-652; DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to develop a complete inventory of
    federal response capabilities. For example, the Catastrophic Incident
    Supplement of the National Response Plan has been approved and includes
    identified specific capabilities from federal agencies that will be
    deployed according to a specified time frame in the event of a
    catastrophic incident (the Supplement may be revised based on the
    ongoing review of the National Response Plan and its annexes and
    supplements). DHS also reported that the National Incident Management
    System Incident Response Information System is currently undergoing
    development and testing. When testing is complete, the system will be
    provided to all federal agencies involved in the National Response Plan
    for collection of their inventory of National Incident Management
    System-typed resources. DHS reported that it is preparing to issue
    information to federal agencies that are signatories to the National
    Response Plan for agencies' use in creating an inventory of their
    resources. According to DHS, the database of these resources and
    capabilities is expected to be operational by the end of 2007. At this
    point, however, FEMA officials told us that the department does not
    have one comprehensive inventory of response capabilities. In addition,
    DHS reported that the Common Operating Picture Function in the Homeland
    Security Information Network serves as a communication tool that allows
    the DHS National Operations Center to gain real-time situational
    awareness of disaster response. During disaster response operations,
    automated reporting templates are populated by appropriate federal
    departments and agencies as specified under the National Response Plan;
    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken a variety of steps to develop a
    complete inventory of federal response capabilities, including
    finalizing the National Response Plan Catastrophic Incident Supplement.
    DHS is also taking steps to develop the National Incident Management
    System Incident Response Information System, but has not yet released
    the system. While DHS provided us with information on its various tools
    for identifying and specifying federal capabilities that will be
    deployed in the event of an incident, DHS reported that it does not yet
    have a complete inventory of all federal capabilities; Assessment:
    Generally not achieved.

    Performance expectation: 10. Develop a national, all-hazards
    preparedness goal;
    Summary of findings: GAO findings: DHS has developed an interim,
    national, all-hazards preparedness goal, but has not yet issued a final
    version of the goal. The December 2005 version of the National
    Preparedness Goal defines both the 37 major capabilities that first
    responders should possess to prevent, protect from, respond to, and
    recover from a wide range of incidents and the most critical tasks
    associated with these capabilities. We reported that an inability to
    effectively perform these critical tasks would, by definition, have a
    detrimental impact on effective protection, prevention, response, and
    recovery capabilities. For more information, see GAO-06-618 and GAO-05-
    652; DHS updated information: In March 2007, DHS reported to us that
    public release of the final National Preparedness Goal was imminent,
    but did not provide us with a target time frame for issuing the final
    version of the goal. DHS officials noted that the department has worked
    with various federal, state, and local entities to develop, review, and
    get approval of the final National Preparedness Goal; Our assessment:
    Until the final version of the National Preparedness Goal is issued, we
    conclude that DHS has generally not achieved this performance
    expectation. Although DHS has developed and issued an interim National
    Preparedness Goal, it has not yet issued a final version of the goal
    and did not provide a target time frame for doing so. Issuing a final
    version of the goal is important for finalizing the major capabilities
    required of first responders in preparing for and responding to various
    incidents;
    Assessment: Generally not achieved.

    Performance expectation: 11. Support citizen participation in national
    preparedness efforts;
    Summary of findings: GAO findings and assessment: We have not completed
    work on DHS's efforts to support citizen participation in national
    preparedness efforts, and DHS did not provide us with information on
    its actions to meet this performance expectation. As a result, we
    cannot make an assessment of DHS's progress for this performance
    expectation;
    Assessment: No assessment made.

    Performance expectation: 12. Develop plans and capabilities to
    strengthen nationwide recovery efforts;
    Summary of findings: GAO and DHS IG findings: DHS has faced challenges
    in developing plans and capabilities needed to strengthen nationwide
    recovery efforts.[A] In February 2006 we reported that beginning and
    sustaining community and economic recovery, including restoring a
    viable tax base for essential services, calls for immediate steps so
    residents can restore their homes and businesses. Removing debris and
    restoring essential gas, electric, oil, communications, water, sewer,
    transportation and transportation infrastructure, other utilities, and
    services such as public health and medical support are vital to
    recovery and rebuilding. However, these recovery efforts in the
    aftermath of Hurricane Katrina were hindered by various factors,
    including the magnitude and scope of the hurricane. For more
    information, see GAO-06-365R; DHS updated information: In March and May
    2007, DHS provided us with updated information on its efforts to
    develop plans and capabilities to strengthen nationwide recovery
    efforts. DHS and the American Red Cross developed the National
    Sheltering System to provide a Web-based data system to support shelter
    management and reporting and identification activities. DHS also issued
    a recovery strategy for mass sheltering and housing assistance in June
    2006 to address contingencies for providing sheltering and housing
    assistance for declared emergencies and major disasters. FEMA also
    developed a Web-based Housing Portal to consolidate available rental
    resources for evacuees from federal agencies, private organization, and
    individuals. In addition, DHS reported making enhancements to its
    debris removal processes by, for example, adjusting its debris removal
    policy to ensure cost sharing for federal contracting, establishing a
    list of debris removal contractors, and developing guidance for local
    government debris removal contractors. DHS reported that an interagency
    work group, initiated in 2005, is working to develop federal
    contaminated debris policy and operational procedure guidance. In
    addition, FEMA officials noted that the agency is using a cost
    estimating format to capture all costs for construction projects by
    taking into account allowances for uncertainties in the construction
    process; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS did not provide us with
    documentation on how its various initiatives have contributed overall
    to develop the department's capabilities to strengthen nationwide
    recovery efforts. DHS has taken steps to develop plans, policies, and
    guidance for recovery efforts. However, DHS did not provide us with
    evidence of its capabilities for recovery efforts;
    Assessment: Generally not achieved.

    Performance expectation: 13. Develop the capacity to provide needed
    emergency assistance and services in a timely manner;
    Summary of findings: GAO and DHS IG findings: DHS has faced
    difficulties in developing the capacity to provide emergency services
    and assistance in a timely manner and has not provided us with
    documentation to demonstrate that it has effectively met this
    performance expectation. The various reports and our own work on FEMA's
    performance before, during, and after Hurricane Katrina suggested that
    FEMA's human, financial, and technological resources and capabilities
    were insufficient to meet the challenges posed by the unprecedented
    degree of damage and the resulting number of hurricane victims. Our
    work pointed out that the National Response Plan did not specify the
    proactive means or capabilities the federal government should use to
    conduct damage assessments and gain situational awareness when the
    responsible state and local officials were overwhelmed. As a result,
    response efforts were hampered by the federal government's failure to
    fully use its available assets to conduct timely, comprehensive damage
    assessments in Louisiana and Mississippi. With regard to logistics, our
    work and that of others indicated that logistics systems--the
    capability to identify, dispatch, mobilize, and demobilize and to
    accurately track and record available critical resources throughout all
    incident management phases--were often totally overwhelmed by Hurricane
    Katrina. Critical resources were not available, properly distributed,
    or provided in a timely manner. The result was duplication of
    deliveries, lost supplies, or supplies never being ordered. Reviews of
    acquisition efforts indicated that while these efforts were noteworthy
    given the scope of Hurricane Katrina, agencies needed additional
    capabilities to (1) adequately anticipate requirements for needed goods
    and services (2) clearly communicate responsibilities across agencies
    and jurisdictions and (3) deploy sufficient numbers of personnel to
    provide contractor oversight. For more information, see Hurricanes
    Katrina and Rita: Unprecedented Challenges Exposed the Individuals and
    Households Program to Fraud and Abuse; Actions Needed to Reduce Such
    Problems in the Future, GAO-06-1013, and GAO-06-618. Also, see
    Department of Homeland Security Office of Inspector General, A
    Performance Review of FEMA's Disaster Management Activities in Response
    to Hurricane Katrina, OIG-06-32 (Washington, D.C.: March 2006); DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to develop the capacity to provide
    needed emergency assistance and services in a timely manner. For
    example, DHS reported that FEMA and the American Red Cross have
    developed and improved methods to better identify and more quickly
    assist individuals evacuated to a shelter, including developing and
    implementing methods to identify and reunify missing and separated
    family members during a disaster. DHS reported that it has developed
    interim guidance regarding sending FEMA registration intake staff to
    Red Cross management shelters following a disaster and plan to refine a
    formal standard operating procedure for this activity. DHS also
    reported that it is pursuing contract and contingency surge
    capabilities that will allow for the rapid expansion of FEMA's
    registration intake capacity of up to 200,000 people per day. (FEMA
    surpassed 100,000 registrations per day following Hurricanes Katrina
    and Rita.) FEMA has also reported tripling its daily home inspection
    capacity through contracted firms from 7,000 to 20,000 per day.
    Furthermore, FEMA reported that it is working with federal, state, and
    local partners to provide mass evacuee support planning to assist state
    and local governments in planning and preparing for hosting of large
    displaced populations. As part of these efforts, FEMA reported that it
    is working to develop an evacuee registration and tracking capability,
    implementation plans for federal evacuation support to states, and
    emergency sheltering guidance and planning assistance for potential
    host states and communities. FEMA reported that it plans to have a Mass
    Evacuation Management Unit operational by January 2008 and the National
    Mass Evacuation Registration and Tracking System operational once
    requirements are fully developed. In addition, DHS reported making
    enhancements to its logistics capabilities. For example, DHS has
    developed an Internet-based system that provides FEMA with the ability
    to manage its inventory and track the location of trailers carrying
    commodities. DHS officials also reported that the department is
    undertaking an optimization planning initiative to, among other things,
    identify best locations for logistics centers, but this planning effort
    is still in its early stages. DHS also reported that its Pre-Positioned
    Disaster Supply and Pre-Positioned Equipment Program provides equipment
    and supplies to emergency responders. DHS reported that its Mobile
    Emergency Response Support Detachments are equipped with communications
    capabilities to provide communication, logistics, operations, and power
    support for emergency responders and disaster victims; Our assessment:
    We conclude that DHS generally has not achieved this performance
    expectation. Although DHS has taken actions to strengthen its capacity
    to provide emergency services and assistance, more work remains for DHS
    to achieve this performance expectation. For example, although DHS has
    reported making improvements to its logistics capabilities, its
    optimization planning efforts are still in the preliminary stages.
    Moreover, DHS did not provide us with documentation on how it
    determined requirements for the prepositioning of disaster supplies and
    equipment to assess whether FEMA has achieved its intended capacity.
    Furthermore, although DHS reported that it is working to develop
    various emergency assistance capabilities, such as evacuee
    registration, DHS generally did not provide us with documentation
    showing that these capabilities are currently in place and can provide
    needed services in a timely and accurate manner following an incident.
    In addition, none of DHS initiatives appear to have been tested on a
    scale that reasonably simulates the conditions and demand they would
    face following a major or catastrophic disaster. Thus, it is difficult
    to assess the probable results of these initiatives in improving
    response to a major or catastrophic disaster, such as a category 4 or 5
    hurricane;
    Assessment: Generally not achieved.

    Performance expectation: 14. Provide timely assistance and services to
    individuals and communities in response to emergency events;
    Summary of findings: GAO and DHS IG findings: DHS has faced
    difficulties in providing assistance and services to individuals and
    communities in a timely manner, particularly in response to Hurricanes
    Katrina and Rita. For example, each of the assessments of the federal
    government's response to Hurricanes Katrina and Rita we reviewed
    identified problems in FEMA's implementation of the Individuals and
    Households Program during and after the storms. Our review and our
    assessment of these reports showed that the agency's efforts to
    implement the program were hindered by a lack of planning, trained
    staff, and program limitations, despite its new and revised approaches
    for implementing the program. More broadly, we reported that although
    controls and accountability mechanisms help to ensure that resources
    are used appropriately, during a catastrophic disaster decision makers
    struggle with the tension between implementing controls and
    accountability mechanisms and the demand for rapid response and
    recovery assistance. On one hand, our work found many examples where
    quick action could not occur due to procedures that required extensive,
    time-consuming processes, delaying the delivery of vital supplies and
    other assistance. On the other hand, we also found examples where
    FEMA's processes under assistance programs to disaster victims left the
    federal government vulnerable to fraud and the abuse of expedited
    assistance payments. We estimate that through February 2006, FEMA made
    about $600 million to $1.4 billion in improper and potentially
    fraudulent payments to applicants who used invalid information to apply
    for expedited cash assistance. DHS and FEMA have reported a number of
    actions that are to be in effect for the hurricane season so that
    federal recovery programs would have more capacity to rapidly handle a
    catastrophic incident but also provide accountability. Examples include
    significantly increasing the quantity of prepositioned supplies, such
    as food, ice, and water; placing global positioning systems on supply
    trucks to track their location and better manage the delivery of
    supplies; an enhanced phone system for victim assistance applications
    that can handle up to 200,000 calls per day; and improved computer
    systems and processes for verifying the eligibility of those applying
    for assistance. We reported that effective implementation of these and
    other planned improvements would be critical to achieving their
    intended outcomes. In March 2006, the DHS IG reported that while FEMA
    made major efforts to coordinate with other agencies and improve its
    ability to provide housing resources in its response to Hurricane
    Katrina, some of its efforts were more effective than others. For
    example, the DHS IG reported that FEMA and the Red Cross experienced
    difficulty in identifying the number and location of evacuees because
    both held different expectations for coordinating the mass care
    function. FEMA was slow in identifying and establishing its direct
    housing mission, so alternative housing resources, such as cruise
    ships, were initially used. Also, it was hard for FEMA to staff its
    Disaster Recovery Centers with experienced personnel, according to the
    DHS IG. In addition, the DHS IG reported that during the response to
    Hurricane Katrina, FEMA provided record levels of support to victims
    and emergency responders. Life-saving and life-sustaining commodities
    and equipment were delivered to the affected areas; personnel increased
    significantly in a short period of time to support response efforts and
    provide assistance to victims; and assistance was provided quickly in
    record amounts, sometime through innovative means. However, a lack of
    asset visibility in the resource-ordering process, inexperienced and
    untrained personnel, unreliable communications, and insufficient
    internal management controls demonstrated a continued need for
    improvement in how FEMA responds and delivers assistance, according to
    the DHS IG. For more information, see GAO-06-618, GAO-06-1013, and GAO-
    06-652. Also, see Department of Homeland Security Office of Inspector
    General, A Performance Review of FEMA's Disaster Management Activities
    in Response to Hurricane Katrina, OIG-06-32 (Washington, D.C.: March
    2006); DHS updated information: In March and April 2007, DHS provided
    us with updated information on its efforts to provide timely assistance
    and services to individuals and communities in response to emergency
    events. For example, FEMA reported that it has developed new policies
    to ensure that all types of temporary housing options are able to be
    provided for displaced applicants with physical disabilities. FEMA also
    reported that it has developed updated policies to improve and expedite
    determination of applicant eligibility for the Individuals and
    Households Program and Expedited Assistance and has clarified policy on
    the appropriate authorization and use of emergency sheltering funds and
    individual housing assistance funds for disaster victims. DHS also
    reported taking steps to implement stronger controls in its
    registration and application processes for disaster assistance
    programs. For example, DHS reported deploying a new Internet
    registration application that does not allow duplicate registrations,
    adding identity proofing controls to the call center registration
    application for the Individuals and Households Program, and flagging
    applications in FEMA's database that fail identity proofing, are not
    residential addresses, or include at-risk Social Security numbers. In
    addition, DHS reported that it has five Mobile Registration Intake
    Centers that can be deployed to provide an on-site mechanism for
    disaster victims to register for FEMA assistance. According to DHS,
    these mobile centers have been tested several times, including in June
    2006, in August 2006 during Tropical Storm Ernesto, and in April 2007.
    DHS reported that issues were identified during the earlier tests that
    indicated that improvements were needed, but noted that these issues
    have been resolved; Our assessment: We conclude that DHS has generally
    not achieved this performance expectation. Although DHS reported taking
    actions to provide timely assistance to individuals and communities,
    with appropriate safeguards against fraud and abuse, DHS did not
    provide us with documentation to demonstrate that these steps have
    improved the department's provision of assistance and services. For
    example, DHS did not provide us with documentation on the results of
    its provision of assistance and services to individuals affected by
    emergency incidents and disasters since 2006. Furthermore, DHS did not
    provide with results of tests or exercises of its emergency assistance
    and service capabilities. For example, although DHS stated that it has
    resolved issues identified during tests of its Mobile Registration
    Intake Centers, DHS did not provide us with information on these issues
    or evidence that the issues have actually been resolved;
    Assessment: Generally not achieved.

    Performance expectation: 15. Implement a program to improve
    interoperable communications among federal, state, and local agencies;
    Summary of findings: GAO findings: DHS has faced challenges in
    implementing a program to improve interoperable communications among
    federal, state, and local agencies. While DHS has implemented a
    program, referred to as SAFECOM, to improve interoperable
    communications, our past work showed that problems defining the scope,
    establishing performance goals and standards, and defining the roles of
    federal, state, local government and other entities were the three
    principal challenges to achieving effective interoperable
    communications for first responders. In April 2007 we reported that
    while SAFECOM is intended to improve interoperable communications at
    all levels of government, the objectives that the program has been
    working toward do not include improving interoperability between
    federal agencies and state and local agencies. For example, when
    conducting their baseline national survey of first responders to
    determine the current level of interoperability, program officials
    included state and local officials, but not federal officials. The
    survey included an extensive list of questions in which respondents
    were asked to rate interoperability (1) with other disciplines, (2)
    with other jurisdictions, and (3) between state and local governments.
    Respondents were also asked at the end of the survey to list federal
    agencies they interoperate with; however, no effort was made to gauge
    the level of interoperability with the federal government, as had been
    done for other disciplines and jurisdictions and between state and
    local governments. In lieu of having communications systems that enable
    direct interoperability between federal first responders and state and
    local first responders, first responders have resorted to alternative
    means of communicating. For example, state or local agencies may loan
    radios to federal first responders or physically pair a federal first
    responder with a state or local responder so they can share information
    and relay it back to their agencies. While approaches such as these may
    be effective in certain situations, they can reflect a general lack of
    planning for communications interoperability. We reported that using
    "work-arounds" such as these could reduce the efficiency and
    effectiveness of the overall public safety response to an incident.
    SAFECOM officials stated that the program's focus has been on state and
    local agencies because they consider them to be a higher priority.
    Further, while they stated that it would be possible for federal
    agencies to make use of some of the planning tools being developed
    primarily for state and local agencies, SAFECOM has not developed any
    tools that directly address interoperability with federal agencies.
    However, interoperability with federal first responders remains an
    important element in achieving nationwide interoperability. We reported
    that until a federal coordinating entity such as SAFECOM makes a
    concerted effort to promote federal interoperability with other
    governmental entities, overall progress in improving communications
    interoperability will remain limited. For more information, see Project
    SAFECOM: Key Cross-Agency Emergency Communications Effort Requires
    Stronger Collaboration, GAO-04-494 and First Responders: Much Work
    Remains to Improve Communications Interoperability, GAO-07-301; DHS
    updated information: In March and June 2007, DHS provided us with
    information on its efforts to implement a program for improving
    interoperable communications. For example, DHS established the Office
    for Interoperability and Compatibility, of which SAFECOM is a part, to
    strengthen and integrate interoperability and compatibility efforts.
    DHS also reported that SAFECOM is developing tools, templates, and
    guidance documents for interoperability, including field-tested
    statewide planning methodologies, online collaboration tools,
    communications requirements, and an online library of lessons learned
    and best practices. The department established the Office of Emergency
    Communications to administer the responsibilities and authorities of
    SAFECOM, the Interoperable Communications Technical Assistance
    Program, and the Integrated Wireless Network, which are three programs
    focused on improving interoperable communications. According to DHS,
    the mission of the Office of Emergency Communications is to support and
    promote the ability of emergency response providers and government
    officials at the local, tribal, state, and federal levels to continue
    to communicate in the event of disasters or acts of terrorism, and to
    ensure, accelerate, and attain emergency interoperable communications
    nationwide. Moreover, DHS noted that its focus on state and local
    interoperable communications is proportional to the nature of the
    interoperability problem, as there are over 50,000 emergency response
    agencies at the state and local level and 90 percent of communications
    infrastructure is owned and operated at the state level. With regard to
    federal agencies, DHS noted that SAFECOM has and will continue to
    partner with federal agencies, such as the Departments of Justice and
    Defense, and that DHS participates in the Federal Partnership for
    Interoperable Communications, which is charged with addressing federal
    wireless communications interoperability. In addition, DHS noted that
    is it in the process of conducting a baseline assessment evaluating
    interoperable capabilities for all departments and agencies; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. While DHS has made progress in implementing a
    program to improve interoperable communications, these implementation
    efforts have focused primarily on improving interoperability among
    state and local entities, and DHS is in the process of evaluating
    federal agencies' interoperable communications' capabilities through
    the recently established Office of Emergency Communications. DHS did
    not provide us with documentation on the extent to which it has taken
    actions to improve interoperability with federal agencies, which we
    reported is a key part of communications interoperability. Moreover,
    while, SAFECOM officials stated that the program's focus has been on
    state and local agencies because there are more state and local first
    responder agencies and most of the communications infrastructure is
    owned by state and local agencies, interoperability with federal first
    responders remains an important element in achieving nationwide
    interoperability and is part of SAFECOM's tasking under the
    Intelligence Reform and Terrorism Prevention Act of 2004. As we
    previously reported, until a more concerted effort is made to promote
    federal interoperability with other governmental entities, overall
    progress in improving communications interoperability would remain
    limited;
    Assessment: Generally not achieved.

    Performance expectation: 16. Implement procedures and capabilities for
    effective interoperable communications;
    Summary of findings: GAO findings: DHS has faced difficulties in
    implementing procedures for effective interoperable communications. In
    April 2007, we reported that SAFECOM--a DHS program intended to
    strengthen interoperable public safety communications at all levels of
    government--has provided planning tools to state and local governments
    intended to help states and local agencies improve their procedures and
    capabilities to enable effective interoperable communications. However,
    based on our review of four states and selected localities, SAFECOM's
    progress in achieving its goals of helping these states and localities
    improve interoperable communications has been limited. We often found
    that the states and local jurisdictions either did not find the tools
    useful or were unaware that the tools existed. These state and local
    officials did not find the tools and guidance useful for various
    reasons, including that (1) the tools and guidance are too abstract and
    do not provide practical implementation guidance on specific issues;
    (2) the documents are lengthy and hard to use as reference tools; and
    (3) awareness of SAFECOM and its tools has not reached all state and
    local agencies. To its credit, SAFECOM's Interoperability Continuum--
    which is intended to provide a framework that emergency response
    agencies can use to baseline their planning and implementation of
    interoperability solutions--was the most widely used and recognized of
    its tools. Seven of the 15 states and localities we visited indicated
    that they used the continuum to assess their interoperability status
    and plan improvements. Another initiative that had a significant impact
    was the Regional Communications Interoperability Pilot. Officials from
    Kentucky--one of the two states that participated in the pilot--
    indicated that the pilot was very helpful in facilitating
    communications planning by identifying relevant stakeholders and
    bringing those stakeholders together for extended discussions about
    interoperability. In April 2007 we reported that one factor
    contributing to the limited impact that SAFECOM has had on implementing
    procedures and capabilities to enable effective interoperable
    communications, is that its activities have not been guided by a
    program plan. A program plan is a critical tool to ensure a program
    meets its goals and responsibilities. Such a tool is used to align
    planned activities with program goals and objectives, as well as define
    how progress in meeting the goals will be measured, compared, and
    validated. Rather than using a program plan to guide their activities,
    SAFECOM officials stated that they develop tools and guidance based on
    a list of suggestions obtained from first responders. The SAFECOM
    Executive Committee--a steering group composed of public safety
    officials from across the country--prioritized the list of suggestions,
    but this prioritization has not been used to develop a plan. Instead,
    program officials have made ad hoc decisions regarding which
    suggestions to implement based on executive committee input, as well as
    the difficulty of implementation. We reported that while this approach
    incorporates a degree of prioritization from first responders, it does
    not provide the structure and traceability of a program plan. For more
    information, see Homeland Security: Federal Leadership and
    Intergovernmental Cooperation Required to Achieve First Responder
    Interoperable Communications, GAO-04-740 and GAO-07-301; DHS updated
    information: In March and June 2007, DHS provided us with information
    on its efforts to implement policies and procedures for effective
    interoperable communications. DHS reported that it developed the
    Statement of Requirements to define operational and functional
    requirements for emergency response communications and the Public
    Safety Architecture Framework to help emergency response agencies map
    interoperable communications system requirements and identify system
    gaps. DHS also reported that it developed the Statewide Communications
    Interoperability Planning Methodology to assist states in initiating
    statewide interoperability planning efforts and that it is helping
    states develop their interoperability plans by the end of 2007. DHS
    reported that SAFECOM's guidance and tools are driven by and
    incorporate the input of emergency responders and that its
    Interoperability Continuum is, for example, widely used as the model
    framework for defining and addressing the problem of interoperability.
    In addition, DHS reported that it is conducting a national baseline
    assessment to, among other things, define the range of interoperable
    and emergency capabilities needed; assess the current available
    capabilities to meet needs; identify the gap between current
    capabilities and defined requirements; and include a national
    interoperable emergency communications inventory to identify
    requirements for federal agencies. DHS noted that the Office of
    Emergency Communications will develop a National Emergency
    Communications Plan in fiscal year 2008 and is in the process of
    developing a strategic plan for fiscal years 2008 through 2013; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. As we previously reported, officials from
    selected states and localities often found that the key tools DHS
    issued such as the Statement of Requirement and the Public Safety
    Architecture Framework which are intended to provide capabilities and
    procedures to state and local agencies to help enable effective
    interoperable communications were not helpful, or officials were
    unaware of what assistance the program had to offer. We also found that
    DHS does not have performance measures in place to determine how
    effective these tools are and to make improvements based on feedback;
    Assessment: Generally not achieved.

    Performance expectation: 17. Increase the development and adoption of
    interoperability communications standards;
    Summary of findings: GAO findings: More work remains for DHS to
    increase the development and adoption of interoperability
    communications standards. In April 2007 we reported that until
    recently, little progress had been made in developing Project 25
    standards--a suite of national standards that are intended to enable
    interoperability among the communications products of different
    vendors. We reported that although one of the eight major subsets of
    standards was defined in the project's first 4 years (from 1989 to
    1993), from 1993 through 2005, no additional standards were completed
    that could be used by a vendor to develop elements of a Project 25
    compliant system. Over the past 2 years, progress has been made in
    developing specifications for three additional subsets of standards.
    However, we reported that ambiguities in the published standards have
    led to incompatibilities among products made by different vendors, and
    no formal compliance testing has been conducted to ensure vendors'
    products are interoperable. More recently, informal peer testing among
    vendors has occurred. To address the lack of well-defined standards,
    users and manufacturers have been revising the standards. To address
    the issue of a lack of formal compliance testing, SAFECOM, the National
    Institute of Standards and Technology, and the Project 25 steering
    committee, began developing a peer compliance assessment program for
    Project 25 products in April 2005. We reported that this compliance
    assessment program is to use various vendors' approved laboratories to
    test Project 25 systems through a set of agreed-upon tests that will
    validate that the systems from various vendors can successfully
    interoperate and meet conformance and performance requirements.
    According to the National Institute of Standards and Technology, the
    vendors will be expected to conduct the tests in compliance with a
    handbook on general testing procedures and requirements, which the
    National Institute of Standards and Technology is preparing to publish.
    For more information, see GAO-07-301. Also, see Department of Homeland
    Security Office of Inspector General, Review of DHS' Progress in
    Adopting and Enforcing Equipment Standards for First Responders, OIG-06-
    30 (Washington, D.C.: March 2006); DHS updated information: In March
    2007, DHS reported that it has helped to develop initial standards for
    six of the eight major system interfaces associated with Project 25, a
    suite of standards for interoperability. In June 2007, DHS reported
    that its Office of Emergency Communications is to establish
    requirements for interoperable communications capabilities in
    coordination with the Office for Interoperability and Compatibility.
    DHS reported that it has worked to promote the acceleration,
    completion, and deployment of interoperable communications standards,
    but noted that DHS does not have the authority to set standards.
    Specifically, DHS reported that it has worked with the National
    Institute of Standards and Technology to establish a vision and key
    priorities for standards and that the Project 25 standards should be
    completed within 18 to 24 months; Our assessment: We conclude that DHS
    has generally not achieved this performance expectation. In our prior
    work, we reported that there were ambiguities in published standards,
    which led to incompatibilities among products made by different
    vendors. DHS has taken some steps to address these challenges, but the
    effectiveness of these efforts is unclear. Moreover, DHS reported that
    it has worked with its partners to develop the Project 25 standards
    but, according to DHS, completion of these standards is many months
    away;
    Assessment: Generally not achieved.

    Performance expectation: 18. Develop performance goals and measures to
    assess progress in developing interoperability;
    Summary of findings: GAO findings: DHS has not yet developed a
    sufficient set of performance goals and measures to effectively assess
    progress in developing interoperability. For instance, in April 2007 we
    reported that since 2001, the management and goals of the SAFECOM
    program have changed several times. In 2003, the SAFECOM program was
    transferred to the Office of Interoperability and Compatibility within
    the Directorate of Science and Technology in DHS and is now within the
    Office of Emergency Communications.[B] Its goals included increasing
    interoperable communications capacity of local, tribal, and state
    public safety agencies, and increasing the number of states that have
    initiated or completed statewide plans. However, these goals do not
    include improving interoperability between federal agencies and state
    and local agencies which is part of SAFECOM's tasking in accordance
    with the Intelligence Reform and Terrorism Prevention Act of 2004. With
    regard to establishing performance measures, we reported that SAFECOM
    program officials have established six performance measures to assess
    progress, including the percentage of fire, emergency medical services,
    and law enforcement organizations that have established informal
    interoperability agreements with other public safety organizations; the
    percentage of public safety agencies that report using interoperability
    to some degree in their operations; the percentage of states that have
    completed statewide interoperability plans; the percentage of grant
    programs for public safety communications that include SAFECOM
    guidance; and the amount of reduction in the cycle time for national
    interoperability standards development. However, we noted that several
    key aspects of the program are not being measured. For example, one of
    the program's goals is to increase the development and adoption of
    standards. However, the only associated performance measure is
    reduction in the cycle time for national interoperability standards
    development--not the extent to which adoption of standards has
    increased or whether interoperability is being facilitated. Also, in
    assessing the growth of interoperable communications capacity at local,
    tribal, and state public safety agencies, SAFECOM's measures--the
    percentage of states that have established informal interoperability
    agreements with other public safety organizations and the percentage of
    public safety agencies that report using interoperability to some
    degree in their operations --addresses only two of the five areas that
    SAFECOM has defined as key to improving interoperability (it does not
    assess improvements made in governance, technology, or training).
    Moreover, none of the program's measures assess the extent to which the
    first responder community finds the tools and assistance helpful or the
    effectiveness of program outreach initiatives. Consequently, we
    reported that measures of the effectiveness of the program and areas
    for improvement are not being collected and are not driving
    improvements in the program, contributing to its limited impact.
    According to SAFECOM officials, by mid-2007, they plan to establish a
    measure to assess customer satisfaction. We reported that until DHS
    develops and implements a program plan that includes goals focusing on
    improving interoperability among all levels of government, establishes
    performances measures that determine if key aspects of the SAFECOM
    program are being achieved, and assesses the extent to which the first
    responder community finds the tools and assistance helpful, the impact
    of its efforts to improve interoperable communications among federal,
    state, and local agencies will likely remain limited. For more
    information, see GAO-07-301; DHS updated information: In March 2007,
    DHS reported that SAFECOM has goals for improving interoperability
    among federal, state, local, and tribal agencies. It also reported that
    SAFECOM, with the Office of Management and Budget, adopted a strategy,
    with metrics, based on user needs to meet its mission as an e-
    government project. DHS also reported that it is working to establish
    quantifiable performance measures by the third quarter of 2007. In
    addition, DHS reported that its Office of Emergency Communications has
    initiated a program planning and performance measurement initiative to
    incorporate and build upon past performance measures established by
    SAEFCOM and the Office of Management and Budget; Our assessment: We
    conclude that DHS generally has not achieved this performance
    expectation. While DHS officials indicate that the Office Emergency
    Communications plans to better address this performance expectation,
    the office is not yet operational. For example, this office was
    required to provide Congress with an initial plan for establishing this
    office by February 1, 2007, and as of June this plan was not yet
    complete. In our prior work, we reported that while DHS established
    performance measures for the SAFECOM program, key aspects of the
    program were not being measured. We also reported that none of the
    program's measures assess the extent to which first responders find DHS
    tools and assistance helpful or the effectiveness of outreach
    initiatives;
    Assessment: Generally not achieved.

    Performance expectation: 19. Provide grant funding to first responders
    in developing and implementing interoperable communications
    capabilities;
    Summary of findings: GAO findings: DHS has provided grant funding to
    first responders for developing and implementing interoperable
    communications. In April 2007 we reported according to DHS, $2.15
    billion in grant funding was awarded to states and localities from
    fiscal year 2003 through fiscal year 2005 for communications
    interoperability enhancements. This funding, along with technical
    assistance, has helped to make improvements on a variety of specific
    interoperability projects. We reported that one of the main purposes of
    the DHS grants program is to provide financial assistance to states and
    localities to help them fund projects to develop and implement
    interoperable communications systems. We reported that, according to
    SAFECOM guidance, interoperability cannot be solved by any one entity
    alone and, therefore, an effective and interoperable communications
    system requires a clear and compelling statewide strategy focused on
    increasing public safety effectiveness and coordination across all
    related organizations. A statewide interoperability plan is essential
    for outlining such a strategy. We reported that the narrow and specific
    use of DHS funding in the states we reviewed could be traced in part to
    the lack of statewide plans; interoperability investments by individual
    localities have not been coordinated toward achieving a broader goal
    for the state. We reported that in accordance with a previous
    recommendation, DHS has required grant recipients to develop and adopt
    a statewide communications plan by the end of 2007. Additionally, the
    fiscal year 2007 DHS appropriations act states that DHS may restrict
    funding to a state if it does not submit a statewide interoperable
    communication plan. However, despite our other previous recommendation
    that DHS should require that states certify that grant applications be
    consistent with statewide plans, no process has yet been established
    for ensuring that states' grant requests are consistent with their
    statewide plans and long-term objectives for improving
    interoperability. We noted that DHS Grants and Training officials were
    considering instituting such a process but they did not yet have
    specific plans to do so. We reported that because of the lack of
    coordination, state and local governments were investing significant
    resources, including DHS grant funds, in developing independent
    interoperability solutions that do not always support each others'
    needs. Until the DHS-mandated statewide communications plans are in
    place, and processes have been established for ensuring that each
    state's grant request is consistent with its statewide plan and longer-
    term interoperability goals, progress by states and localities in
    improving interoperability is likely to be impeded. We also reported
    that in addition to statewide plans, an overarching national plan is
    critical to coordinating interoperability spending, especially where
    federal first responders are involved. For more information, see GAO-07-
    301; DHS updated information: In March 2007, DHS reported that SAFECOM
    had developed coordinated grant guidance that is required for all grant
    programs that provide federal funds for interoperable communications.
    DHS also reported that it is working to ensure all grant funding is
    tied to statewide interoperable communications plans; Our assessment:
    We conclude that DHS has generally achieved this performance
    expectation, as the department has provided grant funding to first
    responders for developing and implementing interoperable communications
    capabilities;
    Assessment: Generally achieved.

    Performance expectation: 20. Provide guidance and technical assistance
    to first responders in developing and implementing interoperable
    communications capabilities;
    Summary of findings: GAO findings: While DHS has provided some guidance
    and technical assistance, the usefulness of these efforts varies. For
    example, based on a previous review of four states and selected
    localities, we often found that the selected states and local
    jurisdictions either did not find key tools useful or were unaware that
    the tools existed. Selected state and local officials did not find the
    tools and guidance useful for various reasons, including that (1) the
    tools and guidance are too abstract and do not provide practical
    implementation guidance on specific issues; (2) the documents are
    lengthy and hard to use as reference tools; and (3) awareness of
    SAFECOM and its tools has not reached all state and local agencies. As
    we previously reported, recently, SAFECOM has issued additional tools
    and guidance for state and local agencies to use, however, we were
    unable to assess them during our previous review because these tools
    were still new and we did not receive assessments of them from state
    and local officials. To its credit, as we reported in April 2007, the
    Interoperable Communications Technical Assistance Program, which is
    intended to provide on-site assistance to Urban Area Security
    Initiative areas to, among other things, assist with developing
    tactical interoperability plans, planning exercises, assessing
    communication gaps, and designing interoperable systems, had been
    beneficial to each of the four Urban Area Security Initiative areas we
    visited. DHS provided extensive assistance to the urban areas in
    developing their tactical interoperability communications plans,
    However, DHS curtailed the exercises that each urban areas was required
    to conduct to validate the robustness and completeness of their plans.
    Due to the complexity of these exercises, the Urban Area Security
    Initiative areas were originally allotted 12 months to plan and execute
    robust, full-scale exercises; DHS subsequently reduced this to 5
    months. DHS officials indicated that they accelerated the deadline so
    that they could use the results as inputs into the interoperability
    scorecards that they published in January 2007. To compensate for the
    reduced time frame, DHS reduced the requirements of the full-scale
    exercise, advising the Urban Area Security Initiative areas to limit
    the scope and size of their activities. In reducing the scope of their
    exercises, the Urban Area Security Initiative areas had to reduce the
    extent to which they tested the robustness and effectiveness of their
    interoperability plans. Without robust exercises to validate tactical
    interoperability communications plans, the Urban Area Security
    Initiative areas can only have limited confidence in the plans'
    effectiveness, and thus the value of DHS's efforts may continue to be
    limited. Similarly, the constraints placed on the exercises means that
    DHS's scorecards of each of the Urban Area Security Initiative areas
    are based on questionable data. In addition, we reported that SAFECOM's
    activities have focused primarily on providing planning tools to state
    and local governments. For more information, see GAO-07-301; DHS
    updated information: In March 2007, DHS reported that it has developed
    a variety of guidance documents related to interoperability. These
    documents include the Statewide Communications Interoperability
    Planning Methodology and Brochure; Tabletop Methodology; State Planning
    Guidebook; Migration Model; and guides on a creating a charter, writing
    a memorandum of understanding, writing standard operating procedures,
    standards and technology, and procurement. DHS also reported that by
    the end of fiscal year 2007, all states and territories are to develop
    and adopt a Statewide Communications Interoperability Plan to be
    reviewed by the Office of Emergency Communications. DHS reported that
    it will provide technical assistance to states and territories in the
    development of their plans through the Interoperable Communications
    Technical Assistance Program. Moreover, DHS reported that it has
    provided various assistance to state and local jurisdictions through
    the Interoperable Communications Technical Assistance Program,
    including providing assistance in the development Tactical
    Interoperable Communication Plans for 65 metropolitan areas;
    participating in the plans' exercise validation; and developing and
    providing assistance to jurisdictions in using the Communication and
    Asset Survey Mapping Tool. In addition, DHS reported that SAFECOM is in
    the process of developing performance measures to ensure its tools are
    being used throughout the emergency response community; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has provided various guidance and
    technical assistance to first responders in developing and implementing
    interoperable communications. However, as we recently reported, several
    states and localities were not aware of SAFECOM tools and guidance and
    did not find the tools and guidance useful. In addition, DHS reported
    that it is developing performance measures to assess use of its tools
    and guidance, but the department has not yet developed these measures;
    Assessment: Generally not achieved.

    Performance expectation: 21. Provide assistance to state and local
    governments to develop all-hazards plans and capabilities;
    Summary of findings: GAO and DHS IG findings: Although DHS has taken
    actions to provide assistance to state and local governments, this
    assistance has not always focused on the development of all-hazards
    plans and capabilities. In July 2005 we reported that because terrorist
    attacks share many common characteristics with natural and accidental
    disasters, many of the capabilities first responders need to support
    national preparedness efforts are similar. Our analysis of DHS's Target
    Capabilities List and our discussions with first responders and other
    emergency management stakeholders revealed that the capabilities
    required to address terrorist attacks and to address natural and
    accidental disasters are most similar for protection, response, and
    recovery, and differ most for prevention. More specifically at the time
    of our review, 30 of the 36 target capabilities yielded by DHS's
    capabilities based planning process applied across all types of
    emergency events. It is possible that terrorist attacks could be
    prevented through actionable intelligence (i.e., information that can
    lead to stopping or apprehending terrorists), but there is no known way
    to prevent natural disasters, such as hurricanes, earthquakes, and
    tornadoes. Natural or accidental disasters differ from terrorist
    attacks in that they are unintentional and unplanned rather than the
    result of deliberate, planned action. It is the deliberate, planned
    nature of terrorist attacks that makes preventive efforts for such
    attacks principally the responsibility of intelligence and law
    enforcement agencies. In 2005 we also reported that DHS grant programs
    have largely focused on enhancing first responders' capabilities to
    respond to terrorist attacks based on Homeland Security Presidential
    Directive 8 and legislation that emphasize preparedness assistance for
    catastrophic terrorism as the highest priority for federal funding. The
    priorities of some first responders we interviewed did not align with
    DHS's priorities for enhancing capabilities. For example, during our
    interviews, 31 of 39 first responder departments who replied to a
    question about DHS's training programs, exercise activities, and grant
    funds disagreed that these were focused on all-hazards. In addition,
    officials from four first responder departments went on to say that DHS
    required too much emphasis on terrorism-related activities in requests
    for equipment and training--for example, combating weapons of mass
    destruction and preventing and responding to terrorist attacks using
    chemical, biological, radiological, nuclear, and explosive materials.
    However, responders said that they had a greater need for assistance
    preparing for natural and accidental disasters. During our interviews,
    37 of the 69 first responder departments who responded to a question
    about the programmatic challenges they face cited the need for
    additional flexibility from DHS or state agencies in order to use grant
    funds to enhance their ability to respond to events that were more
    likely to occur in their jurisdictions. In March 2006, the DHS IG
    reported that the response to Hurricane Katrina demonstrated that DHS's
    efforts to protect and prepare the nation for terrorist events and
    natural disasters had not yet translated into preparedness for all
    hazards. State emergency management staff interviewed said the majority
    of DHS preparedness grants were spent on terrorism preparedness, which
    had not afforded sufficient support or funding for natural hazards
    preparedness. Staff in the Hurricane Katrina affected states described
    a heavy emphasis on terrorism funding and expressed bafflement at the
    lack of natural hazards funding. Few perceived grants as "all-hazard."
    The DHS IG reported that this perception may have been fueled by the
    fact that all DHS preparedness grants were managed by an entity�the
    former Office of Domestic Preparedness�whose mandate was originally
    terrorism preparedness. Additionally, only 2 of the 15 National
    Planning Scenarios, a compilation of potential disasters developed to
    support preparedness, involved natural disasters (a major hurricane and
    a major earthquake). The DHS IG found that although the documents in
    the National Preparedness System addressed all hazards, the prevalence
    of terrorism-related items in them fostered a perception that the
    preparedness for and response to a terrorist event is different from
    that of a naturally occurring event. Further, the DHS IG reported that
    requirements associated with federal emergency preparedness grants to
    states also supported the perception that terrorism preparedness is
    separate from natural disaster preparedness. A majority of grants to
    states emphasized preparedness for terrorism and weapons of mass
    destruction and limited use of the grants to terrorism-preparedness
    measures, such as the purchase of specific personal protective
    equipment. Office of Domestic Preparedness staff said that state
    grantees were failing to take advantage of the grants' flexibility and
    use them for all-hazards preparedness measures. State emergency
    managers questioned grant packages that required so much spending on
    potential events involving terrorism and weapons of mass destruction,
    when they received far less funding to prepare for natural disasters
    that are certain to recur. For example, the DHS IG found that the Gulf
    Coast region experienced 91 major disaster and emergency declarations
    from September 1, 1995, to September 1, 2005, all due to natural
    hazards such as hurricanes and flooding. Yet a significant portion of
    the federal funding for these states was earmarked for terrorism
    preparedness to the exclusion of natural hazards preparedness. For more
    information, see GAO-05-652 and Homeland Security: Management of First
    Responder Grant Programs and Efforts to Improve Accountability Continue
    to Evolve, GAO-05-530T. Also, see Department of Homeland Security
    Office of Inspector General, A Performance Review of FEMA's Disaster
    Management Activities in Response to Hurricane Katrina, OIG-06-32
    (Washington, D.C.: March 2006); DHS updated information: In March
    2007, DHS provided us with updated information on its efforts to
    provide assistance to state and local governments in developing all-
    hazards plans and capabilities. For example, DHS reported that its
    Office of Grants and Training conducted a series of mobile
    implementation training team interviews with senior state and local
    officials to facilitate the development of state and local all-hazards
    plans and capabilities. This office also completed the Nationwide Plan
    Review, a national review of preparedness planning following Hurricane
    Katrina. Moreover, DHS reported that FEMA's Mitigation Division
    provides assistance to communities in the development of hazard
    mitigation plans that include hazard identification and risk assessment
    and identification and prioritization of potential mitigation measures.
    DHS noted that the Mitigation Division reviews and approves these
    plans. DHS reported that FEMA has approved over 13,500 community hazard
    mitigation plans, 54 tribal hazard mitigation plans, 50 state hazard
    mitigation plans, and 11 state enhanced hazard mitigation plans as of
    March 2007. In addition, FEMA reported that is has provided grants
    totaling over $110 million (since 2002) to fund the development of more
    than 1,500 state and local hazard mitigation plans through the Hazard
    Mitigation Grant Program and the Pre-Disaster Mitigation Grant
    Program; Our assessment: We conclude that DHS generally has not
    achieved this performance expectation. DHS did not provide us with
    evidence on the extent to which its assistance to state and local
    governments has focused on all-hazards, rather than just terrorism
    preparedness and response or hazard mitigation. DHS also did not
    provide us with documentation that its assistance to state and local
    governments has helped these government agencies develop all-hazards
    capabilities, in addition to hazard mitigation plans;
    Assessment: Generally not achieved.

    Performance expectation: 22. Administer a program for providing grants
    and assistance to state and local governments and first responders;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation. DHS has developed
    and is administering programs for providing grants and assistance to
    state and local governments and first responders. DHS provides grant
    funds to the 50 states, the District of Columbia, the Commonwealths of
    Puerto Rico and the Northern Mariana Islands, American Samoa, the
    Virgin Islands, Guam, and selected urban areas. For more information,
    see Homeland Security: Management of First Responder Grant Programs Has
    Improved, but Challenges Remain, GAO-05-121 and GAO-05-652;
    Assessment: Generally achieved.

    Performance expectation: 23. Allocate grants based on assessment
    factors that account for population, critical infrastructure, and other
    risk factors;
    Summary of findings: GAO findings and assessment: DHS has taken actions
    to allocate grants based on assessment factors that account for
    population, critical infrastructure, and other risk factors, and we
    conclude that DHS has generally achieved this performance expectation.
    From fiscal year 2003 through 2005, DHS used an approach for assessing
    risk based largely on indicators such as population density combined
    with threat assessments. For fiscal year 2006, DHS adopted a more
    sophisticated risk assessment approach to determine both (1) which
    Urban Area Security Initiative areas were eligible for funding, based
    on their potential risk relative to other areas, and (2) in conjunction
    with a new effectiveness assessment, the amount of funds awarded to
    eligible areas. As described by DHS officials, the fiscal year 2007
    grant process included substantial changes to the 2006 risk assessment
    model, simplifying its structure, reducing the number of variables
    considered, and incorporating the intelligence community's assessment
    of threats for all candidate urban areas, which was used to assign the
    areas to one of four tiers, according to their relative threat, with
    Tier I being those at highest threat. In fiscal years 2006 and 2007,
    the risk assessment process has been used to assess threat,
    vulnerability, and the consequences of various types of successful
    attacks for each urban area assessed. One difference in 2007 is that
    DHS considered most areas of the country equally vulnerable to attack,
    given the freedom of movement within the United States. It focused its
    analysis on the expected impact and consequences of successful attacks
    occurring in specific areas of the country, given their population,
    population density, and assets. The risk assessment process is not
    perfect, is evolving, and of necessity involves professional judgments,
    such as assigning the weights to be used for specific factors in the
    risk assessment model. Although DHS has made progress in developing a
    method of assessing relative risk among urban areas, DHS officials have
    said that they cannot yet assess how effective the actual investments
    from grant funds are in enhancing preparedness and mitigating risk
    because they do not yet have the metrics necessary to do so. For more
    information, see GAO-07-386T and Homeland Security Grants: Observations
    on Process DHS Used to Allocate Funds to Selected Urban Areas, GAO-07-
    381R;
    Assessment: Generally achieved.

    Performance expectation: 24. Develop a system for collecting and
    disseminating lessons learned and best practices to emergency
    responders;
    Summary of findings: GAO findings: DHS has taken actions to develop a
    system to effectively collect and disseminate lessons learned and best
    practices to emergency responders, but more work remains. DHS has
    established the Lessons Learned Information Sharing online portal. The
    portal states that it seeks to improve preparedness nationwide by
    allowing local, state, and federal homeland security and response
    professionals to access information on the most effective planning,
    training, equipping, and operating practices for preventing, preparing
    for, responding to, and recovering from acts of terrorism. However, we
    reported in December 2006 that although the Lessons Learned Information
    Sharing portal includes guidance and other emergency preparedness
    information, officials from two of the five major cities and two of the
    four states we visited told us that specific information is not easy to
    find, in part, because the portal is difficult to navigate. Upon using
    the portal, we also found this to be true. For example, the search
    results appeared to be in no particular order and were not sorted by
    date or relevant key terms, and searched terms were not highlighted or
    shown anywhere in the abstracts of listed documents. In addition, some
    studies were not available through the portal, including studies from
    some of the experts with whom we have spoken and who provided us with
    useful information on evacuation preparedness for transportation-
    disadvantaged populations. In commenting on our December 2006 report,
    DHS officials told us that they had improved the overall functionality
    of DHS's Lessons Learned Information Sharing portal. We revisited the
    portal as of December 7, 2006, and it appeared to have improved some of
    its search and organizational functions. We have found, however, that
    some of the issues we previously identified still remained, including,
    when using the portal's search function, no direct link to key
    evacuation preparedness documents, such as DHS's Nationwide Plan Review
    Phase I and II reports. For more information, see Transportation-
    Disadvantaged Populations: Actions Needed to Clarify Responsibilities
    and Increase Preparedness for Evacuations, GAO-07-44 and GAO-05-652;
    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to collect and disseminate lessons learned
    and best practices to emergency responders. DHS reported that its
    Lessons Learned Information Sharing System houses over 400 after-action
    reports; 1,200 emergency operations plans; and 500 lessons learned and
    best practices that are shared among the system's more than 31,000
    members. DHS reported that in a survey of system users conducted in
    June 2006, 86 percent reported being "satisfied" or "very satisfied"
    with the information provided. In addition, DHS reported that it is
    working to improve the functionality of the Lessons Learned Information
    Sharing System and that enhancements to the system, including an
    improved search engine, is expected to be implemented by the end of
    September 2007; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. Although DHS has developed and
    implemented the Lessons Learned Information Sharing System, it is not
    clear that this system is effectively collecting and disseminating
    lessons learned and best practices to emergency responders. In
    addition, DHS is taking some actions to address the issues with the
    Lessons Learned Information Sharing System that we previously
    identified, but these actions are not yet complete;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [A] We refer to DHS's recovery efforts as the development,
    coordination, and execution of service and site restoration plans
    through DHS assistance programs.

    [B] The Post-Katrina Emergency Management Reform Act of 2006, Pub. L.
    No. 109-295, tit. VI, 120 Stat. at 1394-62, transferred the
    responsibilities for administering SAFECOM to the Office of Emergency
    Communications, which is under the Office of Cyber Security and
    Communications within the Directorate for National Protection and
    Programs. The Office for Interoperability and Compatibility retained
    responsibility for research, development, testing, evaluation, and
    standards-related elements of SAFECOM. See id., � 671(b).

    [End of table]

    DHS Has Made Moderate Progress in Strengthening the Protection of
    Critical Infrastructure and Key Resources:

    Critical infrastructure are systems and assets, whether physical or
    virtual, so vital to the United States that their incapacity or
    destruction would have a debilitating impact on national security,
    national economic security, and national public health or safety, or
    any combination of these matters. Key resources are publicly or
    privately controlled resources essential to minimal operations of the
    economy or government, including individual targets whose destruction
    would not endanger vital systems but could create a local disaster or
    profoundly damage the nation's morale or confidence. While the private
    sector owns approximately 85 percent of the nation's critical
    infrastructure and key resources, DHS has wide-ranging responsibilities
    for leading and coordinating the overall national critical
    infrastructure and key resources protection effort.

    The National Infrastructure Protection Plan identifies 17 critical
    infrastructure and key resources sectors:

    * agriculture and food;
    * banking and finance;
    * chemical;
    * commercial facilities;
    * commercial nuclear reactors, materials, and waste;
    * dams;
    * defense industrial base;
    * drinking water and water treatment systems;
    * emergency services;
    * energy;
    * government facilities;
    * information technology;
    * national monuments and icons;
    * postal and shipping;
    * public health and healthcare;
    * telecommunications; and:
    * transportation systems.

    DHS has overall responsibility for coordinating critical infrastructure
    and key resources protection efforts.[Footnote 26] Within DHS, the
    Office of Infrastructure Protection has been designated as the Sector-
    Specific Agency[Footnote 27] responsible for the chemical; commercial
    facilities; dams; emergency services; and commercial nuclear reactors,
    materials, and waste sectors. TSA has been designated as the Sector-
    Specific Agency for postal and shipping, and TSA and the Coast Guard
    have been designated the Sector-Specific Agencies for transportation
    systems. The Federal Protective Service within ICE has been designated
    as the Sector-Specific Agency for government facilities. The Office of
    Cyber Security and Telecommunications has been designated the Sector-
    Specific Agency for Information Technology and Telecommunications.

    As shown in table 30, we identified seven performance expectations for
    DHS in the area of critical infrastructure and key resources
    protection, and we found that overall DHS has made moderate progress in
    meeting those performance expectations. Specifically, we found that DHS
    has generally achieved four performance expectations and has generally
    not achieved three others.

    Table 30: Performance Expectations and Progress Made in Critical
    Infrastructure and Key Resources Protection:

    Performance expectation: 1. Develop a comprehensive national plan for
    critical infrastructure protection;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop partnerships and coordinate with
    other federal agencies, state and local, governments, and the private
    sector;
    Assessment: Generally achieved.

    Performance expectation: 3. Improve and enhance public/private
    information sharing involving attacks, threats, and vulnerabilities;
    Assessment: Generally not achieved.

    Performance expectation: 4. Develop and enhance national analysis and
    warning capabilities for critical infrastructure;
    Assessment: Generally not achieved.

    Performance expectation: 5. Provide and coordinate incident response
    and recovery planning efforts for critical infrastructure;
    Assessment: Generally not achieved.

    Performance expectation: 6. Identify and assess threats and
    vulnerabilities for critical infrastructure;
    Assessment: Generally achieved.

    Performance expectation: 7. Support efforts to reduce threats and
    vulnerabilities for critical infrastructure;
    Assessment: Generally achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 4;
    Assessment: Generally not achieved: 3;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 31 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of critical infrastructure and key resources protection and
    our assessment of whether DHS has taken steps to satisfy most of the
    key elements of the performance expectation (generally achieved) or has
    not taken steps to satisfy most of the performance expectation's key
    elements (generally not achieved).

    Table 31: Performance Expectations and Assessment of DHS Progress in
    Critical Infrastructure and Key Resources Protection:

    Performance expectation: 1. Develop a comprehensive national plan for
    critical infrastructure protection;
    Summary of findings: GAO findings: DHS issued the National
    Infrastructure Protection Plan in June 2006. In October 2006, we
    reported that the National Infrastructure Protection Plan serves as a
    road map for how DHS and other relevant stakeholders should use risk
    management principles to prioritize protection activities within and
    across sectors in an integrated, coordinated fashion. We reported that
    each of the 17 critical infrastructure sectors had provided a sector-
    specific plan to DHS by the end of December 2006. In May 2007, DHS
    announced the completion of the 17 sector-specific plans. For more
    information see Critical Infrastructure Protection: Progress
    Coordinating Government and Private Sector Efforts Varies by Sectors'
    Characteristics, GAO-07-39; Risk Management: Further Refinements Needed
    to Assess Risks and Prioritize Protective Measures at Ports and Other
    Critical Infrastructure, GAO-06-91; and Homeland Security: Much Is
    Being Done to Protect Agriculture from a Terrorist Attack, but
    Important Challenges Remain, GAO-05-214; DHS updated information: In
    March and April 2007, DHS provided us with updated information on its
    efforts to develop a comprehensive national plan for critical
    infrastructure protection. DHS reported that each sector submitted by
    July 14, 2006, its sector Critical Infrastructure and Key Resources
    Protection Annual Report to DHS in which the sectors identified
    priorities and goals for critical infrastructure and key resources
    protection based on risk, need, and projected resource requirements.
    DHS also reported that on October 15, 2006, it finalized the National
    Critical Infrastructure and Key Resources Protection Annual Report,
    which is an aggregate of the sector annual reports; Our assessment: We
    conclude that DHS has generally achieved this performance expectation
    as DHS issued the National Infrastructure Protection Plan, which
    provides a comprehensive national plan for critical infrastructure
    protection;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop partnerships and coordinate with
    other federal agencies, state and local governments, and the private
    sector;
    Summary of findings: GAO findings: DHS has taken steps to develop
    partnerships and coordinate with other federal agencies, state and
    local governments, and the private sector. DHS is responsible for
    coordinating a national protection strategy, including formation of
    government and private sector councils as a collaborating tool. The
    councils, among other things, are to identify their most critical
    assets and identify protective measures in sector-specific plans that
    comply with DHS's National Infrastructure Protection Plan. In October
    2006 we reported that all 17 critical infrastructure sectors
    established their respective government councils, and nearly all
    sectors initiated their voluntary private sector councils in response
    to the National Infrastructure Protection Plan. In addition, DHS has
    undertaken numerous initiatives to foster partnerships with other
    federal agencies, state and local governments, and the private sector
    about cyber attacks, threats, and vulnerabilities. For example, the
    National Cyber Response and Coordination Group facilitates coordination
    of intragovernmental and public/private preparedness and operations in
    order to respond to and recover from incidents that have significant
    cyber consequences and also brings together officials from national
    security, law enforcement, defense, intelligence, and other government
    agencies that maintain significant cybersecurity responsibilities and
    capabilities. For more information see GAO-07-39; Critical
    Infrastructure Protection: DHS Leadership Needed to Enhance
    Cybersecurity, GAO-06-1087T; Homeland Security: DHS Is Taking Steps to
    Enhance Security at Chemical Facilities, but Additional Authority Is
    Needed, GAO-06-150; Critical Infrastructure Protection: Challenges in
    Addressing Cybersecurity, GAO-05-827T; Critical Infrastructure
    Protection: Department of Homeland Security Faces Challenges in
    Fulfilling Cybersecurity Responsibilities, GAO-05-434; and Protection
    of Chemical and Water Infrastructure: Federal Requirements, Actions of
    Selected Facilities, and Remaining Challenges, GAO-05-327; DHS updated
    information: In March and April 2007, DHS provided us with updated
    information on its efforts to develop partnerships and coordinate with
    other federal agencies, state and local governments, and the private
    sector. For example, DHS reported that its Protective Security Advisor
    program has provided support to state and local officials during
    incidents and contingencies and has made over 13,000 liaison visits to
    local jurisdictions and facilities and also established over 31,000
    points of contact. DHS also reported that its Nuclear and Chemical
    Sector-Specific Agencies have cultivated relationships with their
    respective Government Coordinating Councils and Sector Coordinating
    Councils. DHS identified a number of other efforts these Sector-
    Specific agencies made. For example, the Chemical Sector-Specific
    Agency hosts biweekly Chemical Security teleconferences for senior
    chemical industry security managers. It also sponsors classified
    briefings for industry representatives and holds Government
    Coordinating Council meetings to discuss initiatives throughout the
    government that affect the chemical sector. Similarly, the Nuclear
    Sector-Specific Agency reported that it provides quarterly classified
    threat briefs by the Homeland Infrastructure Threat and Risk Analysis
    Center to the sector. It has also signed a memorandum of understanding
    with the Nuclear Sector Coordinating Council concerning the management
    and maintenance of the Homeland Security Information Network-Nuclear
    Sector and standard operating procedures agreements with the Nuclear
    Energy Institute and Constellation Energy for the safeguard and
    protection of classified information. The Emergency Service Sector
    Sector-Specific Agency reported that it uses the Emergency Services
    Regional Assessment Process to gather and analyze information provided
    by state, local, and tribal communities to identify capability
    weaknesses and protective measures for reducing or eliminating them;
    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has undertaken a number of efforts to
    develop partnerships and coordinate with other federal agencies, state
    and local governments, and the private sector, such as coordinating
    collaborative tools detailed in the National Infrastructure Protection
    Plan;
    Assessment: Generally achieved.

    Performance expectation: 3. Improve and enhance public/private
    information sharing involving attacks, threats, and vulnerabilities;
    Summary of findings: GAO and DHS IG findings: While DHS has worked to
    improve and enhance public/private information sharing involving
    attacks, threats, and vulnerabilities, a number of challenges remain.
    In 2004, DHS piloted the Homeland Security Information Network, which
    is DHS's primary conduit through which it shares information on
    domestic terrorist threats, suspicious activity reports, and incident
    management. We reported in March 2006 that the Homeland Security
    Information Network platform for critical sectors was being developed
    and offered to each sector to provide a suite of information and
    communication tools to share critical information within the sector,
    with DHS, and eventually across sectors. However, in June 2006, the DHS
    IG reported that DHS had failed to take a number of key steps in
    planning and implementing the Homeland Security Information Network.
    For example, DHS did not provide adequate user guidance and had not
    developed specific performance measures for tracking information
    sharing on the Homeland Security Information Network. The DHS IG
    reported that as a result the Homeland Security Information Network was
    not effectively supporting state and local information sharing. In
    April 2007, we reported that DHS did not fully adhere to key practices
    in coordinating efforts on its Homeland Security Information Network
    with key state and local information-sharing initiatives. For example,
    it did not work with the two key state and local information-sharing
    initiatives (of the Regional Information Sharing System program) to
    fully develop joint strategies to meet mutual needs. It also did not
    develop compatible policies, procedures, and other means to operate
    across organizational boundaries. DHS's limited use of these practices
    is attributable in part to the department's expediting its schedule to
    deploy information-sharing capabilities after September 11, 2001, and
    in doing so not developing an inventory of key state and local
    information-sharing initiatives. We also reported that DHS officials
    have efforts planned and under way to improve coordination and
    collaboration, including establishing an advisory committee to obtain
    state and local views on network operations. DHS also plans to
    coordinate its efforts with the Administration's Information Sharing
    Environment initiative that aims to improve information sharing among
    all levels of government and the private sector. However, these
    activities have either just begun or are being planned. Consequently,
    until DHS develops an inventory of key state and local initiatives and
    fully implements coordination and collaboration practices, it is at
    risk that effective information sharing is not occurring and that its
    Homeland Security Information Network may be duplicating state and
    local capabilities. This also raises the issue of whether similar
    coordination and duplication issues exist with the other homeland
    security networks, systems, and applications under DHS's purview; In
    April 2006 we reported that DHS had issued an interim rule that
    established operating procedures for the receipt, care, and storage of
    critical infrastructure information, such as vulnerability assessments
    and security methods, and the agency has created a program office to
    administer the protected critical infrastructure information program.
    However, we noted that DHS had not defined the specific information--
    such as industry-specific vulnerabilities and interdependencies--
    needed under the program, nor has it comprehensively worked with other
    federal agencies with critical infrastructure responsibilities to find
    out what they need; With regard to one critical infrastructure sector,
    the DHS IG reported in February 2007 that the National Infrastructure
    Coordinating Center, the Homeland Security Information Network Food and
    Agriculture portal, the Homeland Infrastructure Threat and Risk
    Analysis Center, and the Protected Critical Infrastructure Information
    program each had shortcomings concerning food sector information
    sharing. For example, the DHS IG reported that food sector experts
    expressed concern that while the Homeland Security Information Network
    Food and Agriculture portal had potential value, it had limited utility
    for the sector's information sharing purposes in its current form. For
    more information, see Information Technology: Homeland Security
    Information Network Needs to Be Better Coordinated with Key State and
    Local Initiatives, GAO-07-822T; Information Technology: Numerous
    Federal Networks Used to Support Homeland Security Need to Be Better
    Coordinated with Key State and Local Information-Sharing Initiatives,
    GAO-07-455; GAO-06-1087T; Securing Wastewater Facilities: Utilities
    Have Made Important Upgrades but Further Improvements to Key System
    Components May Be Limited by Costs and Other Constraints; GAO-06-390;
    Information Sharing: The Federal Government Needs to Establish Policies
    and Processes for Sharing Terrorism-Related and Sensitive but
    Unclassified Information, GAO-06-385; Information Sharing: DHS Should
    Take Steps to Encourage More Widespread Use of Its Program to Protect
    and Share Critical Infrastructure Information, GAO-06-383; GAO-06-150;
    GAO-05-434; Critical Infrastructure Protection: Establishing Effective
    Information Sharing with Infrastructure Sectors, GAO-04-699T; and
    Technology Assessment: Cybersecurity for Critical Infrastructure
    Protection, GAO-04-321. Also, see Department of Homeland Security
    Office of Inspector General, Homeland Security Information Network
    Could Support Information Sharing More Effectively, OIG-06-38
    (Washington, D.C.: June 2006) and The Department of Homeland Security's
    Role in Food Defense and Critical Infrastructure Protection, OIG-07-33
    (Washington, D.C.: February 2007); DHS updated information: In March,
    April, and June 2007, DHS provided updated information regarding its
    efforts to improve and enhance public/private information sharing
    involving attacks, threats, and vulnerabilities. DHS reported that its
    Critical Infrastructure and Key Resources Information Sharing
    Environment encompasses a number of mechanisms that facilitate the flow
    of information, mitigate obstacles to voluntary information sharing by
    Critical Infrastructure and Key Resources owners and operators, and
    provide feedback and continuous improvement for structures and
    processes. DHS stated that the creation of an effective and efficient
    information sharing environment encompasses five components:
    governance (the sector partnerships), content, delivery vehicle (the
    Homeland Security Information Network and the National Infrastructure
    Coordination Center), relationship management, and an adaptive legal
    and policy framework to address the unique requirements of the critical
    infrastructure/key resources sectors. DHS stated the Homeland Security
    Information Network is a key enabler for information delivery. For
    example, in September 2006 testimony before the House Committee on
    Homeland Security, the Director of the Office of Operations
    Coordination stated that the Homeland Security Information Network "is
    the primary, secure nationwide network through which DHS receives and
    shares critical information, including alerts and warnings, with its
    components and its public-and private-sector partners, including
    Federal, State, local, and tribal officials and the owners and
    operators of critical infrastructures". Yet DHS reported that the
    Homeland Security Information Network represents only one of the parts
    of the whole; With regard to other elements of information sharing,
    DHS stated that it has developed its critical infrastructure/key
    resources information sharing environment strategy paper, a roadmap
    that describes and provides the basis for developing process and
    outcome metrics. DHS stated that this strategy has been accepted by the
    information sharing environment program manager as the way ahead for
    sharing information with the critical infrastructure/key resources
    sectors. DHS reported that within this framework, a critical
    infrastructure partnership advisory council working group has been
    established between the information sharing environment program manager
    and the private sector so the private sector can have direct
    representation in the decision making process regarding public/private
    information sharing. The department also reported that it had made a
    number of efforts to address concerns about the Homeland Security
    Information Network. For example, DHS stated that it is coordinating
    the implementation of the Homeland Security Information Network in
    state and local fusion centers and is implementing the DHS Common
    Operating Picture, which is a Web-based tool available through the
    Homeland Security Information Network that is designed to provide a
    common view of critical information to senior executive officials and
    other partners during a crisis. DHS also reported that it is focusing
    training and outreach efforts on state and local government throughout
    the Gulf Coast and East Coast regions, which the department sees as
    areas of high priority for hurricane season that would rely heavily on
    the Common Operating Picture and Homeland Security Information Network
    during incident response. Further, DHS stated that the National
    Infrastructure Coordination Center, which was established to maintain
    operational awareness of the nation's critical infrastructures and key
    resources, and provide a process and mechanism for information sharing
    and coordination with government and industry partners, has established
    processes to share routine and incident-driven information with sectors
    via the Homeland Security Information Network. DHS reported that the
    National Infrastructure Coordination Center also serves as the
    recognized DHS hub for critical infrastructure and key resources
    information during major incidents, facilitating daily interactive
    teleconferences with sector stakeholders; collecting, logging, and
    tracking information requests from critical infrastructure and key
    resources owners and operators; and providing a situation summary for
    stakeholders through the Common Operating Picture. DHS also stated that
    the National Infrastructure Protection Plan provided a framework for
    developing metrics for information sharing and that these metrics are
    in the process of being developed; Further, DHS reported that its
    Technical Resource for Incident Prevention system�DHS's online,
    collaborative, information sharing network for bomb squad, law
    enforcement, and emergency services personnel to learn about current
    terrorist improvised explosive device tactics, techniques, and
    procedures�improves and enhances information sharing involving
    improvised explosive device attacks and threats. DHS also reported that
    in fiscal year 2007 it has had provided easier access to its
    Characteristics and Common Vulnerabilities, Potential Indicators of
    Terrorist Attack, and Protective Measure papers, which are derived from
    vulnerability assessments. DHS stated that in the past 6 months it has
    provide over 385 federal, state, local, and private sector stakeholders
    access to these reports through a web-based portal and that they are
    available on the Homeland Security Information Network; DHS provided
    several examples of information sharing by the Nuclear Sector-Specific
    Agency, the Dams Sector-Specific Agency, the Emergency Sector-Specific
    Agency, and the Chemical Sector-Specific Agency. For example, DHS
    reported that every two weeks the Chemical Sector-Specific Agency hosts
    a security briefing teleconference for the chemical sector and twice a
    year will sponsor a classified briefing for all clear industry
    representatives. In addition, the Coast Guard reported that it launched
    Homeport in October 2005. The Coast Guard stated that Homeport is an
    internet portal and the official Coast Guard information technology
    system for maritime security. The Coast Guard reported that Homeport
    provides instant access to information necessary to support increased
    information sharing requirements among federal, state, local and
    industry decision makers for security management and increased maritime
    domain awareness and is publicly accessible, providing all users with
    current maritime security information including DHS and Federal Bureau
    of Investigation threat products; Our assessment: We conclude that DHS
    has generally not achieved this performance expectation. DHS identified
    five components to its information sharing environment�governance (the
    sector partnerships), content, delivery vehicle (the Homeland Security
    Information Network and the National Infrastructure Coordination
    Center), relationship management, and an adaptive legal and policy
    framework. According to the department, the Homeland Security
    Information Network is a key part of its information sharing efforts
    and serves as the primary mechanism for delivering information to its
    critical infrastructure partners. For example, in September 2006
    testimony before the House Committee on Homeland Security, the Director
    of the Office of Operations Coordination stated that the Homeland
    Security Information Network "is the primary, secure nationwide network
    through which DHS receives and shares critical information, including
    alerts and warnings, with its components and its public-and private-
    sector partners, including Federal, State, local, and tribal officials
    and the owners and operators of critical infrastructures". In previous
    work, we and the DHS IG identified a number of challenges to the
    Homeland Security Information Network, such as coordination with state
    and local information sharing initiatives, and DHS did not provide
    evidence demonstrating that it has addressed these challenges. Further,
    in previous work, we also identified challenges to DHS's efforts to
    collect, care for, and store critical infrastructure information
    through its protected critical infrastructure information program. For
    example, DHS had not defined the specific information it needed nor had
    it worked with other federal agencies to find out what they needed. DHS
    also was not able to provide metrics indicating that its efforts have
    improved information sharing. As a result, it is difficult for
    Congress, us, and other stakeholders to assess the extent to which
    DHS's various initiatives have enhanced and improved information
    sharing related to critical infrastructure and key resources
    protection;
    Assessment: Generally not achieved.

    Performance expectation: 4. Develop and enhance national analysis and
    warning capabilities for critical infrastructure;
    Summary of findings: GAO and DHS IG findings: DHS has taken steps to
    develop and enhance national analysis and warning capabilities for
    critical infrastructure, but more work remains. Our work to date has
    primarily focused on cyber critical infrastructure protection and the
    DHS IG's work on the food and agriculture sector. In the cyber area, in
    May 2005 we reported that DHS has collaborated on, developed, and
    worked to enhance tools and communication mechanisms for providing
    analysis and warning of occurring and potential cyber incidents.
    Through its involvement in the U.S. Computer Emergency Readiness Team,
    DHS provides cyber analysis and warning capabilities by providing
    continuous operational support in monitoring the status of systems and
    networks. When a new vulnerability or exploit is identified, the U.S.
    Computer Emergency Readiness Team evaluates its severity, determines
    what actions should be taken and what message should be disseminated,
    and provides information through the National Cyber Security Division's
    multiple communications channels. However, we reported that DHS faced
    the same challenges in developing strategic analysis and warning
    capabilities that we reported on 4 years prior during a review of the
    National Cyber Security Division's predecessor. At that time, we
    reported that a generally accepted methodology for analyzing strategic
    cyber-based threats did not exist. We also reported that the center did
    not have the industry-specific data on factors such as critical systems
    components, known vulnerabilities, and interdependencies. In February
    2007, the DHS IG reported that while DHS is not the designated lead for
    a number of key activities for food defense and critical
    infrastructure, Congress and the President have assigned DHS many
    important responsibilities in this area. The DHS IG identified several
    limitations in these efforts. For example, the DHS IG stated that
    modeling and simulation of food contamination incidents has not
    developed to the extent desirable. The DHS IG reported that DHS
    currently funds modeling and simulation efforts of the Critical
    Infrastructure Protection Decision Support System, the National
    Infrastructure Simulation and Analysis Center, and the National Center
    for Food Protection and Defense and that these programs have developed
    promising models in several areas of the food supply chain. The DHS IG
    reported that at the time of its fieldwork, these DHS-sponsored
    programs had developed detailed models or contamination scenarios for
    only the beef, dairy, corn, and fresh vegetable supply chains. The DHS
    IG also stated that experts in all three of the programs acknowledged
    that their models for these supply chains needed further refinement and
    could not account for the second-and third-order impacts of a major
    food contamination incident. For more information see GAO-06-383 and
    GAO-05-434. Also see Department of Homeland Security Office of
    Inspector General, The Department of Homeland Security's Role in Food
    Defense and Critical Infrastructure Protection, OIG-07-33 (Washington,
    D.C.: February 2007); DHS updated information: In March, April, and
    June 2007, DHS provided updated information regarding its efforts to
    develop and enhance national analysis and warning capabilities for
    critical infrastructure. DHS reported that over the past 2 years it has
    built out and continues to build the Critical Infrastructure Warning
    Information Network. DHS stated that the Critical infrastructure
    Warning Information Network is its critical, survivable network that
    connects DHS with the vital sector entities (including federal, state,
    private sector, and Canada and the United Kingdom) that are essential
    for restoring the nation's infrastructure during incidents of national
    significance. DHS stated that the Critical Infrastructure Warning
    Information Network has 143 Critical Infrastructure Warning Information
    Network members and provides both data and voice connectivity to allow
    its membership to exchange information, including alerts and
    notifications, as well as other routine information. DHS reported that
    it includes representation from all the critical infrastructure
    sectors, including 68 private sector entities that own and operate key
    concerns in the infrastructure sectors, as well as federal entities
    involved in monitoring and protecting them. DHS also reported that the
    Critical Infrastructure Warning Information Network connects the
    emergency operations centers of the 50 states and the District of
    Columbia to the DHS National Operations Center and is also used to
    provide classified connectivity and secure video teleconferencing
    between DHS and the states. Further, DHS stated that DHS's Office of
    Infrastructure Protection has sponsored a prompt notification pilot
    program with the Nuclear Sector Coordination Counsel. DHS reported that
    the pilot program demonstrated, for example, that DHS has the ability
    to ensure that nuclear sector infrastructure is promptly notified if
    infrastructure other than nuclear assets comes under attack nearby and
    that DHS can make notifications across its components, as well as to
    senior officials; Our assessment: We conclude that DHS has generally
    not achieved this performance expectation. While DHS has undertaken a
    number of efforts to develop and enhance national analysis and warning
    capacities for critical infrastructure, our prior work has shown that
    the department still faces a number of challenges. In the area of
    cybersecurity, for example, issues concerning methodology and data
    continue to pose challenges while a lack of collaboration creates
    challenges for its information gathering and/or analysis centers. These
    methodological issues in the cyber sector raise concerns as to whether
    sound methodologies exist for conducting analysis and warning in the
    other areas. Further, while DHS reported that it has expanded the
    Critical Infrastructure Warning Information Network, the department did
    not provide evidence demonstrating that it has enhanced national
    warning capabilities;
    Assessment: Generally not achieved.

    Performance expectation: 5. Provide and coordinate incident response
    and recovery planning efforts for critical infrastructure;
    Summary of findings: GAO and DHS IG findings: DHS has faced challenges
    in its efforts to provide and coordinate incident response and recovery
    planning efforts in cases when critical infrastructure and key
    resources are attacked or otherwise affected by catastrophic events or
    disasters. Our work to date has primarily focused on cyber critical
    infrastructure protection. In that area, we reported in June 2006 that
    DHS had begun a variety of initiatives to fulfill its responsibility
    for developing an integrated public/private plan for Internet recovery,
    but these efforts were not yet complete or comprehensive. Specifically,
    DHS developed high-level plans for infrastructure protection and
    incident response, but the components of these plans that address the
    Internet infrastructure were not yet complete. We noted that key
    challenges to establishing a plan for recovering from an Internet
    disruption included (1) innate characteristics of the Internet (such as
    the diffuse control of the many networks that make up the Internet and
    the private sector ownership of core components) that make planning for
    and responding to disruptions difficult, (2) lack of consensus on DHS's
    role and when the department should get involved in responding to a
    disruption, (3) legal issues affecting DHS's ability to provide
    assistance to entities working to restore Internet service, (4)
    reluctance of many in the private sector to share information on
    Internet disruptions with DHS, and (5) leadership and organizational
    uncertainties within DHS. We reported that until these challenges were
    addressed, DHS would have difficulty achieving results in its role as a
    focal point for helping to recover the Internet from a major
    disruption. In September 2006, we reported that the nation's experience
    with Hurricane Katrina demonstrated that enhanced capabilities for
    catastrophic response and recovery were needed, particularly for
    capabilities such as the assessment of the disaster's effects, and
    communications. We noted that DHS had reported taking some actions to
    improve capabilities in response to findings in Congress' and the
    administration's reviews. However, ongoing work was still needed by DHS
    to address significant human resource challenges. In February 2007 the
    DHS IG reported that food contamination exercises provide key learning
    opportunities for food sector representatives, and generate valuable
    lessons about how the response to a food-related incident is likely to
    proceed and that Sector Coordinating Council and Government
    Coordinating Council representatives said that they found food
    contamination exercises to be very instructive. The DHS IG reported
    that DHS has provided little direct support for or attention to
    exercises relating to food contamination. Since 2003, DHS has provided
    direct support for only four post-harvest food-related exercises
    through Grants and Training's Exercise and Training Division. DHS has
    sponsored six additional post-harvest food contamination tabletop
    exercises through the Multi-State Partnership for Security in
    Agriculture. And while the June 1, 2006, National Exercise Schedule
    listed a total of 226 exercises over the following year, it did not
    register a single post-harvest food-related exercise. For more
    information see Catastrophic Disasters: Enhanced Leadership,
    Capabilities, and Accountability Controls Will Improve the
    Effectiveness of the Nation's Preparedness, Response, and Recovery
    System, GAO-06-618; Internet Infrastructure: DHS Faces Challenges in
    Developing a Joint Public/Private Recovery Plan, GAO-06-672; GAO-05-
    434; and GAO-05-214. Also see Department of Homeland Security Office of
    Inspector General, The Department of Homeland Security's Role in Food
    Defense and Critical Infrastructure Protection, OIG-07-33 (Washington,
    D.C.: February 2007); DHS updated information: In June 2007, DHS
    provided updated information regarding its efforts to provide and
    coordinate incident response and recovery planning efforts for critical
    infrastructure. DHS reported that it has led a coordinated effort with
    the Nuclear Regulatory Commission, the Environmental Protection Agency,
    the Department of Health and Human Services, the Department of Energy,
    and the Occupational Safety and Health Administration to develop
    interim Protective Action Guides for Radiological Dispersal Devices and
    Improvised Nuclear Device Incidents. DHS stated that the objective of
    the proposed guidance is to provide federal, state, local, and tribal
    decision-makers with uniform federal guidance to protect the public,
    emergency responders, and surrounding environments from the effects of
    radiation following an radiological dispersal devices or improvised
    nuclear device incident and to ensure that local and federal first
    responders can address any issues or circumstances that may arise. DHS
    reported that use of this guidance in subsequent exercises has
    significantly improved the federal and state governments' ability to
    provide sound guidance to the public. DHS also reported that the
    Pandemic Flu Planning initiative for the Nuclear Sector is sponsored by
    the Nuclear Sector Coordination Council, in cooperation with DHS; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. While DHS has taken steps to provide and
    coordinate incident response and recovery planning efforts for critical
    infrastructure, our previous work has shown that DHS efforts to develop
    a public/private plan for Internet recovery were neither complete nor
    comprehensive. We also reported that a number of challenges existed
    that make it difficult to develop a plan. Further, in reviewing the
    nation's experience with Hurricane Katrina, we reported that enhanced
    capabilities for catastrophic response and recovery were needed;
    Assessment: Generally not achieved.

    Performance expectation: 6. Identify and assess threats and
    vulnerabilities for critical infrastructure;
    Summary of findings: GAO and DHS IG findings: DHS has identified and
    assessed threats and vulnerabilities for critical infrastructure. In
    December 2005 we reported that DHS has taken steps to identify and
    assess threats and vulnerabilities by, for example, establishing the
    National Asset Database, an inventory of approximately 80,000 assets,
    and developing and analyzing various threat scenarios. We also reported
    that DHS had begun work to develop threat scenarios and analyze them.
    We found that the Homeland Infrastructure Threat and Risk Analysis
    Center, staffed by sector specialists and intelligence analysts with
    backgrounds from the intelligence community, was responsible for
    generating these plausible threat scenarios and had developed 16, such
    as a suicide bomber and a weapon of mass destruction. However, DHS has
    faced challenges in, among other things, developing a way to
    differentiate the relative probability of various threats and a
    strategy for identifying, prioritizing, and coordinating the protection
    of critical infrastructure. In June 2006, the DHS IG reported that DHS
    was still in the process of identifying and collecting critical
    infrastructure and key resources data for populating the National Asset
    Database while also building the next version of it. The DHS IG also
    found that the National Asset Database contained numerous assets whose
    criticality was not obvious and found inconsistencies in what critical
    infrastructure and key resources states reported. Further, the DHS IG
    reported that the National Asset Database was not yet comprehensive
    enough to support the role envisioned for it in the National
    Infrastructure Protection Plan. In February 2007 we reported that DHS
    developed a method to estimate the relative risk of terrorist attacks
    to urban areas for the Urban Areas Security Initiative, a discretionary
    grant under the Homeland Security Grant Program. In fiscal year 2006,
    DHS estimated the risk faced by urban areas by assessing the relative
    risk of terrorism as a product of three components�threat, or the
    likelihood that a type of attack might be attempted; vulnerability, or
    the likelihood of a successful attack using a particular attack
    scenario; and consequence, or the potential impact of a particular
    attack. To estimate the relative risk, DHS assessed risk from two
    perspectives, asset-based and geographic, and then combined the
    assessments. To estimate asset risk, DHS computed the product of
    threat, vulnerability, and consequence by assessing the intent and
    capabilities of an adversary to successfully attack an asset type, such
    as a chemical plant, dam, or commercial airport, using one of 14
    different attack scenarios. Simultaneously, DHS assessed geographic
    risk by approximating the threat, vulnerability, and consequences
    considering general geographic characteristics mostly independent of
    the area's assets, using counts of data such as reports of suspicious
    incidents, the number of visitors from countries of interest, and
    population. For fiscal year 2007, DHS officials stated that they will
    to continue to use the risk assessments to inform final funding
    decisions. They also described changes that simplified the risk
    methodology, integrating the separate analyses for asset-based and
    geographic-based risk, and included more sensitivity analysis in
    determining what the final results of its risk analysis should be.
    While DHS stated that the department had made significant progress in
    developing its risk assessment methods, DHS officials told us that for
    the 2006 risk assessment process the department had limited knowledge
    of how changes to its risk assessment methods, such as adding asset
    types and using additional or different data sources, affected its risk
    estimates. For more information see Homeland Security Grants:
    Observations on Process DHS Used to Allocate Funds to Selected Urban
    Areas, GAO-07-381R; GAO-06-91; and GAO-05-434. Also, see Department of
    Homeland Security Office of Inspector General, Progress in Developing
    the National Asset Database, OIG-06-40 (Washington, D.C.: June 2006);
    DHS updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to identify and assess threats and
    vulnerabilities for critical infrastructure. For example, DHS has
    conducted over 2,600 vulnerability assessments on every critical
    infrastructure sector though the Comprehensive Review program, the
    Buffer Zone Protection Program, and the Site Assistance Visit program.
    DHS describes the Comprehensive Review as a structured, collaborative
    government and private sector analysis of high value critical
    infrastructure and key resources facilities. The purpose of the review
    is to explore exposure to potential terrorist attacks, their
    consequences, and the integrated prevention and response capabilities
    of stakeholders; Through the Buffer Zone Protection Program, and with
    the support of DHS, local authorities develop Buffer Zone Protection
    Plans, which DHS reported have several purposes, including identifying
    specific threats and vulnerabilities associated with the buffer zone
    and analyzing the level of risk associated with each vulnerability. DHS
    describes the Site Assistance Visit Program as an information gathering
    visit with several goals, such as better understanding and prioritizing
    vulnerabilities of critical infrastructure and key resources and
    increasing awareness of threats and vulnerabilities among critical
    infrastructure and key resources owners and operators. DHS has
    conducted a total of 49 Comprehensive Reviews, 1,900 Buffer Zone Plans,
    and 700 Site Assistance Visits and reported that more are scheduled
    throughout fiscal year 2007; The Coast Guard stated that it is a
    partner in the Comprehensive Review process and reported that the
    results of the Comprehensive Reviews and Port Security Assessments were
    entered into the Maritime Security Risk Analysis Model to prioritize
    risk according to a combination of possible threat, consequence, and
    vulnerability scenarios. The Coast Guard stated that under this
    approach, seaport infrastructure that was determined to be both a
    critical asset and a likely and vulnerable target would be a high
    priority for funding security enhancements while infrastructure that
    was vulnerable to attack but not as critical or that was very critical
    but already well-protected would be lower in priority. Further, DHS
    reported that through its Strategic Homeland Infrastructure Risk
    Assessment program, the Homeland Infrastructure Threat and Risk
    Analysis Center has developed a methodology for comparing and
    prioritizing risks across infrastructure sectors. According to DHS, the
    Center differentiates the relative probability of various threats. DHS
    stated that the Strategic Homeland Infrastructure Risk Assessment was
    produced in 2006 and it served as the National Critical Infrastructure
    and Key Resources Risk Profile in the 2006 National Critical
    Infrastructure and Key Resources Protection Annual Report. DHS reported
    that this risk assessment model provides a mechanism to capture threat
    estimates based on terrorist capability and the intent to attach
    critical infrastructure and key resources. The Homeland Infrastructure
    Threat and Risk Analysis Center provides sources for all analytical
    judgments and coordinates the threat analysis with the Intelligence
    Community. These estimates provide the basis for differentiating the
    relative probability of the threat for each scenario assessed in the
    Strategic Homeland Infrastructure Risk Assessment report. DHS also
    reported that the department uses information contained within the
    National Asset Database, further informed by comprehensive risk
    analysis, to facilitate prioritization of the support it provides to
    help secure the nation's infrastructure. DHS stated that in
    collaboration with the Sector-Specific Agencies and state governments,
    it has developed a list of the nation's most important infrastructure
    to assets to inform the 2007 grants program. DHS stated that this
    prioritization allows it to focus its planning, stakeholder
    interaction, and resource allocation on those sites with the potential
    to have a severe impact on public health, governance, the economy, or
    national security; Our assessment: We conclude that DHS has generally
    achieved this performance expectation, as DHS has taken a number of
    steps to identify and assess threats and vulnerabilities for critical
    infrastructure. For example, DHS has conducted over 2,600 vulnerability
    assessments on each of the 17 critical infrastructure sectors, and it
    has conducted a total of 49 Comprehensive Reviews, 1,900 Buffer Zone
    Plans, and 700 Site Assistance Visits and reported that more are
    scheduled throughout fiscal year 2007. DHS has also assessed threats
    and vulnerabilities through its risk estimates for the Urban Areas
    Security Initiative;
    Assessment: Generally achieved.

    Performance expectation: 7. Support efforts to reduce threats and
    vulnerabilities for critical infrastructure;
    Summary of findings: GAO findings: DHS has supported efforts to reduce
    threats and vulnerabilities for critical infrastructure. Supporting
    efforts have included targeted infrastructure protection grants,
    research and development, and sharing best practices. DHS has funded
    research in different critical infrastructure areas. In 2005, DHS
    released a national research and development plan supporting critical
    infrastructure protection, but acknowledged at the time, though, that
    it was a baseline plan and did not include an investment plan and road
    map that were to be added in 2006. In July 2005 we reported that in the
    area of cybersecurity DHS had initiated efforts to reduce threats by
    enhancing collaboration with the law enforcement community and to
    reduce vulnerabilities by shoring up guidance on software and system
    security. However, we reported that efforts were not completed and that
    vulnerability reduction efforts were limited until the cyber-related
    vulnerability assessments were completed. In February 2007 we reported
    that in fiscal year 2006, DHS provided approximately $1.7 billion in
    federal funding to states, localities, and territories through its
    Homeland Security Grant Program to prevent, protect against, respond
    to, and recover from acts of terrorism or other catastrophic events. In
    fiscal year 2006, DHS awarded approximately $711 million in Urban Areas
    Security Initiative grants, discretionary grants under the Homeland
    Security Grant Program--a 14 percent reduction in funds from the
    previous year--while the number of eligible urban areas identified by
    the risk assessment decreased from 43 to 35. In March 2007 we reported
    that DHS had used various programs to fund passenger rail security
    since 2003. For example, the fiscal year 2005 DHS appropriations act
    provided $150 million for intercity passenger rail transit, freight
    rail, and transit security grants. DHS used this funding to create and
    administer new programs focused specifically on transportation
    security, including the Transit Security Grant Program and the
    Intercity Passenger Rail Security Grant Program, which provided
    financial assistance to address security preparedness and enhancements
    for passenger rail and transit systems. During fiscal year 2006, DHS
    provided $110 million to passenger rail transit agencies through the
    Transit Security Grant Program and about $7 million to Amtrak through
    the Intercity Passenger Rail Security Grant Program. While DHS has
    distributed hundreds of millions of dollars in grants to improve
    passenger rail security, issues have surfaced about the grant process.
    As DHS works to refine its risk assessment methodologies, develop
    better means of assessing proposed investments using grant funds, and
    align grant guidance with the implementation of broader emergency
    preparedness goals, such as implementation of the National Preparedness
    Goal, it has annually made changes to the guidance for the various
    grants it administers. As a result of these annual changes, awardees
    and potential grant recipients must annually review and understand new
    information on the requirements for grant applications, including
    justification of their proposed use of grant funds. Further, while
    funds awarded through the Transit Security Grant Program can be used to
    supplement funds received from other grant programs, allowable uses are
    not clearly defined. For more information see Passenger Rail Security:
    Federal Strategy and Enhanced Coordination Needed to Prioritize and
    Guide Security Efforts, GAO-07-583T; GAO-07-381R; Information
    Security: Coordination of Federal Cyber Security Research and
    Development, GAO-06-811; GAO-05-827T; GAO-05-434; and Homeland
    Security: Much Is Being Done to Protect Agriculture from a Terrorist
    Attack, but Important Challenges Remain, GAO-05-214; DHS updated
    information: In March, April, and June 2007 DHS provided us with
    updated information on its efforts to support efforts to reduce threats
    and vulnerabilities for critical infrastructure. Through the Buffer
    Zone Protection Program, DHS reported that it assists local law
    enforcement to make it more difficult for terrorists to conduct
    surveillance or successfully launch attacks from the immediate vicinity
    of critical infrastructure and key resources targets. DHS reported that
    in fiscal years 2005 and 2006 Buffer Zone Protection Program grants
    awarded to the states totaled approximately $140 million. DHS stated
    that the program requires that funding be subgranted to the responsible
    jurisdictions in support of prevention and protection focused
    activities. DHS stated that of the approximately $140 million awarded,
    the majority, approximately $107 million, or approximately 76 percent,
    has gone to law enforcement organizations as subgrantees. DHS reported
    that the remaining funding was subgranted to other disciplines, such as
    emergency management, agriculture, and cyber security, with emergency
    management receiving the second highest proportion of the funds,
    approximately $18 million or 13 percent. DHS also reported that it is
    documenting, through the Vulnerability Reduction Purchasing Plan, how
    sub-grantees are utilizing grant money to reduce threats and
    vulnerabilities based on the Buffer Zone Plan, Buffer Zone Protection
    Program guidance, and the Authorized Equipment list, a DHS reference
    tool. Further, in April 2007, DHS released the Chemical Facilities
    Anti-Terrorism Standards, which established risk-based performance
    standards for the security of chemical facilities. DHS provided several
    examples of how the Nuclear Sector-Specific Agency, the Dams Sector-
    Specific Agency, the Chemical Sector-Specific Agency, and the
    Commercial Facilities Sector-Specific Agency have supported efforts to
    reduce threats and vulnerabilities for critical infrastructure. For
    example, DHS reported that the Dams Sector-Specific Agency is
    supporting a study on the vulnerabilities of dams to terrorist attacks
    using large aircraft impact as the attack scenarios and that the
    Nuclear Sector-Specific Agency has established the Comprehensive Review
    Outcomes Working Network to reach back to the sites where Comprehensive
    Reviews were conducted, identify the status of the gaps and potential
    enhancements identified by the team, and continue the open and candid
    dialogue between the government, industry, and State/local emergency
    services organizations. In addition, DHS reported that the department's
    Office for Bombing Prevention conducts capabilities assessments of
    public safety bomb squads, explosives detection canine teams, and
    public safety dive teams; Our assessment: We conclude that DHS has
    generally achieved this performance expectation. DHS has funded
    research in different critical infrastructure areas and, in the area of
    cybersecurity, initiated efforts to reduce threats by enhancing
    collaboration with the law enforcement community and to reduce
    vulnerabilities by shoring up guidance on software and system security.
    However, while DHS has taken steps to support efforts to reduce threats
    and vulnerabilities for critical infrastructure, our prior work has
    shown that challenges remain. For example, DHS has issued different
    targeted infrastructure protection grants, but allowable uses of some
    of these grants are not clearly defined. Further, DHS has released the
    Chemical Facilities Anti-Terrorism Standards, but it is too early to
    evaluate their impact; Assessment: Generally achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Limited Progress in the Area of Science and Technology:

    DHS's Science and Technology Directorate was established to coordinate
    the federal government's civilian efforts to identify and develop
    countermeasures to chemical, biological, radiological, nuclear, and
    other emerging terrorist threats to our nation. To coordinate the
    national effort to protect the United States from nuclear and
    radiological threats, in April 2005, the President directed the
    establishment of the Domestic Nuclear Detection Office within DHS. The
    new office's mission covers a broad spectrum of responsibilities and
    activities, but is focused primarily on providing a single accountable
    organization to develop a layered defense system. This system is
    intended to integrate the federal government's nuclear detection,
    notification, and response systems. In addition, under the directive,
    the Domestic Nuclear Detection Office is to acquire, develop, and
    support the deployment of detection equipment in the United States, as
    well as to coordinate the nation's nuclear detection research and
    development efforts.

    As shown in table 32, we identified six performance expectations for
    DHS in the area of science and technology, and we found that overall
    DHS has made limited progress in meeting those performance
    expectations. In particular, we found that DHS has generally achieved
    one performance expectation and has generally not achieved five other
    performance expectations.

    Table 32: Performance Expectations and Progress Made in Science and
    Technology:

    Performance expectation: 1. Develop a plan for departmental research,
    development, testing, and evaluation activities;
    Assessment: Generally not achieved.

    Performance expectation: 2. Assess emerging chemical, biological,
    radiological, and nuclear threats and homeland security
    vulnerabilities;
    Assessment: Generally not achieved.

    Performance expectation: 3. Coordinate research, development, and
    testing efforts to identify and develop countermeasures to address
    chemical, biological, radiological, nuclear, and other emerging
    terrorist threats;
    Assessment: Generally not achieved.

    Performance expectation: 4. Coordinate deployment of nuclear,
    biological, chemical, and radiological detection capabilities and other
    countermeasures;
    Assessment: Generally not achieved.

    Performance expectation: 5. Assess and evaluate nuclear, biological,
    chemical, and radiological detection capabilities and other
    countermeasures;
    Assessment: Generally not achieved.

    Performance expectation: 6. Coordinate with and share homeland security
    technologies with federal, state, local, and private sector entities;
    Assessment: Generally achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 1;
    Assessment: Generally not achieved: 5;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 33 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of science and technology and our assessment of whether DHS
    has taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 33: Performance Expectations and Assessment of DHS Progress in
    Science and Technology:

    Performance expectation: 1. Develop a plan for departmental research,
    development, testing, and evaluation activities;
    Summary of findings: GAO and DHS IG findings: DHS has not yet developed
    a plan for its research, development, testing, and evaluation
    activities to achieve this performance expectation. In 2004, we
    reported that DHS was still developing a strategic plan to identify
    priorities, goals, objectives, and policies for the research and
    development of countermeasures to nuclear, biological, chemical, and
    other emerging terrorist threats. We reported that completion of this
    strategic plan was delayed because much of the time since DHS's March
    2003 creation had been spent organizing the Science and Technology
    Directorate, developing policies and procedures, and hiring necessary
    staff. In addition, the DHS IG has reported that the Science and
    Technology Directorate had to contend with a set of administrative and
    logistical challenges similar to those encountered by other startup
    ventures, including the inability to hire personnel quickly who can
    work in a secure environment, the lack of centralized space, and the
    lack of consistent information technology systems and procurement
    support. For more information, see Homeland Security: DHS Needs to
    Improve Ethics-Related Management Controls for the Science and
    Technology Directorate, GAO-06-206; Transportation Security R&D: TSA
    and DHS Are Researching and Developing Technologies, but Need to
    Improve R&D Management, GAO-04-890; and Homeland Security: DHS Needs a
    Strategy to Use DOE's Laboratories for Research on Nuclear, Biological,
    and Chemical Detection and Response Technologies, GAO-04-653. Also, see
    Department of Homeland Security Office of Inspector General, Survey of
    the Science and Technology Directorate, OIG-04-24 (Washington, D.C.:
    March 2004); DHS updated information: In March and April 2007, DHS
    provided us with updated information on its efforts to develop a plan
    and strategy for research, development, testing, and evaluation
    activities. The department reported that it has put into place a
    combined organization and research portfolio strategy within the
    Science and Technology Directorate aimed at identifying and
    transitioning homeland security capabilities to customers. As part of
    these efforts, DHS developed its FY2007-2008 Science and Technology
    Execution Plan, which details the Science and Technology Directorate's
    research, development, testing, and evaluation activities planned for
    those years. The plan includes an overview of the mission, strategy,
    and function of each Science and Technology Directorate division. DHS
    has also developed and released its Technology Development and Transfer
    report, which provides information on the department's strategy and
    approach to homeland security research, development, testing, and
    evaluation. In June 2007, DHS released the Science and Technology
    Directorate Strategic Plan, which included the Science and Technology
    Directorate Five-Year Research and Development Plan (fiscal years 2007
    through 2011); Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. Since our prior work, DHS has
    developed plans and reports that, according to the department, reflect
    its overall strategy for research, development, testing, and evaluation
    activities. However, our assessment of these plans and reports shows
    that they do not include key elements of a strategic plan, such as
    goals, measures, and milestones. For example, the FY2007-2008 Science
    and Technology Execution Plan discusses activities for a 2-year period
    and does not include performance measures and goals for the
    department's research, development, testing, and evaluation
    activities. The report on Technology Development and Transfer provides
    a framework for how the Science and Technology Directorate plans to
    conduct its activities but does not define the work to be undertaken by
    the directorate. The Science and Technology Directorate Strategic Plan
    and associated Five-Year Research Development Plan provide information
    on deliverables and milestones for fiscal years 2007 through 2011.
    However, these plans do not include goals and measures for the
    department's science and technology activities. In addition, according
    to the department, these plans do not address the requirement in the
    Homeland Security Act of 2002 for the department to develop a national
    policy and strategic plan for identifying priorities, goals,
    objectives, and policies for, and coordinating the federal government's
    civilian efforts to identify and develop countermeasures to chemical,
    biological, and other emerging terrorist threats, upon which this
    performance expectation is, in part, based;
    Assessment: Generally not achieved.

    Performance expectation: 2. Assess emerging chemical, biological,
    radiological, and nuclear threats and homeland security
    vulnerabilities;
    Summary of findings: GAO findings: In 2004, we reported that DHS was in
    the process of conducting risk assessments of various critical
    infrastructure sectors. We reported that in the absence of completed
    risk assessments, DHS officials were using available threat
    intelligence, expert judgment, congressional mandates, mission needs,
    and information about past terrorist incidents to select and prioritize
    their research and development projects. For more information, see GAO-
    04-890; DHS updated information: In March and April 2007, DHS provided
    us with updated information on its efforts to assess emerging chemical,
    biological, radiological, and nuclear threats and homeland security
    vulnerabilities. In fiscal year 2006, DHS completed and distributed the
    Bioterrorism Threat Risk Assessment that calculates risk for 28
    biological threats agents considered in the context of numerous
    possible scenarios, including aerosol dissemination and food and water
    contamination. According to DHS, the process used for determining
    bioterrorism risks included estimating the probabilities of occurrence
    for the scenarios under consideration and then calculating consequences
    for those scenarios should they occur. DHS reported that the
    Bioterrorism Threat Risk Assessment has been used as a basis for other
    assessments, the definition of intelligence collection requirements,
    and technology development and to help decision makers evaluate
    possible risk mitigation strategies. The Science and Technology
    Directorate is currently updating this assessment to include
    agricultural and economic effects and plans to reissue it in fiscal
    year 2008. DHS reported that it is currently conducting a Chemical
    Threat Risk Assessment and the Integrated Chemical, Biological,
    Radiological, and Nuclear Assessment to be delivered in June 2008. DHS
    is also conducting four chemical threat assessments, and these threat
    assessments are known as Population Threat Assessments. Each Population
    Threat Assessment depicts a plausible, high-consequence scenario and
    addresses aspects of an attack process, including the possible
    acquisition, production, and dissemination of agents that could result
    in a high consequence event. The assessment then provides an estimate
    of the number of people potentially exposed to different doses of the
    threat. The Population Threat Assessments are intended to assess
    potential human exposures from a chemical, biological, radiological, or
    nuclear event and provide population exposure estimates to perform
    consequence modeling studies. Moreover, according to DHS, the
    Biodefense Knowledge Center and the Chemical Security Analysis Center
    assess known and emerging threats and issue Technical Bulletins on
    threats and vulnerabilities; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. DHS has completed
    some assessments on biological and chemical threats and
    vulnerabilities. However, DHS is still in the process of completing
    assessments in the chemical sector as well as its Integrated Chemical,
    Biological, Radiological, and Nuclear Assessment. Although DHS plans to
    take actions to assess threats and vulnerabilities over time, including
    updating past assessments, DHS's assessment efforts overall appear to
    be the early stages, and substantial more work remains for DHS to more
    fully conduct assessments of chemical, biological, radiological, and
    nuclear threats;
    Assessment: Generally not achieved.

    Performance expectation: 3. Coordinate research, development, and
    testing efforts to identify and develop countermeasures to address
    chemical, biological, radiological, nuclear, and other emerging
    terrorist threats;
    Summary of findings: GAO findings: In prior work we reported that with
    the creation of the Domestic Nuclear Detection Office in April 2005,
    DHS took an important step in coordinating national research efforts to
    address emerging threats. Among other responsibilities, the Domestic
    Nuclear Detection Office is taking the lead in developing a "global
    architecture," an integrated approach to detecting and stopping nuclear
    smuggling. However, we reported that because the Domestic Nuclear
    Detection Office was created so recently, these efforts are in their
    early stages of development and implementation. With regard to
    radiation portal monitors, in March 2006 we reported that DHS has
    sponsored research, development, and testing activities that attempt to
    improve the capabilities of existing radiation portal monitors and to
    produce new, advanced technologies with even greater detection and
    identification enhancements. However, we noted that much work remained
    for the agency to achieve consistently better detection capabilities.
    For example, DHS sponsored the development of a software package
    designed to reduce the number of false alarms from portal monitors
    already in widespread use. Further, we found that DHS was testing
    advanced portal monitors that use a technology designed to both detect
    the presence of radiation and identify its source. In addition, we
    reported that DHS has sponsored a long-range research program aimed at
    developing innovative technologies designed to improve the capabilities
    of radiation detection equipment. More recently, in October 2006 we
    reported that the Domestic Nuclear Detection Office's cost-benefit
    analysis for the acquisition and deployment of new portal monitors did
    not provide a sound analytical basis for the office's decision to
    purchase and deploy new portal monitor technology. Specifically, we
    reported that the Domestic Nuclear Detection Office did not use the
    results of its own performance tests in its cost-benefit analysis and
    instead relied on assumptions of the new technology's anticipated
    performance level. Furthermore, the analysis did not include the
    results from side-by-side tests that the Domestic Nuclear Detection
    Office conducted of the advanced portal monitors and current portal
    monitors. The cost-benefit analysis for acquiring and deploying portal
    monitors was also incomplete because it did not include all of the
    major costs and benefits required by DHS guidelines. In particular, the
    Domestic Nuclear Detection Office did not assess the likelihood that
    radiation detection equipment would either misidentify or fail to
    detect nuclear or radiological material. Rather, it focused its
    analysis on reducing the time necessary to screen traffic at border
    checkpoints and reduce the impact of any delays on commerce. In March
    2007, we reported that the Domestic Nuclear Detection Office had not
    yet collected a comprehensive inventory of testing information on
    commercially available portal monitors. Such information--if collected
    and used--could improve the office's understanding of how well portal
    monitors detect different radiological and nuclear materials under
    varying conditions. In turn, this understanding would assist the
    Domestic Nuclear Detection Office's future testing, development,
    deployment, and purchases of portal monitors. We also reported that the
    Domestic Nuclear Detection Office has been improving its efforts to
    provide technical and operational information about radiation portal
    monitors to state and local authorities. For example, the office helped
    to establish a Web site that, among other things, includes information
    for state and local officials on radiation detection equipment products
    and performance requirements. However, some state representatives,
    particularly those from states with less experience conducting
    radiation detection programs, would like to see the Domestic Nuclear
    Detection Office provide more prescriptive advice on what types of
    radiation detection equipment to deploy and how to use it. For more
    information, see Combating Nuclear Smuggling: DNDO Has Not Yet
    Collected Most of the National Laboratories' Test Results on Radiation
    Portal Monitors in Support of DNDO's Testing and Development Program,
    GAO-07-347R; Combating Nuclear Smuggling: DHS Has Made Progress
    Deploying Radiation Detection Equipment at U.S. Ports-of-Entry, but
    Concerns Remain, GAO-06-389; Combating Nuclear Smuggling: DHS's Cost-
    Benefit Analysis to Support the Purchase of New Radiation Detection
    Portal Monitors Was Not Based on Available Performance Data and Did Not
    Fully Evaluate All the Monitors' Costs and Benefits, GAO-07-133R; and
    GAO-04-653; DHS updated information: In March and April 2007, DHS
    provided us with updated information on its efforts to coordinate
    research, development, and testing efforts to identify and develop
    countermeasures to address threats. According to DHS, the Science and
    Technology Directorate is currently developing and testing several
    systems to provide the technology needed to counter the use of chemical
    and biological weapons. There are currently 6 projects under
    development as chemical countermeasures and 10 projects for biological
    counter measures. These countermeasures include sensors, detection
    capabilities, and identification systems. DHS also reported that the
    interagency Technical Support Working Group has worked with the DHS
    Science and Technology Directorate to identify technologies that could
    assist DHS customers in addressing their capability gaps. The DHS
    Science and Technology Directorate also noted that it has taken steps,
    such as establishing an International Program Division, to coordinate
    efforts with international partners. DHS also reported that it works
    with other federal agencies and entities to coordinate research and
    development activities, including the National Science and Technology
    Council's Committee on Homeland and National Security; the National
    Nuclear Security Administration; the Departments of Defense, Energy,
    Health and Human Services; the Food and Drug Administration; the
    Centers for Disease Control; and the Environmental Protection Agency.
    DHS reported that in 2004 it started four Regional Technology
    Integration pilots to test chemical and biological explosives detection
    systems; planning and exercise tools to evaluate performance; and
    technologies for credentialing emergency responders and verifying
    victims' identities during an incident; Our assessment: We conclude
    that DHS has generally not achieved this performance expectation. DHS
    has taken some actions to coordinate research, development, and testing
    efforts to identify and develop countermeasures to address various
    threats. Specifically, DHS has taken actions to develop and test
    various capabilities to detect the presence of radiation in cargo
    entering the United States. DHS has also coordinated research,
    development, and testing activities for detecting and identifying
    biological and chemical threats. However, DHS has not always
    comprehensively collected testing shared information with regard to
    radiation portal monitors, and some state officials have identified
    concerns in the advice on the monitors provided by DHS. Moreover, as
    previously discussed, DHS has completed some assessments of threats and
    vulnerabilities and is in the processing of conducting others. Until
    these assessments are completed across the nuclear, radiological,
    biological, and chemical sectors, DHS may not fully know what
    technologies or countermeasures and associated requirements are needed
    to address identified threats and vulnerabilities;
    Assessment: Generally not achieved.

    Performance expectation: 4. Coordinate deployment of nuclear,
    biological, chemical and radiological detection capabilities and other
    countermeasures;
    Summary of findings: GAO findings: In prior work, we reported on the
    progress DHS has made in coordinating the deployment of capabilities
    for screening containerized shipments entering the United States. As of
    February 2006, CBP estimated that it had the ability to screen about 62
    percent of all containerized shipments entering the United States and
    roughly 77 percent of all private vehicles. However, we reported that
    CBP and Pacific Northwest National Laboratory were behind schedule in
    deploying radiation portal monitors and would have to increase the
    speed of deployment by almost 230 percent in order to meet their
    September 2009 program completion date. For more information, see GAO-
    06-389 and GAO-04-890; DHS updated information: In March and April
    2007, DHS provided us with updated information on its efforts to
    coordinate the deployment of nuclear, biological, chemical, and
    radiological detection capabilities and countermeasures. For example,
    DHS reported as of March 2007, it was scanning 91 percent of
    containerized cargo entering the United States by land and sea for
    radiation, deploying 283 new portal monitors in fiscal year 2006 and
    bringing the total number of deployed portal monitors to 966 as of
    March 9, 2007. DHS has deployed the BioWatch system, a biological and
    chemical aerosol monitoring system, in more than 30 cities nationwide
    to provide early warning of a bio-attack. DHS also reported that it is
    piloting the Biological Warning and Incident Characterization system to
    better and more rapidly characterize the public health effects of a
    BioWatch positive indication. DHS also reported that it has deployed
    the Rapidly Deployable Chemical Defense Systems to multiple national
    security special events. This system is a network of chemical ground-
    based detectors and aerial surveillance monitors that can identify
    specific chemical compounds and image the impact of a downwind chemical
    hazard. DHS has also deployed the Program for Response Options and
    Technology Enhancements for Chemical Terrorism that detects the release
    of toxic chemical agents in subway systems. In addition, through the
    Public Health Actionable Assays project, DHS is working to establish
    sampling evaluation and biodetection standards by developing a
    mechanism for rigorous, independent evaluation and validation of Assay
    Technologies; Our assessment: We conclude that DHS has generally not
    yet achieved this performance expectation. DHS has taken actions to
    coordinate the deployment of various chemical, biological,
    radiological, and nuclear detection capabilities and countermeasures.
    In particular, DHS has deployed various systems to ports of entry, for
    example, to detect possible nuclear or radiological materials entering
    the United States. DHS has also deployed systems to detect the presence
    of biological or chemical agents in the air and to provide warning of
    the presence of these agents. However, DHS generally did not provide us
    with documentation on its efforts to coordinate the deployment of
    countermeasures beyond radiation detection capabilities at ports of
    entry and monitoring of possible aerosol-based attacks. Moreover, as
    previously discussed, DHS has completed some assessments of threats and
    vulnerabilities and is in the processing of conducting others. Until
    these assessments are completed across the nuclear, radiological,
    biological, and chemical sectors, DHS may not fully know what
    technologies or countermeasures and associated requirements are needed
    to address identified threats and vulnerabilities. Although we see
    progress in DHS's activities for deploying capabilities and
    countermeasures, much more work is needed for us to conclude that DHS
    has generally achieved this performance expectation;
    Assessment: Generally not achieved.

    Performance expectation: 5. Assess and evaluate nuclear, biological,
    chemical, and radiological detection capabilities and other
    countermeasures;
    Summary of findings: GAO findings: In prior work we reported on the
    effort to test radiation detection equipment. We reported that in
    February 2005, DHS sponsored testing of commercially available portal
    monitors, isotope identifiers, and pagers against criteria set out in
    American National Standards Institute standards. These standards
    provided performance specifications and test methods for testing
    radiation detection equipment, including portal monitors and handheld
    devices. The actual testing was performed by four Department of Energy
    laboratories, with coordination, technical management, and data
    evaluation provided by the Department of Commerce's National Institute
    for Standards and Technology. The laboratories tested a total of 14
    portal monitors from eight manufacturers against 29 performance
    requirements in the standards. Overall, none of the radiation detection
    equipment, including the portal monitors and handheld devices deployed
    by CBP, met all of the performance requirements in this first round of
    testing. However, according to Science and Technology Directorate
    officials, many of the limitations noted in CBP's equipment were
    related to withstanding environmental conditions--not radiation
    detection or isotope identification. More recently, in March 2007 we
    reported that the Domestic Nuclear Detection Office had not yet
    collected a comprehensive inventory of testing information on
    commercially available polyvinyl toluene portal monitors, which detect
    the presence of radiation but cannot distinguish between benign,
    naturally occurring radiological materials, such as ceramic tile, and
    dangerous materials, such as highly enriched uranium. We reported that
    such information--if collected and used--could improve the Domestic
    Nuclear Detection Office's understanding of how well portal monitors
    detect different radiological and nuclear materials under varying
    conditions. In turn, this understanding would assist the Domestic
    Nuclear Detection Office's future testing, development, deployment, and
    purchases of portal monitors. Radiation detection experts with the
    national laboratories and industry told us that, in their view, the
    Domestic Nuclear Detection Office should collect and maintain all the
    national laboratory test reports on commercially available portal
    monitors because these reports provide a comprehensive inventory of how
    well portal monitors detect a wide variety of radiological and nuclear
    materials and how environmental conditions and other factors may affect
    performance. For more information, see GAO-07-347R and GAO-06-389; DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to assess and evaluate nuclear,
    biological, chemical, and radiological detection capabilities and
    countermeasures. DHS reported that the Domestic Nuclear Detection
    Office has conducted a variety of tests on radiation portal monitors.
    In addition, DHS reported that the Domestic Nuclear Detection Office
    has worked with various partners to develop a global nuclear detection
    architecture that identifies vulnerabilities and is used by DHS and its
    partners as a basis for assessing gaps in detection capabilities and
    identifying possible paths from the original source of the radiological
    or nuclear material to targets within the United States. DHS also
    reported that it has evaluated the capabilities it has deployed to
    address chemical and biological threats, including BioWatch and Rapidly
    Deployable Chemical Detection Systems. In addition, DHS has
    participated in efforts to develop and assess a set of procedures,
    plans, and technologies to rapidly restore transportation nodes
    following a biological attack, with a focus on major international
    airports; Our assessment: We conclude that DHS has generally not yet
    achieved this performance expectation. DHS has undertaken efforts to
    assess its chemical, biological, radiological, and nuclear detection
    capabilities, including radiation portal monitors and BioWatch.
    However, we identified concerns about DHS's efforts to collect and
    analyze data on the results of testing of radiation mortal monitors,
    and DHS did not provide us with evidence on the results of its efforts
    to assess countermeasures deployed to address chemical, biological,
    radiological, and nuclear threats. Although we see progress in DHS's
    activities for assessing deployed capabilities and countermeasures,
    much more work is needed for us to conclude that DHS has generally
    achieved this performance expectation;
    Assessment: Generally not achieved.

    Performance expectation: 6. Coordinate with and share homeland security
    technologies with federal, state, local, and private sector entities;
    Summary of findings: GAO and DHS IG findings: DHS has taken actions to
    coordinate with homeland security partners. For example, DHS has
    coordinated with some interagency groups, including the National
    Security Council's Policy Coordinating Committee for Counterterrorism
    and National Preparedness. DHS also cochairs a standing committee on
    Homeland and National Security in the White House's Office of Science
    and Technology Policy. This committee identifies key areas requiring
    interagency coordination in the formulation of research and development
    agendas. DHS has also worked with the Technical Support Working Group-
    -an interagency working group of representatives from over 80 federal
    agencies that is jointly overseen by the Departments of State and
    Defense. DHS also coordinated some of its research and development
    projects with other federal agencies. For example, DHS is responsible
    for BioWatch, a federal program that monitors about 30 major cities for
    chemical and biological threats. BioWatch is executed jointly by DHS,
    Department of Energy's laboratories, the Environmental Protection
    Agency, and the Centers for Disease Control and Prevention. In March
    2007, we reported that with regard to radiation portal monitors, the
    Domestic Nuclear Detection Office has been improving its efforts to
    provide technical and operational information about radiation portal
    monitors to state and local authorities. For example, the Domestic
    Nuclear Detection Office recently helped to establish a Web site that,
    among other things, includes information for state and local officials
    on radiation detection equipment products and performance requirements.
    However, some state representatives with whom we spoke, particularly
    those from states with less experience conducting radiation detection
    programs, would like to see the Domestic Nuclear Detection Office
    provide more prescriptive advice on what types of radiation detection
    equipment to deploy and how to use it. For more information, see GAO-
    07-347R, GAO-04-653, and GAO-04-890; DHS updated information: In March
    and April 2007, DHS provided us with updated information on its efforts
    to coordinate with and share homeland security technologies with
    federal, state, local, and private sector entities. For example, DHS
    reported that the Domestic Nuclear Detection Office has supported the
    Domestic Nuclear Defense Research and Development Working Group to
    develop a coordinated research and development roadmap for domestic
    nuclear defense efforts. Specifically, this working group coordinates
    research and development strategies for domestic nuclear defense, the
    identification and filling of technology gaps, efforts to develop and
    sustain capabilities through appropriate investments in science and
    research, interagency funding for science and technology, and
    collaboration and exchange of research and development information. DHS
    reported that this working group's initial report was completed in
    January 2006 and that the roadmap is currently being updated, with a
    scheduled completion date of September 2007. The DHS Science and
    Technology Directorate reported that its Technology Clearinghouse and
    TechSolutions initiatives provide direct support to emergency
    responders. The Technology Clearinghouse is designed to provide access
    to technology information for federal, state, and local public safety
    and first responder entities. TechSolutions provides a Web-based
    mechanism for first responders to provide information on their
    capability gaps. The Science and Technology Directorate responds by
    identifying existing technology that could meet the need or, if no
    existing technology is available, to prototype a possible solution. DHS
    has also signed a memorandum of understanding with the Department of
    Health and Human Services, the Department of Defense, the Department of
    Justice, and the U.S. Postal Service for the coordination of air
    monitoring programs and, among other things, the development a national
    architecture and joint technology roadmap for investing in technologies
    for monitoring biological threats. Moreover, the Science and Technology
    Directorate has established centers for analysis and development
    efforts with other federal agencies. In addition, metropolitan subway
    systems have taken over operation of the Program for Response Options
    and Technology Enhancements for Chemical Terrorism, a system that
    detects releases of toxic chemical agents; Our assessment: We conclude
    that DHS has generally achieved this performance expectation. DHS has
    taken actions to coordinate with and share homeland security
    technologies with a wide variety of partners;
    Assessment: Generally achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Modest Progress in Acquisition Management:

    Federal agencies use a variety of approaches and tools, including
    contracts, to acquire goods and services needed to fulfill or support
    the agencies' missions. DHS has some of the most extensive acquisition
    needs within the U.S. government. In fiscal year 2004, for example, the
    department obligated $9.8 billion to acquire a wide range of goods and
    services--such as information systems, new technologies, weapons,
    aircraft, ships, and professional services. In fiscal year 2006, the
    department reported that it obligated $15.6 billion to acquire a wide
    range of goods and services. The DHS acquisitions portfolio is broad
    and complex. For example, the department has purchased increasingly
    sophisticated screening equipment for air passenger security; acquired
    technologies to secure the nation's borders; purchased trailers to meet
    the housing needs of Hurricane Katrina victims; and is upgrading the
    Coast Guard's offshore fleet of surface and air assets. DHS has been
    working to integrate the many acquisition processes and systems that
    the disparate agencies and organizations brought with them when they
    merged into DHS in 2003 while still addressing ongoing mission
    requirements and emergency situations, such as responding to Hurricane
    Katrina.

    As shown in table 34, we identified three performance expectations for
    DHS in the area of acquisition management and found that overall DHS
    has made modest progress in meeting those expectations. Specifically,
    we found that DHS has generally achieved one and not achieved two of
    the three performance expectations.

    Table 34: Performance Expectations and Progress Made in Acquisition
    Management:

    Performance expectation: 1. Assess and organize acquisition functions
    to meet agency needs;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop clear and transparent policies and
    processes for all acquisitions;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop an acquisition workforce to
    implement and monitor acquisitions;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 1;
    Assessment: Generally not achieved: 2;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 35 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of acquisition management and our assessment of whether DHS
    has taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 35: Performance Expectations and Assessment of DHS Progress in
    Acquisition Management:

    Performance expectation: 1. Assess and organize acquisition functions
    to meet agency needs;
    Summary of findings: GAO findings: DHS has taken positive steps to
    assess and organize acquisition functions within the department to meet
    agency needs, but more work remains. For example, the department has
    developed an acquisition oversight plan that it expects to be fully
    implemented during fiscal year 2007. The Chief Procurement Officer has
    taken several actions to implement the plan--which generally
    incorporates basic principles of an effective and accountable
    acquisition function. The plan monitors acquisition performance through
    four recurring reviews: self-assessment, operational status, on-site,
    and acquisition planning. Each component has completed the first self-
    assessment, which has helped components to identify and prioritize
    acquisition weaknesses. In addition, each component has submitted an
    initial operational status report to the Chief Procurement Officer and
    on-site reviews are being conducted. However, the plan is in the
    process of being implemented, and is just one of the mechanisms to
    oversee DHS acquisitions. For example, there is a separate investment
    review process established to oversee major, complex acquisitions.
    Regarding the organization of the acquisition function, the October
    2004 management directive entitled "Acquisition Line of Business
    Integration and Management" provided the department's principal
    guidance for "leading, governing, integrating, and managing" the
    acquisition function. This directive states that DHS will create
    departmentwide acquisition policies and procedures and continue to
    consolidate and integrate the number of systems supporting the
    acquisition function. However, our prior work found that the Chief
    Procurement Officer's enforcement authority over procurement decisions
    at the component agencies was unclear. In addition, according to the
    directive, the Coast Guard and Secret Service were exempt from
    complying with the management directive. DHS officials have stated that
    they are in the process of modifying the lines of business management
    directive to ensure that no contracting organization is exempt. DHS
    stated that the Under Secretary for Management has authority as the
    Chief Acquisition Officer to monitor acquisition performance, establish
    clear lines of authority for making acquisition decisions, and manage
    the direction of acquisition policy for the department. They further
    stated that these authorities devolve to the Chief Procurement Officer.
    In addition, DHS reported significant progress in staffing of the
    Office of the Chief Procurement Officer and stated that these
    additional personnel will significantly contribute to improvement in
    the DHS acquisition and contracting enterprise. For more information,
    see Progress and Challenges in Implementing the Department's
    Acquisition Oversight Plan, GAO-07-900; Ongoing Challenges in Creating
    an Effective Acquisition Organization, GAO-07-948T; Interagency
    Contracting: Improved Guidance, Planning, and Oversight Would Enable
    the Department of Homeland Security to Address Risks, GAO-06-996;
    Homeland Security: Further Action Needed to Promote Successful Use of
    Special DHS Acquisition Authority, GAO-05-136; Homeland Security:
    Challenges in Creating an Effective Acquisition Organization, GAO-06-
    1012T; and Homeland Security: Successes and Challenges in DHS's Efforts
    to Create an Effective Acquisition Organization, GAO-05-179; DHS
    updated information: DHS provided additional information on its efforts
    to assess and organize acquisition functions. For example, DHS reported
    the Chief Procurement Officer has some means to influence components
    compliance with procurement policies and procedures. DHS also reported
    that the Chief Procurement Officer meets monthly with the Component
    Heads of Contracting Activities to discuss and address issues and
    common problems. According to DHS, the Chief Procurement Officer has
    asked the component heads to align their performance goals with the
    Chief Procurement Officer goals and has direct input into components'
    performance assessments. DHS reported that the Chief Procurement
    Officer is developing a series of common metrics to assess the status
    of acquisition activities within DHS. In addition, the Under Secretary
    for Management testified that he is examining the authorities of the
    Chief Procurement Officer to determine whether any change is needed;
    Our assessment: We conclude that DHS has generally achieved this
    performance expectation. Modifying the acquisition lines of business
    management directive to ensure that no DHS contracting organization is
    exempt is a positive step. However, until DHS formally designates the
    Chief Acquisition Officer, and modifies applicable management
    directives to support this designation, DHS's existing policy of dual
    accountability between the component heads and the Chief Procurement
    Officer leaves unclear the Chief Procurement Officer's authority to
    enforce corrective actions to achieve the department's acquisition
    goals;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop clear and transparent policies and
    processes for all acquisitions;
    Summary of findings: GAO findings: DHS has not yet developed clear and
    transparent policies and processes for all acquisitions. For example,
    DHS put into place an investment review process that adopts many
    acquisition best practices to help the department reduce risk and
    increase the chances for successful investment in terms of cost,
    schedule, and performance. However, in 2005, we found that the process
    did not include critical management reviews to help ensure that the
    design for the product performs as expected and that resources match
    customer needs before any funds are invested. Our prior work on large
    DHS acquisition programs, such as TSA's Secure Flight program and the
    Coast Guard's Deepwater program, highlight the need for improved
    oversight of contractors and adherence to a rigorous management review
    process. The investment review process is still under revision and the
    department's performance and accountability report for fiscal year 2006
    stated that DHS will incorporate changes to the process by the first
    quarter of fiscal year 2008. In addition, we found that DHS does not
    have clear guidance for all types of acquisitions, such as how to
    manage the risks of interagency contracting. The management of this
    contracting method was identified as a governmentwide high-risk area in
    2005 as a result of improper use. For more information, see GAO-07-
    948T; GAO-06-996; GAO-06-1012T; and GAO-05-179; DHS updated
    information: DHS provided us with updated information on its efforts to
    develop clear policies and processes for acquisitions. DHS reported
    that the department has been working to integrate its organizations
    through common policies and procedures under the Homeland Security
    Acquisition Regulation and the Homeland Security Acquisition Manual.
    DHS also reported that the Chief Procurement Officer works with the
    Component Heads of Contracting Activities to ensure all acquisitions
    are handled according to DHS policies and procedures; Our assessment:
    We conclude that DHS has generally not achieved this performance
    expectation. DHS did not provide us with documentation of its efforts
    to ensure that all acquisitions follow DHS's policies and procedures
    and address challenges we previously identified in DHS's acquisition
    process. For example, DHS did not report progress on efforts to address
    weaknesses we identified in its investment review process, including
    the lack of critical management reviews to help ensure that the design
    of the product performs as expected and that resource match customer
    needs. We also reported that DHS lacked guidance for managing certain
    types of acquisitions, such as how to manage interagency contracting
    risks, and DHS did not provide us with updated guidance;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop an acquisition workforce to
    implement and monitor acquisitions;
    Summary of findings: GAO findings: DHS has taken initial steps needed
    to develop a workforce to ensure that acquisitions are effectively
    implemented and monitored, but more work remains. Our reviews have
    found staffing shortages led the Office of Procurement Operations to
    rely extensively on outside agencies for contracting support in order
    to meet contracting needs of several component organizations. Our work
    on contracting issues following Hurricane Katrina indicated that the
    number of contract monitoring staff available was not always
    sufficient, nor were they effectively deployed to provide sufficient
    oversight. Based on work at the U.S. Immigration and Naturalization
    Service, in July 2003, we recommended that DHS develop a data-driven
    assessment of the department's acquisition personnel, resulting in a
    workforce plan that would identify the number, location, skills, and
    competencies of the workforce. In 2005, we reported on disparities in
    the staffing levels and workload imbalance among the component
    procurement offices. We recommended that DHS conduct a departmentwide
    assessment of the number of contracting staff, and if a workload
    imbalance were to be found, take steps to correct it by realigning
    resources. In 2006, DHS reported significant progress in providing
    staff for the component contracting offices, though much work remained
    to fill the positions with qualified, trained acquisition
    professionals. DHS has established a goal of aligning procurement
    staffing levels with contract spending at its various components by the
    last quarter of fiscal year 2009. For more information, see
    Catastrophic Disasters: Enhanced Leadership, Capabilities, and
    Accountability Controls Will Improve the Effectiveness of the Nation's
    Preparedness, Response, and Recovery System, GAO-06-618; Contract
    Management: INS Contracting Weaknesses Need Attention from the
    Department of Homeland Security, GAO-3-799; GAO-06-996; and GAO-05-179;
    DHS updated information: DHS provided us with additional information on
    its efforts to develop an acquisition workforce. DHS reported that it
    authorized the Office of the Chief Procurement Officer 25 full-time
    equivalents for fiscal year 2007 and has requested an additional 25
    full-time equivalents for fiscal year 2008. According to DHS, these
    additional full-time equivalents will allow the Chief Procurement
    Officer to complete staffing of its procurement oversight and
    management functions and provide staff for other acquisition functions,
    such as program management and cost analysis. In addition, DHS reported
    that it requested funding in fiscal year 2008 to establish a centrally
    managed acquisition intern program and provide acquisition training to
    the DHS acquisition workforce; Our assessment: We conclude that DHS
    generally has not achieved this performance expectation. DHS has much
    work to fill approved positions and has not corrected workload
    imbalances among component organizations;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Modest Progress in Financial Management:

    Effective financial management is a key element of financial
    accountability. With its establishment by the Homeland Security Act of
    2002, DHS inherited a myriad of redundant financial management systems
    from 22 diverse agencies, along with about 100 resource management
    systems and 30 reportable conditions identified in prior component
    financial audits. Additionally, most of the 22 components that
    transferred to DHS had not been subjected to significant financial
    statement audit scrutiny prior to their transfer, so the extent to
    which additional significant internal control deficiencies existed was
    unknown. DHS's Office of the Chief Financial Officer is responsible for
    functions, such as budget, finance and accounting, strategic planning
    and evaluation, and financial systems for the department. The Office of
    the Chief Financial Officer is also charged with ongoing integration of
    these functions within the department. For fiscal year 2006, DHS was
    again unable to obtain an opinion on its financial statements, and
    numerous material internal control weaknesses continued to be reported.
    DHS's auditor had issued a disclaimer of opinion on DHS's fiscal years
    2003, 2004, and 2005 financial statements.

    As shown in table 36, we identified seven performance expectations for
    DHS in the area of financial management and found that overall DHS has
    made modest progress meeting those performance expectations.
    Specifically, we found that DHS has generally achieved two performance
    expectations and has generally not achieved five others.

    Table 36: Performance Expectations and Progress Made in Financial
    Management:

    Performance expectation: 1. Designate a department Chief Financial
    Officer who is appointed by the President and confirmed by the Senate;
    Assessment: Generally achieved.

    Performance expectation: 2. Subject all financial statements to an
    annual financial statement audit; Assessment: Generally achieved:
    [Empty]; Assessment: Generally not achieved: P; Assessment: No
    assessment made: [Empty].

    Performance expectation: 3. Obtain an unqualified financial statement
    audit opinion;
    Assessment: Generally not achieved.

    Performance expectation: 4. Substantially comply with federal financial
    management system requirements, applicable federal accounting
    standards, and the U.S. Standard General Ledger at the transaction
    level;
    Assessment: Generally not achieved.

    Performance expectation: 5. Obtain an unqualified opinion on internal
    control over financial reporting;
    Assessment: Generally not achieved.

    Performance expectation: 6. Prepare corrective action plans for
    internal control weaknesses;
    Assessment: Generally achieved.

    Performance expectation: 7. Correct internal control weaknesses;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 2;
    Assessment: Generally not achieved: 5;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 37 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of financial management and our assessment of whether DHS has
    taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 37: Performance Expectations and Assessment of DHS Progress in
    Financial Management:

    Performance expectation: 1. Designate a department Chief Financial
    Officer who is appointed by the President and confirmed by the Senate;
    Summary of findings: GAO and DHS IG findings and our assessment: DHS
    has designated a Chief Financial Officer appointed by the President on
    January 18, 2006, and confirmed by the Senate on May 26, 2006. In July
    2004, we noted that with the size and complexity of DHS and the many
    significant financial management challenges it faces, it is important
    that DHS's Chief Financial Officer be qualified for the position,
    displays leadership characteristics, and is regarded as part of DHS's
    top management. This is because the Chief Financial Officer Act
    requires, among other things, that the agency's Chief Financial Officer
    develop and maintain an integrated accounting and financial management
    system that provides for complete, reliable, and timely financial
    information that facilitates the systematic measurement of performance
    at the agency, the development and reporting of cost information, and
    the integration of accounting and budget information. The Chief
    Financial Officer is also responsible for all financial management
    personnel and all financial management systems and operations, which in
    the case of DHS would include the component Chief Financial Officers
    and their staff. For more information, see Department of Homeland
    Security: Financial Management Challenges, GAO-04-945T;
    Assessment: Generally achieved.

    Performance expectation: 2. Subject all financial statements to an
    annual financial statement audit;
    Summary of findings: GAO and DHS IG findings: DHS has not subjected all
    financial statements to an annual financial statement audit. According
    to DHS's fiscal year 2006 Performance and Accountability Report, the
    DHS IG engaged an independent auditor to audit the September 30, 2006,
    balance sheet and statement of custodial activity only. According to
    the Independent Auditor's Report, DHS is to represent that its balance
    sheet is fairly stated and obtain at least a qualified opinion before
    it is practical to extend the audit to other financial statements. The
    Office of Financial Management, Coast Guard, TSA, FEMA, ICE, and the
    DHS Management Directorate were unable to provide sufficient evidence
    to support account balances presented in the financial statements and
    collectively contributed to the auditors' inability to render an
    opinion for fiscal year 2006. According to the DHS's financial audit
    results, many of the department's difficulties in financial management
    and reporting could be attributed to the original stand-up of a large,
    new, and complex executive branch agency without adequate
    organizational expertise in financial management and accounting. DHS
    recently committed to obtaining additional human resources and other
    critical infrastructure necessary to develop reliable financial
    processes, policies, procedures, and internal controls to enable
    management to represent that financial statements are complete and
    accurate. For more information, see Department of Homeland Security
    Office of Inspector General, Independent Auditors' Report on DHS' FY
    2006 Financial Statements, OIG-07-10 (Washington, D.C.: November
    2006); DHS updated Information: DHS did not provide updated
    information relating to this performance expectation. In March 2007,
    DHS officials indicated that they generally agreed with our assessment
    and noted that the department has determined that it is not an
    effective use of resources to subject all financial statements to an
    annual audit until its balance sheet receives an unqualified opinion;
    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. According to the DHS fiscal year 2006
    Performance and Accountability Report and audits conducted by the DHS
    IG and independent auditors that DHS has not subjected all of its
    financial statements to an annual financial statement audit;
    Assessment: Generally not achieved.

    Performance expectation: 3. Obtain an unqualified financial statement
    audit opinion;
    Summary of findings: GAO and DHS IG findings: For fiscal year 2006, DHS
    was unable to obtain an opinion on its financial statements, and
    numerous material internal control weaknesses continued to be reported.
    Independent auditors under contract with the DHS IG issued a disclaimer
    of opinion on DHS's fiscal year 2004, 2005, and 2006 financial
    statements. The disclaimer of opinion was due primarily to financial
    reporting problems at four component agencies and at the department
    level. In September 2003, we noted that although many of the larger
    agencies that transferred to DHS had been able to obtain unqualified,
    or "clean," audit opinions on their annual financial statements, most
    employed significant effort and manual workarounds to do so in order to
    overcome a history of poor financial management systems and significant
    internal control weaknesses. For more information, see Department of
    Homeland Security Office of Inspector General, Fiscal Year 2006 DHS
    Performance and Accountability Report (Washington, D.C.: 2006) and
    Department of Homeland Security: Challenges and Steps in Establishing
    Sound Financial Management, GAO-03-1134T; DHS updated information: In
    March 2007, DHS provided updated information about progress component
    agencies had made in audits of their financial statements. DHS stated
    that CBP underwent a full scope, standalone audit of its fiscal year
    2006 financial statements and received an unqualified audit opinion,
    and that the Federal Law Enforcement Training Center achieved an
    unqualified opinion of its first balance sheet audit. However, DHS
    officials stated that the department will likely not be able to obtain
    an unqualified opinion on its financial statements, primarily because
    of material weaknesses at the Coast Guard. According to the DHS Office
    of the Chief Financial Officer, the Coast Guard has a material weakness
    in virtually every category and has not yet addressed many of the root
    causes of these weaknesses, including insufficient policies and
    procedures and lack of effective control systems. With regard to other
    DHS components, the Office of the Chief Financial Officer noted that in
    the fiscal year 2006 audit report, the auditors dropped several
    material conditions that were reported in the fiscal year 2005 report,
    indicating that DHS has made progress in addressing some material
    weaknesses. For example, during fiscal year 2006, the Office of the
    Chief Financial Officer noted that ICE and TSA made significant
    progress in addressing their material weaknesses and are projected to
    make more progress in fiscal year 2007. According to DHS officials, the
    Coast Guard also established a Financial Management Transformation Task
    Force in July 2006 through which the Coast Guard developed milestones
    to address its financial management challenges. In addition, the Office
    of the Chief Financial Officer noted that the department has faced
    challenges in ensuring the development and implementation of effective
    control systems due to the multiple departmental reorganizations since
    its establishment 4 years ago. For more information, see Department of
    Homeland Security Office of Inspector General, Independent Auditors'
    Report on CBP's FY 2006 Consolidated Financial Statements, OIG-07-19
    (Washington, D.C.: December 2006) and Department of Homeland Security
    Office of Inspector General, Special Report: Letter on Information
    Technology Matters Related to TSA's FY 2005 Financial Statements
    (Redacted), OIG-07-18 (Washington, D.C.: December 2006); Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation. Some DHS components have recently made
    progress in their component financial statement and balance sheet
    audits, but substantial more work remains, as DHS has not yet obtained
    an unqualified opinion on its financial statement;
    Assessment: Generally not achieved.

    Performance expectation: 4. Substantially comply with federal financial
    management system requirements, federal accounting standards, and the
    U.S. Standard General Ledger at the transaction level;
    Summary of findings: GAO and DHS IG findings: DHS has not yet ensured
    that it substantially complies with the Federal Financial Management
    Systems Requirements, Federal Accounting Standards, and the U.S.
    Standard General Ledger at the transaction level. In 2006, we reported
    that the eMerge2 program was supposed to provide DHS with the financial
    system functionality to consolidate and integrate the department's
    financial accounting and reporting systems, including budget,
    accounting and reporting, cost management, asset management, and
    acquisition and grants functions, thereby helping the department comply
    with the Federal Financial Management Systems Requirements, Federal
    Accounting Standards, and the U.S. Standard General Ledger at the
    transaction level. We noted that DHS officials stated that a systems
    integrator was hired in December 2003, and the project was expected to
    be fully deployed and operational in 2006. According to DHS officials,
    because the project was not meeting its performance goals and timeline,
    DHS officials began considering whether to continue the project and in
    spring 2005 started looking at another strategy. Further, we reported
    that DHS officials decided to change the strategy for the eMerge2
    program in October 2005 and focus on leveraging the systems already in
    place. DHS planed to continue eMerge2 using a shared services approach.
    According to DHS officials, although a departmentwide concept of
    operations and migration plan were still under development, they
    expected progress to be made in the next 5 years. We reported that DHS
    officials said that they had decided to develop a new strategy for the
    planned financial management systems integration program because the
    prior strategy was not meeting its performance goals and timeline. For
    more information, see Financial Management Systems: DHS Has an
    Opportunity to Incorporate Best Practices in Modernization Efforts,
    GAO-06-553T. Also, see Department of Homeland Security Office of
    Inspector General, Fiscal Year 2006 DHS Performance and Accountability
    Report (Washington, D.C.: 2006); DHS updated information: In March
    2007, DHS provided us with updated information on components' efforts
    to comply with Federal Financial Management System Requirements,
    Federal Accounting Standards, and the U.S. Standard General Ledger at
    the transaction level. In October 2004, CBP successfully implemented,
    on schedule, its third and last phase of its financial system.
    According to DHS, the system replaced several legacy systems and
    provides CBP with a fully integrated system for budget, acquisition,
    finance, and property and therefore helping to ensure CBP's compliance
    with the Federal Financial Management Systems Requirements, Federal
    Accounting Standards, and the U.S. Standard General Ledger at the
    transaction level. DHS further noted that this successful
    implementation was an integral part of CBP obtaining an unqualified
    audit opinion; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS is still in the process of
    developing a new strategy for integrating its financial management
    systems, but departmentwide has not yet substantially compiled with
    Federal Financial Management System Requirements, Federal Accounting
    Standards, and the U.S. Standard General Ledger at the transaction
    level;
    Assessment: Generally not achieved.

    Performance expectation: 5. Obtain an unqualified opinion on internal
    control over financial reporting;
    Summary of findings: GAO and DHS IG findings: DHS is required by the
    DHS Financial Accountability Act to obtain an opinion on its internal
    control over financial reporting. According to DHS's fiscal year 2006
    Performance and Accountability Report, the DHS IG issued an adverse
    opinion. During fiscal year 2006, the auditors identified the following
    reportable conditions, which are considered material weaknesses:
    financial management oversight (entity level controls); financial
    reporting; financial systems security; fund balance with Treasury;
    property, plant, and equipment; operating materials and supplies; legal
    and other liabilities; actuarial liabilities; budgetary accounting; and
    intragovernmental and intradepartmental balances. For more information,
    see Department of Homeland Security Office of Inspector General, FY
    2006 Audit of DHS' Internal Control Over Financial Reporting, OIG-07-20
    (Washington, D.C.: December 2006) and Department of Homeland Security
    Office of Inspector General, Review of FEMA Internal Controls for
    Funding Administrative Cost Under State Management Grants, OIG-07-
    21(Washington, D.C.: December 2007); DHS updated information: DHS did
    not provide us with updated information on its efforts to obtain an
    unqualified opinion on internal control over financial reporting; Our
    assessment: We conclude that DHS has generally not achieved this
    performance expectation, as DHS has not yet obtained an unqualified
    opinion on internal control over financial reporting;
    Assessment: Generally not achieved.

    Performance expectation: 6. Prepare corrective action plans for
    internal control weaknesses;
    Summary of findings: GAO and DHS IG findings: DHS has taken steps to
    prepare corrective action plans for internal control weaknesses.
    According to the fiscal year 2006 DHS Performance and Accountability
    Report, during 2006, DHS reported formalizing the corrective action
    planning process through a management directive, guidance, and
    training; implementing an automated corrective action tracking system
    to ensure progress is tracked and management is held accountable for
    progress; developing a corrective action strategic planning process for
    improving financial management at DHS; working with the Office of
    Management and Budget to monitor corrective action plans; establishing
    ongoing reporting by the DHS IG that assesses and complements
    management's corrective action efforts through performance audits; and
    executing the first phase of the Office of Management and Budget-
    approved multiyear plan to implement a comprehensive internal control
    assessment pursuant to the Office of Management and Budget Circular No.
    A-123, Appendix A, Management's Responsibility for Internal Control,
    guidelines. However, according to the fiscal year 2006 DHS Performance
    and Accountability Report, DHS and its components did not fully develop
    corrective action plans to address all material weaknesses and
    reportable conditions identified by previous financial statement
    audits. In the past, the DHS IG noted that some corrective action plans
    lacked sufficient detail, such as clearly defined roles and
    responsibilities, actions to be taken, timetables for completion of
    actions, and documented supervisory review and approval of completed
    actions. For more information, see Department of Homeland Security
    Office of Inspector General, Audit of DHS' Corrective Action Plan
    Process for Financial Reporting, Report No. 4, OIG-07-29 (Washington,
    D.C.: February 2007) and Audit of DHS' Corrective Action Plan Process
    for Financial Reporting - Report No. 3, OIG-07-13 (Washington, D.C.:
    December 2006); DHS updated information: In April 2007, DHS provided
    us with updated information on its efforts to develop corrective action
    plans. According to DHS, a departmentwide committee has been working
    since January 2006 to develop its first departmentwide Corrective
    Action Plan, which it refers to as its Internal Controls over Financial
    Reporting Playbook Fiscal Year 2007. The department started its
    corrective action planning process in November 2005 by holding internal
    meetings and initiating the procurement process to obtain a contractor
    to develop a tracking system for the department's corrective action
    plans. Additionally, beginning in December 2005, DHS held meetings with
    its components, including the Coast Guard and ICE, to develop
    corrective action plans and establish financial management remediation
    issues for fiscal year 2006. Throughout 2006, the DHS Chief Financial
    Officer held approximately 12 corrective action plan workshops with the
    component agencies regarding areas of focus for improving financial
    management and stressing the importance of identifying and addressing
    the root causes of component agencies' financial management weaknesses.
    Additionally, the department has developed reports to illustrate
    progress in corrective action planning on a quarterly basis; Our
    assessment: We conclude that DHS has generally achieved this
    performance expectation. DHS has taken actions to develop corrective
    action plans by, for example, developing and issuing a departmentwide
    plan for the corrective action plan process and holding workshops or
    corrective action plans;
    Assessment: Generally achieved.

    Performance expectation: 7. Correct internal control weaknesses;
    Summary of findings: GAO and DHS IG findings: DHS and its components
    have not fully implemented corrective action plans to address all
    material weaknesses and reportable conditions identified by previous
    financial statement audits. In its fiscal year 2006 Performance and
    Accountability Report, DHS reported on planned corrective actions to
    address materials weaknesses in internal controls over financial
    reporting and established target dates for completing the corrections.
    In addition, the DHS IG reported that progress in implementing
    corrective action plans among DHS component agencies was mixed. For
    more information, see Department of Homeland Security Office of
    Inspector General, Audit of DHS' Corrective Action Plan Process for
    Financial Reporting, Report No. 4, OIG-07-29 (Washington, D.C.:
    February 2007) and Audit of DHS' Corrective Action Plan Process for
    Financial Reporting - Report No. 3, OIG-07-13 (Washington, D.C.:
    December 2006); DHS updated information: DHS did not provide updated
    information relating to this performance expectation but DHS officials
    indicated that they generally agreed with our assessment, and that DHS
    has not yet corrected its internal control weaknesses. The Office of
    the Chief Financial Officer noted that while DHS addressed many
    weaknesses during fiscal year 2006 and, as shown in the Internal
    Controls over Financial Reporting Playbook, plans to address these
    weaknesses through fiscal year 2010, it will likely take DHS until
    fiscal year 2010 to address all of its weaknesses because of pervasive
    financial management problems at the Coast Guard. According to DHS
    officials, the Coast Guard has made some progress, establishing a
    Financial Management Transformation Task Force in July 2006 through
    which the Coast Guard developed milestones to address its financial
    management challenges. Office of the Chief Financial Officer officials
    stated that DHS has developed goals and milestones for addressing its
    material weaknesses and reportable conditions in the Electronic Program
    Management Office, a project management tool that is supposed to help
    improve communication on activities in component offices, ensure
    accountability, and enhance the department's ability to react quickly
    to meet mission-critical objectives; Our assessment: We conclude that
    DHS has generally not achieved this performance expectation. DHS has
    not yet corrected internal control weaknesses, according to the
    department, the DHS IG, and independent auditors;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Limited Progress in Managing Human Capital:

    Key human capital management areas for all agencies, including DHS, are
    pay, performance management, classification, labor relations, adverse
    actions, employee appeals, and diversity management. Congress provided
    DHS with significant flexibility to design a modern human capital
    management system. DHS and the Office of Personnel Management jointly
    released the final regulations on DHS's new human capital system in
    February 2005. The final regulations established a new human capital
    system for DHS that was intended to ensure its ability to attract,
    retain, and reward a workforce that is able to meet its critical
    mission. Further, the human capital system provided for greater
    flexibility and accountability in the way employees are to be paid,
    developed, evaluated, afforded due process, and represented by labor
    organizations while reflecting the principles of merit and fairness
    embodied in the statutory merit systems principles. Although DHS
    intended to implement the new personnel system in the summer of 2005,
    court decisions enjoined the department from implementing certain labor
    management portions of it. Since that time, DHS has taken actions to
    implement its human capital system and issued its Fiscal Year 2007 and
    2008 Human Capital Operational Plan in April 2007.

    As shown in table 38, we identified eight performance expectations for
    DHS in the area of human capital management and found that overall DHS
    has made limited progress in meeting those performance expectations.
    Specifically, we found that DHS has generally achieved two performance
    expectations and has generally not achieved six other expectations.

    Table 38: Performance Expectations and Progress Made in Human Capital
    Management:

    Performance expectation: 1. Develop a results-oriented strategic human
    capital plan;
    Assessment: Generally achieved.

    Performance expectation: 2. Implement a human capital system that links
    human capital planning to overall agency strategic planning;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop and implement processes to recruit
    and hire employees who possess needed skills;
    Assessment: Generally not achieved.

    Performance expectation: 4. Measure agency performance and make
    strategic human capital decisions;
    Assessment: Generally not achieved.

    Performance expectation: 5. Establish a market-based and more
    performance-oriented pay system;
    Assessment: Generally not achieved.

    Performance expectation: 6. Seek feedback from employees to allow for
    their participation in the decision-making process;
    Assessment: Generally not achieved.

    Performance expectation: 7. Create a comprehensive plan for training
    and professional development;
    Assessment: Generally achieved.

    Performance expectation: 8. Implement training and development programs
    in support of DHS's mission and goals;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 2;
    Assessment: Generally not achieved: 6;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 39 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of human capital management and our assessment of whether DHS
    has taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 39: Performance Expectations and Assessment of DHS Progress in
    Human Capital Management:

    Performance expectation: 1. Develop a results-oriented strategic human
    capital plan;
    Summary of findings: GAO findings: DHS has developed a results-oriented
    strategic human capital plan and issued its human capital strategic
    plan in October 2004. In September 2005 we reported that the plan
    includes selected training strategies, such as developing a leadership
    curriculum to ensure consistency of organizational values across the
    department and using training to support the implementation of the DHS
    human capital management system. We also reported that it provides an
    illustration of one way to communicate linkages between goals and
    strategies contained in the plan and the broader organizational goals
    they are intended to support. For more information see Department of
    Homeland Security: Strategic Management of Training Important for
    Successful Transformation, GAO-05-888 and Human Capital: DHS Faces
    Challenges In Implementing Its New Personnel System, GAO-04-790; DHS
    updated information: In March and April 2007, DHS provided us with
    updated information related to this performance expectation. In
    addition to its strategic human capital plan, DHS has developed a
    fiscal year 2007 and 2008 Human Capital Operational Plan, which
    provides specific measurable goals that the department is using to
    gauge the effectiveness of the its human capital efforts; Our
    assessment: We conclude that DHS has generally achieved this
    performance expectation, as it has developed a strategic human capital
    plan;
    Assessment: Generally achieved.

    Performance expectation: 2. Implement a human capital system that links
    human capital planning to overall agency strategic planning;
    Summary of findings: GAO findings: DHS has taken steps to implement a
    human capital system that links human capital planning to overall
    agency strategic planning, but more work remains. For example, federal
    court decisions have enjoined the department from implementing the
    labor management portions of its human capital system. We reported in
    September 2005 that human capital management system, known at that time
    as MAX[HR], represented a fundamental change in many of the
    department's human capital policies and procedures that would affect a
    large majority--approximately 110,000--of its civilian employees.
    MAXHR covered many key human capital areas, such as pay, performance
    management, classification, labor relations, adverse actions, and
    employee appeals. For more information see GAO-05-888; Human Capital:
    Observations on Final DHS Human Capital Regulations, GAO-05-391T; GAO-
    04-790; and Human Capital: DHS Personnel System Design Effort Provides
    for Collaboration and Employee Participation, GAO-03-1099; DHS updated
    information: In March and April 2007, DHS provided us with updated
    information on its efforts to implement a human capital system that
    links human capital planning to overall agency strategic planning. DHS
    has developed the Human Capital Operational Plan, which identifies five
    department priorities--hiring and retaining a talented and diverse
    workforce; creating a DHS-wide culture of performance; creating high-
    quality learning and development programs for DHS employees;
    implementing a DHS-wide integrated leadership system; and being a model
    of human capital service excellence. DHS told us that the Human Capital
    Operational Plan encompasses the initiatives of the previous human
    capital management system, MAX[HR], but represents a more
    comprehensive human resources program. The Human Capital Operational
    Plan identifies 77 goals for the department to achieve throughout
    fiscal years 2007 and 2008, and DHS has met the 8 goals with target
    dates of April 30, 2007, or earlier. For example, DHS has developed a
    hiring model, developed a communication plan for the Human Capital
    Operational Plan, and equipped components with a service level
    agreement model. DHS also reported that its Performance Management
    Program has been expanded and continues to be expanded across the
    department and is an integral part in DHS's strategy for building a
    single, unified department and linking individual performance with
    specific organizational goals. DHS stated that since deployment of the
    Performance Management Program to bargaining unit employees will
    require collective bargaining, further expansion is proceeding as
    appropriate and that once negotiation is complete at the component
    level, the new program will be rolled out to both bargaining unit and
    non-bargaining unit employees at the same time; Our assessment: We
    conclude that DHS has generally not achieved this expectation. While
    DHS has taken actions to implement a human capital system that links
    human capital planning to overall agency strategic planning, more work
    remains. DHS has issued the Human Capital Operational Plan, which
    identifies department priorities and goals for fiscal years 2007 and
    2008. While DHS has met goals with target dates of April 30, 2007, or
    earlier, the vast majority of goals set out in the Human Capital
    Operational Plan have target dates after April 30, 2007. DHS reported
    that it is on track to meet future goals, but the goals have not yet
    been met;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop and implement processes to recruit
    and hire employees who possess needed skills;
    Summary of findings: GAO findings: DHS has faced difficulties in
    developing and implementing processes to recruit and hire employees who
    possess needed skills. We have noted that hiring or staffing
    difficulties have adversely affected DHS operations in various areas,
    including border security and immigration enforcement, aviation
    security, emergency preparedness and response, and acquisition
    management. For example, in May 2005 we reported that ineffective DHS
    management processes have impeded the department's ability to hire
    employees and maintain contracts. In September 2006 we reported that
    concerns regarding staffing for disaster response management have been
    longstanding, and we noted that FEMA officials cited the lack of agency
    and contractor staffing as a difficulty. We also reported that DHS's
    Office of the Chief Procurement Officer has not focused on oversight
    due in part to limited staffing. In addition, in January 2007 we
    reported that FEMA lacks a strategic workforce plan and related human
    capital strategies--such as succession planning or a coordinated
    training effort. Such tools are integral to managing resources, as they
    enable an agency to define staffing levels, identify the critical
    skills needed to achieve its mission, and eliminate or mitigate gaps
    between current and future skills and competencies. For more
    information see Budget Issues: FEMA Needs Adequate Data, Plans, and
    Systems to Effectively Manage Resources for Day-to-Day Operations, GAO-
    07-139; Critical Infrastructure Protection: DHS Leadership Needed to
    Enhance Cybersecurity, GAO-06-1087T; Homeland Security: Visitor and
    Immigrant Status Program Operating, but Management Improvements Are
    Still Needed, GAO-06-318T; Immigration Benefits: Improvements Needed to
    Address Backlogs and Ensure Quality of Adjudications, GAO-06-20;
    Critical Infrastructure Protection: Department of Homeland Security
    Faces Challenges in Fulfilling Cybersecurity Responsibilities, GAO-05-
    434; Information Technology: Homeland Security Should Better Balance
    Need for System Integration Strategy with Spending for New and Enhanced
    Systems, GAO-04-509; and Homeland Security: Risks Facing Key Border and
    Transportation Security Program Need to Be Addressed, GAO-03-1083; DHS
    updated information: In March, April, and May 2007, DHS provided us
    with updated information on its efforts to develop and implement
    processes to recruit and hire employees who possess needed skills. In
    the Human Capital Operational Plan, DHS identifies a number of goals
    and target dates concerning hiring and recruitment, such as
    implementing DHS-wide recruitment strategies and establishing an intern
    program for specific occupations. DHS has met two of the plan's hiring
    goals and associated target dates--developing/benchmarking a hiring
    model and developing training on the hiring model. DHS's 45-day hiring
    model has 20 steps, such as posting a vacancy announcement and checking
    references, and 8 of the steps are measured for the purposes of the 45-
    day target; DHS stated that the hiring model has been provided to all
    components and that it receives regular reporting from components
    against the 45-day hiring target. DHS reported that it is on track to
    meet the July target date for assessing hiring practices against the
    hiring model and stated that it is on schedule to meet target dates for
    other future goals as well. For example, DHS stated that it is in the
    process of developing e-Recruitment, an enterprise-wide tool for
    application processing and workforce planning; Our assessment: We
    conclude that this performance expectation has generally not been
    achieved. While DHS has taken steps to develop processes to recruit and
    hire employees who possess needed skills, more work remains. For
    example, DHS has developed a hiring model, but the department has not
    yet assessed the component's practices against it. DHS is also still in
    the process of meeting other recruitment and hiring goals, such as the
    deployment of e-Recruitment and the establishment of an intern program
    in specific occupations;
    Assessment: Generally not achieved.

    Performance expectation: 4. Measure agency performance and make
    strategic human capital decisions;
    Summary of findings: GAO findings: DHS has not yet taken the steps
    needed to measure performance and make strategic human capital
    decisions. In June 2004, we reported that DHS headquarters has not yet
    been systematic or consistent in gathering relevant data on the
    successes or shortcomings of legacy component human capital approaches
    or current and future workforce challenges, despite the potential
    usefulness of this information to strategic human capital planning
    activities. We reported that efforts were under way to gather such
    data. For more information see GAO-05-391T and GAO-04-790; DHS updated
    information: In March, April, and May 2007, DHS provided us with
    updated information on its efforts to measure agency performance and
    make strategic human capital decisions. Specifically, DHS stated that
    its human capital accountability plan has been distributed, approved by
    the Office of Personnel Management, and is operational but not final.
    This plan will outline the department's strategy for monitoring and
    evaluating its human capital policies and programs and for conducting
    cyclical compliance audits of human resources management operations.
    DHS also reported that it has identified component representatives to
    serve on audit teams for accountability that will specialize in human
    resources issues. DHS plans to audit the Coast Guard this year.
    Further, DHS stated that it is currently working with components to
    develop metrics for human capital management. DHS stated that these
    metrics will revolve around hiring, talent, leadership, and
    accountability. DHS reported that the department has put together an
    initial framework for these metrics and hopes to have some in use by
    October 2007. DHS also stated that since 2005, the DHS Human Capital
    Office has served on the DHS Chief Financial Officer's Internal
    Controls Committee. DHS reported that GAO's Internal Control Management
    Tool has been used each year to collect and review DHS-wide responses
    and develop corrective action plans, including data on the many Human
    Capital-related questions within this tool. DHS stated that DHS Chief
    Financial Officer tracks and reports the compiled data to the Office of
    Management and Budget; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. DHS has made
    efforts to measure agency performance and make strategic human capital
    decisions. However, these efforts are not yet complete. For example,
    DHS's human capital accountability plan is operational but not yet
    final, and the department has not finalized metrics it will use for
    human capital management;
    Assessment: Generally not achieved.

    Performance expectation: 5. Establish a market-based and more
    performance-oriented pay system;
    Summary of findings: GAO findings: DHS has not yet established a market-
    based and more performance-oriented pay system. In 2005 we testified
    that the final regulations on DHS's human capital system provided for a
    flexible, contemporary, performance-oriented, and market-based
    compensation system. Specifically, DHS planned to establish
    occupational clusters and pay bands and may, after coordination with
    the Office of Personnel Management, set and adjust pay ranges�taking
    into account mission requirements, labor market conditions,
    availability of funds, and other relevant factors. While the final
    regulations contained many elements of a market-based and performance-
    oriented pay system, there were several issues that we identified that
    DHS needed to continue to address as it moved forward with the
    implementation of the system. These issues included linking
    organizational goals to individual performance, using competencies to
    provide a fuller assessment of performance, making meaningful
    distinctions in employee performance, and continuing to incorporate
    adequate safeguards to ensure fairness and guard against abuse. For
    more information, see GAO-05-391T; DHS updated information: In March
    and April 2007, DHS provided us with updated information on its efforts
    to establish a market-based and more performance-oriented pay system.
    DHS reported that it is developing implementation plans to conduct a
    performance-based pay pilot program in a component or organization in
    order to validate, measure, and refine the pay band models and
    processes developed. DHS stated that the steps required for
    implementation of a pilot program have been identified and reported
    that as an initial step in that process it is identifying a group that
    would serve as a reasonable sample for an assessment of DHS's pay band
    model and pay administration procedures. Further, DHS stated that it is
    assessing the budget implications for implementation and taking the
    steps necessary to ensure availability of sufficient funding. DHS also
    told us that it has developed competencies for 115 occupations. DHS
    stated that the competencies will be validated by August 2007 and
    implemented in September 2007; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. While DHS has
    taken steps to develop a market-based and more performance-oriented pay
    system, the department has not yet established such a system. The
    department reported that it is developing a pilot program but that this
    program is still in the planning stages;
    Assessment: Generally not achieved.

    Performance expectation: 6. Seek feedback from employees to allow for
    their participation in the decision-making process;
    Summary of findings: GAO findings: While DHS has taken steps to seek
    feedback from employees to allow them to be involved in the decision-
    making process, more work remains. In September 2003, for example, we
    reported that employee perspectives on the design of the DHS human
    capital system, formerly known as MAX[HR], were sought through many
    mechanisms. Activity updates were provided in the DHS weekly
    newsletter, an e-mail mailbox for employees to submit their suggestions
    and comments was used, and multiple town hall meetings and focus groups
    conducted between the end of May and the beginning of July 2003 were
    held in 10 cities across the United States. However, in June 2004 we
    pointed to challenges in implementing the human capital system in a
    collaborative way. We reported that regardless of whether it is a part
    of collective bargaining, involving employees in such important
    decisions as how they are deployed and how work is assigned is critical
    to the successful operation of the department. This is likely to be a
    significant challenge in light of employee responses to the 2006 U.S.
    Office of Personnel Management Federal Human Capital Survey in which
    about 30 percent of DHS employees indicated a feeling of personal
    empowerment, which is less than the governmentwide response of about 42
    percent. Additionally, about 39 percent of DHS employees reported
    satisfaction with their involvement in decisions that affect their
    work, compared to about 54 percent governmentwide. For more
    information, see GAO-05-391T; GAO-04-790; and GAO-03-1099; DHS updated
    information: In March and April 2007, DHS provided us with updated
    information on its efforts to seek feedback from employees to allow for
    their participation in the decision-making process. DHS reported that
    it is expanding its communication strategy, including an enhanced DHS
    human capital Web site. Further, DHS reported that in consultation with
    the Undersecretary for Management, component heads, and the DHS Human
    Capital Council, it developed an overall strategy for addressing
    employee concerns as reflected in the Federal Human Capital Survey
    results, and the department reported that it has already completed a
    number of actions to address the issues raised in the 2006 Federal
    Human Capital Survey, as well as the findings of the Common Culture
    Task Force. For example, DHS stated that it is continuing ongoing focus
    groups and surveys; Our assessment: We conclude that DHS has generally
    not achieved this performance expectation. DHS has taken a variety of
    steps to seek feedback from employees to allow for their participation
    in the decision-making process, but it continues to face challenges.
    For example, during the design of MAX[HR] , DHS took actions to obtain
    employees' perspectives through focus groups and town hall meetings.
    However, the results of the U.S. Office of Personnel Management Federal
    Human Capital Survey indicate that DHS employees do not perceive that
    they have had sufficient involvement in decision making at DHS. While
    DHS reported that it is taking actions to address the concerns raised
    in the Federal Human Capital Survey, it is too early to evaluate their
    effectiveness;
    Assessment: Generally not achieved.

    Performance expectation: 7. Create a comprehensive plan for training
    and professional development;
    Summary of findings: GAO findings: DHS has created a comprehensive plan
    for training and development. DHS's department-level training strategy
    is presented in its human capital and training strategic plans. Issued
    in October 2004, its human capital strategic plan includes selected
    training strategies, such as developing a leadership curriculum to
    ensure consistency of organizational values across the department and
    using training to support the implementation of the DHS human capital
    management system. In July 2005, DHS issued its first departmental
    training plan, the Department of Homeland Security Learning and
    Development Strategic Plan, which provides a strategic vision for
    departmentwide training. We reported that this plan is a significant
    and positive step toward addressing departmentwide training challenges.
    For more information, see GAO-05-888; DHS updated information: In March
    and April 2007, DHS provided us with updated information on its efforts
    to create comprehensive plans for training and professional
    development. DHS has filled the position of Chief Learning Officer and
    has developed a draft Learning and Development Strategy. The draft plan
    provides a strategy for how the department will institutionalize and
    standardize employee training, education, and professional development,
    and it also identifies the four pillars of the DHS University System,
    which include the Leadership Institute, the Preparedness Center, the
    Homeland Security Academy, and the Center for Academic and Interagency
    Programs; Our assessment: We conclude that DHS has generally achieved
    this performance expectation as the department has created a training
    and professional development plan;
    Assessment: Generally achieved.

    Performance expectation: 8. Implement training and development programs
    in support of DHS's mission and goals;
    Summary of findings: GAO findings: While DHS has taken steps to
    implement training and development programs in support of DHS's mission
    and goals, it continues to face difficulties. In September 2005, we
    reported that under the overall direction of the Chief Human Capital
    Officer office, DHS has established a structure of training councils
    and groups that cover a wide range of issues and include
    representatives from each organizational component within DHS. The
    Training Leaders Council plays a vital role in DHS's efforts to foster
    communication and interchange among the department's various training
    communities. DHS has also established a Chief Learning Officer.
    However, the formation of DHS from 22 legacy agencies and programs has
    created challenges to achieving departmentwide training goals. Of
    particular concern to the training officials we spoke with were the
    lack of common management information systems and the absence of
    commonly understood training terminology across components. For more
    information, see GAO-05-888; DHS updated information: In March, April,
    and May 2007, DHS provided us with updated information on its efforts
    to implement training and development programs in support of DHS's
    mission and goals. Specifically, DHS has established an Office of
    Personnel Management-approved Senior Executive Service Candidate
    Development Program and held the orientation for its initial Senior
    Executive Service Candidate Development Program class in March 2007.
    DHS also reported that it has created and launched the National Capital
    Region Homeland Security Academy. The Academy will offer a fully
    accredited graduate degree in Homeland Security Studies and, when
    combined with the West Coast program, will matriculate 200 students
    annually. Further, DHS reported that it is conducting academic and
    outreach partnerships with National Defense University, Minority
    Servicing Institutions, and educational consortiums, such as the
    National Security Education Consortium and the Homeland Security and
    Defense Education Consortium. DHS also stated that it is developing
    electronic courses for employees in need of specific training and plans
    to roll out these courses in the near future. DHS reported that the DHS
    Training Leaders Council, a council of training representatives from
    DHS Components, created a Training Glossary that is used across the
    department. DHS also reported that on February 5, 2007, the department
    successfully launched its learning management system, DHScovery. DHS
    stated that ultimately DHScovery will deliver and track DHS
    departmentwide employee training events; Our assessment: We conclude
    that DHS generally has not achieved this performance expectation. DHS
    has made progress in implementing training and development programs in
    support of DHS's mission and goals. However, most of DHS's training and
    development goals identified in the Human Capital Operational Plan have
    not yet been fully implemented;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    DHS Has Made Limited Progress in Information Technology Management:

    DHS has undertaken efforts to establish and institutionalize the range
    of information technology management controls and capabilities that our
    research and past work have shown are fundamental to any organization's
    ability to use technology effectively to transform itself and
    accomplish mission goals. Among these information technology management
    controls and capabilities are:

    * centralizing leadership for extending these disciplines throughout
    the organization with an empowered Chief Information Officer,

    * having sufficient people with the right knowledge, skills, and
    abilities to execute each of these areas now and in the future;

    * developing and using an enterprise architecture, or corporate
    blueprint, as an authoritative frame of reference to guide and
    constrain system investments;

    * defining and following a corporate process for informed decision
    making by senior leadership about competing information technology
    investment options;

    * applying system and software development and acquisition discipline
    and rigor when defining, designing, developing, testing, deploying, and
    maintaining systems; and:

    * establishing a comprehensive, departmentwide information security
    program to protect information and systems;

    Despite its efforts over the last several years, the department has
    significantly more to do before each of these management controls and
    capabilities is fully in place and is integral to how each system
    investment is managed.

    As shown in table 40, we identified 13 performance expectations for DHS
    in the area of information technology management and found that overall
    DHS has made limited progress in meeting those expectations. In
    particular, we found that DHS has generally achieved 2 performance
    expectations and has generally not achieved 8 others. For 3 other
    performance expectations, we did not make an assessment.

    Table 40: Performance Expectations and Progress Made in Information
    Technology Management:

    Performance expectation: 1. Organize roles and responsibilities for
    information technology under the Chief Information Officer;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop a strategy and plan for information
    technology management;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop measures to assess performance in
    the management of information technology;
    Assessment: Generally not achieved.

    Performance expectation: 4. Strategically manage information
    technology human capital;
    Assessment: No assessment made.

    Performance expectation: 5. Develop a comprehensive enterprise
    architecture;
    Assessment: No assessment made.

    Performance expectation: 6. Implement a comprehensive enterprise
    architecture;
    Assessment: Generally not achieved.

    Performance expectation: 7. Develop a process to effectively manage
    information technology investments;
    Assessment: Generally not achieved.

    Performance expectation: 8. Implement a process to effectively manage
    information technology investments;
    Assessment: Generally not achieved.

    Performance expectation: 9. Develop policies and procedures for
    effective information systems development and acquisition;
    Assessment: Generally not achieved.

    Performance expectation: 10. Implement policies and procedures for
    effective information systems development and acquisition;
    Assessment: Generally not achieved.

    Performance expectation: 11. Provide operational capabilities for
    information technology infrastructure and applications;
    Assessment: No assessment made.

    Performance expectation: 12. Develop policies and procedures to ensure
    protection of sensitive information;
    Assessment: Generally achieved.

    Performance expectation: 13. Implement policies and procedures to
    effectively safeguard sensitive information;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 2;
    Assessment: Generally not achieved: 8;
    Assessment: No assessment made: 3.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 41 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of information technology management and our assessment of
    whether DHS has taken steps to satisfy most of the key elements of the
    performance expectation (generally achieved) or has not taken steps to
    satisfy most of the performance expectation's key elements (generally
    not achieved).

    Table 41: Performance Expectations and Assessment of DHS Progress in
    Information Technology Management:

    Performance expectation: 1. Organize roles and responsibilities for
    information technology under the Chief Information Officer;
    Summary of findings: GAO findings: In May 2004, we reported that the
    DHS Chief Information Officer did not have the authority and control
    over departmentwide information technology spending. Control over the
    department's information technology budget was vested primarily with
    the Chief Information Officer organizations within each DHS component.
    As a result, DHS's Chief Information Officer did not have authority to
    manage information technology assets across the department. For more
    information, see Homeland Security Progress Continues but Challenges
    Remain on Department's Management of Information Technology, GAO-06-
    598T; DHS updated information: In March and April 2007, DHS provided
    us with updated information on its efforts to organize roles and
    responsibilities under the Chief Information Officer. Specifically, in
    March 2007 DHS issued a management directive that expanded the
    authorities and responsibilities of its Chief Information Officer. The
    directive gives the Chief Information Officer responsibility for and
    authority over information technology resources, including funding and
    human capital of DHS's components; Our assessment: We conclude that
    DHS has generally achieved this performance expectation. DHS's March
    2007 management directive is consistent with our 2004 recommendation
    that the department strengthen the Chief Information Officer's
    authority and control over departmentwide information technology
    spending;
    Assessment: Generally achieved.

    Performance expectation: 2. Develop a strategy and plan for information
    technology management;
    Summary of findings: GAO findings: In 2004 we reported DHS's draft
    information resource management strategic plan dated March 2004 listed
    the priorities of the department's and component agencies' Chief
    Information Officers for 2004. We also reported that the department was
    in the process of developing what it termed as road maps for each of
    these priority areas that included descriptions of the current
    condition of the area, the need for change, the planned future state,
    initiatives, and barriers. However, we reported that neither DHS's
    draft information resource management strategic plan nor the draft
    priority area road maps developed by DHS contained sufficient
    information regarding the department's information technology goals and
    performance measures, when the department expected that significant
    activities would be completed, and the staff resources necessary to
    implement those activities. For more information, see GAO-06-598T and
    Department of Homeland Security: Formidable Information and Technology
    Management Challenge Requires Institutional Approach, GAO-04-702; DHS
    updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop a strategy for information
    technology management. In particular, DHS provided us with a document
    titled the Office of the Chief Information Officer Strategic Plan,
    Fiscal years 2007-2011. This plan lays out five goals for the
    department's information technology capabilities and includes
    information on strategic objectives linked to those goals. The plan's
    five goals are (1) continuing cyber security improvements; (2) driving
    information technology operational efficiencies, improvements; and
    resiliency; (3) aligning information technology planning and budgeting
    with procurement activities and the enterprise architecture; (4)
    establishing a foundation for information sharing, data collection, and
    integration; and (5) establishing and governing a portfolio of cross-
    departmental information technology capabilities to support DHS mission
    and management objectives. The plan also aligns the Office of the Chief
    Information Officer's information technology goals to DHS's mission
    priorities; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS's Office of the Chief
    Information Officer Strategic Plan represents a starting point for DHS
    in its efforts to develop a strategy and plan for information
    technology management. However, the plan does not include well-
    developed milestones and clearly defined roles and responsibilities for
    executing initiatives, which we have previously reported are key
    elements of a good strategic plan;
    Assessment: Generally not achieved.

    Performance expectation: 3. Develop measures to assess performance in
    the management of information technology;
    Summary of findings: GAO findings: In 2004 we reported that neither
    DHS's draft information resource management strategic plan nor the
    draft priority area road maps developed by DHS contained sufficient
    information regarding the department's information technology goals and
    performance measures. We reported that leading organizations define
    specific goals, objectives, and measures; use a diversity of
    measurement types; and describe how information technology outputs and
    outcomes affect organizational customer and agency program delivery
    requirements. In addition, we reported that the Paperwork Reduction Act
    and the Clinger-Cohen Act of 1996 requires agencies to establish goals
    and performance measures on how information and technology management
    contributes to program productivity, the efficiency and effectiveness
    of agency operations, and service to the public. More recently, DHS has
    taken actions consistent with the expectation. Specifically, DHS
    established key information technology initiatives and associated goals
    as part of its 2005-2006 Information Technology Strategy. This strategy
    linked key information technology initiatives and goals to DHS's
    overarching mission and goals, such as providing service to the public
    and increasing the efficiency and effectiveness of agency operations
    and program productivity. For more information, see GAO-04-702; DHS
    updated information: In March and April 2007, DHS provided us with
    updated information on its efforts to develop performance measures for
    information technology management. DHS reported that it uses the Office
    of Management and Budget's Program Assessment Rating Tool to measure
    the performance if individual information technology programs. DHS also
    reported that performance measures for major programs are tracked in
    the Office of Management and Budget Exhibit 300 business cases; Our
    assessment: Until DHS provides evidence that it has developed measures
    for assessing the department's management of information technology, we
    conclude that DHS has generally not achieved this performance
    expectation. DHS reported using various tools to measure performance of
    individual information technology programs. However, we believe that
    while the Program Assessment Rating Tool and the Exhibit 300 business
    cases can help provide important information for the department on the
    management of individual investments, these tools do not provide
    measures for routinely assessing overall information technology
    management performance;
    Assessment: Generally not achieved.

    Performance expectation: 4. Strategically manage information
    technology human capital;
    Summary of findings: GAO findings and assessment: We have not conducted
    work on DHS's information technology human capital management and DHS
    did not provide us with information on its efforts to achieve this
    performance expectation that would allow us to make an assessment on
    DHS's progress in achieving this performance expectation. In the past,
    we noted that DHS faced difficulties in strategically managing its
    human capital for information technology. We also reported that DHS had
    begun strategic planning for information technology human capital at
    the headquarters level, but it had not yet systematically gathered
    baseline data about its existing workforce. We have ongoing work in
    this area and plan to report on the results of this work later this
    year. For more information, see GAO-06-598T and GAO-04-702;
    Assessment: No assessment made.

    Performance expectation: 5. Develop a comprehensive enterprise
    architecture;
    Summary of findings: GAO findings: An enterprise architecture provides
    systematic structural descriptions--in useful models, diagrams, tables,
    and narrative--of how a given entity operates today and how it plans to
    operate in the future, and it includes a road map for transitioning
    from today to tomorrow. The Clinger-Cohen Act and the Office of
    Management and Budget require that departments such as DHS develop and
    use an architecture. DHS has begun developing an enterprise
    architecture using an evolutionary approach that entails producing
    successively more mature versions. DHS released the initial version of
    its enterprise architecture in September 2003. In August 2004 we
    reported that the department's initial enterprise architecture provided
    a partial basis upon which to build future versions but was missing
    most of the content necessary to be considered a well-defined
    architecture. In particular, the content of this initial version was
    not systematically derived from a DHS or national corporate business
    strategy; rather, it was more the result of an amalgamation of the
    existing architectures that several of DHS's predecessor agencies
    already had. To its credit, the department recognized the limitations
    of the initial architecture. To assist DHS in evolving its
    architecture, we recommended 41 actions aimed at having DHS add needed
    architecture content. Since then, the department reported that it had
    taken steps in response to our recommendations. For example, DHS issued
    version 2 of its enterprise architecture, which the department reported
    contained additional business/mission, service, and technical
    descriptions, in October 2004. Subsequently, DHS decided to issue
    annual architecture updates. The first of these, DHS EA 2006, was
    issued in March 2006. In May 2007 we reported that DHS EA 2006
    partially addresses the content shortcomings in earlier versions.
    However, the full depth and breadth of architecture content that our 41
    recommendations provided for is not reflected. For example, we
    recommended that DHS use, among other things, an analysis of the gaps
    between the current ("as-is") and future ("to-be") states of the
    architecture to define missing and needed capabilities and form the
    basis for its transition plan. However, DHS EA 2006 does not include a
    transition plan and it does not include any evidence of a gap analysis.
    In addition we reported in August 2006 on DHS's enterprise architecture
    management capability, stating, among other things, that DHS has not
    fully implemented 7 of 31 elements of our Enterprise Architecture
    Management Maturity Framework. For example, we found that the
    department's enterprise architecture products and management processes
    do not undergo independent verification and validation and that the
    return on enterprise architecture investment is not measured and
    reported. For more information, see Homeland Security: Efforts Under
    Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-
    777; GAO-06-598T; Homeland Security: DHS Enterprise Architecture
    Continues to Evolve but Improvements Needed, GAO-07-564; Enterprise
    Architecture: Leadership Remains Key to Establishing and Leveraging
    Architectures for Organizational Transformation, GAO-06-831; and
    Information Technology: A Framework for Assessing and Improving
    Enterprise Architecture Management (Version 1.1), GAO-03-584G; DHS
    updated information: In March 2007, DHS reported that it has already
    addressed, or has identified tasks in its program plan to address,
    those elements of our Enterprise Architecture Management Maturity
    Framework that we found that the department had previously not fully or
    partially satisfied. In June 2007, DHS provided us with a newer, more
    current version of its architecture (i.e., DHS EA 2007), which it
    reports addresses many of our prior concerns; Our assessment: Because
    of the considerable time and resources necessary to evaluate an
    architecture as large and complex as DHS's, we have not had an
    opportunity to assess this latest version;
    Assessment: No assessment made.

    Performance expectation: 6. Implement a comprehensive enterprise
    architecture;
    Summary of findings: GAO findings: Between 2003 and 2007, we have
    reported on the extent to which the department has implemented its
    enterprise architecture to ensure alignment of major information
    technology investments, such as US-VISIT, CBP's Automated Commercial
    Environment system, and ICE's Atlas program. We reported in September
    2003 that US-VISIT was making assumptions and decisions about the
    program because the operational context was unsettled and unclear. In
    February 2005 we reported that DHS had assessed US-VISIT for alignment
    with the business and information/data views of its architecture and
    found it to be in compliance. However, the assessment did not include
    other architecture views, and DHS could not provide us with sufficient
    documentation to understand its architecture compliance methodology and
    criteria, or verifiable analysis to justify its determination. In
    February 2007, we reported that DHS had not reviewed US-VISIT
    architecture compliance for more than 2 years, during which time both
    US-VISIT and the DHS enterprise architecture had changed. We also
    reported in March 2005 and again in May 2006 that DHS's determination
    that the Automated Commercial Environment was aligned with DHS's
    architecture was not supported by sufficient documentation to allow us
    to understand its architecture compliance methodology and criteria or
    with verifiable analysis demonstrating alignment. We reported in
    September 2005 and again in July 2006 that DHS had determined that
    Atlas was in compliance with the architecture but that this
    determination was also not based on a documented analysis or
    methodology that is necessary to make such a determination. In August
    2006 we reported on DHS's enterprise architecture management
    capability. Among other things, we found that although DHS had a
    process that required information technology investment compliance with
    its enterprise architecture, the process did not include a methodology
    with detailed compliance criteria. For more information, see Homeland
    Security: Risks Facing Key Border and Transportation Security Program
    Need to Be Addressed, GAO-03-1083; Homeland Security: Some Progress
    Made, but Many Challenges Remain on U.S. Visitor and Immigrant Status
    Indicator Technology Program, GAO-05-202; Homeland Security: Planned
    Expenditures for U.S. Visitor and Immigrant Status Program Need to Be
    Adequately Defined and Justified, GAO-07-278; Information Technology:
    Customs Automated Commercial Environment Progress Progressing, but Need
    for Management Improvements Continues, GAO-05-267; Information
    Technology: Customs Has Made Progress on Automated Commercial
    Environment System, but It Faces Long-Standing Management Challenges
    and New Risks, GAO-06-580; Information Technology: Management
    Improvements Needed on Immigration and Customs Enforcement's
    Infrastructure Modernization Program, GAO-05-805; Information
    Technology: Immigration and Customs Enforcement Is Beginning to Address
    Infrastructure Modernization Program Weaknesses but Key Improvements
    Still Needed, GAO-06-823; GAO-03-584G; and GAO-06-831; DHS updated
    information: DHS did not provide us with updated information on its
    efforts to implement an enterprise architecture; Our assessment: We
    conclude that DHS has generally not achieved this performance
    expectation. We have reported that major DHS information technology
    investments have not been fully aligned with DHS's enterprise
    architecture, and DHS did not provide us evidence that these
    investments and others have been fully aligned with DHS's enterprise
    architecture;
    Assessment: Generally not achieved.

    Performance expectation: 7. Develop a process to effectively manage
    information technology investments;
    Summary of findings: GAO findings: DHS has not fully developed a
    process to manage information technology investments. Specifically, in
    April 2007, we reported that DHS has established the management
    structure to effectively manage its investments. However, the
    department had yet to fully define 8 of the 11 related policies and
    procedures defined by our information technology investment management
    framework.[A] Specifically, while DHS had documented the policies and
    related procedures for project-level management, some of these
    procedures did not include key elements. For example, procedures for
    selecting investments did not cite either the specific criteria or
    steps for prioritizing and selecting new information technology
    proposals, and procedures for management oversight of information
    technology projects and systems did not specify the rules that the
    investment boards were to follow in overseeing investments. In
    addition, the department had yet to define most of the policies
    associated with managing its information technology projects as
    investment portfolios. Officials attributed the absence of project-
    level procedures to resource constraints, stating that with a full time
    staff of six to support departmentwide investment management
    activities, they were more focused on performing investment management
    rather than documenting it in great detail. They attributed the absence
    of policies and procedures at the portfolio level to other investment
    management priorities. For more information, see Information
    Technology: DHS Needs to Fully Define and Implement Policies and
    Procedures for Effectively Managing Investments, GAO-07-424; DHS
    updated information: In March and April 2007, DHS provided us with
    information on its efforts to develop a process to effectively manage
    information technology investments. In particular, DHS reported that
    while it has substantial room for improvement in this area, DHS has
    developed an investment oversight foundation that can be effective;
    Our assessment: We conclude that DHS has generally not achieved this
    performance expectation. DHS has taken some actions to develop a
    process to effectively manage information technology investments, but
    much work remains. Specifically, the department has not yet fully
    defined many of the key policies and procedures identified in our
    information technology investment management framework;
    Assessment: Generally not achieved.

    Performance expectation: 8. Implement a process to effectively manage
    information technology investments;
    Summary of findings: GAO findings: DHS is not effectively managing its
    information technology investments. Specifically, in April 2007, we
    reported that DHS had not fully implemented any of the key practices
    our information technology investment management framework specifies as
    being needed to actually control investments--either at the project
    level or at the portfolio level. For example, according to DHS
    officials and the department's control review schedule, the investment
    boards had not conducted regular reviews of investments. Further, while
    control activities were sometimes performed, they were not performed
    consistently across all information technology projects. In addition,
    because the policies and procedures for portfolio management had yet to
    be defined, control of the department's investment portfolios was ad
    hoc, according to DHS officials. To strengthen information technology
    investment management, officials told us that they had hired a
    portfolio manager and were recruiting another one. For more
    information, see GAO-07-424; DHS updated information: In March 2007,
    DHS provided us with information on its efforts to develop a process to
    effectively manage information technology investments. In particular,
    DHS reported that while it has substantial room for improvement in this
    area, DHS has developed an investment oversight foundation that can be
    effective; Our assessment: We conclude that DHS has generally not
    achieved this performance expectation. DHS has taken some actions to
    implement a process to effectively manage information technology
    investments, but more work remains, particularly in implementing the
    key practices of our information technology investment management
    framework for actually controlling investments;
    Assessment: Generally not achieved.

    Performance expectation: 9. Develop policies and procedures for
    effective information systems development and acquisition;
    Summary of findings: GAO findings: In March 2006, we reported that DHS
    was in the process of drafting policies and procedures to establish a
    departmentwide systems development life cycle methodology that was
    intended to provide a common management approach to systems development
    and acquisition. According to DHS, the goals of the systems development
    life cycle are to help align projects to mission and business needs and
    requirements; incorporate accepted industry and government standards,
    best practices, and disciplined engineering methods, including
    information technology maturity model concepts; ensure that formal
    reviews and approval required by the process are consistent with DHS's
    investment management process; and institute disciplined life cycle
    management practices, including planning and evaluation in each phase
    of the information system cycle. The methodology is to apply to DHS's
    information technology portfolio as well as other capital asset
    acquisitions. Under the methodology, each program is expected to, among
    other things, follow disciplined project planning and management
    processes balanced by effective management controls; have a
    comprehensive project management plan; base project plans on user
    requirements that are testable, and traceable to the work products
    produced; and integrate information security activities throughout the
    systems development life cycle. For more information, see GAO-06-598T;
    DHS updated information: In March 2007, DHS provided us with updated
    information on its efforts to develop policies and procedures for
    information systems development and acquisition. Specifically, DHS's
    March 2007 Information Technology Integration and Management directive
    notes that the DHS Chief Information Officer is responsible for
    reviewing and approving any information technology acquisition in
    excess of $2.5 million; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation, as the life cycle
    methodology for managing systems development and acquisition in still
    in draft form and each component has its own methodology;
    Assessment: Generally not achieved.

    Performance expectation: 10. Implement policies and procedures for
    effective information systems development and acquisition;
    Summary of findings: GAO findings: DHS has faced challenges in
    implementing policies and procedures for effective information systems
    development and acquisition. Specifically, our reviews of several key
    (nonfinancial) information technology programs (e.g., US-VISIT, CBP's
    Automated Commercial Environment, and ICE's Atlas program) have
    disclosed numerous weaknesses in the implementation of policies and
    procedures relating to key development and acquisition areas, such as
    requirements development and management, test management, project
    planning, validation and verification, and contract management
    oversight. We have ongoing work related to specific systems acquisition
    programs. For more information, see GAO-04-702; DHS updated
    information: In March 2007, DHS provided us with updated information on
    its efforts to develop policies and procedures for information systems
    development and acquisition. Specifically, DHS's March 2007 Information
    Technology Integration and Management directive notes that the DHS
    Chief Information Officer is responsible for reviewing and approving
    any information technology acquisition in excess of $2.5 million and to
    ensure the alignment of the department's purchases with the target
    enterprise architecture; Our assessment: We conclude that DHS has
    generally not achieved this performance expectation. DHS has taken some
    actions to develop policies and procedures for reviewing information
    technology acquisitions. However, DHS did not provide us with evidence
    that these policies and procedures have been effectively implemented
    with regard to specific information technology acquisition programs,
    such as US-VISIT and the Automated Commercial Environment;
    Assessment: Generally not achieved.

    Performance expectation: 11. Provide operational capabilities for
    information technology infrastructure and applications;
    Summary of findings: GAO findings and assessment: We have not completed
    work in this area upon which to make an assessment. We previously
    reported that a gauge of DHS's progress in managing its information
    technology investments is the extent to which it has deployed and is
    currently operating more modern information technology systems and
    infrastructure;
    Assessment: No assessment made.

    Performance expectation: 12. Develop policies and procedures to ensure
    protection of sensitive information;
    Summary of findings: GAO findings and assessment: We conclude that DHS
    has generally achieved this performance expectation, as DHS has
    developed policies and procedures for protecting sensitive information.
    The Chief Information Officer designated the Chief Information Security
    Officer to carry out specific information security responsibilities
    that include developing and maintaining a departmentwide information
    security program; developing departmental information security policies
    and procedures; providing the direction and guidance necessary to
    ensure that information security throughout the department is compliant
    with federal information security requirements and policies; and
    advising the Chief Information Officer on the status and issues
    involving security aspects of the departmentwide information security
    program. Since DHS became operational in March 2003, the Chief
    Information Security Officer has developed and documented departmental
    policies and procedures that could provide a framework for implementing
    an agencywide information security program. For more information, see
    Information Security: Department of Homeland Security Needs to Fully
    Implement Its Security Program, GAO-05-700;
    Assessment: Generally achieved.

    Performance expectation: 13. Implement policies and procedures to
    effectively safeguard sensitive information;
    Summary of findings: GAO and DHS IG findings: DHS has not yet
    implemented policies and procedures for safeguarding sensitive
    information. In June 2005, we reported that DHS had yet to effectively
    implement a comprehensive, departmentwide information security program
    to protect the information and information systems that support its
    operations and assets. In particular, although it had developed and
    documented departmental policies and procedures that could provide a
    framework for implementing such a program, certain departmental
    components had not yet fully implemented key information security
    practices and controls. Examples of weaknesses in components'
    implementation included incomplete or missing elements in risk
    assessments, security plans, and remedial action plans, as well as
    incomplete, nonexistent, or untested continuity of operations plans. In
    September 2006, the DHS IG reported that DHS had made progress in
    implementing its information security program. For example, the DHS IG
    found that DHS had taken measures to develop a process to maintain a
    comprehensive systems inventory and to increase the number of
    operational systems that had been certified and accredited. Despite
    several improvements in DHS's information security program, the DHS IG
    found that DHS components, through their Information Systems Security
    Managers, had not completely aligned their respective information
    security programs with DHS's overall policies, procedures, and
    practices. For example, all DHS systems had not been properly certified
    and accredited; all components' information security weaknesses were
    not included in a plan of action and milestones; data in the enterprise
    management tool, Trusted Agent FISMA, was not complete or current; and
    system contingency plans had not been tested for all systems. The DHS
    IG reported that while DHS had issued substantial guidance designed to
    create and maintain secure systems, there were areas where the
    implementation of agencywide information security procedures required
    strengthening: (1) certification and accreditation; (2) plan of action
    and milestones; (3) security configurations; (4) vulnerability testing
    and remediation; (5) contingency plan testing; (6) incident detection,
    analysis, and reporting; and (7) specialized security training. For
    more information, see GAO-06-598T and GAO-05-700. Also, see Department
    of Homeland Security Office of Inspector General, Evaluation of DHS'
    Information Security Program for Fiscal Year 2006, OIG-06-62
    (Washington, D.C.: September 2006); DHS updated information: In March
    2007, DHS provided us with updated information on its efforts to
    implement policies and procedures to safeguard sensitive information.
    DHS reported initiating an Information Technology Security Remediation
    Project in 2006 to ensure that all DHS components implemented a common
    set of information security practices and key controls at the system
    level. According to DHS, all system owners were required to implement a
    common set of baseline controls as outlined in the directive on DHS
    Information Security Policy and to demonstrate compliance by submitting
    appropriate system security documentation, including a risk assessment,
    a system security plan, results of controls testing, a contingency plan
    (if required), and an accreditation letter signed by an appropriate
    Designated Accrediting Authority, for a department-level review. By the
    end of October 2006, DHS reported that 95 percent of the department's
    information technology systems were fully accredited; Our assessment:
    We conclude that DHS has generally not achieved this performance
    expectation. Although DHS has taken actions to implement policies and
    procedures to safeguard sensitive information, it has not yet
    effectively done so. For example, the DHS IG reported that the
    department had a material weaknesses in the effectiveness of general
    and application controls over its financial systems, and our ongoing
    work has identified significant information security weaknesses that
    pervade systems supporting a key departmental program. In addition,
    while DHS has taken actions to ensure that certification and
    accreditation activities are completed, the department did not provide
    evidence that it has strengthened its incident detection, analysis, and
    reporting and testing activities;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [A] GAO, Information Technology Investment Management: A Framework for
    Assessing and Improving Process Maturity, GAO-04-394G (Washington,
    D.C.: March 2004).

    [End of table]

    DHS Has Made Moderate Progress in Real Property Management:

    DHS has taken actions to implement its real property management
    responsibilities. Key elements of real property management, as
    specified in Executive Order 13327, "Federal Real Property Asset
    Management," include establishment of a Senior Real Property Officer,
    development of an asset inventory, and development and implementation
    of an asset management plan and performance measures. In June 2006, the
    Office of Management and Budget upgraded DHS's Real Property Asset
    Management Score from red to yellow after DHS developed an approved
    Asset Management Plan, developed a generally complete real property
    data inventory, submitted this inventory for inclusion in the
    governmentwide real property inventory database, and established
    performance measures consistent with Federal Real Property Council
    standards. DHS also designated a Senior Real Property Officer as
    directed by Executive Order 13327.

    As shown in table 42, we identified nine performance expectations for
    DHS in the area of real property management and found that overall DHS
    has made moderate progress in meeting those expectations. Specifically,
    we found that DHS has generally achieved six of the expectations and
    has generally not achieved three others. Our assessments for real
    property management are based on a report on DHS's real property
    management released in June 2007.

    Table 42: Performance Expectations and Progress Made in Real Property
    Management:

    Performance expectation: 1. Establish a Senior Real Property Officer
    who actively serves on the Federal Real Property Council;
    Assessment: Generally achieved.

    Performance expectation: 2. Complete and maintain a comprehensive
    inventory and profile of agency real property;
    Assessment: Generally achieved.

    Performance expectation: 3. Provide timely and accurate information for
    inclusion in the governmentwide real property inventory database;
    Assessment: Generally achieved.

    Performance expectation: 4. Develop an Office of Management and Budget-
    approved asset management plan;
    Assessment: Generally achieved.

    Performance expectation: 5. Establish an Office of Management and
    Budget-approved 3-year rolling timeline with certain deadlines by which
    the agency will address opportunities and determine its priorities as
    identified in the asset management plan;
    Assessment: Generally achieved.

    Performance expectation: 6. Demonstrate steps taken toward
    implementation of the asset management plan;
    Assessment: Generally not achieved.

    Performance expectation: 7. Establish real property performance
    measures;
    Assessment: Generally achieved.

    Performance expectation: 8. Use accurate and current asset inventory
    information and real property performance measures in management
    decision making;
    Assessment: Generally not achieved.

    Performance expectation: 9. Ensure the management of agency property
    assets is consistent with the agency's overall strategic plan, the
    agency asset management plan, and the performance measures;
    Assessment: Generally not achieved.

    Performance expectation: Total;
    Assessment: Generally achieved: 6;
    Assessment: Generally not achieved: 3;
    Assessment: No assessment made: 0.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Table 43 provides more detailed information on the progress that DHS
    has made in taking actions to achieve each performance expectation in
    the area of real property management and our assessment of whether DHS
    has taken steps to satisfy most of the key elements of the performance
    expectation (generally achieved) or has not taken steps to satisfy most
    of the performance expectation's key elements (generally not achieved).

    Table 43: Performance Expectations and Assessment of DHS Progress in
    Real Property Management:

    Performance expectation: 1. Establish a Senior Real Property Officer
    who actively serves on the Federal Real Property Council;
    Summary of findings: GAO findings and assessment: DHS has appointed a
    Senior Real Property Officer whose official title is Chief
    Administrative Officer. The Senior Real Property Officer serves on the
    Federal Real Property Council and coordinates the formulation and
    implementation of real property management planning for DHS. For more
    information, see Federal Real Property: DHS Has Made Progress, but
    Additional Actions Are Needed to Address Real Property Management and
    Security Challenges, GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 2. Complete and maintain a comprehensive
    inventory and profile of agency real property;
    Summary of findings: GAO findings and assessment: DHS has developed and
    maintained an inventory of agency real property. DHS's real property
    data inventory, called the Real Property Information System, is
    designed to enable active and efficient stewardship of its real
    property assets. It has been in place since April 2006. For more
    information, see GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 3. Provide timely and accurate information for
    inclusion in the governmentwide real property inventory database;
    Summary of findings: GAO findings and assessment: DHS submits data on
    real property that it owns and directly leases to the General Services
    Administration's governmentwide real property inventory. For more
    information, see GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 4. Develop an Office of Management and Budget-
    approved asset management plan;
    Summary of findings: GAO findings and assessment: DHS has developed an
    Office of Management and Budget-approved asset management plan. The
    administration's Real Property Initiative required DHS to develop and
    implement an asset management plan, develop a real property inventory
    that tracked DHS's assets, and develop and use performance measures.
    The Office of Management and Budget approved DHS's asset management
    plan in June 2006. For more information, see GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 5. Establish an Office of Management and
    Budget-approved 3-year rolling timeline with certain deadlines by which
    the agency will address opportunities and determine its priorities as
    identified in the asset management plan;
    Summary of findings: GAO findings and assessment: DHS has developed an
    Office of Management and Budget-approved 3-year timeline to implement
    the goals and objectives of the asset management plan. For more
    information, see GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 6. Demonstrate steps taken toward
    implementation of the asset management plan;
    Summary of findings: GAO findings and assessment: DHS has yet to
    demonstrate full implementation of its asset management plan. For more
    information, see GAO-07-658;
    Assessment: Generally not achieved.

    Performance expectation: 7. Establish real property performance
    measures;
    Summary of findings: GAO findings and assessment: DHS has established
    asset management performance measures, including facility condition,
    utilization, mission dependency, and annual operating and maintenance
    costs. For more information, see GAO-07-658;
    Assessment: Generally achieved.

    Performance expectation: 8. Use accurate and current asset inventory
    information and real property performance measures in management
    decision making;
    Summary of findings: GAO findings and assessment: DHS has yet to
    demonstrate full use of asset inventory information and performance
    measures in management decision making. For more information, see GAO-
    07-658;
    Assessment: Generally not achieved.

    Performance expectation: 9. Ensure the management of agency property
    assets is consistent with the agency's overall strategic plan, the
    agency asset management plan, and the performance measures;
    Summary of findings: GAO findings and assessment: DHS has not yet taken
    steps to ensure that the management of agency property assets is
    consistent with the DHS strategic plan, asset management plan, and
    performance measures. For more information, see GAO-07-658;
    Assessment: Generally not achieved.

    Source: GAO analysis.

    Note: An assessment of "generally achieved" indicates that DHS has
    taken sufficient actions to satisfy most elements of the expectation.
    However, an assessment of "generally achieved" does not signify that no
    further action is required of DHS or that functions covered by the
    expectation cannot be further improved or enhanced. Conversely,
    "generally not achieved" indicates that DHS has not yet taken
    sufficient actions to satisfy most elements of the performance
    expectation. An assessment of "generally not achieved" may be warranted
    even where DHS has put forth substantial effort to satisfy some but not
    most elements of an expectation. In cases when we or the DHS IG have
    not completed work upon which to base an assessment of DHS actions to
    satisfy a performance expectation, and/or the information DHS provided
    did not enable us to clearly determine the extent to which DHS has
    achieved the performance expectation, we indicated "no assessment
    made."

    [End of table]

    Cross-cutting Issues Have Hindered DHS's Implementation Efforts:

    Our work has identified homeland security challenges that cut across
    DHS's mission and core management functions. These issues have impeded
    the department's progress since its inception and will continue as DHS
    moves forward. While it is important that DHS continue to work to
    strengthen each of its mission and core management functions, it is
    equally important that these key issues be addressed from a
    comprehensive, departmentwide perspective to help ensure that the
    department has the structure and processes in place to effectively
    address the threats and vulnerabilities that face the nation. These
    issues include: (1) transforming and integrating DHS's management
    functions; (2) establishing baseline performance goals and measures and
    engaging in effective strategic planning efforts; (3) applying and
    improving a risk management approach for implementing missions and
    making resource allocation decisions; (4) sharing information with key
    stakeholders; and (5) coordinating and partnering with federal, state,
    local, and private sector agencies. We have made numerous
    recommendations to DHS to strengthen these efforts, and the department
    has made progress in implementing some of these recommendations.

    DHS Has Not Yet Transformed Its Component Agencies into a Fully
    Functioning Department:

    DHS has faced a variety of difficulties in its efforts to transform
    into a fully functioning department, and we have designated DHS
    implementation and transformation as high-risk. We first designated
    DHS's implementation and transformation as high-risk in 2003 because 22
    disparate agencies had to transform into one department. Many of these
    individual agencies were facing their own management and mission
    challenges. But most importantly, the failure to effectively address
    DHS's management challenges and program risks could have serious
    consequences for our homeland security as well as our economy. We kept
    DHS implementation and transformation on the high-risk list in 2005
    because serious transformation challenges continued to hinder DHS's
    success. Since then, our and the DHS IG's reports have documented DHS's
    progress and remaining challenges in transforming into an effective,
    integrated organization. For example, in the management area, DHS has
    developed a strategic plan, is working to integrate some management
    functions, and has continued to form necessary partnerships to achieve
    mission success. Despite these efforts, we reported that DHS
    implementation and transformation remains on the 2007 high-risk list
    because numerous management challenges remain, such as in the areas of
    acquisition, financial, human capital, and information technology
    management. We stated that the array of management and programmatic
    challenges continues to limit DHS's ability to carry out its roles
    under the National Strategy for Homeland Security in an effective risk-
    based way.

    We have recommended that agencies on the high-risk produce a corrective
    action plan that defines the root causes of identified problems,
    identifies effective solutions to those problems, and provides for
    substantially completing corrective measures in the near term. Such a
    plan should include performance metrics and milestones, as well as
    mechanisms to monitor progress. In the spring of 2006, DHS provided us
    with a draft corrective action plan that did not contain key elements
    we have identified as necessary for an effective corrective action
    plan, including specific actions to address identified objectives. As
    of May 2007, DHS had not submitted a corrective action plan to the
    Office of Management and Budget. According to the Office of Management
    and Budget, this is one of the few high-risk areas that has not
    produced a final corrective action plan.

    Our prior work on mergers and acquisitions, undertaken before the
    creation of DHS, found that successful transformations of large
    organizations, even those faced with less strenuous reorganizations
    than DHS, can take at least 5 to 7 years to achieve. We reported that
    the creation of DHS is an enormous management challenge and that DHS
    faces a formidable task in its transformation efforts as it works to
    integrate over 170,000 federal employees from 22 component agencies.
    Each component agency brought differing missions, cultures, systems,
    and procedures that the new department had to efficiently and
    effectively integrate into a single, functioning unit. At the same time
    it weathers these growing pains, DHS must still fulfill its various
    homeland security and other missions.

    To strengthen its transformation efforts, we recommended, and DHS
    agreed, that it should develop an overarching management integration
    strategy, and provide the then DHS Business Transformation Office with
    the authority and responsibility to serve as a dedicated integration
    team and also to help develop and implement the strategy. We reported
    that although DHS has issued guidance and plans to assist management
    integration on a function by function basis, it has not developed a
    plan that clearly identifies the critical links that should occur
    across these functions, the necessary timing to make these links occur,
    how these interrelationships will occur, and who will drive and manage
    them. In addition, although DHS had established a Business
    Transformation Office that reported to the Under Secretary for
    Management to help monitor and look for interdependencies among the
    individual functional management integration efforts, that office was
    not responsible for leading and managing the coordination and
    integration itself. We understand that the Business Transformation
    Office has been recently eliminated. We have suggested that Congress
    should continue to monitor whether it needs to provide additional
    leadership authorities to the DHS Under Secretary for Management, or
    create a Chief Operating Officer/Chief Management Officer position
    which could help elevate, integrate, and institutionalize DHS's
    management initiatives. The Implementing Recommendations of the 9/11
    Commission Act of 2007, enacted in August 2007, designates the Under
    Secretary for Management as the Chief Management Officer and principal
    advisor on management-related matters to the Secretary.[Footnote 28]
    Under the Act, the Under Secretary is responsible for developing a
    transition and succession plan for the incoming Secretary and Under
    Secretary to guide the transition of management functions to a new
    administration. The Act further authorizes the incumbent Under
    Secretary as of November 8, 2008 (after the next presidential
    election), to remain in the position until a successor is confirmed to
    ensure continuity in the management functions of DHS.

    In addition, transparency plays an important role in helping to ensure
    efficient and effective transformation efforts. With regard to DHS, we
    have reported that DHS has not made its management or operational
    decisions transparent enough so that Congress can be sure it is
    effectively, efficiently, and economically using the billions of
    dollars in funding it receives annually. More specifically, in April
    2007, we testified that we have encountered access issues in numerous
    engagements, and the lengths of delay have been both varied and
    significant and have affected our ability to do our work in a timely
    manner. We reported that we have experienced delays with DHS components
    that include CBP, ICE, FEMA, and TSA on different types of work such as
    information sharing, immigration, emergency preparedness in primary and
    secondary schools, and accounting systems. The Secretary of DHS and the
    Under Secretary for Management have stated their desire to work with us
    to resolve access issues and to provide greater transparency. It will
    be important for DHS to become more transparent and minimize recurring
    delays in providing access to information on its programs and
    operations so that Congress, GAO, and others can independently assess
    its efforts.

    DHS Has Not Yet Developed Outcome-Based Measures to Assess Strategic
    Performance in Many Areas:

    DHS has not always implemented effective strategic planning efforts and
    has not yet fully developed performance measures or put into place
    structures to help ensure that the agency is managing for results. We
    have identified strategic planning as one of the critical success
    factors for new organizations. This is particularly true for DHS, given
    the breadth of its responsibility and need to clearly identify how
    stakeholders' responsibilities and activities align to address homeland
    security efforts. The Government Performance and Results Act (GPRA) of
    1993 requires that federal agencies consult with the Congress and key
    stakeholders to assess their missions, long-term goals, strategies, and
    resources needed to achieve their goals. It also requires that the
    agency include six key components in its strategic plan: (1) a mission
    statement; (2) long-term goals and objectives; (3) approaches (or
    strategies) to achieve the goals and objectives; (4) a description of
    the relationship between annual and long-term performance goals; (5)
    key factors that could significantly affect achievement of the
    strategic goals; and (6) a description of how program evaluations were
    used to establish or revise strategic goals. Other best practices in
    strategic planning and results management that we have identified
    include involving stakeholders in the strategic planning process,
    continuously monitoring internal and external environments to
    anticipate future challenges and avoid potential crises, holding
    managers accountable for the results of their programs, and aligning
    program performance measures and individual performance expectations at
    each organizational level with agencywide goals and objectives.

    DHS issued a departmentwide strategic plan in 2004 that addressed five
    of six GPRA-required elements. The plan included a mission statement,
    long-term goals, strategies to achieve the goals, key external factors,
    and program evaluations, but did not describe the relationship between
    annual and long-term goals. The linkage between annual and long-term
    goals is important for determining whether an agency has a clear sense
    of how it will assess progress toward achieving the intended results of
    its long-term goals. While DHS's Performance Budget Overview and other
    documents include a description of the relationship between annual and
    long-term goals, not including this in the strategic plan made it more
    difficult for DHS officials and stakeholders to identify how their
    roles and responsibilities contributed to DHS's mission. In addition,
    although DHS's planning documents described programs requiring
    stakeholder coordination to effectively implement them, stakeholder
    involvement in the planning process itself was limited. Given the many
    other organizations at all levels of government and in the private
    sector whose involvement is key to meeting homeland security goals,
    earlier and more comprehensive stakeholder involvement in the planning
    process is essential to the success of DHS's planning efforts. Such
    involvement is important to ensure that stakeholders help identify and
    agree on how their daily operations and activities contribute to
    fulfilling DHS's mission. To make DHS a more results-oriented agency,
    we recommended that DHS's strategic planning process include direct
    consultation with external stakeholders, that its next strategic plan
    include a description of the relationship between annual performance
    goals and long-term goals, and that the next strategic plan adopt
    additional good strategic planning practices, such as ensuring that the
    strategic plan includes a timeline for achieving long-terms goals and a
    description of the specific budgetary, human capital, and other
    resources needed to achieve those goals. According to DHS officials,
    the department is planning to issue an updated strategic plan, but they
    did not provide a target time frame for when the plan would be issued.

    We have also reported on the importance of the development of outcome-
    based performance goals and measures as part of strategic planning and
    results management efforts. Performance goals and measures are intended
    to provide Congress and agency management with information to
    systematically assess a program's strengths, weaknesses, and
    performance. A performance goal is the target level of performance
    expressed as a tangible, measurable objective against which actual
    achievement will be compared. A performance measure can be defined as
    an indicator, statistic, or metric used to gauge program performance.
    Outcome-oriented measures show results or outcomes related to an
    initiative or program in terms of its effectiveness, efficiency, or
    impact.[Footnote 29]

    A number of DHS's programs lack outcome goals and measures, which may
    hinder the department's ability to effectively assess the results of
    program efforts or fully assess whether the department is using
    resources effectively and efficiently, especially given various agency
    priorities for resources. In particular, we have reported that some of
    DHS's components have not developed adequate outcome-based performance
    measures or comprehensive plans to monitor, assess, and independently
    evaluate the effectiveness of their plans and performance. For example,
    in August 2005 we reported that ICE lacked outcome goals and measures
    for its worksite enforcement program and recommended that the agency
    set specific time frames for developing these goals and measures. In
    March 2006, we reported that USCIS had not yet established performance
    goals and measures to assess its benefit fraud activities, and we
    recommended that they do so. Further, we have also reported that many
    of DHS's border-related performance goals and measures are not fully
    defined or adequately aligned with one another, and some performance
    targets are not realistic. Yet, we have also recognized that DHS faces
    some inherent difficulties in developing performance goals and measures
    to address its unique mission and programs, such as in developing
    measures for the effectiveness of its efforts to prevent and deter
    terrorist attacks.

    DHS Has Not Fully Applied a Risk Management Approach in Implementing
    All Mission Areas:

    DHS has not fully adopted and applied a risk management approach in
    implementing its mission and core management functions. Risk management
    has been widely supported by the President and Congress as a management
    approach for homeland security, and the Secretary of Homeland Security
    has made it the centerpiece of departmental policy. We have previously
    reported that defining an acceptable, achievable (within constrained
    budgets) level of risk is an imperative to address current and future
    threats. Many have pointed out, as did the Gilmore and 9/11
    Commissions, that the nation will never be completely safe and total
    security is an unachievable goal. Within its sphere of responsibility,
    DHS cannot afford to protect everything against all possible threats.
    As a result, DHS must make choices about how to allocate its scarce
    resources to most effectively manage risk. A risk management approach
    can help DHS make decisions systematically and is consistent with the
    National Strategy for Homeland Security and DHS's strategic plan, which
    have called for the use of risk-based decisions to prioritize DHS's
    resource investments regarding homeland security related programs.

    Several DHS component agencies have taken steps toward integrating
    risk-based decision making into their decision making processes. For
    example, the Coast Guard has taken actions to mitigate vulnerabilities
    and enhance maritime security. Security plans for seaports, facilities,
    and vessels have been developed based on assessments that identify
    their vulnerabilities. In addition, the Coast Guard used a Maritime
    Security Risk Assessment Model to prioritize risk according to a
    combination of possible threat, consequence, and vulnerability
    scenarios. Under this approach, seaport infrastructure that was
    determined to be both a critical asset and a likely and vulnerable
    target would be a high priority for funding security enhancements. By
    comparison, infrastructure that was vulnerable to attack but not as
    critical or infrastructure that was very critical but already well
    protected would be lower in priority. In the transportation area, TSA
    has incorporated risk-based decision-making into number of its programs
    and processes. For example, TSA has started to incorporate risk
    management principles into securing air cargo, but has not conducted
    assessments of air cargo vulnerabilities or critical assets (cargo
    facilities and aircraft)--two crucial elements of a risk-based
    management approach without which TSA may not be able to appropriately
    focus its resources on the most critical security needs. TSA also
    completed an Air Cargo Strategic Plan in November 2003 that outlined a
    threat-based risk management approach to securing the nation's air
    cargo transportation system. However, TSA's existing tools for
    assessing vulnerability have not been adapted for use in conducting air
    cargo assessments, nor has TSA established a schedule for when these
    tools would be ready for use.

    Although some DHS components have taken steps to apply risk-based
    decision making in implementing their mission functions, we also found
    that other components have not always utilized such an approach. DHS
    has not performed comprehensive risk assessments in transportation,
    critical infrastructure, and the immigration and customs systems to
    guide resource allocation decisions. For example, DHS has not fully
    utilized a risk-based strategy to allocate resources among
    transportation sectors. Although TSA has developed tools and processes
    to assess risk within and across transportation modes, it has not fully
    implemented these efforts to drive resource allocation decisions. We
    also recently identified concerns about DHS's use of risk management in
    distributing grants to states and localities. For fiscal years 2006 and
    2007, DHS has used risk assessments to identify urban areas that faced
    the greatest potential risk, and were therefore eligible to apply for
    the Urban Areas Security Initiative grant, and based the amount of
    awards to all eligible areas primarily on the outcomes of the risk
    assessment and a new effectiveness assessment. Starting in fiscal year
    2006, DHS made several changes to the grant allocation process,
    including modifying its risk assessment methodology, and introducing an
    assessment of the anticipated effectiveness of investments. DHS
    combined the outcomes of these two assessments to make funding
    decisions. However, we found that DHS had limited knowledge of how
    changes to its risk assessment methods, such as adding asset types and
    using additional or different data sources, affect its risk estimates.
    As a result, DHS had a limited understanding of the effects of the
    judgments made in estimating risk that influenced eligibility and
    allocation outcomes for fiscal year 2006. DHS leadership could make
    more informed policy decisions if it were provided with alternative
    risk estimates and funding allocations resulting from analyses of
    varying data, judgments, and assumptions. We also reported that DHS has
    not applied a risk management approach in deciding whether and how to
    invest in specific capabilities for a catastrophic threat, and we
    recommended that it do so.

    In April 2007, DHS established the new Office of Risk Management and
    Analysis to serve as the DHS Executive Agent for national-level risk
    management analysis standards and metrics; develop a standardized
    approach to risk; develop an approach to risk management to help DHS
    leverage and integrate risk expertise across components and external
    stakeholders; assess DHS risk performance to ensure programs are
    measurably reducing risk; and communicating DHS risk management in a
    manner that reinforces the risk-based approach. According to DHS, the
    office's activities are intended to develop a risk architecture, with
    standardized methodologies for risk analysis and management, to assist
    in the prioritization of risk reduction programs and to ensure that DHS
    component risk programs are synchronized, integrated, and use a common
    approach. Although this new office should help to coordinate risk
    management planning and activities across the department, it is too
    early to tell what effect this office will have on strengthening
    departmentwide risk management activities.

    Information Sharing Remains a Challenge for DHS:

    The federal government, including DHS, has made progress in developing
    a framework to support a more unified effort to secure the homeland,
    including information sharing. However, opportunities exist to enhance
    the effectiveness of information sharing among federal agencies and
    with state and local governments and private sector entities. As we
    reported in August 2003, efforts to improve intelligence and
    information sharing needed to be strengthened. In 2005, we designated
    information sharing for homeland security as high-risk. We recently
    reported that the nation still lacked an implemented set of
    governmentwide policies and processes for sharing terrorism
    information, but has issued a strategy on how it will put in place the
    overall framework, policies, and architecture for sharing with all
    critical partners--actions that we and others have recommended. The
    Intelligence Reform and Terrorism Prevention Act of 2004 required that
    the President create an "information sharing environment" to facilitate
    the sharing of terrorism information, yet this environment remains in
    the planning stage. An implementation plan for the environment, which
    was released on November 16, 2006, defines key tasks and milestones for
    developing the information sharing environment, including identifying
    barriers and ways to resolve them, as we recommended. We noted that
    completing the information sharing environment is a complex task that
    will take multiple years and long-term administration and congressional
    support and oversight, and will pose cultural, operational, and
    technical challenges that will require a collaborated response.

    DHS has taken some steps to implement its information sharing
    responsibilities. For example, DHS implemented a system to share
    homeland security information. States and localities are also creating
    their own information "fusion" centers, some with DHS support. DHS has
    further implemented a program to protect sensitive information the
    private sector provides it on security at critical infrastructure
    assets, such as nuclear and chemical facilities. However, the DHS IG
    found that users of the information system were confused with it and as
    a result did not regularly use it; and DHS had not secured of the
    private sector's trust that the agency could adequately protect and
    effectively use the information that sector provided. These challenges
    will require longer-term actions to resolve. Our past work in the
    information sharing and warning areas has highlighted a number of other
    challenges that need to be addressed. These challenges include
    developing productive information sharing relationships among the
    federal government, state and local governments, and the private
    sector; and ensuring that the private sector receives better
    information on potential threats.

    DHS Has Faced Difficulties in Coordinating with Homeland Security
    Partners:

    In addition to providing federal leadership with respect to homeland
    security, DHS also plays a large role in coordinating the activities of
    other federal, state, local, private sector, and international
    stakeholders, but has faced challenges in this regard. To secure the
    nation, DHS must form effective and sustained partnerships between
    legacy component agencies and also with a range of other entities,
    including other federal agencies, state and local governments, the
    private and nonprofit sectors, and international partners. We have
    reported that successful partnering and coordination involves
    collaborating and consulting with stakeholders to develop and agree on
    goals, strategies, and roles to achieve a common purpose; identify
    resource needs; establish a means to operate across agency boundaries,
    such as compatible procedures, measures, data, and systems; and agree
    upon and document mechanisms to monitor, evaluate, and report to the
    public on the results of joint efforts. We have found that the
    appropriate homeland security roles and responsibilities within and
    between the levels of government and with the private sector are
    evolving and need to be clarified.

    The implementation of the National Strategy for Homeland Security
    further underscores the importance for DHS of partnering and
    coordination. For example, 33 of the strategy's 43 initiatives are
    required to be implemented by 3 or more federal agencies and the
    National Strategy identifies the private sector as a key homeland
    security partner. If these entities do not effectively coordinate their
    implementation activities, they may waste resources by creating
    ineffective and incompatible pieces of a larger security program. For
    example, because the private sector owns or operates 85 percent of the
    nation's critical infrastructure, DHS must partner with individual
    companies and sector organizations in order to protect vital national
    infrastructure, such as the nation's water supply, transportation
    systems and chemical facilities. In October 2006 we reported that all
    17 critical infrastructure sectors established their respective
    government councils, and nearly all sectors initiated their voluntary
    private sector councils in response to the National Infrastructure
    Protection Plan. The councils, among other things, are to identify
    their most critical assets, assess the risks they face, and identify
    protective measures, in sector-specific plans that comply with DHS's
    National Infrastructure Protection Plan.

    DHS has taken other important actions in developing partnerships and
    mechanisms for coordinating with homeland security partners. For
    example, DHS formed the National Cyber Response Coordination Group to
    coordinate the federal response to cyber incidents of national
    significance. It is a forum of national security, law enforcement,
    defense, intelligence, and other government agencies that coordinates
    intragovernmental and public/private preparedness and response to and
    recovery from national level cyber incidents and physical attacks that
    have significant cyber consequences. In the area of maritime security,
    DHS has also taken actions to partner with a variety of stakeholders.
    For example, the Coast Guard reported to us that as of June 2006, 35
    sector command centers had been created and that these centers were the
    primary conduit for daily collaboration and coordination between the
    Coast Guard and its port partner agencies. We also found that through
    its Customs-Trade Partnership Against Terrorism Program, CBP has worked
    in partnership with private companies to review their supply chain
    security plans to improve members' overall security.

    However, DHS has faced some challenges in developing other effective
    partnerships and in clarifying the roles and responsibilities of
    various homeland security stakeholders. For example, in February 2007
    we testified that because DHS has only limited authority to address
    security at chemical facilities it must continue to work with the
    chemical industry to ensure that it is assessing vulnerabilities and
    implementing security measures. Also, while TSA has taken steps to
    collaborate with federal and private sector stakeholders in the
    implementation of its Secure Flight program, in 2006 we reported these
    stakeholders stated that TSA has not provided them with the information
    they would need to support TSA's efforts as they move forward with the
    program. In addition, we reported in September 2005 that TSA did not
    effectively involve private sector stakeholders in its decision making
    process for developing security standards for passenger rail assets We
    recommended, and DHS developed, security standards that reflected
    industry best practices and could be measured, monitored, and enforced
    by TSA rail inspectors and, if appropriate, by rail asset owners. We
    have also made other recommendations to DHS to help strengthen its
    partnership efforts in the areas of transportation security and
    research and development.

    Further, lack of clarity regarding roles and responsibilities caused
    DHS difficulties in coordinating with its emergency preparedness and
    response partners in responding to Hurricanes Katrina and Rita. For
    example, the Red Cross and FEMA had differing views about their roles
    and responsibilities under the National Response Plan, which hampered
    efforts to coordinate federal mass care assistance. Department of Labor
    and FEMA officials also disagreed about which agency was responsible
    for ensuring the safety and health of response and recovery workers.
    This lack of clarity about each other's roles and procedures resulted
    in delayed implementation of the National Response Plan's Worker Safety
    and Health Support Annex. We recommended that DHS take steps to improve
    partnering and coordination efforts as they relate to emergency
    preparedness and response, including to seek input from the state and
    local governments and private sector entities, such as the Red Cross,
    on the development and implementation of key capabilities, including
    those for interoperable communications.

    Concluding Observations:

    Given the dominant role that DHS plays in securing the homeland, it is
    critical that the department's mission programs and management systems
    and functions operate as efficiently and effectively as possible. In
    the more than 4 years since its establishment, the department has taken
    important actions to secure the border and the transportation sector
    and to defend against, prepare for, and respond to threats and
    disasters. DHS has had to undertake these critical missions while also
    working to transform itself into a fully functioning cabinet
    department--a difficult undertaking for any organization and one that
    can take, at a minimum, 5 to 7 years to complete even under less
    daunting circumstances. At the same time, a variety of factors,
    including Hurricanes Katrina and Rita, threats to and attacks on
    transportation systems in other countries, and new responsibilities and
    authorities provided by Congress have forced the department to reassess
    its priorities and reallocate resources to address key domestic and
    international events and to respond to emerging issues and threats.

    As it moves forward, DHS will continue to face the challenges that have
    affected its operations thus far, including transforming into a high-
    performing, results-oriented agency; developing results-oriented goals
    and measures to effectively assess performance; developing and
    implementing a risk-based approach to guide resource decisions; and
    establishing effective frameworks and mechanisms for sharing
    information and coordinating with homeland security partners. DHS has
    undertaken efforts to address these challenges but will need to give
    continued attention to these efforts in order to efficiently and
    effectively identify and prioritize mission and management needs,
    implement efforts to address those needs, and allocate resources
    accordingly. Efforts to address these challenges will be especially
    important over the next several years given the threat environment and
    long-term fiscal imbalance facing the nation.

    To address these challenges, DHS will need to continue its efforts to
    develop a results-oriented mission and management framework to guide
    implementation efforts and progress toward achieving desired outcomes.
    In moving forward, it will also be important for DHS to routinely
    reassess its mission and management goals, measures, and milestones to
    evaluate progress made, identify past and emerging obstacles, and
    examine alternatives to address those obstacles and effectively
    implement its missions. We have made nearly 700 recommendations to DHS
    on initiatives and reforms that would enhance its ability to implement
    its core mission and management functions, including developing
    performance goals and measures and setting milestones for key programs,
    making resource allocation decisions based on risk assessments, and
    developing and implementing internal controls to help ensure program
    effectiveness. DHS has generally agreed with our prior recommendations.

    Moreover, taking those actions that we have suggested for agencies on
    our high-risk list provides a good road map for DHS as it works to
    further develop management structures that, once in place, could help
    the department more efficiently and effectively implement its mission
    and management functions. To be removed from our high-risk list,
    agencies first have to produce a corrective action plan that defines
    the root causes of identified problems, identifies effective solutions
    to those problems, and provides for substantially completing corrective
    measures in the near term. Such a plan should include performance
    metrics and milestones, as well as mechanisms to monitor progress. In
    the spring of 2006, DHS provided us with a draft corrective action plan
    that did not contain key elements we have identified as necessary for
    an effective corrective action plan, including specific actions to
    address identified objectives, and this plan has not yet been approved
    by the Office of Management and Budget. Second, agencies must
    demonstrate significant progress in addressing the problems identified
    in their corrective action plans. It will be important for DHS to
    become more transparent and minimize recurring delays in providing
    access to information on its programs and operations so that Congress,
    GAO, and others can independently assess its efforts. Finally,
    agencies, in particular top leadership, must demonstrate a commitment
    to sustain initial improvements in their performance over the long
    term. Although DHS leaders have expressed their intent to integrate
    legacy agencies into the new department, they have not dedicated the
    resources needed to oversee this effort.

    A well-managed, high-performing Department of Homeland Security is
    essential to meeting the significant homeland security challenges
    facing the nation. As DHS continues to evolve, implement its programs,
    and integrate its functions, we will continue to review its progress
    and performance and provide information to Congress and the public on
    its efforts.

    Agency Comments and Our Evaluation:

    We requested comments on this report from the Secretary of Homeland
    Security. In comments dated July 20, 2007, and signed by the
    Undersecretary for Management (reprinted in their entirety in appendix
    II), DHS took issues with our methodology and disagreed with the
    conclusions we reached for 42 of the 171 performance expectations
    (specifically 41 of the 84 performance expectations where we assessed
    DHS as not having achieved the expectation and 1 of the 9 performance
    expectations for which we did not make an assessment). DHS also
    provided technical comments, which we considered and incorporated where
    appropriate.

    DHS raised five general issues with our methodology. First, DHS
    believes that we altered the criteria by which we would judge the
    department's progress in changing our terminology from "generally
    addressed" to "generally achieved." As we communicated to DHS, we did
    not change the underlying assessment approach or evaluation criteria.
    Rather, we changed the way that we characterized DHS's progress for
    each performance expectation. For example, our definition for
    "generally addressed" and "generally achieved" did not change: "Our
    work has shown that DHS has taken steps to effectively satisfy the key
    elements of the performance expectation but may not have satisfied all
    of the elements." The change from "addressed" to "achieved" was not a
    change in methodology, criteria, or standards but only a change in
    language to better convey, in the context of results-oriented
    government, the legislative and executive intent behind these
    performance expectations that DHS achieve these expectations rather
    than merely begin to take steps that apply or are relevant to them.

    Second, DHS took issue with the binary standard we used to assess each
    performance expectation. While we acknowledge the binary standard we
    applied is not perfect, we believe it is appropriate for this review
    because the administration generally has not established quantitative
    goals and measures for the performance expectations in connection with
    the various mission and management areas. Thus, we could not assess
    where along a spectrum of progress DHS stood for individual performance
    expectations. We chose the 2-step process for assessing DHS's progress-
    -using a binary standard for individual performance expectations and a
    spectrum for broad mission and management areas--and fully disclosed it
    to and discussed it with DHS officials at the outset and throughout the
    review.

    Third, DHS was concerned about how we defined our criteria for
    assessing DHS's progress in achieving each performance expectation and
    an apparent shift of criteria we applied after the department supplied
    us additional information and documents. With regard to how we defined
    our criteria and the performance expectations, the key elements for the
    expectations were inherent to each one, and we discussed these elements
    in each assessment. Further, we did not shift our criteria. Rather we
    employed a process by which we disclosed our preliminary analysis and
    assessments to DHS, received and analyzed additional documents and
    statements from DHS officials, and updated (and in many cases changed)
    our preliminary assessments based on the additional inputs. This
    process resulted in an improvement, a diminution, or no change in our
    assessment of the applicable area. In some cases, we added language to
    clarify the basis of our assessment after our review of the additional
    information DHS provided.

    Fourth, DHS raised concerns that we did not "normalize" the application
    of our criteria by the many GAO analysts who had input to this review.
    Our methodology involved significant input by these analysts because
    they have had experience with the mission and management areas we were
    evaluating and were knowledgeable about the programs, specific
    performance expectations, activities, data, and results from each area.
    A core team of GAO analysts and managers reviewed all the inputs from
    these other GAO staff to ensure the consistent application of our
    methodology, criteria, and analytical process. In addition, our quality
    control process included detailed reviews of the facts included in this
    report, as well as assurance that we followed GAO's policies and
    generally accepted government auditing standards.

    Finally, DHS points out that we treated all performance expectations as
    if they were of equal significance. In our scope and methodology
    section we recognize that qualitative differences between the
    performance expectations exist, but we did not apply a weight to the
    performance expectations because congressional, departmental, and
    other stakeholders' views on the relative priority of each performance
    expectation may be different and we did not believe it was appropriate
    to substitute our judgment for theirs.

    DHS disagreed with our assessment of 42 of the 171 performance
    expectations--including 41 of the 84 performance expectations we
    assessed as generally not achieved--contending that we did not fully
    take account of all the actions it has taken relative to each
    expectation. Specifically, DHS believes that we expected DHS to achieve
    an entire expectation in cases where both DHS and we agree that
    ultimate achievement will not be possible for several more years, such
    as in the areas of border security and science and technology. This
    report provides Congress and the public with an assessment of DHS's
    progress as of July 2007 and does not reflect the extent to which DHS
    should have or could have made more progress. We believe that it is
    appropriate, after pointing out the expectation for a multiyear program
    and documenting the activities DHS has actually accomplished to date,
    to reach a conclusion about whether DHS had not implemented the program
    after 4 years.

    DHS's concern that we have not adequately used or interpreted
    additional information it provided us, such as for performance
    expectations in the areas of aviation security and emergency
    preparedness and response, has little basis. We fully considered all
    information and documents DHS provided and described how we applied
    this information in the assessment portion of each performance
    expectation. In some cases DHS only provided us with testimonial
    information regarding its actions to achieve each performance
    expectation, but did not provide us with documentation verifying these
    actions. In the absence of such documentation to support DHS's claims,
    we concluded that DHS had generally not achieved the expectations. In
    other cases, the information and documents DHS provided did not
    convince us that DHS had generally achieved the performance expectation
    as stated or as we had interpreted it. In these cases, we explain the
    basis for our conclusions in the "GAO Assessment sections". Further, in
    some cases the information and documents DHS provided were not relevant
    to the specific performance expectation; in these situations we did not
    discuss them in our assessment. In addition, in some of its comments on
    individual performance expectations, DHS referenced new information
    that it did not provide to us during our review. In these cases we
    either explain our views on the information, or in one case we have
    changed our conclusion to "no assessment made".

    Overall, we appreciate DHS's concerns and recognize that in a broad-
    based endeavor such as this, some level of disagreement is inevitable,
    especially at any given point in time. However, we have been as
    transparent as possible regarding our purpose, methodology, and
    professional judgments. In table 44, we have summarized DHS's comments
    on the 42 performance expectations and our response to those comments.

    Table 44: Summary of DHS's Comments on 42 Performance Expectations and
    Our Response:

    Mission/management area: Border security;
    Summary of DHS's comments and our response:
    Performance expectation 4: Implement a program to detect and identify
    illegal border crossings between ports of entry;
    DHS's comments: DHS commented that it is well on its way toward
    implementing the Secure Border Initiative, a comprehensive program to
    detect and identify illegal border crossings. DHS expressed concern
    that basing our assessment on the fact that SBInet has not been fully
    deployed is inconsistent with our acknowledgement in an exit conference
    that the Secure Border Initiative is "on a trajectory" towards
    achieving this comprehensive program. Further, DHS stated that our
    report's criticism of progress in implementing SBInet was surprising in
    light of our previous concern that SBInet was being implemented too
    quickly. DHS also expressed concern that we did not follow our ratings
    system because we said that progress that has been made on the
    implementation of SBInet is "unclear." In addition, DHS commented that
    our report does not consider DHS's efforts toward effective control
    over the northern border, and that contrary to the assertion that DHS
    will not begin work on the northern border until fiscal year 2009, CBP
    has tripled the number of agents assigned to the northern border since
    fiscal year 2001.

    Our response: Although we recognize that DHS has made progress in
    implementing the Secure Border Initiative, SBInet, and other border
    security efforts to achieve this performance expectation, DHS data and
    our analysis showed that DHS has not yet achieved this expectation. For
    example, DHS data show that only about 392 miles or 6.5 percent of the
    6,000 miles of U.S. land border were under effective control as of
    March 2007. Of these miles, only 12 miles are on the northern border.
    Further, we believe that assigning more Border Patrol agents to the
    northern border is only one part of the program DHS is implementing.
    Moreover, Border Patrol currently estimates that it apprehends less
    than half of the illegal alien traffic crossing our borders. We
    recognize that the Secure Border Initiative and SBInet are multiyear
    programs and are in the early stages of implementation and deployment,
    but we also noted that programs that predated the Secure Border
    Initiative faced challenges in implementation. Our work concluded that
    the risks to completing the program on time and within budget needed to
    be further reduced--not that program implementation needed to be
    delayed.

    Mission/management area: Border security;
    Summary of DHS's comments and our response:
    Performance expectation 6: Implement a strategy to detect and interdict
    illegal flows of cargo, drugs, and other items into the United States;
    DHS's comments: DHS commented that our report makes reference to DHS's
    implementation efforts, but does not properly credit DHS for meeting
    this performance expectation. DHS stated that the Securing America's
    Borders at the Ports of Entry Strategic Plan defines a comprehensive
    national strategy and specifically outlines the department's efforts
    over the next 5 years to screen, detect, and interdict illegal cargo,
    contraband, weapons, agricultural products and other illicit
    substances. DHS reported that it has developed a formal Securing
    America's Borders at the Ports of Entry Implementation Plan and
    established the Securing America's Borders at the Ports of Entry
    Implementation Division to provide oversight and coordination in the
    execution of the strategic plan. DHS believes that it has set and
    successfully met several milestones related to this performance
    expectation in fiscal year 2006. Additionally, DHS stated that it has
    been working with federal, state, and local partners to develop a
    strategy and implementation plan which maximizes the efficiency of the
    resources that are dedicated to stopping the entry of illegal drugs
    into the United States along the southwest border. DHS commented that
    while our report acknowledges these counternarcotics efforts, it does
    not assign a proper assessment on the Counternarcotics Strategy and
    Implementation Plan solely because it has only recently been
    developed.

    Our response: We fully reviewed and considered all of the information
    and documentation DHS provided to us and concluded that DHS has not yet
    generally achieved this performance expectation. DHS has made progress
    in implementing programs to achieve this performance expectation.
    However, our prior work identified challenges in implementation.
    Additionally, while we recognize that DHS has developed the Securing
    America's Borders at the Ports of Entry Strategic Plan and the related
    implementation plan and division, as well as the Counternarcotics
    Strategy and Implementation Plan, the actual implementation of these
    efforts are still in the early stages. Once implemented, they should
    help CBP detect and interdict illegal flows of goods into the United
    States.

    Mission/management area: Border security;
    Summary of DHS's comments and our response:
    Performance expectation 8: Implement initiatives related to the
    security of certain documents used to enter the United States;
    DHS's comments: According to DHS, our report's assessment of "generally
    not achieved" for this performance expectation reflects shifting
    criteria and does not take into account external factors beyond the
    department's control. DHS commented that an earlier draft of our report
    based a generally not achieved rating on a lack of evidence that DHS
    had addressed risks and challenges associated with the security of
    travel documents. DHS stated that our current report cites new issues
    relating to plans for the deployment of document readers and the
    development of a strategic plan for the Immigration Advisory Program.
    DHS also commented that the report does not take into consideration
    that Congress has delayed more extensive implementation of the Western
    Hemisphere Travel Initiative. DHS noted that despite these changes, it
    is on track and plans to implement the initiative at land and sea ports
    well in advance of the statutory deadline.

    Our response: We considered all of DHS's additional information and
    documentation as part of our assessment. In doing so, we did not shift
    our criteria. Rather we disclosed our preliminary analysis and
    assessment to DHS in an earlier draft, received and analyzed additional
    documents, and updated our preliminary assessment based on the
    additional inputs. Our assessment recognized the extended timeframes
    for implementation of the Western Hemisphere Travel Initiative but also
    noted that this initiative has faced and continues to face
    implementation challenges despite the congressionally legislated
    extension of the implementation deadline. We noted that DHS has a long
    way to go to implement proposed plans for the initiative.

    Mission/management area: Border security;
    Summary of DHS's comments and our response:
    Performance expectation 12: Leverage technology, personnel, and
    information to secure the border;
    DHS's comments: DHS commented that many of its programs currently
    leverage technology, personnel, and information to secure the border
    including US-VISIT, efforts to capture data on individuals attempting
    illegal entry into the United States between the ports of entry, as
    well as individuals who are being investigated or removed from the
    interior of the country. DHS reported that it takes advantage of the
    synergy from the efforts of both CBP and US-VISIT and leverages
    existing resources.

    Our response: In our assessment, we recognize that although DHS has
    taken some actions to leverage technology, personnel, and information,
    much more work remains. For example, we reported that it is still
    unclear, and DHS has still not provided an adequate explanation of how
    US-VISIT will work with other border security initiatives. We also
    reported that while the Secure Border Strategic Plan provides some
    information on how various border security initiatives relate, the plan
    does not fully describe how these initiatives will interact once
    implemented. In addition, we noted that further development and
    implementation of SBInet would be key to achieving this performance
    expectation.

    Mission/management area: Immigration enforcement;
    Summary of DHS's comments and our response:
    Performance expectation 2: Implement a program to ensure the timely
    identification and removal of aliens subject to removal from the United
    States;
    DHS's comments: DHS commented that the methodology we used to reach
    this assessment is flawed because it dismisses tangible results in
    favor of potential challenges and holds DHS accountable for factors
    outside its control. DHS reported making progress in ensuring the
    timely identification of aliens subject to removal through programs to
    end the practice of "catch and release," increasing its detention bed
    space, shortening processing and detention times, and adding resources
    for interviewing consular officials about removal actions and for
    transporting aliens more quickly. DHS stated that certain variables
    impede the agency's ability to remove an alien including where
    expedited removal is halted or slowed due to certain foreign countries'
    unwillingness to accept their returned nationals and delays due to the
    lengthy duration of removal proceedings.

    Our response: In our assessment, we recognize the difficulties DHS has
    faced in achieving this performance expectation due in part to factors
    beyond its control and highlight actions taken by DHS to address these
    challenges. Nevertheless, we believe that the assessment is appropriate
    and takes into account the challenges faced by DHS. For example, we
    reported that while DHS has taken actions to address challenges
    associated with foreign countries' unwillingness to provide travel
    documents for removing aliens, these efforts may not yet fully address
    the potential national security and public safety risks associated with
    DHS's inability to remove illegal aliens. We also reported that DHS has
    faced challenges in identifying aliens for removal and, according to
    the DHS IG, the fugitive alien population appears to be growing at a
    rate that exceeds Fugitive Operations Teams' ability to apprehend.
    Overall, DHS has implemented some efforts to achieve this performance
    expectation, but we believe that DHS can not yet ensure the timely
    identification and removal of aliens.

    Mission/management area: Immigration enforcement;
    Summary of DHS's comments and our response:
    Performance expectation 3: Ensure the removal of criminal aliens;
    DHS's comments: DHS expressed concern that our assessment for this
    performance expectation undervalues DHS's progress made through the
    Criminal Alien Program. DHS also commented that our report does not
    consider that the program is an ongoing, multiyear effort. DHS outlined
    its actions to ensure the removal of criminal aliens, including noting
    that 40 ICE operation teams presently screen foreign-born inmates and
    that ICE is continuing to train and hire nearly 200 additional staff to
    support the program and extend coverage to state and local jails and
    prisons. DHS indicated that fully implementing the Criminal Alien
    Program in all of the more than 5,000 federal, state, and local
    facilities across the country is an unrealistic expectation revealing a
    marked lack of appreciation for the enormous resources that would be
    required to implement such an expansion. According to DHS, even if it
    were appropriated the funds necessary to expand the program to a single
    additional institution every single day, it would take over eight years
    to achieve this outcome.

    Our response: In our response, we acknowledge the difficult undertaking
    ICE is charged with in removing criminal aliens and have noted the
    various efforts underway, including DHS's efforts to expand the
    Criminal Alien Program. Our assessment is not intended to suggest that
    DHS should expand the Criminal Alien Program to every federal, state,
    and local correctional institution and jail. Rather, we reported that
    ICE has not expanded the program or taken other actions--such as
    reaching agreements with local law enforcement agencies--to ensure
    coverage for federal, state, and local correctional institutions and
    jails. Thus, ICE may not be able to fully ensure the removal of
    criminal aliens from facilities not covered by the Criminal Alien
    Program or agreements, and we concluded that DHS has generally not
    achieved this performance expectation.

    Mission/management area: Immigration enforcement;
    Summary of DHS's comments and our response:
    Performance expectation 6: Implement a program to allow for the secure
    alternative detention of noncriminal aliens;
    DHS's comments: Although we did not make an assessment for this
    performance expectation, DHS commented that the information it provided
    to us demonstrated that programs for secure alternatives to detention
    of noncriminal aliens have been implemented. DHS highlighted its
    progress in implementing such programs and noted that our report
    drastically understates the level of meaningful participation in the
    alternatives to detection programs and the promising results already
    shown.

    Our response: We did not make an assessment for this performance
    expectation because neither we nor the DHS IG had completed prior work,
    and we were unable to assess DHS's progress in achieving this
    performance expectation based on the information DHS provided. DHS
    provided us with procedures for its alternatives to detention program
    and data on the number of aliens enrolled in its programs and the rate
    of aliens' appearances in court and compliance with removal orders. We
    could not clearly determine the extent to which DHS has implemented
    program procedures, which we believe would be key to assessing DHS's
    progress. On the basis of our methodology, we believe that "no
    assessment" is appropriate for this performance expectation.

    Mission/management area: Immigration enforcement;
    Summary of DHS's comments and our response:
    Performance expectation 8: Implement a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed;
    DHS's comments: DHS stated that we have largely not considered its
    achievements in the worksite enforcement area and that DHS's efforts
    have resulted in impressive outcomes, including the increased use of
    employment verification systems and significant increases in
    investigations and arrests. For example, DHS reported making more than
    4,300 worksite enforcement arrests and apprehensions in fiscal year
    2006, and completing nearly 6,000 compliance enforcement investigations
    resulting in administrative arrests of more than 1,700 overstay and
    status violators, a 75 percent increase over the number of
    administrative arrests in fiscal year 2005.

    Our response: We fully considered all of the information and
    documentation provided by DHS related to this performance expectation.
    In our assessment, we recognize the progress DHS has made in
    implementing its worksite enforcement program and outline DHS's program
    outputs, such as number of investigations conduced and arrests made.
    However, DHS did not provide us with evidence that it has established
    outcome-based goals and measures for its worksite enforcement program
    and the extent to which it has achieved desired outcomes for the
    program. We have previously reported that without outcome-based goals
    and measures, it will be difficult for ICE to fully determine whether
    its efforts are achieving desired outcomes. In addition, we highlighted
    challenges associated with DHS's Employment Eligibility Verification
    program, one of the requirements of the ICE Mutual Agreement between
    Government and Employers program, that would have to be fully addressed
    to help ensure the efficient and effective implementation of its
    strategy.

    Mission/management area: Immigration enforcement;
    Summary of DHS's comments and our response:
    Performance expectation 10: Implement a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the
    United States;
    DHS's comments: DHS commented that our assessment of "generally not
    achieved" is not supported by the facts provided to us. According to
    DHS, its strategy for counteracting the trafficking and smuggling of
    aliens is just one part of the larger Secure Border Initiative and
    Securing America's Border at the Ports of Entry Strategic Plan. DHS
    also stated that it has made significant progress in meeting this
    performance expectation in coordination with other departmental
    components and federal agencies. DHS pointed to Border Enforcement and
    Security Task Forces to target cross-border criminal activity,
    including human trafficking, and the ICE Trafficking in Persons
    Strategy to target criminal organizations and individuals engaged in
    human trafficking worldwide. DHS also stated that there are mechanisms
    in place for ICE and CBP to share information related to the
    trafficking or smuggling of aliens.

    Our response: We fully considered all of the information and
    documentation DHS provided to us for this performance expectation. In
    our assessment, we recognize DHS's progress in implementing a strategy
    to interdict and prevent human trafficking and smuggling. However, we
    reported that the effectiveness of such a strategy depends on having
    clearly defined roles and responsibilities and goals and measures for
    assessing the extent to which DHS's efforts are achieving desired
    outcomes. We reported that until DHS has developed a mechanism to
    better share information among the responsible agencies and the ability
    to evaluate the outcome of its efforts, DHS will not have a
    comprehensive strategy in place, and we concluded that DHS has not yet
    generally achieved this performance expectation.

    Mission/management area: Immigration services;
    Summary of DHS's comments and our response:
    Performance expectation 1: Eliminate the benefit application backlog
    and reduce application completion times to 6 months;
    DHS's comments: DHS expressed disagreement with our assessment of
    generally not achieved." According to DHS, it is well on its way to
    eliminating the application backlog, which it reported as of September
    2006 was less than 10,000 applications. DHS expressed concern that we
    penalized DHS for not including in its definition of backlog cases
    instances where information from the applicant or another agency is
    pending. DHS commented that our report does not appropriately recognize
    external factors beyond the department's control--including delays by
    other agencies and the limitation on available visas. DHS also
    commented that our assessment for this performance expectation is
    inconsistent with other assessments made in the report that explicitly
    limit the scope of performance expectations to "DHS's roles and
    responsibilities."

    Our response: In our assessment, we noted that while DHS has made
    significant progress in reducing the number of applications pending
    adjudication, USCIS's method of calculating its backlog leaves the
    possibility of individual cases pending for longer than 6 months, and
    USCIS stated that some applications received in 2004 and 2005, or even
    earlier, may still be pending. We reported that while giving lower
    priority to applications for which a benefit would not be immediately
    available or were awaiting action outside of USCIS is a reasonable
    approach to backlog reduction, those applications--1 million as of
    September 2006--were awaiting adjudication. We reported that
    adjudicating these applications would let applicants know their
    eligibility for benefits and could help prevent future delays if large
    numbers of those benefits became available, as happened when a 2005 law
    eliminated the annual cap on asylum beneficiaries. As we believe that
    adjudication of these applications is possible, we have applied our
    methodology consistently for this performance expectation. In addition,
    DHS's current data systems cannot produce backlog information based on
    the date of the filing of a benefit application, which is necessary
    under the congressional definition of "backlog." USCIS has also not yet
    demonstrated that it has overcome long-standing technology problems
    which have contributed to the backlog in the first place.

    Mission/management area: Immigration services;
    Summary of DHS's comments and our response:
    Performance expectation 3: Establish a timetable for reviewing the
    program rules, business processes, and procedures for immigration
    benefit applications;
    DHS's comments: DHS commented that our assessment of "generally not
    achieved" is not supported by the facts or documents provided to us.
    DHS noted that it has grouped its existing transactions into four major
    types of transactions handled--citizenship, immigrant, humanitarian,
    nonimmigrant--and has developed a timetable to implement improved
    processes for each of these four types of transactions contained in the
    DHS-USCIS Transformation Program Office FY 2007 Expenditure Plan. DHS
    expressed concern that we had not considered this timetable in our
    assessment.

    Our response: DHS provided us the FY2007 Transformation Expenditure
    Plan, which we fully considered as part of our assessment. The plan
    contained general timetables for reviewing each activity by fiscal
    year. The FY 2007 Expenditure Plan states that the timelines and actual
    costs incurred will depend on the specific acquisition strategy defined
    for each increment. Additionally, DHS reported that it will prepare a
    detailed timetable for reviewing program rules, business processes, and
    procedures for each benefit category once it awards the contract. Until
    it does so, we concluded that DHS has generally not achieved this
    expectation.

    Mission/management area: Immigration services;
    Summary of DHS's comments and our response:
    Performance expectation 5: Develop new programs to prevent future
    backlogs from developing;
    DHS's comments: According to DHS, our report does not give proper
    credit to the department's significant transformation efforts to
    increase resources, improve customer service, and modernize business
    practices relating to benefits applications. DHS expressed concern that
    we did not consider the issuance of a rule to adjust the Immigration
    and Naturalization Benefit Application and Petition Schedule to adjust
    fees collected for benefit applications. DHS stated that this
    adjustment will provide a stable source of revenue to support a
    significant reduction in processing times.

    Our response: In our assessment for this performance expectation, we
    recognize revisions made by DHS to the Immigration and Naturalization
    Benefit Application and Petition Schedule. We recognize that raising
    fees may provide the agency with additional revenue and support its
    efforts to reduce processing times. However, we believe that raising
    fees alone will not ensure the prevention of future backlogs. Moreover,
    USCIS has initiated various programs to help reduce processing times,
    but these programs are still in the pilot stages and, in some cases,
    DHS has not yet assessed their results to determine the extent to which
    they could be implemented on a national basis.

    Mission/management area: Immigration services;
    Summary of DHS's comments and our response:
    Performance expectation 12: Establish training programs to reduce fraud
    in the benefits process;
    DHS's comments: According to DHS, it has developed a uniform training
    course for all officers. DHS also stated that it has identified certain
    fraud schemes that are unique to specific application processes and/or
    prevalent in geographical areas. The department consequently has
    provided specialized training to certain officers who handle these
    particular types of matters or who are stationed in certain locations
    above and beyond the uniform training provided to all officers. Instead
    of recognizing the achievements of these programs, DHS commented that
    our report appears to base its assessment of "generally not achieved"
    on the "appropriate[ness]" of the training, which appears to be an
    inconsistency of methodology.

    Our response: In our assessment, we recognize USCIS's training programs
    focused on detecting fraud in the benefits process. However, DHS did
    not provide us with evidence on the extent to which it has taken
    actions to ensure that its training courses have been distributed and
    implemented appropriately across all of its field offices. DHS also did
    not provide us with evidence that it has taken actions to ensure that
    all staff receive training appropriate to their roles and
    responsibilities in adjudicating certain types of applications.
    Therefore, our assessment was not based on our evaluation of the
    appropriateness of the training but, rather, that DHS did not provide
    us with evidence showing that its staff have received the training
    applicable to their roles and responsibilities, which we believe is a
    key part of establishing programs to reduce benefit fraud.

    Mission/management area: Immigration services;
    Summary of DHS's comments and our response:
    Performance expectation 14: Implement a fraud assessment program to
    reduce benefit fraud;
    DHS's comments: DHS commented that the benefit fraud assessments it has
    conducted to date have provided useful baseline data to assist in the
    development of a comprehensive strategy. DHS reported that its
    assessments have resulted in procedural and regulatory changes to
    minimize certain types of fraud. DHS commented that our report states
    that it has not developed and demonstrated the success of a strategy
    for conducting assessments, while an earlier draft indicated that DHS
    had not provided evidence of recently completed assessments.

    Our response: In our assessment, we noted that DHS has completed fraud
    assessments for three benefits types and expects to issue final reports
    on four others later in fiscal year 2007. However, we noted that USCIS
    has not yet developed and implemented a comprehensive strategy for
    conducting fraud assessments, which we believe is a key part of this
    expectation for DHS to implement a fraud assessment program. With
    regard to DHS's comments on differences between our final report and an
    earlier draft, for all of the performance expectations, we disclosed
    our preliminary analysis and assessments to DHS, received and analyzed
    the additional documents and statements from DHS officials, and updated
    our preliminary assessments based on the additional inputs.

    Mission/management area: Aviation security;
    Summary of DHS's comments and our response:
    Performance expectation 2: Establish standards and procedures for
    effective airport perimeter security;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not recognize the significance of the steps the
    department has taken in conjunction with airports and airlines to
    enhance perimeter security, such as inspection of vehicles at access
    gates and assessments of new technologies. DHS also noted that it
    provided us with documentation outlining the department's full
    compliance with relevant requirements established by the Aviation and
    Transportation Security Act. TSA commented that per Aviation and
    Transportation Security Act requirements, it has developed the Aviation
    Inspection Plan, which is based on an analytical risk assessment
    process evaluated threats, vulnerabilities, and potential consequences,
    and is reviews and updated every year. Further, DHS commented that we
    did not give sufficient consideration to the department's action plan
    for addressing recommendations from our 2004 report on airport
    perimeter security. In addition, DHS commented that it is difficult to
    precisely measure the deterrent effect of its measures for airport
    perimeter security.

    Our response: In making our assessment, we considered all documents
    provided by DHS on steps taken to enhance airport perimeter security,
    including updated summaries of departmental policies and procedures and
    plans to assess relevant technology. While DHS has taken actions to
    enhance perimeter security, the department did not provide evidence
    that these actions have resulted in effective airport perimeter
    security, and it did not provide sufficient information or
    documentation that it had addressed all of the relevant requirements
    contained in the Aviation and Transportation Security Act and
    recommendations from our 2004 report. For example, DHS did not provide
    documentation showing that TSA has met an Aviation and Transportation
    Security Act requirement to recommend to airport operators commercially
    available measures or procedures for preventing unauthorized access to
    secured airport areas. In keeping with this requirement, we recommended
    in our 2004 report that DHS compile the results of technology
    assessments--those conducted by TSA as well as independent assessments
    by airport operators--and communicate the integrated results of these
    assessments to airport operators. DHS did not provide us with evidence
    that it has fully addressed this recommendation.

    Mission/management area: Aviation security;
    Summary of DHS's comments and our response:
    Performance expectation 3: Establish standards and procedures to
    effectively control access to airport secured areas;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not recognize the significance of the steps the
    department has taken to effectively control access to airport secured
    areas, such as development of the Aviation Direct Access Screening
    Program--which provides for the random screening of employees
    attempting to access secure areas--and background checks of employees
    before they are granted identification media. DHS noted that while it
    is difficult to precisely measure the deterrent effect of these
    actions, the department has determined that a random, risk-based
    approach to controlling access to secured areas is more effective than
    creating stationary screening stations. DHS also commented that it
    provided us with documentation outlining the department's full
    compliance with relevant requirements established by the Aviation and
    Transportation Security Act. Further, DHS stated that we did not give
    sufficient consideration to their action plan for addressing
    recommendations from our 2004 report.

    Our response: In making our assessment, we considered all documents
    provided by DHS on steps taken to strengthen access controls of secured
    areas, including updated information on its efforts to enhance security
    procedures for gate screening and security measures for issuing
    personnel identification media. While DHS has taken actions to enhance
    procedures for controlling access to airport secured areas, it did not
    provide us with evidence that these actions have resulted in effective
    access control for airport secured areas, and the DHS IG has identified
    continuing weaknesses in DHS's procedures to prevent unauthorized
    workers from accessing secured airport areas. Additionally, DHS did not
    provide sufficient information or documentation that it had addressed
    all of the relevant requirements contained in the Aviation and
    Transportation Security Act and recommendations from our 2004 report.
    For example, DHS did not provide documentation that TSA has met an
    Aviation and Transportation Security Act requirement to require vendors
    who have direct access to aircraft and to the airfield to develop
    security programs. We also did not receive documentation from DHS
    showing that the department had complied with our 2004 report
    recommendation to provide guidance and prioritized funding to airports
    for enhancing the security of the commercial airport system as a
    whole.

    Mission/management area: Aviation security;
    Summary of DHS's comments and our response:
    Performance expectation 14: Develop and implement an advanced
    prescreening system to allow DHS to compare domestic passenger
    information to the Selectee List and No Fly List;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not recognize the department's progress in achieving
    milestones in its multiyear effort. DHS also believes that we did not
    consider all of the evidence the department provided detailing the
    Secure Flight program's mission needs, concept of operations,
    management plans, system requirements, acquisition plans,
    testing/evaluation plans, privacy assessments, and the related
    schedules.

    Our response: In making our
    assessment, we considered the documents provided by DHS on Secure
    Flight's various plans, assessments and requirements, and concept of
    operations. As we have previously reported, DHS has on numerous
    occasions missed key development and implementation milestones it had
    established for the Secure Flight program. Due in part to DHS not
    following a disciplined development process for Secure Flight in 2006,
    DHS halted development of the program to begin a "rebaselining" which
    involves TSA reassessing program goals, requirements, and capabilities.
    DHS has since made some program changes and is continuing its efforts
    to develop Secure Flight. However, DHS has not yet completed
    development efforts for the program and has not yet implemented it. In
    addition, as this report provides an assessment of progress made by DHS
    during its first 4 years, we believe that it is appropriate to assess
    DHS's progress in achieving this performance expectation.

    Mission/management area: Aviation security;
    Summary of DHS's comments and our response:
    Performance expectation 15: Develop and implement an international
    passenger prescreening process to compare passenger information to
    terrorist watch lists before aircraft departure;
    DHS's comments: DHS commented that our assessment for this performance
    expectation prematurely assesses the department's progress on a long-
    term goal. The department noted that the Secure Flight Notice of
    Proposed Rule Making and the Pre-Departure Advanced Passenger
    Information System Final Rule are scheduled to be published in the
    coming months. According to DHS, these rulemakings will place the
    department on track to implement pre-departure international passenger
    screening. DHS commented that it does not appear that we considered
    these proposed rulemakings in making our assessment.

    Our response: We considered the DHS proposed rulemaking
    for Advanced Passenger Information System as part of our assessment for
    this performance expectation. We did not consider the Secure Flight
    Notice of Proposed Rule Making because DHS stated that it would be
    published in the coming months. However, we have identified problems
    with implementation of the international prescreening process and have
    found that full implementation of an integrated domestic and
    international prescreening process is still several years away. In
    addition, as this report provides an assessment of progress made by DHS
    during its first 4 years, we believe that it is appropriate to assess
    DHS's progress in achieving this performance expectation.

    Mission/management area: Aviation security;
    Summary of DHS's comments and our response:
    Performance expectation 18: Deploy checkpoint technologies to address
    vulnerabilities;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not recognize the department's progress and does not
    consider the practical limitations inherent in developing and deploying
    new technologies. According to DHS, it is constantly deploying existing
    and developing new technologies to reduce checkpoint vulnerabilities.
    In addition, DHS noted that we did not consider other efforts in
    addition to checkpoint technologies that have effectively reduced
    vulnerabilities, such as updated procedures to detect explosives,
    enhanced training for transportation security officers, specially-
    trained canine teams, and deployment of transportation security
    officers specifically trained in behavior recognition and bomb
    appraisal.

    Our response: We recognize in our assessment of performance expectation
    17 that DHS has generally achieved the expectation to develop and test
    checkpoint technologies to address vulnerabilities. DHS has made some
    enhancements to currently deployed technologies such as to metal
    detectors and x-ray machines. DHS is also pilot testing new
    technologies. However, DHS has had limited initial deployments of
    technology to provide additional levels of explosives security at
    checkpoints. Further, DHS reported in 2007 that extensive deployment of
    new technologies will not be realized for another 2 years. In addition,
    in our assessments for other performance expectations, we recognized
    DHS's efforts, other than technologies, to reduce vulnerabilities. For
    example, we considered DHS's updated procedures to detect explosives
    and the implementation of a training for transportation security
    officers in behavioral recognition and bomb appraisal in our assessment
    for performance expectation 16--develop and implement processes and
    procedures for physically screening passengers at airport checkpoints--
    and concluded that DHS generally achieved that expectation.

    Mission/management area: Surface transportation security;
    Summary of DHS's comments and our response:
    Performance expectation 3: issue standards for securing surface
    transportation modes;
    DHS's comments: DHS commented that while our assessment for this
    performance expectation recognized the department's issuance of
    standards related to mass transit and passenger and freight rail, it
    did not consider standards issued by the department in other
    transportation modes, including highways and pipelines. DHS noted that
    it developed and provided us with draft Security Action Items that
    contain standards, addressing personnel security, access control, and
    en route security for highway modality. DHS also outlined voluntary
    "smart practices" it has issued for pipeline security.

    Our response: DHS has developed draft Security Action Items that
    contain standards related to highways, but has not yet finalized these
    standards. In general, the standards that have been issued are
    voluntary, and DHS has not identified whether these will be made
    mandatory. Moreover, the department did not provide us with
    documentation that it had developed standards for pipeline security. In
    accordance with our methodology and in absence of documentation
    verifying these standards, we concluded that DHS has generally not
    achieved this performance expectation.

    Mission/management area: Surface transportation security;
    Summary of DHS's comments and our response:
    Performance expectation 4: Conduct compliance inspections for surface
    transportation systems;
    DHS's comments: DHS believes that while our assessment recognizes that
    the department has conducted compliance inspections for mass transit,
    passenger rail, and freight rail, we did not give DHS credit for these
    compliance inspections or progress made in other areas. DHS outlined
    its efforts to conduct inspections for freight rail and mass transit
    systems and noted that Baseline Assessment and Security Enhancements
    reviews have been completed on 38 transportation systems.

    Our response: In our assessment, we recognize DHS's efforts to conduct
    compliance inspections for surface transportation systems, including
    its Baseline Assessment and Security Enhancements reviews. Although DHS
    has deployed inspectors to conduct compliance inspections and carry out
    other security activities for mass transit, including passenger rail,
    and freight rail modes, DHS did not provide us with evidence that it
    has conducted compliance inspections for other surface transportation
    modes or information on whether the department believes compliance
    inspections are needed for other modes. In addition, we have reported
    that DHS's role of inspectors in enforcing security requirements has
    not been fully defined, and DHS did not provide us with documentation
    on its efforts to better define these roles.

    Mission/management area: Maritime security;
    Summary of DHS's comments and our response:
    Performance expectation 16: Develop a long-range vessel-tracking system
    to improve maritime domain awareness;
    DHS's comments: DHS stated that the assessment of "generally not
    achieved" demonstrates the problem of rating multi-year programs on the
    basis of whether total implementation has already been achieved, and
    the department provided examples of the progress it has made in
    achieving this expectation. DHS stated that by the end of 2007 the
    Coast Guard will receive identification and tracking information for
    vessels in U.S. waters in the vicinity of 55 critical ports and 9
    coastal areas. The department also said that it is working to establish
    a Long Range Identification and Tracking system that will provide for
    global information on all U.S. flagged vessels required to carry
    transponders and information on all U.S.-bound vessels regardless of
    flag state within 1000 miles. Further, DHS stated that there are other
    vessel-tracking programs that fulfill the requirement for a long-range
    vessel tracking system. The department said that these programs are
    sensitive and consequently could not provide additional details in its
    comments.

    Our response: While we understand that the development of a long-range
    vessel-tracking system is in process, our report is intended to provide
    an assessment of DHS's progress after 4 years. DHS has made progress in
    developing a long-range vessel-tracking and has vessel-tracking
    capabilities in place. However, based on publicly available
    information, it has not yet completed the development of its Long Range
    Identification and Tracking system that can provide coverage up to
    nautical 2,000 miles and is consistent with international treaties,
    conventions, and agreements. We believe this is key to DHS achieving
    this performance expectation. DHS has reported that the Coast Guard has
    vessel-tracking capabilities, but noted that work is needed in the
    processing, display, and training in the use of this information. In
    addition, DHS has reported that it has worked and is continuing to work
    with the International Maritime Organization to develop a long-range
    vessel tracking system and that an international agreement to implement
    a global tracking system by the end of 2008 has been reached.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 4: Ensure the capacity and readiness of
    disaster response teams;
    DHS's comments: DHS believes that we did not give sufficient
    consideration to its disaster response team capacity and readiness
    improvements and outlined its various teams' capabilities. In
    particular, DHS highlighted its teams' response times following recent
    storms. DHS also reported that it is developing standardized doctrine,
    policies, response metrics, and operating procedures to support its new
    rapidly deployable response teams.

    Our response: We considered all of the information provided by DHS on
    the capacity and readiness of its disaster response teams. DHS did not
    provide us with evidence that it has yet developed readiness indicators
    for most of its disaster response teams, which indicates that DHS
    cannot yet ensure the capacity and readiness of those teams. More
    broadly, DHS did not provide us with documentation of its teams'
    readiness and capacity, such as documentation on the results of
    exercises, tests, or after-action reports on the small-scale disasters
    in which the teams have been used. On the basis of our methodology and
    as DHS did not provide us with evidence verifying its disaster teams'
    readiness and capacity, we concluded that DHS has generally not
    achieved this performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 7: Establish a single, all-hazards national
    response plan;
    DHS's comments: DHS believes that we did not properly
    recognize the current National Response Plan, issued in 2004, and its
    annexes and Catastrophic Incident Supplement. DHS noted that the
    National Response Plan is being used daily to respond to incidents and
    is a "living document that will be regularly reviewed and revised." DHS
    also commented that the existing National Response Plan will be
    implemented in response to incidents that occur before the issuance of
    a revised plan and that there will be a transition process used in
    conjunction with issuance of any revised plan. DHS noted that our view
    that the National Response Plan will negatively impact the ability to
    fully train, exercise, and develop new implementation plans is flawed.

    Our response: In our assessment for this performance expectation, we
    recognize DHS's issuance of the National Response Plan and its
    Catastrophic Incident Supplement. However, the lack of clarity and
    understanding of key roles and responsibilities under the plan was a
    major cause of many of the problems experienced in the response to
    Hurricane Katrina, and the changes made to the plan in 2006 only
    partially addressed these issues. Until the final revised plan is
    issued, federal, state, and local agencies cannot complete and test
    through exercises their operational plans for implementing any revised
    roles and responsibilities under the plan. For example, the Red Cross
    has said that its revised role in mass care and shelter will not take
    place until the National Response Plan review process is complete and
    all changes are approved. Moreover, the Secretary's recent designation
    of Principal Federal Officials and Federal Coordinating Officers raised
    new questions in Congress and among state and local officials regarding
    the roles and responsibilities of these officials and to whom they
    report and are responsible. In early August 2007 DHS circulated a
    revised version of the National Response Plan, now called the National
    Response Framework, but the Framework has not yet been formally
    circulated to state and local stakeholders for review and comment.
    Thus, it is still uncertain when the revision will be finalized.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 8: Coordinate implementation of a single all-
    hazards response plan;
    DHS's comments: DHS believes that we have not given the department
    credit for the progress it has made in coordinating implementation of
    the existing National Response Plan. DHS commented that there has been
    extensive training, exercises, and planning efforts with federal,
    state, and local partners on implementation of the plan. DHS also noted
    that the coordinated responses to 97 major disaster declarations since
    Hurricane Katrina have allowed for greater coordination in the
    implementation of the National Response Plan.

    Our response: Although DHS has said that it has coordinated responses
    to 97 major disaster declarations since Hurricane Katrina, none of
    these have been disasters of the scope of a major hurricane or
    catastrophic disaster. DHS did not provide us documentation on how
    coordination has been improved and assessed, how its training programs
    have contributed to more effective coordination, and how its improved
    coordination efforts can be applied to large-scale disasters. Absent
    this documentation and given concerns regarding the status of the
    revised National Response Plan, we concluded that DHS has generally not
    achieved this performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 13: Develop the capacity to provide needed
    emergency assistance and services in a timely manner;
    DHS's comments: DHS commented that its critical services, such as
    improved logistics tracking and capacity; increased disaster victim
    registration; and robust fraud, waste, and abuse protection, are in
    place and fully functional. DHS noted that it has established and
    tested initiatives in logistics tracking and capacity, such as the
    Total Asset Visibility initiative, and has worked closely with state
    and local partners to identify and address their needs for disaster
    response. DHS also noted that it has engaged in disaster planning
    efforts to identify challenges that would result from major disasters
    in various areas of the nation. Overall, DHS commented that the
    majority of information it provided to us on this performance
    expectation was designed specifically to address catastrophic
    situations that are nearly impossible and very costly to simulate and
    that, in our assessment, we stated that it is difficult to assess DHS-
    FEMA's initiatives regarding this performance expectation.

    Our response: In our assessment, we reported that DHS does not appear
    to have tested its various initiatives on a scale that reasonably
    simulates a major or catastrophic disaster and that, as a result, it is
    difficult to assess the results of DHS's various initiatives to improve
    its response to a major catastrophic disaster. However, as the basis
    for our assessment we noted that DHS did not provide us with
    documentation verifying that its emergency assistance capabilities are
    in place and capable of providing needed services in a timely manner
    following any incident. For example, DHS did not provide us with
    documentation on how it determined requirements for prepositioning
    disaster supplies to assess whether DHS has achieved its intended
    capacity, and DHS's optimization planning efforts for improvements to
    its logistics capabilities are still in the preliminary stages.
    According to our methodology, in the absence of documentation verifying
    DHS's actions, we concluded that DHS has generally not achieved this
    performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 14: Provide timely assistance and services to
    individuals and communities in response to emergency events;
    DHS's comments: DHS commented that it continues to develop and expand
    capabilities to provide timely assistance and services to individuals
    and communities in response to emergency events. For example, DHS
    reported undertaking initiatives and agreements to improve shelter
    management, support targeted registration assistance, and enable
    improved targeting of resources where needed. DHS reported that through
    its Public Assistance Program post-Katrina, DHS has obligated 80
    percent of estimated assistance within an average of 150 days after
    declaration compared to 203 days prior to Katrina and exceeding DHS's
    goal of 180 days. DHS also noted that we did not recognize its
    achievements in updating policies, guidance, and training for debris
    removal and establishing a nationwide list of debris removal
    contractors. In addition, DHS commented that it has successfully
    responded to 107 major disasters, 15 emergencies, and 130 fires since
    Hurricane Katrina.

    Our response: During our review, DHS did not provide us with
    documentation verifying the actions it has taken to provide timely
    assistance to individual and communities in response to emergency
    events. Moreover, DHS did not provide us with the results of tests or
    exercises of its emergency assistance and service capabilities. In the
    absence of such documentation verifying DHS's claims of actions taken
    to improve its capabilities, we concluded that DHS has generally not
    achieved this performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 15: Implement a program to improve
    interoperable communications among federal, state, and local agencies;
    DHS's comments: DHS commented that our assessment does not fully credit
    the department for progress made by its Office of Emergency
    Communications and Office for Interoperability and Compatibility in
    improving federal agencies' interoperable communication capabilities.
    DHS outlined several initiatives aimed at developing programs related
    to interoperable communications, highlighting its Integrated Wireless
    Network to provide the Departments of Justice, Homeland Security, and
    Treasury with a consolidated federal wireless communications service.
    DHS noted that this network is aimed particularly at improving federal
    interoperability. DHS also noted that our report did not consider the
    practical realities associated with developing a communications system
    that will accommodate more than 50,000 emergency response agencies and
    where nearly 90 percent of the communications infrastructure is owned
    at the local level.

    Our response: We considered all of the information and documentation
    provided by DHS on its efforts to implement a program to improve
    interoperable communications among federal, state, and local agencies.
    However, DHS is in the process of evaluating federal agencies'
    interoperable communications capabilities and did not provide us with
    documentation on its actions to improve interoperability between
    federal agencies and state and local agencies, which we believe is a
    key part of communications interoperability. In addition, as previously
    reported, the Integrated Wireless Network is mostly focused on
    improving interoperability among federal agencies, and the level of
    interoperability that state and local agencies will have with federal
    first responders on this network has not yet been decided. In our
    assessment, we reported that until a more concerted effort is made
    promote federal interoperability, overall progress in improving
    communications interoperability would remain limited.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 17: Increase the development and adoption of
    interoperability communications standards;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not fully recognize the significant progress made by
    the department and appears to be based on shifting criteria used to
    evaluate DHS's progress. DHS outlined actions it has taken to increase
    the development and adoption of interoperability communications
    standards, including partnering with various entities to accelerate the
    Project 25 standards to develop and generate interoperable and
    compatible voice communications equipment irrespective of the
    manufacturer. DHS noted that our assessment is premature and
    inconsistent with the language of the performance expectation to
    increase the development and adoption of interoperability
    communications standards.

    Our response: Our criteria for evaluating whether or not DHS has
    generally achieved this performance expectation did not change. DHS has
    taken actions to increase the development and adoption of
    interoperability communications standards, but more work needs to be
    done. In addition to completing undefined subsets of the standards,
    ambiguities in the defined subsets must be resolved in order to enable
    interoperability with radios built to these standards.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 20: Provide guidance and technical assistance
    to first responders in developing and implementing interoperable
    communications capabilities;
    DHS's comments: DHS commented that our assessment does not fully credit
    the department for progress made by its Office of Emergency
    Communications and Office for Interoperability and Compatibility. In
    its comments, DHS outlined several initiatives aimed at developing
    guidance and technical assistance related to interoperable
    communications, including the Interoperable Communications Technical
    Assistance Program. DHS noted that our assessment regarding SAFECOM's
    guidance and tools was based largely on limited feedback from four
    states and selected localities and that its experience suggests that
    numerous other entities have had success in using SAFECOM's guidance
    and tools.

    Our response: As the basis for our assessment, we noted that (1)
    several states and localities were not aware of SAFECOM tools and
    guidance or did not find them useful and (2) DHS is in the process of
    developing measures to assess the extent of the use of its tools and
    guidance, but has not yet developed those measures. In addition, DHS
    did not provide us with documentation on states' and localities' use of
    guidance and tools or on the extent to which states and localities have
    found the guidance and tools useful. In accordance with our methodology
    and in the absence of such documentation, we concluded that DHS has
    generally not achieved this performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 21: Provide assistance to state and local
    governments to develop all-hazards plans and capabilities;
    DHS's comments: DHS commented that it has provided meaningful
    assistance to state and local governments to develop all-hazards plans
    and capabilities and outlines examples of this assistance in its
    comments. For example, DHS commented that our assessment largely relies
    on outdated GAO and DHS IG reports and does not reflect the
    department's recent efforts to include language in grant guidance to
    supports state and local governments' development of all-hazards plans
    and capabilities. DHS also commented that we reported that the
    department has been focused on funding terrorism preparedness rather
    than natural or all-hazards preparedness. DHS noted that while its
    National Planning Scenarios have focused in large part on terrorist
    events, this predominance is due to the fact that their unique and
    exacting capability requirements make them critical planning tools in
    the national effort to develop a truly all-hazards preparedness model.
    DHS also noted that in 2007 it has focused on multi-hazard mitigation
    with state and local governments and is engaged in efforts that develop
    state and local all-hazards capabilities.

    Our response: DHS did not provide us with documentation on the extent
    to which its assistance to state and local governments has focused on
    all-hazards, nor on the extent to which it has helped state and local
    governments develop all-hazards capabilities. In accordance with our
    methodology and in the absence of such documentation verifying DHS's
    actions, we concluded that DHS has generally not achieved this
    performance expectation.

    Mission/management area: Emergency preparedness and response;
    Summary of DHS's comments and our response:
    Performance expectation 24: Develop a system for collecting and
    disseminating lessons learned and best practices to emergency
    responders;
    DHS's comments: DHS commented that our assessment does not reflect the
    substantial progress the department has made in developing the Lessons
    Learned Information Sharing Web site nor does it consider the practical
    difficulties associated with developing an online system. DHS reported
    making continuous improvements to the system, based on user feedback,
    and noted that additional improvements under development will address
    most, if not all, of the issues we previously raised about the system.

    Our response: In our assessment, we recognize that DHS has developed
    and implemented the Lessons Learned Information Sharing System. In
    prior work, we identified various issues with the system. DHS has
    reported taking actions to address these issues, but these actions are
    not yet complete. In addition, it is unclear whether the system is
    actually collecting and disseminating lessons learned and best
    practices to emergency responders.

    Mission/management area: Critical infrastructure and key resources
    protection;
    Summary of DHS's comments and our response:
    Performance expectation 3: Improve and enhance public/private
    information sharing involving attacks, threats, and vulnerabilities;
    DHS's comments: DHS stated that it has made significant progress in
    information sharing. The department highlighted a number of efforts it
    has made in this area, such as the establishment of the Technical
    Resource for Incident Prevention system (TRIPwire) and the National
    Coordinating Center for Telecommunications. Further, DHS stated that we
    did not include an assessment of the private sector utilization of the
    Homeland Security Information Network. The department also stated that
    we relied largely on previous reports that do not account for its
    recent successes and noted that the DHS IG found that five
    recommendations from its report Homeland Security Information Network
    Could Support Information Sharing More Effectively (OIG-06-38) are
    considered resolved.

    Our response: We reviewed DHS's updated information and considered the
    material it provided. While DHS demonstrated that it has created a
    number of information sharing programs, the department did not provide
    evidence demonstrating that these programs have actually improved
    information sharing. Specifically, DHS did not provide any metrics
    indicating that these programs have resulted in improved information
    sharing with federal, state, and local government or the private
    sector. In conducting our analysis we reviewed past and recent GAO and
    DHS IG reports concerning information sharing. Our April 2007 report,
    Information Technology: Numerous Federal Networks Used to Support
    Homeland Security Need to Be Better Coordinated with Key State and
    Local Information-Sharing Initiatives (GAO-07-455), found that DHS had
    not effectively coordinated the Homeland Security Information Network
    with key state and local initiatives and consequently faced the risk
    that information sharing is not occurring. We made four recommendations
    in this report. DHS concurred with three and indicated that it was
    taking actions to address each of them. In May 2007 we concluded that
    until DHS completes these efforts, such as developing an inventory of
    key state and local initiatives and fully implementing and
    institutionalizing key practices for effective coordination and
    collaboration, the department will continue to be at risk that
    information is not being effectively shared and that the department is
    duplicating state and local capabilities. Further, while the DHS IG
    stated in a July 11, 2007 letter that it considered resolved the five
    recommendations in its report OIG-06-38, it also stated that the
    recommendations would remain open until it received supporting
    documentation from the department. DHS identified actions it has taken
    to address the DHS IG's recommendations, and the DHS IG stated that
    these actions would satisfy its recommendations. However, the DHS IG
    stated that it needed evidence verifying DHS's activities before it
    could consider its recommendations closed.

    Mission/management area: Critical infrastructure and key resources
    protection;
    Summary of DHS's comments and our response:
    Performance expectation 4: Develop and enhance national analysis and
    warning capabilities for critical infrastructure;
    DHS's comments: DHS stated that we do not give the department credit
    for advances it has made in achieving this performance expectation,
    particularly with regard to cyber critical infrastructure. DHS
    commented that in the area of cyber infrastructure, we inaccurately
    suggested that the department has provided no evidence of enhanced
    national warning capabilities. DHS also noted that our assessment does
    not consider the progress made by its National Cyber Security Division
    to develop and enhance cyber analysis, watch and warning, and
    collaboration with the private sector. DHS described efforts the U.S.
    Computer Readiness Team has made to conduct analysis, issue warnings,
    and collaborate with the public and private sector. The department also
    stated that its National Communications System and fusion centers have
    contributed to its analysis and warning efforts.

    Our response: Our response: In previous GAO work, we reviewed the U.S.
    Computer Emergency Readiness Team and other DHS cyber security efforts.
    We reported that DHS through the U.S. Computer Emergency Readiness Team
    had made progress in providing analysis and warning capabilities, but
    had not resolved longstanding challenges concerning strategic analysis
    and warning capabilities, including methodological and data issues.
    Further, in the updated information and the response, DHS discussed
    several initiatives related to its analysis and warning capabilities.
    For example, it discusses a draft concept of operations for the private
    sector to handle incidents; however, until it is finalized and
    implemented, it is unclear whether the U.S. Computer Emergency
    Readiness Team's analysis and warning capabilities have been enhanced.
    Further, in the updated information DHS provided, the department
    described the Critical Infrastructure Warning Network as an essential
    component of its warning capabilities, but the department did not
    provide any documentation demonstrating it has improved those
    capabilities. The department also stated that the National
    Communication System and DHS's State and Local Fusion Center Program
    had analytical capabilities, but did not provide documentation
    demonstrating that they have enhanced national analysis and warning
    capabilities. In the absence of documentation verifying the
    accomplishments of theses efforts, we concluded that DHS has generally
    not achieved this performance expectation.

    Mission/management area: Science and technology;
    Summary of DHS's comments and our response:
    Performance expectation 1: Develop a plan for departmental research,
    development, testing, and evaluation activities;
    DHS's comments: DHS commented that our assessment for this performance
    expectation understates the significance of the department's June 2007
    Science and Technology Strategic Plan. DHS noted that the plan
    describes yearly milestones and deliverables/goals for every project
    within the Science and Technology Directorate. DHS also commented that
    our assessment does not give the department credit for the strategic
    plan's description on the Science and Technology Directorate's
    organizational framework and risk-based research portfolio management
    strategy.

    Our response: Our assessment recognizes the DHS Science and Technology
    Directorate's various plans, including its June 2007 strategic plan. As
    noted in our assessment, this performance expectation is based on the
    requirement in the Homeland Security Act of 2002 for the department to
    develop a strategic plan for identifying priorities, goals, objectives,
    and policies for, and coordinating the federal government's civilian
    efforts to identify an develop countermeasures to chemical, biological,
    and other emerging terrorist threats. According to the department, the
    June 2007 strategic plan does not address this requirement; therefore
    we concluded that DHS has generally not achieved this performance
    expectation.

    Mission/management area: Science and technology;
    Summary of DHS's comments and our response:
    Performance expectation 2: Assess emerging chemical, biological,
    radiological, and nuclear threats and homeland security
    vulnerabilities;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not account for the fact that the department's efforts
    to assess emerging vulnerabilities will always be ongoing and are not
    designed to reach a final end-goal completion. DHS outlined its efforts
    to assess threats and vulnerabilities, such as its completion of the
    Bio-Terrorism Risk Assessment in 2006, and noted that these ongoing
    efforts reflect real and meaningful progress by the department.

    Our response: In our assessment we recognize those assessments that the
    department has completed as well as those that are underway.
    Specifically, while DHS has completed assessments on biological and
    chemical threats, other assessments for the chemical, radiological, and
    nuclear sectors are underway, and we believe that DHS's assessment
    efforts overall appear to be in the early stages. In addition, we
    recognize that DHS will be assessing threats and vulnerabilities on a
    regular basis; however, as this report provides an assessment of
    progress made by DHS during its first 4 years, we believe that it is
    appropriate to reach a conclusion that DHS has not yet generally
    achieved this performance expectation.

    Mission/management area: Science and technology;
    Summary of DHS's comments and our response:
    Performance expectation 3: Coordinate research, development, and
    testing efforts to identify and develop countermeasures to address
    chemical, biological, radiological, nuclear, and other emerging
    terrorist threats;
    DHS's comments: DHS commented that our assessment for this performance
    expectation does not account for the fact that the department's efforts
    to develop countermeasures will always be ongoing and are not designed
    to reach a final end-goal completion. DHS outlined its various efforts
    to coordinate the research and development of countermeasures,
    highlighting, for example, its collaboration with other agencies and
    roles and responsibilities as part of interagency committees.

    Our response: In our assessment we discuss DHS's activities to
    coordinate the research and development of countermeasures. However, we
    have identified concerns regarding DHS's coordination efforts. For
    example, we reported that DHS has not always comprehensively collected
    and shared testing information on radiation portal monitors. In
    addition, we believe that until DHS more fully completes its
    assessments of threats and vulnerabilities, it may not fully know what
    technologies or countermeasures and associated requirements are needed
    to address identified threat and vulnerabilities.

    Mission/ management area: Human capital management;
    Summary of DHS's comments and our response:
    Performance expectation 8: Implement training and development programs
    in support of DHS's mission and goals;
    DHS's comments: DHS stated that the assessment of "generally not
    achieved" highlights the problems in using a binary standard to assess
    a multi-year program. The department stated that the Human Capital
    Operational Plan is a two year endeavor and that DHS has been meeting
    its targets within the plan. The department described several of its
    training and development efforts, such as DHScovery and the
    establishment of the National Capital Region Homeland Security
    Academy.

    Our response: While we understand that the implementation of training
    and development programs is in process, our report is intended to
    provide an assessment of DHS's progress after 4 years. The Human
    Capital Operational Plan identifies 20 goals in its learning and
    development section, and DHS has met the 3 goals with deadlines earlier
    than June 1, 2007. The Human Capital Operational Plan contains 4 goals
    with deadlines that fall between June 1, 2007 and the release of this
    report, but we do not have information as to whether they were
    achieved. However, as the Human Capital Operational Plan indicates, the
    majority of department's learning and development goals--the remaining
    13--are yet to be implemented. Given this, we concluded that DHS had
    not yet achieved this performance expectation.

    Mission/management area: Information technology management;
    Summary of DHS's comments and our response:
    Performance expectation 5: Develop a comprehensive enterprise
    architecture;
    DHS's comments: DHS commented that we based our assessment on a belief
    that DHS had not fully implemented elements of our Enterprise
    Architecture Management Maturity Framework and that we disregarded its
    extensive consultation with stakeholders in developing its
    architecture. The department further commented that our original
    assessment of "generally not achieved" was not consistent with the
    Office of Management and Budget's rating of the latest version of the
    department's architecture, referred to as DHS EA 2007, as a 4.3 on a
    scale from 1 to 5 for completeness.

    Our response: We disagree that our assessment does not consider the
    department's progress in satisfying the Enterprise Architecture
    Management Maturity Framework or its consultation with stakeholders in
    developing its architecture. In particular, we recognized that DHS had
    fully implemented 24 of the 31 core elements of the Enterprise
    Architecture Management Maturity Framework, and that it solicited
    comments from its architecture stakeholders. However, we also
    recognized that key Enterprise Architecture Management Maturity
    Framework core elements had nevertheless not been completely
    implemented and that the latest version of the architecture that we had
    received and evaluated (i.e., DHS EA 2006) did not fully address
    stakeholder comments and recommendations that we had previously made
    aimed at adding missing architecture content. Moreover, we found that
    stakeholder commentary on this version was limited (e.g., major DHS
    organizations such as the Transportation Security Agency and Coast
    Guard did not even provide comments). Notwithstanding this, we also
    recognize that the department has since released a newer, more current
    version of its architecture (i.e., DHS EA 2007), which it provided to
    us in June 2007, and that the department reports that this version
    addresses many of our prior concerns and has been recently rated by the
    Office of Management and Budget as 4.3 on a scale of 1 to 5 for
    completeness. Because of the considerable time and resources necessary
    to evaluate an architecture as large and complex as DHS's, we have not
    had an opportunity to validate DHS's statements about this latest
    version. Moreover, we have not evaluated either the Office of
    Management and Budget's enterprise architecture assessment methodology
    or how it applied the methodology in assessing DHS EA 2007. As a
    result, we do not have a basis for concluding whether this more recent
    version of DHS's architecture does or does not generally achieve this
    performance expectation. Accordingly, we have modified our assessment
    of this performance expectation to "no assessment made".

    Mission/management area: Information technology management;
    Summary of DHS's comments and our response:
    Performance expectation 6: Implement a comprehensive enterprise
    architecture;
    DHS's comments: DHS commented that our assessment relied on an
    "allegation" that the department's information technology investments
    have not been fully aligned with its architecture. The department
    further commented that it had provided us with documentation of its
    methodology for assessing information technology investments relative
    to its enterprise architecture but that it appeared that we did not
    consider it. In addition, DHS commented that it has already implemented
    a comprehensive enterprise architecture as evidenced by the Office of
    Management and Budget's rating of DHS EA 2007 as a 4.5 on a scale from
    1 to 5 for architecture use; Our response: We disagree that our
    assessment relied on an allegation and did not consider documentation
    the department provided to us. First, our work was performed in
    accordance with professional auditing standards, and thus it in no way
    cites or relies on allegations. Rather, it is based on facts and
    evidence, or in this case the absence thereof. More specifically, our
    assessment is based on analyses that we conducted between 2003 and 2007
    related to major information technology investments (e.g., US-VISIT) in
    which DHS did not provide sufficient documentation and verifiable
    analysis demonstrating these investments' alignment to any version of
    the DHS architecture. We further disagree that we did not consider
    documentation that the department provided us that it characterized in
    its comments as describing its methodology for assessing information
    technology investments relative to its enterprise architecture. In
    point of fact, we analyzed the documents the department provided and
    determined that they described a process that required information
    technology investment compliance with the enterprise architecture but
    did not include a methodology with detailed compliance criteria. In our
    view, the existence and application of such criteria is necessary to
    implementing an enterprise architecture. As we have previously reported
    and as is reflected in federal guidance and best practices, both a
    methodology and explicit criteria for determining an investment's
    alignment with an enterprise architecture are essential to
    understanding the risk associated with areas of noncompliance.
    Accordingly, we have open recommendations to the department for
    establishing and applying both, as well as for disclosing the risks on
    major investments of not having done so. With respect to the
    department's claim that the Office of Management and Budget's rating on
    its architecture's use is evidence that it has already implemented a
    comprehensive architecture, we have no basis for commenting on the
    rating. However, our view is that it is not possible to effectively
    implement any enterprise architecture without an architecture
    compliance methodology and criteria. Accordingly, we have not changed
    our assessment of this performance expectation.

    Mission/management area: Information technology management;
    Summary of DHS's comments and our response:
    Performance expectation 7: Develop a process to effectively manage
    information technology investments;
    DHS's comments: DHS commented that our assessment does not accurately
    reflect the department's progress and that it has developed processes
    to effectively manage information technology investments. Specifically,
    DHS stated that it had developed and distributed the Periodic
    Reporting, Earned Value Management, and Operational Analysis guidance
    documents for improving the tracking and reporting of investment costs,
    schedules, and performance variances. DHS also noted that it had issued
    a management directive that provides the DHS Chief Information Officer
    with the authority to review and approve the Department's entire
    information technology budget.

    Our response: We disagree that our assessment does not accurately
    reflect DHS's progress in developing processes to effectively manage
    information technology investments. In fact, our assessment is based,
    among other things, on the guidance documents that DHS cited and is
    reflected in our April 2007 report in which we concluded that DHS had
    established the management structure to effectively manage its
    investments but had yet to fully define 8 of the 11 related policies
    and procedures that are defined in the GAO Information Technology
    Investment Management Framework. For example, DHS's procedures for
    selecting investments did not cite either the specific criteria or
    steps for prioritizing and selecting new information technology
    proposals. In written comments on our April report, DHS agreed with our
    report. In addition, we agree that DHS issued a directive expanding the
    authority of the Chief Information Officer, as we recognized in
    assessing the Chief Information Officer's roles and responsibilities as
    generally achieved. However, this directive does not affect our
    findings and conclusions relative to the 8 policies and procedures in
    our framework that were not satisfied. As a result, our assessment
    remains as generally not achieved.

    Mission/management area: Information technology management;
    Summary of DHS's comments and our response:
    Performance expectation 8: Implement a process to effectively manage
    information technology investments;
    DHS's comments: DHS commented that our assessment does not accurately
    reflect the department's progress. In particular, the department stated
    that it has implemented an information technology acquisition review
    process to improve the alignment of information technology purchases to
    the department's homeland security mission and architecture. In
    addition, DHS reported that its information technology portfolio
    management program incorporates specific management processes to
    improve the balance of investments to more effectively meet
    departmental goals and objectives; Our response: We disagree that
    our assessment does not accurately reflect DHS' progress in
    implementing processes to effectively manage information technology
    investments. Our assessment is based on our April 2007 report in which
    we concluded that DHS had not fully implemented any of the key
    practices in the GAO Information Technology Investment Management
    Framework associated with actually controlling investments at either
    the project or the portfolio level. For example, we reported that the
    investment review boards had not conducted regular reviews of
    investments and that while control activities were sometimes performed,
    they were not performed consistently across information technology
    projects. In commenting on our report, DHS agreed with our findings and
    recommendations. As a result, our assessment remains as generally not
    achieved.

    Source: GAO analysis.

    [End of table]

    As arranged with your offices, unless you publicly announce the
    contents of this report earlier, we plan no further distribution until
    30 days after the date of this report. At that time, we will send
    copies of this report to the Secretary of Homeland Security, the
    Director of the Office of Management and Budget, and appropriate
    congressional committees. We will also make copies available to others
    upon request. In addition, the report will be available at no charge on
    GAO's Web site at [hyperlink, http://www.gao.gov].

    If you or your staff has any questions regarding this report, please
    contact me at (202) 512-8777, or rabkinn@gao.gov. Contact points for
    each mission and management area are listed in appendix I. Contact
    points for our Offices of Congressional Relations and Public Affairs
    may be found on this last page of this report. GAO staff who made major
    contributions to this report are listed in appendix III.

    Signed by:

    Norman J. Rabkin:
    Managing Director, Homeland Security and Justice Issues:

    [End of section]

    Appendix I: Key GAO Contacts for DHS Mission and Management Areas:

    Border Security:
    Richard Stana, Director, Homeland Security and Justice, 202-512-8816:
    Jess Ford, Director, International Affairs and Trade, 202-512-4128:

    Immigration Enforcement and Immigration Services:
    Richard Stana, Director, Homeland Security and Justice, 202-512-8816:

    Aviation Security:
    Cathleen Berrick, Director, Homeland Security and Justice, 202-512-
    3404:

    Surface Transportation Security:
    Cathleen Berrick, Director, Homeland Security and Justice, 202-512-
    3404:
    Katherine Siggerud, Director, Physical Infrastructure, 202-512-2834:

    Maritime Security:
    Stephen L. Caldwell, Director, Homeland Security and Justice, 202-512-
    9610:

    Emergency Preparedness and Response:
    William O Jenkins, Jr., Director, Homeland Security and Justice, 202-
    512-8757:
    Linda Koontz, Director, Information Technology, 202-512-7487:

    Critical Infrastructure and Key Resources Protection:
    Eileen R. Larence, Director, Homeland Security and Justice, 202-512-
    8777:
    David A. Powner, Director, Information Technology Management Issues,
    202-512-9286:
    John R. Stephenson, Director, Natural Resources and Environment, 202-
    512-3841:

    Science and Technology:
    Gene Aloise, Director, Natural Resources and Environment, 202-512-3841:
    Keith Rhodes, Chief Technologist, 202-512-6412:

    Acquisition Management:
    John P. Hutton, Director, Acquisition Management and Sourcing, 202-512-
    4841:
    William T. Woods, Director, Acquisition Management and Sourcing, 202-
    512-4841:

    Financial Management:
    McCoy Williams, Director, Financial Management and Assurance, 202-512-
    9095:

    Human Capital Management:
    J. Christopher Mihm, Managing Director, Strategic Issues, 202-512-6806:

    Information Technology Management:
    Randolph Hite, Director, Information Technology, 202-512-3439:
    Gregory Wilshusen, Director, Information Technology, 202-512-6244:

    Real Property Management:
    Mark Goldstein, Director, Physical Infrastructure, 202-512-2834:

    [End of section]

    Appendix II: Comments from the Department of Homeland Security:

    U.S. Department of Homeland Security:
    Washington, DC 20528:

    July 20, 2007:

    Mr. David Walker:
    Comptroller General:
    U.S. Government Accountability Office:
    441 G Street, N.W.:
    Washington, D.C. 20548:

    Dear Comptroller General Walker:

    The Department of Homeland Security (DHS) appreciates the opportunity
    to review and provide comments on the draft report submitted by the
    Government Accountability Office (GAO) entitled Department of Homeland
    Security, Progress Report on Implementation of Mission and
    Management Functions (GAO Report). As you know, this report looks at
    the Department's first four years although GAO has repeatedly observed
    that "successful transformations of large organizations, even those
    faced with less strenuous reorganizations than DHS, can take at least
    five to seven years to achieve."

    To conduct its broad study, GAO devised 171 individual performance
    expectations, categorized into 14 mission and management areas. GAO
    assessed DHS as having "Generally Achieved" 78 of those performance
    expectations. We were pleased to see that GAO recognized our progress
    in these areas. We disagree, however, with many of GAO's remaining
    assessments (including those discussed in the Enclosure). While we
    disagree with many of the conclusions reached by GAO and with the
    methodological approach that was used, we are very appreciative of the
    frank and open communication with GAO that has been established during
    recent months and the final stages of GAO's work on this report. We
    look forward to continuing this cooperative approach. We continue to
    believe, however, that the GAO Report is based on a flawed methodology
    that results e an inaccurate representation of the Department's
    progress and fails to accurately reflect the Department's progress in
    many specific program areas. This is not the first time that the
    Department has expressed concerns over the methodology and content of
    the GAO Report.

    In late February 2007, GAO provided the Department an initial Statement
    of Facts. which evaluated the Department's progress over its first four
    years. GAO officials relied almost exclusively on previous, outdated
    reports to rate the Department's performance on a subjective, binary
    scale	of "Generally Addressed" or "Generally Not Addressed " GAO
    indicated that an assessment of "Generally Addressed" was given where
    analysts determined that DHS had "taken steps to effectively satisfy,
    most of the key elements of the performance expectation." GAO neither
    defined "effectively satisfy," nor identified the key elements or
    criteria associated with each performance expectation. Accordingly, the
    initial Statement of Facts and its assessments provided little insight
    into how GAO had evaluated the Department's activities.

    After personally reviewing the initial Statement of Facts, Secretary
    Chertoff wrote to you on March 7, 2007 expressing his concerns and
    offering to work with GAO "to ensure the final GAO statement fully
    reflect[ed] the Department's achievements over the past four years."
    Shortly thereafter, the Department provided GAO with thousands of pages
    of documents explaining how key programs were on track and a detailed
    100-plus-page explanation of the Department's overall progress, Over
    many weeks, the Department continued to provide additional
    documentation and meet with GAO officials to demonstrate how DHS was
    addressing various program areas and performance expectations.

    In late May 2007, GAO officials submitted a Revised Statement of Facts
    which altered the standard for judging the Department's progress
    without prior warning or consultation with the Department.
    Specifically, the Revised Statement of Facts indicated that the
    Department's progress would now be rated as "Generally Achieved" or
    "Generally Not Achieved." rather than as "Generally Addressed" or
    "Generally Not Addressed." The practical differences between these
    standards go well beyond semantics, as the change reflects a difference
    in how the performance expectations would be perceived- "addressed"
    suggests that a program is on track, whereas "achieved" indicates final
    completion. In addition, GAO still did not articulate the "key
    elements," end-goals to be "achieved," how these goals	were set and by
    whom.

    Based on this new standard, GAO downgraded its assessments of the
    Department in 28 performance expectations to "Generally Not Achieved."
    In 24 such instances, the Department went from Assessment Made" to
    "Generally Not Achieved." These changes were particularly surprising in
    light of the extensive documentation and materials describing the
    Department's progress and the success of its programs and activities
    that were provided to GAO. As discussed below and in the Enclosure, we
    believe the downgraded assessments are not supported by the facts.

    The binary "Achieved"/"Not Achieved" standard ultimately adopted by GAO
    is particularly ill-equipped to evaluate the Department's progress
    accurately in a multi-year endeavor, especially when DHS is only a few
    years into the project. For example, although GAO officials have
    indicated that the Department's Secure Border Initiative (SBI) is "on a
    trajectory" towards achievement, the Department received a score of
    "Generally Not Achieved" in this performance expectation because it had
    not yet fully completed the goals of the entire SBI program. GAO's
    assessments of multi-year programs are thus at odds with GAO's own
    disclaimer that its assessments are "not meant to imply that DHS should
    have fully achieved the performance expectation by the end of its
    fourth year."

    We are also concerned with the apparent shifting of the already
    nontransparent criteria for the performance expectations used by, GAO
    to assess the Department. In many instances where the Department
    provided GAO with supplemental information which we believe directly
    addressed specific criteria discussed in the initial or Revised
    Statement of Facts, GAO acknowledges DHS's new information, yet either
    does not fully consider its significance, or includes additional
    criteria for that performance expectation that were not previously
    provided to the Department. In some cases. this new criteria contained
    in the GAO Report goes beyond the scope of the performance expectation
    itself. For instance, GAO's assessment of the Department's efforts to
    implement a strategy to detect and interdict ills a flows of cargo,
    drugs, and other items illustrates this point. The Revised Statement of
    Facts indicated that GAO's assessment was based in part on GAO's belief
    that the Department had not established or met milestones for achieving
    relevant goals. Amer GAO was provided with information to the contrary,
    GAO simply dropped its reference to those criteria and added language
    regarding new criteria, including the criticism that the Securing
    America's Borders at the Ports of Entry Strategic Plan was "in the
    early stages of implementation." Notably - where the performance
    expectation asks whether the Department has "implemented" a strategy -
    GAO's observation actually supports an assessment of "Generally
    Achieved" rather than the assessment given by GAO.

    Moreover, there appears to have been no effort to "normalize" the
    process by which GAO officials made assessments across the entire
    spectrum of 171 performance expectations. As a result, GAO analysts in
    various mission and management areas could have evaluated the
    Department's performance differently. The vague descriptions of
    "Generally Addressed" - and subsequently of "Generally Achieved"-- do
    not appear to provide detailed guidance to support these
    determinations. Therefore it is difficult to understand the level of
    consistency applied in evaluating the performance expectation criteria
    or the assessments based upon them.

    Furthermore, the GAO Report treats all of the performance expectations
    as if they were of equal significance. While all of the 171 performance
    expectations included in the GAO Report are important, they are not of
    the same priority when it comes to securing the nation's homeland. GAO
    admits that it did not weigh the relationship between each performance
    expectation with the Department's overall priorities and mission, In
    contrast, the Department uses a risk-based approach to consider its
    overall priorities and mission in choosing where to focus its limited
    resources. The GAO Report indicates that DHS has made the greatest
    progress in several areas that it identified as priorities. For
    example, the Secretary has focused the Department's resources on
    securing transportation modes given the nature of the September 11,
    2001 attacks. The GAO Report recognizes that the Department has indeed
    made great strides. giving the Department an assessment of "Generally
    Achieved" in 37 out of 50 performance expectations in that area.

    In addition to these methodological concerns, we further belies e that
    many of the specific assessments do not reflect the significant
    progress made by the Department over the past four years. Prime
    examples include:

    * The GAO Report's assessment that the Department has "Generally Not
    Achieved" the goal of detecting and identifying illegal border
    crossings understates the importance of our successful efforts to
    deploy 6,000 National Guard agents to the border, to increase Border
    Patrol staffing by 30 percent since 2001. and to begin implementation
    of the comprehensive SBI Program. U.S. Customs and Border Protection
    (DHS-CBP) Border Patrol apprehensions for the first three quarters of
    FY 2007 are down 24 percent compared to the previous year along the
    southwest border, indicating a significant decline in illegal cross-
    border activity between ports of entry. The Yuma, Arizona, and Del Rio,
    Texas, sectors experienced the greatest declines, with decreases of 68
    percent and 51 percent, respectively. The number of other-than-Mexican
    alien apprehensions dropped 48 percent along the southern border. The
    decrease in other-than-Mexican apprehensions reduces the time agents
    spend transporting and processing, and increases the time spent
    patrolling the border. Moreover, we have ended the practice of "catch
    and release" for other-than-Mexican apprehensions along the border.

    * The assessment that the Department has not established standards and
    procedures for effective airport perimeter security and to control
    access to secured areas similarly do no give proper consideration to
    the extensive documentation provided to GAO by the Department's
    Transportation Security Administration	which demonstrates its
    substantial progress in these areas. As a result. the report does not
    give DHS proper credit in the development of the Aviation Inspection
    Plan to implement the Aviation and Transportation Security Act; and
    disregards the detailed action plan addressing all GAO recommendations
    from its 2004 audit. he report also does not reflect the many processes
    already in place to improve airport perimeter security and access
    controls.

    * The report's assessment that the Department has "Generally Not
    Achieved" the goal of establishing, coordinating, and implementing a
    single, all hazards national response plan does not take into account
    the Department's achievements in this area. In fact, the Department
    issued the National Response Plan (NRP) December of 2004. With regard
    to implementation. the Department has actively trained Federal, state
    and local government and non-governmental leadership and first
    responders since the plan's release through a formal roll-out process,
    an on-line training course, workshops. and regular exercises. The NRP
    is an organic document and is currently being reviewed and potentially
    revised to reflect lessons learned. In the meantime, however. the
    existing NRP continues to serve as a single. all-hazards national
    response plan.

    The Enclosure contains a more detailed discussion of these and other
    particularly problematic assessments contained in the GAO Report. The
    Department went to great lengths to provide GAO with information
    related to these and other performance expectations, taking the
    initiative to provide GAO with the detailed 100-plus-page response and
    other supplemental information referred to above. "The Department's
    cooperation in this instance reflects our continued efforts to provide
    GAO with appropriate access to information in a timely manner.
    We are committed to strengthening DHS's management and operational
    capabilities. and I hope your final report will capture that
    commitment. We are proud of what DHS has accomplished in the face of
    the many challenges we face. Thank you for this opportunity to comment.
    We look forward to continuing the cooperative approach that was
    followed in preparing this report.

    Sincerely,

    {Signed by}

    Paul A. Schneider:
    Under Secretary for Management:

    Enclosure

    {End of section}

    COMMENTS FROM DHS: DEPARTMENT OF HOMELAND SECURITY, PROGRESS REPORT ON
    IMPLEMENTATION OF MISSION AND MANAGEMENT FUNCTIONS:

    In addition to disagreeing with the methodology used by GAO, the
    Department disagrees with many specific assessments made in the GAO
    Report. This Attachment focuses on the major areas of concern for the
    Department.

    Border Security:

    The Department has made great strides toward achieving its goal of
    securing our Nation's borders. Unfortunately, some assessments do not
    accurately reflect the total progress made by the Department.

    Performance Expectation 4: Implement a program to detect and identify
    illegal border crossings between ports of entry. The assessment of
    "Generally Not Achieved" highlights the methodological flaw in using a
    binary standard to assess what the GAO Report acknowledges is "a multi-
    year program." The Department's Customs and Border Protection (DHS-CBP)
    is well on its way toward implementing the Secure Border Initiative
    (SBI), a comprehensive program to detect and identify illegal border
    crossings. The SBI is currently being carried out through SBInet and
    other programs. The GAO Report states that "DHS has taken actions to
    implement the initiative"; but still rates this performance expectation
    as "Generally Not Achieved."

    The mission of the SBI is to promote border security strategies that:
    (a) prevent terrorist attacks and other transnational crimes; (b)
    coordinate DHS efforts to ensure the legal entry and exit of people and
    goods moving across our borders; and (c) enforce U.S. laws at our
    borders. SBInet is the component of the SBI charged with developing and
    installing technology and tactical infrastructure solutions to gain
    "effective control" of our Nation's borders in accordance with the
    mission of the SBI. Effective control is the consistent ability to
    detect illegal entries into the United States and to identify,
    classify, and respond to illegal entries efficiently and effectively.

    GAO officials stated that the report provides an assessment of
    "Generally Not Achieved," because SBInet has not been fully deployed.
    GAO officials, however, acknowledged in an exit conference that SBI is
    "on a trajectory" towards achieving this comprehensive program to
    detect and identify illegal border crossings. In addition, the report's
    criticism of the Department's progress in implementing SBInet is
    surprising in light of the GAO's previous concern that the Department
    was implementing SBInet too quickly. A February 2007 GAO Report (GAO-07-
    309) recommended that DHS-CBP reduce the extent to which different
    aspects of SBInet were being implemented concurrently, thus lengthening
    the implementation process and delaying full implementation of the
    program.

    The GAO Report also justifies its assessment of "Generally Not
    Achieved" by asserting that the progress that has been made on the
    implementation of SBInet is "unclear." However, according to the
    definitions of the assessment standards repeated throughout the GAO
    Report, a rating of "No Assessment Made" is appropriate when "the
    information DHS provided did not enable [GAO] to clearly assess DHS's
    progress in achieving the performance expectation." Thus, it appears
    that GAO officials did not follow their own ratings system or were
    unable to do so because the standards were never sufficiently defined.

    Furthermore, the GAO Report mentions, but does not adequately consider
    the Department's implementation of other programs and initiatives which
    have yielded significant results related to preventing illegal border
    crossings and securing the border. For example, 6,000 National Guard
    members were deployed to the southwest border as part of Operation Jump
    Start and the President's initiative to secure the border. In addition,
    Border Patrol agent staffing has increased by over 30 percent since
    2001. Moreover, we have ended the practice of "catch and release" for
    other-than-Mexican apprehensions along the border. Results to date have
    been promising. DHS-CBP Border Patrol apprehensions for the first three
    quarters of Fiscal Year 2007 are down 24 percent compared to the
    previous year along the southwest border, indicating a significant
    decline in illegal cross-border activity between ports of entry. The
    Yuma, Arizona, and Del Rio, Texas, sectors experienced the greatest
    declines, with decreases of 68 percent and 51 percent, respectively.
    The number of other-than-Mexican alien apprehensions dropped 48 percent
    along the southern border. The decrease in other-than-Mexican
    apprehensions reduces the time agents spend transporting and
    processing, and increases the time spent patrolling the border.

    DHS-CBP currently has effective control of 380 miles on the southwest
    border, plans to achieve effective control of 642 miles by the end of
    calendar year 2008, and anticipates having effective control over the
    entire southwest border by 2013. Nevertheless, the GAO Report assigns
    low grades to these efforts because DHS, while on target, does not yet
    have effective control over the more than 6,000 miles of U.S. land
    border.

    The GAO Report also does not consider DHS-CBP efforts toward effective
    control over the northern border. Contrary to the GAO Report's
    assertion that DHS-CBP will not begin work on the northern border until
    fiscal year 2009, DHS-CBP has tripled the number of agents assigned to
    the northern border since Fiscal Year 2001. DHSCBP recently initiated a
    Nationwide Voluntary Relocation Opportunity. which has brought
    additional, experienced agents to the U.S./Canadian border. In
    addition, the Department has deployed technology to provide additional
    coverage along the northern border - including ground sensors, cameras,
    radar, and sophisticated software packages. DHS-CBP implemented Border
    Security Evaluation Teams (BSETs) in all eight northern border sectors
    to secure portions of the U.S./Canadian border that were previously too
    remote to have been monitored. Through a partnership with the Canadian
    government, the Integrated Border Enforcement Team (IBET) enhances
    border integrity and security by identifying, investigating, and
    interdicting persons and organizations that pose a threat to national
    security, or are engaged in other organized criminal activity.
    Performance Expectation 6: Implement a strategy to detect and interdict
    illegal flows of cargo, drugs, and other items into the United States.
    The Department strongly disagrees with the GAO Report's assessment of
    "Generally Not Achieved." The GAO Report makes this assessment while at
    the same time acknowledges that DHS has taken "actions to implement
    various programs to detect and interdict illegal flow of goods into the
    United States."

    DHS-CBP has implemented a strategy, known as the Securing America's
    Borders at the Ports of Entry (SABPOE) Strategic Plan, for detecting
    and interdicting illegal cargo, drugs, and other items before entering
    the United States. The SABPOE Strategic Plan defines a comprehensive
    national strategy and specifically outlines the Department's efforts
    over the next five years to screen, detect, and interdict illegal
    cargo, contraband, weapons, agricultural products and other illicit
    substances. The Strategic Plan emphasizes eight core capabilities for
    each port of entry:

    * Identifying people and goods approaching the ports;
    * Assessing the associated risk-level;
    * Inspecting all people and goods according to their assessed level of
    risk;
    * Detecting potential threats and inadmissible people and goods;
    * Enforcing the law and taking action against violators;
    * Recording events at the ports of entry including crossings and
    findings;
    * Analyzing outcomes to address emerging threats; and
    * Deterring potential violators from crossing or shipping goods through
    the ports of entry.

    DHS-CBP has developed a formal SABPOE Implementation Plan which
    consists of inter-related programs, key activities and implementation
    schedules. The SABPOE Implementation Plan establishes detailed steps
    and actions required to achieve the specific goals and objectives
    presented in the SABPOE Strategic Plan. In addition, DHS-CBP set up the
    SABPOE Implementation Division to provide oversight and coordination in
    the execution of the Strategic Plan. This Division entails senior
    executive participation and active steering committee oversight. The
    GAO Report acknowledges that SABPOE "will help CBP detect and interdict
    illegal flows of goods into the United States," but grades the
    Department's efforts as "Generally Not Achieved" because the Strategic
    Plan "is still in the early stages of implementation."

    DHS-CBP also set and then successfully met several milestones related
    to this performance expectation in Fiscal Year 2006, as demonstrated by
    the following activities:

    * DHS-CBP trained and deployed over 100 human detection/narcotic canine
    enforcement teams, which significantly increased the number of
    containers, vehicles, and people screened for illicit items;
    * DHS-CBP expanded the Container Security Initiative to five new ports
    of entry which greatly added to DHS-CBP's ability to pre-screen
    containers (destined for the United States) at foreign ports;
    * DHS-CBP hired more than 80 additional specialists in support of the
    Customs-Trade Partnership Against Terrorism (CTPAT), resulting in
    tighter control of the supply chain and reducing the risk of illegally
    smuggled contraband;
    * DHS-CBP established a Fraudulent Document Analysis Unit to assist in
    the identification of false and fraudulent travel documents; and
    * DHS-CBP expanded its Immigration Advisory Program (IAP) and achieved
    its statutory requirements of identifying the top 50 locations for
    deployment.

    The GAO Report makes reference to these implementation efforts, but we
    believe does not properly credit DHS for meeting this performance
    expectation.

    The Department has also been working with Federal, state and local
    partners to develop a strategy and implementation plan which maximizes
    the efficiency of the resources that are dedicated to stopping the
    entry of illegal drugs into the United States along the Southwest
    Border. For example:

    * The Director of the Department's Office of Counternarcotics
    Enforcement (DHS-CNE) was designated by the International Drug Control
    Policy Coordinating Committee (IDC-PCC) to serve as a Co-Chair for
    developing an Implementation Plan for the National Southwest Border
    Counternarcotics Strategy (approved by the Deputies in March 2006).
    * On August 18, 2006, DHS-CNE and the DOJ Office of the Deputy Attorney
    General (ODAG) jointly submitted the National Southwest Border
    Counternarcotics Strategy and Implementation Plan to the IDC-PCC. This
    classified 235-page document identifies the major goals, objectives,
    and resource requirements for closing gaps in U.S. and Mexico
    counternarcotics capabilities along the Southwest Border.
    * CNE is currently working to update the Implementation Plan to ensure
    it reflects recent developments in U.S.-Mexico relations.

    The GAO Report acknowledges these counternarcotics efforts, but does
    not assign what we consider to be a proper assessment on the
    Counternarcotics Strategy and Implementation Plan solely because it has
    "only recently been developed."

    Performance Expectation 8: Implement initiatives related to the
    security of certain documents used to enter the United States. The GAO
    Report's assessment of "Generally Not Achieved" for this performance
    expectation reflects a shifting criteria while at the same time not
    taking into account external factors beyond the Department's control.

    A prior draft of the Report asserted that this performance expectation
    was "Generally Not Achieved" because DHS did not provide GAO with
    evidence that it had addressed risks and challenges associated with the
    security of travel documents. DHS responded to GAO with information
    relating to the following programs and initiatives:

    * The United States Visitor and Immigrant Status Indicator Technology
    (US-VISIT) program provides the capability to biometrically compare and
    authenticate travel documents issued by DHS and the Department of State
    to non-U.S. citizens. Required by the Enhanced Border Security and Visa
    Entry Reform Act, DHS utilizes the system to verify that U.S. travel
    documents are authentic and confirms non-U.S. citizen identities via
    real-time fingerprint and facial recognition technology.

    Documents that can be verified in this manner include State Department
    issued non-immigrant visas, Border Crossing Cards (BCC) and immigrant
    visas as well as DHS issued Permanent Resident Cards (PRC), refugee
    travel documents, and re-entry permits.

    * The US-VISIT fingerprint capability was implemented at air ports of
    entry in January 2004 and has expanded to all land border ports of
    entry.

    * The use of digital verification and authentication of travel
    documents issued to aliens by DHS allows officers to compare documents
    presented at the time of issuance (including the photograph) to the
    physical appearance and documents presented at the time of travel. In
    this way, the officer can be assured of the authenticity of the
    document. As of October 2005, DHS-CBP had implemented this capability
    at all ports of entry for non-immigrant visas, immigrant visas, legal
    permanent resident cards, and refugee travel documents. Four additional
    examples of the use of digital verification and authentication of
    travel documents include:
    - e-Passports enable officers to evaluate the validity of the
    biographic information and photograph stored on the e-Passport chip. In
    November 2006, DHS implemented the e-Passport program for the visa
    waiver countries at 200 primary inspection lanes at 33 ports of entry.
    - The Consolidated Consular Database (CCD) provides additional
    information on U.S. visas and passports to help determine the
    documents' authenticity. As of February 2006, all U.S. ports of entry
    had access to CCD information, and for the single month of May 2007,
    the ports ran more than 250,000 queries in CCD, resulting in over 1,800
    enforcement actions.
    - The Lost/Stolen Passports Program provides DHS-CBP officers with the
    capability to search passports presented by travelers against the watch
    list of lost/stolen passports. DHS-CBP has utilized this system for
    many years, and every primary and secondary query includes a check of
    lost/stolen passports.
    - The Regional Movement Alert System (RMAS) enables DHS-CBP to confirm
    that certain foreign passports are not lost/stolen by comparing the
    passport information against records of the issuing country. Since RMAS
    was implemented in early 2006, there have been more than 1.8 million
    queries for travelers to the United States.

    The GAO Report acknowledges these programs but cites new issues
    relating to plans for the deployment of document readers and the
    development of a strategic plan for the Immigration Advisory Program.
    The GAO Report further criticizes the Department for not having
    extended the Western Hemisphere Travel Initiative (WHTI) to land and
    sea ports of envy. The report does not take into consideration that
    Congress has delayed more extensive implementation of WHTI. DHS had
    drafted a rule to implement the sea portion of WHTI at the same time as
    the air rule, but Congress required that sea implementation be delayed
    until the land rule could be issued and, at the same time, imposed
    additional requirements before the land rule could take effect. Despite
    these changes, the Department is still on track, and plans to implement
    this program at land and seaports well in advance of the statutory
    deadline.

    Performance Expectation 12: Leverage technology, personnel, and
    information to secure the border. The Department disagrees with the GAO
    Report's assessment of "Generally Not Achieved." The Department. in
    fact, relies upon many programs to leverage technology, personnel, and
    information to secure the border.

    For example, the US-VISIT program incorporates eligibility
    determinations made by both DHS and the Department of State into a
    continuum of security measures. In particular, US-VISIT manages systems
    that operate at 283 air, sea and land ports and 210 Consular Offices
    worldwide. These systems collect data and screen travelers against
    existing watch lists and databases containing information about
    previous DHS encounters with the traveler, verifying identities and
    travel documents. The Department also captures data on individuals
    attempting illegal entry into the United States between the ports of
    entry, as well as individuals who are being investigated or removed
    from the interior of the country. This information is then shared with
    the ports of entry, Consular Offices, Border Patrol Stations,
    Immigration and Customs Enforcement (DHS-ICE) Field Offices, U.S.
    Citizenship Immigration Services (DHS-USCIS), and the U.S. Coast Guard
    (DHS-USCG). This coordination expeditiously provides the Border
    Management community with information regarding an individual who has
    had previous contact with the Department.

    US-VISIT also works closely with DHS-CBP on the development and
    deployment of new initiatives. Such collaboration allows the Department
    to take advantage of the synergy from the efforts of both entities and
    leverage existing resources.

    Immigration Enforcement:

    The Department has significantly improved immigration enforcement in
    this country as recognized by the numerous "Generally Achieved"
    assessments made by GAO officials; however, the Department disagrees
    with the "Generally Not Achieved" assessments in several performance
    expectations related to immigration enforcement.

    Performance Expectation 2: Implement a program to ensure timely
    identification and removal of aliens subject to removal from the US.
    The Department disagrees with the assessment of "Generally Not
    Achieved." The methodology used to reach this assessment is flawed
    because it dismisses tangible results in favor of potential challenges
    and holds DHS accountable for factors outside the Department's control.

    DHS-ICE has made significant strides to ensure the timely
    identification of aliens subject to removal. As part of the Secure
    Border Initiative, the Department has ended the practice of "catch and
    release" along the borders. Since August 2006, all removable aliens
    caught at the border have been detained until the return to their home
    countries. DHS-ICE removed 192,171 illegal aliens, including 88,217
    criminals, from the country in Fiscal Year 2006. This marks a 13
    percent increase in total removals and a 4 percent increase in criminal
    removals over the prior Fiscal Year. DHS-ICE also increased its
    detention bed space by 7,500 during Fiscal Year 2006 and is funded for
    additional beds in corning years.

    DHS-ICE has shortened the processing and detention times for removal of
    aliens through its Electronic Travel Document program. In addition, DHS-
    ICE has added resources for interviewing consular officials about
    removal actions, and for transporting aliens more quickly.

    Yet, despite these results, the GAO Report asserts that the
    Department's efforts "may not yet fully address" the "potential" risks
    of not being able to remove illegal aliens.

    DHS-ICE also must contend with certain variables that impede the
    agency's ability to remove an alien. Although ICE has made great
    strides in the international arena in such matters, expedited removal
    is halted or slowed due to certain foreign countries' unwillingness to
    accept their returned nationals. For example, removal frequently may he
    delayed or refused by a foreign government, even when they are
    presented with conclusive identity information and passports. DHS-ICE
    officials have gone to considerable efforts to encourage non-
    cooperating countries to issue travel documents, but still often
    encounter unnecessary delays.

    In other cases, the removal process may be delayed due to the lengthy
    duration of removal proceedings. Aliens may present their cases to an
    immigration judge, file an appeal, and seek further review in federal
    courts. In some jurisdictions, the removal of aliens is automatically
    stayed - or enjoined - by court order upon the alien's request.

    The GAO Report specifically recognizes these impediments to timely
    removal and admits that they "may be outside of DHS's control." The
    Report still assesses this performance expectation as "Generally Not
    Achieved."

    Performance Expectation 3: Ensure removal of criminal aliens. The
    assessment of "Generally Not Achieved" is unsupported by facts
    regarding this performance expectation.

    For example, the GAO Report undervalues the progress made by the
    Department through the Criminal Alien Program (CAP), despite
    acknowledging that DHS-ICE maintains a presence of officers in
    approximately 2,000 federal, state, and local facilities. There is a
    CAP presence in each of the 114 federal Bureau of Prisons detention
    facilities. While 40 DHS-ICE operation teams presently screen foreign-
    born inmates, we continue to train and hire nearly 200 additional staff
    to support the CAP program and extend coverage to state and local jails
    and prisons. The expansion of CAP has shown tremendous results as CAP
    is on a course to double the number of criminal aliens placed in
    removal proceedings in 2007.

    The GAO Report criticizes the Department for not having fully
    implemented the CAP in all of the more than 5,000 federal, state, and
    local facilities across the country. This unrealistic expectation
    reveals a marked lack of appreciation for the enormous resources that
    would be required to implement such an expansion. Even if DHS-ICE were
    appropriated the funds necessary to expand CAP to a single additional
    institution every single day, it would take over eight years to achieve
    this outcome. The GAO Report does not consider that this is an on-
    going, multi-year effort.

    Performance Expectation 6: Implement a program to allow for the secure
    alternative detention of non-criminal aliens. The GAO Report states
    that no assessment has been made for this performance expectation,
    since GAO has not completed work in this area. However, information
    previously provided to GAO officials by DHS-ICE demonstrates that the
    Department has implemented programs for secure Alternatives To
    Detention (ATD) of non-criminal aliens.

    The GAO Report drastically understates the level of meaningful
    participation in the ATD programs and the promising results already
    shown. For example, DHS-ICE has maintained an a Electronic Monitoring
    Program (EMP) whereby aliens awaiting immigration court hearings or
    removal wear either a monitoring ankle bracelet or report by telephone
    to a case manager. DHS-ICE maintains peak capacity at all times for the
    intensive supervision of the EMP at a rolling rate of 6,500 aliens. In
    addition, DHS-ICE recently initiated an effort to replace the EMP with
    an Enhanced Supervision/Reporting Program (ESR) and improved management
    of electronic monitoring devices.

    Further, DHS-ICE maintains the Intensive Supervision Appearance Program
    (ISAP) which is a voluntary pilot program available to aliens not
    subject to mandatory detention, but awaiting immigration court
    proceedings or removal from the United States. If participants agree to
    comply with the conditions of their release, case specialists are
    assigned to monitor participants using electronic monitoring
    (bracelets), home and work visits and reporting by telephone. The ISAP
    program is currently available in nine U.S. cities and enrolls
    approximately 1,700 participants on a rolling basis. DHS-ICE aims to
    expand the ISAP program by 129 percent, equating to 2,200 new ISAP
    participants. ISAP has shown great promise as an effective alternative
    to detention and has already achieved excellent results: the appearance
    rate for [SAP participants is 98 percent at immigration hearings and 94
    percent at final removal hearings. In short, ICE has implemented a
    successful, growing ATD program for non-criminal aliens.

    Performance Expectation 8: Implement a prioritized worksite enforcement
    strategy to ensure that only authorized workers are employed. The
    assessment of "Generally Not Achieved" highlights the flaw in the
    binary assessment system used by GAO.

    As the GAO Report acknowledges, DHS-ICE provided considerable new
    information on its significant worksite enforcement efforts. GAO
    appears, however, to have largely not considered these achievements,
    asserting instead that the information did not demonstrate how these
    efforts have resulted in "desired outcomes." This conclusion does not
    comport with the evidence provided, which, as described below, reveals
    that DHS-ICE's efforts have resulted in impressive outcomes, including
    the increased use of employment verification systems and significant
    increases in investigations and arrests.

    As DHS-ICE has previously explained to GAO officials, its worksite
    enforcement strategy is a comprehensive three-pronged approach aimed
    at: (a) critical infrastructure projection; (b) criminal investigations
    of egregious employer violators; and (c) enhanced employer compliance
    and outreach through IMAGE. IMAGE is a corporate outreach program
    designed to give employers tools and best practices to ensure that they
    have an authorized workforce. In January 2007, eight companies and one
    trade association became charter IMAGE members and made a formal pledge
    to the program. DHS-ICE has conducted more than 50 IMAGE outreach
    presentations to companies and to industry associations that represent
    or influence thousands of U.S. employers. The IMAGE presentations
    provide employers instructions on their responsibilities for employment
    verification and also provide them with the tools and best practices
    needed to establish and maintain an authorized workforce.

    Moreover, it is important to note the significant results already
    achieved through DHS-ICE worksite enforcement programs. In Fiscal Year
    2006, more than 4,300 arrests and apprehensions were made from worksite
    enforcement cases; this figure represents more than seven times the
    arrests and apprehensions in Fiscal Year 2002 (the last full year of
    operations of the U.S. Immigration and Naturalization Service). DHS-ICE
    has also completed nearly 6,000 compliance enforcement investigations
    resulting in administrative arrests of more than 1,700 overstay and
    status violators, a 75 percent increase over the number of
    administrative arrests in Fiscal Year 2005.

    Performance Expectation 10: Implement a comprehensive strategy to
    interdict and prevent trafficking and smuggling of aliens into the U.S.
    The assessment of "Generally Not Achieved" is not supported by the
    facts provided to GAO officials regarding this performance expectation.

    The Department's strategy for counteracting the trafficking and
    smuggling of aliens is just one part of the larger SBI and SABPOE
    Strategic Plan. In addition to the implementation of these plans by DHS-
    CBP already discussed above, DHS-ICE has also made significant progress
    in meeting this performance expectation in coordination with other
    departmental components and federal agencies. For example, Border
    Enforcement and Security Task Forces (BEST) have been created to target
    cross-border criminal activity, including human trafficking. These task
    forces are nationally-integrated teams comprised of resources drawn
    from DHS-ICE, DHS-CBP, the Drug Enforcement Administration, Federal
    Bureau of Investigation, Bureau of Alcohol, Tobacco, Firearms and
    Explosives, U.S. Marshals Service, as well as state, and local
    representation. Since their inception, BESTs have made 430 criminal
    arrests and 827 administrative arrests; seized 66,265 pounds of
    marijuana, 1,462 pounds of cocaine, S8,318,324 in U.S. currency, and
    155 vehicles.

    Furthermore, since 2006, DHS-ICE has maintained an active and
    aggressive domestic and overseas human trafficking program called the
    ICE Trafficking in Persons Strategy (ICE TIPS). ICE TIPS targets
    criminal organizations and individuals engaged in human trafficking
    worldwide. ICE TIPS focuses on partnerships and collaboration with
    other DHS agencies, foreign governments, Non-Governmental Organizations
    (NGOS), the Department of Justice (DOJ) Civil Rights Division and U.S.
    federal, state and local law enforcement.

    Although the draft GAO Report was also critical of the coordination
    between DHSICE and DHS-CBP, there are in fact mechanisms in place for
    the two components to share information related to the trafficking or
    smuggling of aliens. For example, the Department has established a
    Liaison Section at the DHS-CBP National Targeting Center (NTC) to
    facilitate such coordination. A number of Memoranda of Understanding
    between DHS-ICE and DHS-CBP have also formalized the coordination of
    information between the components. For example, on November 16, 2004,
    the ICE Office of Investigations (OI) and CBP's Office of Border Patrol
    (CBP/BP) entered into a Memorandum of Understanding (MOU) that guides
    CBP Chief Border Patrol Agents and ICE's Special Agents in Charge in
    developing operational partnerships between the Border Patrol and OI
    agents at the local level. On February 2, 2007, CBP/BP and ICE/OI
    signed the addendum to the November 16, 2004 MOU, which clarified the
    roles and responsibilities of each agency and discussed items such as
    data sharing and co-location of Intelligence units, and encouraged
    joint enforcement operations. In addition, on December 8, 2005, ICE/O1
    and CBP Office of Field Operations (CBP/OFO) signed a joint memorandum
    which established ICE/OI as the investigative arm for CBP/OFO and the
    primary contact for investigative matters.

    Immigration Services:

    The GAO Report correctly acknowledges that the Department has achieved
    several key performance expectations in the area of immigration
    services. Other assessments in the GAO Report, however, are not
    consistent with the results recognized both inside and outside of the
    Department.

    Performance Expectations 1 and 5: Eliminate the benefit application
    backlog and reduce application completion times to 6 months and Develop
    new programs to prevent. future backlogs from developing. The
    Department disagrees with the GAO Report's assessments of "Generally
    Not Achieved."

    DHS-USCIS is well on its way to eliminating the application backlog.
    The benefit application backlog as of last September was less than
    10,000 applications. Even the GAO Report acknowledges that USCIS "has
    made significant progress." Moreover, the Senate Committee on
    Appropriations recently reported that "USCIS has made substantial
    progress over the last several years to successfully address the
    backlog of applications and petitions within its control."

    While the GAO Report acknowledges that the Department's method used in
    prioritizing the applications backlog may be considered "reasonable,"
    it still downgrades DHS-USCIS for not including cases where information
    from the applicant or another agency is pending. The Report does not
    appropriately recognize external factors - including delays by other
    agencies and the limitation on available visas - beyond the
    Department's control is a deficiency in the methodology. It is also
    inconsistent with other assessments made in the report that explicitly
    limit the scope of performance expectations to "DHS's roles and
    responsibilities."

    The GAO Report also criticizes the Department for insufficient actions
    to prevent future backlogs. The GAO Report does not give proper credit
    to the Department's significant transformation efforts to increase
    resources, improve customer service, and modernize business practices
    relating to benefits applications. In January 2007, the Department
    issued a Notice of Proposed Rulemaking to adjust the Immigration and
    Naturalization Benefit Application and Petition Schedule. As was
    explained to GAO officials during an exit conference, this rule will
    adjust fees collected for benefit applications, which will provide a
    stable source of revenue to support a significant reduction in
    processing times.

    Performance Expectation 3: Establish a timetable for reviewing the
    program rules, business processes, and procedures for immigration
    benefit applications. The GAO Report assessment of "Generally Not
    Achieved" is not supported by the facts or documents previously
    provided to GAO officials.

    Through an extensive program to transform its processes, DHS-USCIS
    grouped the existing transactions into four major types of transactions
    handled: (i) citizenship; (ii) immigrant; (iii) humanitarian; and (iv)
    non-immigrant. Subsequently, DHS-USCIS developed a timetable to
    implement improved processes for each of these four types of
    transactions. These timetables are contained in the DHS-USCIS
    Transformation Program Office FY 2007 Expenditure Plan, and articulate
    the timeframes for implementation of the improved processes and
    increased business capabilities. DHS-USCIS previously provided a copy
    of this Expenditure Plan and the accompanying timetables to GAO yet,
    GAO has not considered this.

    Performance Expectations 12 and 14: Establish training programs to
    reduce fraud in the benefits process and Implement a fraud assessment
    program to reduce benefit fraud. The GAO Report states that DHS-USCIS
    has made progress in establishing training programs to reduce fraud in
    the benefits process, yet concludes that the Department has "Generally
    Not Achieved" this performance expectation. This assessment does not
    comport with the evidence provided to GAO officials and cited in the
    GAO Report.

    Contrary to the statement in the GAO Report, DHS-USCIS has developed a
    uniform training course for all officers. This success was evidenced by
    the complete list of topics and rosters for its training programs that
    DHS-USCIS provided to GAO officials.

    In addition, DHS-USCIS explained to GAO officials that it has
    identified certain fraud schemes that are unique to specific
    application processes and/or prevalent in geographical areas. The
    Department consequently has provided specialized training to certain
    officers who handle these particular types of matters or who are
    stationed in certain locations above and beyond the uniform training
    provided to all officers. A prior draft of the GAO Report appears to
    have misunderstood data relating to these specialized and targeted
    programs as evidence of inconsistent training across offices. The
    current GAO Report seems to have rectified this misunderstanding,
    citing specific DHS-USCIS examples of a clear nexus between locations
    where fraud is centralized and specialized anti-fraud training.
    However, instead of recognizing the achievements of these programs, the
    GAO Report now appears to base its assessment of "Generally Not
    Achieved" on the "appropriate[ness]" of the training. This appears to
    be an inconsistency of methodology.

    With respect to DHS-USCIS's fraud assessment efforts, a prior draft of
    the GAO Report based its assessment on the fact that the Department had
    not provided evidence of recently completed Benefit Fraud Assessments
    (BFAs). BFAs are assessments conducted on randomly-selected cases
    involving a particular benefit claim in order to identify the extent
    and nature of fraud for specific immigration benefits. Most BFAs also
    include field inquiries to identify fraud that cannot be discerned from
    systems checks, interviews, or by reviewing files. DHS-USCIS
    subsequently informed GAO officials that, in addition to the three BFAs
    conducted to date, four more BFAs are scheduled to be completed before
    the end of this fiscal year, and two more BFAs are to conclude in the
    next fiscal year. The current GAO Report acknowledges this updated and
    responsive information to the prior criticism. Nevertheless, the Report
    now states that DHS-USCIS has not developed and demonstrated the
    success of a strategy for conducting BFAs. In fact, the BFAs conducted
    to date have provided useful baseline data to assist DHS-USCIS in
    developing a comprehensive strategy, and they have already resulted in
    procedural and regulatory changes to minimize certain types of fraud.

    Aviation Security:

    The Department has made significant progress in many facets of aviation
    security, including the 17 performance areas in which the GAO Report
    gave DHS an assessment of "Generally Achieved." GAO thus recognized,
    for example, the Department's efforts to develop a strategic approach
    for aviation security functions, processes and procedures for screening
    passengers, and plans for baggage and air cargo screening. The GAO
    Report is nevertheless incorrect in its assessment that DHS has
    "Generally Not Achieved" key elements in several additional performance
    areas, including the following.

    Performance Expectations 2 and 3: Establish standards and procedures
    for effective airport perimeter security and Establish standards and
    procedures to effectively control access to airport secured areas. The
    Department takes strong exception to the GAO Report's assessments of
    "Generally Not Achieved" for these performance expectations. These
    assessments do not give the Department credit for the substantial
    progress made in this area by the Department's Transportation Security
    Administration (DHS-TSA).

    Contrary to GAO's assertion, DHS-TSA has provided documentation
    outlining DHS-TSA full compliance with requirements of the Aviation and
    Transportation Security Act (ATSA), specifically as they relate to
    strengthening the airport perimeters and access controls. Per ATSA
    requirements, TSA has developed the "Aviation Inspection Plan," which
    is based on an analytical risk-assessment process evaluating threats,
    vulnerabilities, and potential consequences, and is reviewed and
    updated every year.

    Airports and airlines play key roles in the areas of perimeter and
    access security, and share in the overall responsibility. In stating
    that the Department has not provided evidence that its actions have
    provided for effective airport perimeter security and access controls,
    the GAO Report does not properly consider the significance of the steps
    taken by the Department in conjunction with airports and airlines
    including:
    * Inspections of vehicles at access gates;
    * Screening of airport and airline employees attempting to gain access
    to secure areas (pursuant to the Aviation Direct Access Screening
    Program);
    * Security threat assessments before persons are issued airport
    credentials or identification;
    * Ongoing assessments and monitoring of new technologies;
    * A comprehensive review of all airside security provisions; and
    * Development of near-term and long-term plans that include enhanced
    vetting and credentialing procedures, tighter controls over critical
    infrastructures, and the incorporation of biometric data into
    identification systems and access controls.

    These processes and programs demonstrate that the Department has
    established strong standards for effective airport perimeter and
    secured-area security and have improved security in these areas. In
    addition, DHS-TSA also furnished GAO officials with a detailed action
    plan addressing all GAO recommendations from its 2004 audit, which does
    not appear to have been given significant weight in the GAO Report.

    Although GAO indicates that it would like to see evidence of the impact
    of this improved security, it is difficult to precisely measure the
    deterrent effect that the Department's measures have had.

    DHS-TSA has nevertheless determined that a random, flexible, risk-based
    approach provides more effective security than creating stationary
    security posts. Experience shows that stationary, predictable security
    measures can be the easiest to foil. DHSTSA therefore has implemented
    the Aviation Direct Access Screening Program (ADASP), which includes
    elements of random screening of airport and airline employees,
    property, and vehicles as they enter secure or sterile areas other than
    through the established DHS-TSA checkpoints. During those random
    screenings, Transportation Security Officers (TSO) screen for the
    presence of explosives, incendiaries, weapons, and other contraband, as
    well as improper airport identification documents.

    Performance Expectation 14: Develop and implement an advanced
    prescreening system to allow DHS to compare domestic passenger
    information to the Selectee List and No Fly List. The assessment of
    "Generally Not Achieved" does not recognize the Department's progress
    in achieving program milestones in this multi-year effort.

    In particular, GAO largely dismisses the extensive materials previously
    provided to GAO by DHS-TSA, including a total of 57 documents detailing
    the Secure Flight program's mission needs; concept of operations,
    management plans; system requirements, acquisition plans;
    testing/evaluation plans, privacy assessments, and the related
    schedules; as well as more than a dozen briefings for GAO officials.
    Instead, it appears GAO bases its assessment on the fact that the
    Secure Flight program development efforts and implementation have not
    been fully completed at present.

    Performance Expectation 15: Develop and implement an international
    passenger prescreening process to compare passenger information to
    terrorist watch lists before aircraft departure. The GAO Report makes
    an assessment of "Generally Not Achieved" because full implementation
    of an integrated Secure Flight system will not occur for several years.
    By doing so, GAO unfairly and prematurely assesses the Department's
    progress on a long-term goal.

    The Department has previously informed GAO officials that the Secure
    Flight Notice of Proposed Rule Making and the Pre-Departure APIS Final
    Rule are scheduled to be published in the coming months, and GAO
    officials have been briefed on the content of the Secure Flight
    proposed rulemaking. With these two rulemakings, the
    Department is on track to implement pre-departure international
    passenger screening.

    The GAO Report recognizes that efforts to define functional
    requirements and operations are underway in order to align the
    international and domestic passenger prescreening programs.
    Departmental officials have briefed GAO officials on the plans for
    alignment and furnished them with a copy of the Secure Flight Concept
    of Operations and the Consolidated Users Guide. In addition, the
    upcoming Secure Flight Notice of Proposed Rule Making and Pre-Departure
    APIS Final Rule will outline the alignment plan in greater detail.
    Despite having been provided with this detailed update on this long-
    term program (as well as the Department's short-term solution), it does
    not appear this information was considered in the assessment.

    Performance Expectation 18: Deploy checkpoint technologies to address
    vulnerabilities. The Department disagrees with the assessment of
    "Generally Not Achieved." This assessment does not recognize the
    Department's progress in this Performance Expectation, and does not
    consider the practical limitations inherent in developing and deploying
    new technological solutions.

    Contrary to the statement in the GAO Report, the Department is
    constantly deploying existing technologies and developing new
    technologies to reduce checkpoint vulnerabilities. In particular, DH
    DHS-TSA continues to apply the latest improvements to existing
    technologies - such as checkpoint x-ray systems, walk-through metal
    detectors. and next-generation explosive trace detection systems. With
    regard to developing technologies, DHS-TSA is working closely with the
    DHS Science and Technology Directorate (DHS-S&T) on research and
    development activities to rapidly and responsibly respond to threats
    and to achieve advancements in screening technologies.

    In Fiscal Year 2007, DHS-TSA and S&T explored technologies, such as
    bottled liquids scanners, whole body imagers, cast and prosthetics
    scanners, automated explosives detection devices, and advanced
    technology screening systems for carry-on items. The development of new
    technologies, however, takes time to test in the laboratory and in the
    field. Such testing must be conducted to determine operational
    effectiveness and suitability before new technologies can be deployed
    at operating checkpoints. The safety of the Nation and its citizens is
    too important to rush the deployment of untested technologies. Adequate
    testing before deployment also is needed to exercise proper stewardship
    of federal resources.

    Furthermore, the GAO Report does not consider other efforts, in
    addition to checkpoint technologies, that have effectively reduced
    vulnerabilities. For example, DHS-TSA has instituted updated procedures
    to detect explosives and has provided enhanced training for
    Transportation Security Officers (TSO). Better educated and trained
    TSOs are better equipped to recognize and deal with potentially
    threatening contraband. Deployment of TSOs specifically trained in
    behavioral recognition and bomb appraisal, as well as specially-trained
    canines, also enhances the safety of the current checkpoint screening
    procedures.

    Surface Transportation Security:

    Although recognizing that the Department "Generally Achieved" three of
    the five performance expectations related to securing modes of surface
    transportation, the GAO Report does not recognize the progress that has
    been made by the Department in the remaining areas.

    Performance Expectation 3: Issue standards for securing surface
    transportation modes. The GAO Report assessment of "Generally Not
    Achieved" is inaccurate and does not reflect the Department's
    significant progress. While recognizing the Department's issuance of
    standards related to mass transit and passenger and freight rail, the
    Report does not take into consideration standards issued by the
    Department in other modes of transportation, such as highways and
    pipelines.

    With respect to highways, DHS-TSA has developed draft Security Action
    Items (SAIs). Copies of the draft SAIs were provided to GAO officials
    in connection with a prior GAO audit on "Commercial Vehicle Security."
    These SAIs contained standards addressing personnel security, access
    control and en route security related to the highway modality.

    With respect to pipelines, DHS-TSA issued "Pipeline Security Smart
    Practices" to pipeline industries in an effort to assist them in their
    security planning and implementation. These Smart Practices are drawn
    from the data collected from the numerous on-site security reviews of
    pipeline operators, personnel, and security measures conducted since
    the Fall of 2003. The Smart Practices contain voluntary standards that
    address badging and access control, physical security, vehicle
    checkpoint and intrusion detection, and security incident management
    planning. In addition, the Department of Transportation (DOT) issued
    the Pipeline Security Information Circular and the Pipeline Security
    Contingency Planning Guidance in 2002. DHS-TSA supports these
    standards, as they were used as the basis for its CSRs.

    Performance Expectation 4: Conduct compliance inspections for surface
    transportation systems. The Department disagrees with the assessment of
    "Generally Not Achieved." Although the GAO Report recognizes that the
    Department has conducted compliance inspections with regard to the mass
    transit, passenger rail, and freight rail modes, its assessment does
    not appear to give DHS credit for these compliance inspections or the
    progress that has been made in other areas.

    In particular, the GAO Report notes that DHS-TSA provided supplemental
    information regarding Surface Transportation Security Inspectors'
    (STSIs) on-site assessments of the freight railroad industry and the
    Department's implementation of security measures for Toxic Inhalation
    Hazard (TIH) shipments. GAO's Report does not appear to consider the
    impact of these assessments, however. Since the STSIs began auditing
    freight railroad carriers for the Security Action Items beginning in
    October 2006, they have audited more than 320 facilities. In June 2007,
    STSIs also began auditing freight carriers for adherence with
    Supplemental Security Action Items. These audits will assist in
    achieving the goal of reducing risk from TIH rail shipments by 50
    percent by the end of next year.

    GAO does not give the Department credit for the Baseline Assessment and
    Security Enhancement (BASE) reviews that have been completed on 38
    transportation systems. In addition, there are 6 more reviews currently
    in progress. The BASE program is designed to collect detailed
    information regarding the security posture of a transit system in order
    to assess the implementation of recommended security measures. During a
    BASE review, STSIs assess the security posture of a transit system
    based upon 17 Security and Emergency Preparedness Action Items. The
    goal is to complete BASE assessments on the top 50 transit agencies by
    the end of 2007.

    Maritime Security:

    The Department is proud of the tremendous progress we have made in the
    area of Maritime Security, as demonstrated by the 17 ratings of
    "Generally Achieved." The Department disagrees, however, with the
    assessment in the area of developing a long range vessel-tracking
    system.

    Performance Expectation 16: Develop a long-range vessel-tracking system
    to improve maritime domain awareness. Although the GAO Report
    acknowledges the significant progress that has been made by the DHS-
    USCG to develop a long-range vessel-tracking system, it nevertheless
    gives the Department an assessment of "Generally Not Achieved." The
    assessment is another example of the report's propensity to rate the
    ongoing development and implementation of multi-year programs on the
    basis of whether total implementation has been achieved today.
    As recognized by GAO, the Nationwide Automatic Identification System
    (NAIS) is presently providing vessel-tracking information for vessels
    in U.S. waters. By the end of 2007, DHS-USCG will receive
    identification and tracking information for vessels in U.S. waters in
    the vicinity of 55 critical ports and 9 coastal areas. When fully
    implemented, the NAIS project will provide tracking capabilities for
    all U.S. waters and up to 2,000 miles offshore. DHS-USCG anticipates
    initial long-range tracking capability later this year.

    In addition, DHS-USCG is working to establish a Long Range
    Identification and Tracking (LRIT) system to provide a global tracking
    capability. LRIT is an International Maritime Organization regulation
    requiring vessels on international voyages, passenger and cargo ships
    of 300 gross tons and above, to carry working LRIT transponders. This
    LRIT system will give the United States a system that is compatible and
    interoperable with the global maritime community. LRIT will provide for
    global information on all U.S. flagged vessels required to carry
    transponders, and information on all U.S.-bound vessels regardless of
    flag state within 1000 miles.

    Furthermore, there are other vessel-tracking programs that currently
    fulfill the requirement for a long-range vessel tracking system;
    however, these systems cannot be detailed here due to their sensitive
    nature. In conjunction with the sources described above, long-range
    vessel tracking is currently being achieved to obtain MDA. It appears
    GAO does not consider this information and the significant progress
    that has been made with respect to the NAIS and LRIT systems.

    Emergency Preparedness and Response:

    The Department is proud of the progress that has been made in the area
    of emergency preparedness and response in light of the many challenges
    recognized by GAO that have arisen in this area, including the recent
    reorganization required by the Congress following Hurricane Katrina. As
    GAO also recognized, the Department has made progress in the areas of
    developing a national incident management system and with respect to
    federal grants to first-responders and state and local governments. The
    Department, disagrees with several other assessments made by GAO.

    Performance Expectation 4: Ensure the capacity and readiness of
    disaster response teams. The Department disagrees with the assessment
    of "Generally Not Achieved," which does not give sufficient
    consideration to the disaster response team capacity and readiness
    improvements already implemented by the Department.

    DHS currently manages multiple disaster response operations centers,
    teams, and assets through the Federal Emergency Management Agency (DHS-
    FEMA). The Department has a tiered disaster response framework, with
    several disaster response teams ready to provide varying levels of
    response depending on the circumstances and related requirements. The
    capacity and readiness of these teams arc constantly being refined and
    improved based on lessons learned and ongoing assessments.

    * The Federal Incident Response Support Teams (FIRSTs) were formed in
    2003 to provide preliminary on-scene federal management and important
    situational awareness for the Department. The mission of FIRSTs is to
    support the state and local response by expediting the delivery of life-
    saving federal assistance. FIRSTs also provide initial situation
    assessments for local, state, and federal officials, determine federal
    support requirements, and integrate federal assets into the state and
    local response. FIRSTs' on-site capabilities include several command
    vehicle and communications capabilities through the into-net,
    satellites, computers, mobile radios and GPS units. FIRSTs are self-
    sufficient for up to five days. Based on recent refinements to their
    readiness standards, FIRSTs can now deploy within two hours of notice
    and arrive on scene in 12 hours or less.
    * Advanced elements of Emergency Response Teams (ERT-As) are regional
    disaster response teams that can be deployed in the event of a
    disaster. Because FIRSTs arc essentially forward extensions of the
    larger ERT-As, an ERT-A will continue to provide the federal response
    capabilities described above once it arrives on scene. Under current
    readiness standards, ERT-As can be deployed within six hours of notice
    of an event and arrive within 12 hours.
    * The National Emergency Response Teams (ERT-Ns) are national disaster
    response teams. They provide similar response capacities to the ERT-As.
    ERT-Ns can be activated and deploy within 12 hours of notice and arrive
    on-scene within 24 hours.
    * Mobile Emergency Response Support (MERS) detachments are specialized
    response teams. They are designed to provide mobile telecommunications,
    life support, logistics, operational support and power generation.
    Under current readiness standards, MERS detachments can deploy within
    four hours of notification of an event.

    The Department's responses to recent storms and tornadoes have
    demonstrated the capacity and readiness of these teams. In response to
    Tropical Storm Ernesto, for example, the FIRST arrived approximately
    seven hours after being deployed. In response to the recent tornadoes
    in Florida and Alabama, FIRSTs arrived the same day that the storms
    struck. The ERT-A showed a similar rapid response following the recent
    Greensburg, Kansas tornado, when it arrived within seven hours of being
    deployed. The MERS deployment arrived on scene a few hours later. These
    real-life examples contradict the assertion in the GAO Report that the
    Department can offer no evidence that the current levels of readiness
    and capabilities have improved since Hurricanes Katrina and Rita.
    Fortunately, there has been no opportunity to deploy DHS disaster
    response teams in response to an event of the magnitude of Katrina or
    Rita. That fortuity does not diminish, however, the Department's recent
    successes.

    DHS is also currently developing the next generation of rapidly
    deployable response teams - Incident Management Assistance Teams
    (IMATs). The IMATs will have the ability to establish an effective
    federal presence on-scene within 12 hours of notification to support
    the state, coordinate federal activities, and provide initial
    situational awareness. These teams will be self-sufficient for a
    minimum of 48 hours so as not to drain potentially scarce local
    resources. These IMATs are being designed to incorporate the best
    practices, design factors, and performance metrics from the existing
    teams along with next-generation technologies. Standardized doctrine,
    policies, response metrics, and operating procedures are being
    developed to support these new teams, ensuring that DHS response team
    assets will be further strengthened to meet the incident needs of the
    future.

    Performance Expectation 7 and 8: Establish a single, all hazards
    national response plan; and Coordinate implementation of a single, all
    hazards response plan. The Department strongly disagrees with the
    assessments of "Generally Not Achieved" for these performance
    expectations because they do not properly recognize the current
    National Response Plan (NRP) that was implemented in 2004.

    Contrary to the assessment made. GAO acknowledges that "DHS has
    established a single all-hazards national response plan." The current
    all-hazards NRP includes appropriate annexes as well as a Catastrophic
    Incident Supplement. The review and revision of the NRP currently
    underway does not change the fact that a single, all-hazards NRP
    remains in place and is being used daily to respond to a multitude of
    incidents across the Nation. The GAO Report does not appear to consider
    the reality that the NRP is a living document that will be regularly
    reviewed and revised as long as it is in existence: when the current
    revision effort is completed the process of identifying potential
    improvements for the next revision will already be underway. There can
    never be an all-hazards national response plan that will be set in
    stone.

    Similarly, the GAO Report's concern that the Department's ongoing
    efforts to review and revise the NRP will negatively impact the ability
    to fully train, exercise and develop new implementation plans for the
    NRP is flawed. The existing NRP will be implemented in response to
    incidents that occur before the issuance of a revised plan, and there
    will be a thoughtful transition process executed in conjunction with
    the issuance of any revised plan.

    GAO also does not give the Department credit for the progress that has
    been made in coordinating implementation of the existing NRP. There has
    been extensive coordination of the NRP implementation through training,
    exercises, and planning efforts with our Federal, state and local
    partners. The Department has also engaged in special hurricane
    preparedness initiatives in the major hurricane-prone areas of the
    Nation. As a result of the successful creation and coordination of the
    NRP, more than 6 million Federal, state, local, private sector and non-
    governmental organization employees have been trained on Incident
    Command System and National Incident Management System concepts that
    form the basis for effective response efforts. Over six million people
    across the private and public sectors within the United States have
    taken such courses and now are able to understand and implement the
    Department's National Response Plan. In addition, the coordinated
    responses to 97 major disaster declarations since Katrina have allowed
    for greater coordination in the implementation of the NRP. These
    efforts all indicate the progress that has been made by the Department
    since Katrina.

    Performance Expectation 13: Develop the capacity to provide needed
    emergency assistance and services in a timely manner. DHS strongly
    disagrees with GAO's assessment. Critical services, such as improved
    logistics tracking and capacity, increased disaster victim
    registration, and robust fraud, waste and abuse protections are in
    place and fully functional. For example, the Total Asset Visibility
    (TAV) initiative has resulted in improved logistics tracking, while
    interagency agreements with the Defense Logistics Agency, pre-scripted
    mission assignments, and a strengthened stand-alone Logistics
    Directorate have resulted in greater logistical capacity.

    Contrary to GAO's statement, the Department has established and tested
    initiatives in this area. The TAV system has been tested in numerous
    recent disaster response situations including the response to severe
    winter storms. For instance, in January 2007 during the severe winter
    storms in Oklahoma, the TAV system accurately and seamlessly tracked
    over 70 truckloads of supplies through changes in location. During
    powerful tornadoes in Florida, Alabama, Georgia, and Kansas, the TAV
    system tracked both truckloads of supplies and Mobile Disaster Response
    Centers, providing FEMA Leadership with the accurate and current
    location of assets, as well as the projected time of arrival. This
    system enabled effective logistics and planning decisions for efficient
    use of resources when they arrived in the disaster area.

    FEMA has also engaged in outreach to other Federal agencies to ensure
    the smooth and responsive coordination of Federal support when it is
    needed. The most visible demonstration of this coordination is the
    array of Federal capabilities contained in the "playbook" of pre-
    scripted mission assignments. This playbook represents an examination
    of the range of Federal capabilities and support and includes advance
    inter-agency coordination to ensure the timely delivery of such
    capabilities in times of need. At present, we have developed and
    coordinated 187 pre-scripted mission assignments with as many as 21
    Federal agencies. Up to an additional 40 mission assignments are
    currently under review. This support ranges from heavy-lift helicopters
    from DOD, to generators from the U.S. Army Corps of Engineers, to
    Disaster Medical Assistance Teams from HHS and Emergency Road Clearing
    Teams from the U.S. Forest Service. These pre-scripted mission
    assignments will result in more rapid and responsive delivery of
    Federal support to States. FEMA also has established contracts with
    private-sector suppliers to provide additional needed support in a
    major disaster.

    FEMA has worked closely with our state and local partners in an
    "engaged partnership" to identify and address their needs, recognizing
    that disaster response is not a "one-size fits all" proposition. For
    example, FEMA has been working closely with highest risk hurricane
    states on a gap analysis initiative that helps them identify and
    address their strengths and weaknesses. This allows the identification
    of areas where the specific states are likely to need Federal support
    and the development of plans to address those needs. FEMA is supporting
    major planning efforts in the Gulf Coast states to address evacuation
    needs should another major disaster strike that area. There are also
    catastrophic planning efforts underway in other areas to identify the
    challenges that would result from major disasters in other areas of the
    nation including those susceptible to flooding and earthquakes. All of
    these efforts help develop the capacity at the Federal, state and local
    levels to provide needed emergency assistance and services in a timely
    manner.

    FEMA has also significantly strengthened its internal capacity to
    respond effectively. A focused effort to fill agency vacancies has
    resulted in FEMA reaching the point where 95 percent of its full-time
    employee slots are filled, including a major restructuring of key
    leadership positions such as the ten regional administrators who are
    all in place and highly qualified for their positions with decades of
    experience in emergency management.

    The majority of information DHS provided to GAO on this performance
    expectation is designed specifically to address catastrophic situations
    which are nearly impossible and very costly to simulate. The GAO Report
    acknowledges that it is therefore "difficult to assess" DHS-FEMA's
    initiatives regarding this performance expectation yet rates the
    performance expectation as "Generally Not Achieved."

    Performance Expectation 14: Provide timely assistance and services to
    individuals and communities in response to emergency events. DHS
    strongly disagrees with GAO's assessment.

    DHS continues to develop and expand capabilities to provide timely
    assistance and services to individuals and communities in response to
    emergency events. A number of initiatives and agreements have been
    undertaken to improve shelter management, including FEMA/Red Cross
    agreements to initiate the National Shelter System -- a web-based data
    system designed to provide information concerning shelter populations
    and available capacity, support targeted registration assistance, and
    enable improved targeting of resources where needed. Deployable Mobile
    Registration Intake Centers have been developed to support timely
    registration at congregate shelters and other locations with
    concentrations of disaster victims. The ability of these Intake Centers
    to respond in a timely manner has been successfully tested both through
    exercises and in response to real events. The capacity to register
    disaster victims has been doubled to more than 200,000 registrations a
    day, and FEMA has entered into an MOU with the IRS to provide surge
    call center support until a contract with a private sector vendor is
    signed this fall. Several MOUs have been developed to share information
    that could assist in the location of missing children and support
    family reunification during a disaster.

    FEMA has undertaken a number of improvements for the provision of
    temporary housing to streamline the determination of applicant
    eligibility and speed the provision of assistance. The agency has also
    developed new policies to ensure all types of temporary housing options
    are available to displaced applicants with disabilities. FEMA
    coordinated with the U.S. Access board to develop new specifications
    for temporary housing and group sites construction to accommodate
    applicants with physical disabilities.

    To combat fraud, waste and abuse, automated checks are in place to
    detect duplicate registrations, identify applicant addresses that are
    not residential, and verify social security numbers, addresses and
    occupancy requirements. Automated systems also now ensure that no
    payments are made until flagged applications are reviewed. FEMA has
    also expanded its home inspection capacity to 20,000 homes per day and
    has added third party evaluation of inspections to improve the speed
    and accuracy of determinations of the level of assistance to be
    provided to the victim.

    The GAO Report criticizes DHS for not providing tangible evidence of
    its successes in this area. However, through the Public Assistance
    program, post-Katrina, DHS has obligated 80 percent of estimated
    assistance within an average of 150 days after declaration compared to
    203 days prior to Katrina. This performance is ahead of our goal which
    is to obligate 80 percent of funding within 180 days. For the important
    debris removal mission, FEMA has issued updated policies, guidance and
    training to support more equitable and timely assistance, and
    established a nationwide list of debris removal contractors for use by
    state and local communities as they plan for, and respond to, debris
    removal requirements. The GAO Report does not recognize these
    achievements.

    Furthermore, DHS has successfully responded to 107 major disasters, 15
    emergencies and 130 fires since Hurricane Katrina. These were not
    catastrophic disasters, but they demonstrated that the Department can
    successfully provide timely assistance and services to individuals and
    communities.

    Performance Expectations 15 and 20: Implement a program to improve
    interoperable communications among federal, state, and local agencies;
    and Provide guidance and technical assistance to first responders in
    developing and implementing interoperable communications capabilities.
    The assessments of "Generally Not Achieved" in these areas do not fully
    credit the Department for the progress that has been made by the
    Department's Office of Emergency Communications (DHS-OEC) and Office
    for Interoperability and Compatibility (DHS-OIC) within the National
    Protection and Programs Directorate (DHS-NPPD), particularly with
    regard to improving federal agencies' interoperable communication
    capabilities.

    The Department oversees several programs aimed at developing programs,
    guidance, and technical assistance related to interoperable
    communications:

    * SAFECOM is a communications program within the DHS-OIC that works to
    improve emergency response through more effective and efficient
    interoperable wireless communications. SAFECOM provides research,
    development, testing and evaluation, guidance, tools, and templates on
    communications-related issues to local, tribal, state, and federal
    emergency response agencies. SAFECOM also participates in the Federal
    Partnership for Interoperable Communications, a partnership of 44
    Federal entities and more than 200 participants focused on wireless
    communications interoperability.
    * The Interoperable Communications Technical Assistance Program (ICTAP)
    is administered by DHS-OEC. The purpose of ICTAP is to enhance
    interoperable communications between federal, state, and local
    emergency responders and public safety officials. ICTAP works with
    states as well as the Urban Area Working Groups (UAWG) to assess the
    current communications infrastructure and determine technical
    requirements needed to design an interoperable communications system.
    * The Integrated Wireless Network (IWN) is also administered by DHS-
    OEC. IWN is a collaborative effort by the Departments of Justice,
    Homeland Security, and the Treasury to provide a consolidated Federal
    wireless communications service. The IWN supports law enforcement,
    first responder, and homeland security requirements with integrated
    communications services in a wireless environment. The IWN will
    implement solutions to provide Federal agency interoperability with
    state, local, and tribal public safety and homeland security entities.

    The GAO Report suggests that the Department's programs have focused on
    improving interoperability with regard to state and local entities to
    the exclusion of improving interoperability with other federal
    agencies. The IWN effort is aimed particularly at improving federal
    interoperability.

    DHS-OEC is also establishing uniform policies, approaches, guidelines,
    and methodologies for integrating these programs and their activities,
    as well as metrics to demonstrate their success in improving
    interoperable communications. Many of the specific assessments in the
    GAO Report do not consider the practical realities associated with
    developing a communications system that will accommodate more than
    50,000 emergency response agencies and where nearly 90 percent of the
    communications infrastructure is owned at the local level.

    For example, DHS-OEC completed the National Interoperability Baseline
    Survey last December. This survey of 22,400 randomly selected emergency
    responders represents the first large-scale, statistically-significant
    study to measure interoperable capabilities across the nation. Among
    the many key findings of the study, approximately two-thirds of
    emergency responders report using some interoperable communications in
    their operations. By providing a clear representation of national
    capacities, the survey allows the Department to make informed decisions
    about strategies regarding the implementation of programs, procedures,
    and capabilities for effective interoperable communications. The
    Department is currently undertaking a National Communications Baseline
    Assessment to evaluate interoperable capabilities for all Federal
    agencies, as well as state and local emergency responders and the
    emergency response community at large.

    Through the ICTAP, DHS has provided assistance in development of
    Tactical Interoperable Communication Plans for 65 Urban/Metropolitan
    Areas and participated in the exercise validation of 75 more. In the
    areas of technical guidance, the Department has developed and provided
    assistance to jurisdictions in using the Communication and Asset Survey
    Mapping Tool and otherwise provided ongoing assistance to 65 sites.

    Due in large measure to the Department's progress in this area, all
    states and territories are required to develop and adopt Statewide
    Communications Interoperability Plans by the end of Fiscal Year 2007.
    SAFECOM developed the Statewide Interoperability Planning Guidebook,
    which outlines criteria for the development of the robust
    interoperability plans. DHS-OEC will be reviewing, providing feedback
    on, and approving the statewide Plans in consultation with the
    Department's National Protection and Programs Directorate and the
    National Telecommunications and Information Administration.

    GAO's criticism regarding the SAFECOM guidance and tools is based
    largely on limited feedback from just four states and selected
    localities. Such a small sample size is hardly statistically
    significant in a population made up of 56 states and territories and
    over 50,000 emergency response agencies. The Department's experience
    suggests that numerous other entities have had success using SAFECOM's
    guidance and tools. By way of just one of such example, SAFECOM
    recently worked with the Commonwealth of Kentucky in the Regional
    Communications Interoperability Pilot (RCIP) project; this was a
    successful collaborative effort. In addition, the SAFECOM
    Interoperability Continuum is widely used as the model framework by the
    emergency response community across the nation.

    Performance Expectation 17: Increase the development and adoption of
    interoperability communications standards. The assessment of "Generally
    Not Achieved" is incorrect because it does not fully recognize the
    significance of the progress made by the Department and appears to be
    based on shifting criteria used to evaluate the Department.

    Although the GAO Report acknowledges that the Department does not have
    authority to unilaterally set standards for interoperability
    communications, DHS has made significant progress in partnering with
    the Department of Commerce, National Institute of Standards and
    Technology (NIST), the private sector and the emergency response
    community to accelerate the "Project 25" (P25) standards. "P25" is an
    initiative that will develop and generate interoperable and compatible
    voice communications equipment, irrespective of the manufacturer. DHS-
    OIC has established a vision and communicated key priorities for these
    interoperability standards. As a result, the private-sector industry
    has dramatically accelerated the development of key standards for four
    of the eight major system interfaces associated with Project 25. These
    four key interfaces should be completed within the next 18-24 months.
    OIC is also working with NIST on a Compliance Assessment Program to
    validate that P25 standardized systems are P25-compliant and that
    equipment from different manufacturers are compatible.

    Recognizing these successes, the GAO Report nevertheless assesses the
    performance expectation as "Generally Not Achieved" because "the
    effectiveness of these efforts is unclear." That assessment is not only
    premature, but also inconsistent with the language of the performance
    expectation at issue which asks whether the Department has increased
    the development and adoption of interoperability communication
    standards. The Department has unquestionably achieved the goals
    described in the original performance expectation.

    Performance Expectation 21: Provide assistance to state and local
    governments to develop all-hazards plans and capabilities. DHS
    disagrees with GAO's assessment of "Generally Not Achieved," because it
    is contrary to strong evidence demonstrating that DHS has in fact
    provided meaningful assistance to state and local governments to
    develop all-hazard plans and capabilities.

    For example, the GAO Report largely relies on outdated GAO and OIG
    reports and does not reflect the Department's recent efforts to include
    language in grant guidance documents to support state and local
    government efforts to develop all-hazard plans and capabilities.
    Notably, the Homeland Security Grant Program (HSGP) guidance documents
    have changed dramatically since most of those outdated reports were
    conducted. For the sake of comparison, the Fiscal Year 2005 HSGP Grant
    Guidance contained 29 percent more references to terror and terrorist
    tactics than to all-hazard and capabilities planning. In contrast,
    references to all-hazard and capabilities-based planning in the Fiscal
    Year 2007 HSGP Grant Guidance exceeded references to terror and
    terrorist tactics by 29 percent - reflecting a dramatic shifting in
    priorities over that two-year period. Nor does the GAO Report reflect
    the moving of the Department's Office of Grants and Training into DHS-
    FEMA as part of the Post-Katrina Emergency Reform Act of 2006
    reorganization. As these changes indicate, recent DHS grant cycles have
    continued to develop and encourage a deliberative and measured all-
    hazards approach to preparedness.

    The GAO Report also cites an alleged perception that the Department has
    been focused on funding terrorism preparedness rather than natural or
    all-hazards funding. This "perception" is again drawn largely from old
    GAO and OIG reports and is out of date. While the National Planning
    Scenarios - referred in the GAO Report - focus in large part on
    terrorist events, the predominance is due to the fact that their unique
    and exacting capability requirements make them critical planning tools
    in our national effort to develop a truly all-hazards preparedness
    model. Moreover. DHS-FEMA has focused in 2007 on multi-hazard planning
    in conjunction with state and local governments and is engaged in
    efforts that develop state and local all-hazards capabilities. For
    example:

    * The Hurricane Gap Analysis Program is a joint effort between state
    emergency management representatives and DHS-FEMA regional
    representatives in 18 hurricane-prone States (plus Puerto Rico, the
    Virgin Islands and Washington, D.C.) to better understand
    vulnerabilities by conducing gap analyses. This program, developed in
    coordination with the State of New York Emergency Management Office and
    New York City Office of Emergency Management, will help DHS-FEMA and
    its partners at the state and local levels to determine the level of
    Federal support potentially needed during a category 3 hurricane.
    Through structured discussions with DHS-FEMA and state emergency
    management representatives, local jurisdictions will be able to better
    understanding potential disaster response asset gaps in critical areas
    such as debris removal, evacuation. sheltering, interim housing,
    healthcare facilities, commodity distribution, communications, and
    fuel, and to ask specific questions of federal and state officials. Our
    efforts have seen a steady decrease in the initial shortfalls and
    vulnerabilities identified in areas such as debris removal contracts,
    transportation contracts, identification of potential shelters and
    evacuation routes, identifying points of distribution, provision of
    specific commodities such as tarps. generators, cots, and so on.
    Although the Department's initial use of this program is being applied
    for the upcoming hurricane season, this process is applicable to all
    hazards.
    * Through the Gulf Coast State Evacuation Plan, DHS-FEMA is helping
    Louisiana, Mississippi and Alabama develop an evacuation plan that
    extends to adjacent states who may host Gulf Coast evacuees. In order
    to synchronize separate state evacuation plans to create a more jointly
    organized effort, the Department is engaging with each state to first
    identify requirements and capabilities, and then develop a plan that
    integrates shelter and transportation planning. The result will be a
    timelier, better organized and coordinated evacuation by those with
    their own transportation and those who need assistance to evacuate by
    bus or air.
    * Several Catastrophic Disaster Planning Initiatives are also underway.
    The Department is working with 13 southeastern Louisiana parishes
    (including the City of New Orleans) vulnerable to hurricane disasters
    to plan and prepare for the 2007 hurricane season. DHS is also using
    two-phased, scenario-driven workshops to enhance the State of Florida's
    capability to respond to a Category 5 Hurricane making landfall in
    Southern Florida. Phase l focuses on developing regional response and
    recovery plans, including evacuation planning, for the counties and
    communities surrounding Lake Okeechobee in the event of failure of the
    Herbert Hoover Dike. Phase 2 will address the effects of a Category 5
    hurricane striking south Florida and result in standardized and
    comprehensive catastrophic Category 5 hurricane disaster functional
    response and recovery plans for the State of Florida and responding
    federal agencies.

    These recent efforts by the Department to shift the focus of its grant
    program and documents and to engage in efforts that assist state and
    local governments in developing their all-hazard capabilities are not
    reflected in the GAO Report.

    Performance Expectation 24: Develop a system for collecting and
    disseminating lessons learned and best practices to emergency
    responders. The assessment of "Generally Not Achieved" does not reflect
    the substantial progress the Department has made in developing the
    Lessons Learned Information Sharing website (LLIS.gov). The GAO Report
    does not appear to consider the practical difficulties associated with
    developing an online system, and unfairly downgrades the Department
    despite its on-going efforts to constantly improve that system based on
    user feedback.

    LLIS.gov has been available to the first responder community since
    2004, and system enhancements have been - and will continue to be -
    continuously made. LLIS.gov launched significant system upgrades in
    December 2006 based on user feedback, which resulted in dramatic
    improvements in the ability of first responders to access and share
    valuable information on all aspects of emergency response and homeland
    security. Upgrades included enhancements to the search engine that
    combined full-text searching with sorting and filtering tools;
    redesigning the homepage to deliver more information directly to
    members in fewer clicks; adding a "Recent Incidents" box highlights the
    latest homeland security news with links directly to related content;
    providing an interactive, clickable map enabling users to view both
    LLIS.gov members and documents by state; and adding topic-specific
    pages to serve as "one-stop shops" for information on emergency
    response and homeland security topics including mass evacuation to
    pandemic influenza, community preparedness, and emergency planning for
    persons with disabilities and other special needs.

    Other recent improvements allow the latest LLIS.gov content to be
    delivered directly to member inboxes through the LLIS Dispatch feature.
    Additional improvements are under development and will address most, if
    not all, of the issues previously raised by GAO. Migration to a new
    hosting platform will allow the implementation of an improved search
    engine. The new search engine will include search-term highlighting in
    the text of both abstracts and documents; weighted relevancy algorithm
    to ensure key documents appear first in search results; and upgraded
    indexing to ensure that all published documents are indexed immediately
    and available to users in their search results. This new search engine
    is expected to be available within a few months.

    Increased usage of LLIS.gov is a testament to the Department's success
    in developing a system for collecting and disseminating lessons learned
    and best practices that is actually useful to emergency responders.
    April 2007 was the third highest month both in terms of the number of
    visits and visitors to LLIS.gov. LLIS.gov has also seen a 55 percent
    increase in visits and a 50 percent increase in visitors for the first
    four months of 2007, resulting in an average of 27,133 visits and 9,973
    visitors per month. These numbers contradict GAO's assessment that the
    Department has not achieved this performance expectation.

    Critical Infrastructure and Key Assets Protection:

    The Department has made significant progress in the area of protecting
    critical infrastructure and key resources (CI/KR), as recognized by
    GAO's assessments of "Generally Achieved" in the areas of developing a
    comprehensive national plan and partnerships for protecting CI/KR and
    identifying, assessing and supporting efforts to reduce threats and
    vulnerabilities for critical infrastructure. The Department feels that
    several other assessments, does not adequately reflect the Department's
    progress related to CI/KR.

    Performance Expectation 3: Improve and enhance public/private
    information sharing involving attacks, threats, and vulnerabilities.
    The Department disagrees with the assessment of "Generally Not
    Achieved" for this performance expectation, as the assessment does not
    reflect the progress the Department has made.

    The Department has made significant progress in its CI/KR protection
    capabilities, particularly in the area of information sharing. For
    example, the Office of Infrastructure Protection (DHS-OIP), within
    NPPD, completed Sector Specific Plans (SSPs) within the National
    Infrastructure Protection Plan (NIPP). In completing the SSPs, DHS
    worked with the private sector to implement tailored protective
    measures, including site-assistance visits and transforming feedback
    into educational reports that owners and operators can use to identify
    vulnerabilities. DHS-OIP also created the Chemical Terrorism
    Vulnerability Information Sharing Task Force, comprised of state and
    local officials. The Department also worked with the private sector to
    develop more than 800 Buffer Zone Protection Plans (BZPP) to enhance
    security around critical infrastructure sites. To further disseminate
    information to the private sector, more than 150 training courses on
    increasing terrorism awareness were provided to private security guards
    last year and increasing use was made of the Homeland Security
    Information Network (HSIN). Additionally, the TRIPwire program
    mentioned in the GAO Report provides situational awareness on
    improvised explosive devices to a broad swath of security stakeholders,
    including representatives of 40 Federal departments and agencies; 28
    military units; 365 state and local agencies; and 35 private sector
    companies and organizations. Since its release, TRIPwire has recorded
    more than 4 million site hits. On June 29, 2007, in response to the
    bombing events in London, TRIPwire recorded approximately 200 percent
    more hits than its average for that month. This included 6,219 page
    views and 40,130 hits.

    Other achievements in the area of information-sharing related to CI/KR
    vulnerabilities include the NIPP Sector Partnership Model, which is
    currently in full operation. This model has been and will continue to
    he an essential mechanism for the exchange of strategic information at
    an unprecedented level between the Government and the owners and
    operators of CI/KR. The National Infrastructure Coordinating Center
    (NICC) also routinely shares a wide range of information products
    containing warning, threat, and CI/KR protection information via the
    HSIN. During the last year, the NICC has posted more than 900
    information products to HSIN for use by CI/KR owners and operators. The
    Department is also currently deploying professional intelligence and
    operations officers to state fusion centers and installing the Homeland
    Security Data Network for communicating classified information.

    The National Coordinating Center (NCC) for Telecommunications is
    another Departmental model for successful information sharing. The NCC
    provides a forum through which the Federal government and the private
    sector communications companies can interact on a daily basis. Numerous
    Federal departments and agencies provide full time detailees to the NCC
    and several industry members provide cleared personnel who maintain
    full time offices at the NCC. These cleared personnel have access to
    classified read binders and can interact with the NCC Watch on a 24-
    hour basis. Additionally, the NCC conducts weekly conference calls
    where members interact with those Federal departments and agencies with
    the most significant communications responsibilities and requirements.

    Moreover, explicitly excluded is an assessment of the private sector
    utilization of the HSIN. Consequently, the GAO Report does not
    accurately reflect the current deployment approach for the HSIN in the
    CI/KR sectors. Nine of the CI/KR sectors or major sub-sectors have
    signed memoranda of understanding with DHS to deploy Homeland Security
    Information Network-Critical Sectors (HSIN-CS) to their sectors.

    Also, DHS strategic, operational, and policy initiatives have taken
    into account the critical role the private sector plays in protecting
    the Homeland. DHS has taken steps to designate a DHS Coordinator for
    Private Sector Security within DHS, who develops internal cross-cutting
    processes for synchronizing DHS efforts to support Private Sector
    security interests, and develop a way forward to expand and sustain the
    DHS/Private Sector partnership.

    It appears the GAO Report largely relies on previous reports that do
    not account for the achievements discussed above and other recent
    successes. For example, in making its "Generally Not Achieved"
    assessment, the GAO Report cites assessments in an OIG report entitled,
    Homeland Security Information Network Could Support Information Sharing
    More Effectively (OIG-06-38). However, in a letter dated July 11, 2007
    from the OIG regarding the compliance follow-up to OIG-06-38, the
    Assistant Inspector General, Information Technology stated that five
    recommendations from the OIG report "are considered resolved." The OIG
    has also indicated that it is satisfied with DHS's efforts to mitigate
    problems outlined in the OIG-06-38 report.

    Performance Expectation 4: Develop and enhance national analysis and
    warning capabilities for critical infrastructure. The GAO Report -
    which focuses its assessment primarily on cyber critical
    infrastructure - does not give the Department credit for the
    significant advances it has made in achieving this performance
    expectation. In the area of cyber infrastructure, the GAO Report
    inaccurately suggests that the Department has provided no evidence of
    enhanced national warning capabilities. This assessment does not
    consider the tremendous progress by the Department's National Cyber
    Security Division (DHS-NCSD), within the Office of Cyber Security and
    Communications (DHS-CS&C), to develop and enhance cyber analysis, watch
    and warning, and collaboration with the private sector.

    The U.S. Computer Emergency Readiness Team (US-CERT) within DHS-NCSD
    provides a 24-hour, 7 day-a-week watch center to conduct daily analysis
    and situational monitoring in order to provide information on cyber
    incidents and other events. For example, US-CERT's Einstein program
    enables the rapid detection of current and pending cyber attacks
    affecting agencies and provides federal agencies with early incident
    detection. The information gathered by the Einstein program is analyzed
    and then used to provide actionable and timely alerts and reporting
    regarding current and impending cyber attacks. The program also provides
    indications and warnings of actual and potential intrusions to Federal
    government computer security teams. To date, Einstein has assisted in
    the identification of more than 300 potential malicious incidents that
    would have otherwise gone undetected.

    US-CERT's near real-time data collection and information sharing
    increases awareness among public and private sector stakeholders and
    reduces cyber infrastructure vulnerabilities. US-CERT notifies public
    and private partners through a variety of products that encompass the
    National Cyber Alert System (NCAS). USCERT established a vulnerability
    remediation process and the NCAS in order to collect, mitigate, and
    disseminate vulnerability information. NCAS is the first cohesive
    national cyber security system for identifying, analyzing, and
    prioritizing emerging vulnerabilities and threats. NCAS delivers
    targeted, timely, and actionable information for technical and non-
    technical audiences to enhance security. NCAS reports are made
    available through the NCAS. Information Sharing and Analysis Centers
    (ISACs), and on the US-CERT public website. For Fiscal Year 2005,
    USCERT issued 338 alerts, bulletins, and vulnerability notes to
    stakeholders through the public website and for Fiscal Year 2006 US-
    CERT issued 490 alerts, bulletins, and vulnerability notes. Information
    from US-CERT is also provided to the National Vulnerability Database
    (NVD), also sponsored by DHS-NCSD. Approximately 400 vulnerabilities
    are published to the NVD web site each month based upon newly
    discovered issues.

    US-CERT also produces Critical Infrastructure Information Notices (DIN)
    which are intended to provide information about a cyber security
    incident and make recommendations for avoiding or mitigating risks. The
    CHN is specifically written to notify private sector organizations and
    Federal agencies about efforts to protect critical infrastructure. For
    Fiscal Year 2006, US-CERT produced 15 CINNs, which are provided to key
    stakeholders on a secure internet portal.

    US-CERT is actively working to formalize processes and procedures for
    collaboration with the private sector. These processes undercut the
    concern expressed in the GAO Report that a lack of collaboration
    challenges the Department's ability to gather and share information. To
    the contrary, US-CERT has developed a draft concept of operations for
    Private Industry Cyber Security Incident Handling which addresses
    information sharing, communication, and coordination with the private
    sector, including the ISACs.

    The National Communications System (NCS) has also been deeply engaged
    in analysis and warning functions. The NCS has developed multiple
    programs to ensure that the Federal government can still communicate
    during times of crisis. Additionally, the NCS also has a significant
    analytical capability dedicated to conducting analyses and assessments
    of the public communications network. This capability, only possible
    through robust and deep information sharing with the private sector,
    has proven invaluable in initiatives such as the Department's Pandemic
    Influenza Planning and cross sector dependency analyses.

    Furthermore, DHS is conducting outreach to the private sector at the
    state and Local levels through fusion centers designed to push and pull
    information that directly relates to threats within a geographic region
    containing critical infrastructure. The DHS State and Local Fusion
    Center Program has also provided technical assistance to state and
    local jurisdictions responsible for critical infrastructure to ensure
    that partnerships between local authorities and the private sector are
    in place in every state. Despite the fact that the response to these
    efforts has been overwhelmingly positive, the GAO Report largely
    dismisses these achievements.

    Science and Technology:

    The Department strongly disagrees with the assessments in the Science
    and Technology (S&T) mission area. Many of the concerns with GAO's
    methodology are particularly applicable here, where the relevant
    performance expectations are - by their very nature and necessity -
    continuous processes, rather than programs with specific endpoints or
    deadlines. Further, we were disappointed when our performance was
    downgraded in four areas from "No Assessment Made" to "Generally Not
    Achieved" - even after the Department provided extensive documentation
    demonstrating DHS-S&T's significant progress.

    DHS-S&T projects are executed in support of the Department, its
    operational components, and the Nation's first responders. The four-
    year lifetime of the Department is a relatively short period of time in
    terms of the maturation process for science and technology programs.
    The Department believes that many of the assessments in this mission
    area are, at a minimum, premature.

    Performance Expectation 1: Develop a plan for departmental research,
    development, testing, and evaluation activities. The assessment of
    "Generally Not Achieved" understates the significance of the
    Department's Science and Technology Strategic Plan delivered to
    Congress on June 26, 2007. As the GAO Report recognizes, this Strategic
    Plan incorporates a five-year Research and Development Plan that
    includes information on milestones for fiscal years 2007 through 2011.

    The GAO Report asserts that the Strategic Plan does not contain
    sufficient goals and measures. However, the Strategic Plan describes
    yearly milestones and deliverables/goals for every project within S&T,
    including Test and Evaluation. The Strategic Plan reflects the highest
    level objectives for internal departmental activities, and provides
    overarching guidance for addressing the science and technology needs
    within each homeland security mission area. Detailed performance goals
    for all programs are included in the five year Research and Development
    Plan, progress is reviewed annually in developing the annual budget
    request. GAO's suggestion that each individual project sponsored by DHS-
    S&T does not include specific goals, measures and milestones is
    incorrect. These metrics are extremely important to DHSS&T in its
    evaluations of these projects.

    Furthermore, the GAO Report does not give the Department credit for the
    Strategic Plan's description of the S&T Directorate's organizational
    framework and risk-based research portfolio management strategy. Nor
    does GAO acknowledge that the Strategic Plan also addresses the
    importance of developing a strong homeland security science and
    technology national workforce by developing professional S&T employees.
    The Plan also maintains research and educational opportunities that
    will foster the long-term homeland security intellectual base. By not
    placing proper emphasis on the significance of the Strategic Plan, GAO
    understates the Department's progress in this area.

    Performance Expectations 2 and 3: Assess emerging chemical, biological,
    radiological, and nuclear threats and homeland security
    vulnerabilities; and Coordinate research, development, and testing
    efforts to identify and develop countermeasures to address chemical,
    biological, radiological, nuclear, and other emerging terrorist
    threats. The Department disagrees with the assessments of "Generally
    Not Achieved." These assessments again highlight the flaws in the
    Report's methodology, as the Department's efforts to assess emerging
    vulnerabilities and develop countermeasures will always be ongoing and
    are not designed to reach a final end-goal completion.

    The GAO Report does not adequately recognize and assign credit for the
    tremendous strides that DHS-S&T has made in assessing threats and
    vulnerabilities, as well as identifying and developing countermeasures.
    In 2006, the Department conducted the Bio-Terrorism Risk Assessment
    (BTRA). This risk assessment evaluated hundreds of thousands of
    scenarios relating to 28 high-priority agents, eight classes of release
    (e.g., indoor, outdoor, food, water, and human vector), and varying
    terrorist capabilities. The BTRA has been very useful in prioritizing
    research and developing countermeasures against these agents. In
    addition, the BTRA helps DHS-S&T to understand and resolve associated
    uncertainties, and to prioritize emerging biological threats and
    homeland security vulnerabilities.

    Based on the results of the BTRA, DHS has issued nine Material Threat
    Determinations (MTDs). For each material threat, DHS has conducted a
    Material Threat Assessment (now referred to as Population Threat
    Assessments) that provides an in-depth look at the exposed populations
    and related impacts from plausible biological terrorism scenarios.
    These MTDs and their associated assessments have been used by the
    Department of Health and Human Services (HHS) in formulating the Public
    Health Emergency Medical Countermeasure Enterprise strategy, and to
    ensure that there are adequate supplies of medical countermeasures in
    the national stockpile.

    Based on the success and impact of the BTRA, DHS-S&T is developing an
    integrated Chemical, Biological, Radiological and Nuclear (CBRN) Risk
    Assessment. This risk assessment will analyze and evaluate
    vulnerabilities and the impacts of CBRN threats, and can be used to
    determine priorities and resource allocations regarding the development
    of countermeasures.

    For the GAO Report to assign a low rating to the Department's progress
    in assessing emerging vulnerabilities to chemical, biological,
    radiological, and nuclear threats because "substantial more work
    remains for DHS" does not take into account the practical reality that
    the Department will never be done assessing such vulnerabilities. The
    Department must continually work to identify and assess new and
    emerging vulnerabilities to constantly evolving threats. These
    completed and ongoing efforts discussed above, and acknowledged by GAO,
    reflect real and meaningful progress by the Department that is not
    reflected in GAO's assessment.

    The Department has also undertaken to coordinate and develop
    countermeasures with other Government agencies and stakeholders. For
    example, DHS-S&T's Biological Surveillance and Detection Research and
    Development Program works to develop next-generation detectors for
    biological threat agents. The program also develops the assays
    (signatures or fingerprints of biological agents) that detectors need
    to recognize a biological agent, and as well as detection systems to
    protect agriculture and food products and industries. The Chemical
    Detection Program develops technology for warning and notification of a
    chemical threat release, including technologies responders need to
    survey potentially contaminated scenes, while limiting their exposure
    to chemical agents. In response to the recent liquid explosives plot
    discovered in the United Kingdom, DHS-S&T established a Rapid Response
    Team composed of Department of Energy laboratories, the DHS Centers of
    Excellence, and the Transportation Security Laboratory. Based on this
    work, DHSTSA was able to issue a rule allowing approximately three
    ounces of liquids in carry-on luggage within two months. DHS-S&T and
    TSA continue to work toward the ability to detect home-made explosives,
    including liquids, gels, pastes, and other explosive compounds derived
    from commonly available materials.

    In addition, DHS is an ex officio member of the HHS Executive
    Governance Board for the development of medical countermeasures. The
    DHS-S&T risk assessments referenced above play a major role in defining
    national strategies and implementation plans and in prioritizing
    countermeasures. Further, DHS is a co-chair of the National Science and
    Technology Council's (NSTC) Subcommittee on Decontamination Standards
    and Technologies, which has developed draft guidelines for restoration
    following a biological and chemical attack and a supporting five-year
    R&D plan. Moreover, DHS is a co-chair of the Foreign Animal Disease
    Threat subcommittee of the NSTC, which also published a five-year
    integrated R&D strategy. Through these inter-agency committees, DHS-S&T
    has made real progress in coordinating the identification and
    development of meaningful countermeasures to address emerging homeland
    security vulnerabilities.

    Human Capital Management:

    The GAO Report does not present a full picture of the significant
    progress the Department has made in the area of Human Capital
    Management. Indeed, the GAO Report consistently acknowledges that DHS
    "is on track," "is in the process of," and "has made progress in"
    achieving the performance expectations many of which involve multi-year
    efforts. Yet, the assessments do not reflect this progress.

    Performance Expectation 8: Implement training and development programs
    in support of DHS's mission and goals. The Department strongly
    disagrees with the assessment of "Generally Not Achieved." The GAO
    Report does not accurately reflect the information previously provided
    to GAO officials.

    The GAO Report suggests that most of the DHS training programs
    referenced within the Human Capital Operational Plan has not been
    achieved. These assertions are not accurate. The Human Capital
    Operational Plan is a two year endeavor, and DHS has been meeting its
    targets within the plan. The assessment of "Generally Not
    Achieved" highlights the problems in using a binary standard to assess
    what the GAO Report acknowledges is "a multi-year program."

    Indeed, the Department has successfully launched an information system
    for the training programs. DHScovery, a learning management system, is
    an initiative offering a comprehensive catalog of 2,000 online courses
    and electronic books, in areas such as leadership and information
    technology. DHScovery serves multiple purposes. For instance, it is a
    means to consolidate training systems across the Department. Therefore,
    DHScovery eliminates redundancies, achieves economies of scale, and
    establishes a common delivery environment. DHScovery also aligns the
    DHS Learning and Development Strategy, the Human Capital Operations
    Plan, and the President's Management Agenda.

    With regard to the development of terminology, the DHS Training Leaders
    Council - a group of training representatives from DHS components -
    created a Training Glossary that is used throughout the Department.
    This Training Glossary provides a common language and terminology for
    all human capital offices throughout the entire Department, and
    enhances the clarity and precision of communications among such
    components. The Training Glossary was previously provided to GAO
    officials, but apparently was not considered in the GAO Report.

    In addition, the Department previously provided information to GAO
    officials regarding other significant DHS training and development
    programs. For example, the Department's Chief Human Capital Office (DHS-
    CHCO) submitted information about the Department's establishment of the
    National Capital Region Homeland Security Academy. This new Academy
    offers a fully accredited graduate degree in Homeland Security Studies.
    When combined with the existing Master's Degree program currently
    offered by the Center for Homeland Defense and Security at the Naval
    Post Graduate School, the two programs will matriculate 200 students
    annually.

    In order to provide additional development programs which support the
    Department's mission and goals, DHS is also conducting academic and
    outreach partnerships with the National Defense University,
    institutions, colleges and universities that serve historically
    underrepresented groups, and educational consortiums, such as the
    National Security Education Consortium and the Homeland Security and
    Defense Education Consortium. These programs provide additional
    training to DHS employees as well as state and local officials.

    Information Technology Management:

    Performance Expectation 5: Develop a comprehensive enterprise
    architecture. The assessment of "Generally Not Achieved" is not
    supported by the facts. In particular, the GAO Report appears to have
    wrongly based its assessment on a belief that DHS had not fully
    implemented elements of the GAO Enterprise Architecture Management
    Maturity Framework (EAMMF).

    The Department has made great strides in developing an Enterprise
    Architecture (EA) that substantially meets each of the EAMMF elements.
    Indeed, an August 2006 GAO report (GAO-06-831) found that DHS fully
    satisfied 24 out of 31 applicable EAMMF elements, and partially
    satisfied four additional elements. Since that time, DHS has
    taken additional steps to identify and/or address the final three
    elements. Products related to the EA are now required to undergo
    independent verification and validation (IV&V) which will ensure
    interoperability, compatibility, and efficiency within the larger
    structure. DHS has also worked to centralize information technology
    (IT) processes and avoid unnecessary duplication, by requiring
    adherence to the EA for all IT investments over $2.5 million.

    In developing its EA, the Department sought significant input from and
    consulted with, key stakeholders. In fact, stakeholders provided more
    than 400 comments on the EA, and DHS considered each one. GAO appears
    to have disregarded this extensive consultation in preparing this GAO
    Report, as well as the GAO report from last May (07-564), entitled DHS
    Enterprise Architecture Continues to Evolve. In 07-564, GAO
    inaccurately stated that the Department failed to consult with
    stakeholders. This is not the case.

    In evaluating the comprehensiveness of the EA developed by the
    Department, it should be noted that the Office of Management and Budget
    (OMB) has rated the Homeland Security Enterprise Architecture (HLS EA)
    2007 as a 4.3 on a 5.0 scale for completeness. This score does not
    support the GAO Report's assessment.

    Performance Expectation 6: Implement a comprehensive enterprise
    architecture. The assessment of "Generally Not Achieved" is not
    supported by the facts, because the Department has already implemented
    a comprehensive EA. OMB has rated the HLS EA 2007 4.5 on a 5.0 scale
    for use of its enterprise architecture which includes the elements of
    governance, change management, deployment, collaboration, and Capital
    Planning and Investment Control (CPIC) integration.

    In support of its assessment to the contrary, the GAO Report relies
    most heavily on the allegation that the Department's IT investments
    have not been fully aligned with the EA. To the contrary, the DHS
    Office of the Chief Information Officer (DHS-CIO) is currently aligning
    all new investments to the EA. In particular, all IT investments in
    Fiscal Year 2008 have already been aligned with the Department's
    strategic plans, and this alignment process will continue in future
    fiscal years.

    The GAO Report also states that DHS does not have a repeatable
    methodology for assessing potential IT investments relative to the EA.
    To the contrary, DHS has developed a methodology for such assessments
    based upon detailed compliance criteria, and indeed, it has assessed
    all major IT investments in relation to its EA. During May 2006 and
    again in February 2007, DHS supplied GAO officials with written
    documentation of its methods to assess IT investments and the review
    criteria It does not appear, however, that the GAO Report considered
    these documents.

    Performance Expectations 7 and 8: Develop a process to effectively
    manage information technology investments; and Implement a process to
    effectively manage information technology investments. The assessment
    of "Generally Not Achieved" does not accurately reflect the
    Department's progress with respect to these performance expectations.

    The Department has developed and implemented processes to effectively
    management IT investments. For example, the Department issued a
    Management Directive earlier this year which provided the DHS Chief
    Information Officer with the authority to review and approve the
    Department's entire information technology budget.

    The Department also requires programs to submit Periodic Reporting (PR)
    information for all major investments on a quarterly basis. In
    addition, the Department published and distributed PR Guidance in the
    first quarter of Fiscal Year 2006 and provided associated training
    courses to personnel within the DHS Program Management Office (PMO).
    The Department also distributed Earned Value Management (EVM) and
    Operational Analysis (OA) guidance documents throughout the Department.
    These processes have led to more effective management of IT investments
    by significantly improving tracking and reporting of investment costs,
    schedules, and performance variances. The analysis from these processes
    has been provided to GAO.

    The Department is also currently deploying a business tool that will
    enable DHS management to view trends of quarterly PR information. In
    this way, senior DHS officials will be able to assess the performance
    of the systems and enhance supervisory oversight of IT investments.

    In addition, the Department has already implemented an IT acquisition
    review (ITAR) process to improve the alignment of IT purchases to the
    homeland security mission and Department architecture. The ITAR process
    requires that the DHS-CIO review and approve IT acquisitions of $2.5
    million and greater, while component CIOs are only authorized to
    approve IT acquisitions of less than this value. The ITAR process has
    thus improved IT management by providing the DHS-OCIO with supervisory
    control over IT investments and identifying duplicative investments.
    Over the first six months of its implementation, the ITAR process has
    been successful in reviewing approximately $1.8 billion in IT
    investments.

    These management processes have also been extended into the IT
    Portfolio Management process, whereby the Department has developed and
    applied tools, methodologies, and techniques lo assist in IT investment
    decisions based upon quantifiable measurements. The Portfolio
    Management program incorporates specific management processes to
    establish performance goals, transition plans, architectural targets,
    and performance measures. In this way. the Department can continue to
    improve the balance of investments to more effectively meet
    Departmental goals and objectives. The IT Portfolio Management Process
    has already been used to assist the DHS-CIO in selecting and
    prioritizing IT investments in relation to the Enterprise Architecture.

    [End of section]

    Appendix III: GAO Contact and Staff Acknowledgments:

    GAO Contact:

    Norman J. Rabkin (202) 512-8777 or rabkinn@gao.gov:

    Staff Acknowledgments:

    In addition to the person named above, Christopher Keisling, Assistant
    Director; Jason Barnosky; Cathleen A. Berrick; Sharon Caudle; Virginia
    Chanley; Michele Fejfar; Rebecca Gambler; Kathryn Godfrey; Stephanie
    Hockman; Tracey King; Thomas Lombardi; Jan Montgomery; Octavia Parks;
    and Sue Ramanathan made key contributions to this report. Other
    contributors to this report included Eugene Aloise; John Bagnulo; Mark
    Bird; Nancy Briggs; Kristy Brown; Stephen Caldwell; Frances Cook;
    Stephen Donahue; Jeanette Espinola; Jess Ford; Amanda Gill; Mark
    Goldstein; Ellen Grady; Samuel Hinojosa; Randolph Hite; Daniel Hoy;
    John Hutton; William O. Jenkins, Jr; Casey Keplinger; Kirk Kiester;
    Eileen Larence; Leena Mathew; Kieran McCarthy; Tiffany Mostert; Shannin
    O'Neill; Bonita Oden; David Powner; Jerry Seigler; Katherine Siggerud;
    Richard Stana; Bernice Steinhardt; John Stephenson; Sarah Veale; John
    Vocino; Gregory Wilshusen; Eugene Wisnoksi; and William T. Woods.

    [End of section]

    Related GAO Products:

    Border Security:

    Homeland Security: Prospects For Biometric US-VISIT Exit Capability
    Remain Unclear. GAO-07-1044T. Washington, D.C.: June 28, 2007.

    Border Patrol: Costs and Challenges Related to Training New Agents.
    GAO-07-997T. Washington, D.C.: June 19, 2007.

    Homeland Security: Information on Training New Border Patrol Agents.
    GAO-07-540R. Washington, D.C.: March 30, 2007.

    Homeland Security: US-VISIT Program Faces Operational, Technological,
    and Management Challenges. GAO-07-632T. Washington, D.C.: March 20,
    2007.

    Secure Border Initiative: SBInet Planning and Management Improvements
    Needed to Control Risks. GAO-07-504T. Washington, D.C.: February 27,
    2007.

    Homeland Security: US-VISIT Has Not Fully Met Expectations and
    Longstanding Program Management Challenges Need to Be Addressed. GAO-
    07-499T. Washington, D.C.: February 16, 2007.

    Secure Border Initiative: SBInet Expenditure Plan Needs to Better
    Support Oversight and Accountability. GAO-07-309. Washington, D.C.:
    February 15, 2007.

    Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant
    Status Program Need to Be Adequately Defined and Justified. GAO-07-278.
    Washington, D.C.: February 14, 2007.

    Border Security: US-VISIT Program Faces Strategic, Operational, and
    Technological Challenges at Land Ports of Entry. GAO-07-378T.
    Washington, D.C.: January 31, 2007.

    Border Security: US-VISIT Program Faces Strategic, Operational, and
    Technological Challenges at Land Ports of Entry. GAO-07-248.
    Washington, D.C.: December 6, 2006.

    Department of Homeland Security and Department of State: Documents
    Required for Travelers Departing From or Arriving in the United States
    at Air Ports-of-Entry From Within the Western Hemisphere. GAO-07-250R.
    Washington, DC: December 6, 2006.

    Border Security: Stronger Actions Needed to Assess and Mitigate Risks
    of the Visa Waiver Program. GAO-06-1090T. Washington, D.C.: September
    7, 2006.

    Illegal Immigration: Border-Crossing Deaths Have Doubled Since 1995;
    Border Patrol's Efforts to Prevent Deaths Have Not Been Fully
    Evaluated. GAO-06-770. Washington, D.C.: August 15, 2006.

    Border Security: Continued Weaknesses in Screening Entrants into the
    United States. GAO-06-976T. Washington, D.C.: August 2, 2006.

    Border Security: Stronger Actions Needed to Assess and Mitigate Risks
    of the Visa Waiver Program. GAO-06-854. Washington, D.C.: July 28,
    2006.

    Process for Admitting Additional Countries into the Visa Waiver
    Program. GAO-06-835R. Washington, D.C.: July 28, 2006.

    Intellectual Property: Initial Observations on the STOP Initiative and
    U.S. Border Efforts to Reduce Piracy. GAO-06-1004T. Washington, D.C.:
    July 26, 2006.

    Border Security: Investigators Transported Radioactive Sources Across
    Our Nation's Borders at Two Locations. GAO-06-940T. Washington, D.C.:
    July 7, 2006.

    Border Security: Investigators Transported Radioactive Sources Across
    Our Nation's Borders at Two Locations. GAO-06-939T. Washington, D.C.:
    July 5, 2006.

    Information on Immigration Enforcement and Supervisory Promotions in
    the Department of Homeland Security's Immigration and Customs
    Enforcement and Customs and Border Protection. GAO-06-751R. Washington,
    D.C.: June 13, 2006.

    Homeland Security: Contract Management and Oversight for Visitor and
    Immigrant Status Program Need to Be Strengthened. GAO-06-404.
    Washington, D.C.: June 9, 2006.

    Observations on Efforts to Implement the Western Hemisphere Travel
    Initiative on the U.S. Border with Canada. GAO-06-741R. Washington,
    D.C.: May 25, 2006.

    Homeland Security: Management and Coordination Problems Increase the
    Vulnerability of U.S. Agriculture to Foreign Pests and Disease. GAO-06-
    644. Washington, D.C.: May 19, 2006.

    Border Security: Reassessment of Consular Resource Requirements Could
    Help Address Visa Delays. GAO-06-542T. Washington, D.C.: April 4, 2006.

    Border Security: Investigators Transported Radioactive Sources Across
    Our Nation's Borders at Two Locations. GAO-06-583T. Washington, D.C.:
    March 28, 2006.

    Border Security: Investigators Successfully Transported Radioactive
    Sources Across Our Nation's Borders at Selected Locations. GAO-06-545R.
    Washington, D.C.: March 28, 2006.

    Homeland Security: Better Management Practices Could Enhance DHS's
    Ability to Allocate Investigative Resources. GAO-06-462T. Washington,
    D.C.: March 28, 2006.

    Combating Nuclear Smuggling: DHS Has Made Progress Deploying Radiation
    Detection Equipment at U.S. Ports-of-Entry, but Concerns Remain. GAO-
    06-389. Washington, D.C.: March 22, 2006.

    Combating Nuclear Smuggling: Corruption, Maintenance, and Coordination
    Problems Challenge U.S. Efforts to Provide Radiation Detection
    Equipment to Other Countries. GAO-06-311. Washington, D.C.: March 14,
    2006.

    Border Security: Key Unresolved Issues Justify Reevaluation of Border
    Surveillance Technology Program. GAO-06-295. Washington, D.C.:
    February 22, 2006.

    Homeland Security: Recommendations to Improve Management of Key Border
    Security Program Need to Be Implemented. GAO-06-296. Washington, D.C.:
    February 14, 2006.

    Homeland Security: Visitor and Immigrant Status Program Operating, but
    Management Improvements Are Still Needed. GAO-06-318T. Washington,
    D.C.: January 25, 2006.

    Border Security: Strengthened Visa Process Would Benefit from
    Improvements in Staffing and Information Sharing. GAO-05-859.
    Washington, D.C.: September 13, 2005.

    Border Security: Opportunities to Increase Coordination of Air and
    Marine Assets. GAO-05-543. Washington, D.C.: August 12, 2005.

    Border Security: Actions Needed to Strengthen Management of Department
    of Homeland Security's Visa Security Program. GAO-05-801. Washington,
    D.C.: July 29, 2005.

    Border Patrol: Available Data on Interior Checkpoints Suggest
    Differences in Sector Performance. GAO-05-435. Washington, D.C.: July
    22, 2005.

    Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection
    Equipment in the United States and in Other Countries. GAO-05-840T.
    Washington, D.C.: June 21, 2005.

    Homeland Security: Performance of Foreign Student and Exchange Visitor
    Information System Continues to Improve, But Issues Remain. GAO-05-
    440T. Washington, D.C.: March 17, 2005.

    Homeland Security: Some Progress Made, but Many Challenges Remain on
    U.S. Visitor and Immigrant Status Indicator Technology Program. GAO-05-
    202. Washington, D.C.: February 23, 2005.

    Border Security: Streamlined Visas Mantis Program Has Lowered Burden on
    Foreign Science Students and Scholars, but Further Refinements Needed.
    GAO-05-198. Washington, D.C.: February 18, 2005.

    Border Security: Joint, Coordinated Actions by State and DHS Needed to
    Guide Biometric Visas and Related Programs. GAO-04-1080T. Washington,
    D.C.: September 9, 2004.

    Border Security: State Department Rollout of Biometric Visas on
    Schedule, but Guidance Is Lagging. GAO-04-1001. Washington, D.C.:
    September 9, 2004.

    Border Security: Consular Identification Cards Accepted within United
    States, but Consistent Federal Guidance Needed. GAO-04-881. Washington,
    D.C.: August 24, 2004.

    Border Security: Additional Actions Needed to Eliminate Weaknesses in
    the Visa Revocation Process. GAO-04-795. Washington, D.C.: July 13,
    2004.

    Border Security: Additional Actions Needed to Eliminate Weaknesses in
    the Visa Revocation Process. GAO-04-899T. Washington, D.C.: July 13,
    2004.

    Border Security: Agencies Need to Better Coordinate Their Strategies
    and Operations on Federal Lands. GAO-04-590. Washington, D.C.: June 16,
    2004.

    Overstay Tracking: A Key Component of Homeland Security and a Layered
    Defense. GAO-04-82. Washington, D.C.: May 21, 2004.

    Homeland Security: First Phase of Visitor and Immigration Status
    Program Operating, but Improvements Needed. GAO-04-586. Washington,
    D.C.: May 11, 2004.

    Homeland Security: Risks Facing Key Border and Transportation Security
    Program Need to Be Addressed. GAO-04-569T. Washington, D.C.: March 18,
    2004.

    Border Security: Improvements Needed to Reduce Time Taken to Adjudicate
    Visas for Science Students and Scholars. GAO-04-443T. Washington, D.C.:
    February 25, 2004.

    Border Security: Improvements Needed to Reduce Time Taken to Adjudicate
    Visas for Science Students and Scholars. GAO-04-371. Washington, D.C.:
    February 25, 2004.

    Homeland Security: Overstay Tracking Is a Key Component of a Layered
    Defense. GAO-04-170T. Washington, D.C.: October 16, 2003.

    Security: Counterfeit Identification Raises Homeland Security
    Concerns. GAO-04-133T. Washington, D.C.: October 1, 2003.

    Homeland Security: Risks Facing Key Border and Transportation Security
    Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September
    19, 2003.

    Security: Counterfeit Identification and Identification Fraud Raise
    Security Concerns. GAO-03-1147T. Washington, D.C.: September 9, 2003.

    Land Border Ports of Entry: Vulnerabilities and Inefficiencies in the
    Inspections Process. GAO-03-1084R. Washington, D.C.: August 18, 2003.

    Federal Law Enforcement Training Center: Capacity Planning and
    Management Oversight Need Improvement. GAO-03-736. Washington, D.C.:
    July 24, 2003.

    Border Security: New Policies and Increased Interagency Coordination
    Needed to Improve Visa Process. GAO-03-1013T. Washington, D.C.: July
    15, 2003.

    Border Security: New Policies and Procedures Are Needed to Fill Gaps in
    the Visa Revocation Process. GAO-03-908T. Washington, D.C.: June 18,
    2003.

    Border Security: New Policies and Procedures Are Needed to Fill Gaps in
    the Visa Revocation Process. GAO-03-798. Washington, D.C.: June 18,
    2003.

    Homeland Security: Challenges Facing the Department of Homeland
    Security in Balancing its Border Security and Trade Facilitation
    Missions. GAO-03-902T. Washington, D.C.: June 16, 2003.

    Counterfeit Documents Used to Enter the United States From Certain
    Western Hemisphere Countries Not Detected. GAO-03-713T. Washington,
    D.C.: May 13, 2003.

    Information Technology: Terrorist Watch Lists Should Be Consolidated to
    Promote Better Integration and Sharing. GAO-03-322. Washington, D.C.:
    April 15, 2003.

    Border Security: Challenges in Implementing Border Technology. GAO-03-
    546T. Washington, D.C.: March 12, 2003.

    Immigration Enforcement:

    Alien Detention Standards: Telephone Access Problems Were Pervasive at
    Detention Facilities; Other Deficiencies Did Not Show a Pattern of
    Noncompliance. GAO-07-875. Washington, D.C.: July 6, 2007.

    Employment Verification: Challenges Exist in Implementing a Mandatory
    Electronic Verification System. GAO-07-924T. Washington, D.C.: June 7,
    2007.

    Foreign Workers: Information on Selected Countries' Experiences. GAO-
    06-1055. Washington, D.C.: September 8, 2006.

    Information Technology: Immigration and Customs Enforcement Is
    Beginning to Address Infrastructure Modernization Program Weaknesses,
    but Key Improvements Still Needed. GAO-06-823. Washington, D.C.: July
    27, 2006.

    Immigration Enforcement: Benefits and Limitations to Using Earnings
    Data to Identify Unauthorized Work. GAO-06-814R. Washington, D.C.: July
    11, 2006.

    Immigration Enforcement: Weaknesses Hinder Employment Verification and
    Worksite Enforcement Efforts. GAO-06-895T. Washington, D.C.: June 19,
    2006.

    Information on Immigration Enforcement and Supervisory Promotions in
    the Department of Homeland Security's Immigration and Customs
    Enforcement and Customs and Border Protection. GAO-06-751R. Washington,
    D.C.: June 13, 2006.

    Homeland Security: Better Management Practices Could Enhance DHS's
    Ability to Allocate Investigative Resources. GAO-06-462T. Washington,
    D.C.: March 28, 2006.

    Information Technology: Management Improvements Needed on Immigration
    and Customs Enforcement's Infrastructure Modernization Program. GAO-
    05-805. Washington, D.C.: September 7, 2005.

    Immigration Enforcement: Weaknesses Hinder Employment Verification and
    Worksite Enforcement Efforts. GAO-05-813. Washington, D.C.: August 31,
    2005.

    Combating Alien Smuggling: The Federal Response Can Be Improved. GAO-
    05-892T. Washington, D.C.: July 12, 2005.

    Combating Alien Smuggling: Opportunities Exist to Improve the Federal
    Response. GAO-05-305. Washington, D.C.: May 27, 2005.

    Information on Certain Illegal Aliens Arrested in the United States.
    GAO-05-646R. Washington, D.C.: May 9, 2005.

    Department of Homeland Security: Addressing Management Challenges that
    Face Immigration Enforcement Agencies. GAO-05-664T. Washington, D.C.:
    May 5, 2005.

    Information on Criminal Aliens Incarcerated in Federal and State
    Prisons and Local Jails. GAO-05-337R. Washington, D.C.: April 7, 2005.

    Homeland Security: Performance of Foreign Student and Exchange Visitor
    Information System Continues to Improve, But Issues Remain. GAO-05-
    440T. Washington, D.C.: March 17, 2005.

    Alien Registration: Usefulness of a Nonimmigrant Alien Annual Address
    Reporting Requirement Is Questionable. GAO-05-204. Washington, D.C.:
    January 28, 2005.

    Homeland Security: Management Challenges Remain in Transforming
    Immigration Programs. GAO-05-81. Washington, D.C.: October 14, 2004.

    Immigration Enforcement: DHS Has Incorporated Immigration Enforcement
    Objectives and Is Addressing Future Planning Requirements. GAO-05-66.
    Washington, D.C.: October 8, 2004.

    Homeland Security: Performance of Information System to Monitor Foreign
    Students and Exchange Visitors Has Improved, but Issues Remain. GAO-04-
    690. Washington, D.C.: June 18, 2004.

    Investigations of Terrorist Financing, Money Laundering, and Other
    Financial Crimes. GAO-04-464R. Washington, D.C.: February 20, 2004.

    Combating Money Laundering: Opportunities Exist to Improve the National
    Strategy. GAO-03-813. Washington, D.C.: September 26, 2003.

    Immigration Services:

    Department of Homeland Security: Adjustment of the Immigration and
    Naturalization Benefit Application and Petition Fee Schedule. GAO-07-
    946R. Washington, D.C.: June 15, 2007.

    Immigration Benefits: Sixteenth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-07-796R. Washington, D.C.: April
    27, 2007.

    DHS Immigration Attorneys: Workload Analysis and Workforce Planning
    Efforts Lack Data and Documentation. GAO-07-206. Washington, D.C.:
    April 17, 2007.

    Foreign Physicians: Data on Use of J-1 Visa Waivers Needed to Better
    Address Physician Shortages. GAO-07-52. Washington, D.C.: November 30,
    2006.

    Immigration Benefits: Fifteenth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-07-168R. Washington, D.C.:
    November 9, 2006.

    Immigration Benefits: Additional Efforts Needed to Help Ensure Alien
    Files Are Located when Needed. GAO-07-85. Washington, D.C.: October 27,
    2006.

    Estimating the Undocumented Population: A "Grouped Answers" Approach to
    Surveying Foreign-Born Respondents. GAO-06-775. Washington, D.C.:
    September 29, 2006.

    Executive Office for Immigration Review: Caseload Performance Reporting
    Needs Improvement. GAO-06-771. Washington, D.C.: August 11, 2006.

    H-1B Visa Program: More Oversight by Labor Can Improve Compliance with
    Program Requirements. GAO-06-901T. Washington, D.C.: June 22, 2006.

    H-1B Visa Program: Labor Could Improve Its Oversight and Increase
    Information Sharing with Homeland Security. GAO-06-720. Washington,
    D.C.: June 22, 2006.

    Immigration Benefits: Circumstances under Which Petitioners' Sex
    Offenses May Be Disclosed to Beneficiaries. GAO-06-735. Washington,
    D.C.: June 14, 2006.

    Immigration Benefits: Fourteenth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-06-589R. Washington, D.C.: April
    21, 2006.

    Information Technology: Near-Term Effort to Automate Paper-Based
    Immigration Files Needs Planning Improvements. GAO-06-375. Washington,
    D.C.: March 31, 2006.

    International Remittances: Different Estimation Methodologies Produce
    Different Results. GAO-06-210. Washington, D.C.: March 28, 2006.

    Immigration Benefits: Additional Controls and a Sanctions Strategy
    Could Enhance DHS' Ability to Control Benefit Fraud. GAO-06-259.
    Washington, D.C.: March 10, 2006.

    Social Security Administration: Procedures for Issuing Numbers and
    Benefits to the Foreign-Born. GAO-06-253T. Washington, D.C.: March 2,
    2006.

    Immigration Benefits: Improvements Needed to Address Backlogs and
    Ensure Quality of Adjudications. GAO-06-20. Washington, D.C.: November
    21, 2005.

    Immigration Benefits: Thirteenth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-06-122R. Washington, D.C.:
    October 21, 2005.

    Taxpayer Information: Options Exist to Enable Data Sharing Between IRS
    and USCIS but Each Presents Challenges. GAO-06-100. Washington, D.C.:
    October 11, 2005.

    Immigration Services: Better Contracting Practices Needed at Call
    Centers. GAO-05-526. Washington, D.C.: June 30, 2005.

    Immigration Benefits: Twelfth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-05-481R. Washington, D.C.: April
    14, 2005.

    Immigrant Investors: Small Number of Participants Attributed to Pending
    Regulations and Other Factors. GAO-05-256. Washington, D.C.: April 1,
    2005.

    Immigration Benefits: Eleventh Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-04-1030R. Washington, D.C.:
    August 13, 2004.

    Taxpayer Information: Data Sharing and Analysis May Enhance Tax
    Compliance and Improve Immigration Eligibility Decisions. GAO-04-972T.
    Washington, D.C.: July 21, 2004.

    Illegal Alien Schoolchildren: Issues in Estimating State-by-State
    Costs. GAO-04-733. Washington, D.C.: June 21, 2004.

    Undocumented Aliens: Questions Persist about Their Impact on Hospitals'
    Uncompensated Care Costs. GAO-04-472. Washington, D.C.: May 21, 2004.

    Immigration Application Fees: Current Fees Are Not Sufficient to Fund
    U.S. Citizenship and Immigration Services' Operations. GAO-04-309R.
    Washington, D.C.: January 5, 2004.

    Immigration Benefits: Tenth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-04-189R. Washington, D.C.:
    October 17, 2003.

    Social Security Administration: Actions Taken to Strengthen Procedures
    for Issuing Social Security Numbers to Noncitizens, but Some Weaknesses
    Remain. GAO-04-12. Washington, D.C.: October 15, 2003.

    Social Security Numbers: Improved SSN Verification and Exchange of
    States' Driver Records Would Enhance Identity Verification. GAO-03-920.
    Washington, D.C.: September 15, 2003.

    H-1B Foreign Workers: Better Tracking Needed to Help Determine H-1B
    Program's Effects on U.S. Workforce. GAO-03-883. Washington, D.C.:
    September 10, 2003.

    Supplemental Security Income: SSA Could Enhance Its Ability to Detect
    Residency Violations. GAO-03-724. Washington, D.C.: July 29, 2003.

    Immigration Benefits: Ninth Report Required by the Haitian Refugee
    Immigration Fairness Act of 1998. GAO-03-681R. Washington, D.C.: April
    21, 2003.

    Aviation Security:

    Aviation Security: Efforts to Strengthen International Passenger
    Prescreening Are Under Way, but Planning and Implementation Issues
    Remain. GAO-07-346. Washington, D.C.: May 16, 2007.

    Aviation Security: Federal Efforts to Secure U.S.-Bound Air Cargo Are
    in the Early Stages and Could Be Strengthened. GAO-07-660. Washington,
    D.C.: April 30, 2007.

    Aviation Security: TSA's Change to Its Prohibited Items List Has Not
    Resulted in Any Reported Security Incidents, but the Impact of the
    Change on Screening Operations Is Inconclusive. GAO-07-634R.
    Washington, D.C.: April 25, 2007.

    Aviation Security: Risk, Experience, and Customer Concerns Drive
    Changes to Airline Passenger Screening Procedures, but Evaluation and
    Documentation of Proposed Changes Could Be Improved. GAO-07-634.
    Washington, D.C.: April 16, 2007.

    Aviation Security: Cost Estimates Related to TSA Funding of Checked
    Baggage Screening Systems at Los Angeles and Ontario Airports. GAO-07-
    445. Washington, D.C.: March 30, 2007.

    Aviation Security: TSA's Staffing Allocation Model Is Useful for
    Allocating Staff among Airports, but Its Assumptions Should Be
    Systematically Reassessed. GAO-07-299. Washington, D.C.: February 28,
    2007.

    Aviation Security: Progress Made in Systematic Planning to Guide Key
    Investment Decisions, but More Work Remains. GAO-07-448T. Washington,
    D.C.: February 13, 2007.

    Transportation Security Administration: Oversight of Explosive
    Detection Systems Maintenance Contracts Can Be Strengthened. GAO-06-
    795. Washington D.C.: July 31, 2006.

    Aviation Security: TSA Oversight of Checked Baggage Screening
    Procedures Could Be Strengthened. GAO-06-869. Washington, D. C.: July
    28, 2006.

    Aviation Security: TSA Has Strengthened Efforts to Plan for the Optimal
    Deployment of Checked Baggage Screening Systems, but Funding
    Uncertainties Remain. GAO-06-875T. Washington, D.C.: June 29, 2006.

    Aviation Security: Management Challenges Remain for the Transportation
    Security Administration's Secure Flight Program. GAO-06-864T.
    Washington, D.C.: June 14, 2006.

    Aviation Security: Further Study of Safety and Effectiveness and Better
    Management Controls Needed if Air Carriers Resume Interest in Deploying
    Less-than-Lethal Weapons. GAO-06-475. Washington, D.C.: May 26, 2006.

    Aviation Security: Transportation Security Administration Has Made
    Progress in Managing a Federal Workforce and Ensuring Security at U.S.
    Airports, but Challenges Remain. GAO-06-597T. Washington, D.C.: April
    4, 2006.

    Aviation Security: Enhancements Made in Passenger and Checked Baggage
    Screening, but Challenges Remain. GAO-06-371T. Washington, D.C.: April
    4, 2006.

    Aviation Security: Progress Made to Set Up Program Using Private-Sector
    Airport Screeners, but More Work Remains. GAO-06-166. Washington, D.
    C.: March 31, 2006.

    Aviation Security: Significant Management Challenges May Adversely
    Affect Implementation of the Transportation Security Administration's
    Secure Flight Program. GAO-06-374T. Washington, D.C.: February 9, 2006.

    Aviation Security: Federal Air Marshal Service Could Benefit from
    Improved Planning and Controls. GAO-06-203. Washington, D.C.: November
    28, 2005.

    Aviation Security: Federal Action Needed to Strengthen Domestic Air
    Cargo Security. GAO-06-76. Washington, D.C.: October 17, 2005.

    Transportation Security Administration: More Clarity on the Authority
    of Federal Security Directors Is Needed. GAO-05-935. Washington, D.C.:
    September 23, 2005.

    Aviation Security: Flight and Cabin Crew Member Security Training
    Strengthened, but Better Planning and Internal Controls Needed. GAO-05-
    781. Washington, D.C.: September 6, 2005.

    Aviation Security: Transportation Security Administration Did Not Fully
    Disclose Uses of Personal Information during Secure Flight Program
    Testing Initial Privacy Notes, but Has Recently Taken Steps to More
    Fully Inform the Public. GAO-05-864R. Washington, D.C.: July 22, 2005.

    Aviation Security: Better Planning Needed to Optimize Deployment of
    Checked Baggage Screening Systems. GAO-05-896T. Washington, D.C.: July
    13, 2005.

    Aviation Security: Screener Training and Performance Measurement
    Strengthened, but More Work Remains. GAO-05-457. Washington, D.C.: May
    2, 2005.

    Aviation Security: Secure Flight Development and Testing Under Way, but
    Risks Should Be Managed as System Is Further Developed. GAO-05-356.
    Washington, D.C.: March 28, 2005.

    Aviation Security: Systematic Planning Needed to Optimize the
    Deployment of Checked Baggage Screening Systems. GAO-05-365.
    Washington, D.C.: March 15, 2005.

    Aviation Security: Measures for Testing the Impact of Using Commercial
    Data for the Secure Flight Program. GAO-05-324. Washington, D.C.:
    February 23, 2005.

    Transportation Security: Systematic Planning Needed to Prioritize
    Resources. GAO-05-357T. Washington, D.C.: February 15, 2005.

    Aviation Security: Preliminary Observations on TSA's Progress to Allow
    Airports to Use Private Passenger and Baggage Screening. GAO-05-126.
    Washington, D.C.: November 19, 2004.

    General Aviation Security: Increased Federal Oversight Is Needed, but
    Continued Partnership with the Private Sector Is Critical to Long-Term
    Success. GAO-05-144. Washington, D.C.: November 10, 2004.

    Aviation Security: Further Steps Needed to Strengthen the Security of
    Commercial Airport Perimeters and Access Controls. GAO-04-728.
    Washington, D.C.: June 4, 2004.

    Aviation Security: Challenges in Using Biometric Technologies. GAO-04-
    785T. Washington, D.C.: May 19, 2004.

    Aviation Security: Private Security Screening Contractors Have Little
    Flexibility to Implement Innovative Approaches. GAO-04-505T.
    Washington, D.C.: April 22, 2004.

    Aviation Security: Challenges Delay Implementation of Computer-
    Assisted Passenger Prescreening System. GAO-04-504T. Washington, D.C.:
    March 17, 2004.

    Aviation Security: Computer-Assisted Passenger Prescreening System
    Faces Significant Implementation Challenges. GAO-04-385. Washington,
    D.C.: February 13, 2004.

    Aviation Security: Computer-Assisted Passenger Prescreening System
    Faces Significant Implementation Challenges. GAO-04-385. Washington,
    D.C.: February 12, 2004.

    Aviation Security: Challenges Exist in Stabilizing and Enhancing
    Passenger and Baggage Screening Operations. GAO-04-440T. Washington,
    D.C.: February 12, 2004.

    Aviation Security: Efforts to Measure Effectiveness and Strengthen
    Security Programs. GAO-04-285T. Washington, D.C.: November 20, 2003.

    Aviation Security: Federal Air Marshal Service Is Addressing Challenges
    of Its Expanded Mission and Workforce, but Additional Actions Needed.
    GAO-04-242. Washington, D. C.: November 19, 2003.

    Aviation Security: Efforts to Measure Effectiveness and Address
    Challenges. GAO-04-232T. Washington, D.C.: November 5, 2003.

    Airport Passenger Screening: Preliminary Observations on Progress Made
    and Challenges Remaining. GAO-03-1173. Washington, D.C.: September 24,
    2003.

    Aviation Security: Progress since September 11, 2001, and the
    Challenges Ahead. GAO-03-1154T. Washington, D.C.: September 9, 2003.

    Transportation Security: Federal Action Needed to Address Security
    Challenges. GAO-03-843. Washington, D.C.: June 30, 2003.

    Transportation Security: Post-September 11th Initiatives and Long-Term
    Challenges. GAO-03-616T. Washington, D. C.: April 1, 2003.

    Surface Transportation Security:

    Passenger Rail Security: Federal Strategy and Enhanced Coordination
    Needed to Prioritize and Guide Security Efforts. GAO-07-583T.
    Washington, D.C.: March 7, 2007.

    Passenger Rail Security: Federal Strategy and Enhanced Coordination
    Needed to Prioritize and Guide Security Efforts. GAO-07-459T.
    Washington, D.C.: February 13, 2007.

    Passenger Rail Security: Federal Strategy and Enhanced Coordination
    Needed to Prioritize and Guide Security Efforts. GAO-07-442T.
    Washington, D.C.: February 6, 2007.

    Passenger Rail Security: Enhanced Leadership Needed to Prioritize and
    Guide Security Efforts. GAO-07-225T. Washington, D.C.: January 18,
    2007.

    Passenger Rail Security: Evaluating Foreign Security Practices and Risk
    Can Help Guide Security Efforts. GAO-06-557T. Washington, D.C.: March
    29, 2006.

    Passenger Rail Security: Enhanced Federal Leadership Needed to
    Prioritize and Guide Security Efforts. GAO-06-181T. Washington, D.C.:
    October 20, 2005.

    Passenger Rail Security: Enhanced Federal Leadership Needed to
    Prioritize and Guide Security Efforts. GAO-05-851. Washington, D.C.:
    September 9, 2005.

    Transportation Security: Systematic Planning Needed to Optimize
    Resources. GAO-05-357T. Washington, D.C.: February 15, 2005.

    Transportation Security R&D: TSA and DHS Are Researching and Developing
    Technologies, but Need to Improve R&D Management. GAO-04-890.
    Washington, D.C.: September 30, 2004.

    Surface Transportation: Many Factors Affect Investment Decisions. GAO-
    04-744. Washington, D.C.: June 30, 2004.

    Rail Security: Some Actions Taken to Enhance Passenger and Freight Rail
    Security, but Significant Challenges Remain. GAO-04-598T. Washington,
    D.C.: March 23, 2004.

    Transportation Security: Federal Action Needed to Enhance Security
    Efforts. GAO-03-1154T. Washington, D.C.: September 9, 2003.

    Transportation Security: Federal Action Needed to Help Address Security
    Challenges. GAO-03-843. Washington, D.C.: June 30, 2003.

    Transportation Security Research: Coordination Needed in Selecting and
    Implementing Infrastructure Vulnerability Assessments. GAO-03-502.
    Washington, D.C.: May 1, 2003.

    Rail Safety and Security: Some Actions Already Taken to Enhance Rail
    Security, but Risk-based Plan Needed. GAO-03-435. Washington, D.C.:
    April 30, 2003.

    Transportation Security: Post-September 11th Initiatives and Long-Term
    Challenges. GAO-03-616T. New York City: April 1, 2003.

    Maritime Security:

    Information on Port Security in the Caribbean Basin. GAO-07-804R.
    Washington, D.C.: June 29, 2007.

    Maritime Security: Observations on Selected Aspects of the SAFE Port
    Act. GAO-07-754T. Washington, D.C.: April 26, 2007.

    Transportation Security: TSA Has Made Progress in Implementing the
    Transportation Worker Identification Credential Program, but
    Challenges Remain. GAO-07-681T. Washington, D.C.: April 12, 2007.

    Port Risk Management: Additional Federal Guidance Would Aid Ports in
    Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March 28,
    2007.

    Maritime Security: Public Safety Consequences of a Liquefied Natural
    Gas Spill Need Clarification. GAO-07-633T. Washington, D.C.: March 21,
    2007.

    Combating Nuclear Smuggling: DHS's Decision to Procure and Deploy the
    Next Generation of Radiation Detection Equipment Is Not Supported by
    Its Cost-Benefit Analysis. GAO-07-581T. Washington, D.C.: March 14,
    2007.

    Combating Nuclear Smuggling: DNDO Has Not Yet Collected Most of the
    National Laboratories' Test Results on Radiation Portal Monitors in
    Support of DNDO's Testing and Development Program. GAO-07-347R.
    Washington, D.C.: March 9, 2007.

    Maritime Security: Public Safety Consequences of a Terrorist Attack on
    a Tanker Carrying Liquefied Natural Gas Need Clarification. GAO-07-316.
    Washington, D.C.: February 22, 2007.

    Combating Nuclear Smuggling: DHS's Cost-Benefit Analysis to Support the
    Purchase of New Radiation Detection Portal Monitors Was Not Based on
    Available Performance Data and Did Not Fully Evaluate All the Monitors'
    Costs and Benefits. GAO-07-133R. Washington, D.C.: October 17, 2006.

    Transportation Security: DHS Should Address Key Challenges before
    Implementing the Transportation Worker Identification Credential
    Program. GAO-06-982. Washington, D.C.: September 29, 2006.

    Maritime Security: Information sharing Efforts Are Improving. GAO-06-
    933T. Washington, D.C.: July 10, 2006.

    Coast Guard: Observations on Agency Performance, Operations and Future
    Challenges. GAO-06-448T. Washington, D.C.: June 15, 2006.

    Cargo Container Inspections: Preliminary Observations on the Status of
    Efforts to Improve the Automated Targeting System. GAO-06-591T.
    Washington, D.C.: March 30, 2006.

    Combating Nuclear Smuggling: DHS Has Made Progress Deploying Radiation
    Detection Equipment at U.S. Ports-of-Entry, but Concerns Remain. GAO-
    06-389. Washington, D.C.: March 22, 2006.

    Risk Management: Further Refinements Needed to Assess Risks and
    Prioritize Protective Measures at Ports and Other Critical
    Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.

    Homeland Security: Key Cargo Security Programs Can Be Improved. GAO-05-
    466T. Washington, D.C.: May 26, 2005.

    Maritime Security: Enhancements Made, but Implementation and
    Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:
    May 17, 2005.

    Container Security: A Flexible Staffing Model and Minimum Equipment
    Requirements Would Improve Overseas Targeting and Inspection Efforts.
    GAO-05-557. Washington, D.C.: April 26, 2005.

    Maritime Security: New Structures Have Improved Information Sharing,
    but Security Clearance Processing Requires Further Attention. GAO-05-
    394. Washington, D.C.: April 15, 2005.

    Coast Guard: Observations on Agency Priorities in Fiscal Year 2006
    Budget Request. GAO-05-364T. Washington, D.C.: March 17, 2005.

    Cargo Security: Partnership Program Grants Importers Reduced Scrutiny
    with Limited Assurance of Improved Security. GAO-05-404. Washington,
    D.C.: March 11, 2005.

    Homeland Security: Process for Reporting Lessons Learned from Seaport
    Exercises Needs Further Attention. GAO-05-170. Washington, D.C.:
    January 14, 2005.

    Port Security: Better Planning Needed to Develop and Operate Maritime
    Worker Identification Card Program. GAO-05-106. Washington, D.C.:
    December 10, 2004.

    Maritime Security: Better Planning Needed to Help Ensure an Effective
    Port Security Assessment Program. GAO-04-1062. Washington, D.C.:
    September 30, 2004.

    Maritime Security: Partnering Could Reduce Federal Costs and Facilitate
    Implementation of Automatic Vessel Identification System. GAO-04-868.
    Washington, D.C.: July 23, 2004.

    Maritime Security: Substantial Work Remains to Translate New Planning
    Requirements into Effective Port Security. GAO-04-838. Washington,
    D.C.: June 30, 2004.

    Homeland Security: Summary of Challenges Faced in Targeting Oceangoing
    Cargo Containers for Inspection. GAO-04-557T. Washington, D.C.: March
    31, 2004.

    Coast Guard: Relationship between Resources Used and Results Achieved
    Needs to Be Clearer. GAO-04-432. Washington, D.C.: March 22, 2004.

    Container Security: Expansion of Key Customs Programs Will Require
    Greater Attention to Critical Success Factors. GAO-03-770. Washington,
    D.C.: July 25, 2003.

    Coast Guard: Comprehensive Blueprint Needed to Balance and Monitor
    Resource Use and Measure Performance for All Missions. GAO-03-544T.
    Washington, D.C.: March 12, 2003.

    Emergency Preparedness and Response:

    Preliminary Information on Rebuilding Efforts in the Gulf Coast. GAO-
    07-809R. Washington, D.C.: June 29, 2007.

    Emergency Management: Most School Districts Have Developed Emergency
    Management Plans, but Would Benefit from Additional Federal Guidance.
    GAO-07-609. Washington, D.C.: June 12, 2007.

    Emergency Management: Status of School Districts' Planning and
    Preparedness. GAO-07-821T. Washington, D.C.: May 17, 2007.

    Homeland Security: Observations on DHS and FEMA Efforts to Prepare for
    and Respond to Major and Catastrophic Disasters and Address Related
    Recommendations and Legislation. GAO-07-835T. Washington, D.C: May 15,
    2007.

    First Responders: Much Work Remains to Improve Communications
    Interoperability. GAO-07-301. Washington, D.C.: April 2, 2007.

    Emergency Preparedness: Current Emergency Alert System Has Limitations,
    and Development of a New Integrated System Will Be Challenging. GAO-07-
    0411. Washington, D.C.: March 30, 2007.

    Hurricanes Katrina and Rita Disaster Relief: Continued Findings of
    Fraud, Waste, and Abuse. GAO-07-300. Washington, D.C.: March 15, 2007.

    Disaster Assistance: Better Planning Needed for Housing Victims of
    Catastrophic Disasters. GAO-07-88. Washington, D.C.: February 28, 2007.

    Homeland Security Grants: Observations on Process DHS Used to Allocate
    Funds to Selected Urban Areas. GAO-07-381R. Washington, D.C.: February
    7, 2007.

    Homeland Security: Applying Risk Management Principles to Guide Federal
    Investments. GAO-07-386T. Washington, D.C.: February 7, 2007.

    Budget Issues: FEMA Needs Adequate Data, Plans, and Systems to
    Effectively Manage Resources for Day-to-Day Operations, GAO-07-139.
    Washington, D.C.: January 19, 2007.

    Transportation-Disadvantaged Populations: Actions Needed to Clarify
    Responsibilities and Increase Preparedness for Evacuations. GAO-07-44.
    Washington, D.C.: December 22, 2006.

    Homeland Security: Assessment of the National Capital Region Strategic
    Plan. GAO-06-1096T. Washington, D.C.: September 28, 2006.

    Hurricanes Katrina and Rita: Unprecedented Challenges Exposed the
    Individuals and Households Program to Fraud and Abuse; Actions Needed
    to Reduce Such Problems in the Future. GAO-06-1013. Washington, D.C.:
    September 27, 2006.

    Catastrophic Disasters: Enhanced Leadership, Capabilities, and
    Accountability Controls Will Improve the Effectiveness of the Nation's
    Preparedness, Response, and Recovery System. GAO-06-618. Washington,
    D.C.: September 6, 2006.

    Coast Guard: Observations on the Preparation, Response, and Recovery
    Missions Related to Hurricane Katrina. GAO-06-903. Washington, D.C.:
    July 31, 2006.

    Child Welfare: Federal Action Needed to Ensure States Have Plans to
    Safeguard Children in the Child Welfare System Displaced by Disasters.
    GAO-06-944. Washington, D.C.: July 28, 2006.

    Disaster Preparedness: Limitations in Federal Evacuation Assistance for
    Health Facilities Should Be Addressed. GAO-06-826. Washington, D.C.:
    July 20, 2006.

    Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to
    Fraudulent, Improper, and Abusive Activity. GAO-06-957T. Washington,
    D.C.: July 19, 2006.

    Individual Disaster Assistance Programs: Framework for Fraud
    Prevention, Detection, and Prosecution. GAO-06-954T. Washington, D.C.:
    July 12, 2006.

    Expedited Assistance for Victims of Hurricanes Katrina and Rita: FEMA's
    Control Weaknesses Exposed the Government to Significant Fraud and
    Abuse. GAO-06-655. Washington, D.C.: June 16, 2006.

    Hurricanes Katrina and Rita: Improper and Potentially Fraudulent
    Individual Assistance Payments Estimated to Be between $600 Million and
    $1.4 Billion. GAO-06-844T. Washington, D.C.: June 14, 2006.

    Hurricanes Katrina and Rita: Coordination between FEMA and the Red
    Cross Should Be Improved for the 2006 Hurricane Season. GAO-06-712.
    Washington, D.C.: June 8, 2006.

    U.S. Tsunami Preparedness: Federal and State Partners Collaborate to
    Help Communities Reduce Potential Impacts, but Significant Challenges
    Remain. GAO-06-519. Washington, D.C.: June 5, 2006.

    Disaster Preparedness: Preliminary Observations on the Evacuation of
    Vulnerable Populations due to Hurricanes and Other Disasters. GAO-06-
    790T. Washington, D.C.: May 18, 2006.

    Continuity of Operations: Selected Agencies Could Improve Planning for
    Use of Alternate Facilities and Telework during Disruptions. GAO-06-
    713. Washington, D.C.: May 11, 2006.

    Federal Emergency Management Agency: Factors for Future Success and
    Issues to Consider for Organizational Placement. GAO-06-746T.
    Washington, D.C.: May 9, 2006.

    Hurricane Katrina: Improving Federal Contracting Practices in Disaster
    Recovery Operations. GAO-06-714T. Washington, D.C.: May 4, 2006.

    Hurricane Katrina: Planning for and Management of Federal Disaster
    Recovery Contracts. GAO-06-622T. Washington, D.C.: April 10, 2006.

    Hurricane Katrina: Comprehensive Policies and Procedures Are Needed to
    Ensure Appropriate Use of and Accountability for International
    Assistance. GAO-06-460. Washington, D.C.: April 6, 2006.

    Homeland Security: The Status of Strategic Planning in the National
    Capital Region. GAO-06-559T. Washington, D.C.: March 29, 2006.

    Agency Management of Contractors Responding to Hurricanes Katrina and
    Rita. GAO-06-461R. Washington, D.C.: March 15, 2006.

    Hurricane Katrina: GAO's Preliminary Observations Regarding
    Preparedness, Response, and Recovery. GAO-06-442T. Washington, D.C.:
    March 8, 2006.

    Emergency Preparedness and Response: Some Issues and Challenges
    Associated with Major Emergency Incidents. GAO-06-467T. Washington,
    D.C.: February 23, 2006.

    Expedited Assistance for Victims of Hurricanes Katrina and Rita: FEMA's
    Control Weaknesses Exposed the Government to Significant Fraud and
    Abuse. GAO-06-403T. Washington, D.C.: February 13, 2006.

    Statement by Comptroller General David M. Walker on GAO's Preliminary
    Observations Regarding Preparedness and Response to Hurricanes Katrina
    and Rita. GAO-06-365R. Washington, D.C.: February 1, 2006.

    Hurricanes Katrina and Rita: Provision of Charitable Assistance. GAO-
    06-297T. Washington, D.C.: December 13, 2005.

    Hurricanes Katrina and Rita: Preliminary Observations on Contracting
    for Response and Recovery Efforts. GAO-06-246T. Washington, D.C.:
    November 8, 2005.

    Hurricanes Katrina and Rita: Contracting for Response and Recovery
    Efforts. GAO-06-235T. Washington, D.C.: November 2, 2005.

    Federal Emergency Management Agency: Oversight and Management of the
    National Flood Insurance Program. GAO-06-183T. Washington, D.C. October
    20, 2005.

    Federal Emergency Management Agency: Challenges Facing the National
    Flood Insurance Program. GAO-06-174T. Washington, D.C.: October 18,
    2005.

    Federal Emergency Management Agency: Improvements Needed to Enhance
    Oversight and Management of the National Flood Insurance Program. GAO-
    06-119. Washington, D.C.: October 18, 2005.

    Hurricane Katrina: Providing Oversight of the Nation's Preparedness,
    Response, and Recovery Activities. GAO-05-1053T. Washington, D.C.:
    September 28, 2005.

    Homeland Security: Managing First Responder Grants to Enhance Emergency
    Preparedness in the National Capital Region. GAO-05-889T. Washington,
    D.C.: July 14, 2005.

    Flood Map Modernization: Federal Emergency Management Agency's
    Implementation of a National Strategy. GAO-05-894T. Washington, D.C.:
    July 12, 2005.

    Homeland Security: DHS's Efforts to Enhance First Responders' All-
    Hazards Capabilities Continue to Evolve. GAO-05-652. Washington, D.C.:
    July 11, 2005.

    National Flood Insurance Program: Oversight of Policy Issuance and
    Claims. GAO-05-532T. Washington, D.C.: April 14, 2005.

    Homeland Security: Management of First Responder Grant Programs and
    Efforts to Improve Accountability Continue to Evolve. GAO-05-530T.
    Washington, D.C.: April 12, 2005.

    Homeland Security: Management of First Responder Grant Programs Has
    Improved, but Challenges Remain. GAO-05-121. Washington, D.C.: February
    2, 2005.

    Homeland Security: Federal Leadership and Intergovernmental
    Cooperation Required to Achieve First Responder Interoperable
    Communications. GAO-04-740. Washington, D.C.: July 20, 2004.

    Homeland Security: Management of First Responder Grants in the National
    Capital Region Reflects the Need for Coordinated Planning and
    Performance Goals. GAO-04-433. Washington, D.C.: May 28, 2004.

    Project SAFECOM: Key Cross-Agency Emergency Communications Effort
    Requires Stronger Collaboration. GAO-04-494. Washington, D.C.: April
    16, 2004.

    Flood Map Modernization: Program Strategy Shows Promise, but Challenges
    Remain. GAO-04-417. Washington, D.C.: March 31, 2004.

    Continuity of Operations: Improved Planning Needed to Ensure Delivery
    of Essential Government Services. GAO-04-160. Washington, D.C.:
    February 27, 2004.

    September 11: Overview of Federal Disaster Assistance to the New York
    City Area. GAO-04-72. Washington, D.C.: October 31, 2003.

    Disaster Assistance: Information on FEMA's Post 9/11 Public Assistance
    to the New York City Area. GAO-03-926. Washington, D.C.: August 29,
    2003.

    Flood Insurance: Challenges Facing the National Flood Insurance
    Program. GAO-03-606T. Washington, D.C.: April 1, 2003.

    Critical Infrastructure and Key Resources Protection:

    Information Technology: Homeland Security Information Network Needs to
    Be Better Coordinated with Key State and Local Initiatives. GAO-07-
    822T. Washington, D.C.: May 10, 2007.

    Information Technology: Numerous Federal Networks Used to Support
    Homeland Security Need to Be Better Coordinated with Key State and
    Local Information sharing Initiatives. GAO-07-455. Washington, D.C.:
    April 16, 2007.

    DHS Multi-Agency Operation Centers Would Benefit from Taking Further
    Steps to Enhance Collaboration and Coordination. GAO-07-686R.
    Washington, D.C.: April 5, 2007.

    Critical Infrastructure: Challenges Remain in Protecting Key Sectors.
    GAO-07-626T. Washington, D.C.: March 20, 2007.

    Passenger Rail Security: Federal Strategy and Enhanced Coordination
    Needed to Prioritize and Guide Security Efforts. GAO-07-583T.
    Washington, D.C.: March 7, 2007.

    Homeland Security: Applying Risk Management Principles to Guide Federal
    Investments. GAO-07-386T. Washington, D.C.: February 7, 2007.

    Homeland Security Grants: Observations on Process DHS Used to Allocate
    Funds to Selected Urban Areas. GAO-07-381R. Washington, D.C.: February
    7, 2007.

    Homeland Security: Opportunities Exist to Enhance Collaboration at 24/
    7 Operations Centers Staffed by Multiple DHS Agencies. GAO-07-89.
    Washington, D.C.: October 20, 2006.

    Critical Infrastructure Protection: Progress Coordinating Government
    and Private Sector Efforts Varies by Sectors' Characteristics. GAO-07-
    39. Washington, D.C.: October 16, 2006.

    Information Security: Coordination of Federal Cyber Security Research
    and Development. GAO-06-811. Washington, D.C.: September 29, 2006.

    Critical Infrastructure Protection: DHS Leadership Needed to Enhance
    Cybersecurity. GAO-06-1087T. Washington, D.C.: September 13, 2006.

    Catastrophic Disasters: Enhanced Leadership, Capabilities, and
    Accountability Controls Will Improve the Effectiveness of the Nation's
    Preparedness, Response, and Recovery System. GAO-06-618. Washington,
    D.C.: September 6, 2006.

    Homeland Security: DHS Is Addressing Security at Chemical Facilities,
    but Additional Authority Is Needed. GAO-06-899T. Washington, D.C.: June
    21, 2006.

    Internet Infrastructure: DHS Faces Challenges in Developing a Joint
    Public/Private Recovery Plan. GAO-06-672. Washington, D.C.: June 16,
    2006.

    Homeland Security: Guidance and Standards Are Needed for Measuring the
    Effectiveness of Agencies' Facility Protection Efforts. GAO-06-612.
    Washington, D.C: May 31, 2006.

    Information Sharing: DHS Should Take Steps to Encourage More Widespread
    Use of Its Program to Protect and Share Critical Infrastructure
    Information. GAO-06-383. Washington, D.C.: April 17, 2006.

    Securing Wastewater Facilities: Utilities Have Made Important Upgrades
    but Further Improvements to Key System Components May Be Limited by
    Costs and Other Constraints. GAO-06-390. Washington, D.C.: March 31,
    2006.

    Information Sharing: The Federal Government Needs to Establish Policies
    and Processes for Sharing Terrorism-Related and Sensitive but
    Unclassified Information. GAO-06-385. Washington, D.C.: March 17, 2006.

    Homeland Security: DHS Is Taking Steps to Enhance Security at Chemical
    Facilities, but Additional Authority Is Needed. GAO-06-150. Washington,
    D.C.: January 27, 2006.

    Risk Management: Further Refinements Needed to Assess Risks and
    Prioritize Protective Measures at Ports and Other Critical
    Infrastructure. GAO-06-91. Washington, D.C.: December 15, 2005.

    Critical Infrastructure Protection: Challenges in Addressing
    Cybersecurity. GAO-05-827T. Washington, D.C.: July 19, 2005.

    Critical Infrastructure Protection: Department of Homeland Security
    Faces Challenges in Fulfilling Cybersecurity Responsibilities. GAO-05-
    434. Washington, D.C.: May 26, 2005.

    Protection of Chemical and Water Infrastructure: Federal Requirements,
    Actions of Selected Facilities, and Remaining Challenges. GAO-05-327.
    Washington, D.C.: March 28, 2005.

    Homeland Security: Much Is Being Done to Protect Agriculture from a
    Terrorist Attack, but Important Challenges Remain. GAO-05-214.
    Washington, D.C.: March 8, 2005.

    Critical Infrastructure Protection: Improving Information Sharing with
    Infrastructure Sectors. GAO-04-780. Washington, D.C.: July 9, 2004.

    Technology Assessment: Cybersecurity for Critical Infrastructure
    Protection. GAO-04-321. Washington, D.C.: May 28, 2004.

    Critical Infrastructure Protection: Establishing Effective Information
    Sharing with Infrastructure Sectors. GAO-04-699T. Washington, D.C.:
    April 21, 2004.

    Critical Infrastructure Protection: Challenges and Efforts to Secure
    Control Systems. GAO-04-628T. Washington, D.C.: March 30, 2004.

    Critical Infrastructure Protection: Challenges and Efforts to Secure
    Control Systems. GAO-04-354. Washington, D.C.: March 15, 2004.

    Posthearing Questions from the September 17, 2003, Hearing on
    Implications of Power Blackouts for the Nation's Cybersecurity and
    Critical Infrastructure Protection: The Electric Grid, Critical
    Interdependencies, Vulnerabilities, and Readiness. GAO-04-300R.
    Washington, D.C.: December 8, 2003.

    Drinking Water: Experts' Views on How Future Federal Funding Can Best
    Be Spent to Improve Security. GAO-04-29. Washington, D.C.: October 31,
    2003.

    Critical Infrastructure Protection: Challenges in Securing Control
    Systems. GAO-04-140T. Washington, D.C.: October 1, 2003.

    Information Security: Progress Made, But Challenges Remain to Protect
    Federal Systems and the Nation's Critical Infrastructures. GAO-03-564T.
    Washington, D.C.: April 8, 2003.

    Homeland Security: Voluntary Initiatives Are Under Way at Chemical
    Facilities, but the Extent of Security Preparedness Is Unknown. GAO-03-
    439. Washington, D.C.: March 14, 2003.

    Science and Technology:

    Department of Homeland Security: Science and Technology Directorate's
    Expenditure Plan. GAO-07-868. Washington, D.C.: June 22, 2007.

    Combating Nuclear Smuggling: DHS's Decision to Procure and Deploy the
    Next Generation of Detection Equipment Is Not Supported by Its Cost-
    Benefit Analysis. GAO-07-581T. Washington, D.C.: March 14, 2007.

    Combating Nuclear Smuggling: DNDO Has Not Yet Collected Most of the
    National Laboratories' Test Results on Radiation Portal Monitors in
    Support of DNDO's Testing and Development Program. GAO-07-347R.
    Washington, D.C.: March 9, 2007.

    Homeland Security: DHS Needs to Improve Ethics-Related Management
    Controls for the Science and Technology Directorate. GAO-06-206.
    Washington, D.C.: December 22, 2006.

    Combating Nuclear Smuggling: DHS's Cost-Benefit Analysis to Support the
    Purchase of New Radiation Detection Portal Monitors Was Not Based on
    Available Performance Data and Did Not Fully Evaluate All the Monitors'
    Costs and Benefits. GAO-07-133R. Washington, D.C.: October 17, 2006.

    Combating Nuclear Terrorism: Federal Efforts to Respond to Nuclear and
    Radiological Threats and to Protect Emergency Response Capabilities
    Could Be Strengthened. GAO-06-1015. Washington, D.C.: September 21,
    2006.

    Combating Nuclear Smuggling: DHS Has Made Progress Deploying Radiation
    Detection Equipment at U.S. Ports-of-Entry, but Concerns Remain. GAO-
    06-389. Washington, D.C.: March 22, 2006.

    Combating Nuclear Smuggling: Corruption, Maintenance, and Coordination
    Problem Challenge U.S. Effort to Provide Radiation Detection Equipment
    to Other Countries. GAO-06-311. Washington, D.C.: March 14, 2006.

    Transportation Security R&D: TSA and DHS Are Researching and Developing
    Technologies, but Need to Improve R&D Management. GAO-04-890.
    Washington, D.C.: September 30, 2004.

    Homeland Security: DHS Needs a Strategy to Use DOE's Laboratories for
    Research on Nuclear, Biological, and Chemical Detection and Response
    Technologies. GAO-04-653. Washington, D.C.: May 24, 2004.

    Acquisition Management:

    Coast Guard: Challenges Affecting Deepwater Asset Deployment and
    Management and Efforts to Address Them. GAO-07-874. Washington, D.C.:
    June 18, 2007.

    Department of Homeland Security: Progress and Challenges in
    Implementing the Department's Acquisition Oversight Plan. GAO-07-900.
    Washington, D.C.: June 13, 2007.

    Department of Homeland Security: Ongoing Challenges in Creating an
    Effective Acquisition Organization. GAO-07-948T. Washington, D.C.:
    June 7, 2007.

    Homeland Security: Observations on the Department of Homeland
    Security's Acquisition Organization and on the Coast Guard's Deepwater
    Program. GAO-07-453T. Washington, D.C.: February 8, 2007.

    Interagency Contracting: Improved Guidance, Planning, and Oversight
    Would Enable the Department of Homeland Security to Address Risks. GAO-
    06-996. Washington, D.C.: September 27, 2006.

    Catastrophic Disasters: Enhanced Leadership, Capabilities, and
    Accountability Controls Will Improve the Effectiveness of the Nation's
    Preparedness, Response, and Recovery System. GAO-06-618. Washington,
    D.C.: September 6, 2006.

    Homeland Security: Challenges in Creating an Effective Acquisition
    Organization. GAO-06-1012T. Washington, D.C.: July 27, 2006.

    Coast Guard: Status of Deepwater Fast Response Cutter Design Efforts.
    GAO-06-764. Washington, D.C.: June 23, 2006.

    Coast Guard: Changes to Deepwater Appear Sound, and Program Management
    Has Improved, But Continued Monitoring Is Warranted. GAO-06-546.
    Washington, D.C.: April 28, 2006.

    Coast Guard: Preliminary Observations on the Condition of Deepwater
    Legacy Assets and Acquisition Management Challenges. GAO-05-651T.
    Washington, D.C.: June 21, 2005.

    Homeland Security: Successes and Challenges in DHS's Efforts to Create
    an Effective Acquisition Organization. GAO-05-179. Washington, D.C.:
    March 29, 2005.

    Homeland Security: Further Action Needed to Promote Successful Use of
    Special DHS Acquisition Authority. GAO-05-136. Washington, D.C.:
    December 15, 2004.

    Coast Guard: Deepwater Program Acquisition Schedule Update Needed. GAO-
    04-695. Washington, D.C.: June 14, 2004.

    Contract Management: Coast Guard's Deepwater Program Needs Increased
    Attention to Management and Contractor Oversight. GAO-04-380.
    Washington, D.C.: March 9, 2004.

    Contract Management: INS Contracting Weaknesses Need Attention from the
    Department of Homeland Security. GAO-03-799. Washington, D.C.: July 25,
    2003.

    Financial Management:

    Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to
    Fraudulent, Improper, and Abusive Activity. GAO-06-1117. Washington,
    D.C.: September 28, 2006.

    Internal Control: Analysis of Joint Study on Estimating the Costs and
    Benefits of Rendering Opinions on Internal Control over Financial
    Reporting in the Federal Environment. GAO-06-255R. Washington, D.C.:
    September 6, 2006.

    Financial Management: Challenges Continue in Meeting Requirements of
    the Improper Payments Information Act. GAO-06-581T. Washington, D.C.:
    April 5, 2006.

    Financial Management Systems: DHS Has an Opportunity to Incorporate
    Best Practices in Modernization Efforts. GAO-06-553T. Washington, D.C.:
    March 29, 2006.

    Financial Management Systems: Additional Efforts Needed to Address Key
    Causes of Modernization Failures. GAO-06-184. Washington, D.C.: March
    15, 2006.

    Financial Management: Challenges Remain in Meeting Requirements of the
    Improper Payments Information Act. GAO-06-482T. Washington, D.C.: March
    9, 2006.

    CFO Act of 1990: Driving the Transformation of Federal Financial
    Management. GAO-06-242T. Washington, D.C.: November 17, 2005.

    Financial Management: Achieving FFMIA Compliance Continues to Challenge
    Agencies. GAO-05-881. Washington, D.C.: September 20, 2005.

    Financial Audit: The Department of Homeland Security's Fiscal Year 2004
    Management Representation Letter on Its Financial Statements. GAO-05-
    600R. Washington, D.C.: July 14, 2005.

    Financial Management: Challenges in Meeting Requirements of the
    Improper Payments Information Act. GAO-05-417. Washington, D.C.: March
    31, 2005.

    Financial Management: Effective Internal Control Is Key to
    Accountability. GAO-05-321T. Washington, D.C.: February 16, 2005.

    Financial Management: Improved Financial Systems Are Key to FFMIA
    Compliance. GAO-05-20. Washington, D.C.: October 1, 2004:

    Financial Management: Department of Homeland Security Faces Significant
    Financial Management Challenges. GAO-04-774. Washington, D.C.: July 19,
    2004.

    Department of Homeland Security: Financial Management Challenges. GAO-
    04-945T. Washington, D.C.: July 8, 2004.

    Financial Management: Recurring Financial Systems Problems Hinder FFMIA
    Compliance. GAO-04-209T. Washington, D.C.: October 29, 2003:

    Department of Homeland Security: Challenges and Steps in Establishing
    Sound Financial Management. GAO-03-1134T. Washington, D.C.: September
    10, 2003.

    Human Capital Management:

    Homeland Security: Management and Programmatic Challenges Facing the
    Department of Homeland Security. GAO-07-833T. Washington, D.C.: May 10,
    2007.

    Homeland Security: Information on Training New Border Patrol Agents.
    GAO-07-540R. Washington, D.C.: March 30, 2007.

    Homeland Security: Management and Programmatic Challenges Facing the
    Department of Homeland Security. GAO-07-452T. Washington, D.C.:
    February 7, 2007.

    Budget Issues: FEMA Needs Adequate Data, Plans, and Systems to
    Effectively Manage Resources for Day-to-Day Operations. GAO-07-139.
    Washington, D.C.: January 19, 2007.

    Department of Homeland Security: Strategic Management of Training
    Important for Successful Transformation. GAO-05-888. Washington, D.C.:
    September 23, 2005.

    Human Capital: Observations on Final DHS Human Capital Regulations.
    GAO-05-391T. Washington, D.C.: March 2, 2005.

    Human Capital: DHS Faces Challenges In Implementing Its New Personnel
    System. GAO-04-790. Washington, D.C.: June 18, 2004.

    Human Capital: DHS Personnel System Design Effort Provides for
    Collaboration and Employee Participation. GAO-03-1099. Washington,
    D.C.: September 30, 2003.

    Information Technology Management:

    Homeland Security: DHS Enterprise Architecture Continues to Evolve but
    Improvements Needed. GAO-07-564. Washington, D.C.: May 9, 2007.

    Information Technology: DHS Needs to Fully Define and Implement
    Policies and Procedures for Effectively Managing Investments. GAO-07-
    424. Washington, D.C.: April 27, 2007.

    Homeland Security: Planned Expenditures for U.S. Visitor and Immigrant
    Status Program Need to Be Adequately Defined and Justified. GAO-07-278.
    Washington, D.C.: February 14, 2007.

    Enterprise Architecture: Leadership Remains Key to Establishing and
    Leveraging Architectures for Organizational Transformation. GAO-06-
    831. Washington, D.C.: August 14, 2006.

    Information Technology: Immigration and Customs Enforcement Is
    Beginning to Address Infrastructure Modernization Program Weaknesses,
    but Key Improvements Still Needed. GAO-06-823. Washington, D.C.: July
    27, 2006.

    Information Technology: Customs Has Made Progress on Automated
    Commercial Environment System, but It Faces Long-Standing Management
    Challenges and New Risks. GAO-06-580. Washington, D.C.: May 31, 2006.

    Homeland Security Progress Continues but Challenges Remain on
    Department's Management of Information Technology. GAO-06-598T.
    Washington, D.C.: March 29, 2006.

    Information Technology: Management Improvements Needed on Immigration
    and Customs Enforcement's Infrastructure Modernization Program. GAO-
    05-805. Washington, D.C.: September 7, 2005.

    Information Security: Department of Homeland Security Needs to Fully
    Implement Its Security Program. GAO-05-700. Washington, D.C: June 17,
    2005.

    Information Security: Department of Homeland Security Faces Challenges
    in Fulfilling Statutory Requirements. GAO-05-567T. Washington, D.C.:
    April 14, 2005.

    Information Technology: Customs Automated Commercial Environment
    Program Progressing, but Need for Management Improvements Continues.
    GAO-05-267. Washington, D.C.: March 14, 2005.

    Homeland Security: Some Progress Made, but Many Challenges Remain on
    U.S. Visitor and Immigrant Status Indicator Technology Program. GAO-05-
    202. Washington, D.C.: February 23, 2005.

    Department of Homeland Security: Formidable Information and Technology
    Management Challenge Requires Institutional Approach. GAO-04-702.
    Washington, D.C.: August 27, 2004.

    Homeland Security: Efforts Under Way to Develop Enterprise
    Architecture, but Much Work Remains. GAO-04-777. Washington, D.C.:
    August 6, 2004.

    Information Technology: Homeland Security Should Better Balance Need
    for System Integration Strategy with Spending for New and Enhanced
    Systems. GAO-04-509. Washington, D.C.: May 21, 2004.

    Information Technology: Early Releases of Customs Trade System
    Operating, but Pattern of Cost and Schedule Problems Needs to Be
    Addressed. GAO-04-719. Washington, D.C.: May 14, 2004.

    Information Technology: OMB and Department of Homeland Security
    Investment Reviews. GAO-04-323. Washington, D.C.: February 10, 2004.

    Homeland Security: Risks Facing Key Border and Transportation Security
    Program Need to Be Addressed. GAO-03-1083. Washington, D.C.: September
    19, 2003.

    Information Technology: A Framework for Assessing and Improving
    Enterprise Architecture Management (Version 1.1). GAO-03-584G.
    Washington, D.C.: April 2003.

    Real Property Management:

    Federal Real Property: DHS Has Made Progress, but Additional Actions
    Are Needed to Address Real Property Management and Security Challenges.
    GAO-07-658. Washington, D.C.: June 22, 2007.

    General Reports:

    Homeland Security: Guidance from Operations Directorate Will Enhance
    Collaboration among Departmental Operations Centers. GAO-07-683T.
    Washington, D.C.: June 20, 2007.

    Homeland Security: Management and Programmatic Challenges Facing the
    Department of Homeland Security. GAO-07-833T. Washington, D.C.: May 10,
    2007.

    DHS Privacy Office: Progress Made but Challenges Remain in Notifying
    and Reporting to the Public. GAO-07-522. Washington, D.C.: April 27,
    2007.

    Transportation Security: DHS Efforts to Eliminate Redundant Background
    Check Investigations, GAO-07-756. Washington, D.C.: April 26, 2007.

    Department of Homeland Security: Observations on GAO Access to
    Information on Programs and Activities. GAO-07-700T. Washington, D.C.:
    April 25, 2007.

    DHS Multi-Agency Operation Centers Would Benefit from Taking Further
    Steps to Enhance Collaboration and Coordination. GAO-07-686R.
    Washington, D.C.: April 5, 2007.

    Homeland Security: Applying Risk Management Principles to Guide Federal
    Investments. GAO-07-386T. Washington, D.C.: February 7, 2007.

    Homeland Security: Management and Programmatic Challenges Facing the
    Department of Homeland Security. GAO-07-452T. Washington, D.C.:
    February 7, 2007.

    Homeland Security: Management and Programmatic Challenges Facing the
    Department of Homeland Security. GAO-07-398T. Washington, D.C.:
    February 6, 2007.

    Homeland Security: Progress Has Been Made to Address the
    Vulnerabilities Exposed by 9/11, but Continued Federal Action Is Needed
    to Further Mitigate Security Risks. GAO-07-375. Washington, D.C.:
    January 24, 2007.

    Terrorist Watch List Screening: Efforts to Help Reduce Adverse Effects
    on the Public. GAO-06-1031. Washington, D.C.: September 29, 2006.

    Combating Terrorism: Determining and Reporting Federal Funding Data.
    GAO-06-161. Washington, D.C; January 17, 2006.

    Homeland Security: Overview of Department of Homeland Security
    Management Challenges. GAO-05-573T. Washington, D.C.: April 20, 2005.

    Results-Oriented Government: Improvements to DHS's Planning Process
    Would Enhance Usefulness and Accountability. GAO-05-300. Washington,
    D.C.: March 31, 2005.

    September 11: Recent Estimates of Fiscal Impact of 2001 Terrorist
    Attack on New York. GAO-05-269. Washington, D.C; March 30, 2005.

    Department of Homeland Security: A Comprehensive and Sustained Approach
    Needed to Achieve Management Integration. GAO-05-139. Washington, D.C;
    March 16, 2005.

    Homeland Security: Observations on the National Strategies Related to
    Terrorism. GAO-04-1075T. Washington, D.C.: September 22, 2004.

    Homeland Security: Effective Regional Coordination Can Enhance
    Emergency Preparedness. GAO-04-1009. Washington, D.C.: September 15,
    2004.

    Intelligence Reform: Human Capital Considerations Critical to 9/11
    Commission's Proposed Reforms. GAO-04-1084T. Washington, D.C.:
    September 14, 2004.

    9/11 Commission Report: Reorganization, Transformation, and
    Information Sharing. GAO-04-1033T. Washington, D.C.: August 3, 2004.

    The Chief Operating Officer Concept and its Potential Use as a Strategy
    to Improve Management at the Department of Homeland Security. GAO-04-
    876R. Washington, D.C.: June 28, 2004.

    Homeland Security: Communication Protocols and Risk Communication
    Principles Can Assist in Refining the Advisory System. GAO-04-682.
    Washington, D.C.: June 25, 2004.

    Transfer of Budgetary Resources to the Department of Homeland Security
    (DHS). GAO-04-329R. Washington, D.C.: April 30, 2004.

    Homeland Security: Selected Recommendations from Congressionally
    Chartered Commissions and GAO. GAO-04-591. Washington, D.C.: March 31,
    2004.

    Homeland Security: Information Sharing Responsibilities, Challenges,
    and Key Management Issues. GAO-03-1165T. Washington, D.C.: September
    17, 2003.

    Homeland Security: Information Sharing Responsibilities, Challenges,
    and Key Management Issues. GAO-03-715T. Washington, D.C.: May 8, 2003.

    FOOTNOTES

    [1] Examples of nonhomeland security functions include Coast Guard
    search and rescue and naturalization services.

    [2] GAO, Suggested Areas for Oversight for the 110th Congress,
    GAO-07-235R (Washington, D.C.: Nov. 17, 2006).

    [3] GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.:
    January 2003).

    [4] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.:
    January 2005) and GAO, High-Risk Series: An Update, GAO-07-310
    (Washington, D.C.: January 2007).

    [5] GAO-05-207 and GAO-07-310.

    [6] GAO, GAO's High-Risk Program, GAO-06-497T (Washington, D.C.: Mar.
    15, 2006) and GAO-07-310.

    [7] GAO, Major Management Challenges and Program Risks: Department of
    Homeland Security, GAO-03-102 (Washington, D.C.: January 2003).

    [8] Implemented Recommendations of the 9/11 Commission Act of 2007,
    Pub. L. No. 110-53, � 2405, 121 Stat. 266 (2007).

    [9] This report also addresses our mandate at section 477(d)(2) of the
    Homeland Security Act of 2002. Pub. L. No. 107-296, 116 Stat. 2135,
    2210-11.

    [10] Our subject matter experts are individuals within GAO who have
    directed and managed work related to the DHS mission and management
    areas.

    [11] We focused these mission areas primarily on DHS's homeland
    security-related functions. We did not consider the Secret Service,
    domestic counterterrorism, intelligence activities, or trade
    enforcement functions because (1) GAO and the DHS Office of Inspector
    General have completed limited work in these areas; (2) there are few,
    if any, requirements identified for the Secret Service's mission and
    for DHS's role in domestic counterterrorism and intelligence (the
    Department of Justice serves as the lead agency for most
    counterterrorism initiatives); and (3) we address DHS actions that
    could be considered part of domestic counterterrorism and intelligence
    in other areas, such as aviation security, critical infrastructure and
    key resources protection, and border security.

    [12] A performance goal is the target level of performance expressed as
    a tangible, measurable objective against which actual achievement will
    be compared. A performance measure can be defined as an indicator,
    statistic, or metric used to gauge program performance.

    [13] Pub. L. No. 108-458, 118 Stat. 3638 (2004).

    [14] Pub. L. No. 107-296, 116 Stat. 2135 (2002).

    [15] Pub. L. No. 107-295, 116 Stat. 2064 (2002).

    [16] Pub. L. No. 107-173, 116 Stat. 543 (2002).

    [17] Pub. L. No. 107-71, 115 Stat. 597 (2001).

    [18] We reviewed various effective practices reports for each
    management area. For acquisition management, we reviewed GAO, Best
    Practices: Taking a Strategic Approach Could Improve DOD's Acquisition
    of Services, GAO-02-230 (Washington, D.C.: Jan. 18, 2002); GAO, 2010
    Census: Census Bureau Generally Follows Selected Leading Acquisition
    Planning Practices, but Continued Management Attention Is Needed to
    Help Ensure Success, GAO-06-277 (Washington, D.C.: May 18, 2006); and
    GAO, A Framework for Assessing the Acquisition Function at Federal
    Agencies, GAO-05-218G (Washington, D.C.: September 2005). For financial
    management, we reviewed GAO, Financial Management Systems: DHS Has an
    Opportunity to Incorporate Best Practices in Modernization Efforts,
    GAO-06-553T (Washington, D.C.: Mar. 29, 2006). For human capital, we
    reviewed GAO, A Model of Strategic Human Capital Management,
    GAO-02-373SP (Washington, D.C.: Mar. 15, 2002); GAO, Managing for
    Results: Using Strategic Human Capital Management to Drive
    Transformational Change, GAO-02-940T (Washington, D.C.: July 15, 2002);
    GAO, Human Capital: A Self-Assessment Checklist for Agency Leaders,
    GAO/OCG-00-14G (Washington, D.C: September 2000); and GAO, Department
    of Homeland Security: Strategic Management of Training Important for
    Successful Transformation, GAO-05-888 (Washington, D.C.: Sept. 23,
    2005). For information technology, we reviewed GAO, Homeland Security:
    Progress Continues, but Challenges Remain on Department's Management of
    Information Technology, GAO-06-598T (Washington, D.C.: Mar. 29, 2006);
    GAO, Enterprise Architecture: Leadership Remains Key to Establishing
    and Leveraging Architectures for Organizational Transformation,
    GAO-06-831 (Washington, D.C.: Aug. 14, 2006); GAO, Department of
    Homeland Security: Formidable Information and Technology Management
    Challenge Requires Institutional Approach, GAO-04-702 (Washington,
    D.C.: Aug. 27, 2004); GAO, Maximizing the Success of Chief Information
    Officers, GAO-01-376G (Washington, D.C.: February 2001); and GAO,
    Improving Mission Performance through Strategic Information Management
    and Technology, GAO/AIMD-94-115 (Washington, D.C.: May 1994).

    [19] These 22 agencies, offices, and programs were U.S. Customs
    Service; U.S. Immigration and Naturalization Service; Federal
    Protective Service; Transportation Security Administration; Federal
    Law Enforcement Training Center; Animal and Plant Health Inspection
    Service; Office for Domestic Preparedness; Federal Emergency Management
    Agency; Strategic National Stockpile and the National Disaster Medical
    System; Nuclear Incident Response Team; Domestic Emergency Support
    Team; National Domestic Preparedness Office; Chemical, Biological,
    Radiological, and Nuclear Countermeasures Program; Environmental
    Measures Laboratory; National BW Defense Analysis Center; Plum Island
    Animal Disease Center; Federal Computer Incident Response Center;
    National Communication System; National Infrastructure Protection
    Center; Energy Security and Assurance Program; Secret Service; and U.S.
    Coast Guard.

    [20] The amounts reflect total budget authority amounts as reported to
    us by DHS. The amounts include annual and supplemental appropriations,
    rescissions, amounts reprogrammed or transferred, fee estimates, and
    mandatory amounts. The amounts do not reflect carryover or rescissions
    of unobligated balances.

    [21] See Pub. L. No. 109-295, �� 601-99, 120 Stat. 1355, 1394-1463
    (2006).

    [22] We did not include DHS's trade enforcement functions, such as
    export enforcement, in our review because we have completed limited
    work in this area.

    [23] DHS undertakes these efforts in accordance with the Immigration
    and Nationality Act of 1952, as amended. See generally 8 U.S.C. � 1101
    et seq.

    [24] The Stafford Act is codified as amended at 42 U.S.C. � 5121 et
    seq.

    [25] Other departments have major roles in critical infrastructure and
    key resource protection as well. For example, the Department of Defense
    is active in this mission area, primarily in areas of physical security
    of military and military-related activities, installations, and
    personnel. The Department of Energy's role involves the development and
    implementation of policies and procedures for safeguarding the nation's
    power plants, research labs, weapons production facilities, and cleanup
    sites from terrorists. The Department of Justice, primarily through
    work done by the Federal Bureau of Investigation and the Computer Crime
    and Intellectual Property Section of the Criminal Division, is active
    in this mission area in preventing, where possible, the exploitation of
    the Internet, computer systems, or networks as the principal
    instruments or targets of terrorist organizations.

    [26] The National Infrastructure Protection Plan defines the
    responsibility of Sector-Specific Agencies as to implement the plan's
    framework and guidance as tailored to the specific characteristics and
    risk landscapes of each of the critical infrastructure and key
    resources sectors designated in Homeland Security Presidential
    Directive 7.

    [27] Implemented Recommendations of the 9/11 Commission Act of 2007,
    Pub. L. No. 110-53, � 2405, 121 Stat. 266 (2007).

    [28] The performance expectations we identified for DHS in this report
    do not represent performance goals or measures for the department. We
    define performance expectations as a composite of the responsibilities
    or functions, derived from legislation, homeland security presidential
    directives and executive orders, DHS planning documents, and other
    sources, that the department is to address in implementing efforts in
    its mission and management areas.

    [29] The performance expectations we identified for DHS in this report
    do not represent performance goals or measures for the department. We
    define performance expectations as a composite of the responsibilities
    or functions, derived from legislation, homeland security presidential
    directives and executive orders, DHS planning documents, and other
    sources, that the department is to address in implementing efforts in
    its mission and management areas.

    GAO's Mission:

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting
    its constitutional responsibilities and to help improve the performance
    and accountability of the federal government for the American people.
    GAO examines the use of public funds; evaluates federal programs and
    policies; and provides analyses, recommendations, and other assistance
    to help Congress make informed oversight, policy, and funding
    decisions. GAO's commitment to good government is reflected in its core
    values of accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony:

    The fastest and easiest way to obtain copies of GAO documents at no
    cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
    weekday, GAO posts newly released reports, testimony, and
    correspondence on its Web site. To have GAO e-mail you a list of newly
    posted products every afternoon, go to [hyperlink, http://www.gao.gov]
    and select "Subscribe to Updates."

    Order by Mail or Phone:

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent
    of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
    more copies mailed to a single address are discounted 25 percent.
    Orders should be sent to:

    U.S. Government Accountability Office:
    441 G Street NW, Room LM:
    Washington, D.C. 20548:

    To order by Phone:
    Voice: (202) 512-6000:
    TDD: (202) 512-2537:
    Fax: (202) 512-6061:

    To Report Fraud, Waste, and Abuse in Federal Programs:

    Contact:

    Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
    E-mail: fraudnet@gao.gov:
    Automated answering system: (800) 424-5454 or (202) 512-7470:

    Congressional Relations:

    Gloria Jarmon, Managing Director, JarmonG@gao.gov:
    (202) 512-4400:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7125:
    Washington, D.C. 20548:

    Public Affairs:

    Susan Becker, Acting Manager, Beckers@gao.gov (202) 512-4400:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7125:
    Washington, D.C. 20548:

    *** End of document. ***