24 July 1997 Source: http://www.access.gpo.gov/su_docs/aces/aces160.shtml ------------------------------------------------------------------------ Combating Terrorism: Status of DOD Efforts to Protect Its Force Overseas (Letter Report, 07/21/97, GAO/NSIAD-97-207). GAO reviewed the Department of Defense's (DOD) efforts to protect U.S. forces from terrorist attacks, focusing on: (1) measures taken at overseas U.S. bases to enhance the security of deployed personnel; and (2) recent DOD initiatives to improve its antiterrorism program. GAO reviewed that: (1) many deployed U.S. forces are better protected today from terrorist attacks similar to the one that occurred at Khobar Towers; (2) during March and April 1997, GAO visited 30 overseas sites and found that security improvements were most evident where the risk of terrorism is the greatest, such as Turkey and the Middle East; (3) DOD has placed less emphasis on addressing vulnerabilities in countries that are currently considered to have a lower threat; (4) senior military commanders and defense officials GAO met with emphasized that they can reduce, but not eliminate, vulnerabilities and that further terrorist attacks against U.S. forces should be expected; (5) they also observed that efforts to defend against terrorism are complicated by a number of factors, including the ability of terrorists to decide where and when to attack and to choose from a wide selection of targets; (6) nevertheless, the officials said, some risk must be accepted as the United States pursues its national security strategy abroad; (7) since the bombing at Khobar Towers, DOD has initiated a number of changes aimed at improving its antiterrorism program; (8) for example, DOD has established a new office for combating terrorism on the Joint Staff, enhanced the antiterrorism responsibilities of the geographic combatant commands, and instituted a vulnerability assessment process under the aegis of the joint staff; (9) these initiatives, however, have not resulted in a comprehensive, consistent approach to antiterrorism as called for by the Downing task force; (10) for instance, DOD's force protection focal point has not provided the geographic combatant commanders the guidance the commanders believe they need to carry out their expanded antiterrorism responsibilities; (11) such guidance would include establishing standards for assessing vulnerabilities and agencywide physical security requirements designed to provide a minimum level of protection to U.S. forces no matter where they are located; (12) a comprehensive, consistent approach to antiterrorism using common standards would give commanders a more objective basis for determining whether they are providing adequate protection to their facilities and personnel; and (13) DOD would have a capability to compare vulnerabilities at different sites on a worldwide basis and thus ensure that sufficient emphasis is being placed on the most vulnerable areas. --------------------------- Indexing Terms ----------------------------- REPORTNUM: NSIAD-97-207 TITLE: Combating Terrorism: Status of DOD Efforts to Protect Its Force Overseas DATE: 07/21/97 SUBJECT: Terrorism Military bases Military personnel Armed forces abroad Explosives Facility security IDENTIFIER: Saudi Arabia Middle East Turkey Europe Riyadh (Saudi Arabia) Khobar Towers (Dhahran, Saudi Arabia) Dhahran (Saudi Arabia) ****************************************************************** ** This file contains an ASCII representation of the text of a ** ** GAO report. Delineations within the text indicating chapter ** ** titles, headings, and bullets are preserved. Major ** ** divisions and subdivisions of the text, such as Chapters, ** ** Sections, and Appendixes, are identified by double and ** ** single lines. The numbers on the right end of these lines ** ** indicate the position of each of the subsections in the ** ** document outline. These numbers do NOT correspond with the ** ** page numbers of the printed product. ** ** ** ** No attempt has been made to display graphic images, although ** ** figure captions are reproduced. Tables are included, but ** ** may not resemble those in the printed version. ** ** ** ** Please see the PDF (Portable Document Format) file, when ** ** available, for a complete electronic file of the printed ** ** document's contents. ** ** ** ** A printed copy of this report may be obtained from the GAO ** ** Document Distribution Center. For further details, please ** ** send an e-mail message to: ** ** ** ** ** ** ** ** with the message 'info' in the body. ** ****************************************************************** Cover ================================================================ COVER Report to Congressional Requesters July 1997 COMBATING TERRORISM - STATUS OF DOD EFFORTS TO PROTECT ITS FORCES OVERSEAS GAO/NSIAD-97-207 DOD's Antiterrorism Program (703174) Abbreviations =============================================================== ABBREV DOD - Department of Defense JCS/J-34 - Joint Chiefs of Staff/Deputy Directorate for Combating Terroism NATO - North Atlantic Treaty Organization Letter =============================================================== LETTER B-277464 July 21, 1997 The Honorable Ike Skelton House of Representatives The Honorable John Glenn Ranking Minority Member Committee on Governmental Affairs United States Senate As you requested, we have reviewed the Department of Defense's (DOD) efforts to protect U.S. forces from terrorist attacks. This report addresses (1) measures taken at overseas U.S. bases to enhance the security of deployed personnel and (2) recent DOD initiatives to improve its antiterrorism\1 program. We plan to issue a separate report on national counterterrorism policy and strategy; the roles, responsibilities, programs, and activities of federal agencies under this policy; and the mechanisms for coordinating interagency efforts. -------------------- \1 For the purposes of this report, we are using the DOD term "antiterrorism" to refer to defensive measures used to reduce the vulnerability of individuals and property to terrorist acts. Counterterrorism, in contrast, refers to offensive measures taken to prevent, deter, and respond to terrorism. Antiterrorism and counterterrorism are elements of a broader concept known as combating terrorism. In turn, combating terrorism is part of a much broader concept known as force protection. Other elements of force protection are physical security, operations security, protective services, and law enforcement operations. BACKGROUND ------------------------------------------------------------ Letter :1 In November 1995, a car bomb exploded in Riyadh, Saudi Arabia, killing five Americans who were working at the Office of the Program Manager, Saudi Arabian National Guard. A few months later, in June 1996, another terrorist bomb detonated near Dhahran, Saudi Arabia. The explosion killed 19 U.S. service personnel living in a high-rise apartment building at the Khobar Towers military complex. Hundreds more were injured. Soon after the Khobar Towers bombing, the Secretary of Defense appointed a task force headed by retired four-star Army General Wayne A. Downing to investigate the incident and make recommendations on how to prevent or minimize the damage of future attacks. The Downing Assessment Task Force completed its work in August 1996. The Secretary of Defense on the whole concurred with the task force's report and announced a series of measures intended to improve the protection of deployed U.S. forces. He said that the threat of sophisticated, organized terrorism against our overseas forces was now a fact of life and that U.S. leaders must adopt a "radically new mind-set" with regard to international terrorism. In early 1997, the Chairman of the Joint Chiefs of Staff provided a status report to Congress on DOD's response to the Downing task force. The Chairman stated DOD was implementing all of the task force's recommendations.\2 The task force found that DOD lacked a comprehensive, consistent approach to antiterrorism that is based on common guidance, standards, and procedures. A top priority, it said, should be designating a single element in DOD to oversee an integrated system approach to force protection efforts, manage resources, and assist commanders in the field. At that time, DOD lacked a single entity with responsibility for the program, and the task force stated this had an adverse impact on the posture of forces in the field. The task force noted that policies, standards, and available resources all varied significantly among both service and joint forces. The Downing task force identified key principles for managing and improving the Department's antiterrorism program. We used these as the primary criteria for our review. DOD does not know how much is being spent on antiterrorism because it cannot easily determine what costs are associated with its antiterrorism program. DOD has estimated that it spends about $4 billion a year on combating terrorism--the term DOD uses when discussing both antiterrorism and counterterrorism--but this figure includes broad cost elements such as physical security, counterintelligence, security and investigative matters, and counterterrorism.\3 In addition, certain costs related to antiterrorism are not captured in the $4 billion estimate. In particular, the estimate does not include funds being spent by base commanders from their base operations accounts--the money they use to finance the day-to-day operations of their activities. Also not included in this estimate is the cost of dual-use items such as ballistic body armor or armored vehicles that can be used in support of a unit's primary mission or to defend and protect against a terrorist attack. DOD designates the terrorist threat level faced by personnel in each country. A five-step scale is used to describe the severity of threat. These steps, from highest to lowest, are critical, high, medium, low, and negligible. Threat levels may be raised or lowered based on new information or analysis. In May 1997, DOD had designated 13 countries as having a high threat level and 1--Lebanon--as having a critical threat level (see fig. 1). Figure 1: Countries Where the Terrorist Threat Is Critical or High (as of May 15, 1997) (See figure in printed edition.) Source: Defense Intelligence Agency. (See figure in printed edition.) -------------------- \2 As of June 3, 1997, DOD said all but 2 of the task force's 81 recommendations had been implemented. Implementation of the two remaining recommendations was delayed by procurement problems. \3 About 90 percent of the costs in DOD's $4 billion estimate are for civilian and military personnel such as contract guards and military police. RESULTS IN BRIEF ------------------------------------------------------------ Letter :2 Many deployed U.S. forces are better protected today from terrorist attacks similar to the one that occurred at Khobar Towers. During March and April 1997, we visited 30 overseas sites and found that security improvements were most evident where the risk of terrorism is the greatest, such as Turkey and the Middle East. DOD has placed less emphasis on addressing vulnerabilities in countries that are currently considered to have a lower threat. Senior military commanders and defense officials we met with emphasized that they can reduce, but not eliminate, vulnerabilities and that further terrorist attacks against U.S. forces should be expected. They also observed that efforts to defend against terrorism are complicated by a number of factors, including the ability of terrorists to decide where and when to attack and to choose from a wide selection of targets. Nevertheless, the officials said, some risk must be accepted as the United States pursues its national security strategy abroad. Since the bombing at Khobar Towers, DOD has initiated a number of changes aimed at improving its antiterrorism program. For example, DOD has established a new office for combating terrorism on the Joint Staff, enhanced the antiterrorism responsibilities of the geographic combatant commands, and instituted a vulnerability assessment process under the aegis of the Joint Staff. These initiatives, however, have not resulted in a comprehensive, consistent approach to antiterrorism as called for by the Downing task force. For instance, DOD's force protection focal point has not provided the geographic combatant commanders the guidance the commanders believe they need to carry out their expanded antiterrorism responsibilities. Such guidance would include establishing standards for assessing vulnerabilities and agencywide physical security requirements designed to provide a minimum level of protection to U.S. forces no matter where they are located. A comprehensive, consistent approach to antiterrorism using common standards would give commanders a more objective basis for determining whether they are providing adequate protection to their facilities and personnel. Further, DOD would have a capability to compare vulnerabilities at different sites on a worldwide basis and thus ensure that sufficient emphasis is being placed on the most vulnerable areas. PROTECTION OF MANY U.S. FORCES HAS IMPROVED, BUT VULNERABILITIES REMAIN ------------------------------------------------------------ Letter :3 During our visits to overseas bases, we found significant security improvements have been made in Turkey and the Middle East to protect against vehicle bombs. In these countries, sites have been fortified in various ways against a terrorist attack, particularly against a truck bomb similar to the one that struck Khobar Towers. Commanders have attempted to extend the stand-off\4 distance around their facilities, and where sufficient stand-off cannot be obtained, they are using other measures to mitigate against the impact of a truck bomb. Saudi Arabia has seen the most profound changes, as thousands of DOD personnel have been moved to remote facilities in the desert and restricted from leaving base throughout their entire tour. Most military dependents have been sent back to the United States to reduce their exposure to the terrorist threat. Many dependents are also being withdrawn from Kuwait and Bahrain. In Turkey, an off-base apartment building dedicated solely to U.S. military personnel was closed because it was considered too vulnerable to a truck bomb attack. The personnel living in this building were relocated to on-base housing or dispersed to other off-base housing facilities. The base also had installed concrete barriers to make on-base residential areas and headquarters buildings less vulnerable and had begun to repair holes in the perimeter fence. DOD has placed less emphasis on improving security at sites where the terrorist threat is not considered to be high. Base officials at many of the installations we visited identified numerous vulnerabilities that were still to be addressed. For instance, stand-off distance around base facilities, including housing, was often a few feet or less. Facilities were frequently located in populated areas, abutting public roads and privately owned land, offices, or residences. Base officials said it would be very difficult to defend these facilities against a truck bomb attack like the one at Khobar Towers. However, they said it was impractical to obtain sufficient stand-off distance either due to shortages of suitable land or the high cost of obtaining it. During our visits, military officials told us that the question is not whether additional terrorist attacks will occur, but when, where, and how. In this light, they emphasized that while vulnerabilities to attacks can be reduced, a "zero defects" approach to fighting terrorism is not possible. DOD faces a number of obstacles in defending against future terrorist attacks. First, DOD has a large presence in many countries around the world, offering a plethora of potential targets. DOD does not have the resources to fully protect all of them all the time. Second, predictive intelligence on terrorist attacks is difficult to obtain. Commanders, therefore, may not be in a position to prevent an attack from occurring; they can only prepare to minimize the consequences from an attack. Third, DOD installations are often located on host nation installations and, as a result, there are limitations on the security measures DOD can undertake. Political and cultural considerations outside the control of local commanders may influence decisions that affect security. According to DOD officials, terrorism is a pervasive phenomenon, whose specific threats are difficult to predict. It is worldwide in scope, with some terrorist organizations state supported and some only loosely affiliated, in support of multiple causes. It is a transnational phenomenon, cutting across geographic and political boundaries. Areas considered safe and benign one day, such as Saudi Arabia prior to the bombings, can quickly become high threat the next. According to these officials, terrorism's tactic is not to challenge U.S. military power directly, but to weaken U.S. resolve through indirect attacks on weak links with high publicity value. In a September 1996 report to the President, the Secretary of Defense said executing the national security strategy to protect U.S. interests requires the physical presence of U.S. forces in many nations, presenting constant exposure to the threat. U.S. commanders in the past have accepted operating locations that present serious security challenges in today's terrorist environment. The location of Khobar Towers, for example, was difficult to defend, but the complex was paid for by the Saudis and convenient to U.S. military work areas. In most of the countries we visited, we found that many U.S. forces are located in urban areas, closely surrounded by easily accessible buildings or roads. In many cases overseas, U.S. forces work at facilities that are owned by the host nation, and they depend on the host nation for important security functions. U.S. forces in the Middle East are prevented from patrolling outside their own perimeter fencing. At one location we visited in Europe, entry to the base is controlled by host nation security forces with no U.S military role. The U.S. military does not have its own perimeter at this base and may not approach the base perimeter without escort. Some officials expressed concern that efforts to isolate and fortify DOD facilities could make other targets more vulnerable. For instance, terrorists could decide to target small military offices, housing areas, or vehicular traffic outside the main installations. In most of the countries we visited, many U.S. military personnel were living in off-base housing complexes or in individual quarters dispersed among the civilian population. In Naples, Italy, for instance, residences for U.S. personnel were spread out over an approximately 350 square-mile area. At one base we visited, antiterrorism officials were fairly comfortable with the security of the base but were concerned about a five-story housing complex for unaccompanied personnel that is located in a residential area off a heavily traveled street. This housing complex lacked basic physical security features such as protective window coating, a central fire alarm system, and adequate perimeter fencing. In addition to choosing different targets, terrorists can also alter their mode of attack. For instance, some commanders in the Middle East are concerned that terrorists will switch to weapons that can be fired over perimeter defenses from hidden locations. One U.S. commander was concerned that terrorists could launch indirect fire attacks from several sectors of the surrounding city. Such attacks are difficult to defend against because these weapons can be set up, fired, and moved from concealed areas very quickly. U.S. security officials at a base in Europe said because the host nation-controlled base perimeter is easily penetrated, they believe themselves to be more vulnerable to suitcase bombs than to truck bombs. -------------------- \4 According to DOD officials, stand-off is the distance between the base facilities and uncontrolled public and private land. DOD HAS TAKEN STEPS TO IMPROVE THE ANTITERRORISM PROGRAM ------------------------------------------------------------ Letter :4 DOD has initiated a number of changes in the antiterrorism program since the Khobar Towers bombing. Announcing the initiatives in September 1996, the Secretary of Defense stated that their intended aggregate effect was to (1) place antiterrorism up front as a major consideration with other key mission goals, (2) ensure that the threat and antiterrorism measures are constantly evaluated, and (3) empower commanders with increased resources and flexibility to be responsive to changes in threat. Some of the major initiatives are as follows: -- The Secretary of Defense issued a revision of DOD Directive 2000.12, which governs the Department's antiterrorism program. -- The Secretary of Defense assigned the Chairman, Joint Chiefs of Staff, to be his principal advisor on antiterrorism. To support this added responsibility, the Chairman created a new office in the Joint Staff--the Deputy Directorate for Combating Terrorism (JCS/J-34). -- The Secretary of Defense directed that the five geographic combatant commanders take on increased antiterrorism responsibilities. The commanders of the U.S. Atlantic Command, U.S. Central Command, U.S. European Command, U.S. Pacific Command, and U.S. Southern Command are now responsible for ensuring the protection of DOD personnel in their area of responsibility. Prior to this, no DOD components were explicitly given this responsibility. -- Under the direction of JCS/J-34, the Defense Special Weapons Agency began to conduct vulnerability assessments at installations. The assessments, which supplement those done by other DOD components, are intended to help commanders understand their vulnerabilities to terrorist attack and to give them options for enhancing security and mitigating weapon effects. -- DOD has mandated more robust antiterrorism training for personnel deploying to medium- and high-threat countries. The training is intended to increase awareness of the threat and provide information on individual protective measures. Additional training is to be provided to (1) personnel designated as unit antiterrorism instructors and advisors, (2) officers attending precommand courses, and (3) executive-level officials with antiterrorism responsibilities. -- The Secretary of Defense established a $14-million centrally controlled fund to support emergency, high-priority antiterrorism requirements not funded by the services. The fund is managed by JCS/J-34. -- The services have also planned or instituted changes in their approach to antiterrorism. Most notably, the Air Force has created a Force Protection Group that will be among the first to deploy in a contingency. The group, consisting of personnel from a variety of specialties, will be responsible for establishing the security infrastructure at the deployment site. During our visits overseas, we found evidence that commanders at all levels were placing more emphasis on the antiterrorism program than they had prior to Khobar Towers. Since that bombing, most sites had appointed an antiterrorism focal point, established a team to address antiterrorism issues, and conducted additional vulnerability assessments to identify needed improvements. By far the most progress had been made by the U.S. Central Command and its service component commands. U.S. Central Command's area of responsibility includes the Middle East, the region with the most high-threat countries. The special emphasis at U.S. Central Command is not unexpected given that its forces were the most recent targets of terrorist attacks. Among other actions, the command had -- determined the range of specific terrorist threats it needed to counteract in its area of responsibility, including a 20,000-pound truck bomb; -- devised threat-based standards, such as stand-off, to guide the design and construction of new facilities and modifications to existing structures; -- established a forward activity that is responsible for coordinating antiterrorism in the region and reports directly to the Deputy Commander-in-Chief, U.S. Central Command; and -- identified a need for hundreds of additional security personnel and filled these slots. The U.S. European Command, whose area of responsibility includes large parts of Europe, Africa, and the Middle East, also had made progress. Its Army component was particularly active in addressing antiterrorism issues. For instance, it had updated its operations order governing antiterrorism at Army sites, conducted assessments of the antiterrorism programs of its subordinate commands, and established a senior-level working group to make antiterrorism funding decisions. DOD STILL NEEDS TO DEVELOP A COMPREHENSIVE, CONSISTENT APPROACH TO ANTITERRORISM ------------------------------------------------------------ Letter :5 DOD's current emphasis on antiterrorism was still relatively new at the time we completed our review in June 1997--1 year after the Khobar Towers bombing. Nevertheless, our work raises concerns that its initiatives fall short of correcting the shortcomings identified in the Downing task force report and of meeting the needs of commanders in the field. The task force envisioned a comprehensive, consistent DOD approach to combating terrorism spearheaded by one office that would develop policy and standards, act as an advocate, assist commanders in the field, and manage resources on both a routine and emergency basis. On the basis of our review, we believe DOD's combating terrorism office--JCS/J-34--has not taken an active enough role in providing the antiterrorism tools commanders are requesting. For instance, DOD has not -- provided common standards to assess vulnerabilities, -- promulgated prescriptive physical security standards that would require at least a minimum level of protection to U.S. forces, -- ensured consistency in the security countermeasures commands take in responding to threats, and -- clarified security responsibilities for all its personnel overseas. The Downing task force found that in the absence of definitive guidance from DOD, local commanders approach force protection based on general guidance from their service component commands or on their own knowledge and experience and that of their staff. Based on our site visits, we found that, outside the U.S. Central Command, this was generally still the case. In our view, DOD's failure to impose a comprehensive approach to combating terrorism, as envisioned by the Downing task force, has resulted in a program that still lacks consistency and coordination. DOD NEEDS A MORE ACTIVE ANTITERRORISM FOCAL POINT TO PROVIDE THE GUIDANCE COMMANDERS ARE REQUESTING ---------------------------------------------------------- Letter :5.1 One of the central conclusions of the Downing task force was that DOD needed a stronger centralized approach to antiterrorism. To implement this approach, the task force said, a single DOD entity should be designated as responsible for antiterrorism. This entity, among other things, should develop and issue physical security standards, inspect compliance with these standards, manage resources on both a routine and emergency basis, and assist field commanders with antiterrorism matters, the task force said. The task force found in its review that the lack of a single DOD entity responsible for antiterrorism had had an adverse impact on the posture of forces in the field. In response to the task force recommendation, the Secretary of Defense acknowledged the need for a more centralized focus and clearer lines of responsibility for establishing, coordinating, and overseeing force protection. Accordingly, he appointed the Chairman of the Joint Chiefs of Staff as DOD's focal point for antiterrorism and directed the Chairman to establish an office to carry out the antiterrorism responsibilities. This new office, JCS/J-34, has subsequently become involved in a wide variety of antiterrorism issues. JCS/J-34 sees its role as synchronizing the efforts of the Joint Staff in combating terrorism, to include assisting the combatant commands in the execution of their new antiterrorism responsibilities, but not to the extent of prescribing policies and procedures to the geographic combatant commands for carrying out their new antiterrorism responsibilities. In addition, JCS/J-34 has no plans to develop and issue physical security standards (discussed further later in this report), nor does it plan to conduct compliance inspections as recommended by the Downing task force.\5 JCS/J-34 officials said they are precluded from exercising authority over the antiterrorism program because the Chairman is not in the geographic combatant commanders' chain of command. These officials said the Secretary of Defense is the single DOD entity with authority over the antiterrorism program. However, the Secretary of Defense directed that the joint staff office review standards, doctrine, deployments, budgets, audit plans, technology development programs, and all other aspects of force protection policy and programs and recommend any action needed. For example, JCS/J-34 is the principal author of DOD's new combating terrorism program standards to be issued by the Secretary of Defense. Although the new program standards lack the detailed and descriptive criteria called for by the Downing task force, they demonstrate that JCS/J-34 has the capability to develop prescriptive standards for issuance by the Secretary of Defense. Moreover, on the basis of our review, we believe there is a need for this type of guidance. During our visits to the geographic combatant commands and their service component commands, officials identified a need for more guidance to help them carry out their expanded force protection responsibilities. For example: -- A senior official at U.S. Southern Command said that additional guidance should be provided to help commanders determine when sufficient antiterrorism measures had been taken. -- Senior antiterrorism officials at U.S. European Command and U.S. Central Command said they were waiting for implementation guidance from DOD on how to fulfill the requirement that they identify and report antiterrorism deficiencies in their area of responsibility. -- U.S. Air Forces in Europe recommended that DOD develop an antiterrorism "postulated threat" to assist in developing security measures, manning standards, and construction specifications. -- U.S. Central Command requested that a DOD-wide standard for stand-off distance be developed. When DOD declined to issue such a standard, U.S. Central Command developed its own. However, there were still questions about the appropriate risk to accept from a 20,000-pound truck bomb. One subordinate command advocated doubling the stand-off distance standard to decrease the potential damage to personnel. -------------------- \5 JCS/J-34 and the Defense Special Weapons Agency have stressed that their new vulnerability assessments are not intended as inspections. VULNERABILITY ASSESSMENTS DIFFER IN FREQUENCY, APPROACH, AND QUALITY ---------------------------------------------------------- Letter :5.2 Vulnerability assessments are tools commanders use to evaluate their ability to defend against terrorist attack and to highlight security weaknesses that terrorists could exploit. Currently, however, there is not a common understanding within DOD of how to conduct a vulnerability assessment or what constitutes a high-quality assessment. DOD and the services have prescribed few requirements for conducting vulnerability assessments. The result is that commanders in the field may receive a detailed and useful assessment or they may receive one that is of little to no use. Furthermore, in the absence of standardized assessments, DOD cannot compare the results from different sites and determine, on a worldwide basis, how well its forces are protected. We reviewed selected vulnerability assessments completed after the Khobar Towers bombing and found inconsistencies in frequency, approach, and quality. -- Some sites have had numerous assessments, while others have had none. At many high-threat sites, numerous assessments had been conducted. One site in Kuwait had been assessed at least nine times between July 1996 and March 1997. Officials at many sites we visited expressed concern about the high frequency of, and lack of cohesion among, assessments. Conversely, officials at some component commands told us that vulnerability assessments had never been conducted at sites in their area of responsibility. In the absence of a vulnerability assessment, commanders are not in a position to answer the question, "How vulnerable are you to terrorist attack?" -- Few of the assessments covered all the minimum functions suggested in DOD guidance. DOD suggests, but does not require, that at a minimum, vulnerability assessments address four areas: (1) weaknesses in physical security plans, programs, and structures; (2) inefficiencies in personnel practices and procedures related to security and incident control, response, and resolution; (3) enhancements in operational procedures; and (4) resources necessary to meet security requirements. Many of the assessments we reviewed addressed physical security, but few addressed all four areas. -- Some vulnerability assessments had limited value because they did not identify specific vulnerabilities. For example, assessments for Air Force and Navy sites in Panama did not mention specific vulnerabilities, making it impossible to determine what, if any, improvements were needed to decrease their vulnerability to terrorist attacks. These assessments instead gave a single numerical rating of vulnerability based on a number of elements such as location, terrain, and access. A force protection official at U.S. Southern Command said these assessments were not useful for making antiterrorism decisions. In contrast, Army assessments in Panama were very detailed. -- Threat information was not well defined. According to DOD guidance, a threat analysis provides a basis for assessing the terrorist risk to a given site, including the likelihood of terrorist attack and the mode of attack. It is a precursor to the vulnerability assessment. However, some of the assessments we reviewed did not mention the threat against which the site needed to defend itself. Others vaguely referred to the terrorist threat, but lacked specifics on the mode or modes of attack that would most likely be used. Still others postulated a threat that appeared incongruent with threat assumptions made elsewhere. Most notably, an assessment conducted for a headquarters building in the United States postulated a truck bomb threat that was twice the size of the bomb DOD estimates was used in the Khobar Towers bombing. We also found that some commanders believe they must implement all recommendations contained in vulnerability assessments. While the assessments are a tool to help commanders identify their security weaknesses, we were told that since the Khobar Towers bombing some commanders feel they must implement all recommendations from vulnerability assessments, whether they agree with them or not. They are taking this approach out of fear that if terrorists attack their forces, they could be criticized for failing to implement a recommended corrective action that, in hindsight, would have mitigated the damage from the attack. Vulnerability assessments lack consistency because DOD has not established common standards for them. The Downing task force criticized the current approach to conducting vulnerability assessments, noting that DOD lacked standards governing their frequency, format, and content. DOD has acknowledged that vulnerability assessments vary widely in scope and comprehensiveness. Further, DOD has acknowledged that common approaches and standards are needed, but it does not plan to impose standards that would apply to all assessments. JCS/J-34 officials told us this was not their role. We reviewed DOD's proposed program standards and found the following standards regarding vulnerability assessments: "DOD Components will schedule a higher headquarters level assessment of their installations and [Antiterrorism/Force Protection] Programs at least once every three years." "Commanders will prepare a terrorist physical security vulnerability assessment for facilities, installations, and operating areas within their area of responsibility. The assessment will address the broad range of physical threats to the security of personnel and assets." In our opinion, these standards will not address the shortcomings we identified when we reviewed the vulnerability assessments because they do not provide specific requirements for methodology, scope, and content. DOD HAS NOT ISSUED PRESCRIPTIVE PHYSICAL SECURITY STANDARDS ---------------------------------------------------------- Letter :5.3 In its investigation of the Khobar Towers bombing, the Downing task force found that DOD had not established physical security standards, including standards governing the design and construction of new buildings or the modification of existing structures against the terrorist threat. The Downing task force recommended that DOD adopt prescriptive physical security standards. We found that DOD had not implemented this recommendation and had no plans to do so. The Downing task force held up the State Department's physical security standards as an example for DOD to follow in developing its own standards. The task force characterized the standards as detailed and descriptive. Most importantly, the task force stated, State had adopted the standards as requirements, not as guidance. State's standards, developed in coordination with the Overseas Security Policy Board, apply to all U.S. missions abroad under the authority of a chief of mission. The standards were created primarily for U.S. diplomatic offices and residential facilities. They are based on the assessed threat level in the country, with the result that facilities in higher threat countries must meet more stringent requirements. For high-threat areas, the standards address such physical security concerns as the height of perimeter walls, entry control, stand-off distance, and the location of parking areas. Currently, DOD requires its components to deploy a physical security system to protect defense resources. But, unlike at State, its regulations do not establish physical security standards that define what is acceptable or unacceptable. The new standards developed by JCS/J-34, noted above, also do not provide detailed and descriptive requirements. The standards, rather, are considered "performance standards" that are intended to lead commanders through an assessment of their antiterrorism capabilities. For instance, one standard states, "Commanders will develop and implement a physical security plan, as part of the [antiterrorism/force protection] program, that incorporates facilities, equipment, trained personnel, and procedures into a comprehensive effort designed to provide maximum antiterrorism protection to personnel and assets." More specific guidance to implement these performance standards is provided in a DOD handbook, but the handbook guidance is advisory only.\6 JCS/J-34 officials told us they had no plans to issue DOD-wide physical security standards. They believe that the variability in threat and vulnerabilities among geographic areas and individual sites precludes such standards. However, we noted that diplomatic missions also face different threats and vulnerabilities yet are required to meet State's physical security standards. The JCS/J-34 officials said commanders responsible for antiterrorism may establish standards if they choose. Of the five geographic combatant commands, only U.S. Central Command had developed prescriptive design standards. Central Command officials said that since DOD declined to issue standards for protecting facilities against a bomb blast, they developed their own. Officials at the other geographic combatant commands had various opinions regarding the need for DOD-wide physical security standards. For instance, U.S. European Command officials stated that DOD should establish minimum physical security standards for each threat level and then require the services to publish more specific guidance. Such an approach would allow for differences among the services. U.S. Pacific Command officials believe that measurable DOD-wide physical security standards are a good idea if they provide flexibility to allow for variability in the threat and local circumstances. U.S. Navy Europe stated that there is an absolute need for a DOD-wide standard that is tough enough to force all activities to a minimum level of compliance but flexible enough to allow an activity to adjust for impediments that impact its ability to comply. In its report, the Downing task force noted that commanders are currently left to a subjective determination of what is safe and unsafe. With the exception of the U.S. Central Command, we confirmed this observation during our site visits and came across instances where decisions to build facilities in the absence of DOD-wide physical security standards had resulted in serious security lapses. -- Newly completed dormitories in one country we visited are located close to a heavily traveled public road. Base officials believe that the road presents a vulnerability to truck bombs similar to the bomb that exploded at Khobar Towers. During our visit, they were contemplating closing the road or building a tunnel to reroute traffic away from the dormitories. The installation had not yet begun to calculate the cost of these measures. -- In one country, a new $1.9 million facility was being built on a city street with no stand-off distance. The geographic combatant command assessed the facility's vulnerabilities during construction and recommended that it be relocated to a more secure location. Furthermore, the command found that with one exception, none of the off-base facilities it visited in this country conformed with the advisory guidelines contained in DOD's antiterrorism handbook. -- A headquarters building under construction in the United States is considered to be so unsafe that a service assessment team suggested that it be relocated. The additional cost to improve the security at this leased facility is estimated to be about $1 million per year. -------------------- \6 DOD 0-2000.12-H, Protection of DOD Personnel and Activities Against Acts of Terrorism and Political Turbulence, dated February 1993. SECURITY THREAT CONDITIONS ARE INCONSISTENTLY APPLIED ---------------------------------------------------------- Letter :5.4 DOD has established a system of terrorist threat conditions to indicate the security posture at its sites. All DOD components are required to implement the system. One objective of the system is to provide a common framework to facilitate interservice coordination. The geographic combatant commanders are required to ensure that threat conditions are uniformly implemented in their area of responsibility. Commanders may choose from one of five threat conditions--Normal, Alpha, Bravo, Charlie, and Delta--depending on their assessment of the threat and other factors such as target vulnerability, criticality of assets, and the availability of security resources. Threat Condition Normal indicates that a general threat of possible terrorist activity exists but warrants only a routine security posture. Threat Condition Delta, on the other hand, applies to the immediate area where a terrorist attack has occurred or when intelligence has been received that terrorist action against a specific location is likely. In this case, commanders are required to implement a series of security measures. The other threat conditions fall between Normal and Delta, with each one having associated security measures. The Downing task force noted that personnel restrictions based on threat conditions varied widely. DOD's guidance states that the threat condition system is designed to provide commanders with flexibility, to enable them to temper actions based on their best judgment and knowledge of the local situation. DOD officials added that commanders and managers must take account of the mission, the threat, and specific circumstances, all of which may require higher levels of force protection. During our review, however, we found continued inconsistencies in the implementation of the threat condition system that did not appear to have any basis in mission, threat, or circumstance. For example: -- Some commanders in the Middle East implemented markedly different interpretations of the security measures associated with Threat Condition Charlie. In one country, for instance, personnel from one service were permitted to leave the base, whereas personnel belonging to another service at two nearby bases could not. In a second country, personnel at one installation were generally confined to the installation but allowed to make limited forays to an off-base civilian housing complex. Personnel at other installations in this country were confined to their bases except for mission-essential travel. -- Even within the same base, interpretations of Threat Condition Charlie could be inconsistent. At one base, personnel under one combatant command were restricted to base except for mission-essential travel. At this same base, personnel assigned to a security assistance organization were permitted to go to restaurants and shopping areas downtown, with no clear requirement that these trips be mission related. These same groups also implemented markedly different controls over the many third country workers who provide cooking, cleaning, and maintenance services to the base. The combatant command required escorts for their workers while the security assistance organization allowed its third country workers to come and go in their area of the base unescorted. -- Commanders in two Middle Eastern countries had been generally maintaining the intense security posture associated with Threat Condition Charlie for the 9 months since the June 1996 Khobar Towers bombing, even though this posture was supposed to be used only for short durations in response to imminent terrorist action. The extended use of the measures associated with this threat condition, such as the cancellation of social events; the placing of cafes, theaters, and other high-risk areas off limits; and the increased requirements for guard personnel, is recognized as likely to create a hardship on the units and their personnel. Several of the commanders we visited called for review of the threat condition system in light of the current security environment. -- Differences in interpreting threat condition measures can have an operational impact. In the Middle East one command refused to allow one of its transport aircraft to land because a disabled aircraft was already on the ground. The command believed that under Threat Condition Charlie, two of its aircraft could not be on the ground at the same time in one location, and the command diverted the flight to Cairo, Egypt. However, the local commander responsible for designating the threat condition advised us that he would have allowed the aircraft to land. -- The rationale for establishing a particular threat condition was not always clear. In a low-threat country for instance, one base had established Threat Condition Normal, whereas an abutting base belonging to another service had established Threat Condition Bravo--two levels above Normal. Officials at the base designated as Bravo said they were under the impression that a higher headquarters had mandated that they be at this threat condition. They added that they were not actually implementing the security measures associated with Bravo. We were subsequently informed that the threat condition at this base would be lowered. -- The security forces commander at one base in Europe said he did not have a trained and ready auxiliary force. As a result, if the threat condition were raised to Charlie, his forces would have to concentrate their efforts on guarding critical assets and could not protect office, housing, shopping, and recreational areas where personnel congregate. ANTITERRORISM RESPONSIBILITY FOR SOME DEPLOYED PERSONNEL REMAINS UNCLEAR ---------------------------------------------------------- Letter :5.5 Antiterrorism support for some personnel deployed overseas may be inadequate because DOD has not ensured that responsibility for their security is clear. The Secretary of Defense took steps following the bombings in Saudi Arabia to clarify antiterrorism responsibilities for DOD elements on the Arabian peninsula. DOD is aware that similar problems exist in other countries, but it has largely left it to local military officials to address the issue. As noted earlier, DOD has recently assigned the five geographic combatant commanders the responsibility for ensuring the security of all DOD personnel in their area of responsibility. However, approximately 30,000 DOD personnel deployed abroad do not fall under the command of a geographic combatant commander. Some of these personnel, such as those assigned to a Defense Attache Office and Marine embassy guards, fall under the authority of a chief of mission, who is responsible for their security. However, many others, while formally under the authority of a chief of mission, have been described as falling into a gray area between the force protection responsibility of the geographic combatant commander and the chief of mission. The U.S. Ambassador to Turkey and the Commander-in-Chief, U.S. European Command, were very concerned about security gaps for gray-area DOD personnel in that high-threat country. The embassy, working with local U.S. military representatives, identified nearly 1,500 gray-area personnel, including several hundred assigned to the North Atlantic Treaty Organization (NATO). Many of these personnel were receiving little or no security support from the embassy. Such support can include things such as security guards, physical security assessments of housing and work places, and threat information. The officials said that antiterrorism responsibilities for these personnel must be clarified. If there is a question about DOD's or NATO's responsibility for any of these gray-area personnel, then they should be withdrawn from Turkey, the embassy said. Alternatively, if the embassy is to be given responsibility for these personnel, then it must also have explicit authority over them to enforce State's security regulations. Furthermore, the embassy must receive a concomitant increase in resources to cover its added responsibilities. Missions in other European countries have raised similar concerns about gray-area DOD personnel. These missions believe they should be responsible for protecting only those DOD personnel accredited to the mission. They said they lack the resources to take on responsibility for additional DOD personnel. Following the bombings in Saudi Arabia, DOD and the Department of State agreed that security responsibilities in the region had become muddled. The Secretary of Defense, in coordination with the Secretary of State, decided to take on security responsibility for most DOD personnel on the peninsula. Under a memorandum of understanding between the two agencies, U.S. Central Command negotiated with each chief of mission to specifically determine which DOD elements will fall under the antiterrorism responsibility of the combatant commander and which will fall under the responsibility of the mission. DOD has not taken such a comprehensive approach to resolving gray-area problems outside the Arabian peninsula. Rather, the geographic combatant commands and in-country military representatives have been working with the missions to identify gray-area personnel and address security issues at the local level. Embassy officials in Turkey expressed frustration with this approach. They believe their ability to address security issues is limited and that fundamental policy decisions must be addressed at high levels within DOD and the State Department. For instance, U.S. officials in Turkey will not be able to unilaterally order gray-area DOD elements to modify their operations for security purposes. Nor can they resolve resource matters on their own. They advocated that a memorandum of agreement similar to that for the Arabian peninsula be extended to other countries. Officials at other embassies said a more comprehensive approach is needed. For instance, embassy and military officials in Italy said there is no mechanism to ensure that the embassy is informed about the number and location of DOD personnel in country. DOD and State Department officials are addressing gray-area issues through a joint working group and are considering establishing a memorandum of understanding that would apply to countries outside the Arabian peninsula. As in the Arabian peninsula, such a memorandum of understanding would require implementation agreements between each chief of mission and the combatant commander. CONCLUSIONS ------------------------------------------------------------ Letter :6 We recognize that individual commanders are responsible for ensuring the protection of their forces, to include employing appropriate antiterrorism procedures. Nevertheless, we believe that the Department of Defense has not taken the steps necessary to promote a comprehensive, consistent approach to antiterrorism that will give commanders at all levels the tools they need to fulfill their antiterrorism responsibilities. A lack of prescriptive, measurable standards leaves commanders without an objective basis for determining whether their antiterrorism measures are sufficient. Moreover, DOD lacks assurance that the antiterrorism programs implemented by local commanders meet a consistent minimum standard for all overseas personnel. RECOMMENDATIONS ------------------------------------------------------------ Letter :7 We recommend the Secretary of Defense direct the Chairman of the Joint Chiefs of Staff to develop common standards and procedures to include -- standardized vulnerability assessments to ensure a consistent level of quality and to provide a capability to compare the results from different sites, -- DOD-wide physical security standards that are measurable yet provide a means for deviations when required by local circumstances, and -- procedures to maintain greater consistency among commands in their implementation of threat condition security measures. To ensure that security responsibility for DOD personnel overseas is clear, we recommend that the Secretary of Defense take the necessary steps to ensure that the memorandum of understanding now under discussion with the Department of State is signed expeditiously. Further, the Secretary should provide the geographic combatant commanders with the guidance to successfully negotiate implementation agreements with chiefs of mission. AGENCY COMMENTS AND OUR EVALUATION ------------------------------------------------------------ Letter :8 In commenting on a draft of this report, DOD concurred with all but one of the recommendations. It did not concur with our recommendation for DOD-wide physical security standards. DOD disagreed with our view that JCS/J-34, as the designated antiterrorism focal point within DOD, should take a more active role in prescribing common standards. Issuing such standards would exceed JCS/J-34's authority, DOD asserted, and as a Washington, D.C.-based office, JCS/J-34 would not be able to react quickly enough to changes in terrorist tactics. In addition, DOD stated that commanders are responsible for the physical security of their personnel and should not be told how to accomplish this task. DOD believes that its proposed combating terrorism "performance-based standards," supplemented by existing physical security guidance, will be sufficient to assist commanders. Finally, DOD stated that in advocating a more active focal point, we had misrepresented the spirit and intent of the Downing Assessment Task Force. We continue to believe that common DOD standards would aid commanders by providing them with a more objective basis for determining whether their forces are adequately protected from terrorist threats. Many of the commanders and antiterrorism officials we spoke with specifically noted the need for, and the importance of, DOD-wide standards. The most obvious source of common DOD standards is JCS/J-34 because it is the designated focal point within the Department. As discussed in the report, we recognize that it is the Secretary of Defense who formally issues DOD standards, and we are not asking that JCS/J-34 exceed its authority as a staff office. However, JCS/J-34, through the Chairman, Joint Chiefs of Staff, has been given the mandate to take an active role in reviewing and recommending changes to the antiterrorism program. It should take full advantage of this role by advocating, and leading the development of, common standards. If DOD continues to believe that JCS/J-34 is not the appropriate entity to develop common standards, then the Secretary of Defense should consider assigning this task to another entity. The fundamental point remains: DOD-wide standards are needed to assist commanders in protecting their forces from terrorist attack. We agree with DOD that any physical security standards must be flexible to accommodate DOD's unique security situations and have included this in our recommendation. The common DOD standards could be supplemented as needed by the geographic combatant commands and their service component commands. Similarly, if a waiver system is required, it could be implemented by these commands rather than by a central office in Washington such as JCS/J-34. Moreover, in our view and in the view of several commanders we spoke with, a waiver system is likely to add a measure of accountability to the program and ensures that senior-level officials are aware of potential problems. We disagree that we have misrepresented the spirit and intent of the Downing Assessment Task Force when we advocate a more active focal point. In conducting our review, we drew extensively from the task force report, and we believe our report is consistent with its spirit and intent. While DOD is correct when it notes that the task force report stated that the single DOD element should not become a substitute for commanders at all levels applying experience, expertise, and resources to the protection of its forces, it failed to note the task force's opinion that the lack of a single element in DOD for force protection had an adverse impact on the posture of the forces in the field. Throughout its report, the task force emphasized the need for a single DOD element responsible for force protection. Specifically, the task force stated: "The continued threat from terrorism strongly argues for a single element within the DOD to develop policy and standards for force protection, to act as an advocate for greater priority to this effort, to assist commanders in developing and implementing force protection measures at overseas sites, and to manage resources on both a routine and emergency basis. This agency must have resources, authority to act, and the mandate to support directly forces challenged by terrorist threats." The Secretary of Defense, in his September 15, 1996, report to the President entitled "The Protection of U.S. Forces Deployed Abroad," stated: "General Downing's report correctly recognizes the need for a stronger centralized approach to force protection within DOD. There indeed should be a single individual designated as responsible for ensuring that our policies will result in adequate force protection measures being taken and for auditing the performance of our units." Moreover, we spoke with a senior member of the Downing Assessment Task Force regarding the role of a single entity, and he confirmed our interpretation. He also confirmed that the task force intended that DOD adopt physical security standards that were specific, directive in nature, and applicable across the Department. In its report, the task force repeatedly emphasized the need for mandatory standards (as opposed to advisory guidance) regarding physical security. For example, it recommended that the Secretary of Defense "establish prescriptive DOD physical security standards" and "designate a single agency within DOD to develop, issue, and inspect compliance with force protection physical security standards." The following are examples of specific observations made by the task force regarding prescriptive physical security standards: "Because neither [DOD O-2000.12-H] nor any DOD directive provides formal force protection standards with which the service components must comply, commanders are left to a subjective determination of what is safe or unsafe. Unlike the Department of Defense, the Department of State has mandated physical security standards . . . . Regional Security Officers [at U.S. missions] are responsible for ensuring compliance with the [State] standards which are detailed and descriptive. They rely in part on the assessed Threat Level in the country. They are regularly supplemented. Most importantly, they are recognized as requirements by the Department of State." "DOD O-2000.12-H provides guidance on physical security for U.S.-occupied facilities. It does not consider the structural characteristics of buildings to be protected. It does not define standards for design, materials, or construction of new buildings or modification of existing buildings . . . . Construction and modification standards are required to ensure that buildings occupied by U.S. forces provide appropriate protection in the specific threat environment in each country. The addition of Shatter Resistant Window Film is listed in [DOD O-2000.12-H] as a suggested measure to mitigate the effects of blast, but it is not required . . . . DOD must address the significance of blast effects with formal standards." "There are no DOD standards for warning systems. This was a significant factor that contributed to the injuries sustained in the attack on Khobar Towers . . . . Standards must address requirements for and utility of warning systems in a range of potential environments." In its comments, DOD also stated that our report uses anecdotal evidence and represents a "snapshot" of a program that has undergone dramatic changes since we completed our fieldwork. In criticizing the use of anecdotal evidence, DOD appears to be referring to the illustrative examples used throughout the report. We believe that the evidence we gathered during the course of our work was reliable, relevant, and sufficient to support our findings, conclusions, and recommendations. We visited approximately 30 overseas bases as well as all 5 geographic combatant commands and most of their service component commands (see app. I). During these visits we obtained (1) testimonial evidence from designated antiterrorism officers and others, (2) documentary evidence such as vulnerability assessments and corrective action plans, and (3) physical evidence based on our own observations. The results of our work are based on the totality of this evidence and not, as DOD implies, primarily on anecdotes. With respect to DOD's comment on the timeliness of our review, we recognize in the report that DOD's renewed emphasis on antiterrorism is only about a year old--dating to the Khobar Towers bombing. Nevertheless, we believe that the report accurately reflects the current status of DOD's antiterrorism efforts and that the program has not changed dramatically, as DOD states, since we completed our field visits in March and April 1997. When we asked DOD officials to provide evidence of dramatic changes in the program, they stated that (1) the geographic combatant commands now have access to the draft combating terrorism performance standards; (2) the Joint Staff and the Defense Special Weapons Agency are coordinating their vulnerability assessments with the combatant commands and the services; and (3) requests submitted to the JCS/J-34-managed combating terrorism fund have increased. All three of these initiatives were ongoing during our review and do not bring into question the currency of our work. DOD's comments and our further evaluation of them are presented in appendix II. DOD also provided technical comments concerning factual information in the report, and we have modified the report where appropriate. ---------------------------------------------------------- Letter :8.1 Our scope and methodology are discussed in appendix I. We are sending copies of this report to the Secretaries of Defense, the Army, the Air Force, and the Navy; the Chairman, Joint Chiefs of Staff; the Commandant, U.S. Marine Corps; and the Secretary of State. We will make copies available to other interested parties upon request. The major contributors to this report were Sharon Cekala, Donald L. Patton, Carole Coffey, John Nelson, Robert Crowl, and Thomas Gosling. If you or your staff have any questions concerning this report, please call me on (202) 512-5140. Mark E. Gebicke Director, Military Operations and Capabilities Issues SCOPE AND METHODOLOGY =========================================================== Appendix I Representative Ike Skelton and the Ranking Minority Member, Senate Committee on Governmental Affairs, asked that we review the Department of Defense's (DOD) efforts to protect U.S. forces from terrorist attacks. In response to this request, we reviewed (1) measures taken at overseas U.S. bases to enhance the security of deployed personnel and (2) recent DOD initiatives to improve its antiterrorism program. For our review of antiterrorism measures taken at overseas U.S. bases, we visited the five geographic combatant commands, many of their service component commands, and selected overseas sites where U.S. forces are deployed. Most of the sites we visited were in countries that DOD considers to be a high threat (Kuwait, Saudi Arabia, and Turkey) or a medium threat (Bahrain,\1 Italy, and Qatar). We also visited sites in Panama and Germany, which are considered low-threat countries. We conducted these visits in March and April 1997. During the visits, we met with designated antiterrorism officials and others involved in the program to discuss the progress that had been made in identifying and addressing vulnerabilities since the Khobar Towers bombing. We also reviewed pertinent documents, such as vulnerability assessments, corrective action plans, and records pertaining to the work of command and base antiterrorism teams. We also toured the installations to inspect vulnerabilities. In addition, we discussed and reviewed documents regarding funding, intelligence, training, and host nation relationships. The geographic combatant commands and the component commands we visited were as follows: -- U.S. Central Command, U.S. Central Command Air Forces, U.S. Navy Forces Central Command, U.S. Army Forces Central Command. -- U.S. European Command, U.S. Army Europe, U.S. Navy Europe, U.S. Air Forces in Europe. -- U.S. Southern Command, Special Operations Command South, U.S. Army South. -- U.S. Pacific Command, U.S. Pacific Air Forces, Commander-in-Chief Pacific Fleet, U.S. Army Pacific, Marine Forces Pacific, Special Operations Command Pacific. -- U.S. Atlantic Command, Air Combat Command, U.S. Army Forces Command. The sites we visited, by country, were as follows: -------------------- \1 Shortly after our visit, the threat level in Bahrain was changed from medium to high. BAHRAIN --------------------------------------------------------- Appendix I:1 U.S. Navy Headquarters and Support Compound Mina Salman pier facilities Aviation Unit, Bahrain International Airport DOD Dependents School Mannai Plaza Housing Compound GERMANY --------------------------------------------------------- Appendix I:2 Ramstein Air Base 26th Area Support Group, U.S. Army ITALY --------------------------------------------------------- Appendix I:3 Aviano Air Base Caserma Ederle, U.S. Army Naval Support Activity Naples KUWAIT --------------------------------------------------------- Appendix I:4 Ahmed Al Jaber Air Base Ali Al Salem Air Base Camp Doha Prepositioning Site Aviation Unit, Kuwait City International Airport PANAMA --------------------------------------------------------- Appendix I:5 Howard Air Force Base Fort Clayton Army Base Naval Station (Rodman) Panama Canal QATAR --------------------------------------------------------- Appendix I:6 Camp Snoopy, Qatar International Airport Al Udeid Air Base (under construction) As Sayliyah Prepositioning Site Al Messilah Housing Compound Umm Said pier facilities SAUDI ARABIA --------------------------------------------------------- Appendix I:7 Eskan Village Prince Sultan Air Base Al Yamama Housing Compound Site 12 Eagletown U.S. Military Training Mission Detachment Al Rakah Housing Compound TURKEY --------------------------------------------------------- Appendix I:8 Incirlik Air Base To review recent DOD initiatives to improve its antiterrorism program, we interviewed officials and obtained information from the Deputy Directorate for Combating Terrorism, Joint Chiefs of Staff (JCS/J-34); the Office for Counterterrorism Analysis, Defense Intelligence Agency; the Under Secretary of Defense (Comptroller); the Defense Special Weapons Agency; the Departments of the Army, the Air Force, and the Navy; Headquarters, U.S. Marine Corps; and the geographic combatant commanders and service component commands. During our site visits, we discussed the impact of DOD's initiatives on their ability to protect their forces, including the problems they faced in implementing their antiterrorism responsibilities. We also obtained their views on other initiatives that DOD could undertake. In addition, we reviewed pertinent DOD and service documents, such as directives, regulations, and guidance on combating terrorism and the reports of the DOD Antiterrorism Task Force and the Downing Assessment Task Force. The task forces were created to recommend improvements to DOD's antiterrorism program following the two terrorist bombings in Saudi Arabia. The Downing task force identified key principles for managing and improving the Department's antiterrorism program. We used these as the primary criteria for our review. Because the Department of State has security responsibilities for many DOD personnel overseas, we met with the Director for Overseas Operations, Bureau of Diplomatic Security; the U.S. Ambassadors to Kuwait, Qatar, and Turkey; and the Regional Security Officers responsible for Bahrain, Great Britain, Italy, Kuwait, Panama, Qatar, Saudi Arabia, and Turkey. We obtained their views on the missions' ability to provide security to DOD personnel and on the probems, if any, of expanding their security responsibilities to additional DOD personnel overseas. At some of these missions, we also met with DOD officials who fall under the security responsibility of the State Department. We conducted our review between October 1996 and June 1997 in accordance with generally accepted government auditing standards. (See figure in printed edition.)Appendix II COMMENTS FROM THE DEPARTMENT OF DEFENSE =========================================================== Appendix I (See figure in printed edition.) (See figure in printed edition.) (See figure in printed edition.) (See figure in printed edition.) (See figure in printed edition.) (See figure in printed edition.) The following is our response to DOD's letter dated June 30, 1997. GAO COMMENTS --------------------------------------------------------- Appendix I:9 1. We met with DOD officials to review their concerns and deleted references to specific locations. DOD officials approved these changes. These changes do not affect the message of our report. 2. In our view, using the standards in DOD Instruction 2000.XX will not resolve the vulnerability assessment problems we noted during our review. First, the standards are performance standards, not physical security standards. Because these performance standards focus on policies, procedures, and plans rather than physical security, it is not clear how they can be used to identify physical security vulnerabilities. The inability to identify specific vulnerabilities was a problem we noted with some of the assessments we reviewed. Second, because the standards are not detailed and descriptive, they are subject to interpretation by the many different agencies and individuals who conduct vulnerability assessments. In the absence of more specific, measurable standards, the fundamental issues of methodology, scope, and completeness discussed in our report will remain. Also, as of early July 1997, DOD had not issued DOD Instruction 2000.XX. DOD officials said they could not estimate when the instruction would be issued. In addition, at the time we completed our fieldwork, only the Central Command had established its own standards, a key component of the assessment process according to DOD. 3. As DOD acknowledges in its comments, this guidance is advisory in nature. Furthermore, the Downing Assessment Task Force found that many commanders in the field were not aware of this guidance and, thus, were not using it. 4. Our recommendation does not encourage DOD to limit the commander's prerogative to establish the threat condition security measures for his or her unit, but we would encourage the Department to take the necessary steps to ensure that these measures are based on a realistic assessment of the mission, the threat, and the specific circumstances of the local situation. During our review we noted inconsistencies in the threat condition system that did not appear to be based on these factors. For example, in the instance cited by DOD in its comments, the security assistance personnel are permitted to leave the base for nonmission-related activities, such as shopping and eating at restaurants. 5. The steps DOD is taking should promote greater consistency in how vulnerability assessments are conducted. However, in the absence of formal DOD standards, the combatant commands and services may still choose to deviate from the program of instruction used by the Joint Service Integrated Vulnerability Assessment teams. Therefore, we continue to believe that common standards and procedures for conducting vulnerability assessments are needed to ensure a consistent level of quality and to provide a capability to compare results from different sites. 6. Neither DOD Directive 2000.12 nor DOD Instruction 2000.XX requires that commanders establish prescriptive physical security standards for each area of responsibility. As we noted in comment 2, only the Central Command has established prescriptive standards. 7. As of early July 1997, the memorandum of understanding had not been signed. DOD officials said they could not estimate when it would be signed. 8. As discussed in our report, the memorandum of understanding and accompanying agreements should address (1) the authority of a chief of mission to direct DOD entities to comply with State security standards and (2) the resources of the mission to fulfill its security responsibilities with respect to DOD personnel. DOD does not address these concerns in its comments. *** End of document. *** ------------------------------------------------------------------------