This is the accessible text file for GAO report number GAO-09-859T 
entitled 'Homeland Security: Preliminary Results Show Federal 
Protective Service's Ability to Protect Federal Facilities Is Hampered 
By Weaknesses in Its Contract Security Guard Program' which was 
released on July 8, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Testimony: 

Before the Senate Committee on Homeland Security and Governmental 
Affairs: 

United States Government Accountability Office: 
GAO: 

For Release on Delivery: 
Expected at 10:00 a.m. EDT:
Wednesday, July 8, 2009: 

Homeland Security: 

Preliminary Results Show Federal Protective Service's Ability to 
Protect Federal Facilities Is Hampered By Weaknesses in Its Contract 
Security Guard Program: 

Statement of Mark L. Goldstein, Director: 
Physical Infrastructure Issues: 

GAO-09-859T: 

GAO Highlights: 

Highlights of GAO-09-859T, a report to U.S. Senate Committee on 
Homeland Security and Governmental Affairs. 

Why GAO Did This Study: 

To accomplish its mission of protecting about 9,000 federal facilities, 
the Federal Protective Service (FPS) currently has a budget of about $1 
billion, about 1,200 full time employees, and about 13,000 contract 
security guards. GAO has previously reported on FPSs lack of oversight 
of these guards and potential security vulnerabilities of its guard 
program. 

This testimony discusses GAOs preliminary findings on (1) the extent 
to which FPS ensures that its guards have the required training and 
certifications before being deployed to a federal facility, (2) the 
extent to which FPS ensures that its guards comply with their assigned 
responsibilities (post orders) once they are deployed at federal 
facilities, and (3) security vulnerabilities GAO recently identified 
related to FPSs guard program. To address these objectives, GAO 
conducted site visits at 6 of FPSs 11 regions, interviewed numerous 
FPS officials, guards, contractors, and analyzed FPSs policies and 
data. GAO also conducted covert testing at 10 judgmentally selected 
level IV facilities in four cities. A level IV facility has over 450 
employees and a high volume of public contact. 

What GAO Found: 

FPS does not fully ensure that its contract security guards have the 
training and certifications required to be deployed to a federal 
facility. FPS requires that all prospective guards complete 128 hours 
of training including 8 hours of x-ray and magnetometer training. 
However, in one region, FPS has not provided the x-ray or magnetometer 
training to its 1,500 guards since 2004. Nonetheless, these guards are 
assigned to posts at federal facilities. X-ray training is critical 
because guards control access points at facilities. Insufficient x-ray 
and magnetometer training may have contributed to several incidents 
where guards were negligent in carrying out their responsibilities. For 
example, at a level IV facility, an infant in a carrier was sent 
through an x-ray machine due to a guards negligence. Moreover, GAO 
found that FPS does not have a fully reliable system for monitoring and 
verifying guard training and certification requirements. GAO reviewed 
663 randomly selected guard records and found that 62 percent of the 
guards had at least one expired certification including domestic 
violence declaration, which make them ineligible to carry firearms. 

FPS has limited assurance that its guards are complying with post 
orders. FPS does not have specific national guidance on when and how 
guard inspections should be performed. FPSs inspections of guard posts 
at federal facilities are inconsistent and the quality varied in the 
six regions GAO visited. GAO also found that guard inspections are 
typically completed by FPS during regular business hours and in 
locations where FPS has a field office; and seldom on nights and on 
weekends. However, on an occasion when FPS did conduct a post 
inspection at night it found a guard asleep at his post after taking 
the pain killer prescription drug Percocet. FPS also found other 
incidents at level IV facilities where guards neglected or inadequately 
performed their assigned responsibilities. For example, a guard failed 
to recognize or did not properly x-ray a box containing handguns at the 
loading dock at a facility. FPS became aware of the situation because 
the handguns were delivered to FPS. 

GAO identified substantial security vulnerabilities related to FPSs 
guard program and recent related FPS actions. GAO investigators 
carrying the components for an improvised explosive device successfully 
passed undetected through security checkpoints monitored by FPSs 
guards at each of the 10 level IV federal facilities where GAO 
conducted covert testing. Of the 10 level IV facilities GAO penetrated, 
8 were government owned, 2 were leased, and included offices of a U.S. 
Senator and U.S. Representative, as well as agencies such as the 
Departments of Homeland Security, State, and Justice. Once GAO 
investigators passed the control access points, they assembled the 
explosive device and walked freely around several of floors of these 
level IV facilities with the device in a briefcase. In response to GAO
s findings, FPS has recently taken some actions including increasing 
the frequency of intrusion testing and guard inspections. However, 
implementing these changes may be challenging, according to FPS. 

What GAO Recommends: 

GAO has ongoing work on this issue and will report its complete 
evaluation along with any potential recommendations at a later date. 

View [hyperlink, http://www.gao.gov/products/GAO-09-859T] or key 
components. For more information, contact Mark Goldstein at (202) 512-
2834 or goldsteinm@gao.gov. 

[End of section] 

July 8, 2009: 

Mr. Chairman and Members of the Committee: 

We are pleased to be here to discuss the preliminary results of our 
review of the Federal Protective Service's (FPS) contract security 
guard (guard) program. There has not been a large-scale attack on a 
domestic federal facility since the terrorist attacks of September 11, 
2001 and the 1995 bombing of the Alfred P. Murrah Federal Building in 
Oklahoma City, Oklahoma. Nevertheless, the recent shooting death of a 
guard at the U.S. Holocaust Memorial Museum--though not a federal 
facility-demonstrates the continued vulnerability of public buildings 
to domestic terrorist attack. Thus, one of FPS's most critical 
responsibilities is to effectively manage its guard program so that the 
over one million government employees, as well as members of the public 
who work in and visit the 9,000 federal facilities each year are 
protected.[Footnote 1] 

To accomplish its mission of protecting federal facilities, FPS 
currently has a budget[Footnote 2] of about $1 billion, about 1,200 
full time employees, and about 13,000 guards deployed at approximately 
2,300 of the 9,000 federal facilities across the country.[Footnote 3] 
While FPS does not use guards at the remaining 6,700 facilities under 
its protection, it frequently uses other security countermeasures such 
as cameras and perimeter lighting to help protect these facilities. In 
our June 2008 report, we found that FPS faced significant challenges in 
ensuring the quality and timeliness of its building security 
assessments and in maintaining complete crime statistics. We also 
reported that its risk assessment process was partially flawed. 
[Footnote 4] FPS used these tools to help determine how to protect 
federal facilities. 

As of June 2009, FPS's guard program has cost about $613 million and 
represents the single largest item in its budget. It is the most 
visible component of FPS's operations as well as the first public 
contact when entering a federal facility. FPS relies heavily on its 
guards and considers them to be the agency's "eyes and ears" while 
performing their duties. Guards are primarily responsible for 
controlling access to federal facilities by (1) checking the 
identification of government employees as well as members of the public 
who work in and visit federal facilities, and (2) operating security 
equipment, such as x-ray machines and magnetometers to screen for 
prohibited materials, such as firearms, knives, explosives, or items 
intended to be used to fabricate an explosive or incendiary device. 
Guards do not have arrest authority but can detain individuals who are 
being disruptive or pose a danger to public safety. 

In June 2008, we reported that FPS faced several funding and 
operational challenges, including oversight of its guard program, that 
hamper its ability to accomplish its mission of protecting federal 
facilities and ensuring the safety of the occupants. We recommended, 
among other things, that the Secretary of the Department of Homeland 
Security (DHS) direct the Director of FPS to develop and implement a 
strategic approach to better manage its staffing resources, evaluate 
current and alternative funding mechanisms, and develop appropriate 
measures to assess performance. While DHS concurred with our 
recommendations, FPS has not fully implemented these recommendations. 
This testimony is based on preliminary findings of ongoing work and 
addresses (1) the extent to which FPS ensures that its guards have the 
required training and certifications before being deployed to a federal 
facility, (2) the extent to which FPS ensures that its guards comply 
with post orders[Footnote 5] once they are deployed at federal 
facilities, and (3) security vulnerabilities we identified related to 
FPS's guard program and recent related FPS actions taken in response. 

To determine the extent to which FPS ensures that its guards have the 
required training and certifications prior to being deployed to a 
federal facility and are complying with post orders once deployed to a 
federal facility, we conducted site visits at 6 of FPS's 11 regions. 
These regions have responsibilities for almost 63 percent of FPS's 
13,000 guards and 52 percent of the 2,360 facilities that have guards. 
To select the regions, we considered the number of federal facilities 
in each region, geographic dispersion across the United States, and the 
number of FPS employees in each region. At these locations, we 
interviewed FPS's Contract Guard Program Managers and their support 
staff; law enforcement security officers (also referred to as 
inspectors) who are responsible for conducting guard inspections, 
regional managers, as well as guards and the contractors about FPS's 
efforts to manage its guard program. We also interviewed officials at 
FPS and GSA headquarters as well as GSA's regional security officials. 
We reviewed and analyzed FPS's guard training and certification 
requirements, Security Guard Information Manual, and guard contracts. 
To determine how FPS tracks the status of whether its guards have met 
the training and certifications requirements, in the 6 regions we 
visited we randomly selected 663 guard files that were maintained in 
FPS's Contract Guard Employment Requirements Tracking System (CERTS). 
Because CERTS was not fully reliable we also used information 
maintained in some of FPS's regional databases or at the contractor's 
office. The 663 guard files we reviewed in the six regions we visited 
are not generalizable. To determine how FPS ensures that its guards are 
complying with post orders, we reviewed FPS's guard inspection process 
and observed numerous guard inspections at federal facilities in each 
of the 6 regions we visited. To identify potential security 
vulnerabilities in FPS's guard program, we conducted covert testing at 
10 judgmentally selected level IV facilities. The facilities were 
selected from FPS's most current listing of federal facilities by 
security level.[Footnote 6] The results of our covert testing at the 10 
level IV facilities are not generalizable. Because of the sensitivity 
of some of the information in our report, we cannot provide information 
about the specific locations of incidents discussed. We conducted this 
performance audit from July 2008 to July 2009 in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

In Summary: 

FPS does not fully ensure that its guards have the training and 
certifications required to stand post at federal facilities. While FPS 
requires that all prospective guards complete about 128 hours of 
training, including 8 hours of x-ray and magnetometer training, it was 
not providing some of its guards with all of the required training in 
the six regions we visited. For example, in one region, FPS has not 
provided the required 8 hours of x-ray or magnetometer training to its 
1,500 guards since 2004. X-ray training is critical because the 
majority of guards are primarily responsible for using this equipment 
to monitor and control access points at federal facilities. 
Insufficient x-ray and magnetometer training may have contributed to 
several incidents in federal facilities where guards were negligent in 
carrying out their responsibilities. For example, at a level IV 
facility in a major city, an infant in a carrier was sent through an x- 
ray machine, which is considered hazardous,[Footnote 7] due to the 
guard's negligence. We also found that some guards had not been 
provided building-specific training, which may have contributed to 
several guards at one federal facility not following evacuation 
procedures and leaving access points unattended and vulnerable. FPS's 
primary system--CERTS--for monitoring and verifying whether guards have 
the training and certifications required to stand post at federal 
facilities is not fully reliable. We reviewed training and 
certification data for 663 randomly selected guards in 6 of FPS's 11 
regions maintained in CERTS, which is the agency's primary system for 
tracking guard training and certifications. Because CERTS was not fully 
reliable we also used databases maintained by some of FPS's regions or 
information provided by the contractor. We found that 62 percent, or 
411 of the 663 guards who were deployed to a federal facility had at 
least one expired firearm qualification, background investigation, 
domestic violence declaration[Footnote 8], or CPR/First Aid training 
certification. More specifically, according to the most recent 
information from one contractor, we found that over 75 percent of the 
354 guards at a level IV facility had expired certifications or the 
contractor had no record of the training. Based on the contractor 
information for another contract, we also found that almost 40 percent 
of the 191 guards at another level IV facility had expired domestic 
violence declarations. Without domestic violence declarations in place, 
guards are not permitted to carry a firearm. FPS requires its guards to 
carry weapons. In addition, one of FPS's contractors allegedly 
falsified training records for its guards--an incident that is 
currently being litigated. FPS became aware of this alleged violation 
from an employee of the contractor and not from its internal control 
procedures. Moreover, we found that FPS officials in the 6 regions we 
visited are generally relying on the contractor to self-report that 
training and certification requirements are met because CERTS is not 
fully reliable. 

FPS has limited assurance that its guards are complying with post 
orders once they are deployed to a federal facility. FPS does not have 
specific national guidance on when and how guard inspections should be 
performed. The frequency with which FPS inspects these posts also 
varied across the regions. For example, one region we visited required 
its inspectors to complete 5 guard inspections each month while another 
region did not have any inspection requirements. We also found that in 
the 6 regions we visited that guard inspections are typically completed 
by FPS during routine business hours and in metropolitan cities where 
FPS has a field office, and seldom at nights or on weekends. However, 
on the few occasions when FPS has conducted post inspections at night, 
it has found instances of guards not complying with post orders. For 
example, at a level IV facility, an armed guard was found asleep at his 
post after taking the pain killer prescription drug Percocet. 
Similarly, FPS has also found other incidents at level IV facilities 
where guards were not in compliance with post orders. For example, 
while a guard should have been standing post, the guard was caught 
using government computers to manage a private for-profit adult 
website. At another facility, a guard either failed to recognize or did 
not properly x-ray a box containing semi-automatic handguns at the 
loading dock at one federal facility we visited. FPS became aware of 
the situation because the handguns were delivered to it. 

Our investigators identified substantial security vulnerabilities 
related to FPS's guard program. With the components for an improvised 
explosive device (IED) concealed on their persons, our investigators 
passed undetected through access points controlled by FPS guards at 10 
level IV facilities in four major cities where we conducted covert 
tests. Our investigators used publicly available information to 
identify a type of device that a terrorist could use to cause damage to 
a federal facility and threaten the safety of federal workers and the 
general public. The IED was made up of two parts--a liquid explosive 
and a low-yield detonator--and included a variety of materials not 
typically brought into a federal facility by an employee or the public. 
Of the 10 Level IV facilities we penetrated, 8 were government-owned, 2 
were leased, and included offices of a U.S. Senator and U.S. 
Representative, as well as agencies such as the Departments of Homeland 
Security, State, and Justice. Once our investigators passed the access 
control point, they assembled the IED and walked freely around several 
floors of the facilities and into various executive and legislative 
branch offices with the IED in a briefcase. In response to the security 
vulnerabilities we identified during our covert testing, FPS has 
recently taken steps to improve oversight of the guard program. 
Specifically, according to FPS officials, it has authorized overtime to 
conduct guard post inspections during non-routine business hours and is 
conducting its own penetration tests to identify weaknesses at access 
control points. In March 2009, FPS also issued a policy directive 
intended to standardize inspection requirements across all FPS regions. 
Implementing the new requirements may be challenging, according to FPS 
management and some regional staff. We will be reporting more fully on 
our findings, with potential recommendations, in September 2009. 

Background: 

To accomplish its mission of protecting federal facilities, FPS has 
become increasingly reliant on its guard force. As of June 2009, FPS's 
guard program has cost $613 million and represents the single largest 
item in its fiscal year 2009 budget. While the contractor has the 
primary responsibility for training and ensuring that the guards have 
met certification requirements, FPS is responsible for oversight of the 
guards and relies on about 930 law enforcement personnel located in its 
11 regions to inspect guard posts and verify that training, 
certifications, and timecards are accurate. Figure 1 shows the location 
of FPS's 11 regions and the number of guards and federal facilities 
with guards in each of these regions. 

Figure 1: Number of FPS Guards and Federal Facilities with Guards by 
Region: 

[Refer to PDF for image: map of the United States] 

Map of the United States, depicting the number of FPS guards and 
federal facilities with guards by region, as follows: 

Region: New England; 
Number of guards: 443; 
Federal facilities with guards: 101. 

Region: Northeast and Caribbean; 
Number of guards: 1,505; 
Federal facilities with guards: 185. 

Region: Mid-Atlantic; 
Number of guards: 1,356; 
Federal facilities with guards: 259. 

Region: Southeast; 
Number of guards: 1,801; 
Federal facilities with guards: 385. 

Region: Great Lakes; 
Number of guards: 1,396; 
Federal facilities with guards: 301. 

Region: The Heartland; 
Number of guards: 571; 
Federal facilities with guards: 135. 

Region: Greater Southwest; 
Number of guards: 1,476; 
Federal facilities with guards: 294. 

Region: Rocky Mountain; 
Number of guards: 359; 
Federal facilities with guards: 132. 

Region: Pacific Rim; 
Number of guards: 1,022; 
Federal facilities with guards: 292. 

Region: Northwest/Arctic; 
Number of guards: 369; 
Federal facilities with guards: 111. 

Region: National Capital; 
Number of guards: 2,998; 
Federal facilities with guards: 165. 

Source: GAO analysis of FPS data and Map Resources. 

[End of figure] 

Some of the key responsibilities of FPS's guards include controlling 
access; enforcing property rules and regulations; detecting and 
reporting criminal acts; and responding to emergency situations 
involving the safety and security of the facility. Guards may only 
detain, not arrest, an individual, and their authority typically does 
not extend beyond the facility. Before being assigned to a post or an 
area of responsibility at a federal facility, FPS requires that all 
guards undergo background suitability checks and complete approximately 
128 hours of training provided by the contractor or FPS, including 8 
hours of x-ray and magnetometer training. Guards must also pass an FPS- 
administered written examination and possess the necessary 
certificates, licenses, and permits as required by the contract. Table 
1 shows the training and certifications that FPS requires its guards to 
(1) obtain before standing post and (2) maintain during the course of 
their employment. FPS also requires its guards to complete 40 hours of 
refresher training every 2 to 3 years depending on the terms of the 
contract. In addition to FPS's requirements, some states require that 
guards obtain additional training and certifications. 

Table 1: Guard Training and Certification Required by FPS: 

Training: Contractor Provided; 
* 64 hours basic training; 
* 32 hours live firearms training; 
* 8 hours classroom firearms training; 
* 8 hours basic baton training. 

Training: FPS Provided; 
* 8 hours government training; 
* 8 hours x-ray and magnetometer. 

Certifications: 
* DHS background investigation; 
* Medical examination certificate; 
* Domestic violence declaration; 
* Passing score on written examination; 
* Firearms qualification certificate; 
* Expandable/straight baton training certificate; 
* CPR training certificate; 
* Basic training certificate; 
* Firearms training certificate; 
* Government provided training certificate; 
* Magnetometer/x-ray training certificate; 
* First aid training certificate. 

Source: FPS. 

[End of table] 

FPS currently has contracts with 67 private companies for guard 
services. These contractors are responsible for providing and 
maintaining all guard services as described in the contract statement 
of work, including management, supervision, training, equipment, 
supplies and licensing. FPS is also required to actively monitor and 
verify the contractors' performance and ensure that the terms of the 
contract are met. 

Many FPS Guards Do Not Appear to Have the Training and Certifications 
Required to Stand Post at Federal Facilities in Some Regions: 

FPS Is Not Providing Guards With All of the Required Training in Some 
Regions: 

FPS does not fully ensure that its guards have the training and 
certifications required to be deployed to a federal facility. While FPS 
requires that all prospective guards complete approximately 128 hours 
of training, including 8 hours of x-ray and magnetometer training, it 
was not providing some of its guards with all of the required training 
in the six regions we visited. For example, in one region, FPS has not 
provided the required 8 hours of x-ray or magnetometer training to its 
1,500 guards since 2004. X-ray and magnetometer training is important 
because the majority of the guards are primarily responsible for using 
this equipment to monitor and control access points at federal 
facilities. Controlling access and egress to a facility helps ensure 
that only authorized personnel, vehicles, and materials are allowed to 
enter, move within, and leave the facility. According to FPS officials, 
the 1,500 guards were not provided the required x-ray or magnetometer 
training because the region does not have the employees that are 
qualified or who have the time to conduct the training. Nonetheless, 
these guards continue to control access points at federal facilities in 
this region. In absence of the x-ray and magnetometer training, one 
contractor in the region said that they are relying on veteran guards 
who have experience operating these machines to provide some "on-the- 
job" training to new guards. Moreover, in the other five regions we 
visited where FPS is providing the x-ray and magnetometer training, 
some guards told us that they believe the training, which is computer 
based, is insufficient because it is not conducted on the actual 
equipment located at the federal facility. 

Lapses and weaknesses in FPS's x-ray and magnetometer training have 
contributed to several incidents at federal facilities in which the 
guards were negligent in carrying out their responsibilities. For 
example, at a level IV federal facility in a major metropolitan area, 
an infant in a carrier was sent through the x-ray machine. 
Specifically, according to an FPS official in that region, a woman with 
her infant in a carrier attempted to enter the facility, which has 
child care services. While retrieving her identification, the woman 
placed the carrier on the x-ray machine.[Footnote 9] Because the guard 
was not paying attention and the machine's safety features had been 
disabled,[Footnote 10] the infant in the carrier was sent through the x-
ray machine. FPS investigated the incident and dismissed the guard. 
However, the guard subsequently sued FPS for not providing the required 
x-ray training. The guard won the suit because FPS could not produce 
any documentation to show that the guard had received the training, 
according to an FPS official. In addition, FPS officials from that 
region could not tell us whether the x-ray machine's safety features 
had been repaired. 

We also found that some guards were not provided building-specific 
training, such as what actions to take during a building evacuation or 
a building emergency. This lack of training may have contributed to 
several incidents where guards neglected their assigned 
responsibilities. For example, 

* at a level IV facility, the guards did not follow evacuation 
procedures and left two access points unattended, thereby leaving the 
facility vulnerable; 

* at a different level IV facility, the guard allowed employees to 
enter the building while an incident involving suspicious packages was 
being investigated; and, 

* at a level III facility, the guard allowed employees to access the 
area affected by a suspicious package, which was required to be 
evacuated. 

In addition to insufficient building-specific training, some guards 
said they did not receive scenario-based training and thus were not 
sure what they should do in certain situations. During our site visits 
at 6 FPS regions, we interviewed over 50 guards and presented them with 
an incident that occurred at a federal facility in 2008. Specifically, 
we asked the guards whether they would assist an FPS inspector chasing 
an individual escaping a federal facility in handcuffs.[Footnote 11] 
The guards' responses varied. Some guards stated that they would assist 
the FPS inspector and apprehend the individual, while others stated 
that they would likely do nothing and stay at their post because they 
feared being fired for leaving their post. Some guards also told us 
that they would not intervene because of the threat of a liability suit 
for use of force and did not want to risk losing their job. The guard's 
different responses suggest that more scenario-based training may be 
needed. 

FPS Lacks Assurance That Its Guards Have Required Certifications: 

FPS's primary system--CERTS--for monitoring and verifying whether 
guards have the training and certifications required to stand post at 
federal facilities is not fully reliable. We reviewed training and 
certification data for 663 randomly selected guards in 6 of FPS's 11 
regions maintained either in CERTS, which is the agency's primary 
system for tracking guard training and certifications, databases 
maintained by some of FPS's regions, or contractor information. We 
found that 62 percent, or 411 of the 663 guards who were deployed to a 
federal facility had at least one expired certification, including for 
example, firearms qualification, background investigation, domestic 
violence declaration, or CPR/First Aid training certification. More 
specifically, according to the most recent information from a 
contractor, we found that over 75 percent of the 354 guards at one 
level IV facility had expired certifications, or the contractor had no 
record of the training. Based on the contractor information for another 
contract, we also found that almost 40 percent of the 191 guards at 
another level IV facility had expired domestic violence declarations. 
Without domestic violence declarations certificates, guards are not 
permitted to carry a firearm. FPS requires its guards to carry weapons 
in most cases. Moreover, five of the six regions we visited did not 
have current information on guard training and certifications. 
According to FPS officials in these five regions, updating CERTS is 
time consuming and they do not have the resources needed to keep up 
with the thousands of paper files. Consequently, these five regions 
were not generally relying on CERTS and instead were relying on the 
contractor to self-report training and certification information about 
its guards. 

In addition, not having a fully reliable system to better track whether 
training has occurred may have contributed to a situation in which a 
contractor allegedly falsified training records. In 2007, FPS was not 
aware that a contractor who was responsible for providing guard service 
at several level IV facilities in a major metropolitan area had 
allegedly falsified training records until it was notified by an 
employee of the company. According to FPS's affidavit, the contractor 
allegedly repeatedly self-certified to FPS that its guards had 
satisfied CPR and First Aid training, as well as the contractually 
required bi-annual recertification training, although the contractor 
knew that the guards had not completed the required training and was 
not qualified to stand post at federal facilities. According to FPS's 
affidavit, in exchange for a $100 bribe, contractor officials provided 
a security guard with certificates of completion for CPR and First Aid. 
The case is currently being litigated in U.S. District Court. 

FPS Has Limited Assurance that Guards Comply with Post Orders: 

FPS Is Not Consistently Inspecting Guards Posts: 

FPS has limited assurance that its 13,000 guards are complying with 
post orders. FPS does not have specific national guidance on when and 
how guard inspections should be performed. FPS's inspections of guard 
posts at federal facilities are inconsistent and the quality and rigor 
of its inspections varies across regions. At each guard post, FPS 
maintains a book, referred to as post orders, that describes the duties 
that guards are to perform while on duty. However, we found that in one 
region some of the post orders were not current and dated back to 2002 
when FPS was part of GSA. In addition, the frequency with which FPS 
inspects these posts varied. For example, one region we visited 
required its inspectors to complete 5 guard inspections each month, 
while another region we visited did not have any inspection 
requirements. According to the regional staff, there is no requirement 
that every guard post be inspected each month; rather inspectors are 
required to complete 5 inspections per month which leads to some guard 
posts being inspected multiple times per month and some guard posts not 
being inspected at all. For example, while we were observing guard 
inspections in this region, one guard told us she had been inspected 
twice that week. In contrast, according to FPS officials, guards 
assigned to posts at federal facilities in remote locations or during 
the night shift are rarely inspected. 

During our site visits we also found that the quality of FPS's guard 
inspections varied. According to FPS's procedures for conducting guard 
inspections, FPS should inspect the guard's uniform and equipment, 
knowledge of post orders, and ID and certification cards. For example, 
an inspector in one region performed a more thorough inspection than 
other inspectors. The inspector included an inspection of guard 
certifications, knowledge of post orders, uniform and equipment check, 
inspection of the post station, and timecards. The inspector also asked 
the guard a number of scenario-based questions and asked the guard if 
he had any questions or concerns. The results of the inspection were 
documented immediately following the inspection. Conversely, in a 
different FPS region we visited, the FPS inspector asked the guard if 
all his certifications and training were current; but never physically 
inspected the guard's certifications or asked any scenario-based 
questions. During another inspection we observed, an inspector in 
another region performed a uniform and equipment check but did not ask 
for any certifications. 

We also found that in the 6 regions we visited that guard inspections 
are typically completed by FPS during regular business hours and in 
cities where FPS has a field office. In most FPS regions, FPS is only 
on duty during regular business hours and according to FPS, inspectors 
are not authorized overtime to perform guard inspections during night 
shifts or on weekends. However, on the few occasions when inspectors 
complete guard inspections at night or on their own time, FPS has found 
instances of guards not complying with post orders. For example, as 
shown in figure 2, at a level IV facility, an armed guard was found 
asleep at his post after taking the pain killer prescription drug 
Percocet during the night shift. FPS's guard manual states that guards 
are not permitted to sleep or use any drugs (prescription or non- 
prescription) which may impair the guard's ability to perform duties. 

Figure 2: FPS Guard Sleeping at Post: 

[Refer to PDF for image: photograph] 

Source: FPS. 

[End of figure] 

FPS's post orders also describe a number of items that guards are 
prohibited from doing while on post. For example, guards are prohibited 
from sleeping, using government property such as computers, and test 
firing a weapon unless at a range course. However, FPS has found 
incidents at level IV facilities where guards were not in compliance 
with post orders. Some examples follow. 

* A guard was caught using government computers, while he was supposed 
to be standing post, to further his private for-profit adult website. 

* A guard attached a motion sensor to a pole at the entrance to a 
federal facility garage to alert him whenever a person was approaching 
his post. Another law enforcement agency discovered the device and 
reported it to FPS. 

* A guard, during regular business hours, accidentally fired his 
firearm in a restroom while practicing drawing his weapon. 

* A guard failed to recognize or did not properly x-ray a box 
containing semi-automatic handguns at the loading dock at one federal 
facility we visited. FPS only became aware of the situation because the 
handguns were delivered to FPS. 

While the guards were fired or disciplined in each of these incidents, 
they illustrate that FPS is able to identify some instances where 
guards are not complying with post orders and the importance of why it 
should improve the oversight of its guard program. 

Covert Testing of FPS's Guard Program Reveals Weaknesses: 

We identified substantial security vulnerabilities related to FPS's 
guard program. Each time they tried, in April and May 2009, our 
investigators successfully passed undetected through security 
checkpoints monitored by FPS's guards, with the components for an IED 
concealed on their persons at 10 level IV facilities in four cities in 
major metropolitan areas. The specific components for this device, 
items used to conceal the device components, and the methods of 
concealment that we used during our covert testing are classified, and 
thus are not discussed in this testimony. Of the 10 level IV facilities 
we penetrated, 8 were government owned and 2 were leased facilities. 
The facilities included field offices of a U.S Senator and U.S. 
Representative as well as agencies of the Departments of Homeland 
Security, Transportation, Health and Human Services, Justice, State and 
others. The two leased facilities did not have any guards at the access 
control point at the time of our testing. 

Using publicly available information, our investigators identified a 
type of device that a terrorist could use to cause damage to a federal 
facility and threaten the safety of federal workers and the general 
public. The device was an IED made up of two parts--a liquid explosive 
and a low-yield detonator--and included a variety of materials not 
typically brought into a federal facility by employees or the public. 
Although the detonator itself could function as an IED, investigators 
determined that it could also be used to set off a liquid explosive and 
cause significantly more damage. To ensure safety during this testing, 
we took precautions so that the IED would not explode. For example, we 
lowered the concentration level of the material.[Footnote 12] 

To gain entry into each of the 10 level IV facilities, our 
investigators showed photo identification (state driver's license) and 
walked through the magnetometer machines without incident. The 
investigators also placed their briefcases with the IED material on the 
conveyor belt of the x-ray machine, but the guards detected nothing. 
Furthermore, our investigators did not receive any secondary searches 
from the guards which might have revealed the IED material that we 
brought into the facilities. At security checkpoints at 3 of the 10 
facilities, our investigators noticed that the guard was not looking at 
the x-ray screen as some of the IED components passed through the 
machine. A guard questioned an item in the briefcase at one of the 10 
facilities but the materials were subsequently allowed through the x- 
ray machines. At each facility, once past the guard screening 
checkpoint, our investigators proceeded to a restroom and assembled the 
IED. At some of the facilities, the restrooms were locked. Our 
investigators gained access by asking employees to let them in. With 
the IED completely assembled in a briefcase, our investigators walked 
freely around several floors of the facilities and into various 
executive and legislative branch offices, as described above. 

This testimony is accompanied by a video that shows our investigators 
passing through an access point at a level IV facility and tests of 
actual assembled IEDs at national laboratories: [hyperlink, 
http://www.gao.gov/media/video/gao-09-859t/]. 

FPS's Recent Actions to Improve Its Oversight of Guards May Be 
Challenging to Implement: 

Because of the sensitivity of our review, we have already briefed FPS 
and GSA on the results of our covert testing at 10 level IV facilities 
and other preliminary findings regarding the guard program. FPS 
subsequently identified and began taking several actions in response to 
our findings. According to FPS officials, it recently authorized the 
use of overtime to monitor guards during non-routine business hours and 
is requiring penetration tests to identify weaknesses at access control 
guard posts. FPS has conducted limited intrusion testing in the past 
and experienced difficulty in executing such tests. For example, in 
2008, one FPS region conducted an intrusion test at a level IV facility 
and successfully brought a "fake bomb" into the building through a 
loading area. During the test, FPS agents misplaced the box containing 
the "fake bomb" and it was picked up by a guard who took it to the mail 
room for processing. It was opened by the guard who panicked. After 
this incident, the intrusion testing program in that region was 
canceled, according to FPS officials in that region. 

FPS has also accelerated the implementation of a new directive designed 
to clarify organizational responsibilities for conducting and reporting 
the results of inspections and evaluations. For example, under the 
March 2009 directive, at a level IV facility, FPS is planning to 
inspect 2 guard posts a week. Prior to the new directive, FPS did not 
have a national requirement for when to conduct inspections at federal 
facilities and each region we visited had requirements that ranged from 
no inspection requirements to each inspector having to conduct 5 
inspections per month. Meeting these new requirements may be 
challenging, according to FPS management and regional staff we 
contacted. FPS management in several regions we visited told us that 
the new directive appears to be based primarily on what works well from 
a headquarters or National Capital Region perspective, not a regional 
perspective that reflects local conditions and limitations in staffing 
resources. A FPS official in one region also said the region is not 
adequately staffed to complete all the current mission-essential tasks 
that are required, and another FPS official in that region does not 
believe the region will be able to conduct the additional inspections 
as required in the new policy. Finally, according to the Director of 
FPS, while having more resources would help address the weaknesses in 
the guard program, the additional resources would have to be trained 
and thus could not be deployed immediately. 

Agency Comments: 

We provided FPS a detailed briefing on June 5, 2009 on our preliminary 
findings. We also provided FPS with a draft of this testimony. FPS 
provided no comments on this testimony. 

We plan to provide this Committee with our complete evaluation and a 
final report on FPS's oversight of its guard program in September 2009. 
This concludes our testimony. We are pleased to answer any questions 
you might have. 

Contact Information: 

For further information on this testimony, please contact Mark 
Goldstein at 202-512-2834 or by email at goldsteinm@gao.gov. 
Individuals making key contributions to this testimony include Jonathan 
Carver, Tammy Conquest, John Cooney, Colin Fallon, Daniel Hoy, George 
Ogilvie, Susan Michal-Smith, and Ramon Rodriguez. 

[End of section] 

Footnotes: 

[1] For the purposes of this testimony, federal facilities are the 
9,000 buildings under the control or custody of General Services 
Administration (GSA). 

[2] Funding for FPS is provided through revenues and collections 
charged to building tenants in FPS protected property. The revenues and 
collections are credited to FPS's appropriation and are available until 
expended for the protection of federally owned and leased buildings and 
for FPS operations. 

[3] In our June 2008 report, FPS officials said its guard force totaled 
about 15,000. See GAO, Homeland Security: The Federal Protective 
Service Faces Several Challenges That Hamper Its Ability to Protect 
Federal Facilities, [hyperlink, http://www.gao.gov/products/GAO-08-683] 
(Washington, D.C.: June 11, 2008). However, FPS officials recently said 
that number was not correct and that based on more accurate information 
obtained from its contractors, its guard force currently totals about 
13,000. 

[4] [hyperlink, http://www.gao.gov/products/GAO-08-683]. 

[5] At each guard post, FPS maintains a book, also referred to as post 
orders, that describes the duties that the guards are required to 
perform. 

[6] The level of security FPS provides at each of the 9,000 federal 
facilities varies depending on the building's security level. Based on 
the Department of Justice's (DOJ) 1995 Vulnerability Assessment 
Guidelines, there are five types of security levels. A level I facility 
is typically a small storefront-type operation such as military 
recruiting office which has 10 or fewer employees and a low volume of 
public contact. A level II facility has from 11 to 150 employees, a 
level III facility has from 151 to 450 federal employees and moderate 
to high volume of public contact, a level IV facility has over 450 
employees, a high volume of public contact, and includes high risk law 
enforcement and intelligence agencies. FPS does not have responsibility 
for a Level V facility which include the White House and the Central 
Intelligence Agency. The Interagency Security Committee has recently 
promulgated new security level standards that will supersede the 1995 
DOJ standards. 

[7] X-ray machines are hazardous because of the potential radiation 
exposure. 

[8] Under 18 U.S.C.  922, it is unlawful for anyone convicted of a 
misdemeanor crime of domestic violence to possess a firearm. 

[9] X-ray machines are hazardous because of the potential radiation 
exposure. In contrast, magnetometers do not emit radiation and are used 
to detect metal. 

[10] With this safety feature disabled, the x-ray machine's belt was 
operating continuously although the guard was not present. 

[11] [hyperlink, http://www.gao.gov/products/GAO-08-683]. 

[12] Tests that we performed at a national laboratory in July 2007 and 
in February 2006, clearly demonstrated that a terrorist using these 
devices could cause severe damage to a federal facility and threaten 
the safety of federal workers and the general public. Our investigators 
obtained the components for these devices at local stores and over the 
Internet for less than $150. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAOs actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAOs Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: