oversight

Combating Terrorism: Status of DOD Efforts to Protect Its Force Overseas

Published by the Government Accountability Office on 1997-07-21.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                   United States General Accounting Office

GAO                Report to Congressional Requesters




July 1997
                   COMBATING
                   TERRORISM
                   Status of DOD Efforts
                   to Protect Its Forces
                   Overseas




GAO/NSIAD-97-207
             United States
GAO          General Accounting Office
             Washington, D.C. 20548

             National Security and
             International Affairs Division

             B-277464

             July 21, 1997

             The Honorable Ike Skelton
             House of Representatives

             The Honorable John Glenn
             Ranking Minority Member
             Committee on Governmental Affairs
             United States Senate

             As you requested, we have reviewed the Department of Defense’s (DOD)
             efforts to protect U.S. forces from terrorist attacks. This report addresses
             (1) measures taken at overseas U.S. bases to enhance the security of
             deployed personnel and (2) recent DOD initiatives to improve its
             antiterrorism1 program. We plan to issue a separate report on national
             counterterrorism policy and strategy; the roles, responsibilities, programs,
             and activities of federal agencies under this policy; and the mechanisms
             for coordinating interagency efforts.


             In November 1995, a car bomb exploded in Riyadh, Saudi Arabia, killing
Background   five Americans who were working at the Office of the Program Manager,
             Saudi Arabian National Guard. A few months later, in June 1996, another
             terrorist bomb detonated near Dhahran, Saudi Arabia. The explosion killed
             19 U.S. service personnel living in a high-rise apartment building at the
             Khobar Towers military complex. Hundreds more were injured. Soon after
             the Khobar Towers bombing, the Secretary of Defense appointed a task
             force headed by retired four-star Army General Wayne A. Downing to
             investigate the incident and make recommendations on how to prevent or
             minimize the damage of future attacks. The Downing Assessment Task
             Force completed its work in August 1996. The Secretary of Defense on the
             whole concurred with the task force’s report and announced a series of
             measures intended to improve the protection of deployed U.S. forces. He
             said that the threat of sophisticated, organized terrorism against our
             overseas forces was now a fact of life and that U.S. leaders must adopt a
             “radically new mind-set” with regard to international terrorism. In early
             1997, the Chairman of the Joint Chiefs of Staff provided a status report to

             1
              For the purposes of this report, we are using the DOD term “antiterrorism” to refer to defensive
             measures used to reduce the vulnerability of individuals and property to terrorist acts.
             Counterterrorism, in contrast, refers to offensive measures taken to prevent, deter, and respond to
             terrorism. Antiterrorism and counterterrorism are elements of a broader concept known as combating
             terrorism. In turn, combating terrorism is part of a much broader concept known as force protection.
             Other elements of force protection are physical security, operations security, protective services, and
             law enforcement operations.



             Page 1                                          GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




Congress on DOD’s response to the Downing task force. The Chairman
stated DOD was implementing all of the task force’s recommendations.2

The task force found that DOD lacked a comprehensive, consistent
approach to antiterrorism that is based on common guidance, standards,
and procedures. A top priority, it said, should be designating a single
element in DOD to oversee an integrated system approach to force
protection efforts, manage resources, and assist commanders in the field.
At that time, DOD lacked a single entity with responsibility for the program,
and the task force stated this had an adverse impact on the posture of
forces in the field. The task force noted that policies, standards, and
available resources all varied significantly among both service and joint
forces. The Downing task force identified key principles for managing and
improving the Department’s antiterrorism program. We used these as the
primary criteria for our review.

DOD does not know how much is being spent on antiterrorism because it
cannot easily determine what costs are associated with its antiterrorism
program. DOD has estimated that it spends about $4 billion a year on
combating terrorism—the term DOD uses when discussing both
antiterrorism and counterterrorism—but this figure includes broad cost
elements such as physical security, counterintelligence, security and
investigative matters, and counterterrorism.3 In addition, certain costs
related to antiterrorism are not captured in the $4 billion estimate. In
particular, the estimate does not include funds being spent by base
commanders from their base operations accounts—the money they use to
finance the day-to-day operations of their activities. Also not included in
this estimate is the cost of dual-use items such as ballistic body armor or
armored vehicles that can be used in support of a unit’s primary mission or
to defend and protect against a terrorist attack.

DOD designates the terrorist threat level faced by personnel in each
country. A five-step scale is used to describe the severity of threat. These
steps, from highest to lowest, are critical, high, medium, low, and
negligible. Threat levels may be raised or lowered based on new
information or analysis. In May 1997, DOD had designated 13 countries as
having a high threat level and 1—Lebanon—as having a critical threat level
(see fig. 1).


2
 As of June 3, 1997, DOD said all but 2 of the task force’s 81 recommendations had been implemented.
Implementation of the two remaining recommendations was delayed by procurement problems.
3
 About 90 percent of the costs in DOD’s $4 billion estimate are for civilian and military personnel such
as contract guards and military police.



Page 2                                          GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                                            B-277464




Figure 1: Countries Where the Terrorist Threat Is Critical or High (as of May 15, 1997)




                                                                                        Bosnia


                                                                                                       Turkey

                                                                                   Greece    Lebanon
                                                                                                                 Jordan Kuwait
                                                                                                                           Bahrain
                                                                    Algeria                                                          Pakistan
                                                                                               Egypt
                                                                                                                Saudi Arabia




       Columbia

                                                                                        Rwanda

      Peru




                                            Source: Defense Intelligence Agency.



                                            Many deployed U.S. forces are better protected today from terrorist
Results in Brief                            attacks similar to the one that occurred at Khobar Towers. During March
                                            and April 1997, we visited 30 overseas sites and found that security
                                            improvements were most evident where the risk of terrorism is the
                                            greatest, such as Turkey and the Middle East. DOD has placed less
                                            emphasis on addressing vulnerabilities in countries that are currently



                                            Page 3                                          GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                         B-277464




                         considered to have a lower threat. Senior military commanders and
                         defense officials we met with emphasized that they can reduce, but not
                         eliminate, vulnerabilities and that further terrorist attacks against
                         U.S. forces should be expected. They also observed that efforts to defend
                         against terrorism are complicated by a number of factors, including the
                         ability of terrorists to decide where and when to attack and to choose
                         from a wide selection of targets. Nevertheless, the officials said, some risk
                         must be accepted as the United States pursues its national security
                         strategy abroad.

                         Since the bombing at Khobar Towers, DOD has initiated a number of
                         changes aimed at improving its antiterrorism program. For example, DOD
                         has established a new office for combating terrorism on the Joint Staff,
                         enhanced the antiterrorism responsibilities of the geographic combatant
                         commands, and instituted a vulnerability assessment process under the
                         aegis of the Joint Staff. These initiatives, however, have not resulted in a
                         comprehensive, consistent approach to antiterrorism as called for by the
                         Downing task force. For instance, DOD’s force protection focal point has
                         not provided the geographic combatant commanders the guidance the
                         commanders believe they need to carry out their expanded antiterrorism
                         responsibilities. Such guidance would include establishing standards for
                         assessing vulnerabilities and agencywide physical security requirements
                         designed to provide a minimum level of protection to U.S. forces no matter
                         where they are located. A comprehensive, consistent approach to
                         antiterrorism using common standards would give commanders a more
                         objective basis for determining whether they are providing adequate
                         protection to their facilities and personnel. Further, DOD would have a
                         capability to compare vulnerabilities at different sites on a worldwide
                         basis and thus ensure that sufficient emphasis is being placed on the most
                         vulnerable areas.


                         During our visits to overseas bases, we found significant security
Protection of Many       improvements have been made in Turkey and the Middle East to protect
U.S. Forces Has          against vehicle bombs. In these countries, sites have been fortified in
Improved, but            various ways against a terrorist attack, particularly against a truck bomb
                         similar to the one that struck Khobar Towers. Commanders have
Vulnerabilities Remain   attempted to extend the stand-off4 distance around their facilities, and
                         where sufficient stand-off cannot be obtained, they are using other
                         measures to mitigate against the impact of a truck bomb.

                         4
                          According to DOD officials, stand-off is the distance between the base facilities and uncontrolled
                         public and private land.



                         Page 4                                          GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




Saudi Arabia has seen the most profound changes, as thousands of DOD
personnel have been moved to remote facilities in the desert and restricted
from leaving base throughout their entire tour. Most military dependents
have been sent back to the United States to reduce their exposure to the
terrorist threat. Many dependents are also being withdrawn from Kuwait
and Bahrain. In Turkey, an off-base apartment building dedicated solely to
U.S. military personnel was closed because it was considered too
vulnerable to a truck bomb attack. The personnel living in this building
were relocated to on-base housing or dispersed to other off-base housing
facilities. The base also had installed concrete barriers to make on-base
residential areas and headquarters buildings less vulnerable and had begun
to repair holes in the perimeter fence.

DOD has placed less emphasis on improving security at sites where the
terrorist threat is not considered to be high. Base officials at many of the
installations we visited identified numerous vulnerabilities that were still
to be addressed. For instance, stand-off distance around base facilities,
including housing, was often a few feet or less. Facilities were frequently
located in populated areas, abutting public roads and privately owned
land, offices, or residences. Base officials said it would be very difficult to
defend these facilities against a truck bomb attack like the one at Khobar
Towers. However, they said it was impractical to obtain sufficient
stand-off distance either due to shortages of suitable land or the high cost
of obtaining it.

During our visits, military officials told us that the question is not whether
additional terrorist attacks will occur, but when, where, and how. In this
light, they emphasized that while vulnerabilities to attacks can be reduced,
a “zero defects” approach to fighting terrorism is not possible. DOD faces a
number of obstacles in defending against future terrorist attacks. First,
DOD has a large presence in many countries around the world, offering a
plethora of potential targets. DOD does not have the resources to fully
protect all of them all the time. Second, predictive intelligence on terrorist
attacks is difficult to obtain. Commanders, therefore, may not be in a
position to prevent an attack from occurring; they can only prepare to
minimize the consequences from an attack. Third, DOD installations are
often located on host nation installations and, as a result, there are
limitations on the security measures DOD can undertake. Political and
cultural considerations outside the control of local commanders may
influence decisions that affect security.




Page 5                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




According to DOD officials, terrorism is a pervasive phenomenon, whose
specific threats are difficult to predict. It is worldwide in scope, with some
terrorist organizations state supported and some only loosely affiliated, in
support of multiple causes. It is a transnational phenomenon, cutting
across geographic and political boundaries. Areas considered safe and
benign one day, such as Saudi Arabia prior to the bombings, can quickly
become high threat the next. According to these officials, terrorism’s tactic
is not to challenge U.S. military power directly, but to weaken U.S. resolve
through indirect attacks on weak links with high publicity value.

In a September 1996 report to the President, the Secretary of Defense said
executing the national security strategy to protect U.S. interests requires
the physical presence of U.S. forces in many nations, presenting constant
exposure to the threat. U.S. commanders in the past have accepted
operating locations that present serious security challenges in today’s
terrorist environment. The location of Khobar Towers, for example, was
difficult to defend, but the complex was paid for by the Saudis and
convenient to U.S. military work areas. In most of the countries we visited,
we found that many U.S. forces are located in urban areas, closely
surrounded by easily accessible buildings or roads.

In many cases overseas, U.S. forces work at facilities that are owned by
the host nation, and they depend on the host nation for important security
functions. U.S. forces in the Middle East are prevented from patrolling
outside their own perimeter fencing. At one location we visited in Europe,
entry to the base is controlled by host nation security forces with no U.S
military role. The U.S. military does not have its own perimeter at this base
and may not approach the base perimeter without escort.

Some officials expressed concern that efforts to isolate and fortify DOD
facilities could make other targets more vulnerable. For instance,
terrorists could decide to target small military offices, housing areas, or
vehicular traffic outside the main installations. In most of the countries we
visited, many U.S. military personnel were living in off-base housing
complexes or in individual quarters dispersed among the civilian
population. In Naples, Italy, for instance, residences for U.S. personnel
were spread out over an approximately 350 square-mile area. At one base
we visited, antiterrorism officials were fairly comfortable with the security
of the base but were concerned about a five-story housing complex for
unaccompanied personnel that is located in a residential area off a heavily
traveled street. This housing complex lacked basic physical security




Page 6                              GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                          B-277464




                          features such as protective window coating, a central fire alarm system,
                          and adequate perimeter fencing.

                          In addition to choosing different targets, terrorists can also alter their
                          mode of attack. For instance, some commanders in the Middle East are
                          concerned that terrorists will switch to weapons that can be fired over
                          perimeter defenses from hidden locations. One U.S. commander was
                          concerned that terrorists could launch indirect fire attacks from several
                          sectors of the surrounding city. Such attacks are difficult to defend against
                          because these weapons can be set up, fired, and moved from concealed
                          areas very quickly. U.S. security officials at a base in Europe said because
                          the host nation-controlled base perimeter is easily penetrated, they believe
                          themselves to be more vulnerable to suitcase bombs than to truck bombs.


                          DOD has initiated a number of changes in the antiterrorism program since
DOD Has Taken Steps       the Khobar Towers bombing. Announcing the initiatives in
to Improve The            September 1996, the Secretary of Defense stated that their intended
Antiterrorism             aggregate effect was to (1) place antiterrorism up front as a major
                          consideration with other key mission goals, (2) ensure that the threat and
Program                   antiterrorism measures are constantly evaluated, and (3) empower
                          commanders with increased resources and flexibility to be responsive to
                          changes in threat.

                          Some of the major initiatives are as follows:

                      •   The Secretary of Defense issued a revision of DOD Directive 2000.12, which
                          governs the Department’s antiterrorism program.
                      •   The Secretary of Defense assigned the Chairman, Joint Chiefs of Staff, to
                          be his principal advisor on antiterrorism. To support this added
                          responsibility, the Chairman created a new office in the Joint Staff—the
                          Deputy Directorate for Combating Terrorism (JCS/J-34).
                      •   The Secretary of Defense directed that the five geographic combatant
                          commanders take on increased antiterrorism responsibilities. The
                          commanders of the U.S. Atlantic Command, U.S. Central Command,
                          U.S. European Command, U.S. Pacific Command, and U.S. Southern
                          Command are now responsible for ensuring the protection of DOD
                          personnel in their area of responsibility. Prior to this, no DOD components
                          were explicitly given this responsibility.
                      •   Under the direction of JCS/J-34, the Defense Special Weapons Agency began
                          to conduct vulnerability assessments at installations. The assessments,
                          which supplement those done by other DOD components, are intended to



                          Page 7                              GAO/NSIAD-97-207 DOD’s Antiterrorism Program
    B-277464




    help commanders understand their vulnerabilities to terrorist attack and
    to give them options for enhancing security and mitigating weapon effects.
•   DOD has mandated more robust antiterrorism training for personnel
    deploying to medium- and high-threat countries. The training is intended
    to increase awareness of the threat and provide information on individual
    protective measures. Additional training is to be provided to (1) personnel
    designated as unit antiterrorism instructors and advisors, (2) officers
    attending precommand courses, and (3) executive-level officials with
    antiterrorism responsibilities.
•   The Secretary of Defense established a $14-million centrally controlled
    fund to support emergency, high-priority antiterrorism requirements not
    funded by the services. The fund is managed by JCS/J-34.
•   The services have also planned or instituted changes in their approach to
    antiterrorism. Most notably, the Air Force has created a Force Protection
    Group that will be among the first to deploy in a contingency. The group,
    consisting of personnel from a variety of specialties, will be responsible
    for establishing the security infrastructure at the deployment site.

    During our visits overseas, we found evidence that commanders at all
    levels were placing more emphasis on the antiterrorism program than they
    had prior to Khobar Towers. Since that bombing, most sites had appointed
    an antiterrorism focal point, established a team to address antiterrorism
    issues, and conducted additional vulnerability assessments to identify
    needed improvements.

    By far the most progress had been made by the U.S. Central Command and
    its service component commands. U.S. Central Command’s area of
    responsibility includes the Middle East, the region with the most
    high-threat countries. The special emphasis at U.S. Central Command is
    not unexpected given that its forces were the most recent targets of
    terrorist attacks. Among other actions, the command had

•   determined the range of specific terrorist threats it needed to counteract
    in its area of responsibility, including a 20,000-pound truck bomb;
•   devised threat-based standards, such as stand-off, to guide the design and
    construction of new facilities and modifications to existing structures;
•   established a forward activity that is responsible for coordinating
    antiterrorism in the region and reports directly to the Deputy
    Commander-in-Chief, U.S. Central Command; and
•   identified a need for hundreds of additional security personnel and filled
    these slots.




    Page 8                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                          B-277464




                          The U.S. European Command, whose area of responsibility includes large
                          parts of Europe, Africa, and the Middle East, also had made progress. Its
                          Army component was particularly active in addressing antiterrorism
                          issues. For instance, it had updated its operations order governing
                          antiterrorism at Army sites, conducted assessments of the antiterrorism
                          programs of its subordinate commands, and established a senior-level
                          working group to make antiterrorism funding decisions.



                          DOD’s current emphasis on antiterrorism was still relatively new at the time
DOD Still Needs to        we completed our review in June 1997—1 year after the Khobar Towers
Develop a                 bombing. Nevertheless, our work raises concerns that its initiatives fall
Comprehensive,            short of correcting the shortcomings identified in the Downing task force
                          report and of meeting the needs of commanders in the field. The task force
Consistent Approach       envisioned a comprehensive, consistent DOD approach to combating
to Antiterrorism          terrorism spearheaded by one office that would develop policy and
                          standards, act as an advocate, assist commanders in the field, and manage
                          resources on both a routine and emergency basis. On the basis of our
                          review, we believe DOD’s combating terrorism office—JCS/J-34—has not
                          taken an active enough role in providing the antiterrorism tools
                          commanders are requesting. For instance, DOD has not

                      •   provided common standards to assess vulnerabilities,
                      •   promulgated prescriptive physical security standards that would require at
                          least a minimum level of protection to U.S. forces,
                      •   ensured consistency in the security countermeasures commands take in
                          responding to threats, and
                      •   clarified security responsibilities for all its personnel overseas.

                          The Downing task force found that in the absence of definitive guidance
                          from DOD, local commanders approach force protection based on general
                          guidance from their service component commands or on their own
                          knowledge and experience and that of their staff. Based on our site visits,
                          we found that, outside the U.S. Central Command, this was generally still
                          the case. In our view, DOD’s failure to impose a comprehensive approach to
                          combating terrorism, as envisioned by the Downing task force, has
                          resulted in a program that still lacks consistency and coordination.




                          Page 9                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                            B-277464




DOD Needs a More Active     One of the central conclusions of the Downing task force was that DOD
Antiterrorism Focal Point   needed a stronger centralized approach to antiterrorism. To implement
to Provide the Guidance     this approach, the task force said, a single DOD entity should be designated
                            as responsible for antiterrorism. This entity, among other things, should
Commanders Are              develop and issue physical security standards, inspect compliance with
Requesting                  these standards, manage resources on both a routine and emergency basis,
                            and assist field commanders with antiterrorism matters, the task force
                            said. The task force found in its review that the lack of a single DOD entity
                            responsible for antiterrorism had had an adverse impact on the posture of
                            forces in the field.

                            In response to the task force recommendation, the Secretary of Defense
                            acknowledged the need for a more centralized focus and clearer lines of
                            responsibility for establishing, coordinating, and overseeing force
                            protection. Accordingly, he appointed the Chairman of the Joint Chiefs of
                            Staff as DOD’s focal point for antiterrorism and directed the Chairman to
                            establish an office to carry out the antiterrorism responsibilities. This new
                            office, JCS/J-34, has subsequently become involved in a wide variety of
                            antiterrorism issues.

                            JCS/J-34 sees its role as synchronizing the efforts of the Joint Staff in
                            combating terrorism, to include assisting the combatant commands in the
                            execution of their new antiterrorism responsibilities, but not to the extent
                            of prescribing policies and procedures to the geographic combatant
                            commands for carrying out their new antiterrorism responsibilities. In
                            addition, JCS/J-34 has no plans to develop and issue physical security
                            standards (discussed further later in this report), nor does it plan to
                            conduct compliance inspections as recommended by the Downing task
                            force.5 JCS/J-34 officials said they are precluded from exercising authority
                            over the antiterrorism program because the Chairman is not in the
                            geographic combatant commanders’ chain of command. These officials
                            said the Secretary of Defense is the single DOD entity with authority over
                            the antiterrorism program. However, the Secretary of Defense directed
                            that the joint staff office review standards, doctrine, deployments,
                            budgets, audit plans, technology development programs, and all other
                            aspects of force protection policy and programs and recommend any
                            action needed. For example, JCS/J-34 is the principal author of DOD’s new
                            combating terrorism program standards to be issued by the Secretary of
                            Defense. Although the new program standards lack the detailed and
                            descriptive criteria called for by the Downing task force, they demonstrate

                            5
                              JCS/J-34 and the Defense Special Weapons Agency have stressed that their new vulnerability
                            assessments are not intended as inspections.



                            Page 10                                         GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                                B-277464




                                that JCS/J-34 has the capability to develop prescriptive standards for
                                issuance by the Secretary of Defense.

                                Moreover, on the basis of our review, we believe there is a need for this
                                type of guidance. During our visits to the geographic combatant
                                commands and their service component commands, officials identified a
                                need for more guidance to help them carry out their expanded force
                                protection responsibilities. For example:

                            •   A senior official at U.S. Southern Command said that additional guidance
                                should be provided to help commanders determine when sufficient
                                antiterrorism measures had been taken.
                            •   Senior antiterrorism officials at U.S. European Command and U.S. Central
                                Command said they were waiting for implementation guidance from DOD
                                on how to fulfill the requirement that they identify and report
                                antiterrorism deficiencies in their area of responsibility.
                            •   U.S. Air Forces in Europe recommended that DOD develop an antiterrorism
                                “postulated threat” to assist in developing security measures, manning
                                standards, and construction specifications.
                            •   U.S. Central Command requested that a DOD-wide standard for stand-off
                                distance be developed. When DOD declined to issue such a standard,
                                U.S. Central Command developed its own. However, there were still
                                questions about the appropriate risk to accept from a 20,000-pound truck
                                bomb. One subordinate command advocated doubling the stand-off
                                distance standard to decrease the potential damage to personnel.


Vulnerability Assessments       Vulnerability assessments are tools commanders use to evaluate their
Differ in Frequency,            ability to defend against terrorist attack and to highlight security
Approach, and Quality           weaknesses that terrorists could exploit. Currently, however, there is not a
                                common understanding within DOD of how to conduct a vulnerability
                                assessment or what constitutes a high-quality assessment. DOD and the
                                services have prescribed few requirements for conducting vulnerability
                                assessments. The result is that commanders in the field may receive a
                                detailed and useful assessment or they may receive one that is of little to
                                no use. Furthermore, in the absence of standardized assessments, DOD
                                cannot compare the results from different sites and determine, on a
                                worldwide basis, how well its forces are protected.

                                We reviewed selected vulnerability assessments completed after the
                                Khobar Towers bombing and found inconsistencies in frequency,
                                approach, and quality.



                                Page 11                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
    B-277464




•   Some sites have had numerous assessments, while others have had none.
    At many high-threat sites, numerous assessments had been conducted.
    One site in Kuwait had been assessed at least nine times between July
    1996 and March 1997. Officials at many sites we visited expressed concern
    about the high frequency of, and lack of cohesion among, assessments.
    Conversely, officials at some component commands told us that
    vulnerability assessments had never been conducted at sites in their area
    of responsibility. In the absence of a vulnerability assessment,
    commanders are not in a position to answer the question, “How vulnerable
    are you to terrorist attack?”
•   Few of the assessments covered all the minimum functions suggested in
    DOD guidance. DOD suggests, but does not require, that at a minimum,
    vulnerability assessments address four areas: (1) weaknesses in physical
    security plans, programs, and structures; (2) inefficiencies in personnel
    practices and procedures related to security and incident control,
    response, and resolution; (3) enhancements in operational procedures;
    and (4) resources necessary to meet security requirements. Many of the
    assessments we reviewed addressed physical security, but few addressed
    all four areas.
•   Some vulnerability assessments had limited value because they did not
    identify specific vulnerabilities. For example, assessments for Air Force
    and Navy sites in Panama did not mention specific vulnerabilities, making
    it impossible to determine what, if any, improvements were needed to
    decrease their vulnerability to terrorist attacks. These assessments instead
    gave a single numerical rating of vulnerability based on a number of
    elements such as location, terrain, and access. A force protection official
    at U.S. Southern Command said these assessments were not useful for
    making antiterrorism decisions. In contrast, Army assessments in Panama
    were very detailed.
•   Threat information was not well defined. According to DOD guidance, a
    threat analysis provides a basis for assessing the terrorist risk to a given
    site, including the likelihood of terrorist attack and the mode of attack. It
    is a precursor to the vulnerability assessment. However, some of the
    assessments we reviewed did not mention the threat against which the site
    needed to defend itself. Others vaguely referred to the terrorist threat, but
    lacked specifics on the mode or modes of attack that would most likely be
    used. Still others postulated a threat that appeared incongruent with threat
    assumptions made elsewhere. Most notably, an assessment conducted for
    a headquarters building in the United States postulated a truck bomb
    threat that was twice the size of the bomb DOD estimates was used in the
    Khobar Towers bombing.




    Page 12                            GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                        B-277464




                        We also found that some commanders believe they must implement all
                        recommendations contained in vulnerability assessments. While the
                        assessments are a tool to help commanders identify their security
                        weaknesses, we were told that since the Khobar Towers bombing some
                        commanders feel they must implement all recommendations from
                        vulnerability assessments, whether they agree with them or not. They are
                        taking this approach out of fear that if terrorists attack their forces, they
                        could be criticized for failing to implement a recommended corrective
                        action that, in hindsight, would have mitigated the damage from the attack.

                        Vulnerability assessments lack consistency because DOD has not
                        established common standards for them. The Downing task force
                        criticized the current approach to conducting vulnerability assessments,
                        noting that DOD lacked standards governing their frequency, format, and
                        content. DOD has acknowledged that vulnerability assessments vary widely
                        in scope and comprehensiveness. Further, DOD has acknowledged that
                        common approaches and standards are needed, but it does not plan to
                        impose standards that would apply to all assessments. JCS/J-34 officials told
                        us this was not their role. We reviewed DOD’s proposed program standards
                        and found the following standards regarding vulnerability assessments:

                        “DOD Components will schedule a higher headquarters level assessment of
                        their installations and [Antiterrorism/Force Protection] Programs at least
                        once every three years.”

                        “Commanders will prepare a terrorist physical security vulnerability
                        assessment for facilities, installations, and operating areas within their
                        area of responsibility. The assessment will address the broad range of
                        physical threats to the security of personnel and assets.”

                        In our opinion, these standards will not address the shortcomings we
                        identified when we reviewed the vulnerability assessments because they
                        do not provide specific requirements for methodology, scope, and content.



DOD Has Not Issued      In its investigation of the Khobar Towers bombing, the Downing task force
Prescriptive Physical   found that DOD had not established physical security standards, including
Security Standards      standards governing the design and construction of new buildings or the
                        modification of existing structures against the terrorist threat. The
                        Downing task force recommended that DOD adopt prescriptive physical




                        Page 13                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




security standards. We found that DOD had not implemented this
recommendation and had no plans to do so.

The Downing task force held up the State Department’s physical security
standards as an example for DOD to follow in developing its own standards.
The task force characterized the standards as detailed and descriptive.
Most importantly, the task force stated, State had adopted the standards as
requirements, not as guidance. State’s standards, developed in
coordination with the Overseas Security Policy Board, apply to all U.S.
missions abroad under the authority of a chief of mission. The standards
were created primarily for U.S. diplomatic offices and residential facilities.
They are based on the assessed threat level in the country, with the result
that facilities in higher threat countries must meet more stringent
requirements. For high-threat areas, the standards address such physical
security concerns as the height of perimeter walls, entry control, stand-off
distance, and the location of parking areas.

Currently, DOD requires its components to deploy a physical security
system to protect defense resources. But, unlike at State, its regulations do
not establish physical security standards that define what is acceptable or
unacceptable. The new standards developed by JCS/J-34, noted above, also
do not provide detailed and descriptive requirements. The standards,
rather, are considered “performance standards” that are intended to lead
commanders through an assessment of their antiterrorism capabilities. For
instance, one standard states, “Commanders will develop and implement a
physical security plan, as part of the [antiterrorism/force protection]
program, that incorporates facilities, equipment, trained personnel, and
procedures into a comprehensive effort designed to provide maximum
antiterrorism protection to personnel and assets.” More specific guidance
to implement these performance standards is provided in a DOD handbook,
but the handbook guidance is advisory only.6

JCS/J-34
       officials told us they had no plans to issue DOD-wide physical
security standards. They believe that the variability in threat and
vulnerabilities among geographic areas and individual sites precludes such
standards. However, we noted that diplomatic missions also face different
threats and vulnerabilities yet are required to meet State’s physical
security standards. The JCS/J-34 officials said commanders responsible for
antiterrorism may establish standards if they choose. Of the five
geographic combatant commands, only U.S. Central Command had

6
 DOD 0-2000.12-H, Protection of DOD Personnel and Activities Against Acts of Terrorism and Political
Turbulence, dated February 1993.



Page 14                                        GAO/NSIAD-97-207 DOD’s Antiterrorism Program
    B-277464




    developed prescriptive design standards. Central Command officials said
    that since DOD declined to issue standards for protecting facilities against a
    bomb blast, they developed their own. Officials at the other geographic
    combatant commands had various opinions regarding the need for
    DOD-wide physical security standards. For instance, U.S. European
    Command officials stated that DOD should establish minimum physical
    security standards for each threat level and then require the services to
    publish more specific guidance. Such an approach would allow for
    differences among the services. U.S. Pacific Command officials believe
    that measurable DOD-wide physical security standards are a good idea if
    they provide flexibility to allow for variability in the threat and local
    circumstances. U.S. Navy Europe stated that there is an absolute need for
    a DOD-wide standard that is tough enough to force all activities to a
    minimum level of compliance but flexible enough to allow an activity to
    adjust for impediments that impact its ability to comply.

    In its report, the Downing task force noted that commanders are currently
    left to a subjective determination of what is safe and unsafe. With the
    exception of the U.S. Central Command, we confirmed this observation
    during our site visits and came across instances where decisions to build
    facilities in the absence of DOD-wide physical security standards had
    resulted in serious security lapses.

•   Newly completed dormitories in one country we visited are located close
    to a heavily traveled public road. Base officials believe that the road
    presents a vulnerability to truck bombs similar to the bomb that exploded
    at Khobar Towers. During our visit, they were contemplating closing the
    road or building a tunnel to reroute traffic away from the dormitories. The
    installation had not yet begun to calculate the cost of these measures.
•   In one country, a new $1.9 million facility was being built on a city street
    with no stand-off distance. The geographic combatant command assessed
    the facility’s vulnerabilities during construction and recommended that it
    be relocated to a more secure location. Furthermore, the command found
    that with one exception, none of the off-base facilities it visited in this
    country conformed with the advisory guidelines contained in DOD’s
    antiterrorism handbook.
•   A headquarters building under construction in the United States is
    considered to be so unsafe that a service assessment team suggested that
    it be relocated. The additional cost to improve the security at this leased
    facility is estimated to be about $1 million per year.




    Page 15                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                                 B-277464




Security Threat Conditions       DOD has established a system of terrorist threat conditions to indicate the
Are Inconsistently Applied       security posture at its sites. All DOD components are required to implement
                                 the system. One objective of the system is to provide a common
                                 framework to facilitate interservice coordination. The geographic
                                 combatant commanders are required to ensure that threat conditions are
                                 uniformly implemented in their area of responsibility. Commanders may
                                 choose from one of five threat conditions—Normal, Alpha, Bravo, Charlie,
                                 and Delta—depending on their assessment of the threat and other factors
                                 such as target vulnerability, criticality of assets, and the availability of
                                 security resources. Threat Condition Normal indicates that a general
                                 threat of possible terrorist activity exists but warrants only a routine
                                 security posture. Threat Condition Delta, on the other hand, applies to the
                                 immediate area where a terrorist attack has occurred or when intelligence
                                 has been received that terrorist action against a specific location is likely.
                                 In this case, commanders are required to implement a series of security
                                 measures. The other threat conditions fall between Normal and Delta, with
                                 each one having associated security measures.

                                 The Downing task force noted that personnel restrictions based on threat
                                 conditions varied widely. DOD’s guidance states that the threat condition
                                 system is designed to provide commanders with flexibility, to enable them
                                 to temper actions based on their best judgment and knowledge of the local
                                 situation. DOD officials added that commanders and managers must take
                                 account of the mission, the threat, and specific circumstances, all of which
                                 may require higher levels of force protection. During our review, however,
                                 we found continued inconsistencies in the implementation of the threat
                                 condition system that did not appear to have any basis in mission, threat,
                                 or circumstance. For example:

                             •   Some commanders in the Middle East implemented markedly different
                                 interpretations of the security measures associated with Threat Condition
                                 Charlie. In one country, for instance, personnel from one service were
                                 permitted to leave the base, whereas personnel belonging to another
                                 service at two nearby bases could not. In a second country, personnel at
                                 one installation were generally confined to the installation but allowed to
                                 make limited forays to an off-base civilian housing complex. Personnel at
                                 other installations in this country were confined to their bases except for
                                 mission-essential travel.
                             •   Even within the same base, interpretations of Threat Condition Charlie
                                 could be inconsistent. At one base, personnel under one combatant
                                 command were restricted to base except for mission-essential travel. At
                                 this same base, personnel assigned to a security assistance organization



                                 Page 16                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
    B-277464




    were permitted to go to restaurants and shopping areas downtown, with
    no clear requirement that these trips be mission related. These same
    groups also implemented markedly different controls over the many third
    country workers who provide cooking, cleaning, and maintenance services
    to the base. The combatant command required escorts for their workers
    while the security assistance organization allowed its third country
    workers to come and go in their area of the base unescorted.
•   Commanders in two Middle Eastern countries had been generally
    maintaining the intense security posture associated with Threat Condition
    Charlie for the 9 months since the June 1996 Khobar Towers bombing,
    even though this posture was supposed to be used only for short durations
    in response to imminent terrorist action. The extended use of the
    measures associated with this threat condition, such as the cancellation of
    social events; the placing of cafes, theaters, and other high-risk areas off
    limits; and the increased requirements for guard personnel, is recognized
    as likely to create a hardship on the units and their personnel. Several of
    the commanders we visited called for review of the threat condition
    system in light of the current security environment.
•   Differences in interpreting threat condition measures can have an
    operational impact. In the Middle East one command refused to allow one
    of its transport aircraft to land because a disabled aircraft was already on
    the ground. The command believed that under Threat Condition Charlie,
    two of its aircraft could not be on the ground at the same time in one
    location, and the command diverted the flight to Cairo, Egypt. However,
    the local commander responsible for designating the threat condition
    advised us that he would have allowed the aircraft to land.
•   The rationale for establishing a particular threat condition was not always
    clear. In a low-threat country for instance, one base had established Threat
    Condition Normal, whereas an abutting base belonging to another service
    had established Threat Condition Bravo—two levels above Normal.
    Officials at the base designated as Bravo said they were under the
    impression that a higher headquarters had mandated that they be at this
    threat condition. They added that they were not actually implementing the
    security measures associated with Bravo. We were subsequently informed
    that the threat condition at this base would be lowered.
•   The security forces commander at one base in Europe said he did not have
    a trained and ready auxiliary force. As a result, if the threat condition were
    raised to Charlie, his forces would have to concentrate their efforts on
    guarding critical assets and could not protect office, housing, shopping,
    and recreational areas where personnel congregate.




    Page 17                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                          B-277464




Antiterrorism             Antiterrorism support for some personnel deployed overseas may be
Responsibility for Some   inadequate because DOD has not ensured that responsibility for their
Deployed Personnel        security is clear. The Secretary of Defense took steps following the
                          bombings in Saudi Arabia to clarify antiterrorism responsibilities for DOD
Remains Unclear           elements on the Arabian peninsula. DOD is aware that similar problems
                          exist in other countries, but it has largely left it to local military officials to
                          address the issue.

                          As noted earlier, DOD has recently assigned the five geographic combatant
                          commanders the responsibility for ensuring the security of all DOD
                          personnel in their area of responsibility. However, approximately
                          30,000 DOD personnel deployed abroad do not fall under the command of a
                          geographic combatant commander. Some of these personnel, such as
                          those assigned to a Defense Attache Office and Marine embassy guards,
                          fall under the authority of a chief of mission, who is responsible for their
                          security. However, many others, while formally under the authority of a
                          chief of mission, have been described as falling into a gray area between
                          the force protection responsibility of the geographic combatant
                          commander and the chief of mission.

                          The U.S. Ambassador to Turkey and the Commander-in-Chief,
                          U.S. European Command, were very concerned about security gaps for
                          gray-area DOD personnel in that high-threat country. The embassy, working
                          with local U.S. military representatives, identified nearly
                          1,500 gray-area personnel, including several hundred assigned to the North
                          Atlantic Treaty Organization (NATO). Many of these personnel were
                          receiving little or no security support from the embassy. Such support can
                          include things such as security guards, physical security assessments of
                          housing and work places, and threat information. The officials said that
                          antiterrorism responsibilities for these personnel must be clarified. If there
                          is a question about DOD’s or NATO’s responsibility for any of these gray-area
                          personnel, then they should be withdrawn from Turkey, the embassy said.
                          Alternatively, if the embassy is to be given responsibility for these
                          personnel, then it must also have explicit authority over them to enforce
                          State’s security regulations. Furthermore, the embassy must receive a
                          concomitant increase in resources to cover its added responsibilities.
                          Missions in other European countries have raised similar concerns about
                          gray-area DOD personnel. These missions believe they should be
                          responsible for protecting only those DOD personnel accredited to the
                          mission. They said they lack the resources to take on responsibility for
                          additional DOD personnel.




                          Page 18                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
              B-277464




              Following the bombings in Saudi Arabia, DOD and the Department of State
              agreed that security responsibilities in the region had become muddled.
              The Secretary of Defense, in coordination with the Secretary of State,
              decided to take on security responsibility for most DOD personnel on the
              peninsula. Under a memorandum of understanding between the two
              agencies, U.S. Central Command negotiated with each chief of mission to
              specifically determine which DOD elements will fall under the antiterrorism
              responsibility of the combatant commander and which will fall under the
              responsibility of the mission.

              DOD  has not taken such a comprehensive approach to resolving gray-area
              problems outside the Arabian peninsula. Rather, the geographic
              combatant commands and in-country military representatives have been
              working with the missions to identify gray-area personnel and address
              security issues at the local level. Embassy officials in Turkey expressed
              frustration with this approach. They believe their ability to address
              security issues is limited and that fundamental policy decisions must be
              addressed at high levels within DOD and the State Department. For
              instance, U.S. officials in Turkey will not be able to unilaterally order
              gray-area DOD elements to modify their operations for security purposes.
              Nor can they resolve resource matters on their own. They advocated that a
              memorandum of agreement similar to that for the Arabian peninsula be
              extended to other countries. Officials at other embassies said a more
              comprehensive approach is needed. For instance, embassy and military
              officials in Italy said there is no mechanism to ensure that the embassy is
              informed about the number and location of DOD personnel in country.

              DOD and State Department officials are addressing gray-area issues through
              a joint working group and are considering establishing a memorandum of
              understanding that would apply to countries outside the Arabian
              peninsula. As in the Arabian peninsula, such a memorandum of
              understanding would require implementation agreements between each
              chief of mission and the combatant commander.


              We recognize that individual commanders are responsible for ensuring the
Conclusions   protection of their forces, to include employing appropriate antiterrorism
              procedures. Nevertheless, we believe that the Department of Defense has
              not taken the steps necessary to promote a comprehensive, consistent
              approach to antiterrorism that will give commanders at all levels the tools
              they need to fulfill their antiterrorism responsibilities. A lack of
              prescriptive, measurable standards leaves commanders without an



              Page 19                            GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                         B-277464




                         objective basis for determining whether their antiterrorism measures are
                         sufficient. Moreover, DOD lacks assurance that the antiterrorism programs
                         implemented by local commanders meet a consistent minimum standard
                         for all overseas personnel.


                         We recommend the Secretary of Defense direct the Chairman of the Joint
Recommendations          Chiefs of Staff to develop common standards and procedures to include

                     •   standardized vulnerability assessments to ensure a consistent level of
                         quality and to provide a capability to compare the results from different
                         sites,
                     •   DOD-wide physical security standards that are measurable yet provide a
                         means for deviations when required by local circumstances, and
                     •   procedures to maintain greater consistency among commands in their
                         implementation of threat condition security measures.

                         To ensure that security responsibility for DOD personnel overseas is clear,
                         we recommend that the Secretary of Defense take the necessary steps to
                         ensure that the memorandum of understanding now under discussion with
                         the Department of State is signed expeditiously. Further, the Secretary
                         should provide the geographic combatant commanders with the guidance
                         to successfully negotiate implementation agreements with chiefs of
                         mission.


                         In commenting on a draft of this report, DOD concurred with all but one of
Agency Comments          the recommendations. It did not concur with our recommendation for
and Our Evaluation       DOD-wide physical security standards. DOD disagreed with our view that
                         JCS/J-34, as the designated antiterrorism focal point within DOD, should take
                         a more active role in prescribing common standards. Issuing such
                         standards would exceed JCS/J-34’s authority, DOD asserted, and as a
                         Washington, D.C.-based office, JCS/J-34 would not be able to react quickly
                         enough to changes in terrorist tactics. In addition, DOD stated that
                         commanders are responsible for the physical security of their personnel
                         and should not be told how to accomplish this task. DOD believes that its
                         proposed combating terrorism “performance-based standards,”
                         supplemented by existing physical security guidance, will be sufficient to
                         assist commanders. Finally, DOD stated that in advocating a more active
                         focal point, we had misrepresented the spirit and intent of the Downing
                         Assessment Task Force.




                         Page 20                             GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




We continue to believe that common DOD standards would aid
commanders by providing them with a more objective basis for
determining whether their forces are adequately protected from terrorist
threats. Many of the commanders and antiterrorism officials we spoke
with specifically noted the need for, and the importance of, DOD-wide
standards. The most obvious source of common DOD standards is JCS/J-34
because it is the designated focal point within the Department. As
discussed in the report, we recognize that it is the Secretary of Defense
who formally issues DOD standards, and we are not asking that JCS/J-34
exceed its authority as a staff office. However, JCS/J-34, through the
Chairman, Joint Chiefs of Staff, has been given the mandate to take an
active role in reviewing and recommending changes to the antiterrorism
program. It should take full advantage of this role by advocating, and
leading the development of, common standards. If DOD continues to
believe that JCS/J-34 is not the appropriate entity to develop common
standards, then the Secretary of Defense should consider assigning this
task to another entity. The fundamental point remains: DOD-wide standards
are needed to assist commanders in protecting their forces from terrorist
attack.

We agree with DOD that any physical security standards must be flexible to
accommodate DOD’s unique security situations and have included this in
our recommendation. The common DOD standards could be supplemented
as needed by the geographic combatant commands and their service
component commands. Similarly, if a waiver system is required, it could be
implemented by these commands rather than by a central office in
Washington such as JCS/J-34. Moreover, in our view and in the view of
several commanders we spoke with, a waiver system is likely to add a
measure of accountability to the program and ensures that senior-level
officials are aware of potential problems.

We disagree that we have misrepresented the spirit and intent of the
Downing Assessment Task Force when we advocate a more active focal
point. In conducting our review, we drew extensively from the task force
report, and we believe our report is consistent with its spirit and intent.
While DOD is correct when it notes that the task force report stated that the
single DOD element should not become a substitute for commanders at all
levels applying experience, expertise, and resources to the protection of
its forces, it failed to note the task force’s opinion that the lack of a single
element in DOD for force protection had an adverse impact on the posture
of the forces in the field. Throughout its report, the task force emphasized




Page 21                              GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




the need for a single DOD element responsible for force protection.
Specifically, the task force stated:

“The continued threat from terrorism strongly argues for a single element within the DOD to
develop policy and standards for force protection, to act as an advocate for greater priority
to this effort, to assist commanders in developing and implementing force protection
measures at overseas sites, and to manage resources on both a routine and emergency
basis. This agency must have resources, authority to act, and the mandate to support
directly forces challenged by terrorist threats.”


The Secretary of Defense, in his September 15, 1996, report to the
President entitled “The Protection of U.S. Forces Deployed Abroad,”
stated:

“General Downing’s report correctly recognizes the need for a stronger centralized
approach to force protection within DOD. There indeed should be a single individual
designated as responsible for ensuring that our policies will result in adequate force
protection measures being taken and for auditing the performance of our units.”


Moreover, we spoke with a senior member of the Downing Assessment
Task Force regarding the role of a single entity, and he confirmed our
interpretation. He also confirmed that the task force intended that DOD
adopt physical security standards that were specific, directive in nature,
and applicable across the Department.

In its report, the task force repeatedly emphasized the need for mandatory
standards (as opposed to advisory guidance) regarding physical security.
For example, it recommended that the Secretary of Defense “establish
prescriptive DOD physical security standards” and “designate a single
agency within DOD to develop, issue, and inspect compliance with force
protection physical security standards.”

The following are examples of specific observations made by the task
force regarding prescriptive physical security standards:

“Because neither [DOD O-2000.12-H] nor any DOD directive provides formal force protection
standards with which the service components must comply, commanders are left to a
subjective determination of what is safe or unsafe. Unlike the Department of Defense, the
Department of State has mandated physical security standards . . . . Regional Security
Officers [at U.S. missions] are responsible for ensuring compliance with the [State]
standards which are detailed and descriptive. They rely in part on the assessed Threat




Page 22                                    GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




Level in the country. They are regularly supplemented. Most importantly, they are
recognized as requirements by the Department of State.”


“DOD O-2000.12-H provides guidance on physical security for U.S.-occupied facilities. It does
not consider the structural characteristics of buildings to be protected. It does not define
standards for design, materials, or construction of new buildings or modification of
existing buildings . . . . Construction and modification standards are required to ensure that
buildings occupied by U.S. forces provide appropriate protection in the specific threat
environment in each country. The addition of Shatter Resistant Window Film is listed in
[DOD O-2000.12-H] as a suggested measure to mitigate the effects of blast, but it is not
required . . . . DOD must address the significance of blast effects with formal standards.”


“There are no DOD standards for warning systems. This was a significant factor that
contributed to the injuries sustained in the attack on Khobar Towers . . . . Standards must
address requirements for and utility of warning systems in a range of potential
environments.”


In its comments, DOD also stated that our report uses anecdotal evidence
and represents a “snapshot” of a program that has undergone dramatic
changes since we completed our fieldwork. In criticizing the use of
anecdotal evidence, DOD appears to be referring to the illustrative
examples used throughout the report. We believe that the evidence we
gathered during the course of our work was reliable, relevant, and
sufficient to support our findings, conclusions, and recommendations. We
visited approximately 30 overseas bases as well as all 5 geographic
combatant commands and most of their service component commands
(see app. I). During these visits we obtained (1) testimonial evidence from
designated antiterrorism officers and others, (2) documentary evidence
such as vulnerability assessments and corrective action plans, and
(3) physical evidence based on our own observations. The results of our
work are based on the totality of this evidence and not, as DOD implies,
primarily on anecdotes.

With respect to DOD’s comment on the timeliness of our review, we
recognize in the report that DOD’s renewed emphasis on antiterrorism is
only about a year old—dating to the Khobar Towers bombing.
Nevertheless, we believe that the report accurately reflects the current
status of DOD’s antiterrorism efforts and that the program has not changed
dramatically, as DOD states, since we completed our field visits in March
and April 1997. When we asked DOD officials to provide evidence of
dramatic changes in the program, they stated that (1) the geographic
combatant commands now have access to the draft combating terrorism




Page 23                                    GAO/NSIAD-97-207 DOD’s Antiterrorism Program
B-277464




performance standards; (2) the Joint Staff and the Defense Special
Weapons Agency are coordinating their vulnerability assessments with the
combatant commands and the services; and (3) requests submitted to the
JCS/J-34-managed combating terrorism fund have increased. All three of
these initiatives were ongoing during our review and do not bring into
question the currency of our work.

DOD’s comments and our further evaluation of them are presented in
appendix II. DOD also provided technical comments concerning factual
information in the report, and we have modified the report where
appropriate.


Our scope and methodology are discussed in appendix I.

We are sending copies of this report to the Secretaries of Defense, the
Army, the Air Force, and the Navy; the Chairman, Joint Chiefs of Staff; the
Commandant, U.S. Marine Corps; and the Secretary of State. We will make
copies available to other interested parties upon request.

The major contributors to this report were Sharon Cekala,
Donald L. Patton, Carole Coffey, John Nelson, Robert Crowl, and
Thomas Gosling. If you or your staff have any questions concerning this
report, please call me on (202) 512-5140.




Mark E. Gebicke
Director, Military Operations
and Capabilities Issues




Page 24                            GAO/NSIAD-97-207 DOD’s Antiterrorism Program
Page 25   GAO/NSIAD-97-207 DOD’s Antiterrorism Program
Appendix I

Scope and Methodology


                 Representative Ike Skelton and the Ranking Minority Member, Senate
                 Committee on Governmental Affairs, asked that we review the Department
                 of Defense’s (DOD) efforts to protect U.S. forces from terrorist attacks. In
                 response to this request, we reviewed (1) measures taken at overseas U.S.
                 bases to enhance the security of deployed personnel and (2) recent DOD
                 initiatives to improve its antiterrorism program.

                 For our review of antiterrorism measures taken at overseas U.S. bases, we
                 visited the five geographic combatant commands, many of their service
                 component commands, and selected overseas sites where U.S. forces are
                 deployed. Most of the sites we visited were in countries that DOD considers
                 to be a high threat (Kuwait, Saudi Arabia, and Turkey) or a medium threat
                 (Bahrain,1 Italy, and Qatar). We also visited sites in Panama and Germany,
                 which are considered low-threat countries. We conducted these visits in
                 March and April 1997. During the visits, we met with designated
                 antiterrorism officials and others involved in the program to discuss the
                 progress that had been made in identifying and addressing vulnerabilities
                 since the Khobar Towers bombing. We also reviewed pertinent
                 documents, such as vulnerability assessments, corrective action plans, and
                 records pertaining to the work of command and base antiterrorism teams.
                 We also toured the installations to inspect vulnerabilities. In addition, we
                 discussed and reviewed documents regarding funding, intelligence,
                 training, and host nation relationships.

                 The geographic combatant commands and the component commands we
                 visited were as follows:

             •   U.S. Central Command, U.S. Central Command Air Forces, U.S. Navy
                 Forces Central Command, U.S. Army Forces Central Command.
             •   U.S. European Command, U.S. Army Europe, U.S. Navy Europe, U.S. Air
                 Forces in Europe.
             •   U.S. Southern Command, Special Operations Command South, U.S. Army
                 South.
             •   U.S. Pacific Command, U.S. Pacific Air Forces, Commander-in-Chief
                 Pacific Fleet, U.S. Army Pacific, Marine Forces Pacific, Special Operations
                 Command Pacific.
             •   U.S. Atlantic Command, Air Combat Command, U.S. Army Forces
                 Command.




                 1
                  Shortly after our visit, the threat level in Bahrain was changed from medium to high.



                 Page 26                                         GAO/NSIAD-97-207 DOD’s Antiterrorism Program
               Appendix I
               Scope and Methodology




               The sites we visited, by country, were as follows:

               U.S. Navy Headquarters and Support Compound
Bahrain        Mina Salman pier facilities
               Aviation Unit, Bahrain International Airport
               DOD Dependents School
               Mannai Plaza Housing Compound


               Ramstein Air Base
Germany        26th Area Support Group, U.S. Army


               Aviano Air Base
Italy          Caserma Ederle, U.S. Army
               Naval Support Activity Naples


               Ahmed Al Jaber Air Base
Kuwait         Ali Al Salem Air Base
               Camp Doha Prepositioning Site
               Aviation Unit, Kuwait City International Airport


               Howard Air Force Base
Panama         Fort Clayton Army Base
               Naval Station (Rodman) Panama Canal


               Camp Snoopy, Qatar International Airport
Qatar          Al Udeid Air Base (under construction)
               As Sayliyah Prepositioning Site
               Al Messilah Housing Compound
               Umm Said pier facilities


               Eskan Village
Saudi Arabia   Prince Sultan Air Base
               Al Yamama Housing Compound
               Site 12
               Eagletown




               Page 27                            GAO/NSIAD-97-207 DOD’s Antiterrorism Program
         Appendix I
         Scope and Methodology




         U.S. Military Training Mission Detachment
         Al Rakah Housing Compound


         Incirlik Air Base
Turkey
         To review recent DOD initiatives to improve its antiterrorism program, we
         interviewed officials and obtained information from the Deputy
         Directorate for Combating Terrorism, Joint Chiefs of Staff (JCS/J-34); the
         Office for Counterterrorism Analysis, Defense Intelligence Agency; the
         Under Secretary of Defense (Comptroller); the Defense Special Weapons
         Agency; the Departments of the Army, the Air Force, and the Navy;
         Headquarters, U.S. Marine Corps; and the geographic combatant
         commanders and service component commands. During our site visits, we
         discussed the impact of DOD’s initiatives on their ability to protect their
         forces, including the problems they faced in implementing their
         antiterrorism responsibilities. We also obtained their views on other
         initiatives that DOD could undertake.

         In addition, we reviewed pertinent DOD and service documents, such as
         directives, regulations, and guidance on combating terrorism and the
         reports of the DOD Antiterrorism Task Force and the Downing Assessment
         Task Force. The task forces were created to recommend improvements to
         DOD’s antiterrorism program following the two terrorist bombings in Saudi
         Arabia. The Downing task force identified key principles for managing and
         improving the Department’s antiterrorism program. We used these as the
         primary criteria for our review.

         Because the Department of State has security responsibilities for many
         DOD personnel overseas, we met with the Director for Overseas
         Operations, Bureau of Diplomatic Security; the U.S. Ambassadors to
         Kuwait, Qatar, and Turkey; and the Regional Security Officers responsible
         for Bahrain, Great Britain, Italy, Kuwait, Panama, Qatar, Saudi Arabia, and
         Turkey. We obtained their views on the missions’ ability to provide
         security to DOD personnel and on the probems, if any, of expanding their
         security responsibilities to additional DOD personnel overseas. At some of
         these missions, we also met with DOD officials who fall under the security
         responsibility of the State Department.

         We conducted our review between October 1996 and June 1997 in
         accordance with generally accepted government auditing standards.




         Page 28                            GAO/NSIAD-97-207 DOD’s Antiterrorism Program
Appendix II

Comments From the Department of Defense


Note: GAO comments
supplementing those in the
report text appear at the
end of this appendix.




See comment 1.




See pp. 21 to 23.




See pp. 21 to 23.




                             Page 29   GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                     Appendix II
                     Comments From the Department of Defense




See pp. 23 and 24.




                     Page 30                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                    Appendix II
                    Comments From the Department of Defense




See pp. 21 to 23.




See comment 2.




                    Page 31                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                    Appendix II
                    Comments From the Department of Defense




See pp. 21 to 23.




See comment 3.




                    Page 32                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                 Appendix II
                 Comments From the Department of Defense




See comment 4.




                 Page 33                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                    Appendix II
                    Comments From the Department of Defense




See comment 5.




See pp. 21 to 23.




See comment 6.




                    Page 34                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
                 Appendix II
                 Comments From the Department of Defense




See comment 4.




See comment 7.




See comment 8.




                 Page 35                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
               Appendix II
               Comments From the Department of Defense




               The following is our response to DOD’s letter dated June 30, 1997.


               1. We met with DOD officials to review their concerns and deleted
GAO Comments   references to specific locations. DOD officials approved these changes.
               These changes do not affect the message of our report.

               2. In our view, using the standards in DOD Instruction 2000.XX will not
               resolve the vulnerability assessment problems we noted during our
               review. First, the standards are performance standards, not physical
               security standards. Because these performance standards focus on
               policies, procedures, and plans rather than physical security, it is not clear
               how they can be used to identify physical security vulnerabilities. The
               inability to identify specific vulnerabilities was a problem we noted with
               some of the assessments we reviewed. Second, because the standards are
               not detailed and descriptive, they are subject to interpretation by the many
               different agencies and individuals who conduct vulnerability assessments.
               In the absence of more specific, measurable standards, the fundamental
               issues of methodology, scope, and completeness discussed in our report
               will remain.

               Also, as of early July 1997, DOD had not issued DOD Instruction 2000.XX.
               DOD officials said they could not estimate when the instruction would be
               issued. In addition, at the time we completed our fieldwork, only the
               Central Command had established its own standards, a key component of
               the assessment process according to DOD.

               3. As DOD acknowledges in its comments, this guidance is advisory in
               nature. Furthermore, the Downing Assessment Task Force found that
               many commanders in the field were not aware of this guidance and, thus,
               were not using it.

               4. Our recommendation does not encourage DOD to limit the commander’s
               prerogative to establish the threat condition security measures for his or
               her unit, but we would encourage the Department to take the necessary
               steps to ensure that these measures are based on a realistic assessment of
               the mission, the threat, and the specific circumstances of the local
               situation. During our review we noted inconsistencies in the threat
               condition system that did not appear to be based on these factors. For
               example, in the instance cited by DOD in its comments, the security
               assistance personnel are permitted to leave the base for
               nonmission-related activities, such as shopping and eating at restaurants.



               Page 36                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
           Appendix II
           Comments From the Department of Defense




           5. The steps DOD is taking should promote greater consistency in how
           vulnerability assessments are conducted. However, in the absence of
           formal DOD standards, the combatant commands and services may still
           choose to deviate from the program of instruction used by the Joint
           Service Integrated Vulnerability Assessment teams. Therefore, we
           continue to believe that common standards and procedures for conducting
           vulnerability assessments are needed to ensure a consistent level of quality
           and to provide a capability to compare results from different sites.

           6. Neither DOD Directive 2000.12 nor DOD Instruction 2000.XX requires that
           commanders establish prescriptive physical security standards for each
           area of responsibility. As we noted in comment 2, only the Central
           Command has established prescriptive standards.

           7. As of early July 1997, the memorandum of understanding had not been
           signed. DOD officials said they could not estimate when it would be signed.

           8. As discussed in our report, the memorandum of understanding and
           accompanying agreements should address (1) the authority of a chief of
           mission to direct DOD entities to comply with State security standards and
           (2) the resources of the mission to fulfill its security responsibilities with
           respect to DOD personnel. DOD does not address these concerns in its
           comments.




(703174)   Page 37                               GAO/NSIAD-97-207 DOD’s Antiterrorism Program
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 6015
Gaithersburg, MD 20884-6015

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested