    Defense Critical Infrastructure: Adherence to Guidance Would
    Improve DOD's Approach to Identifying and Assuring the
    Availability of Critical Transportation Assets (15-AUG-08,
    GAO-08-851).

    The Department of Defense (DOD) established the Defense Critical
    Infrastructure Program (DCIP) to assure the availability of
    mission-critical infrastructure, including surface, sea, and air
    transportation assets to carry out its missions. GAO was asked to
    evaluate (1) the extent to which the U.S. Transportation Command
    (TRANSCOM) has identified, prioritized, and assessed critical
    transportation assets; (2) the extent to which DOD installation
    personnel have taken actions to help assure the availability of
    critical transportation assets, both within and independent of
    DCIP; and (3) how DOD is funding critical transportation asset
    assurance. GAO examined a nonprojectable sample of 22 critical
    transportation assets, reviewed relevant DOD guidance and
    documents, and interviewed cognizant officials.
    -------------------------Indexing Terms-------------------------
    REPORTNUM:   GAO-08-851
        ACCNO:   A83566
      TITLE:     Defense Critical Infrastructure: Adherence to Guidance
    Would Improve DOD's Approach to Identifying and Assuring the
    Availability of Critical Transportation Assets
         DATE:   08/15/2008
      SUBJECT:   Agency missions
    	     Air transportation
    	     Assets
    	     Cost analysis
    	     Critical infrastructure
    	     Defense capabilities
    	     Defense contingency planning
    	     Defense cost control
    	     Defense operations
    	     Defense procurement
    	     Homeland security
    	     Military facilities
    	     Military forces
    	     Program evaluation
    	     Program management
    	     Risk assessment
    	     Risk management
    	     Strategic planning
    	     Terrorism
    	     Transportation
    	     Cost estimates
    	     Program costs
    	     Program goals or objectives
    	     Program implementation
    	     Defense Critical Infrastructure Program

    ******************************************************************
    ** This file contains an ASCII representation of the text of a  **
    ** GAO Product.                                                 **
    **                                                              **
    ** No attempt has been made to display graphic images, although **
    ** figure captions are reproduced.  Tables are included, but    **
    ** may not resemble those in the printed version.               **
    **                                                              **
    ** Please see the PDF (Portable Document Format) file, when     **
    ** available, for a complete electronic file of the printed     **
    ** document's contents.                                         **
    **                                                              **
    ******************************************************************
    GAO-08-851

    This text file was formatted by the U.S. Government Accountability
    Office (GAO) to be accessible to users with visual impairments, as part
    of a longer term project to improve GAO products' accessibility. Every
    attempt has been made to maintain the structural and data integrity of
    the original printed product. Accessibility features, such as text
    descriptions of tables, consecutively numbered footnotes placed at the
    end of the file, and the text of agency comment letters, are provided
    but may not exactly duplicate the presentation or format of the printed
    version. The portable document format (PDF) file is an exact electronic
    replica of the printed version. We welcome your feedback. Please E-mail
    your comments regarding the contents or accessibility features of this
    document to Webmaster@gao.gov.

    This is a work of the U.S. government and is not subject to copyright
    protection in the United States. It may be reproduced and distributed
    in its entirety without further permission from GAO. Because this work
    may contain copyrighted images or other material, permission from the
    copyright holder may be necessary if you wish to reproduce this
    material separately.

    Report to Congressional Requesters:

    United States Government Accountability Office:

    GAO:

    August 2008:

    Defense Critical Infrastructure:

    Adherence to Guidance Would Improve DOD's Approach to Identifying and
    Assuring the Availability of Critical Transportation Assets:

    Defense Critical Infrastructure:

    GAO-08-851:

    GAO Highlights:

    Highlights of GAO-08-851, a report to congressional requesters.

    Why GAO Did This Study:

    The Department of Defense (DOD) established the Defense Critical
    Infrastructure Program (DCIP) to assure the availability of mission-
    critical infrastructure, including surface, sea, and air transportation
    assets to carry out its missions. GAO was asked to evaluate (1) the
    extent to which the U.S. Transportation Command (TRANSCOM) has
    identified, prioritized, and assessed critical transportation assets;
    (2) the extent to which DOD installation personnel have taken actions
    to help assure the availability of critical transportation assets, both
    within and independent of DCIP; and (3) how DOD is funding critical
    transportation asset assurance. GAO examined a nonprojectable sample of
    22 critical transportation assets, reviewed relevant DOD guidance and
    documents, and interviewed cognizant officials.

    What GAO Found:

    TRANSCOM has taken some actions to identify, prioritize, and assess its
    critical transportation assets but, according to officials from the
    Office of the Assistant Secretary of Defense for Homeland Defense and
    Americas� Security Affairs (ASD[HD&ASA]), its methodology for doing so,
    until recently, has been inconsistent with the intent of DOD�s various
    DCIP guidance and with the approach adopted by some of the other
    combatant commands and military services. TRANSCOM considers entire
    installations�military air bases, seaports, and commercial airports�as
    critical assets, rather than identifying assets with greater
    specificity, such as individual runways, navigation aids, and fuel
    storage facilities. This methodology diminishes the reliability of the
    critical transportation asset list, a condition that impedes DOD�s
    ability to prioritize its critical assets departmentwide and
    effectively target spending on risk-reduction efforts. Further,
    TRANSCOM was using its vulnerability assessments to identify specific
    critical transportation assets on the installations. This practice
    conflicts with DOD�s DCIP guidance not to use vulnerability assessments
    to identify critical assets. Though TRANSCOM officials stated that they
    now plan to discontinue this practice, they were unable to provide
    ASD(HD&ASA) or GAO with any documentation to confirm that this decision
    had occurred officially. Further, TRANSCOM�s memorandum of
    understanding with the Joint Staff to participate as transportation
    subject matter experts on the Joint Staff�s vulnerability assessments
    with a DCIP module is still in draft. In May 2008, TRANSCOM officials
    told GAO that they now plan to use the draft DCIP critical asset
    identification process to reevaluate its 300 identified critical
    transportation assets; however, a timeline to complete this has not yet
    been determined.

    DOD installation personnel at the 22 sites GAO visited have taken
    actions to help assure the availability of critical transportation
    assets; however, these actions have routinely occurred independent of
    DCIP. Consequently, they do not consider the full spectrum of threats
    and hazards and they tend to focus on preventing mass personnel
    casualties instead of critical asset assurance. DCIP�s impact at the
    installations where the assets are located was negligible because of
    the lack of service-specific guidance. This gap in guidance hinders
    installation personnel�s ability to make informed risk management
    decisions based on asset criticality. Coordination efforts between
    installation personnel and non-DOD owners of critical transportation
    assets and supporting public works infrastructure were substantial, but
    have been focused on the protection of people and not on asset
    assurance.

    DOD has allocated approximately $283 million for DCIP from fiscal years
    2004 to 2008, including $8.6 million to TRANSCOM for its combatant
    command and defense sector responsibilities. Critical infrastructure
    assurance efforts also have been funded through other DOD complementary
    programs, such as the Antiterrorism Program, and through foreign
    government contributions. Although existing DCIP funding does not
    include funding for remediating asset vulnerabilities, remediation has
    been funded from these other sources.

    What GAO Recommends:

    GAO recommends TRANSCOM (1) implement established criteria to identify
    critical transportation assets, and develop a timeline for doing so,
    (2) discontinue its use of vulnerability assessments as its primary
    tool for identifying its critical assets, and (3) finalize an agreement
    with the Joint Staff to participate as transportation experts on Joint
    Staff DCIP vulnerability assessments, and that the military services
    develop and implement service-specific DCIP guidance. DOD partially
    concurred with the recommendations. GAO modified one recommendation on
    vulnerability assessments, in response to agency comments.

    To view the full product, including the scope and methodology, click on
    [http://www.gao.gov/cgi-bin/getrpt?GAO-08-851]. For more information,
    contact Davi M. D'Agostino at (202) 512-5431 or dagostinod@gao.gov.

    [End of section]

    Contents:

    Letter:

    Results in Brief:

    Background:

    TRANSCOM Efforts to Identify, Prioritize, and Assess Critical
    Transportation Assets Have Been Inconsistent with Guidance:

    Most Installations Took Some Steps to Assure the Availability of
    Critical Transportation and Public Works Assets but Were Unaware of
    Asset Criticality and Lacked a DCIP Focus:

    Critical Transportation Asset Assurance Has Received Some Funding
    through DCIP and Has Benefited from Other Sources of Funding:

    Conclusions:

    Recommendations for Executive Action:

    Agency Comments and Our Evaluation:

    Appendix I: Scope and Methodology:

    Appendix II: Comments from the Department of Defense:

    Appendix III: GAO Contact and Staff Acknowledgments:

    Related GAO Products:

    Table:

    Table 1: Number of Critical Transportation Assets Selected by Asset
    Category and Geographic Combatant Command Area of Responsibility:

    Figures:

    Figure 1: Geographic Combatant Commands' Areas of Responsibility:

    Figure 2: DOD Guidance for Risk Management:

    Figure 3: TRANSCOM's Efforts Prior to Implementing DCIP's Asset
    Identification Process:

    Figure 4: Representative Types of Critical Transportation Assets:

    Figure 5: TRANSCOM's DCIP Funding Trend, Fiscal Years 2004 to 2013:

    Figure 6: GAO Critical Transportation Asset Selection Methodology:

    Abbreviations:

    ASD(HD&ASA): Assistant Secretary of Defense for Homeland Defense and
    Americas' Security Affairs:

    DCIP: Defense Critical Infrastructure Program:

    DOD: Department of Defense:

    OSD: Office of the Secretary of Defense:

    TRANSCOM: U.S. Transportation Command:

    United States Government Accountability Office:

    Washington, DC 20548:

    August 14, 2008:

    The Honorable Solomon P. Ortiz:
    Chairman:
    The Honorable J. Randy Forbes:
    Ranking Member:
    Subcommittee on Readiness:
    Committee on Armed Services:
    House of Representatives:

    The Honorable W. Todd Akin:
    House of Representatives:

    The Department of Defense (DOD) relies on a global network of critical
    surface, sea, and air transportation infrastructure--such as roads,
    railways, seaports, military air bases, and commercial airports--to
    carry out its missions. The incapacitation or destruction of one or
    more of the assets constituting this network of critical infrastructure
    could have a debilitating effect on DOD's ability to project, support,
    and sustain its forces and operations worldwide. DOD's critical
    transportation infrastructure is owned by both DOD and non-DOD
    entities, including private companies, state and local governments, and
    foreign governments. Because of its importance to DOD operations, this
    critical infrastructure represents an attractive target to adversaries,
    and may also be vulnerable to a host of natural disasters and
    accidents. DOD has recognized and emphasized the importance of assuring
    the availability of mission-critical infrastructure in the most recent
    versions of the National Military Strategy[Footnote 1] and the
    Quadrennial Defense Review.[Footnote 2] Critical assets in the
    Transportation Defense Sector depend on public works infrastructure
    that provides the utilities needed for many transportation critical
    assets to remain operational.[Footnote 3] To identify and help assure
    the availability of mission-critical infrastructure, the Assistant
    Secretary of Defense for Homeland Defense and Americas' Security
    Affairs (ASD[HD&ASA]) was assigned responsibility for the risk-based
    Defense Critical Infrastructure Program (DCIP) in September 2003.
    ASD(HD&ASA) subsequently issued guidance in August 2005 articulating
    the roles and responsibilities for DOD organizations involved in the
    program.[Footnote 4]

    Under DCIP, DOD created 10 functionally based defense sectors and
    designated a Defense Infrastructure Sector Lead Agent (sector lead
    agent) for each sector.[Footnote 5] The U.S. Transportation Command
    (TRANSCOM) is the sector lead agent for the Transportation Defense
    Sector. DOD Directive 3020.40 assigns the sector lead agent
    responsibility for, in collaboration with other DCIP stakeholders,
    identifying the interdependencies among infrastructure that crosses DOD
    sector boundaries, and for maintaining a characterization of sector
    support functions, systems, assets, and dependencies as they relate to
    identified operational capabilities and assets. Because TRANSCOM also
    is a combatant command, it is responsible for preventing and mitigating
    the loss of DOD-owned critical assets, within its assigned area of
    responsibility, and for coordinating with the military services and
    other sector lead agents in identifying and assessing critical assets.
    In addition to DCIP, DOD has established several other complementary
    programs, such as the Antiterrorism Program, that predate DCIP but
    contribute indirectly to the protection and assurance of critical
    assets.

    You requested that we review a number of issues related to DOD's
    mission-critical infrastructure. To date, we have issued four reports
    in response to that request. Our first report examined the extent to
    which DOD has developed a comprehensive management plan for DCIP and
    the actions needed to identify, prioritize, and assess defense critical
    infrastructure.[Footnote 6] The second report examined DOD's efforts to
    implement a risk management approach for defense industrial base
    critical assets.[Footnote 7] The third report examined the extent to
    which DOD included highly sensitive assets in its critical
    infrastructure program.[Footnote 8] Finally, the fourth report focused
    on threats and vulnerabilities affecting intelligence, surveillance,
    and reconnaissance operations at Creech Air Force Base,
    Nevada.[Footnote 9] As agreed with your offices, we plan to issue two
    additional reports later this year. The first report evaluates DOD's
    efforts to assure the availability of critical infrastructure in the
    Space; Intelligence, Surveillance, and Reconnaissance; and Global
    Information Grid Defense Sectors.[Footnote 10] The other report
    examines the extent to which DOD has trained key personnel and
    developed expertise to assist DOD organizations across five defense
    sectors in assuring the availability of critical infrastructure and has
    incorporated the assurance of critical infrastructure into exercises.

    In 2007, we reported that DCIP implementation at the department,
    military service, and combatant command headquarters levels was
    relatively immature.[Footnote 11] To understand what impact this was
    having on the availability of mission-essential transportation and
    supporting public works assets,[Footnote 12] this report focuses on DOD
    and non-DOD (i.e., foreign) installations where the critical
    transportation assets are located. Specifically, we evaluated (1) the
    extent to which TRANSCOM has identified, prioritized, and assessed its
    critical transportation assets; (2) the extent to which DOD
    installation personnel have taken actions to help assure the
    availability of critical transportation assets, both within and
    independent of DCIP; and (3) how DOD is funding critical transportation
    asset assurance.

    Critical asset tiers:

    Tier 1--An asset the loss, incapacitation, or disruption of which could
    result in mission (or function) failure at the DOD, military
    department, combatant command, sub-unified command, defense agency, or
    defense infrastructure sector level.

    Tier 2--An asset the loss, incapacitation, or disruption of which could
    result in mission (or function) degradation at the DOD, military
    department, combatant command, sub-unified command, defense agency, or
    defense infrastructure sector level.

    Tier 3--An asset the loss, incapacitation, or disruption of which could
    result in mission (or function) failure below the military department,
    combatant command, sub-unified command, defense agency, or defense
    infrastructure sector level.

    We drew a nonprobability sample[Footnote 13] of critical transportation
    assets in the United States and abroad, using draft critical asset
    lists developed by the Joint Staff, each of the four military services,
    and TRANSCOM. We selected assets based on (1) overlap among the various
    critical asset lists; (2) geographic dispersion among geographic
    combatant commands' areas of responsibility; (3) representation from
    each military service; and (4) representation in the three asset
    categories--air bases, seaports, and commercial airports--TRANSCOM
    identified in the continental United States, and in the European,
    Middle Eastern, and Pacific regions. Through this methodology, we
    selected 22 assets for review, including two of the four Tier 1
    critical transportation assets.[Footnote 14] Tier 1 assets represent
    those assets that are most critical for carrying out combatant command
    missions.

    Figure 1 shows the areas of responsibility for each geographic
    combatant command.

    Figure 1: Geographic Combatant Commands' Areas of Responsibility:

    This figure is a map of the combatant commands' areas of
    responsibility.

    [See PDF for image]

    Source: GAO presentation of DOD data.

    [A] The state of Alaska is assigned to the U.S. Northern Command's area
    of responsibility. Forces based in Alaska, however, may be assigned to
    multiple commands.

    [B] The U.S. Africa Command was officially established in October 2007
    with a goal to reach full operational capability as a geographic
    combatant command by September 30, 2008, assuming responsibility for
    U.S. military activities in Africa.

    [End of figure]

    Further, we assessed relevant planning documents, including continuity
    of operations and emergency management plans for assets we selected for
    review and for the associated public works assets that support them. We
    reviewed Transportation Infrastructure Vulnerability Assessments that
    focus on critical infrastructure, when available, for those DOD and
    foreign installations we visited. Also, we analyzed relevant Office of
    the Secretary of Defense (OSD), military service, and combatant command
    guidance and funding data. Within DOD, we interviewed officials from
    OSD, the Joint Staff, defense agencies, the military services,
    combatant commands, subcomponent commands, sector lead agents, and
    installation-level organizations in the United States and abroad. In
    addition, we interviewed officials at the Department of Homeland
    Security, at three U.S. embassies and three commercial airports; host
    nation officials; and officials in both the private sector and
    academia. (Throughout this unclassified report, we do not identify
    specific assets, their locations or installations, or combatant command
    or others' missions that the assets support because that information is
    classified.) We conducted this performance audit from May 2007 through
    July 2008 in accordance with generally accepted government auditing
    standards. Those standards require that we plan and perform the audit
    to obtain sufficient, appropriate evidence to provide a reasonable
    basis for our findings and conclusions based on our audit objectives.
    We believe that the evidence obtained provides a reasonable basis for
    our findings and conclusions based on our audit objectives. To assess
    the reliability of data, we interviewed appropriate officials and
    reviewed relevant documentation. We found the data provided by DOD to
    be sufficiently reliable for representing the nature and extent of the
    DCIP funding. A more thorough description of our scope and methodology
    is provided in appendix I.

    Results in Brief:

    Although TRANSCOM has taken some actions to identify, prioritize, and
    assess its critical transportation assets, its methodology for doing
    so, until recently, has been, according to ASD(HD&ASA) officials,
    inconsistent with the intent of DCIP guidance and with the approach
    adopted by some of the other combatant commands and military services.
    TRANSCOM has identified entire installations--military air bases,
    seaports, and commercial airports--as critical assets, rather than
    identifying critical assets with greater specificity, such as
    individual runways, navigation aids, and fuel storage facilities.
    TRANSCOM officials identified entire installations based on their
    interpretation of the definition of an asset as outlined in DOD
    Directive 3020.40 and because these types of installations constitute
    the worldwide Defense Transportation System necessary to carry out
    TRANSCOM's missions. This methodology of identifying critical assets
    diminishes the reliability of the critical transportation asset list, a
    condition that impedes DOD's ability to prioritize its critical assets
    and effectively target spending for risk reduction efforts. TRANSCOM
    was using its Transportation Infrastructure Vulnerability Assessments
    to identify specific critical transportation assets on the
    installations, a practice that conflicts with DOD's DCIP guidance not
    to use vulnerability assessments for this purpose. Though TRANSCOM
    officials stated that they now plan to discontinue this practice, they
    were unable to provide ASD(HD&ASA) or us with any documentation to
    confirm that this decision had occurred officially. Further, TRANSCOM's
    memorandum of understanding with the Joint Staff to participate as
    transportation subject matter experts on the Joint Staff's
    vulnerability assessments with a DCIP module is still in draft. In May
    2008, TRANSCOM officials told us that they now plan to use the draft
    DCIP critical asset identification process to reevaluate its critical
    transportation assets. TRANSCOM officials believe that this will result
    in a "significant reduction" in the number of assets it identifies as
    critical; however, TRANSCOM has not yet set a timeline to begin and
    complete this reevaluation.

    DOD installation personnel have taken actions to help assure the
    availability of critical transportation assets. However, because the
    vast majority of these actions have occurred outside of DCIP, their
    actions do not consider the full spectrum of threats and hazards, and
    tend to focus on preventing mass personnel casualties instead of
    assuring asset availability. Although DOD established DCIP to help
    assure the availability of critical infrastructure--including
    transportation assets--departmentwide, DCIP's impact at the 22
    installations we visited where the assets were located was negligible.
    For 18 of the 22 critical transportation assets we examined, we found
    that (1) installation personnel were often unaware of the criticality
    of their assets for TRANSCOM's missions and (2) coordination efforts
    between installation personnel and DOD and non-DOD owners of critical
    transportation assets and their supporting public works infrastructure
    were substantial, but again tended to focus on the protection of people
    and not on ensuring the availability of critical assets. DCIP guidance
    instructs the military departments to allocate resources for an
    organizational program supporting DCIP, including the implementation of
    risk management decisions. Further, it requires combatant commands to
    coordinate with other combatant commands, the military services, and
    sector lead agents in identifying and assessing critical assets and
    associated infrastructure interdependencies and to act to prevent or
    mitigate loss or degradation of critical assets. However, at 20 of the
    22 installations we visited, critical assets were not incorporated into
    installations' emergency management, continuity of operations, or risk
    management plans. Further, installation personnel attributed their
    unfamiliarity with DCIP to the military services not yet having issued
    DCIP implementing guidance as well as the frequent rotations of
    installation commanders. As a result, this gap hindered installation
    personnel's ability to make informed risk management decisions, such as
    remediation priorities, because installation personnel at the sites we
    visited were not aware of what assets were more critical than others.

    DOD has allocated approximately $283 million in budgeted and
    supplemental appropriations for critical asset assurance through DCIP
    from fiscal years 2004 to 2008, including about $8.6 million to
    TRANSCOM. DCIP guidance requires combatant commands and sector lead
    agents to provide adequate resources to implement their DCIP
    responsibilities. To this end, TRANSCOM has allocated approximately
    $5.7 million for its combatant command DCIP responsibilities and $2.9
    million for its Transportation Defense Sector DCIP responsibilities
    during this 5-year period to identify and assess its critical assets.
    Additionally, asset owners have funded critical asset initiatives
    through other DOD programs, such as the Antiterrorism Program, as well
    as benefited from funding from foreign government payments in countries
    where DOD has identified critical transportation assets. Although
    existing DCIP funding does not include funding for remediation of
    critical asset vulnerabilities, some remediation has occurred through
    these other complementary programs.

    We are recommending that TRANSCOM fully implement the criteria,
    methodology, and process in the draft DOD Critical Asset Identification
    Process manual to reevaluate and update the identification of all
    critical transportation assets, and develop a timeline for doing so;
    discontinue the use of Transportation Infrastructure Vulnerability
    Assessments as its primary tool for identifying its critical assets;
    and finalize the memorandum of understanding with the Joint Staff to
    enable TRANSCOM transportation subject matter experts to participate in
    the DCIP module of a Joint Staff vulnerability assessment. Also, we are
    recommending that the military departments develop and implement
    service-specific guidance based on published DOD DCIP guidance.

    GAO provided a draft of this report to DOD in July 2008 with three
    draft recommendations for its review and comment. In written comments
    on a draft of this report, DOD partially concurred with our
    recommendations. Based on DOD's agency comments, we modified one
    recommendation (making it two recommendations rather than one) to
    reflect the distinction between the separate issues of finalizing the
    memorandum of understanding with the Joint Staff and discontinuing the
    use of Transportation Infrastructure Vulnerability Assessments as the
    primary tool to identify critical assets. Also, TRANSCOM and U.S.
    Central Command provided us with technical comments, which we
    incorporated in the report as appropriate. DOD's response is reprinted
    in appendix II.

    Background:

    Homeland Security Presidential Directive 7,[Footnote 15] issued in
    December 2003, designates the Secretary of Homeland Security as the
    principal federal official responsible for leading, integrating, and
    coordinating the overall national effort to protect the nation's
    critical infrastructure and key resources. Homeland Security
    Presidential Directive 7 also requires all federal departments and
    agencies to identify, prioritize, and coordinate the protection of
    critical infrastructure and key resources from terrorist attacks.
    ASD(HD&ASA), within the Office of the Under Secretary of Defense for
    Policy, serves as the principal civilian advisor and the Chairman of
    the Joint Chiefs of Staff serves as the principal military advisor to
    the Secretary of Defense on critical infrastructure protection.

    The Transportation Defense Sector is made up of a worldwide network of
    DOD and non-DOD surface, sea, and air assets that the U.S. military
    relies on to move personnel and equipment. Currently, the
    Transportation Defense Sector consists of 300 critical air bases,
    seaports, and commercial airports worldwide and owned by DOD, other
    U.S. governmental organizations, private companies, and foreign
    governments. According to TRANSCOM officials, the Transportation
    Defense Sector is highly resilient because of significant redundancy
    among the various modes of transportation, particularly as it relates
    to surface transportation. For example, the size and capabilities of
    the U.S. rail and highway networks afford ability to reroute shipments
    via alternate roads and rail lines in the event of disruptions, a key
    reason why surface transportation assets were not identified as
    critical.

    In addition to DCIP, DOD has established other complementary programs
    that help assure critical assets, including the Antiterrorism
    Program[Footnote 16] and the Defense Continuity Program.[Footnote 17]
    The Antiterrorism Program is intended to establish protection standards
    for DOD assets against terrorist attacks. The Defense Continuity
    Program is intended to ensure that DOD mission-essential functions
    continue under all circumstances, such as a man-made or natural
    disaster. DCIP supports a risk-management process that seeks to ensure
    defense critical infrastructure availability. The risk-management
    process is comprised of a risk assessment component that identifies
    critical assets and infrastructure interdependencies that support DOD
    missions. Applicable follow-on threat and vulnerability assessments are
    then conducted on those assets to complete the risk assessment. The
    risk response component ensures that limited resources are optimally
    allocated towards those assets deemed most important to overall mission
    success for DOD, and for which it has been determined that the
    identified level of risk is unacceptable.

    Several DOD organizations have key roles in helping assure the
    availability of DOD's transportation critical assets. The military
    services, defense agencies, and the combatant commands are responsible,
    in coordination with the sector lead agents, for identifying and
    assessing critical assets. The military departments, in their role as
    executive agent for the combatant commands, provide funding and
    resources for combatant command critical infrastructure programs. DOD
    Directive 3020.40 also states that sector lead agents are responsible
    for collaborating with other defense sector lead agents and DOD DCIP
    stakeholders to identify cross-sector interdependencies.

    TRANSCOM Efforts to Identify, Prioritize, and Assess Critical
    Transportation Assets Have Been Inconsistent with Guidance:

    According to ASD(HD&ASA) officials, TRANSCOM's methodology for
    identifying, prioritizing, and assessing its critical transportation
    assets is inconsistent with the intent of DOD's DCIP guidance and with
    the approach adopted by some of the other combatant commands and
    military services. TRANSCOM officials stated in May 2008 that they now
    plan to leverage the draft DOD Critical Asset Identification Process
    manual to reevaluate its currently identified critical transportation
    assets; however, a timeline to complete this reevaluation has not yet
    been established. Further, until recently, TRANSCOM relied on its
    vulnerability assessments to identify critical transportation assets,
    an action that also conflicted with established DOD guidance and
    practice. While TRANSCOM officials stated that they will discontinue
    the use of vulnerability assessment for identification purposes, they
    were unable to provide any documentation to ASD(HD&ASA) or us to
    confirm this decision officially. Moreover, its memorandum of
    understanding with the Joint Staff to participate as transportation
    subject matter experts on Joint Staff DCIP vulnerability assessments is
    still in draft.

    TRANSCOM's Asset Identification Efforts Are Inconsistent with Intent of
    DCIP Guidance and Practice:

    At the time of our review, TRANSCOM had identified 300 Tier 1 and Tier
    2 critical transportation assets linked to its global mobility mission.
    TRANSCOM officials told us that they identified larger systems of
    assets--categorized as air bases, seaports, and commercial airports--
    based on their interpretation of the definition of an asset as outlined
    in DOD Directive 3020.40.[Footnote 18] TRANSCOM officials explained
    that these types of installations are part of its worldwide Defense
    Transportation System that is necessary to carry out TRANSCOM's
    missions. This broad list of assets has been submitted to the Joint
    Staff for inclusion in DOD's overall draft critical asset list. Because
    of TRANSCOM's interpretation of the guidance, its critical asset list
    lacks the specificity of the critical asset lists prepared by some of
    the other combatant commands and military services. Moreover, according
    to ASD(HD&ASA) officials, TRANSCOM's decision to identify entire
    installations was inconsistent with the intent of DCIP guidance. While
    TRANSCOM is not the only combatant command or military service to
    identify an entire installation as critical, it is the only
    organization that has done so for its entire list. DOD guidance
    requires combatant commands to first identify their missions, the
    critical assets that support those missions, and the threats and
    hazards to those critical assets, and then assess the vulnerability of
    the critical assets to the threats and hazards identified (see fig. 2).

    Figure 2: DOD Guidance for Risk Management[Footnote 19]

    This figure is a flow chart showing the steps of DOD guidance for risk
    management.

    Step 1: Identify Combatant Command Missions;
    Step 2: Identify Critical Assets;
    Step 3: Identify Threats and Hazards to Critical Assets;
    Step 4: Conduct Vulnerability.

    [See PDF for image]

    Source: GAO analysis of DOD data.

    [End of figure]

    TRANSCOM skips steps two and three listed in figure 2 and instead has
    been using Transportation Infrastructure Vulnerability Assessments to
    identify specific critical assets. According to TRANSCOM officials, the
    identification of threats and hazards to critical assets (step 3) is
    incorporated in the conduct of vulnerability assessments (step 4),
    since Transportation Infrastructure Vulnerability Assessments
    specifically address vulnerability to all threats and hazards.

    ASD(HD&ASA) officials stated that when they began developing an overall
    DOD critical asset list, they told the combatant commands and military
    services that stopping the identification process for critical assets
    at the installation level is insufficient for the purposes of DCIP. As
    a result of continued submission of entire installations as critical
    assets, ASD(HD&ASA) published in March 2008 the Strategy for Defense
    Critical Infrastructure[Footnote 20] to reiterate the need for greater
    specificity in critical asset identification. Further, ASD(HD&ASA) is
    developing the DOD Critical Asset Identification Process manual, which
    is still in draft, but also notes that stopping the asset
    identification process at the system level (e.g., an air base, seaport,
    or commercial airport) does not meet the needs of DCIP, and that rarely
    is an entire system essential to mission success. For example, it is
    insufficient to identify an air base as a critical asset; rather, more
    specific assets, such as a runway, should be identified as appropriate.
    Figure 3 illustrates the DCIP critical asset identification process and
    where TRANSCOM's previous efforts have stopped.

    Figure 3: TRANSCOM's Efforts Prior to Implementing DCIP's Asset
    Identification Process:

    This figure is a flowchart of TRANSCOM's efforts prior to implementing
    DCIP's asset identification process.

    [See PDF for image]

    Source: GAO analysis of DOD data.

    [End of figure]

    TRANSCOM officials stated that because the DOD Critical Asset
    Identification Process manual was still in draft, they had initially
    chosen not to implement its contents until its formal publication.
    According to TRANSCOM officials, beginning in May 2008, TRANSCOM began
    the process to develop coordination methods to facilitate the use of
    the criteria in the draft DOD Critical Asset Identification Process
    manual for the identification and validation of assets prior to
    submitting them to the Joint Staff. TRANSCOM has recognized that this
    process will require time to complete a meaningful critical
    transportation asset list; however, a timeline to complete this process
    has not yet been established.

    Complicating the process of identifying and prioritizing critical
    assets has been TRANSCOM's use of Transportation Infrastructure
    Vulnerability Assessments. Though contrary to DCIP guidance,[Footnote
    21] TRANSCOM has been using its vulnerability assessments to identify
    specific critical assets rather than using the process outlined in DCIP
    guidance to identify specific critical assets. As a result, TRANSCOM
    officials could not tell us what specific transportation assets at a
    given site were critical, stating that in the absence of a
    Transportation Infrastructure Vulnerability Assessment it could be,
    though not necessarily, assumed that what was identified as critical at
    one location might be critical at another. For example, if a
    Transportation Infrastructure Vulnerability Assessment identified
    specific critical assets (such as a runway, navigation aids, or a fuel
    depot) at an air base as critical, it could be reasonably assumed that
    the same assets would probably be critical at other air bases. However,
    while TRANSCOM officials have stated that they will discontinue the use
    of vulnerability assessment for identification purposes, they were
    unable to provide any documentation to ASD(HD&ASA) or us to confirm
    this decision officially. Additionally, TRANSCOM's memorandum of
    understanding with the Joint Staff to serve as transportation subject
    matter experts for the enhanced DCIP module to the Joint Staff's
    Integrated Vulnerability Assessment when transportation assets are
    assessed remains in draft.

    At the behest of ASD(HD&ASA) in 2006, the Joint Staff began the process
    of creating a list of Tier 1 critical assets based on assets nominated
    and submitted by DOD organizations, including the combatant commands
    and the military services using DCIP-approved criteria. The Joint
    Staff's list has gone through several iterations and a subset of Tier 1
    critical assets, known as Defense Critical Assets, will be selected by
    ASD(HD&ASA).[Footnote 22] These Defense Critical Assets are of such
    extraordinary importance to DOD operations in peace, crisis, and war
    that their incapacitation or destruction would have a very serious,
    debilitating effect on the ability of DOD to fulfill its missions.
    TRANSCOM has not yet established a timeline to reevaluate critical
    transportation assets using the approved DCIP methodology. Until this
    reevaluation is completed, ASD(HD&ASA)'s ability to formulate a
    comprehensive Defense Critical Asset list that includes transportation
    assets and effectively targets spending for risk reduction efforts will
    be impeded.

    Figure 4 illustrates the types of specific critical transportation
    assets that TRANSCOM could identify below the installation (air base,
    seaport, and commercial airport) level.

    Figure 4: Representative Types of Critical Transportation Assets:

    This figure is a combination of four pictures showing types of critical
    transportation assets.

    The pictures are of:

    Cargo handling equipment at a U.S. air base;
    Fuel transfer pipeline;
    A refueling pier critical to sealift port operations;
    and Mobile control tower; a backup capability for continuity of air
    operations.

    [See PDF for image]

    Source: DOD.

    [End of figure]

    TRANSCOM plans to reevaluate its critical asset list using the DCIP-
    approved criteria, which is expected to result in a "significant
    reduction" of critical transportation assets.

    Most Installations Took Some Steps to Assure the Availability of
    Critical Transportation and Public Works Assets but Were Unaware of
    Asset Criticality and Lacked a DCIP Focus:

    Although DOD established DCIP to help assure the availability of
    mission-critical infrastructure--including transportation assets--
    installation personnel were often unfamiliar with DCIP and unaware of
    the critical role specific transportation assets play in TRANSCOM's
    missions. This lack of awareness contributed to a singular focus on
    protecting personnel and did not consider mission-critical assets.

    Installation Officials Often Are Unaware of Asset Criticality:

    Installation officials responsible for critical transportation assets
    at the 22 sites we visited were often unaware of asset criticality
    because they were unfamiliar with DCIP and thus DCIP's impact at these
    installations was negligible. While some efforts have been made to
    coordinate with both DOD and non-DOD entities, including the private
    sector, state and local governments, and foreign governments to assure
    the availability of critical transportation assets at home and abroad,
    these coordination efforts have been conducted despite a lack of
    service-specific DCIP implementation guidance. According to officials
    at 17 of the 22 installations we visited, efforts at installations have
    mostly focused on protecting people through such actions as
    antiterrorism protection rather than focusing on specific mission-
    critical transportation assets.

    At 18 of the 22 installations we visited, we found numerous
    complementary programs, such as the Antiterrorism and Chemical,
    Biological, Radiological, Nuclear, and high-yield Explosive Programs;
    and continuity of operations and emergency management planning.
    Officials responsible for assuring the availability of critical
    transportation assets at 20 of the 22 installations we visited, told us
    that they had not heard of DCIP prior to our visit because (1) there is
    an absence of service-specific guidance that explains how to implement
    DCIP and (2) the frequent rotation of installation commanders
    (typically every 2 years), which can limit leadership continuity over
    DCIP at the installation level. Officials at 16 of the 22 installations
    we visited told us that they would have more vigorously advocated for
    resources to fund protection of critical assets had they been aware of
    an asset's criticality to TRANSCOM's mission. Without service-specific
    guidance to ensure that mission-critical assets are being protected,
    installations rely on other complementary programs in lieu of the all-
    hazards approach[Footnote 23] that DCIP requires.

    Installation Coordination Efforts Have Been Extensive, but Often Do Not
    Focus on the Assurance of Mission-Critical Assets:

    Nearly all of the installations (18 of 22) we visited had coordinated
    with both DOD and non-DOD entities, including the private sector, state
    and local governments, and foreign governments to help assure the
    availability of critical transportation assets at home and abroad.
    However, these coordination efforts have been performed independent of
    DCIP and, therefore, focus on protecting people and not on assuring the
    availability of mission-critical transportation assets. DOD DCIP
    guidance requires the combatant commands to coordinate with one another
    and with the military services and sector lead agents to identify and
    assess critical assets. At 21 of the 22 sites we visited, installation
    officials had taken steps to coordinate such efforts with DOD
    organizations on the installation and/or with the private sector, state
    and local communities, or with host nation officials. For example, at
    one air base we visited in Europe, installation officials conducted
    joint security patrols with host nation military officials and trained
    jointly with military and civilian firefighting personnel. Further, at
    10 DOD installations we visited in the Pacific region, installation
    officials routinely coordinated with state, local, and foreign
    governments on emergency management planning or scenarios, such as
    typhoons and earthquakes. Such coordination efforts, however, do not
    directly assure the availability of specific critical assets in the
    wake of a natural or man-made disaster.

    Installations Have Taken Steps to Mitigate the Potential Disruption of
    Public Works:

    To mitigate public works disruptions, personnel at 18 of the 22
    installations we visited were coordinating with DOD organizations on
    the installation, as well as local, state, or host nation officials.
    Specifically, these installations had developed resiliency in
    supporting public works infrastructure, such as fuel and electric power
    sources, so that critical transportation assets remained operational in
    the event of an installation-wide disruption. For example, 18 of these
    installations have developed backup or alternative capabilities to
    mitigate the loss of electricity and fuel. For 17 of the 22 critical
    transportation assets we visited, installation personnel were
    coordinating with DOD tenant organizations on the installation and with
    host governments to maintain and sustain public works support for its
    assets located on the facility. Most of the installations we visited
    (17 of 22) had emergency management plans and continuity of operations
    plans that accounted for the loss or degradation of supporting public
    works infrastructure located on or within the installation, although
    none of the plans specifically identified the critical transportation
    assets as high-priority assets vis-�-vis the installation's other
    assets. We also found that installation personnel at 18 of the 22
    locations we visited frequently tested and maintained backup fuel and
    electric power sources and often included them in their emergency
    management planning exercises. Seventeen of these installations had
    developed prioritized facilities lists to determine which facilities or
    assets would receive priority for power restoration when power to the
    installation was interrupted.

    Critical Transportation Asset Assurance Has Received Some Funding
    through DCIP and Has Benefited from Other Sources of Funding:

    DOD has allocated approximately $283.3 million for critical asset
    assurance through DCIP from fiscal years 2004 to 2008. DCIP guidance
    requires combatant commands and sector lead agents to provide adequate
    resources to implement their DCIP responsibilities. TRANSCOM has
    received approximately $8.6 million over this period to carry out its
    DCIP responsibilities, both as a combatant command and as a sector lead
    agent for the Transportation Defense Sector. In addition to these
    funds, critical transportation assets also have benefited indirectly
    from other DOD programs, such as the Antiterrorism Program, and from
    funding from foreign governments in countries where the United States
    maintains a military presence.

    Of the $8.6 million TRANSCOM has received in total DCIP funding from
    fiscal years 2004 to 2008, approximately $5.7 million has been used for
    carrying out its combatant command responsibilities and approximately
    $2.9 million has been used for implementing its transportation defense
    sector responsibilities.

    TRANSCOM, which is funded by the Air Force, as TRANSCOM's executive
    agent, has requested DCIP funding for fiscal years 2009 to 2013
    totaling $9.4 million for its combatant command responsibilities and
    $4.1 million[Footnote 24] for its defense sector responsibilities.
    Although the Air Force has not established a dedicated funding account
    for DCIP for itself,[Footnote 25] according to TRANSCOM officials, the
    Air Force has budgeted DCIP funding for TRANSCOM to perform its
    combatant command and defense sector responsibilities. Figure 5 depicts
    TRANSCOM's DCIP allocated and planned funding for its combatant command
    and defense sector responsibilities from fiscal years 2004 to 2013.

    Figure 5: TRANSCOM's DCIP Funding Trend, Fiscal Years 2004 to 2013:

    This figure is a combination line graph showing TRANSCOM's DCIP funding
    trend, fiscal years 2004 to 2013. The X axis represents the fiscal
    year, and the Y axis represents the dollars (in millions). The lines
    represent the sector allocated, which becomes sector budgeted. The
    other line represents and turns to TRANSCOM budgeted.

    Fiscal year: 2004;
    Sector allocated: [Empty];
    TRANSCOM allocated: 2.2.

    Fiscal year: 2005;
    Sector allocated: 0.552;
    TRANSCOM allocated: 0.552.

    Fiscal year: 2006;
    Sector allocated: 0.413;
    TRANSCOM allocated: 0.631.

    Fiscal year: 2007
    Sector allocated: 0.413;
    TRANSCOM allocated: 0.631.

    Fiscal year: 2008;
    Sector budgeted: 1.5;
    TRANSCOM budgeted: 1.7.

    Fiscal year: 2009;
    Sector budgeted: 1.2;
    TRANSCOM budgeted: 1.8.

    Fiscal year: 2010;
    Sector budgeted: 0.72;
    TRANSCOM budgeted: 1.8.

    Fiscal year: 2011;
    Sector budgeted: 0.72;
    TRANSCOM budgeted: 1.8.

    Fiscal year: 2012;
    Sector budgeted: 0.72;
    TRANSCOM budgeted: 2.

    Fiscal year: 2013;
    Sector budgeted: 0.72;
    TRANSCOM budgeted: 2.

    [See PDF for image]

    Source: GAO analysis of DOD data.

    [A] Sector-specific funding data are unavailable for fiscal year 2004.

    [End of figure]

    The assurance of critical transportation assets also benefits,
    indirectly, from other DOD sources, such as the Antiterrorism Program
    and the Combating Terrorism Readiness Initiative Fund. Among other
    things, the Antiterrorism Program provides a source of funding for
    installations to remediate vulnerabilities to transportation assets.
    Typically, remediation actions, such as improved security at entry
    control points or the hardening of a building to withstand an explosive
    blast, are done to counter a perceived terrorist threat--and do not
    explicitly consider other threats and hazards. Nonetheless, critical
    assets located within the installation or within a hardened building
    will benefit as a result of these other efforts. Further, the Combating
    Terrorism Readiness Initiative Fund provides another mechanism to fund
    antiterrorism measures, which tangentially affects the assurance of
    critical transportation assets.

    In addition to other DOD programs, foreign countries that host the U.S.
    military fund initiatives that indirectly help assure critical
    transportation assets. For example, U.S. embassy officials estimate
    that one country we visited in U.S. Central Command's area of
    responsibility provides over $1 billion annually and one country we
    visited in U.S. Pacific Command's area of responsibility contributes
    about $4.1 billion annually in support of the U.S. military presence in
    its country. In both instances, a portion of the funding contributed by
    these countries is used to safeguard installations containing critical
    transportation assets.

    Conclusions:

    Until now, TRANSCOM's practice of designating entire air bases,
    seaports, and commercial airports as critical transportation assets has
    been inconsistent with DCIP guidance and the approach adopted by some
    of the other combatant commands and military services to identify
    specific mission-critical assets. Recently, however, TRANSCOM decided
    to discontinue its current critical asset identification process in
    favor of the draft critical asset identification methodology.
    TRANSCOM's decision will necessitate reevaluating the approximately 300
    installations on its existing critical asset list--an undertaking that
    could potentially delay ASD(HD&ASA)'s issuance of the department's
    approved Defense Critical Asset List. Consequently, it is important for
    TRANSCOM to establish a timeline and key dates associated with the
    reevaluation process so that ASD(HD&ASA) can account for transportation
    assets in future iterations of the Defense Critical Asset List. Once
    this process is completed, ASD(HD&ASA) should have greater visibility
    over the full complement of mission-critical infrastructure and be
    better positioned to effectively remediate vulnerabilities to its most
    critical assets. While TRANSCOM officials have stated that they will
    discontinue the practice of using Transportation Infrastructure
    Vulnerability Assessments to identify specific critical transportation
    assets on the installations, they were not able to provide ASD(HD&ASA)
    or us with any documentation to confirm this decision officially.
    Lastly, until TRANSCOM finalizes its memorandum of understanding with
    the Joint Staff, it will not be able to define the roles and
    responsibilities of transportation subject matter experts to
    participate in the Joint Staff vulnerability assessments with a DCIP
    module.

    Although OSD issued department-wide guidance on critical infrastructure
    in 2005, knowledge of the program at the installation level--where
    critical transportation assets are located--is minimal because the
    military services have not yet developed their own implementation
    guidance. This lack of awareness has led installation officials to rely
    on other, more established programs to protect critical assets. While
    programs, such as DCIP and the Antiterrorism Program, do share some
    precepts, there are significant differences in the types of threats and
    hazards each program focuses on and in their emphasis on protection,
    resilience, and restoration of operations and assets. Until the
    military services issue guidance that installation personnel can use to
    implement local critical infrastructure programs, mission-critical
    assets may incur unintended risk.

    Recommendations for Executive Action:

    We are making the following four recommendations to help assure the
    availability of critical assets in the Transportation Defense Sector.

    To enable decision makers within DOD to more effectively prioritize and
    target limited resources to reduce critical asset vulnerabilities and
    allow ASD(HD&ASA) to formulate a complete and accurate list of Defense
    Critical Assets, we recommend that the Secretary of Defense, through
    ASD(HD&ASA) and the Chairman of the Joint Chiefs of Staff, direct the
    Commander of TRANSCOM to take the following three actions:

    * Fully implement the criteria, methodology, and process in the draft
    DOD Critical Asset Identification Process manual to reevaluate and
    update the identification of all critical transportation assets, and
    develop a timeline for doing so.

    * Discontinue the use of Transportation Infrastructure Vulnerability
    Assessments as its primary tool for identifying its critical assets.

    * Finalize its memorandum of understanding with the Joint Staff to
    enable TRANSCOM transportation subject matter experts to participate in
    the DCIP module of a Joint Staff vulnerability assessment.

    To facilitate DCIP implementation at the installation level, we
    recommend that the Secretary of Defense direct the secretaries of the
    military departments to develop and implement service-specific guidance
    based on published DOD DCIP guidance.

    Agency Comments and Our Evaluation:

    In written comments on a draft of this report, which included three
    draft recommendations, DOD partially concurred with our
    recommendations. Also, TRANSCOM and U.S. Central Command provided us
    with technical comments, which we incorporated in the report where
    appropriate. DOD's comments are reprinted in appendix II.

    In its written comments, DOD stated that it partially concurred with
    our recommendation that TRANSCOM fully implement the criteria,
    methodology, and processes outlined in the draft DOD Critical Asset
    Identification Process manual to reevaluate and update the
    identification of all critical transportation assets, and develop a
    timeline for doing so. DOD agreed with the recommendation and noted
    that TRANSCOM already has initiated implementation of the current draft
    manual as a means to reevaluate identification of critical
    transportation assets. DOD stated that, consequently, TRANSCOM does not
    require additional ASD(HD&ASA) direction to do so. However, while
    TRANSCOM officials agreed during our review to begin reevaluating their
    critical assets using established criteria in the draft manual, our
    recommendation also calls for TRANSCOM to develop a timeline for
    completing this action. DOD acknowledged in its written comments that
    while the draft manual provides a process for critical asset
    identification, it has not yet provided timelines for the various
    milestones. DOD's comments stated that ASD(HD&ASA) will work with the
    various components to establish timelines, but estimated that the
    manual will require approximately 1 year to complete, and will require
    timely cooperation and participation by numerous stakeholders. We
    believe that establishing these timelines is essential so that TRANSCOM
    can reevaluate and update the identification of all critical
    transportation assets in a timely manner.

    DOD partially concurred with our draft recommendation that TRANSCOM
    finalize the memorandum of understanding with the Joint Staff to
    discontinue the use of Transportation Infrastructure Vulnerability
    Assessments as its primary tool for identifying its critical assets. In
    its written comments, DOD noted that this recommendation contained two
    separate issues: (1) the discontinuation of the Transportation
    Infrastructure Vulnerability Assessments as means to identify critical
    assets and (2) the finalization of a memorandum of understanding
    between TRANSCOM and the Joint Staff. DOD noted in its written comments
    that the purpose of the memorandum of understanding is to define the
    roles and responsibilities of transportation subject matter experts to
    augment the enhanced DCIP module rather than to discontinue the use of
    the Transportation Infrastructure Vulnerability Assessments. In
    response to DOD's comments and to reflect this distinction, we made
    this two recommendations rather than one. DOD also stated that no
    additional direction on ASD(HD&ASA)'s part is required because TRANSCOM
    has already taken steps to address both of these issues. As noted in
    our report, however, TRANSCOM officials were unable to provide
    ASD(HD&ASA) or us with any documentation to confirm that they have
    discontinued the use of the Transportation Infrastructure Vulnerability
    Assessments. TRANSCOM's discontinuation of the Transportation
    Infrastructure Vulnerability Assessments as a means of identifying
    critical transportation assets and its adoption of the manual's
    methodology are both key to TRANSCOM's ability to provide DOD with an
    accurate list of critical transportation assets. Further, while we
    recognize that TRANSCOM has taken steps to coordinate with the Joint
    Staff to define its roles and responsibilities for the DCIP module to
    the Joint Staff Integrated Vulnerability Assessment, the memorandum of
    understanding remains in draft. Timely completion of the draft
    memorandum of understanding is important so that TRANSCOM's expertise
    can be adequately leveraged on future vulnerability assessments of
    critical transportation infrastructure. Therefore, we believe this
    recommendation remains valid.

    Finally, DOD partially concurred with our recommendation to develop and
    implement service-specific guidance based on published DOD DCIP
    guidance. In its written response, DOD stated that the Army has already
    developed and is implementing service-specific guidance, and it noted
    that the military departments prefer to wait for the official
    publication of the draft DOD Critical Asset Identification Process
    manual before implementing service-specific guidance. We acknowledge
    the Army's efforts and recognize that other military services may
    prefer to wait until the manual is published before they implement
    service-specific guidance. However, our recommendation is based on the
    entire body of DOD's DCIP guidance--not just the draft DOD Critical
    Asset Identification Process manual, which is focused primarily on
    identification of critical assets and will take at least another year
    to complete. In our view, service-specific DCIP guidance should be
    issued promptly based on DOD Directive 3020.40 and DOD Instruction
    3020.45, which have been finalized at the OSD level. In the absence of
    timely service-specific DCIP guidance, installation personnel will
    continue to rely primarily on antiterrorism plans instead of on an all-
    hazards approach to remediate, mitigate, or otherwise reduce the
    vulnerabilities to critical transportation infrastructure.

    As agreed with your offices, we are sending copies of this report to
    the Chairmen and Ranking Members of the Senate and House Committees on
    Appropriations, Senate and House Committees on Armed Services, and
    other interested congressional parties. We also are sending copies of
    this report to the Secretary of Defense; the Secretary of Homeland
    Security; the Secretary of State; the Chairman of the Joint Chiefs of
    Staff; the Secretaries of the Army, the Navy, and the Air Force; the
    Commandant of the Marine Corps; the Combatant Commanders of the
    functional and geographic combatant commands; the Commander, U.S. Army
    Corps of Engineers; and the Director, Office of Management and Budget.
    We will also make copies available to others upon request.

    If you or your staff have questions concerning this report, please
    contact me at (202) 512-5431 or . Contact points for our Offices of
    Congressional Relations and Public Affairs may be found on the last
    page of this report. GAO staff who made major contributions to this
    report are listed in appendix III.

    Signed by:

    Davi M. D'Agostino:

    Director, Defense Capabilities and Management:

    [End of section]

    Appendix I: Scope and Methodology:

    To conduct our review of the Department of Defense's (DOD) efforts to
    assure the availability of critical assets in the Transportation
    Defense Sector, we obtained relevant documentation and interviewed
    officials from the following DOD organizations:[Footnote 26]

    Office of the Secretary of Defense:

    * Under Secretary of Defense (Comptroller)/Chief Financial Officer:

    * Assistant Secretary of Defense for Homeland Defense and Americas'
    Security Affairs (ASD[HD&ASA]):

    Joint Staff, Directorate for Operations, Antiterrorism and Homeland
    Defense:

    Defense Threat Reduction Agency, Combat Support Assessments Division:

    Military Services:

    * Department of the Army, Asymmetric Warfare Office, Critical
    Infrastructure Risk Management Branch:

    * Department of the Navy:

    - Office of the Chief Information Officer:

    - Mission Assurance Division, Naval Surface Warfare Center, Dahlgren
    Division, Dahlgren, Virginia:

    * Department of the Air Force, Air, Space and Information Operations,
    Plans, and Requirements, Homeland Defense Division:

    * Headquarters, U.S. Marine Corps, Security Division, Critical
    Infrastructure Protection Office:

    Combatant Commands:

    * Headquarters, U.S. Central Command, Critical Infrastructure Program
    Office, MacDill Air Force Base, Florida:

    * Headquarters, U.S. European Command, Critical Infrastructure
    Protection Program Office, Patch Barracks, Germany:

    * Headquarters, U.S. Pacific Command, Antiterrorism and Critical
    Infrastructure Division, Camp H.M. Smith, Hawaii:

    - U.S. Forces Japan:

    Headquarters, U.S. Transportation Command (TRANSCOM), Critical
    Infrastructure Program, Scott Air Force Base, Illinois:

    * Headquarters, Air Mobility Command, Homeland Defense Branch, Scott
    Air Force Base, Illinois:

    * Headquarters, Military Sealift Command, Force Protection Office:

    * Headquarters, Surface Deployment and Distribution Command, Scott Air
    Force Base, Illinois:

    * Headquarters, Transportation Engineering Agency, Scott Air Force
    Base, Illinois:

    Defense Infrastructure Sector Lead Agents:

    * Headquarters, U.S. Transportation Command, Critical Infrastructure
    Program, Scott Air Force Base, Illinois:

    * Headquarters, U.S. Army Corps of Engineers, Directorate of Military
    Programs:

    Selected critical assets in the continental United States, Hawaii, the
    U.S. Territory of Guam, Germany, Greece, Kuwait and another country in
    U.S. Central Command's area of responsibility, and Japan:

    We also met with officials from the Department of Homeland Security,
    Infrastructure Information Collection Division, to discuss the extent
    to which DOD was coordinating with the Department of Homeland Security
    on the protection of non-DOD-owned defense critical assets in the
    Transportation and Public Works Defense Sectors. Further, to become
    more familiar with additional work being conducted on defense critical
    infrastructure, we met in Arlington, Virginia, with officials from the
    George Mason University School of Law's Critical Infrastructure
    Protection Program and in Washington, D.C., with the Congressional
    Research Service (Resources, Science, and Industry Division).

    We drew a nonprobability sample of critical transportation assets
    located in the United States and abroad, using several critical asset
    lists developed by the Joint Staff, each of the four military services,
    and TRANSCOM. The assets we selected for review were initially drawn
    from the Joint Staff's list of Tier 1[Footnote 27] critical
    transportation assets; however, the list includes only 4 Tier 1
    critical transportation assets worldwide.[Footnote 28] To increase the
    size of our sample, we used TRANSCOM's Tier 1[Footnote 29] and Tier 2
    critical asset lists, which together total 300 critical assets.
    Further, we analyzed critical asset lists from each of the four
    military services for overlap with TRANSCOM's critical asset list. From
    this, we selected 22 assets for review that included geographic
    dispersion among two countries in each geographic region (Europe, the
    Middle East, and the Pacific). We also selected assets from each
    military service and that were representative of the three principal
    types of assets identified by TRANSCOM--air base, seaport, commercial
    airport. Our cases for review included two of the four Tier 1 critical
    transportation assets. The specific assets we reviewed, their
    locations, and the missions that they support are omitted from this
    appendix, since that information is classified. Figure 6 shows the
    methodology we used to select the critical transportation assets for
    review.

    Figure 6: GAO Critical Transportation Asset Selection Methodology:

    This figure is a flowchart detailing GAO Critical Transportation Asset
    Selection methodology.

    [See PDF for image]

    Source: GAO analysis of DOD data.

    [End of figure]

    Table 1 shows a breakout of critical transportation assets selected by
    geographic combatant command.

    Table 1: Number of Critical Transportation Assets Selected by Asset
    Category and Geographic Combatant Command Area of Responsibility:

    Geographic Combatant Command: U.S. Northern Command;
    Air base: 2;
    Seaport: 1;
    Commercial airport: 1[A].

    Geographic Combatant Command: U.S. European Command;
    Air base: 2[B];
    Seaport: 0[B];
    Commercial airport: 0.

    Geographic Combatant Command: U.S. Central Command;
    Air base: 2;
    Seaport: 3;
    Commercial airport: 1.

    Geographic Combatant Command: U.S. Pacific Command[C];
    Air base: 4;
    Seaport: 4;
    Commercial airport: 2.

    Source: GAO analysis.

    [A] Selected but not visited.

    [B] One of the installations we visited in Europe identified by
    TRANSCOM is both an air base and a seaport.

    [C] U.S. Pacific Command's area of responsibility includes Hawaii and
    the U.S. Territory of Guam.

    [End of table]

    Because the Joint Staff list of Tier 1 critical assets does not include
    critical assets from the Public Works Defense Sector, for the purposes
    of this report, we are treating public works assets as supporting
    infrastructure. For the critical transportation assets that we
    selected, we also spoke with the asset owners and operators about their
    reliance on public works assets that support the critical assets.

    To evaluate TRANSCOM's identification and assessment efforts of its
    critical transportation assets, we reviewed documentation and guidance
    and met with officials from ASD(HD&ASA), the Joint Staff, the military
    services, and TRANSCOM. We analyzed critical asset identification
    criteria and guidance and compared the guidance with current asset
    identification efforts. In addition, we spoke with DOD installation and
    U.S. embassy personnel to discuss their involvement with various DOD
    critical asset data calls and other efforts they participated in to
    identify critical assets. We reviewed TRANSCOM's Transportation
    Infrastructure Vulnerability Assessments for assets we selected for
    review to determine if specific critical transportation assets below
    the installation level were identified. We also attempted to match
    these critical assets identified through the TRANSCOM's vulnerability
    assessments with assets listed on TRANSCOM's critical asset list.

    To determine the extent to which DOD installation personnel have taken
    actions to help assure the availability of critical transportation
    assets, both within and independent of DCIP, we reviewed DOD guidance
    on risk management and other complementary programs. In addition, we
    reviewed and analyzed installation emergency management plans and
    continuity of operations plans to determine how, if at all, critical
    assets were incorporated. We also interviewed combatant command,
    subcomponent, and installation personnel responsible for assuring the
    availability of critical transportation assets to ascertain the
    adequacy of guidance, assessments, inspections, funding, and other
    processes to enhance asset availability. Finally, we assessed the
    supporting public works infrastructure for the 22 assets we selected
    for review to determine their impact on the availability of the
    critical asset.

    To determine how DOD is funding critical transportation asset
    assurance, we reviewed and analyzed DCIP funding data and we
    interviewed officials from the Office of the Under Secretary of Defense
    (Comptroller)/Chief Financial Officer. Additionally, we interviewed
    officials from ASD(HD&ASA) and TRANSCOM to verify that the funding data
    were comprehensive and reflected DCIP funding from all sources.
    Further, we interviewed installation officials; personnel from U.S.
    Forces Japan, U.S. European Command, U.S. Central Command, and U.S.
    Pacific Command; and U.S. embassy officials in Kuwait and another
    country in U.S. Central Command's area of responsibility, and Japan
    regarding other sources of funding. These sources include funding from
    other complementary programs or host nation contributions that provide
    an indirect contribution to the assurance of critical transportation
    assets. We found the data provided by DOD to be sufficiently reliable
    for representing the nature and extent of the DCIP funding.

    We conducted this performance audit from May 2007 through July 2008 in
    accordance with generally accepted government auditing standards. Those
    standards require that we plan and perform the audit to obtain
    sufficient, appropriate evidence to provide a reasonable basis for our
    findings and conclusions based on our audit objectives. We believe that
    the evidence obtained provides a reasonable basis for our findings and
    conclusions based on our audit objectives.

    [End of section]

    Appendix II: Comments from the Department of Defense:

    Assistant Secretary Of Defense:
    2600 Defense Pentagon:
    Washington, D.C. 20301-2600:

    Homeland Defense & Americas Security Affairs:

    August 11, 2008:

    Ms. Davi M. D'Agostino:
    Director, Defense Capabilities and Management:
    U.S. Government Accountability Office:
    441 G Street, N.W.:
    Washington, DC 20548:

    Dear Ms. D'Agostino:

    This is the Department of Defense (DoD) response to the GAO draft
    report, GAO-08-851, "Defense Critical Infrastructure: Adherence to
    Guidance Would Improve DoD's Approach to Identifying and Assuring the
    Availability of Critical Transportation Assets," (GAO Code 351124). DoD
    partially concurs with the three recommendations in the report. Our
    response to your recommendations is enclosed.

    Our point of contact for this action is Mr. Antwane Johnson, Office of
    the Assistant Secretary of Defense for Homeland Defense and Americas'
    Security Affairs, (703) 602-5730, extension 143 or
    Antwane.Johnson@osd.mil.

    Sincerely,

    Signed by:

    Paul McHale

    [End of section]

    Enclosure:
    As stated:

    GAO Draft Report � Dated July 18, 2008 GAO Code 351124/GAO-08-851
    "Defense Critical Infrastructure: Adherence to Guidance Would Improve
    Doll's Approach to Identifying and Assuring the Availability of
    Critical Transportation Assets":

    Department Of Defense Comments To The Recommendations:

    Recommendation 1: The GAO recommends that the Secretary of Defense
    through the Assistant Secretary of Defense for Homeland Defense and
    Americas' Security Affairs (ASD (HD&ASA) and the Chairman of the Joint
    Chiefs of Staff, direct the Commander of the U.S. Transportation
    Command to fully implement the criteria, methodology, and process in
    the DoD Critical Asset Identification Process Manual to reevaluate and
    update the identification of all critical transportation assets, and
    develop a timeline for doing so.

    DOD Response: Partially concur. ASD (HD&ASA) agrees with the
    recommendation to fully implement the criteria, methodology, and
    process in Critical Asset Identification Process (CAIP) Manual and to
    reevaluate and update the identification of all critical transportation
    assets. However, as noted in the report, the U.S. Transportation
    Command (USTRANSCOM) already has initiated implementation of the
    current draft CAIP Manual as a means to reevaluate identification of
    transportation-related Task Critical Assets (TCAs); consequently
    USTRANSCOM does not require additional ASD (HD&ASA) direction to do so.
    While the draft CAIP Manual provides a process for critical asset
    identification, it has not yet provided timelines for the various
    milestones. ASD (HD&ASA) will work with Components to establish
    timelines. The CAIP requires close coordination between mission and
    asset owners, and given the complexity of interaction among the many
    participants in the process, we anticipate it will require
    approximately 1 year to complete the CAIP, and will require timely
    cooperation and participation by numerous stakeholders. Since the
    Defense Critical Asset (DCA) List is dynamic, as TCAs are identified in
    accordance with the Manual, they will be submitted into Strategic
    Mission Assurance Data System (SMADS) and may then be considered by the
    Joint Staff and the ASD (HD&ASA) as DCA candidates.

    Recommendation 2: The GAO recommends that the Secretary of Defense
    through the Assistant Secretary of Defense for homeland Defense and
    Americas' Security Affairs (ASD (HD&ASA) and the Chairman of the Joint
    Chiefs of Staff, direct the Commander of the U.S. Transportation
    Command to finalize the memorandum of understanding with the Joint
    Staff to discontinue the use of Transportation Infrastructure
    Vulnerability Assessments as its primary tool for identifying its
    critical assets.

    DOD Response: Partially concur. ASD (HD&ASA) agrees with the
    recommendation to finalize the memorandum of understanding with the
    Joint Staff and to discontinue the use of Transportation Infrastructure
    Vulnerability Assessments (TIVAs) as the primary tool to identify
    critical assets. However, those are two separate issues.

    To accurately reflect the issues in the recommendation, request the
    recommendation be re- worded to read as follows: "The GAO recommends
    that the Secretary of Defense through the ASD (HD&ASA) and the Chairman
    of the Joint Chiefs of Staff, direct the Commander, U.S. Transportation
    Command (USTRANSCOM) to discontinue the use of TIVAs as its primary
    tool for identifying its critical assets and continue discussions with
    the Joint Staff to finalize the memorandum of understanding for
    USTRANSCOM CIP transportation subject matter experts to augment the
    enhanced DCIP module to the Joint Staff's Integrated Vulnerability
    Assessment when transportation assets are assessed." As currently
    written, this GAO recommendation implies the purpose of the memorandum
    of understanding is to discontinue the execution of TIVAs. In fact, the
    memorandum is being developed to define the roles and responsibilities
    of transportation subject matter experts to augment the enhanced DCIP
    module. A memorandum of understanding for the discontinuance of TIVAs
    is not required. This discontinuance, a USTRANSCOM initiative started
    on June 27, 2008, has already been taken in coordination with the Joint
    Staff; consequently USTRANSCOM does not require additional ASD (HD&ASA)
    direction to do so.

    As discussed in the July 1, 2008 Exit Teleconference, USTRANSCOM has
    already discontinued the planning and execution of its TIVAs. Assets
    will be identified in accordance with the Critical Asset Identification
    Process Manual methodology and in coordination with other Mission
    Owners and Resource Providers.

    Recommendation 3: The GAO recommends that the Secretary of Defense
    direct the Secretaries of the Military Departments to develop and
    implement Service-specific guidance based on published DoD Defense
    Critical Infrastructure Program guidance.

    DOD Response: Partially concur. Although the Army has developed Service-
    specific guidance (AR 525-26) and HQDA Implementation Letter (in final
    staffing) and is executing that guidance along with DoD Directive
    3020.40 and DoD Instruction 3020.45, the Military Departments prefer to
    await official publication of the Critical Asset Identification Process
    prior to implementing Service-specific guidance.

    [End of section]

    Appendix III: GAO Contact and Staff Acknowledgments:

    GAO Contact:

    Davi M. D'Agostino, (202) 512-5431 or:

    Acknowledgments:

    In addition to the contact named above, Mark A. Pross, Assistant
    Director; Jon K. Bateman; Gina M. Flacco; James P. Krustapentus; Kate
    S. Lenane; Danielle Pakdaman; Terry L. Richardson; Marc J. Schwartz;
    John S. Townes; Cheryl A. Weissman; and Alex M. Winograd made key
    contributions to this report.

    [End of section]

    Related GAO Products:

    Defense Critical Infrastructure: Additional Air Force Actions Needed at
    Creech Air Force Base to Ensure Protection and Continuity of UAS
    Operations. GAO-08-469RNI. Washington, D.C.: April 23, 2008 (For
    Official Use Only).

    Defense Critical Infrastructure: DOD's Risk Analysis of Its Critical
    Infrastructure Omits Highly Sensitive Assets. GAO-08-373R. Washington,
    D.C.: April 2, 2008.

    Defense Infrastructure: Management Actions Needed to Ensure
    Effectiveness of DOD's Risk Management Approach for the Defense
    Industrial Base. GAO-07-1077. Washington, D.C.: August 31, 2007.

    Defense Infrastructure: Actions Needed to Guide DOD's Efforts to
    Identify, Prioritize, and Assess Its Critical Infrastructure. GAO-07-
    461. Washington, D.C.: May 24, 2007.

    [End of section]

    Footnotes:

    [1] Department of Defense, The National Military Strategy of the United
    States of America: A Strategy for Today: A Vision for Tomorrow
    (Washington, D.C.: 2004). The National Military Strategy is the Joint
    Chiefs of Staff's document on the strategic direction of the armed
    forces, which establishes three military objectives: (1) protect the
    United States against external attacks and aggression, (2) prevent
    conflict and surprise attack, and (3) prevail against adversaries.

    [2] Department of Defense, Quadrennial Defense Review Report
    (Washington, D.C.: Feb. 6, 2006). The Quadrennial Defense Review is a
    comprehensive internal review of DOD's forces, resources, and programs.

    [3] The purpose of public works infrastructure, according to the draft
    DOD Critical Asset Identification Process manual, is to provide and
    maintain utilities and real property and provide emergency services.

    [4] DOD Directive 3020.40, Defense Critical Infrastructure Program
    (DCIP) (Washington, D.C.: Apr. 19, 2005).

    [5] The 10 defense sectors are the Defense Industrial Base; Financial
    Services; Global Information Grid; Health Affairs; Intelligence,
    Surveillance, and Reconnaissance; Logistics; Personnel; Public Works;
    Space; and Transportation.

    [6] GAO, Defense Infrastructure: Actions Needed to Guide DOD's Efforts
    to Identify, Prioritize, and Assess Its Critical Infrastructure, GAO-07-
    461 (Washington, D.C.: May 24, 2007).

    [7] GAO, Defense Infrastructure: Management Actions Needed to Ensure
    Effectiveness of DOD's Risk Management Approach for the Defense
    Industrial Base, GAO-07-1077 (Washington, D.C.: Aug. 31, 2007).

    [8] GAO, Defense Critical Infrastructure: DOD's Risk Analysis of Its
    Critical Infrastructure Omits Highly Sensitive Assets, GAO-08-373R
    (Washington, D.C.: Apr. 2, 2008).

    [9] GAO, Defense Critical Infrastructure: Additional Air Force Actions
    Needed at Creech Air Force Base to Ensure Protection and Continuity of
    UAS Operations, GAO-08-469RNI (Washington, D.C.: Apr. 23, 2008) (For
    Official Use Only).

    [10] GAO, Defense Critical Infrastructure: DOD's Evolving Assurance
    Program Has Made Progress but Leaves Critical Space, Intelligence, and
    Global Communications Assets at Risk, GAO-08-828NI (For Official Use
    Only), forthcoming.

    [11] GAO-07-461.

    [12] While public works is one of the 10 defense sectors identified by
    ASD(HD&ASA) in DOD Directive 3020.40, assets in this defense sector did
    not rise to the same level of criticality as assets in other sectors.
    Because the Joint Staff list of Tier 1 critical assets does not include
    critical assets from the Public Works Defense Sector, for the purposes
    of this report, we are treating public works assets as supporting
    infrastructure.

    [13] Results from nonprobability samples cannot be used to make
    inferences about a population, because in a nonprobability sample some
    elements of the population being studied have no chance or an unknown
    chance of being selected as part of the sample.

    [14] At the time of our sample selection, only four transportation
    assets had been identified as Tier 1 critical assets; however, TRANSCOM
    subsequently identified four more, raising the total to eight Tier 1
    critical transportation assets. Of these eight assets, two were
    included in our sample.

    [15] Homeland Security Presidential Directive 7 (Washington, D.C.: Dec.
    17, 2003).

    [16] DOD Directive 2000.12, DOD Antiterrorism (AT) Program (Washington,
    D.C.: Dec. 13, 2007).

    [17] DOD Directive 3020.26, Defense Continuity Program (DCP)
    (Washington, D.C.: Jan. 1, 2007).

    [18] DOD Directive 3020.40 defines an asset as a distinguishable
    network entity that provides a service or capability. Assets are
    people, physical entities, or information located either within or
    outside the United States and owned or operated by domestic, foreign,
    public, or private sector organizations.

    [19] DOD Instruction 3020.45, Defense Critical Infrastructure Program
    (DCIP) Management, (Washington, D.C.: Apr. 21, 2008).

    [20] DOD, ASD(HD&ASA), Strategy for Defense Critical Infrastructure
    (Washington, D.C.: Mar. 2008).

    [21] DOD Instruction 3020.45.

    [22] According to DOD Instruction 3020.45, ASD(HD&ASA) is responsible
    for issuing a list of Defense Critical Assets based on nominations from
    the Chairman of the Joint Chiefs of Staff.

    [23] An all-hazards approach looks not only at intentional threats,
    such as hostile or terrorist attack, but also non-intentional hazards,
    such as accidents, weather events, and natural disasters.

    [24] According to TRANSCOM officials, ASD(HD&ASA) will continue to fund
    the Transportation Defense Sector at an average of $720,000 per year
    until fiscal year 2013 at which time TRANSCOM will be required to seek
    funding for its defense sector responsibilities from the Air Force,
    TRANSCOM's executive agent.

    [25] A February 2006 memorandum from the Principal Deputy for
    ASD(HD&ASA) stated that beginning in fiscal year 2008, each service
    should allocate $2.4 million per year and each combatant command,
    through its executive agent, should allocate $1.8 million per year to
    carry out their assigned DCIP responsibilities.

    [26] DOD organizations are located in the Washington, D.C.,
    metropolitan area unless otherwise indicated.

    [27] Critical assets are categorized into three tiers based on their
    relative criticality. The loss, incapacitation, or disruption of a Tier
    1 asset could result in mission (or function) failure at the DOD,
    military department, combatant command, sub-unified command, defense
    agency, or defense infrastructure sector level. The loss,
    incapacitation, or disruption of a Tier 2 asset could result in mission
    (or function) degradation at the DOD, military department, combatant
    command, sub-unified command, defense agency, or defense infrastructure
    sector level. The loss, incapacitation, or disruption of a Tier 3 asset
    could result in mission (or function) failure below the military
    department, combatant command, sub-unified command, defense agency, or
    defense infrastructure sector level.

    [28] At the time of our sample selection, only four transportation
    assets had been identified as Tier 1 critical assets; however, TRANSCOM
    subsequently identified four more, raising the total to eight Tier 1
    critical transportation assets. Of these assets, two were included in
    our sample.

    [29] TRANSCOM's Tier 1 critical asset list is synonymous with the Joint
    Staff's Tier 1 critical transportation asset list.

    GAO's Mission:

    The Government Accountability Office, the audit, evaluation and
    investigative arm of Congress, exists to support Congress in meeting
    its constitutional responsibilities and to help improve the performance
    and accountability of the federal government for the American people.
    GAO examines the use of public funds; evaluates federal programs and
    policies; and provides analyses, recommendations, and other assistance
    to help Congress make informed oversight, policy, and funding
    decisions. GAO's commitment to good government is reflected in its core
    values of accountability, integrity, and reliability.

    Obtaining Copies of GAO Reports and Testimony:

    The fastest and easiest way to obtain copies of GAO documents at no
    cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
    weekday, GAO posts newly released reports, testimony, and
    correspondence on its Web site. To have GAO e-mail you a list of newly
    posted products every afternoon, go to [hyperlink, http://www.gao.gov]
    and select "E-mail Updates."

    Order by Mail or Phone:

    The first copy of each printed report is free. Additional copies are $2
    each. A check or money order should be made out to the Superintendent
    of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
    more copies mailed to a single address are discounted 25 percent.
    Orders should be sent to:

    U.S. Government Accountability Office:
    441 G Street NW, Room LM:
    Washington, D.C. 20548:

    To order by Phone:
    Voice: (202) 512-6000:
    TDD: (202) 512-2537:
    Fax: (202) 512-6061:

    To Report Fraud, Waste, and Abuse in Federal Programs:

    Contact:

    Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
    E-mail: fraudnet@gao.gov:
    Automated answering system: (800) 424-5454 or (202) 512-7470:

    Congressional Relations:

    Ralph Dawn, Managing Director, dawnr@gao.gov:
    (202) 512-4400:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7125:
    Washington, D.C. 20548:

    Public Affairs:

    Chuck Young, Managing Director, youngc1@gao.gov:
    (202) 512-4800:
    U.S. Government Accountability Office:
    441 G Street NW, Room 7149:
    Washington, D.C. 20548:

    *** End of document. ***