    Embassy Security: Upgrades Have Enhanced Security, but Site
    Conditions Prevent Full Adherence to Standards (18-JAN-08,
    GAO-08-162).

    Following the 1998 embassy bombings, the Department of State
    (State) determined that more than 85 percent of diplomatic
    facilities did not meet security standards and were vulnerable to
    terrorist attacks. State's Bureau of Overseas Buildings
    Operations (OBO) has undertaken a program to replace or upgrade
    the security of these facilities. As of 2007, OBO had constructed
    more than 50 new embassies and moved nearly 15,000 staff to safer
    facilities. However, most remaining facilities will not be
    replaced in the near term. To address these facilities, OBO has
    obligated about $140 million per year for its Compound Security
    Upgrade Program (CSUP). GAO was asked to (1) describe the process
    that OBO follows to prioritize and plan CSUP projects, including
    stakeholder involvement; (2) determine the extent to which CSUP
    projects met contracted cost and time frames and whether OBO has
    procedures to ensure security upgrades are installed; and (3)
    assess whether State's CSUP efforts have enhanced posts'
    abilities to comply with State's physical security standards. To
    address these objectives, GAO reviewed pertinent State documents,
    met with State officials in Washington, D.C., and overseas, and
    traveled to 11 posts in Latin America, Europe, and the Middle
    East. State provided written comments on a draft of this report
    and agreed with our findings.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-08-162
        ACCNO:   A79930
      TITLE:     Embassy Security: Upgrades Have Enhanced Security, but
    Site Conditions Prevent Full Adherence to Standards
         DATE:   01/18/2008
      SUBJECT:   Embassies
    	     Entry security
    	     Facility management
    	     Facility security
    	     Safety standards
    	     Security assessments
    	     Security policies
    	     Security regulations
    	     Security threats
    	     Strategic planning
    	     Terrorists
    	     Compound Security Upgrade Program

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-08-162

         * [1]Results in Brief
         * [2]Background
         * [3]CSUP Planning Process Balances Security Needs of Posts and I

              * [4]OBO Planning Reflects DS Security Analysis and Input from Po
              * [5]DS Priority Assessments Focus on Main Compounds, but Efforts
              * [6]OBO Has Taken Steps to Conduct More Comprehensive Needs Asse

         * [7]CSUP Projects Generally Completed within Contractual Time Fr
         * [8]CSUP Has Enhanced Physical Security, but Site Conditions at
         * [9]Agency Comments and Our Evaluation
         * [10]Appendix I: Scope and Methodology
         * [11]Appendix II: Comments from the Department of State
         * [12]Appendix III: GAO Contact and Staff Acknowledgments

              * [13]GAO Contact
              * [14]Staff Acknowledgments

         * [15]Related GAO Products

              * [16]Order by Mail or Phone

    Report to the Ranking Member, Committee on Oversight and Government
    Reform, House of Representatives

    United States Government Accountability Office

    GAO

    January 2008

    EMBASSY SECURITY

    Upgrades Have Enhanced Security, but Site Conditions Prevent Full
    Adherence to Standards

    GAO-08-162

    Contents

    Letter 1

    Results in Brief 2
    Background 4
    CSUP Planning Process Balances Security Needs of Posts and Includes Input
    from Stakeholders 8
    CSUP Projects Generally Completed within Contractual Time Frames and
    Costs, and OBO Has Project Management Procedures to Help Ensure Completion
    11
    CSUP Has Enhanced Physical Security, but Site Conditions at Many Posts
    Limit Ability to Adhere to All Security Standards 14
    Agency Comments and Our Evaluation 18
    Appendix I Scope and Methodology 20
    Appendix II Comments from the Department of State 22
    Appendix III GAO Contact and Staff Acknowledgments 24
    Related GAO Products 25

    Figures

    Figure 1: Key Security Measures at a Notional Embassy Compound 7
    Figure 2: CSUP Project Timeliness, Cost, and Contract Modifications 12
    Figure 3: A New CAC Facility 15
    Figure 4: A New Fence, Bollards, and Concrete Planters 16
    Figure 5: A Post with Insufficient Setback 18

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. The published product may be reproduced
    and distributed in its entirety without further permission from GAO.
    However, because this work may contain copyrighted images or other
    material, permission from the copyright holder may be necessary if you
    wish to reproduce this material separately.

    Abbreviations

    CAC: compound access control:
    CSUP: Compound Security Upgrades Program:
    DS: State Department's Bureau of Diplomatic Security:
    NEC: New Embassy Compound:
    OBO: State Department's Bureau of Overseas Buildings Operations:

    United States Government Accountability Office
    Washington, DC 20548

    January 18, 2008

    The Honorable Tom Davis:
    Ranking Member:
    Committee on Oversight and Government Reform:
    House of Representatives:

    Dear Mr. Davis:

    Following the 1998 embassy attacks in East Africa, the Department of State
    (State) determined that more than 85 percent of diplomatic facilities
    overseas did not meet security standards at that time and were vulnerable
    to terrorist attacks. Since then, State has worked with other agencies
    that operate overseas to enhance security standards and State's Bureau of
    Overseas Buildings Operations (OBO) has undertaken a major program to
    replace or upgrade these facilities to comply with security standards. As
    of the end of fiscal year 2007, OBO constructed more than 50 new
    facilities and moved nearly 15,000 staff to safer work facilities at a
    cost of more than $5.9 billion.^1 However, most remaining overseas
    diplomatic office facilities will not be replaced in the near term. To
    address security deficiencies at these facilities, OBO has obligated
    approximately $140 million per year for its Compound Security Upgrade
    Program (CSUP), which aims to enhance physical security protection for
    vulnerable facilities until they are replaced by improving perimeter
    security measures and installing forced entry/ballistic resistant doors
    and windows, among other security upgrades.^212 At posts where OBO does
    not plan to replace the embassy facility, CSUP aims to enhance physical
    security protection to the extent possible given the nature of the
    facility and the risks identified. Following the 1998 embassy attacks in
    East Africa, the Department of State (State) determined that more than 85
    percent of diplomatic facilities overseas did not meet security standards
    at that time and were vulnerable to terrorist attacks. Since then, State
    has worked with other agencies that operate overseas to enhance security
    standards and State's Bureau of Overseas Buildings Operations (OBO) has
    undertaken a major program to replace or upgrade these facilities to
    comply with security standards. As of the end of fiscal year 2007, OBO
    constructed more than 50 new facilities and moved nearly 15,000 staff to
    safer work facilities at a cost of more than $5.9 billion. However, most
    remaining overseas diplomatic office facilities will not be replaced in
    the near term. To address security deficiencies at these facilities, OBO
    has obligated approximately $140 million per year for its Compound
    Security Upgrade Program (CSUP), which aims to enhance physical security
    protection for vulnerable facilities until they are replaced by improving
    perimeter security measures and installing forced entry/ballistic
    resistant doors and windows, among other security upgrades. At posts where
    OBO does not plan to replace the embassy facility, CSUP aims to enhance
    physical security protection to the extent possible given the nature of
    the facility and the risks identified.

    In this report, we (1) describe the process that OBO follows to prioritize
    and plan CSUP projects, including stakeholder involvement; (2) determine
    the extent to which CSUP projects met contracted cost and time frames and
    whether OBO has procedures to ensure security upgrades are In this report,
    we (1) describe the process that OBO follows to prioritize and plan CSUP
    projects, including stakeholder involvement; (2) determine the extent to
    which CSUP projects met contracted cost and time frames and whether OBO
    has procedures to ensure security upgrades are installed; and (3) assess
    whether State's CSUP efforts have enhanced posts' ability to comply with
    State's physical security standards.

    ^1We reviewed OBO's progress with new embassy construction and other
    efforts to enhance the security of U.S. personnel overseas in earlier
    reports. See Related GAO Products.

    ^2State incorporates physical security standards in its "Foreign Affairs
    Handbook" and "Foreign Affairs Manual."

    To address these objectives, we reviewed State prioritization and planning
    documents concerning the assignment of post threat levels, assessments of
    the security vulnerabilities of posts, and project planning procedures. We
    also reviewed contracting documentation for select CSUP projects to assess
    their timeliness and cost. Our scope included all 47 projects contracted
    since fiscal year 2004, completed by the end of fiscal year 2007, and
    valued at $1 million or more and, therefore, excluded smaller projects
    such as those designed to enhance the security of schools and other
    non-U.S. government properties frequented by U.S. personnel and their
    dependents.^3 We assessed the impact of these projects on physical
    security conditions at posts based on the security standards set forth in
    State's "Foreign Affairs Handbook" and "Foreign Affairs Manual." We
    discussed CSUP with officials from OBO and State's Bureau of Diplomatic
    Security (DS) in Washington, D.C., and with post officials and contractors
    overseas. We traveled to 11 posts in Latin America, Europe, and the Middle
    East. We selected these countries to ensure regional coverage, a range of
    project types, and a mix of ongoing and completed projects. We are not
    naming the specific countries we visited for this review due to security
    concerns.

    We conducted this performance audit from November 2006 through January
    2008, in accordance with generally accepted government auditing standards.
    Those standards require that we plan and perform the audit to obtain
    sufficient, appropriate evidence to provide a reasonable basis for our
    findings based on our audit objectives. We believe that the evidence
    obtained provides a reasonable basis for our findings based on our audit
    objectives. (See app. I for a more complete description of our scope and
    methodology.)

    Results in Brief

    OBO has a threat- and vulnerability-based process for determining which
    posts receive a CSUP project each year and a project planning process to
    develop each CSUP project, utilizing input from DS and post personnel. OBO
    prioritizes which posts will receive upgrades based in part on assessments
    from DS of the threat levels and physical security conditions at each
    post. However, the DS physical security assessment is currently based on
    the physical security needs of the post's main compound, even though there
    are hundreds of post facilities located outside the main embassy or
    consulate compound. DS is developing a risk-based prioritization process
    that will factor in the number of personnel, threat levels, and
    vulnerabilities at each facility, including off-compound facilities. After
    State receives its budget appropriation, OBO decides where it will install
    CSUP upgrades based on its priority list. As OBO moves into the design and
    construction phase of individual projects, it consults with security and
    facilities management officials at the posts. In recent years, OBO has
    improved its project planning processes by conducting a comprehensive
    survey of the physical security needs of posts, including off-compound
    facilities, early in the planning phase.

    ^3We reviewed State's efforts to protect U.S. officials and citizens
    outside of embassies in earlier reports, including: GAO, Overseas
    Security: State Department Has Not Fully Implemented Key Measures to
    Protect U.S. Officials from Terrorist Attacks Outside of Embassies,
    [17]GAO-05-642 (Washington, D.C.: May 9, 2005).

    Most CSUP projects have been completed within 30 days of their contractual
    completion date and for the contracted cost, and OBO has project
    management procedures to help ensure that contractors complete the work
    called for in the contracts. However, OBO found it necessary to modify all
    but one of the contracts to extend project completion dates, adjust costs,
    or both. In reviewing schedule performance data for 47 projects undertaken
    since 2004, we found that 96 percent of projects were completed within 30
    days of their contractual completion date. However, OBO modified 81
    percent of the 47 contracts to extend their completion dates by an average
    of almost 4 months. In reviewing cost data, we found that while OBO paid
    the contractors the amount specified in the fixed-price contracts, at an
    average project cost of $2.6 million, contract modifications resulted in
    cost adjustments to all but two of the contracts. OBO increased the total
    cost of three-quarters of the projects an average of 17 percent and
    decreased the remaining quarter of the projects an average of 5 percent--a
    net increase of $10 million for all 47 projects. Past GAO assessments of
    government construction projects found that for renovations of existing
    facilities such cost variances were not uncommon. OBO cited factors
    outside the contractor's control as the cause of most of the delays and
    cost increases, such as unusually lengthy local permitting processes and
    design changes made during construction work. For example, when OBO
    increased the scope of work of a CSUP project to include a new compound
    access control (CAC) facility, it modified the contract to compensate the
    contractor an additional $874,000. To help ensure that security upgrades
    contracted for are completed and enhance posts' compliance with physical
    security standards, OBO assigns a project manager who is responsible for
    the effective completion of the project and relies on a mix of regional
    and post officials to provide additional on-site monitoring. At the 11
    posts we visited, the upgrades contracted for had been or were being
    installed.

    Completed CSUP projects have generally enhanced posts' compliance with
    physical security standards at 47 embassies and consulates, but many of
    these posts continue to face physical security deficiencies that cannot be
    addressed without building a new facility. CSUP security enhancements at
    these posts have encompassed constructing compound access control
    facilities at the perimeter of the compounds at 25 posts; building safe
    areas for post officials in case of attack at 25 posts; and improving
    compound walls, fencing, and barriers at 22 posts. At the 11 posts we
    visited, we found the CSUP projects had enhanced posts' compliance with
    State's physical security standards as detailed in the "Foreign Affairs
    Handbook" and "Foreign Affairs Manual." Specifically, the projects
    replaced perimeter fencing to meet anti-climb requirements, installed
    bollards^4 and barriers at key points to meet anti-ram requirements, built
    safe areas for post officials in case of attack, and replaced or enhanced
    pedestrian and vehicle access points to the posts. However, because of
    site conditions that were outside the scope of the physical security
    upgrade projects, we found that none of the posts we visited were in full
    compliance with all of State's physical security standards.^5 For example,
    more than one post's location in a dense urban area prevented it from
    achieving a 100-foot setback from the street, a key security standard,
    while older structures at some posts were not able to support forced
    entry/ballistic resistant windows. As a result, many buildings and their
    occupants may remain vulnerable to attack.

    The Department of State provided written comments on a draft of this
    report, which are reproduced in appendix II. State agreed with our
    findings, noting that the report accurately describes State's CSUP
    efforts. State also provided us with technical suggestions and
    clarifications that we have addressed in this report, as appropriate.

    Background

    In response to various attacks, State has continually assessed and updated
    its security standards and physical security measures at posts around the
    world. After the 1998 embassy bombings in Nairobi, Kenya, and Dar es
    Salaam, Tanzania, State initiated the Capital Security Construction
    program (also referred to as the New Embassy Compound [NEC] program), a
    multiyear effort to replace approximately 200 facilities with new
    facilities that meet State's updated security standards. As of the end of
    fiscal year 2007, State had obligated more than $5.9 billion for this
    program, awarded contracts for the construction of 78 new embassy and
    consulate compounds, and completed more than 50 new facilities. State
    currently plans to contract for 80 more new facilities through 2014.

    ^4A bollard is one of a series of short posts for excluding or diverting
    motor vehicles from entering an area.

    ^5State's "Foreign Affairs Handbook" and "Foreign Affairs Manual"
    recognize that the standards apply to existing office buildings only to
    the maximum extent feasible or practicable.

    To complement its efforts to move overseas U.S. government employees into
    more secure facilities, State initiated efforts to enhance physical
    security at existing facilities. After the 1998 embassy bombings, State
    initiated a new physical security upgrades program called the World-Wide
    Security Upgrade Program, which focused on enhancing perimeter security
    measures. In response to the September 11 terrorist attacks, State focused
    on ensuring that embassies and consulates had adequate safe areas for
    staff in case of an attack on the facilities. Since 2004, State has taken
    a more comprehensive approach to physical security upgrades by reviewing
    the entire range of physical security needs at posts through CSUP. State
    has identified the following four goals for CSUP:

               o to provide physical security protection to the extent practical
               for existing facilities;
               o to provide physical security upgrades to meet current security
               standards for those facilities that will not be replaced by a NEC
               in the near-term;
               o to initiate physical security upgrades at facilities that are
               not part of the chancery compound, including annexes, public
               diplomacy facilities, and warehouses; and
               o to provide security upgrades to nongovernmental facilities
               ("soft targets") frequented by U.S. citizens.

               From fiscal year 1999 through 2007, State had obligated more than
               $1.2 billion for security upgrades. Since fiscal year 2004 and the
               initiation of CSUP, OBO has undertaken approximately 55 major
               projects costing over $1 million that enhance physical security at
               posts that are not going to be replaced with a new facility in the
               near future, if at all. OBO's Long-Range Overseas Buildings Plan
               calls for it to undertake an average of 13 major CSUP projects per
               year through 2012. CSUP provides several categories of security
               upgrades to help posts meet physical security standards, such as
               perimeter security measures (including anti-climb walls, fences,
               compound access control facilities, bollards, cameras, and
               security lighting); forced entry/ballistic resistant doors and
               windows; safe areas for U.S. personnel in case of emergency; and
               stand-alone mail screening facilities. In addition, OBO has
               obligated approximately $58 million per year of CSUP funds for
               minor post-managed security upgrade projects, such as minor
               residential security upgrades, maintenance, repair, and
               replacement of existing forced entry/ballistic resistant doors and
               windows, and modular mail screening facilities.

               The Overseas Security Policy Board, which includes representatives
               from more than 20 U.S. intelligence, foreign affairs, and other
               agencies, is responsible for considering, developing, and
               promoting security policies and standards that affect U.S.
               government agencies under the authority of the Chief of Mission at
               a post. This responsibility includes reviewing and issuing uniform
               guidance on physical security standards for embassies, consulates,
               and other overseas office space. State incorporates the board's
               physical security standards in its "Foreign Affairs Handbook" and
               "Foreign Affairs Manual." With respect to existing office
               buildings, the standards apply to the maximum extent feasible or
               practicable.^6

               State has identified five key Overseas Security Policy Board
               standards to protect overseas diplomatic office facilities against
               terrorism and other dangers (see fig. 1).

    ^612 F.A.M. 311.2.

    Figure 1: Key Security Measures at a Notional Embassy Compound

    First, the Secure Embassy Construction and Counterterrorism Act of 1999^7
    requires that office facilities be at least 100 feet from uncontrolled
    areas, such as a street where vehicles can pass without being checked by
    security officials. This distance is meant to help protect the buildings
    and occupants against threats such as bomb blasts. Second, State requires
    high perimeter walls or fences that are difficult to climb, thereby
    deterring those who might attack the compound on foot. Third, State
    requires anti-ram barriers to ensure that vehicles cannot breach the
    facility perimeter to get close to the building and detonate a bomb. The
    fourth standard requires blast-resistant construction techniques and
    materials. These materials include reinforced concrete and steel
    construction and blast-resistant windows. Coupled with a 100-foot setback,
    blast-resistant construction provides the best possible protection against
    vehicle bomb attack, according to DS officials. State's fifth security
    standard is controlled access of pedestrians and vehicles at the perimeter
    of a compound. Compound access control facilities allow guards to screen
    personnel and visitors before they enter the compound to verify that they
    have legitimate business at the embassy or consulate and that they bring
    nothing onto the compound that could be potentially harmful or used to
    surreptitiously gather intelligence. Similarly, the facilities allow
    guards to search vehicles before they are permitted to enter the compound.

    ^722 U.S.C. 4865(a)(3)(A).

    CSUP Planning Process Balances Security Needs of Posts and Includes Input from
    Stakeholders

    OBO has a threat- and vulnerability-based planning process for its CSUP
    projects that includes input from DS's analysis of security threats and
    vulnerabilities and from post officials. The DS analysis currently focuses
    on embassy and consulate compounds, though DS is developing a risk-based
    prioritization process that considers the number of personnel, threats,
    and vulnerabilities at each facility, including off-compound facilities.
    OBO has improved its process for developing projects by conducting more
    comprehensive needs assessments of posts, including off-compound
    facilities, early in the design phase.

    OBO Planning Reflects DS Security Analysis and Input from Post

    OBO prioritizes which posts will receive upgrades based in part on
    assessments from DS of the physical security conditions and threat levels
    at each post. Each year, DS ranks all 262 posts based on their threat
    levels and vulnerabilities. With input from posts' security officers and
    the intelligence community, DS determines the threat level for terrorism
    and political violence. DS also determines the vulnerabilities of each
    post in several categories, including protection from chemical and
    biological attack, seismic and blast resistance, the strength of the
    construction and fac,ade, and the amount of setback. Once these
    determinations are made, DS ranks the posts.^8 The resulting list of
    rankings is used by OBO and other stakeholders to plan NEC projects.

    For CSUP planning, posts that are scheduled for an NEC project within the
    next 2 to 3 years are removed from the list, and DS and OBO reevaluate the
    list, factoring in the number of people at post, to create a priority list
    for CSUP projects. OBO then modifies the list to balance various factors.
    First, OBO removes facilities that cannot be further upgraded, such as
    many leased facilities. Second, OBO adds facilities that may have been
    removed, such as vulnerable off-compound facilities at posts where NEC
    projects are planned. Third, OBO has security engineers conduct a thorough
    assessment of each post's needs. Fourth, OBO alters the list to account
    for external factors, such as difficulty getting a host government's
    approval on a project, which would move a project down the list. Finally,
    OBO develops its 6-year list of CSUP projects based on expected funds and
    places these projects in the Long-Range Overseas Buildings Plan. If OBO
    experiences budget constraints, it will delay projects--moving future
    projects to subsequent fiscal years--rather than reduce their scope,
    according to State officials.

    Once a project is placed on the Long-Range Overseas Buildings Plan, an OBO
    team undertakes an assessment visit to the post to determine what the
    project should include. OBO consults with DS and the post and reviews
    Office of Inspector General security inspections in order to determine the
    scope of the project. One year prior to a project's start date, OBO then
    develops an initial planning survey in which OBO seeks agreement between
    its engineers and the post's Regional Security Officer. The initial
    planning survey is then sent in draft form for approval by OBO and post
    officials, including the Regional Security Officer, administrative
    officer, and facilities manager. Once this process is completed, OBO works
    with its contract design firm to develop conceptual design plans. State's
    contracting offices use these plans to advertise for bids to complete the
    design and construct the improvements using a design-build contract.^9
    After a firm has been awarded the contract, it will develop and submit
    interim and then final plans for OBO's review. OBO consults with post
    officials, including the Regional Security Officer, in reviewing the
    designs to help ensure that proposed upgrades meet each post's security
    needs before giving the firm authorization to proceed with construction.

    ^8We did not assess State's methodology for determining posts' threat
    levels and vulnerabilities or the formula it uses to determine actual post
    rankings, as this was beyond the scope of our assignment.

    ^9The design-build contract delivery method reduces project cycle time by
    combining design and construction in a single contract award and may allow
    contractors to begin construction before the building design is complete.

    DS Priority Assessments Focus on Main Compounds, but Efforts Are Being Made to
    Address All Post Facilities

    According to OBO and DS officials, the DS physical security assessment is
    currently based on the physical security needs of each post's main
    compound but does not factor in the security of facilities located outside
    the main embassy or consulate compound, even though hundreds of such
    facilities exist. We noted that, in several cases, these off-compound
    facilities lacked required physical security measures. For example, we
    found that one post compound, following the conclusion of its CSUP
    project, met most security standards, but a nearby off-compound office
    facility did not have setback, blast-resistant walls and windows, a
    controlled access facility for pedestrians and vehicles, a safe area, and
    other security features.

    OBO and DS are currently working to better address the needs of all
    facilities, including the hundreds of annexes located off compound, and
    improve CSUP project prioritization. OBO officials commented that newer
    projects take into account the needs of all facilities at a post, whether
    they are on compound or not. For example, at one post we visited, we saw a
    CSUP project for an off-compound office facility. Moreover, DS is
    developing a new risk-based process to prioritize CSUP projects that will
    rate the vulnerabilities of each overseas building with office space,
    including annexes, and factor in the number of personnel and threat levels
    to better set priorities. According to a DS official, the formula needs to
    be validated and, if successful, staff needs to be trained on its use
    before beginning implementation. State expects to complete these steps by
    March 2008.

    OBO Has Taken Steps to Conduct More Comprehensive Needs Assessments during
    Project Design

    OBO is taking additional steps to more comprehensively address post
    security needs and improve CSUP planning processes. According to OBO, CSUP
    initially focused on perimeter security, but as new standards have been
    put in place and perimeter projects completed, the program has broadened
    its focus to ensure that posts meet all physical security standards to the
    extent feasible. For example, in 2004, terrorists rushed on foot past the
    barriers blocking a car being inspected at the vehicular gate of the
    consulate in Jeddah, Saudi Arabia. In response, State began to install
    additional fencing and a secondary gate, called a man trap, at vehicle
    entry points at posts to prevent attackers on foot from accessing the
    compounds. Moreover, the Overseas Security Policy Board is currently
    considering the addition of a new security standard requiring man traps.
    In addition, OBO officials noted that they meet monthly to improve
    processes for project planning and execution, including those involving
    CSUP. One result of these meetings has been a decision to conduct OBO's
    initial planning surveys earlier in the design process to gain a better
    understanding of post's security needs. Another result of these meetings
    is that OBO created a more comprehensive survey instrument to better
    identify all vulnerabilities at the post for consideration in the CSUP
    project.

    CSUP Projects Generally Completed within Contractual Time Frames and Costs, and
    OBO Has Project Management Procedures to Help Ensure Completion

    While most CSUP projects we reviewed have been completed within their
    contractual time frames and costs, OBO found it necessary to modify all
    but one of the contracts to extend project time frames, adjust costs, or
    both. Since the beginning of fiscal year 2004, OBO has contracted for 47
    projects valued at $1 million or more that were subsequently completed by
    September 30, 2007. In reviewing schedule performance data, we found that
    96 percent of projects were completed within 30 days of their contractual
    completion date (see fig. 2). However, we found that OBO modified the
    contracts to extend their completion dates for 81 percent of the projects.
    On average, OBO extended the contracts by 4 months--an average increase of
    26 percent.^10 Many of these extensions did not result in increased costs
    to the government.

    ^10For one project, the modification documents are awaiting final
    approval; therefore, the completion date and cost modifications are not
    factored into this calculation.

    Figure 2: CSUP Project Timeliness, Cost, and Contract Modifications

    ^aTimeliness was measured against contractual obligations, including
    modifications. Total does not equal 100 due to rounding.

    ^bTotal does not equal 100 due to rounding.

    ^cThis project has a pending modification for both completion date and
    cost.

    For each of the 47 projects, OBO paid the contractor the amount specified
    in the fixed-price contracts--an average project cost of $2.6 million. In
    reviewing cost data, we found that OBO increased the contract cost for 34
    projects, at an average increase of 17 percent, and decreased the contract
    cost for 11 projects, at an average decrease of 5 percent (see fig. 2).
    The net change in the cost of the 47 projects was an increase of $10
    million. Cost increases were generally due to changes in the scope of the
    projects, while cost decreases were generally due to a reduction in
    expected local tax costs. Our past assessments of domestic government
    renovation projects found that work on existing facilities presented a
    number of difficulties and challenges, making renovations especially
    susceptible to cost increases stemming from unexpected conditions.^11 We
    found that, for such projects, government agencies generally budget 5 to
    15 percent of project cost for unexpected changes.

    OBO cited factors outside the contractor's control as the cause of most of
    the delays and cost increases, such as unusually lengthy local permitting
    processes, previously unidentified underground utilities that needed to be
    moved, design changes that OBO made during construction work, and project
    changes requested by the post. For example, OBO extended the deadline 10
    months for completion of perimeter fencing upgrades and a new CAC facility
    at a U.S. consulate in Asia because of delays in receiving approval from
    local authorities to proceed with the work. In addition, in response to a
    request from officials at a U.S. embassy in Europe, OBO added to the scope
    of the planned CSUP project, including a new CAC facility, and modified
    the contract to pay the contractor an additional $874,000 for the added
    work. However, in cases where OBO found that contractor error was the
    cause of a delay or cost increase, OBO held the contractor accountable.
    For example, at a U.S. mission in Europe, OBO found instances where the
    contractor's work did not conform to contract specifications and required
    the contractor to redo the work. OBO did not compensate the contractor for
    the additional costs associated with replacing the substandard work.
    Similarly, at a U.S. consulate in Europe, the contractor was more than 6
    months late in completing the security upgrades; OBO, therefore, assessed
    the contractor a penalty of almost $60,000.

    ^11GAO, Kennedy Center: Stronger Oversight of Fire Safety Issues,
    Construction Projects, and Financial Management Needed, [18]GAO-05-334
    (Washington, D.C.: Apr. 22, 2005).

    OBO has project management procedures to help ensure the security upgrades
    it contracted for are completed and have enhanced posts' compliance with
    physical security standards. For each CSUP project, OBO assigns a project
    manager who is responsible for the effective completion of the project.
    However, because CSUP projects are generally small and OBO has limited
    resources, project managers are not usually able to be on site full time
    during the project. Project managers visit posts to ensure the work
    contracted for is being done and, in many cases, rely on post officials,
    including the Regional Security Officers and facility managers, to provide
    additional monitoring of the work. In our visits to 11 posts, we found
    that, in most cases, the work called for in the projects had been done or
    was under way. However, at one location, we found that one component of
    the project--strengthening the room where the post's emergency generator
    is located--was removed from the scope of the project because, according
    to post officials, it would have unexpectedly required creating new office
    space to relocate people during the work, adding costs that could not be
    covered by the CSUP budget. OBO decided to remove this work from the scope
    of the project and initiate a new project in the future to address this
    physical security need.

    CSUP Has Enhanced Physical Security, but Site Conditions at Many Posts Limit
    Ability to Adhere to All Security Standards

    Completed CSUP projects have achieved their objective of enhancing the
    security at posts by bringing posts in better compliance with security
    standards. Major CSUP projects have enhanced physical security at 47
    embassies and consulates since fiscal year 2004, and OBO currently expects
    to complete all major CSUP projects, barring extensive changes to current
    security standards or expected funding, by 2018. CSUP security
    enhancements have encompassed constructing compound access control
    facilities at the perimeter of the compounds at 25 posts (see fig. 3 for
    an example); building safe areas for post officials in case of attack at
    25 posts; improving compound walls, fencing, and barriers at 22 posts (see
    fig. 4 for examples); and strengthening the interior walls and doors that
    create a "hard line" that separates American staff from visitors at 8
    posts.

    Figure 3: A New CAC Facility

    Figure 4: A New Fence, Bollards, and Concrete Planters

    At the 11 posts we visited with ongoing or completed CSUP projects, we
    found that the projects had enhanced posts' compliance with State's
    physical security standards as detailed in the "Foreign Affairs Handbook"
    and "Foreign Affairs Manual." The projects we viewed added or enhanced
    pedestrian and vehicle access points, replaced perimeter fencing to meet
    anti-climb requirements, installed bollards and barriers at key points to
    meet anti-ram requirements, built safe areas for post officials in case of
    attack, enhanced the hard line separating post employees from visitors,
    and installed forced entry/ballistic-resistant windows and doors.

    Nevertheless, without building a new facility, many posts are unable to
    meet all security standards for a variety of reasons beyond the scope of
    CSUP. We found that none of the posts we visited adhered fully with
    current security standards because of conditions that were outside the
    scope of CSUP projects.^12 For example, most of the posts we visited were
    located in dense urban areas that prevented them from achieving a 100-foot
    setback from the street, one of the key security standards (see fig. 5 for
    an example). OBO and DS officials acknowledged that, at many locations, it
    is not feasible to increase the setback by acquiring land and closing off
    nearby streets. In other cases, officials stated the buildings themselves
    were not structurally capable of handling heavy forced
    entry/ballistic-resistant windows or other upgrades. And in other cases,
    officials commented that host nations or cities would not allow certain
    upgrades to be implemented, such as removing trees to create a clear zone
    around the embassy or changing the facade of historic buildings. Finally,
    current plans for the NEC program do not include the replacement of 61 of
    262 embassies and consulates. Several of these facilities were built after
    physical security standards were strengthened in response to terrorist
    attacks against U.S. facilities in Beirut, Lebanon, in the 1980s. State
    officials acknowledged that other facilities may not be replaced due to
    cost and political concerns. As a result, many buildings and their
    occupants may remain vulnerable to attack.

    ^12When an upgrade project cannot meet security standards due to site
    location and other factors, OBO and DS seeks the appropriate waivers and
    exceptions to ensure that the process has been fully vetted by
    stakeholders.

    Figure 5: A Post with Insufficient Setback

    Agency Comments and Our Evaluation

    The Department of State provided written comments on a draft of this
    report, which are reproduced in appendix II. State agreed with our
    findings, noting that the report accurately describes State's CSUP
    efforts. State also provided us with technical suggestions and
    clarifications that we have addressed in this report, as appropriate.

    As agreed with your office, unless you publicly announce the contents of
    this report earlier, we plan no further distribution until 30 days from
    the report date. At that time, we will send copies of this report to
    interested Members of Congress and the Secretary of State. We also will
    make copies available to others upon request. In addition, the report will
    be available at no charge on the GAO Web site at [19]http://www.gao.gov .

    If you or your staff have any questions about this report, please contact
    Charles Michael Johnson, Jr., at (202) 512-7331 or [20]johnsoncm@gao.gov .
    Contact points for our Office of Congressional Relations and Public
    Affairs may be found on the last page of this report. GAO staff who made
    major contributions to this report are listed in appendix III.

    Sincerely yours,

    Charles Michael Johnson, Jr., Acting Director, International Affairs and
    Trade

    Appendix I: Scope and Methodology

    To discuss the factors that the Bureau of Overseas Buildings Operations
    (OBO) considers as it plans and prioritizes Compound Security Upgrades
    Program (CSUP) projects, we reviewed Department of State (State)
    prioritization and planning documents concerning the assignment of post
    threat levels, assessments of the security vulnerabilities of posts, and
    CSUP. We discussed CSUP prioritization and planning, as well as changes to
    those processes in response to recent attacks, with officials from OBO and
    State's Bureau of Diplomatic Security (DS) in Washington, D.C, and
    overseas, including post officials, including Deputy Chiefs of Mission,
    Regional Security Officers, facilities managers, and General Services
    Officers, and with contractors overseas. In addition, we reviewed past GAO
    audit work on related issues. (See Related GAO Products at the end of this
    report.) To help confirm the accuracy of our analysis, we discussed our
    findings with State personnel involved in CSUP.

    To assess the extent to which CSUP projects met cost and schedule
    projections, we analyzed data that OBO provided specifically for the
    purposes of our review. Our scope included all 47 projects contracted
    since fiscal year 2004, completed by the end of fiscal year 2007, and
    valued at $1 million or more and, therefore, excluded smaller projects
    such as those designed to enhance the security of schools and other
    non-U.S. government properties frequented by U.S. personnel and their
    dependents. For each CSUP project, OBO provided data on the originally
    contracted completion date and cost, the modifications to the contracted
    completion date and cost, and the actual date of substantial completion
    and final contract cost for completed projects. We reviewed contracting
    documents to verify that the data were sufficiently reliable for the
    purposes of this report. To assess the extent to which CSUP projects
    included the security upgrades called for in the contract, we reviewed
    OBO's project management procedures. We interviewed project managers in
    Washington, D.C., and facilities managers, administrative officers, and
    regional security officers at 11 posts to verify the role and
    responsibilities of the project managers. We also inspected the ongoing or
    completed CSUP work at these posts to verify that the projects encompassed
    all of the security upgrades called for under the contract.

    To review the extent to which State's CSUP efforts have enhanced posts'
    ability to comply with State's physical security standards, we reviewed
    the project authorization memoranda, contract modifications, and OBO
    summary document on each of the 47 CSUP projects. These documents allowed
    us to identify the type of physical security upgrades that were installed
    at all 47 facilities. We discussed over 50 completed, ongoing, and planned
    projects with OBO officials. To confirm our initial findings, we traveled
    to 11 posts in Latin America, Europe, and the Middle East that had
    recently completed or ongoing CSUP projects. We selected these countries
    to ensure regional coverage, a range of project types, and a mix of
    ongoing and completed projects; however, as this was not a generalizeable
    sample, our findings do not necessarily apply to all posts. We are not
    naming the specific countries we visited for this review due to security
    concerns. We developed a physical security needs checklist based upon
    State's "Foreign Affairs Handbook," "Foreign Affairs Manual," and OBO's
    own needs assessment documentation. We applied our checklist consistently
    at all 11 posts. Our checklist did not, however, attempt to assess State's
    procedures for utilizing physical security upgrades. For example, the
    checklist did not assess whether posts use new CACs properly to screen
    vehicles or people. At each post, we conducted a review of the security
    needs and received briefings on the recently completed, ongoing, or
    planned CSUP projects. We met with relevant post personnel, including
    Deputy Chiefs of Mission, Regional Security Officers, facilities managers,
    and General Services Officers, as well as contractors to discuss the
    physical security needs at post, CSUP project management and
    implementation, and post-specific limitations to receiving certain
    physical security upgrades.

    We conducted this performance audit from November 2006 through January
    2008, in accordance with generally accepted government auditing standards.
    Those standards require that we plan and perform the audit to obtain
    sufficient, appropriate evidence to provide a reasonable basis for our
    findings based on our audit objectives. We believe that the evidence
    obtained provides a reasonable basis for our findings based on our audit
    objectives.

    Appendix II: Comments from the Department of State

    United States Department of State:
    Assistant Secretary for Resource Management and Chief Financial
    Officer:
    Washington, D, C. 20520:

    December 19, 2007:

    Ms. Jacquelyn Williams-Bridgers:
    Managing Director:
    International Affairs and Trade:
    Government Accountability Office:
    441 G Street, N.W.:
    Washington, D.C. 20548-0001:

    Dear Ms. Williams-Bridgers:

    We appreciate the opportunity to review your draft report, "Embassy
    Security: Upgrades Have Enhanced Security, but Site Conditions Prevent
    Full Adherence to Standards," GAO Job Code 320456.

    The enclosed Department of State comments are provided for
    incorporation with this letter as an appendix to the final report.

    If you have any questions concerning this response, please contact
    Paula Harrison, Program Analyst, Bureau of Overseas Building
    Operations, at (703) 875-5128.

    Sincerely,

    Signed by:

    Bradford R. Higgins:
    cc: GAO � Michael Courts:
    OBO � Gen. Charles Williams State/OIG � Mark Duda:

    Department of State Comments on GAO Draft:

    Embassy Security: Upgrades Have Enhanced Security, but Site Conditions
    Prevent Full Adherence to Standards (GAO-08-162, GAO Code 320456):

    Thank you for giving the Department the opportunity to comment on GAO's
    report concerning the Compound Security Upgrade Program (CSUP). We
    appreciate your interest in the Department's planning and
    implementation of CSUP projects.

    We agree with the GAO's observations and conclusions in this review.
    The report accurately describes the Department's significant efforts to
    prioritize, plan, and execute CSUP projects.

    The Department, through the Capital Security Construction program (also
    known as the New Embassy Construction (NEC) program), continues to
    aggressively replace vulnerable, deficient, and functionally obsolete
    overseas facilities with new, safe, and secure compounds. Since 2001,
    the Department � with excellent support from the Congress -- has moved
    nearly 15,000 U.S. Government (USG) employees into new buildings.

    However, as noted in this report, the large number of remaining
    deficient facilities � in conjunction with the time and cost to
    construct new facilities � necessitates interim measures to protect
    overseas personnel. Security upgrades since 1998 have prevented or
    limited deaths, injuries, and damage caused by terrorist attacks on
    U.S. diplomatic facilities in Pakistan, Uzbekistan, Saudi Arabia,
    Syria, and Austria, and have deterred planned attacks at numerous other
    posts. The Compound Security Upgrade Program remains a vital component
    of the Department's ongoing, high priority efforts to provide safe and
    secure facilities.

    The Department agrees with the GAO's conclusion that CSUP projects are
    limited by existing site conditions and other host nation restrictions.
    As stated in one of the report's examples, the Department typically
    cannot meet the 100-foot setback requirement at posts located in dense
    urban areas. In many cases, the only way to meet all security standards
    is to consolidate all post functions within a safe and secure New
    Embassy Compound through the Capital Security Construction program.

    Appendix III: GAO Contact and Staff Acknowledgments

    GAO Contact

    Charles Michael Johnson, Jr., Acting Director, International Affairs and
    Trade, (202) 512-7331, or [21]johnsoncm@gao.gov

    Staff Acknowledgments

    In addition the individual named above, David C. Maurer, Assistant
    Director; Michael J. Courts, Assistant Director; Valerie L. Nowak; Thomas
    M. Costa; Martin H. de Alteriis; Michael W. Armes; Leslie K. Locke; Ramon
    J. Rodriguez; Joseph P. Carney; Ian A. Ferguson; Etana Finkler; and Jason
    L. Bair made key contributions to this report.

    Related GAO Products

    Embassy Construction: State Has Made Progress Constructing New Embassies,
    but Better Planning Is Needed for Operations and Maintenance Requirements.
    [22]GAO-06-641 . Washington, D.C.: June 30, 2006.

    Overseas Security: State Department Has Not Fully Implemented Key Measures
    to Protect U.S. Officials from Terrorist Attacks Outside of Embassies.
    [23]GAO-05-688T . Washington, D.C.: May 10, 2005.

    Overseas Security: State Department Has Not Fully Implemented Key Measures
    to Protect U.S. Officials from Terrorist Attacks Outside of Embassies.
    [24]GAO-05-642 . Washington, D.C.: May 9, 2005.

    Embassy Construction: Achieving Concurrent Construction Would Help Reduce
    Costs and Meet Security Goals. [25]GAO-04-952 . Washington, D.C.:
    September 28, 2004.

    Embassy Construction: State Department Has Implemented Management Reforms,
    but Challenges Remain. [26]GAO-04-100 . Washington, D.C.: November 4,
    2003.

    Overseas Presence: Conditions of Overseas Diplomatic Facilities.
    [27]GAO-03-557T . Washington, D.C.: March 20, 2003.

    Embassy Construction: Better Long-Term Planning Will Enhance Program
    Decision-making. [28]GAO-01-11 . Washington, D.C.: January 22, 2001.

    State Department: Overseas Emergency Security Program Progressing, but
    Costs Are Increasing. [29]GAO/NSIAD-00-83 . Washington, D.C.: March 8,
    2000.

    (320456)

    GAO's Mission

    The Government Accountability Office, the audit, evaluation, and
    investigative arm of Congress, exists to support Congress in meeting its
    constitutional responsibilities and to help improve the performance and
    accountability of the federal government for the American people. GAO
    examines the use of public funds; evaluates federal programs and policies;
    and provides analyses, recommendations, and other assistance to help
    Congress make informed oversight, policy, and funding decisions. GAO's
    commitment to good government is reflected in its core values of
    accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony

    The fastest and easiest way to obtain copies of GAO documents at no cost
    is through GAO's Web site ( [30]www.gao.gov ). Each weekday, GAO posts
    newly released reports, testimony, and correspondence on its Web site. To
    have GAO e-mail you a list of newly posted products every afternoon, go to
    [31]www.gao.gov and select "E-mail Updates."

    Order by Mail or Phone

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent of
    Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
    copies mailed to a single address are discounted 25 percent. Orders should
    be sent to:

    U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
    DC 20548

    To order by Phone:
    Voice: (202) 512-6000
    TDD: (202) 512-2537
    Fax: (202) 512-6061

    To Report Fraud, Waste, and Abuse in Federal Programs

    Contact:

    Web site: [32]www.gao.gov/fraudnet/fraudnet.htm
    E-mail: [33]fraudnet@gao.gov
    Automated answering system: (800) 424-5454 or (202) 512-7470

    Congressional Relations

    Gloria Jarmon, Managing Director, [34]jarmong@gao.gov , (202) 512-4400
    U.S. Government Accountability Office, 441 G Street NW, Room 7125
    Washington, DC 20548

    Public Affairs

    Chuck Young, Acting Manager, [35]youngcl@gao.gov , (202) 512-4800 U.S.
    Government Accountability Office, 441 G Street NW, Room 7149 Washington,
    DC 20548

    To view the full product, including the scope
    and methodology, click on [36]GAO-08-162 .

    For more information, contact Charles Michael Johnson, Jr., at (202)
    512-7331 or johnsoncm@gao.gov.

    Highlights of [37]GAO-08-162 , a report to the Ranking Member, Committee
    on Oversight and Government Reform, House of Representatives

    January 2008

    EMBASSY SECURITY

    Upgrades Have Enhanced Security, but Site Conditions Prevent Full
    Adherence to Standards

    Following the 1998 embassy bombings, the Department of State (State)
    determined that more than 85 percent of diplomatic facilities did not meet
    security standards and were vulnerable to terrorist attacks. State's
    Bureau of Overseas Buildings Operations (OBO) has undertaken a program to
    replace or upgrade the security of these facilities. As of 2007, OBO had
    constructed more than 50 new embassies and moved nearly 15,000 staff to
    safer facilities. However, most remaining facilities will not be replaced
    in the near term. To address these facilities, OBO has obligated about
    $140 million per year for its Compound Security Upgrade Program (CSUP).

    GAO was asked to (1) describe the process that OBO follows to prioritize
    and plan CSUP projects, including stakeholder involvement; (2) determine
    the extent to which CSUP projects met contracted cost and time frames and
    whether OBO has procedures to ensure security upgrades are installed; and
    (3) assess whether State's CSUP efforts have enhanced posts' abilities to
    comply with State's physical security standards. To address these
    objectives, GAO reviewed pertinent State documents, met with State
    officials in Washington, D.C., and overseas, and traveled to 11 posts in
    Latin America, Europe, and the Middle East.

    State provided written comments on a draft of this report and agreed with
    our findings.

    OBO has a threat- and vulnerability-based process for prioritizing which
    posts receive CSUP projects and a planning process that utilizes input
    from State's Bureau of Diplomatic Security (DS) and post officials. DS
    assessments are currently based on physical security of each post's main
    compound, although many posts have facilities located outside the
    compound. DS is developing a prioritization process that will factor in
    the number of personnel, threat levels, and vulnerabilities at each
    facility, including those off compound. OBO has improved its planning
    processes by conducting a comprehensive survey of posts' physical security
    needs, including off-compound facilities.

    GAO found that 96 percent of 47 projects undertaken since fiscal year 2004
    were completed within 30 days of their contractual completion date.
    However, OBO modified 81 percent of the contracts to extend their
    completion dates. GAO also found that while OBO paid the contractors the
    amount specified in the contracts, contract modifications resulted in cost
    adjustments to all but two contracts, which GAO found in prior work is not
    uncommon in government renovation projects. OBO cited factors outside the
    contractors' control as the cause of most delays and cost increases, such
    as lengthy local permitting issues. To help ensure security upgrades
    contracted for are completed, OBO assigns a project manager who is
    responsible for the project's completion and relies on regional and post
    officials to provide additional monitoring.

    CSUP projects have enhanced posts' compliance with physical security
    standards by constructing compound access control facilities, safe areas
    for post personnel, and compound walls and barriers. However, at the 11
    posts GAO visited, site conditions prevented them from adhering fully with
    standards. For example, more than one post's urban location prevented it
    from achieving a 100-foot setback from the street, a key security
    standard. As a result, many buildings and their occupants may remain
    vulnerable to attack.

    Key Security Measures at a Notional Embassy

    References

    Visible links
      17. http://www.gao.gov/cgi-bin/getrpt?GAO-05-642
      18. http://www.gao.gov/cgi-bin/getrpt?GAO-05-334
      19. http://www.gao.gov/
      20. mailto:johnsoncm@gao.gov
      21. mailto:johnsoncm@gao.gov
      22. http://www.gao.gov/cgi-bin/getrpt?GAO-06-641
      23. http://www.gao.gov/cgi-bin/getrpt?GAO-05-688T
      24. http://www.gao.gov/cgi-bin/getrpt?GAO-05-642
      25. http://www.gao.gov/cgi-bin/getrpt?GAO-04-952
      26. http://www.gao.gov/cgi-bin/getrpt?GAO-04-100
      27. http://www.gao.gov/cgi-bin/getrpt?GAO-03-557T
      28. http://www.gao.gov/cgi-bin/getrpt?GAO-01-11
      29. http://www.gao.gov/cgi-bin/getrpt?GAO/NSIAD-00-83
      30. http://www.gao.gov/
      31. http://www.gao.gov/
      32. http://www.gao.gov/fraudnet/fraudnet.htm
      33. mailto:fraudnet@gao.gov
      34. mailto:jarmong@gao.gov
      35. mailto:youngcl@gao.gov
      36. http://www.gao.gov/cgi-bin/getrpt?GAO-08-162
      37. http://www.gao.gov/cgi-bin/getrpt?GAO-08-162
    *** End of document. ***