[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]
FACILITY PROTECTION: IMPLICATIONS OF THE NAVY YARD SHOOTING ON HOMELAND
SECURITY
=======================================================================
HEARING
before the
SUBCOMMITTEE ON OVERSIGHT
AND MANAGEMENT EFFICIENCY
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED THIRTEENTH CONGRESS
FIRST SESSION
__________
OCTOBER 30, 2013
__________
Serial No. 113-40
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC] [TIFF OMITTED] TONGRESS.#13
Available via the World Wide Web: http://www.gpo.gov/fdsys/
__________
U.S. GOVERNMENT PRINTING OFFICE
87-184 WASHINGTON : 2014
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, U.S. Government Printing Office. Phone 202�09512�091800, or 866�09512�091800 (toll-free). E-mail, [email protected].
COMMITTEE ON HOMELAND SECURITY
Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas Bennie G. Thompson, Mississippi
Peter T. King, New York Loretta Sanchez, California
Mike Rogers, Alabama Sheila Jackson Lee, Texas
Paul C. Broun, Georgia Yvette D. Clarke, New York
Candice S. Miller, Michigan, Vice Brian Higgins, New York
Chair Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania William R. Keating, Massachusetts
Jeff Duncan, South Carolina Ron Barber, Arizona
Tom Marino, Pennsylvania Dondald M. Payne, Jr., New Jersey
Jason Chaffetz, Utah Beto O'Rourke, Texas
Steven M. Palazzo, Mississippi Tulsi Gabbard, Hawaii
Lou Barletta, Pennsylvania Filemon Vela, Texas
Chris Stewart, Utah Steven A. Horsford, Nevada
Richard Hudson, North Carolina Eric Swalwell, California
Steve Daines, Montana
Susan W. Brooks, Indiana
Scott Perry, Pennsylvania
Mark Sanford, South Carolina
Greg Hill, Chief of Staff
Michael Geffroy, Deputy Chief of Staff/Chief Counsel
Michael S. Twinchek, Chief Clerk
I. Lanier Avant, Minority Staff Director
------
SUBCOMMITTEE ON OVERSIGHT AND MANAGEMENT EFFICIENCY
Jeff Duncan, South Carolina, Chairman
Paul C. Broun, Georgia Ron Barber, Arizona
Lou Barletta, Pennsylvania Donald M. Payne, Jr., New Jersey
Richard Hudson, North Carolina Beto O'Rourke, Texas
Steve Daines, Montana, Vice Chair Bennie G. Thompson, Mississippi
Michael T. McCaul, Texas (Ex (Ex Officio)
Officio)
Ryan Consaul, Subcommittee Staff Director
Deborah Jordan, Subcommittee Clerk
Tamla Scott, Minority Subcommittee Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable Jeff Duncan, a Representative in Congress From the
State of South Carolina, and Chairman, Subcommittee on
Oversight and Management Efficiency:
Oral Statement................................................. 1
Prepared Statement............................................. 3
The Honorable Beto O'Rourke, a Representative in Congress From
the State of Texas............................................. 4
The Honorable Ron Barber, a Representative in Congress From the
State of Arizona, and Ranking Member, Subcommittee on Oversight
and Management Efficiency:
Prepared Statement............................................. 5
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Ranking Member, Committee on
Homeland Security:
Prepared Statement............................................. 6
Witnesses
Mr. L. Eric Patterson, Director, Federal Protective Service, U.S.
Department of Homeland Security:
Oral Statement................................................. 8
Joint Prepared Statement....................................... 10
Mr. Greg Marshall, Chief Security Officer, U.S. Department of
Homeland Security:
Oral Statement................................................. 16
Prepared Statement............................................. 18
Mr. Caitlin Durkovich, Assistant Secretary, Infrastructure
Protection, U.S. Department of Homeland Security, Testifying on
Behalf of The Interagency Security Committee:
Oral Statement................................................. 20
Joint Prepared Statement....................................... 10
Mr. Mark L. Goldstein, Director, Physical Infrastructure Issues,
U.S. Government Accountability Office:
Oral Statement................................................. 22
Prepared Statement............................................. 24
Appendix
Question From Chairman Jeff Duncan for L. Eric Patterson......... 51
Questions From Ranking Member Ron Barber for L. Eric Patterson... 51
Questions From Chairman Jeff Duncan for Caitlin Durkovich........ 53
Question From Chairman Jeff Duncan for Greg Marshall............. 53
Questions From Ranking Member Ron Barber for Greg Marshall....... 54
Questions From Chairman Jeff Duncan for Mark L. Goldstein........ 55
Questions From Ranking Member Ron Barber for Mark L. Goldstein... 55
FACILITY PROTECTION: IMPLICATIONS OF THE NAVY YARD SHOOTING ON HOMELAND
SECURITY
----------
Wednesday, October 30, 2013
U.S. House of Representatives,
Subcommittee on Oversight and Management
Efficiency,
Committee on Homeland Security,
Washington, DC.
The subcommittee met, pursuant to call, at 9:32 a.m., in
Room 210, Cannon House Office Building, Hon. Jeff Duncan
[Chairman of the subcommittee] presiding.
Present: Representatives Duncan, Hudson, Barber, and
O'Rourke.
Also present: Representative Jackson Lee.
Mr. Duncan. All right. The House Committee on Homeland
Security, Subcommittee on Oversight and Management Efficiency
will come to order.
The purpose of this hearing is to examine what the
Department of Homeland Security is currently doing to protect
Federal facilities and what steps, if any, need to be taken to
improve current layers of security, so that incidents such as
the Navy Yard shooting do not occur in the future.
Now, this isn't our normal committee room, so we are going
to work through some things today, I am sure.
But I will now recognize myself for an opening statement.
The events that took place on September 16 at the
Washington Navy Yard, less than 2 miles from where we are right
now, were shocking and tragic. Twelve innocent lives were lost
that day, along with several injured. Our thoughts and prayers
go out to the families of the victims and those survivors and
the folks that work as co-workers in the Navy Yard.
While much of the security of this horrific event will
rightly focus on how someone in Aaron Alexis' mental state was
able to pass a Governmental background investigation and to
hold a security clearance, today's hearing will concentrate on
the physical preventative security measures that are currently
in place for our Federal facilities.
How do we control access to these facilities to protect
both employees and public visitors? What physical security
measures, if any, can be taken to prevent future tragedies?
The Federal Protective Service, or FPS, is charged with
protection of Federal facilities and safeguarding Federal
employees, contractors, and visitors within those facilities.
FPS is the primary agency for protecting and securing
almost 50 percent of the General Service Administration's, or
GSA's, owned or leased properties. That is about 9,600
facilities Nation-wide.
As the front-line personnel charged with the daily safety
of Federal employees and visitors, it is crucial that this
workforce is adequately trained and prepared to respond at
moment's notice.
I strongly support the public/private partnership model
that DHS uses with the contract guard force. Having private
guards can increase the accountability for the taxpayer, but
DHS cannot be deficient in its management responsibilities and
must deploy the right number of guards, based on risk.
Unfortunately, according to the Government Accountability
Office, or GAO, report that was released today, the Federal
Protective Service has many weaknesses with the oversight and
management of the guard program.
For example, FPS continues to lack effective management
controls to ensure that all guards have met their certification
and training requirements.
GAO has previously urged FPS to develop a management
control system to document and verify training in reports
submitted to Congress in 2010 and 2012, but FPS has yet to
implement this recommendation.
Without such a system, how can FPS know and ensure that its
guard force is sufficiently trained?
It seems common-sense to me that FPS should be able to
verify that its guards are trained and certified properly,
especially when others trust and rely on FPS guards for their
protection.
One of the most shocking findings in the most recent GAO
report is FPS' inadequate approach to active-shooter scenarios.
From the Holocaust Museum shooting in 2009 and the Navy
Yard shooting to the most recent Federal courthouse shooting in
Wheeling, West Virginia, in October, examples exist of the risk
FPS and facility guards must confront from active-shooter
scenarios. While FPS does require its guard force to receive
training on active-shooter situations, it is unclear how this
training is conducted and for what length of time.
GAO also noted that not all guards receive this training,
and, even for those that have, it is unclear how their contract
guards are expected to respond to an active shooter.
According to DHS, if an active shooter is not in a guard's
line of sight, that guard's actions are then dictated by his or
her post orders. So, does that mean that if an active shooter
is in the building, killing innocent people, an armed guard is
not allowed to assist until Federal or local law enforcement
arrive at the scene?
If this is the case, then DHS' bureaucratic process is
putting lives at risk.
The American people need to know how these guards can
protect them in life-threatening situations, and I am looking
forward to DHS providing clarity on this issue today.
As an additional layer of security, Federal employees are
required to carry valid identification credentials for
admittance into Federal facilities. As a Federal Government
contractor, Aaron Alexis had valid identification, which gave
him access to the Naval Sea Systems Command headquarters, and
that enabled him to pass through security.
While some buildings only require an ID to be used as a
flash pass or visually inspected, other facilities require
verification by use of a credential access control system, or
swiping of the card.
Although the second scenario may provide higher security
against individuals using fraudulent or expired and flagged
credentials, it was discouraging to learn from my staff that
DHS officials informed them that the department currently is
not aware of the type of access control systems in place across
DHS facilities.
How, after 10 years, does the Department not have a handle
on what measures are in place to secure their own employees,
let alone the general public, at Federal facilities?
I want to know precisely what DHS is doing to obtain this
information and when it will have a full and complete grasp of
the issue.
Considering the heinous events which took place just close
by at the Navy Yard, it is important to ensure that the
security framework in place at our Federal facilities is strong
and effective.
The Federal Protective Service and its contract guard force
put their lives on the line every day on a daily basis to
protect the American people, and I want to thank them for their
service and the tremendous amount of heroism that was exhibited
in the Navy Yard.
I hope this hearing can serve as an opportunity to assess
the state of physical security across Federal facilities and
what DHS must do to improve the protection of employees and
visitors to these facilities and prevent future tragedies as we
recently witnessed.
[The statement of Chairman Duncan follows:]
Statement of Chairman Jeff Duncan
October 30, 2013
The events that took place on September 16 at the Washington Navy
Yard--less than 2 miles from where we are right now--were shocking and
tragic. Twelve innocent lives were lost that day along with several
injured.
While much of the scrutiny of this horrific event will rightly
focus on how someone in Aaron Alexis's mental state was able to pass a
Government background investigation and to hold a security clearance,
today's hearing will concentrate on the physical preventative security
measures that are currently in place at our Federal facilities. How do
we control access to these facilities to protect employees and public
visitors? What physical security measures, if any, can be taken to
prevent future tragedies?
The Federal Protective Service (FPS) is charged with the protection
of Federal facilities and the safeguarding of Federal employees,
contractors, and visitors within those facilities. FPS is the primary
agency for protecting and securing almost 50% of the General Services
Administration's (GSA) owned or leased properties. That's about 9,600
facilities Nation-wide. As the front-line personnel charged with the
daily safety of Federal employees and visitors, it is crucial that this
workforce is adequately trained and prepared to respond at a moment's
notice.
I strongly support the public-private partnership model DHS uses
with the contract guard force. Having private guards can increase
accountability for the taxpayer but DHS cannot be deficient in its
management responsibilities and must deploy the right number of guards
based on risk.
Unfortunately, according to a Government Accountability Office
(GAO) report that was released today, the Federal Protective Service
has many weaknesses with the oversight and management of their guard
program. For example, FPS continues to lack effective management
controls to ensure that all guards have met their certification and
training requirements.
GAO has previously urged FPS to develop a management control system
to document and verify training in reports submitted to Congress in
2010 and 2012, but FPS has yet to implement this recommendation.
Without such a system, how can FPS know and ensure that its guard force
is sufficiently trained? It seems common-sense to me that FPS should be
able to verify that its guards are trained and certified properly--
especially when others trust and rely on FPS guards for their
protection.
One of the most shocking findings in this most recent GAO report is
FPS's inadequate approach to active-shooter scenarios. From the
Holocaust Museum shooting in 2009, and the Navy Yard shooting to the
most recent Federal courthouse shooting in Wheeling, West Virginia in
October, examples exist of the risks FPS and facility guards must
confront from active-shooter scenarios.
While FPS does require its guard force to receive training on
active-shooter situations, it is unclear how this training is conducted
and for what length of time. GAO also noted that not all guards
received this training, and even for those who have, it is unclear how
their contract guards are expected to respond to an active shooter.
According to DHS, if an active shooter is not in a guard's line of
sight, that guard's actions are then dictated by his or her post
orders. So does that mean that if an active shooter is in the building,
killing innocent people, an armed guard is not allowed to assist until
Federal or local law enforcement arrive at the scene? If this is the
case, then DHS's bureaucratic process is putting lives at risk. The
American people need to know how these guards can protect them in life-
threatening situations. I am looking forward to DHS providing clarity
on this issue today.
As an additional layer of security, Federal employees are required
to carry valid identification credentials for admittance into Federal
facilities. As a Federal Government contractor, Aaron Alexis had valid
identification which gave him access to the Naval Sea Systems Command
headquarters which enabled him to pass through security.
While some buildings only require an ID to be used as a ``flash
pass'' or visually inspected, other facilities require additional
verification by use of a credential access control system, or
``swiping'' of the card. Although the second scenario may provide
higher security against individuals using fraudulent or expired and
flagged credentials, it was discouraging to learn from my staff that
DHS officials informed them that the Department currently is not aware
of the type of access control systems in place across DHS facilities.
How, after 10 years, does the Department not have a handle on what
measures are in place to secure their own employees, let alone the
general public at Federal facilities? I want to know precisely what DHS
is doing to obtain this information and when it will have a full grasp
of this issue.
Considering the heinous events which took place at the Navy Yard,
it is important to ensure that the security framework in place at our
Federal facilities is strong and effective.
The Federal Protective Service and its contract guard force put
their lives on the line on a daily basis to protect the American
people, and I thank them for their service. I hope this hearing can
serve as an opportunity to assess the state of physical security across
Federal facilities and what DHS must do to improve protection of the
employees and visitors to these facilities and prevent future
tragedies.
Mr. Duncan. The Chairman will now recognize the Ranking
Member of the subcommittee, the gentleman from Texas who is
sitting in for the Ranking Member, Mr. Barber. But the
gentleman from Texas, Mr. O'Rourke, is recognized for an
opening statement.
Mr. O'Rourke. Thank you.
I want to thank Chairman Duncan for calling and organizing
today's hearing.
I want to thank the witnesses for their testimony, in
advance, and I want to thank them in advance for answering our
questions.
I want to thank the committee staff from both sides for
doing all the leg work to get us ready for today.
I also want to extend my condolences to the families and
survivors from those horrific events last month.
I know that any time there is a hearing like this or the
issue reappears in the news, that has to open up those memories
again, and must cause some additional pain and heartache for
those who are involved.
So I want to make sure that we use today's hearing to learn
what we can from what took place, and to apply those lessons to
ensuring or trying to ensure that we don't have a repeat of
this event at a Federal facility in the future.
I also want to make sure that we are proportionate in our
response to what we learn. As the Chairman said, we want to
have the right number of guards proportionate to the risk that
we understand to take place.
These are, after all, public buildings. We want to make
sure that we don't so fortify them that we exclude the public,
that we create an impression that the public is not welcome,
that we make it unduly difficult for people to access
Government, to receive the services that they are paying for.
They should have the right to expect to access.
I also hope that we will be able to explore the true cost
of contracting services, using contractors versus dedicated
civil servants or professionals who are in those jobs for their
careers. There is a balance that we have to strike in terms of
cost savings and efficiencies versus some level of
dependability and building a culture that might, in fact,
ultimately prevent these kinds of activities in the future.
I hope that, in closing, and I want to be brief because I
want to get to the testimony from our witnesses, I hope that we
use what we learn from horrific events like these--and
unfortunately there are far too many over the last few years--
to strike that right balance in all of those areas.
So I look forward to the testimony, to applying those
lessons, to the Chairman's leadership in making sure that we
strike that balance. With that, I will conclude and yield back
to the Chairman.
Mr. Duncan. I thank the gentleman from Texas.
Other Members of the subcommittee are reminded that opening
statements may be submitted for the record.
[The statements of Ranking Members Barber and Thompson
follow:]
Statement of Ranking Member Ron Barber
October 30, 2013
Thank you, Chairman Duncan, for holding this very important hearing
to examine how extensively standards for Federal facility security are
being followed to ensure the safety of Federal personnel and visitors
to these buildings.
Across the country, we are experiencing a rise in attempts by
individuals to shoot at or otherwise attack Federal facilities, and it
is both timely and critical that we hear today from Department
officials and other witnesses about the efficacy of the standards put
in place by the Interagency Security Committee to protect our people as
well Federal facilities.
In addition to my own personal experience as the unintended victim
of a shooting incident, we seem to get all-too-frequent news reports of
attempts by mentally unstable or disgruntled individuals who open fire
at Federal facilities.
I will be interested to hear today from the witnesses how effective
they think the Interagency Security Committee has been to date not only
in establishing a set of physical security standards, but also in
providing enough guidance to Federal agencies and departments to
increase their adoption of these standards.
It is not sufficient to issue standards--it is also incumbent upon
the Interagency Security Committee and the Federal Protective Service,
or FPS, as the implementing agency to make sure that Executive branch
agencies understand how the Government's standards for physical
security can best be utilized.
In the Government Accountability Office or GAO report issued at
Ranking Member Thompson's request in January, GAO states that the
Interagency Security Committee's standards are frequently the second
choice of Federal physical security managers after their own
institutional knowledge.
This is a troubling finding by GAO, and given the recent uptick in
attempted shootings at Federal facilities, it is incumbent upon all of
us to assist the Interagency Security Committee in strengthening its
outreach and guidance regarding its standards for the safety of all
Federal personnel and visitors.
In addition, GAO states in their testimony that Federal facility
security is further jeopardized by FPS' on-going mismanagement of its
contract guard force, and alarmingly, but the agency's failure to
ensure that its guards receive the required active-shooter response
training that would best prepare them to protect Federal facilities.
Further, GAO's testimony indicates that FPS and several other
Federal agencies are not currently using an appropriate methodology to
assess risk at Federal facilities which only increases the
vulnerability of those who work in or visit Federal buildings. I look
forward to hear the witnesses address these and other pertinent issues
related to Federal facility security.
______
Statement of Ranking Member Bennie G. Thompson
The purpose of this hearing is to review the security protocols in
place to safeguard Federal facilities and the Federal personnel who
work within them, and the visitors to those buildings. I am a long-
standing observer of the Federal Protective Service, or FPS, and at the
beginning of this Congress, I reintroduced my legislation, H.R. 735,
the Federal Protective Service Improvement and Accountability Act of
2013. My legislation seeks to move FPS away from its over-reliance on
contract security guards, and to instead build up the agency's internal
capacity.
Also, at my request, the Government Accountability Office has
produced 10 reports related to FPS, the most recent of which pertains
to today's topic of Federal facility security protocols and which was
released in January of this year. We are all cognizant of the recent
shooting at the Navy Yard on September 16, yet incidents of active
shooters who breach Federal facilities have become all too commonplace.
In my own home district of Jackson, Mississippi, a man was arrested
on October 2 for attempting to walk inside the Veterans Affairs
regional affairs office with a pistol and was then recommended to
undergo a psychiatric evaluation. Some other recent examples of
individuals who have attempted to open fire on Federal facilities
include a former police officer in Wheeling, West Virginia who fired
more than 20 shots at a Federal courthouse located there on October 8
of this year; on February 15, 2012, an ICE agent shot and killed one
colleague and wounded another in the Federal building in Long Beach,
California; and a bag containing an improvised explosive device, or
IED, was left undetected for several weeks inside the Federal building
in Detroit, Michigan in February 2011. An FPS contract guard brought
the bag inside the building and placed it under a screening console
where the IED remained in the bag until it was discovered 21 days
later.
Clearly, we must ensure that the personnel who oversee physical
security programs at our Federal facilities are adhering closely to the
uniform set of standards provided by the Interagency Security
Committee. In 1995, after the bombing of the Alfred P. Murrah Federal
building in Oklahoma City, President Bill Clinton signed Executive
Order 12977. As an outcome of Executive Order 12977, the Interagency
Security Committee was created to produce a coherent set of physical
security standards that can be tailored to meet the diverse needs of
Federal agencies and departments.
This hearing should allow us to determine how closely Federal
agencies and departments are complying with the Interagency Committee's
security protocols, and demonstrate what remaining outreach work DHS
must undertake to make sure that its physical security protocols are
being implemented and adhered to in the interest of National safety.
Mr. Duncan. We are pleased to have a distinguished panel of
witnesses before us today on this important topic. Let me
remind the witnesses that their entire written statement will
appear in the record.
I will introduce each of you first and then I will
recognize you individually for your testimony.
Members of the Committee may come and go today. There is a
lot going on on the Hill with mark-ups and other committee
hearings on a Wednesday morning. So Members may come and go as
the committee progresses.
So let me start off by introducing the witnesses. The first
one is Mr. L. Eric Patterson. Eric was appointed director of
the Federal Protective Service, a subcomponent of the National
Protection and Programs Directorate of the Department of
Homeland Security in September 2010.
Mr. Patterson previously served as deputy director of
defense, counterintelligence, and HUMINT center at the Defense
Intelligence Agency, DIA. Prior to joining DIA, Mr. Patterson
served as a principal with Booz Allen Hamilton, where he
supported two of the Defense Technical Information Center
analysis centers.
Mr. Patterson is a retired United States Air Force
brigadier general with 30 years of service.
Sir, thank you for your service to our great Nation.
Mr. Greg Marshall is the chief security officer for the
Department of Homeland Security. In this capacity, Mr. Marshall
is responsible for security-related issues effecting the
Department personnel security, physical security, special
security, special access programs, security training and
awareness.
Mr. Marshall began his Federal career as a police officer
with the United States Capitol Police in 1984 and later
transferred to the Howard County Maryland Police Department
where he retired in 2007.
He returned to Federal service when he joined DHS as deputy
chief of physical security and was later promoted deputy chief
security officer.
Ms. Caitlin Durkovich is the assistant secretary for
infrastructure protection at the Department for Homeland
Security. In this role, she leads the Department's efforts to
strengthen public-private partnerships and coordinate programs
to protect the Nation's critical infrastructure, assess and
mitigate risk, build resilience, and strengthen instant
response and recovery.
Previously, Ms. Durkovich served as the National Protection
and Program Directorate as chief of staff, overseeing day-to-
day management of the director and the development of internal
policies and strategic planning.
She is testifying on behalf of the inter-agency security
committee, a committee comprised of 53 representatives of
Federal agencies and departments with the mandate to enhance
the quality and effectiveness of physical security of Federal
buildings in the United States.
Last, Mr. Mark Goldstein is the director of physical
infrastructure issues at the GAO. Mr. Goldstein is responsible
for GAO's work in the areas of Government property, critical
infrastructure, and telecommunications.
Mr. Goldstein has held other public-sector positions
including serving as the deputy executive director and chief of
staff to the District of Columbia financial control board,
legislative adviser of the commissioner of internal revenue,
and a senior staff member of the United States Senate Committee
on Homeland Security and Governmental Affairs.
Prior to Government service, Mr. Goldstein was an
investigative journalist and author.
We can see that we have got a great panel here today and I
look forward to your testimony. So I want to thank you all for
being here. I now recognize Mr. Patterson for his opening
statement.
STATEMENT OF L. ERIC PATTERSON, DIRECTOR, FEDERAL PROTECTIVE
SERVICE, U.S. DEPARTMENT OF HOMELAND SECURITY
Mr. Patterson. Good morning, sir. Good morning and thank
you, Chairman Duncan and Congressman O'Rourke and the other
distinguished Members of the subcommittee.
My name is Eric Patterson and I am the director of the
Federal Protective Service within the National Protection and
Programs Directorate of the Department of Homeland Security. I
am honored to testify before this committee today regarding the
mission and operations of the Federal Protective Service.
In the United States, Government facilities remain a
potential target of attacks. FPS's mission is to protect over
9,000 Federal facilities and over 1.4 million occupants and
visitors.
To accomplish our mission, FPS inspectors and contract
protective security officers, referred to as PSOs, work in
tandem to attend to daily security needs at Federal facilities
and respond to threats directed against the facilities or the
Government personnel working within them.
PSOs are the eyes and ears of our organization. PSOs are
responsible for controlling access to Federal facilities,
detecting and reporting criminal acts, and responding to
emergency situations.
PSOs also ensure prohibited items such as firearms,
explosives, knives, and drugs do not enter Federal facilities.
In fact, FPS PSOs stop approximately 700,000 prohibited items
from entering Federal facilities annually.
All PSOs must undergo preliminary background investigation
checks to determine their fitness to begin work on behalf of
the Federal Government.
FPS partners with private-sector guard companies to ensure
that the guards have met the certification, training, and
qualification requirements specified in the contracts, covering
subject areas such as ethics, crime scene protection, actions
to take in special situations such as building evacuations,
safety in fire prevention, and public relations.
To ensure high performance of our contractor PSO force, FPS
law enforcement personnel conduct PSO post-inspections and
integrate covert test activities to monitor vendor compliance
and countermeasure effectiveness. Additionally, vendor files
are audited periodically to validate the PSO certifications and
training records reflect compliance with contract requirements.
In fiscal year 2013 alone, FPS conducted 54,000 post
inspections and 17,000 PSO personnel file audits.
As Members of the committee may be aware, the GAO has in
the past raised some concerns regarding FPS's handling of PSO
training and oversight. FPS has taken significant steps to
improve oversight of PSO contracts.
For example, FPS is currently hiring 39 additional contract
officer representatives in order to improve oversight of vendor
contract compliance. FPS has also drafted and is vetting an
enhanced policy for FPS PSO contract performance monitoring and
oversight.
Due in part to these actions, FPS has made significant
progress toward closing GAO and OIG recommendations pertaining
to our oversight.
FPS also directly employs 1,000 Federal law enforcement
personnel who perform a variety of critical functions,
including PSO oversight, facility security assessments, and
uniformed police response.
To assist our law enforcement personnel in performing
oversight of PSO posts, FPS has partnered with DHS Science and
Technology to develop a near-term, real-time post-tracking
system, also referred to as PTS, which will facilitate the
identification of the most effective and efficient solutions
for managing our guard force.
One of the most important responsibilities of FPS law
enforcement personnel is conducting facility security
assessments, also referred to as FSAs. FSAs document security-
related risk to a facility and provide a record of
countermeasure recommendations designed to enable tenant
agencies to meet inter-agency security committee standards for
Federal facility security.
Specifically, FPS conducts multiple interviews and in-depth
research to support the accomplishment of facility-specific
threat assessments. These assessments are an integral first
step in establishing the foundation for the risk framework.
FPS collaboration with private sector and Government
stakeholders is critical to the successful implementation and
characterization of a risk-management framework for each unique
facility.
Finally, FPS officers respond to tens of thousands of calls
for service annually, which entail responding to criminal
activity in progress, to protect life and property, and to
respond to National security events or to support other law
enforcement responding to a critical situation, as was in the
case at the Navy Yard on September 16, 2013.
With regard to responding to an active-shooting incident, I
would like to take this opportunity to note that FPS does
administer an active-shooter tenant awareness training program
and has provided training to more than 3,300 Federal facility
tenants. Additionally, while FPS PSOs are not sworn Federal law
enforcement officers and are statutorily limited in the scope
of actions that they can take during an active-shooter
incident, FPS does provide them instruction regarding actions
to take in special situations such as a building fire or report
of workplace violence or other emergency situations or
evacuations.
In closing, I would like to acknowledge and thank our
partners, especially members of the law enforcement community,
who responded the day of the Navy Yard shooting. The events of
September 16 were both a testament to their dedication and
training, and a stark reminder of the critical importance of
the mission of the Department of Homeland Security and the
Federal Protective Service.
The Federal Protective Service remains committed to
providing safety, security, protection, and a sense of well-
being to thousands of Federal employees, citizens, and visitors
who work and conduct business in our Federal facilities daily.
Thank you again for the opportunity to testify before this
committee, and I will be pleased to answer any questions you
may have.
[The joint prepared statement of Mr. Patterson and Ms.
Durkovich follows:]
Joint Prepared Statement of Leonard E. Patterson and Caitlin Durkovich
October 30, 2013
Thank you Chairman Duncan, Ranking Member Barber, and the
distinguished Members of the subcommittee. We are pleased to appear
before the committee today to discuss the efforts by the National
Protection and Programs Directorate (NPPD) to increase security and
resilience at our Nation's Federal facilities. The men and women
serving in NPPD have wide-ranging responsibilities, from serving on the
front lines of law enforcement to developing standards with
stakeholders to conducting training Nation-wide. NPPD works with owners
and operators, public safety, and countless others daily to keep the
Nation secure. These efforts prepare our partners for steady state and
day-to-day activity, but also for large-scale and complex incidents.
NPPD builds capabilities among our stakeholders and enhances
coordination and planning efforts, so when an incident occurs, our
employees and stakeholders are prepared to respond and mitigate future
incidents.
In addition to working with public and private-sector partners to
enhancing security across the sectors, NPPD provides daily protection
at Federal facilities through the Federal Protective Service (FPS),
protecting more than 1.4 million tenants and visitors in the
facilities, on the grounds, and on property owned, occupied, or secured
by the Federal Government. Across the country FPS provides law
enforcement and security management services, which include operations
and oversight of approximately 12,000 contract Protective Security
Officers (PSO), and security countermeasure services for more than
9,000 General Services Administration-owned, -leased, or -operated
facilities located across the country and other Federal facilities.
ENSURING THE SECURITY AND RESILIENCE OF CRITICAL INFRASTRUCTURE
Within NPPD, the Office of Infrastructure Protection (IP) works
with public and private-sector partners to increase the security and
resilience of critical infrastructure and protect the individuals
relying on infrastructure. This includes programs to support critical
infrastructure owners and operators in enhancing their facilities'
security and resilience and coordinating critical infrastructure
sectors.
IP is responsible for overall coordination of the Nation's critical
infrastructure security and resilience efforts, including development
and implementation of the National Infrastructure Protection Plan
(NIPP). The NIPP establishes the framework for integrating the Nation's
various critical infrastructure security and resilience initiatives
into a coordinated effort. The NIPP provides the structure through
which the Department of Homeland Security (DHS), in partnership with
Government and industry, implements programs and activities to protect
critical infrastructure, promote National preparedness, and enhance
incident response. The NIPP is regularly updated to capture evolution
in the critical infrastructure risk environment, and DHS is currently
updating the NIPP based on requirements set forth in Presidential
Policy Directive (PPD) 21.\1\
---------------------------------------------------------------------------
\1\ In February 2013, President Obama issued Presidential Policy
Directive (PPD) 21 on Critical Infrastructure Security and Resilience.
PPD-21 advances a National unity of effort to strengthen and maintain
secure, functioning, and resilient critical infrastructure. One of the
requirements set forth in the policy was for DHS to update the NIPP.
---------------------------------------------------------------------------
IP conducts on-site risk assessments of critical infrastructure and
shares risk and threat information with State, local, and private-
sector partners. In addition to helping critical infrastructure owners
and operators become more aware of the risks, hazards, and mitigation
strategies, we're also helping them measure and compare their levels of
security and resilience and how they can improve. In the last year, we
conducted more than 900 vulnerability assessments and security surveys
on critical infrastructure to identify potential gaps and provide the
owners and operators with options to mitigate those gaps and strengthen
security and resilience. In addition to serving owners and operators
and Government officials directly, IP supports the development of
standards, reports, guidelines, and best practices for civilian Federal
facilities through the Interagency Security Committee (ISC).
Interagency Security Committee
The mission of the ISC is to safeguard U.S. civilian facilities
from all hazards by developing state-of-the-art security standards in
collaboration with public and private homeland security partners. The
ISC was created following the bombing of the Alfred P. Murrah Federal
Building in Oklahoma City on April 19, 1995--the deadliest attack on
U.S. soil before September 11, 2001 and the worst domestic-based
terrorist attack in U.S. history. Following the attack, Executive Order
12977 created the ISC to address ``continuing Government-wide
security'' for Federal facilities in the United States.
ISC standards apply to all civilian Federal facilities in the
United States. These include facilities that are Government-owned, -
leased, or -managed, to be constructed or modernized, or to be
purchased, accounting for more than 399,000 Federally-owned and -leased
assets and over 3.35 billion square feet Nation-wide.\2\ The ISC is
truly an interagency body exhibiting collaboration and communication
between 53 Federal agencies and departments.\3\ When agencies cannot
solve security-related problems on their own, the ISC brings chief
security officers and senior executives together to solve continuing
Government-wide security concerns. The ISC is responsible for the
creation and implementation of numerous standards, guidelines, and best
practices for the protection of over 300,000 nonmilitary Federal
facilities across the country. This work is based on real-world,
present-day conditions and challenges and allows for cost savings by
focusing on specific security needs of the agencies.
---------------------------------------------------------------------------
\2\ The Federal Real Property Council's Fiscal Year 2010 Federal
Real Property Report, An Overview of the U.S. Federal Government's Real
Property Assets.
\3\ Additional information on ISC membership is located in the
Appendix.
---------------------------------------------------------------------------
The ISC is a permanent body with appointed members who often serve
multi-year terms. Several have represented their organizations for more
than a decade. Leadership of the ISC is provided by the assistant
secretary for infrastructure protection, an executive director, as well
as 8 standing subcommittees: Steering, Standards, Technology,
Convergence, Training, Countermeasures, Design-Basis Threat, and the
Chair Roundtable.
FPS is an active participant in the work of the ISC, helping shape
standards, guidance, and best practices that enable FPS employees to
perform their protection mission with consistency and efficiency. FPS
sits on the ISC Steering committee, chairs the Training subcommittee,
and has representatives on a number of other ISC committees and working
groups, including the Design Basis Threat group, the Countermeasures
subcommittee, and others. FPS chaired the working group that authored a
``Best Practices for Federal Mobile Workplace Security'' document in
2013 that is currently under review, and is also on the Active Shooter-
Prevention and Response as well as the PPD-21 and Compliance working
groups that are currently meeting. In recent years, FPS has also co-
chaired the working groups that produced the Items Prohibited from
Federal Facilities: An ISC Standard and Best Practices for Armed
Security Officers in Federal Facilities, 2nd Edition documents. FPS
also serves as the Sector-Specific Agency for the Government Facilities
Sector. In this role FPS is responsible for working with various
partners--including other Federal agencies; State, local, Tribal, and
territorial governments as well as other sectors--to develop and
implement the Government facilities sector-specific plan.
Standards and Best Practices for Secure Facilities
The ISC issues standards, reports, guidelines, and best practices
to protect approximately 1.2 million Federally-owned buildings,
structures, and land parcels more than 2.5 million tenant employees,
and millions of visitors each day from harm. The documents developed by
the ISC affect all civilian Federal facilities--Government-owned, -
leased, to be constructed, modernized, or purchased.
Examples of ISC Standards and Guidelines
The Risk Management Process for Federal Facilities
Standard.--Issued August 2013, this ISC Standard defines the
criteria and processes that those responsible for the security
of a facility should use to determine its facility security
level and provides an integrated, single source of physical
security countermeasures for all non-military Federal
facilities. The Standard also provides guidance for
customization of the countermeasures for Federal facilities and
encompasses the following documents:
(1) Facility Security Level Determinations (FSL)--2008;
(2) Physical Security Criteria for Federal Facilities--2010;
(3) Design Basis Threat--2013;
(4) Facility Security Committees--2012;
(5) Use of Physical Security Performance Measures--2009;
(6) Child-Care Centers--Level of Protection Template--2010.
Violence in the Federal Workplace: A Guide for Prevention
and Response.--Issued April 2013, these Government-wide
procedures for threat assessment, intervention, and response to
incidents of workplace violence were developed by the ISC, in
conjunction with the Chief Human Capital Officers Council and
the National Institutes of Occupational Safety and Health.
Occupant Emergency Programs: An ISC Guide.--Issued March
2013, this guidance outlines the components of an Occupant
Emergency Program, including those items that comprise an
emergency plan, and defines the basic guidelines/procedures to
be used for establishing and implementing an effective occupant
emergency program.
Items Prohibited From Federal Facilities: An ISC Standard.--
Issued February 2013, this standard establishes a guide-line
process for detailing control of prohibited items into Federal
facilities, and identifies responsibilities for denying entry
to those individuals who attempt to enter with such items.
Best Practices for Armed Security Officers in Federal
Facilities, 2nd Edition.--Issued February 2013, this best
practice recommends a set of minimum standards to be applied to
all contract armed security officers working in Federal
facilities.
Security Specialist Competencies: An ISC Guideline.--Issued
January 2012, this document provides the range of core
competencies Federal Security Specialists should possess to
perform their basic duties and responsibilities.
Best Practices for Mail Screening and Handling.--Issued
September 2011, this joint ISC-Department of Defense Combating
Terrorism Technical Support Office/Technical Support Working
Group (CTTSO/TSWG) document provides mail center managers,
supervisors, and security personnel with a framework for
mitigating risks posed by mail and packages.
The ISC continues to identify new initiatives based on current and
emerging threats as well as revise policies which may become outdated.
Currently the ISC is working on several new initiatives:
Active Shooter--Prevention and Response.--Streamlining
existing Federal guidance and ISC policy on Active Shooter into
one cohesive guidance document that agencies housed in non-
military Federal facilities can use as a reference to enhance
preparedness for an active-shooter incident.
Facility Security Plan.--Utilizing the ISC's Risk Management
Process to develop guidance agencies can use to develop a
Facility Security Plan.
Security Office Staffing.--Establishing criteria and
policies which will inform agencies' staffing of Security
Offices.
Resource Management.--Developing guidance to help agencies
make the most effective use of resources available for physical
security across their portfolio of facilities and examine the
use of organizational practices for resource management
purposes.
Presidential Policy Directive 21 and Compliance.--Developing
security criteria for critical infrastructure supporting
mission-essential functions to account for PPD-21 requirements
and to create a strategy for compliance.
Best Practices for Federal Mobile Workplace Security.--
Analyzing the future impact on physical and cybersecurity
policy and practices.
Threats to our critical infrastructure, including Federal
facilities, are wide-ranging. Not only are there terrorist threats,
like the bombing at the Boston Marathon this past spring, but threats
from weather-related events, such as Hurricane Sandy, as well as
threats to our cyber infrastructure which may have a direct impact on
the security of our Federal buildings. While it's impossible to
anticipate every threat, NPPD is taking a holistic approach to create a
more resilient infrastructure environment to better handle these
challenges, and the work of the ISC exemplifies these efforts. Ensuring
our Federal facilities are secure and resilient is a large challenge,
but by providing our partners with standards and best practices, law
enforcement agencies serving at Federal facilities every day, like the
Federal Protective Service, have the tools and resources necessary to
mitigate threats.
Active-Shooter Preparedness
Recent events have demonstrated the need to identify measures that
can be taken to reduce the risk of mass casualty shootings, improve
preparedness, and expand and strengthen on-going efforts intended to
prevent future incidents. DHS aims to enhance preparedness through a
``whole community'' approach by providing training, products, and
resources to a broad range of stakeholders on issues such as active-
shooter awareness, incident response, and workplace violence.
FPS has developed an Active-Shooter Tenant Awareness training
program and has provided this training to more than 3,300 Federal
facility tenants so they may be better equipped to analyze a potential
situation and work through concerns, actions, and decisions. In
addition, more than 1,000 FPS law enforcement officers and agents have
been trained in ``Active-Shooter Response Tactics.'' To date, over
9,700 individuals have viewed DHS's active-shooter webinar, over 7,300
attendees have participated in over 100 active-shooter workshops and
exercises Nation-wide, and over 263,400 Americans have taken DHS's
``Active Shooter: What You Can Do'' course. Each workshop allows
participants to ``live'' an emergency incident and analyze the
situation to work through concerns, actions, and decisions. DHS also
launched an active-shooter webpage in January 2013, which includes
active-shooter training resources for Federal, State, and local
partners, as well as the public. Since its launch, the page has been
accessed more than 258,000 times. In addition to the training FPS
provides to tenants, FPS's PSOs receive instruction regarding actions
to take in special situations, such as a building fire, a report of an
active shooter or workplace violence, and other emergency situations or
evacuations.
ENSURING THE SECURITY AND RESILIENCE OF FEDERAL FACILITIES
In the United States Government facilities remain a potential
target of attacks. The NPPD FPS mission is to protect Federal
facilities and their occupants and visitors by providing superior law
enforcement and protective security services, leveraging the
intelligence and information resources of its network of Federal,
State, local, Tribal, territorial, and private-sector partners. To
accomplish our mission and help prevent incidents like the Navy Yard
tragedy from occurring at FPS-protected Federal facilities, our
inspectors and PSOs work in tandem to attend to daily security needs at
Federal facilities, assess individual Federal facilities'
vulnerabilities to both natural and man-made events, and effectively
respond to security-related activities and threats directed against the
facilities or the Government personnel working within them.
In performing the mission of protecting Federal facilities and
persons thereon, we rely on our law enforcement and security
authorities found at 40 U.S.C. 1315; our ability to enter into
agreements with State, local, and Tribal law enforcement agencies for
purposes of protecting Federal property; the enforcement of Federal
Management Regulation sections pertinent to conduct on Federal property
under 41 C.F.R., Part 102-74 Subpart C; and our responsibility as a
recognized ``first responder'' for all crimes and suspicious
circumstances occurring at GSA-owned or -leased property.
FPS OPERATIONS
FPS contracted PSOs are the eyes and ears of our organization. PSOs
are responsible for controlling access to Federal facilities,
conducting screening at access points to Federal facilities, enforcing
property rules and regulations, detecting and reporting criminal acts,
and responding to emergency situations involving facility safety and
security. PSOs also ensure prohibited items, such as firearms,
explosives, knives, and drugs, do not enter Federal facilities. In
fact, FPS PSOs stop approximately 700,000 prohibited items from
entering Federal facilities annually.
Suitability
All PSOs must undergo preliminary background investigation checks
to determine their fitness to begin work on behalf of the Government.
At FPS, preliminary checks consist of a review of the applicant's
background investigation questionnaire form as well as automated record
checks with the FBI, National Crime Information Center, credit
reporting bureaus, and naturalization/citizenship checks, when
applicable. If derogatory information cannot be mitigated to allow for
a favorable preliminary decision, the background investigation must be
completed and favorably adjudicated prior to ``Entry On Duty''
approval. For PSOs serving in Federal facilities requiring a high-level
security clearance, DHS uses the Defense Security Service to adjudicate
background investigations.
Training
FPS partners with private-sector guard companies to ensure that
PSOs are prepared to accomplish their duties. FPS works with the guard
companies to ensure the guards have met the certification, training,
and qualification requirements specified in the contracts, covering
subject areas such as ethics, crime scene protection, actions to take
in special situations such as building evacuations, safety and fire
prevention, and public relations. Courses are taught by FPS, by the
contract guard company, or by a qualified third party such as the
American Red Cross for CPR. PSOs also receive instruction in areas such
as X-Ray and magnetometer equipment, firearms training and
qualification, baton qualification, and First-Aid certification. PSOs
are required to attend refresher training and they must recertify in
weapons qualifications in accordance with Federal and State
regulations.
The FPS training team is working closely with industry and Federal
partners in an effort to further standardize the PSO training screening
station-related training. For example, our trainers work with the U.S.
Marshals Service and Transportation Security Administration trainers to
incorporate best practices into the base X-Ray, Magnetometer, and Hand-
Held Metal Detector training. Additionally, FPS is working closely with
the National Association of Security Companies to develop a National
Lesson Plan for PSOs that will establish a basic and National training
program for all PSOs; this is important to ensure standards are
consistent across the Nation. These efforts will further standardize
training PSOs receive and will provide for a great capability to
validate training and facilitate rapid adjustments to training to
account for changes in threat and technological advancements.
Oversight
FPS is committed to ensuring high performance of its contracted PSO
workforce. FPS Law Enforcement personnel conduct PSO post inspections
and integrated covert test activities to monitor vendor compliance and
countermeasure effectiveness. Additionally, vendor files are audited
periodically to validate that PSO certifications and training records
reflect compliance with contract requirements. In fiscal year 2013, FPS
conducted 54,830 PSO post inspections and 17,500 PSO personnel file
audits.
In addition, and in accordance with procurement regulation and
policy, contract deficiencies and performance issues are documented in
the annual Contractor Performance Assessment Report. FPS Headquarters
and regional leadership are provided with regular reports to maintain
visibility on the status of these important assessments that are also
used by agency source selection officials in the procurement process
when awarding new PSO contracts.
As Members of the committee may be aware, the GAO has, in the past,
raised some concerns regarding FPS's handling of PSO training and
oversight. FPS has taken significant steps to improve oversight of PSO
contracts. For example, FPS is currently hiring 39 additional
Contracting Officer Representatives in order to improve oversight of
vendor contract compliance. FPS has also drafted and implemented an
enhanced policy for FPS PSO performance monitoring, security force
management, and contractor management functions. Among other
improvements, this standardizes Nationally the methods and frequencies
of PSO post inspections and audits of contractor files.
Due in part to these actions, FPS has made significant progress
toward closing GAO and OIG recommendations pertaining to oversight.
Since 2011, FPS has successfully closed 13 GAO and 4 OIG
recommendations and has submitted closure documentation for 9
additional recommendations. Of these, 2 were successfully closed and 7
are pending GAO's internal review for closure.
LAW ENFORCEMENT PERSONNEL
FPS also directly employs over 1,000 Federal Law Enforcement
Personnel who are trained physical security experts. Law Enforcement
Personnel perform a variety of critical functions, including conducting
comprehensive security assessments of vulnerabilities at facilities,
developing and implementing protective countermeasures, and providing
uniformed police response and investigative follow-up. As previously
noted, Law Enforcement Personnel also conduct PSO guard post
inspections on a daily basis as well as Operation Shield activities,
which involve deployments of a highly visible array of law enforcement
personnel to validate and augment the effectiveness of FPS
countermeasures across the protective inventory.\4\
---------------------------------------------------------------------------
\4\ This includes providing highly-visible law enforcement presence
to disrupt terrorist/criminal activity, expand patrol and response
operations through increased coverage, demonstrate FPS's commitment to
employing the highest standards for the security of Federal facilities
and the safety of their occupants; and collect and assimilate data to
continually assess and improve FPS's ability to achieve its core
mission--to secure facilities and safeguard occupants.
---------------------------------------------------------------------------
Facility Security Assessments
One of the most important responsibilities of FPS Law Enforcement
Personnel is conducting Facility Security Assessments (FSAs) at FPS-
protected facilities Nation-wide. FSAs document security-related risks
to a facility and provide a record of countermeasure recommendations.
The process analyzes potential threats toward a facility through a
variety of research sources and information. Upon identification of the
threats, the process identifies and analyzes vulnerabilities to a
particular facility utilizing Protective Measure Indices (PMI).
Assessors utilize the Modified Infrastructure Survey Tool (MIST) to
document the existing protective posture at a facility and compares how
a facility is, or is not, meeting the baseline level of protection for
its FSL as set forth in the ISC's Physical Security Criteria for
Federal Facilities standard and the ISC's Design Basis Threat report.
MIST also compares the disparities identified against the baseline
level of protection specified in the ISC standards, thereby
operationalizing those standards, and enabling mitigation of the
vulnerabilities identified. The FSA report is a historical record and
informative report provided to FPS stakeholders to support their
decision making in risk mitigation strategies.
FSAs require collaboration between FPS private-sector stakeholders
and Government stakeholders. Collaboration between these entities is
critical to successful implementation of a risk management framework.
FPS partners with all of the stakeholders to identify and gather all
necessary information for characterizing the risks to each unique
facility. FSA is accomplished on a recurring schedule broken down by
FSL.
Law Enforcement Response
FPS officers respond to tens of thousands of calls for service
annually, some of which entail responding to criminal activity in
progress, others to protect life and property, and still others to
respond to National security events or to support other law enforcement
responding to a critical situation, as was the case in the Navy Yard
complex on September 16, 2013. In this case, FPS responded to the on-
scene Navy Yard Unified Command center in a supporting role and
deployed six K9 Explosive Detection Dog teams to be staged at the Navy
Yard and sweep the Nationals Park parking lot in response to mutual-aid
calls from the District of Columbia Metropolitan Police Department and
the FBI. Additionally, given the proximity of the FPS-protected U.S.
Department of Transportation (DOT) building to the Navy Yard complex,
FPS deployed to the DOT building, coordinated a Shelter-in-Place for
all occupants, established a secure perimeter around the building,
conducted K9 sweeps around the perimeter, and increased uniformed
patrol activities at other FPS-protected Federal facilities located
within the southeast corridor of the District of Columbia.
COMMITMENT TO SECURING FEDERAL FACILITIES
In closing, we would like to acknowledge and thank our partners in
both the public and private sector, especially members of the law
enforcement community who responded the day of the Navy Yard shooting.
We are grateful for their continued service. The shooting at the Navy
Yard on September 16 provided a reminder of the need to ensure our
infrastructure is secure and resilient so we can protect our
communities, regardless of the threat. We must maintain our
partnerships and continue to seek new opportunities to enhance the
security and resiliency of our Nation while providing our first
responders with the resources and tools they need.
DHS is committed to ensuring our Federal facilities remain safe and
secure for employees and visitors. Our employees will continue serving
on the front lines at Federal facilities and working behind the scenes
to develop standards and supporting law enforcement efforts. Thank you
again for the opportunity to testify before this committee. We look
forward to answering any questions you may have.
Appendix.--Interagency Security Committee Membership
Membership in the ISC consists of over 100 senior-level executives
from 53 Federal agencies and departments. In accordance with Executive
Order 12977, modified by Executive Order 13286, primary members
represent 21 Federal agencies. Associate membership is determined at
the discretion of the ISC Steering Committee and the ISC Chair.
Currently, associate members represent 32 Federal departments.
Primary Members (21)
(1) Assistant to the President for National Security Affairs
(2) Central Intelligence Agency
(3) Department of Agriculture
(4) Department of Commerce
(5) Department of Defense
(6) Department of Education
(7) Department of Energy
(8) Department of Health and Human Services
(9) Department of Homeland Security
(10) Department of Housing and Urban Development
(11) Department of the Interior
(12) Department of Justice
(13) Department of Labor
(14) Department of State
(15) Department of Transportation
(16) Department of the Treasury
(17) Department of Veterans Affairs
(18) Environmental Protection Agency
(19) General Services Administration
(20) Office of Management and Budget
(21) U.S. Marshals Service
Associate Members (32)
(1) Commodity Futures Trading Commission
(2) Court Services and Offender Supervision Agency
(3) Federal Aviation Administration
(4) Federal Bureau of Investigation
(5) Federal Communications Commission
(6) Federal Deposit Insurance Corporation
(7) Federal Emergency Management Agency
(8) Federal Protective Service
(9) Federal Reserve Board
(10) Federal Trade Commission
(11) Government Accountability Office
(12) Internal Revenue Service
(13) National Aeronautics & Space Administration
(14) National Archives & Records Administration
(15) National Capital Planning Commission
(16) National Institute of Building Sciences
(17) National Institute of Standards & Technology
(18) National Labor Relations Board
(19) National Science Foundation
(20) Nuclear Regulatory Commission
(21) Office of the Director of International Intelligence
(22) Office of Personnel Management
(23) Office of the U.S. Trade Representative
(24) Securities and Exchange Commission
(25) Smithsonian Institution
(26) Social Security Administration
(27) U.S. Army Corps of Engineers
(28) U.S. Capitol Police
(29) U.S. Coast Guard
(30) U.S. Courts
(31) U.S. Institute of Peace
(32) U.S. Postal Service
Mr. Duncan. Thank you.
The Chairman will now recognize Mr. Marshall to testify.
STATEMENT OF GREG MARSHALL, CHIEF SECURITY OFFICER, U.S.
DEPARTMENT OF HOMELAND SECURITY
Mr. Marshall. Chairman Duncan, Congressman O'Rourke,
Members of the committee, good morning and thank you for the
opportunity to provide testimony on access control for Federal
facilities.
I am Greg Marshall, the chief security officer for the U.S.
Department of Homeland Security. I am a career official with
nearly 30 years of law enforcement experience. The mission of
my office is to safeguard the Department's people, property,
and information. Accordingly, I am responsible, often in
partnership with my colleagues at the Federal Protective
Service, for security-related issues affecting more than
235,000 DHS employees that comprise the Department.
The security oversight and guidance authority of my office
applies across the Department. However, operational components
play a significant role in managing the facilities which they
inhabit, including access. The diverse missions and
responsibilities of the Department and the facilities used to
meet these missions underscore the challenges involved with the
physical security and access control disciplines.
The tragic events of Monday, September 16 at the Navy Yard
have placed the issue of physical security, access control, and
personnel vetting front and center in the minds of security
professionals across the Federal landscape. I need to make
clear, however, that security aims to manage risk, not
eliminate it. Our job is to do everything we can to keep our
employees safe, and in doing so we have the benefit of policies
and procedures and processes and technologies, both proven and
emerging, to help guide and improve our security programs.
When we consider the security for a Federal facility,
including access control, we follow the interagency security
community standards. Facilities are assessed for risk and
appropriate countermeasures are employed. The outcome of these
risk assessments drives the level of protection, to include an
appropriate access control posture. A one-size security
solution, however, cannot and will not fit all.
For employees to qualify for access to facilities, they
must undergo a background investigation to establish
suitability or fitness for employment. These investigations are
for the most part conducted by OPM. Contractors are screened in
a similar process to determine fitness for work on a DHS
contract and to also have facility access. Background
investigations for suitability and fitness examine character
and conduct, past conduct. Based upon all available
information, we make an adjudicative decision concerning a
person's suitability or fitness for employment or access to
classified information.
It is important to note that any background investigation,
no matter how rigorous, is no guarantee that all relevant
information is known, available, or has been included in the
investigation. Also, a background investigation may not
reliably predict future behavior. A background investigation is
an exercise in risk management, establishing some basic facts,
but cannot guarantee any individual's continuing fitness to
carry out their duties or to behave in a lawful or safe manner.
Recent improvements in our ability to manage these
incidents--these inherent risks and incidents include Homeland
Security Presidential Directive 12, which mandated a
Government-wide standard for secure and reliable credential to
be used when accessing Federal facilities. This credential,
also known as a PIV card, represents a marked improvement over
legacy identity cards. The background investigation process
itself is undergoing major Government-wide reform with phased
implementation to begin this fiscal year.
The concept of continuous evaluation has been developed to
supplement normal reinvestigation reviews with a process that
examines conduct between the reinvestigation time frames.
Relevant security information, like a recent arrest, would
become available in near-real time, helping to ensure that
Classified information and/or Federal facilities are
appropriately safeguarded.
Finally, this administration's recent information sharing
and safeguarding initiative, also known as ``insider threat,''
seeks to complement background investigations and continuous
evaluation with continuous monitoring. This program will
incorporate and analyze data in near-real time from a much
broader set of sources. Its focus is the protection of
Classified information, but its applicability to suitability
and contractor fitness is evident.
To conclude, suitability determinations and access control
to Federal facilities remains a work in progress, but is
evolving toward dramatic improvement. We have made great
progress, but managing employee and facility risks will
continue to be a challenge.
Thank you again for the opportunity to testify today.
[The prepared statement of Mr. Marshall follows:]
Prepared Statement of Gregory Marshall
October 30, 2013
Chairman Duncan, Ranking Member Barber, Members of the committee,
good morning and thank you for the opportunity to provide testimony on
access control for Federal facilities.
I am Greg Marshall, chief security officer of the U.S. Department
of Homeland Security (DHS). I lead the dedicated men and women who make
up the Office of the Chief Security Officer. My office is an element of
the Department's Management Directorate, and I report to the under
secretary for management.
The mission of our office is to safeguard the Department's people,
property, information, and systems. Accordingly, the DHS chief security
officer, often in partnership with the Federal Protective Service, is
responsible for security-related issues affecting the more than 240,000
DHS employees that compose the Department. I exercise DHS-wide security
program authorities in the areas of personnel security, physical
security, administrative security, special security, identity
management, special access programs, and security training and
awareness. I also support the chief information officer in the area of
IT security policy and the under secretary for intelligence and
analysis in the protection of intelligence sources and methods, and
accreditations of Classified facilities.
The security oversight and guidance authority of my office applies
across the Department. However, Operational components play a
significant role in managing the facilities which they inhabit,
including access to those facilities. The diverse missions and
responsibilities of the Department underscore the challenges involved
within the physical security and access control disciplines.
The tragic events of Monday, September 16 at the Washington Navy
Yard have placed the issue of physical security, access control, and
personnel vetting front and center in the minds of security
professionals across the Federal landscape.
Shortly after the Navy yard incident, I convened a meeting of the
Department's Chief Security Officer Council. Each component Chief
Security Officer (CSO) acknowledged the significance of the Navy Yard
tragedy to access control and the underlying vetting processes and each
CSO commented on the complexities of vetting and access, including the
costs involved. With this in mind, the Department remains committed to
ensuring that only those persons with a legitimate need to access any
given facility are allowed to enter, that those persons possess no
prohibited items, and that the backgrounds of those persons who do
enter have been vetted to an appropriate level of rigor.
I would make clear, however, that security involves risk
management. Our job is to do everything we can to reduce the risk and
keep our employees safe. In pursuit of our mission, please be assured
that DHS security leadership and the professionals we manage have the
benefit of extensive knowledge, training, and experience. We also have
the benefit of comprehensive policies, procedures, processes, and
emerging technologies to help guide and improve our key security
programs.
For example, when we consider the security posture for a Federal
facility, including access control, we at DHS follow Interagency
Security Committee standards. During this process, facilities are
assessed for risk, and appropriate countermeasures are employed to
mitigate the risks. Using a decision matrix involving mission
criticality, the sensitivity of the activities conducted, threats to
the facility, facility population of persons who work and visit there,
and other factors, an appropriate Federal Security Level is assigned to
each facility. Accordingly, the outcomes of these risk assessments
drive the level of protection for each facility, to include an
appropriate access control posture. Simply put, a one-size security
solution does not and cannot fit all facilities.
For our employees to qualify for access to a Federal DHS facility,
an employee must undergo a background investigation to establish his or
her suitability for employment. These investigations are, for the most
part, conducted by OPM on behalf of DHS. Contractors are screened in a
process similar to employees in order to determine their fitness to
work on a DHS contract and have unescorted access to DHS facilities.
Background investigations for suitability and fitness examine character
and conduct behaviors, such as criminal history, alcohol and drug use,
and employment history, among others. Based upon all available
information, a personnel security specialist makes an adjudicative
decision concerning a person's suitability or fitness for employment,
including access to facilities.
It is important to understand that a background investigation for
suitability and one for a security clearance processes with multiple
levels of investigation dependent upon the access required and level of
risk. A security clearance allows access to Classified information,
while a favorable suitability or fitness determination allows
employment and access to facilities. On its own, a background
investigation for suitability does not permit access to Classified
information.
It is also important to note that a background investigation for
either a suitability determination or a security clearance, no matter
how rigorous, is no guarantee that every bit of relevant information
about the individual is available or has been included. For example,
prior criminal convictions and/or arrest information may not be
reported in State and/or Federal repositories, often simply due to data
entry resource constraints. It is these types of checks that are basic
elements of any Federal employment background investigation.
Also, it is important to note that a background investigation may
not be an indicator of future behavior. Even those who have
successfully undergone the most rigorous set of background checks
available--even a comprehensive polygraph examination--may someday
prove untrustworthy. Ultimately, a Federal background investigation
only examines past behavior and is sometimes based on limited available
information.
A Federal background investigation is an exercise in risk
management, establishing some basic facts such as identity,
citizenship, criminal history, etc. However, a background investigation
cannot be characterized, in and of itself, does not guarantee any
single individual's continuing day-to-day fitness to carry out his or
her employment responsibilities or to behave in a lawful and safe
manner.
With these limitations in mind, there have been several recent
improvements to the ability of the Government to manage these inherent
risks.
First, Homeland Security Presidential Directive 12 (HSPD-12)
mandated the development and implementation of a Government-wide
standard for a secure and reliable Personal Identity Verification (PIV)
card for gaining access to Federally-controlled facilities. To date,
DHS Headquarters and components have issued over 250,000 PIV cards to
Federal employees and contractors. For the first time, this process has
effectively linked the completion of a person's background
investigation with the issuance to that person of a unique Federal
identity credential. The PIV card represents a marked improvement over
the various legacy access/identity cards, but is only a part of any
solution. As a result, Federal facility access control processes use
this PIV card and its various authentication mechanisms to verify the
identity of the holder, link the holder to the card, and link the card
itself to a database of valid employees and contractors having
legitimate business at any given facility.
Second, the background investigation process itself is undergoing a
major Government-wide reform effort, to include revised Federal
investigative standards signed jointly by the director of National
Intelligence and the director of the Office of Personnel Management in
2012, and phased implementation to begin this fiscal year. With the
Federal investigative standards, the concept of ``continuous
evaluation'' is being developed to supplement the normal re-
investigation reviews of employees which, under the revised standards,
will be in 5-year increments, with a Government-led process that
examines a person's conduct within his or her normal re-investigation
time frames. As such, relevant security information like a recent
arrest or conviction for a crime outside of the Federal system, for
example, would become available on a timelier basis to security
officials responsible for assessing a person's eligibility for access
to Classified information, thereby helping to ensure that Classified
information and/or Federal facilities are appropriately safeguarded.
``Continuous evaluation'' represents a significant process improvement
over current capabilities and will mitigate some of the limitations in
the existing background investigation process discussed above.
Finally, this administration's recent Information Sharing and
Safeguarding initiative, also known as ``Insider Threat,'' seeks to
complement background investigations and continuous evaluation with
continuous monitoring. Continuous monitoring will incorporate data in
near-real time from a much broader set of data sources, as compared to
information that was previously available in the background
investigation process. The initiative focuses on monitoring certain IT
systems and incorporates analysis and collation software to aid in the
identification of behavioral trends that could be indicative of an
insider threat problem. Strict referral protocols are in place to
investigate abnormalities. The aim is the detection and mitigation of
threats to Classified information before any damage can be done. The
focus of this program is the protection of Classified information, but
its applicability to other behavioral issues, including suitability and
contractor fitness, is evident.
In conclusion, the suitability determinations of and access control
to Federal facilities by Federal employees and contractors remains a
work in progress, but is evolving toward dramatic improvement. It is
our responsibility as DHS security leaders, with the support of
Congress, to ensure a safe and secure workplace. We have made important
strides, but assessing and managing employee and facility risks will
continue to be a challenge in the future. We will continue to work
every day to meet these challenges. Thank you again for the opportunity
to testify today.
Mr. Duncan. Thank you so much, Mr. Marshall.
Ms. Durkovich. If I pronounced that wrong, just tell me--
Durkovich?
Ms. Durkovich. You have pronounced it correctly. Thank you,
sir.
Mr. Duncan. Thank you so much. You are recognized for 5
minutes.
STATEMENT OF CAITLIN DURKOVICH, ASSISTANT SECRETARY,
INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND
SECURITY, TESTIFYING ON BEHALF OF THE INTERAGENCY SECURITY
COMMITTEE
Ms. Durkovich. Thank you very much, Chairman Duncan and
Ranking Member O'Rourke and the distinguished Members of the
subcommittee. I am honored to appear before you today.
As assistant secretary for infrastructure protection, I
have the responsibility to lead the overall coordination of the
Nation's critical infrastructure security and resilience
efforts, including development and implementation of the
National Infrastructure Protection Plan, or the NIPP. The NIPP
establishes the framework for integrating the Nation's various
critical infrastructure security and resilience initiatives
into a coordinated effort.
One of the most rewarding opportunities I have is to serve
as chair of the Interagency Security Committee and oversee the
development of standards and guidelines and best practices for
civilian Federal facilities through the Interagency Security
Committee, or the ISC. The ISC was created by Executive Order
following the bombing of the Alfred P. Murrah Federal Building
in Oklahoma City on April 19, 1995.
The ISC is responsible for the creation and adoption of
numerous standards, guidelines, and best practices for the
protection of nearly 400,000 non-military Federal facilities
across the country. This work is based on real-world present-
day conditions and challenges and allows for cost savings by
focusing on specific security needs of the agencies.
ISC standards provide the Federal community with strategies
for identifying physical security measures and support the
design and implementation of risk-based security policies. In
August, the ISC issued the risk management process for Federal
facilities standard, which defines the criteria and processes
that those responsible for security should use to determine a
facility's security level and provides an integrated single
source of physical security countermeasures for all non-
military Federal facilities.
The standard also provides guidance for customization of
countermeasures for Federal facilities and explains that risk
can be addressed in various ways, depending on agency mission
needs, for example, the presence of child care on-site and
historical significance. It is most important to note that the
ISC is truly a collaborative interagency body. Fifty-three
Federal departments and agencies participate in the ISC and
take the lead on bringing ideas to the table and drafting
standards and best practices.
When agencies cannot solve security-related problems on
their own, the ISC is a convening body for chief security
officers and senior executives to solve continuing Government-
wide security concerns. The ISC membership develops standards
and best practices based on real-world threats. Recent events
have demonstrated the need to identify measures that can be
taken to reduce the risk of mass-casualty shootings, improve
preparedness, and expand and strengthen on-going efforts
intended to prevent future incidents.
DHS aims to enhance preparedness through a whole-of-
community approach, by providing resources to a broad range of
stakeholders on issues such as active-shooter awareness,
incident response, and workplace violence.
Working with partners in the private sector, DHS developed
training and other awareness materials to assist critical
infrastructure owners and operators with better training their
staff and coordinating with local law enforcement.
We have hosted hundreds of workshops and developed an on-
line training tool targeted at preparing those who work in
these buildings.
These efforts and resources have been well-received and are
applicable to Government facilities as well as commercial
spaces.
Cognizant of this growing threat, the ISC this past spring
formed a Federal active-shooter working group. While a number
of Federal guidance documents previously existed on active-
shooter preparedness and response, including our designed basis
threat report, the violence in Federal workplace, a guide for
prevention response, and occupant emergency programs, an ISC
guide, the working group was formed to streamline existing ISC
policies into a single cohesive document.
To date, the working group has met four times and has
reviewed numerous publications and guidance documents,
including training materials developed by the Department for
commercial facilities.
It will also leverage lessons learned from real-world
incidents, including the Navy Yard shooting.
It is our intention that the resulting work will serve as a
resource for agencies to enhance preparedness for an active-
shooter incident in a Federal facility.
Threats to our critical infrastructure, including Federal
facilities, are wide-ranging. Not only are there terrorist
threats, like the bombing at the Boston Marathon this past
spring, or the complex shopping mall attack we saw recently
overseas, but threats from weather-related events, such as
Hurricane Sandy, as well as threats to our cyber infrastructure
which may have a direct impact on the security of our Federal
buildings.
While it is impossible to anticipate every threat, the
Department is taking a holistic approach to create a more
secure and resilient infrastructure environment to better
handle these challenges, and the work of the ISC exemplifies
these efforts.
Ensuring our Federal facilities are secure and resilient is
a large undertaking. But the work of our 53 member departments
and agencies to ensure those responsible for Federal facility
security have the tools and resources necessary to mitigate
these threats is worth noting.
In closing, I would like to thank you for the opportunity
to appear before you and discuss the important work of the ISC.
I look forward to answering any questions you may have.
Mr. Duncan. Thank you so much.
The Chairman will now recognize Mr. Goldstein for 5
minutes.
STATEMENT OF MARK L. GOLDSTEIN, DIRECTOR, PHYSICAL
INFRASTRUCTURE ISSUES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Goldstein. Good morning, Mr. Chairman and Members of
the subcommittee. We are pleased to be here today to discuss
our latest report on the Federal Protective Service and the
protection of Federal facilities.
As part of the Department of Homeland Security, the FPS is
responsible for protecting Federal employees and visitors in
approximately 9,600 Federal facilities.
Sadly, recent incidents at Federal facilities demonstrate
their continued vulnerability to attacks and other acts of
violence.
To help accomplish its mission, FPS conducts the facility
risk assessments and provides oversight of approximately 13,500
contract security guards deployed to Federal facilities.
My testimony today is based on the results of a September
2013 report which is being released by the subcommittee today,
previous GAO reports on this topic and the preliminary results
of work GAO conducted for a report that we will issue to the
Chairman later this year.
My testimony today discusses challenges FPS faces in
ensuring contract security guards deployed to Federal
facilities are properly trained and certified, and the extent
to which FPS and select Federal agencies' facility risk
assessment methodologies align with standards issued by the
ISC.
Our findings are as follows: First, the Federal Protective
Service faces challenges ensuring that contract guards have
been properly trained and certified before being deployed to
Federal facilities.
In particular, GAO found that providing active-shooter
response and screener training is a challenge for FPS. For
example, according to officials at five guard companies, their
contract guards have not received training on how to respond
during incidents involving an active shooter.
Without ensuring that all guards receive this training, FPS
has limited assurance that its guards are prepared for such a
threat. Similarly, officials from one of FPS' contract guard
companies stated that 133, about 38 percent of its
approximately 350 guards, had never received screener training.
As a result, those guards may be using X-ray and magnetometer
equipment at Federal facilities that they are not qualified to
use, raising questions about their ability to properly screen
access control points at Federal facilities, one of their
primary responsibilities.
We were unable to determine the extent to which FPS' guards
have received active-shooter response and screener training.
Second, GAO also found that FPS continues to lack effective
management controls to ensure its guards have met its training
and certification requirements.
For instance, although FPS agreed with GAO's 2010 and 2012
recommendations that it develop a comprehensive and reliable
system for managing information on guard's training,
certifications, and qualifications, it still does not have such
a system.
Additionally, 23 percent of nearly 300 guard files that GAO
examined, maintained by 11 of the 31 contract guard companies
we interviewed, lacked required training and certification
documents. Examples of missing items include documentation of
initial weapons and screener training and firearms
qualifications.
Finally, GAO's preliminary results on our risk assessment
report indicate that several agencies, including FPS, do not
use a methodology to assess risk at their facilities that
aligns with the ISC's risk assessment standards.
Risk assessments help decision makers identify and evaluate
security risks and implement protective measures to mitigate
risk. ISC's standards state that agencies' facility risk
assessment methodologies must, first, consider all of the
undesirable events identified by ISC as a possible risk to
Federal facilities, and, No. 2, assess the threat vulnerability
and consequences of specific undesirable events.
Most commonly, FPS and eight agencies' methodologies that
we reviewed are inconsistent with ISC standards because they do
not assess facilities' vulnerabilities to specific undesirable
events. If an agency does not know its facility's potential
vulnerabilities to specific scenarios, it cannot set priorities
to mitigate these vulnerabilities.
In addition, as GAO reported in August 2012, although
Federal agencies pay FPS millions of dollars to assess risk at
their facilities, FPS' own risk assessment tool is not
consistent with ISC's risk assessment standards, because it
does not assess consequence, the level, duration, and nature of
loss, resulting from undesirable events.
As a result, FPS and the agencies we reviewed may not have
a complete understanding of the risks facing approximately
57,000 Federal facilities located around the country, including
the 9,600 facilities that FPS protects. As mentioned, our final
report on this topic will be available later this fall.
Mr. Chairman, this completes my statement. I would be happy
to respond to any questions. Thank you.
[The prepared statement of Mr. Goldstein follows:]
Prepared Statement of Mark L. Goldstein
October 30, 2013
GAO HIGHLIGHTS
Highlights of GAO-14-128T, a testimony before the Subcommittee on
Oversight and Management Efficiency, Committee on Homeland Security,
House of Representatives.
Why GAO Did This Study
As part of the Department of Homeland Security (DHS), FPS is
responsible for protecting Federal employees and visitors in
approximately 9,600 Federal facilities under the control and custody of
the General Services Administration (GSA). Recent incidents at Federal
facilities demonstrate their continued vulnerability to attacks or
other acts of violence. To help accomplish its mission, FPS conducts
facility risk assessments and provides oversight of approximately
13,500 contract security guards deployed to Federal facilities.
This testimony is based on the results of our September 2013 report
(released by the subcommittee today), previous reports, and preliminary
results of work GAO conducted for a report that GAO plans to issue to
the Chairman later this year. GAO discusses: (1) Challenges FPS faces
in ensuring contract security guards deployed to Federal facilities are
properly trained and certified, and (2) the extent to which FPS and
select Federal agencies' facility risk assessment methodologies align
with standards issued by the ISC. To perform this work, GAO reviewed
FPS and guard company documentation and interviewed officials about
oversight of guards. GAO also reviewed FPS's and 8 Federal agencies'
risk assessment documentation and compared it to ISC's standards. These
agencies were selected based on their missions and types of facilities.
What GAO Recommends
DHS and FPS agreed with GAO's recommendations in its September 2013
report.
homeland security.--challenges associated with federal protective
service's contract guards and risk assessments at federal facilities
What GAO Found
The Federal Protective Service (FPS) faces challenges ensuring that
contract guards have been properly trained and certified before being
deployed to Federal facilities around the country. In a September 2013
report, GAO found that providing active-shooter response and screener
training is a challenge for FPS. For example, according to officials at
five guard companies, their contract guards have not received training
on how to respond during incidents involving an active shooter. Without
ensuring that all guards receive this training, FPS has limited
assurance that its guards are prepared for such a threat. Similarly,
officials from one of FPS's contract guard companies stated that 133
(about 38 percent) of its approximately 350 guards have never received
screener training. As a result, those guards may be using X-ray and
magnetometer equipment at Federal facilities that they are not
qualified to use, raising questions about their ability to properly
screen access control points at Federal facilities--one of their
primary responsibilities. We were unable to determine the extent to
which FPS's guards have received active-shooter response and screener
training. FPS agreed with GAO's 2013 recommendation that they take
steps to identify guards that have not had required training and
provide it to them. GAO also found that FPS continues to lack effective
management controls to ensure its guards have met its training and
certification requirements. For instance, although FPS agreed with
GAO's 2010 and 2012 recommendations that it develop a comprehensive and
reliable system for managing information on guards' training,
certifications, and qualifications, it still does not have such a
system. Additionally, 23 percent of the 276 guard files GAO examined
(maintained by 11 of the 31 guard companies we interviewed) lacked
required training and certification documentation. Examples of missing
items include documentation of initial weapons and screener training
and firearms qualifications.
GAO's preliminary results indicate that several agencies, including
FPS, do not use a methodology to assess risk at their facilities that
aligns with the Interagency Security Committee's (ISC) risk assessment
standards. Risk assessments help decision makers identify and evaluate
security risks and implement protective measures to mitigate the risk.
ISC's standards state that agencies' facility risk assessment
methodologies must: (1) Consider all of the undesirable events
identified by ISC as possible risks to Federal facilities, and (2)
assess the threat, vulnerability, and consequence of specific
undesirable events. Most commonly, agencies' methodologies that GAO
reviewed are inconsistent with ISC's standards because they do not
assess facilities' vulnerabilities to specific undesirable events. If
an agency does not know its facilities' potential vulnerabilities to
specific undesirable events, it cannot set priorities to mitigate these
vulnerabilities. In addition, as GAO reported in August 2012, although
Federal agencies pay FPS millions of dollars to assess risk at their
facilities, FPS's risk assessment tool is not consistent with ISC's
risk assessment standards because it does not assess consequence (i.e.,
the level, duration, and nature of loss resulting from undesirable
events). As a result, FPS and the other non-compliant agencies GAO
reviewed may not have a complete understanding of the risks facing
approximately 57,000 Federal facilities located around the country
(including the 9,600 protected by FPS).
Chairman Duncan, Ranking Member Barber, and Members of the
subcommittee: We are pleased to be here to discuss the results of our
September 2013 report, which the subcommittee is releasing today, and
the efforts of the Department of Homeland Security's (DHS) Federal
Protective Service (FPS) to protect the nearly 9,600 Federal facilities
that are under the control and custody of the General Services
Administration (GSA). The 2012 shooting at the Anderson Federal
Building in Long Beach, California, and the results of our 2009 covert
testing and FPS's on-going penetration testing demonstrate the
continued vulnerability of Federal facilities. Moreover, the challenge
of protecting Federal facilities is one of the major reasons why we
have designated Federal real property management as a high-risk
area.\1\
---------------------------------------------------------------------------
\1\ GAO, High Risk Series: An Update, GAO-13-283 (Washington, DC:
Feb. 14, 2013).
---------------------------------------------------------------------------
FPS is authorized: (1) To protect the buildings, grounds, and
property that are under the control and custody of GSA, as well as the
persons on the property; (2) to enforce Federal laws and regulations
aimed at protecting such property and persons on the property; and (3)
to investigate offenses against these buildings and persons.\2\ FPS
conducts its mission by providing security services through two types
of activities: (1) Physical security activities--conducting security
assessments and recommending countermeasures aimed at preventing
incidents--and, (2) law enforcement activities--proactively patrolling
facilities, responding to incidents, conducting criminal
investigations, and exercising arrest authority. To accomplish its
mission, FPS currently has almost 1,200 full-time employees and about
13,500 contract guards deployed at Federal facilities across the
country. It expects to receive approximately $1.3 billion in fees for
fiscal year 2013.\3\
---------------------------------------------------------------------------
\2\ Section 1315(a) of title 40, United States Code, provides that:
``To the extent provided for by transfers made pursuant to the Homeland
Security Act of 2002, the Secretary of Homeland Security . . . shall
protect the buildings, grounds, and property that are owned, occupied,
or secured by the Federal Government (including any agency,
instrumentality, or wholly owned or mixed-ownership corporation
thereof) and the persons on the property.''
\3\ To fund its operations, FPS charges fees for its security
services to Federal tenant agencies in GSA-controlled facilities.
---------------------------------------------------------------------------
Since 2008, we have reported on the challenges FPS faces with
carrying out its mission, including overseeing its contract guards and
assessing risk at Federal facilities. FPS's contract guard program is
the most visible component of the agency's operations, and the agency
relies on its guards to be its ``eyes and ears'' while performing their
duties. However, we reported in 2010 and again in 2013 that FPS
continues to experience difficulty ensuring that its guards have the
required training and certifications. Before guards are assigned to a
post (an area of responsibility) at a Federal facility, FPS requires
that they all undergo employee fitness determinations \4\ and complete
approximately 120 hours of training provided by the contractor and FPS,
including basic training and firearms training. Among other duties,
contract guards are responsible for controlling access to facilities;
conducting screening at access points to prevent the introduction of
prohibited items, such as weapons and explosives; and responding to
emergency situations involving facility safety and security.\5\ FPS
also faces challenges assessing risks at the 9,600 facilities under the
control and custody of GSA. For instance, in 2012, we reported that
FPS's ability to protect and secure Federal facilities has been
hampered by the absence of a risk assessment program that is consistent
with Federal standards.
---------------------------------------------------------------------------
\4\ A contractor employee's fitness determination is based on the
employee's suitability for work for or on behalf of the Government
based on character and conduct.
\5\ In general, guards may only detain, not arrest, individuals at
their facility. Some guards may have arrest authority under conditions
set forth by the individual States.
---------------------------------------------------------------------------
This testimony is based on our September 2013 report, released
today,\6\ previous reports,\7\ and preliminary results of work we
conducted for a report that we plan to issue to the Chairman later this
year.\8\ This testimony discusses: (1) Challenges FPS faces in ensuring
contract security guards deployed to Federal facilities are properly
trained and certified, and (2) the extent to which FPS and select
Federal agencies' facility risk assessment methodologies align with
Federal risk assessment standards issued by the Interagency Security
Committee (ISC).\9\ To identify challenges associated with ensuring
FPS's contract guards are properly trained and certified, we analyzed
selected guard services contracts active as of September 2012 and FPS's
Security Guard Information Manual. We drew a non-generalizable sample
of 31 contracts from FPS's 117 guard services contracts (one contract
for every guard company with which FPS has contracted for non-emergency
guard services).\10\ A subset (11) of the 31 guard contracts was chosen
based on geographic diversity and geographic density of contracts
within FPS regions to allow us to conduct file reviews for multiple
contracts during each of four site visits that we conducted. For each
of these 11 contracts, we reviewed the contracts as well as a random
sample of guard files associated with each contract. The remaining 20
guard services contracts we selected were the most recent contract for
each of the remaining guard companies that FPS had contracted with as
of November 2012. We also interviewed officials from each of the 31
contract guard companies.
---------------------------------------------------------------------------
\6\ GAO, Federal Protective Service: Challenges with Oversight of
Contract Guard Program Still Exist, and Additional Management Controls
Are Needed, GAO-13-694 (Washington, DC: September 2013).
\7\ GAO, Federal Protective Service: Actions Needed to Assess Risk
and Better Manage Contract Guards at Federal Facilities, GAO-12-739
(Washington, DC: August 2012), GAO, Homeland Security: Federal
Protective Service's Contract Guard Program Requires More Oversight and
Reassessment of Use of Contract Guards, GAO-10-341 (Washington, DC:
April 2010), and GAO, Homeland Security: The Federal Protective Service
Faces Several Challenges That Hamper Its Ability to Protect Federal
Facilities, GAO-08-683 (Washington, DC: June 2008).
\8\ That report will contain our final evaluation and
recommendations about agencies' risk assessment methodologies.
\9\ The Interagency Security Committee (ISC) was created pursuant
to Executive Order 12977, 60 Fed. Reg. 54411 (Oct. 19, 1995), as
amended by Executive Order 13286, 68 Fed. Reg. 10610 (March 5, 2003).
The ISC is a permanent body established to address continuing
Government-wide security for Federal facilities and was tasked with,
among other things, developing security standards for Federal
facilities. The ISC is comprised of primary members from Federal
Executive branch agencies designated by the Executive Order as well as
associate members from other agencies and departments not designated in
the Executive Order. The ISC is to be chaired by the Secretary of DHS
or a designee of the Secretary.
\10\ When we chose contracts for review, FPS had a total of 117
contracts with 32 guard companies. However, 1 of the 32 companies had a
contract with FPS for only emergency guard services. As such, we chose
1 contract for review for each company with which FPS had contracted
for non-emergency guard services as of November 2012.
---------------------------------------------------------------------------
To determine the extent to which contract guard companies
documented compliance with FPS's guard training and certification
requirements, we examined documentation related to our non-
generalizeable sample of 11 contracts, as previously discussed. From
these 11 contracts, we randomly selected 276 guard files to review for
compliance with FPS requirements. For each guard file, we compared the
file documents to a list of requirements contained in FPS's
Administrative Audit and Protective Security Officer File Review Forms,
which FPS uses to conduct its monthly guard file reviews.
To identify the management controls and processes FPS and the guard
companies use to ensure compliance with training, certification, and
qualification requirements, we reviewed FPS's procedures for: (1)
Conducting monthly guard file reviews; (2) documenting compliance with
guard training, certification, and qualification requirements; and (3)
monitoring performance. We also visited 4 of FPS's 11 regions to
discuss how regional officials ensure that guards are qualified to be
deployed to Federal facilities. We selected the 4 regions to provide
geographic density of contracts in the region to facilitate reviews of
guard files, diversity in the size of guard companies, and geographic
diversity. In addition, we interviewed officials from each of FPS's 31
guard companies regarding their policies and procedures for complying
with FPS's guard training and certification requirements. While the
results of our work are not generalizeable, about 40 percent of the GSA
facilities with guards are located in the four regions where we
conducted our site visits and our review of guard files involved 11 of
FPS's 31 guard companies. To assess the extent to which FPS's monthly
guard-file review results identified files with missing documentation
of training, certifications, and qualifications, we compared FPS's
monthly file review results from the month in which we conducted our
file review for each of the 11 contracts to identify guard files that
were included in both our review and FPS's monthly review. We
identified any discrepancies between the reviews and used FPS's file
review forms to examine the discrepancies.
To determine the extent to which FPS and select Federal agencies'
facility risk assessment methodologies align with ISC's risk assessment
standards, we reviewed and analyzed risk assessment documentation and
interviewed officials at 9 Federal agencies and compared each agency's
methodology to ISC's standards. The nine selected agencies include:
Department of Energy, Office of Health, Safety, and Security;
Department of Interior; Department of Justice, Justice Protective
Service; Department of State, Diplomatic Security; Department of
Veterans Affairs; Federal Emergency Management Agency; Federal
Protective Service; Nuclear Regulatory Commission; and Office of
Personnel Management. These agencies were selected to achieve diversity
with respect to the number and types of agencies' facilities, as well
as the agencies' missions.
We conducted our on-going work from August 2012 to October 2013 in
accordance with generally accepted Government auditing standards. Also,
our previously-issued reports were done in accordance with these
standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable
basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for
our findings and conclusions based on our audit objectives.
fps faces challenges ensuring contract guards have been properly
trained and certified before being deployed to federal facilities
Some FPS Contract Guards Have Not Received Required Training on
Responding to Active-Shooter Scenarios
According to FPS officials, since 2010 the agency has required its
guards to receive training on how to respond to an active-shooter
scenario. However, as our 2013 report shows,\11\ FPS faces challenges
providing active-shooter response training to all of its guards.
According to FPS officials, the agency provides guards with information
on how they should respond during an active-shooter incident as part of
the 8-hour FPS-provided orientation training. FPS officials were not
able to specify how much time is devoted to this training, but said
that it is a small portion of the 2-hour special situations
training.\12\ According to FPS's training documents, this training
includes instructions on how to notify law enforcement personnel,
secure the guard's area of responsibility, appropriate use of force,
and direct building occupants according to emergency plans.
---------------------------------------------------------------------------
\11\ GAO-13-694.
\12\ This training is provided during a block of training on
special situations, which includes information on how guards should
respond to situations other than their normal duties, such as reports
of missing or abducted children, bomb threats, and active-shooter
scenarios. FPS officials stated that guards hired before 2010 should
have received this information during guard-company-provided training
on the guards' post orders (which outline the guards' duties and
responsibilities) as part of basic and refresher training.
---------------------------------------------------------------------------
However, when we asked officials from 16 of the 31 contract guard
companies we spoke to if their guards had received training on how
guards should respond during active-shooter incidents, responses
varied.\13\ For example, of the 16 contract guard companies we
interviewed about this topic:
---------------------------------------------------------------------------
\13\ The remaining 15 guard companies did not respond to this
question.
---------------------------------------------------------------------------
officials from 8 contract guard companies stated that their
guards have received active-shooter scenario training during
FPS orientation;
officials from 5 guard companies stated that FPS has not
provided active-shooter scenario training to their guards
during the FPS-provided orientation training; and,
officials from 3 guard companies stated that FPS had not
provided active-shooter scenario training to their guards
during the FPS-provided orientation training, but that the
topic was covered at some other time.
We were unable to determine the extent to which FPS's guards have
received active-shooter response training. Without ensuring that all
guards receive training on how to respond to active-shooter incidents,
FPS has limited assurance that its guards are prepared for this threat.
FPS agreed with our recommendation that they take immediate steps to
determine which guards have not received this training and provide it
to them.
Some FPS Guards Have Not Received Required Screener Training
As part of their 120 hours of training, guards must receive 8 hours
of screener training from FPS on how to use X-ray and magnetometer
equipment. However, in our September 2013 report,\14\ we found that FPS
has not provided required screener training to all guards. Screener
training is important because many guards control access points at
Federal facilities and thus must be able to properly operate X-ray and
magnetometer machines and understand their results. In 2009 and 2010,
we reported that FPS had not provided screener training to 1,500
contract guards in one FPS region.\15\ In response to our reports, FPS
stated that it planned to implement a program to train its inspectors
to provide screener training to all of its contract guards. However, 3
years after our 2010 report, guards continue to be deployed to Federal
facilities who have never received this training. For example, an
official at one contract guard company stated that 133 of its
approximately 350 guards (about 38 percent) on three separate FPS
contracts (awarded in 2009) have never received their initial X-ray and
magnetometer training from FPS. The official stated that some of these
guards are working at screening posts. Further, officials at another
contract guard company in a different FPS region stated that, according
to their records, 78 of 295 (about 26 percent) guards deployed under
their contract have never received FPS's X-ray and magnetometer
training. These officials stated that FPS's regional officials were
informed of the problem, but allowed guards to continue to work under
this contract, despite not having completed required training. Because
FPS is responsible for this training, according to guard company
officials no action was taken against the company. Consequently, some
guards deployed to Federal facilities may be using X-ray and
magnetometer equipment that they are not qualified to use--thus raising
questions about the ability of some guards to execute a primary
responsibility to properly screen access control points at Federal
facilities. We were unable to determine the extent to which FPS's
guards have received screener training. FPS agreed with our
recommendation that they take immediate steps to determine which guards
have not received screener training and provide it to them.
---------------------------------------------------------------------------
\14\ GAO-13-694.
\15\ GAO, Homeland Security: Federal Protective Service Has Taken
Some Initial Steps to Address Its Challenges, but Vulnerabilities Still
Exist, GAO-09-1047T (Washington, DC: Sept. 23, 2009) and GAO-10-341.
---------------------------------------------------------------------------
FPS Lacks Effective Management Controls to Ensure Guards Have Met
Training and Certification Requirements
In our September 2013 report, we found that FPS continues to lack
effective management controls to ensure that guards have met training
and certification requirements. For example, although FPS agreed with
our 2010 and 2012 recommendations to develop a comprehensive and
reliable system for contract guard oversight, it still does not have
such a system. Without a comprehensive guard management system, FPS has
no independent means of ensuring that its contract guard companies have
met contract requirements, such as providing qualified guards to
Federal facilities. Instead, FPS requires its guard companies to
maintain files containing guard-training and certification information
and to provide it with a monthly report containing this information. In
our September 2013 report, we found that 23 percent of the 276 guard
files we reviewed (maintained by 11 of the 31 guard companies we
interviewed) lacked required training and certification
documentation.\16\ As shown in Table 1, some guard files lacked
documentation of basic training, semi-annual firearms qualifications,
screener training, the 40-hour refresher training (required every 3
years), and CPR certification.
---------------------------------------------------------------------------
\16\ See GAO-13-694. During our non-generalizeable review of 276
randomly-selected guard files, we found that 64 files (23 percent) were
missing one or more required documents.
TABLE 1.--TOTAL MISSING DOCUMENTS IDENTIFIED IN 64 OF 276 GUARD FILES
GAO REVIEWED
------------------------------------------------------------------------
Number of
Instances of
Requirement Each Missing
Document
------------------------------------------------------------------------
Copy of driver's license/State ID....................... 1
Domestic Violence ``Lautenberg'' Form................... 1
Medical certification................................... 1
Verified alien/immigration status....................... 3
Current baton certification............................. 3
Basic training.......................................... 3
Firearms qualifications................................. 3
First-aid certification................................. 5
FPS screener training--8 hours.......................... 5
FPS orientation......................................... 8
Contractor employee fitness determination............... 12
CPR certification....................................... 12
AED certification....................................... 12
Refresher training...................................... 15
Pre-employment drug testing............................. 16
Initial weapons training................................ 17
---------------
Total............................................. \1\ 117
------------------------------------------------------------------------
Source.--GAO analysis of contract guard company data.
Note.--These results are non-generalizeable and based on a review of 276
randomly-selected guard files for 11 of 117 FPS guard contracts.
\1\ Some of the files that did not comply with requirements were missing
more than one document, for a total of 117 missing documents.
FPS has also identified guard files that did not contain required
documentation. FPS's primary tool for ensuring that guard companies
comply with contractual requirements for guards' training,
certifications, and qualifications is to conduct monthly reviews of
guard companies' guard files. From March 2012 through March 2013, FPS
reviewed more than 23,000 guard files.\17\ It found that a majority of
the guard files had the required documentation but more than 800 (about
3 percent) did not. FPS's file reviews for that period showed files
missing, for example, documentation of screener training, initial
weapons training, CPR certification, and firearms qualifications.
However, as our September 2013 report explains, FPS's process for
conducting monthly file reviews does not include requirements for
reviewing and verifying the results, and we identified instances in
which FPS's monthly review results did not accurately reflect the
contents of guard files. For instance, FPS's review indicated that
required documentation was present for some guard files, but we were
not able to find documentation of training and certification, such as
initial weapons training, DHS orientation, and pre-employment drug
screenings.\18\ As a result of the lack of management controls, FPS is
not able to ensure that guards have met training and certification
requirements.
---------------------------------------------------------------------------
\17\ FPS has approximately 13,500 contract guards, but FPS may
review a guard file more than once annually.
\18\ For more information on this review and our methodology, see
GAO-13-694.
---------------------------------------------------------------------------
GAO's Recommendations to Improve the Management and Oversight of FPS's
Contract Guard Program
In our September 2013 report, we recommended that DHS and FPS take
the following actions:
take immediate steps to determine which guards have not had
screener or active-shooter scenario training and provide it to
them and, as part of developing a National curriculum, decide
how and how often these trainings will be provided in the
future;
require that contract guard companies' instructors be
certified to teach basic and refresher training courses to
guards and evaluate whether a standardized instructor
certification process should be implemented; and,
develop and implement procedures for monthly guard-file
reviews to ensure consistency in selecting files and verifying
the results.
DHS and FPS agreed with our recommendations.
preliminary results indicate that fps and select federal agencies' risk
assessment methodologies do not align with isc's risk assessment
standards
Risk assessments help decision makers identify and evaluate
security risks and implement protective measures to mitigate the
potential undesirable effects of these risks. ISC's risk assessment
standards state that agencies' facility risk assessment methodologies
must: Consider all of the undesirable events identified by ISC as
possible risks to Federal facilities, and assess the threat,
vulnerability, and consequence of specific undesirable events.
Preliminary results from our on-going review of 9 Federal agencies'
risk assessment methodologies indicate that several agencies, including
FPS, do not use a methodology that aligns with ISC's risk assessment
standards to assess Federal facilities.\19\
---------------------------------------------------------------------------
\19\ ISC's risk assessment standards define ``Federal facilities''
as Government-leased or -owned facilities in the United States occupied
by Federal employees for non-military activities. Aside from
intelligence-related exceptions, Executive branch agencies and
departments are required to cooperate and comply with ISC's standards,
including its risk assessment standards. These standards do not apply
to Legislative branch agencies and Federal facilities occupied by
military employees.
---------------------------------------------------------------------------
Most commonly, agencies' methodologies are not consistent with
ISC's standards because agencies do not assess their facilities'
vulnerabilities to specific undesirable events. For example, officials
from one agency told us that their vulnerability assessments are based
on the total number of protective measures in place at a facility,
rather than how vulnerable the facility is to specific undesirable
events, such as insider attacks or vehicle bombs. Because agencies'
risk assessment methodologies are inconsistent with ISC's risk
assessment standards, these agencies may not have a complete
understanding of the risks facing approximately 57,000 Federal
facilities located around the country--including the 9,600 protected by
FPS and several agencies' headquarters facilities.\20\
---------------------------------------------------------------------------
\21\ For example, if an agency's methodology does not consider all
the undesirable events identified by ISC, and/or it does not assess all
three components of risk (threat, vulnerability, and consequence), then
the agency would have an incomplete picture of risk at facilities
assessed using this methodology.
---------------------------------------------------------------------------
Moreover, because risk assessments play a critical role in helping
agencies tailor protective measures to reflect their facilities' unique
circumstances and risks, these agencies may not allocate security
resources effectively, i.e., they may provide too much or too little
protection at their facilities. Providing more protection at a facility
than is needed may result in an unnecessary expenditure of Government
resources, while providing too little protection may leave a facility
and its occupants vulnerable to attacks. For example, if an agency does
not know its facility's potential vulnerabilities to specific
undesirable events, it cannot set priorities to mitigate them.
In addition, we reported in 2012 that although Federal agencies pay
FPS millions of dollars to assess risk at their facilities, FPS's
interim facility assessment tool--the Modified Infrastructure Survey
Tool (MIST)--was not consistent with Federal risk assessment standards
and had other limitations. Specifically, FPS's risk assessment
methodology was inconsistent with ISC's risk assessment standards
because it did not assess the consequence of possible undesirable
events (i.e., the level, duration, and nature of loss resulting from
undesirable events). FPS officials told us that MIST was not designed
to assess consequence, and that adding this component would have
required additional testing and validation. However, without a risk
assessment tool that includes all three components of risk--threat,
vulnerability, and consequence--as we have recommended, FPS has limited
assurance that facility decision-makers can efficiently and effectively
prioritize programs and allocate resources to address existing and
potential security risks.\21\ Furthermore, because MIST also was not
designed to compare risks across facilities, FPS has limited assurance
that it prioritizes and mitigates critical risks within the agency's
portfolio of more than 9,600 Federal facilities.
---------------------------------------------------------------------------
\21\ FPS agreed with our 2012 recommendation, but has yet to
implement it.
---------------------------------------------------------------------------
This concludes our testimony. We are pleased to answer any
questions you, Ranking Member Barber, and Members of the subcommittee
might have.
Mr. Duncan. Well, I thank you so much, Mr. Goldstein and
all the witnesses for your excellent testimony.
Mr. O'Rourke is recognized.
Mr. O'Rourke. Mr. Chairman, I ask unanimous consent that
the gentlewoman from Texas, Ms. Jackson Lee, be allowed to sit
and question the witnesses at the hearing's end.
Mr. Duncan. Without objection, so ordered.
The Chairman will now recognize himself for 5 minutes.
My intent today is, since we do have a small committee,
active committee today, is just to allow us to delve into the
issue. We are going to try to adhere to the 5-minute rule, but
I will allow some leeway, because I do want some questions
answered and I want you to have--to feel free to--to really get
into the subject, but within reason. So.
What I would like to do is I want to go to the Navy Yard
shooting, Director Patterson, first, and ask you a question
about how a FPS officer actually engages an active shooter or
doesn't engage.
Then I will back up and start delving into the background
checks and what we do to make sure this doesn't happen.
I realize that we have a lot of Federal facilities. I also
realize that risk assessment is generally looking at keeping
someone from breaking into the facility from outside, and this
was a unique inside access issue with the Navy Yard shooter.
So, now we have had to think about that sort of thing
versus a typical risk assessment of a facility, looking at the
entries and exits and the guards, the personnel necessary to
secure the premises.
But now we have got a different scenario to think about.
So, according to your response letter to GAO's report,
Director Patterson, a protective service officer, or PSO's,
actions if unable to visibly see an active shooter, they are
dictated by his or her post orders. Although armed, a PSO is
not supposed to engage in tactics associated with law
enforcement response.
So, could you please explain in further detail what steps a
PSO is supposed to take in an active-shooting situation?
Mr. Patterson. Yes, sir, I sure can.
Well, first of all, sir, I just want to let you know that
our No. 1 priority is the protection of the people in the
Federal facility. That is No. 1.
The first--in the event of an active-shooting situation,
the first step to be taken by the PSO, because that is our
first line of defense, will be to call our megacenter, to allow
them to pass that information on to our megacenter. That is
where the information is passed that will allow not only that
information to be passed to our inspectors, but also to local
law enforcement, that there is a situation that is evolving or
taking place in that facility.
Mr. Duncan. Excuse me, just a second. Will you do that by
landline or would that be a radio comm?
Mr. Patterson. It will be both, sir. He will do it by
landline and then by radio comm.
Mr. Duncan. Okay.
Mr. Patterson. So that we have a general awareness of what
is going on. Then there will be an assessment by that PSO as to
what action that he needs to take next.
Our PSOs are trained to take action in emergency
situations. Because they are not Federal or State law
enforcement officials, they are constrained by--the contractor
is constrained by State law as to what he or his company can do
in these situations. So that is why we don't have what we call
active-shooter training, if you will, where our PSOs will go
out and actively pursue an active shooter.
However, if we come across a situation where that PSO is
the only individual in that facility and has no reasonable
expectation that law enforcement can respond in a reasonably
quick manner, then that individual will more than likely take
action to limit the damage of the active shooter.
Mr. Duncan. Let me ask this, because as you were talking, I
am trying to envision--you have an active shooter in a building
like the Navy Yard. The PSO hears the shots, understands lives
are possibly threatened, picks up the phone, calls his
supervisor to try to get permission or at least let them know
what is going on, but then try to get permission on how to act
beyond his post orders.
Does the same thing with radio comms. Coordination between
the PSOs within the facility. While these bureaucratic, seems
to me bureaucratic, steps are put in place or being activated,
are lives not threatened even further during that? Is there a
delay, I guess is what I am asking? Does that put the public
safety at risk?
Mr. Patterson. Unfortunately, sir, the challenge here is
that we don't know what is really happening and neither does
the PSO. So he has a responsibility to the people in that area.
His responsibility is to ensure that he can get either--keep
people from coming into the building or getting people out of
the building.
So he has got a job to do right there. In this case, we are
hoping, we believe that we are going to have a quick response
by either Federal law enforcement, our folks, or by the State
and local, if they are in the area. If the situation dictates
that we believe that we are in a remote area and we don't think
that someone is going to be able to come quickly, then he will
take action.
Mr. Duncan. Right, and I get that. We had a conversation
yesterday with staff about that scenario. The PSO actually
securing his entry-door exit, but also making sure that an exit
is available for personnel within the building to flee the
scene and make sure no one--another active shooter doesn't come
in as part of a team. So I get all that.
Mr. Patterson. Right.
Mr. Duncan. I just want to make sure there is not a delay.
You have answered that question fairly well.
So I want to go to Mr. Marshall and ask, if for any reason
an individual is deemed a threat, and I know with the Navy Yard
shooter, there was some evidence there, but whether it got to
the proper person to make that decision is still being
investigated. You know, how we miss those signals.
But if an individual is deemed a threat, are you able to
deactivate their access credential remotely? Talk me through
the process of how their credentials are pulled or their access
is denied and limited, if you could.
Mr. Marshall. Yes, sir. If derogatory information about an
individual reaches us, we will investigate it and we will take
the necessary steps to make sure that if that person is deemed
a threat after the investigation, we can deactivate their card.
Not only their card, but we can also deactivate their access in
whatever physical security access system or PACS system that
that person has access to.
That can be done remotely, yes, sir.
Mr. Duncan. That is on a swipe. But let's talk about maybe
a flash pass or some credential that they may have on their
persons. I guess at this point an actual supervisor would take
that, if it was a termination issue.
If it was an issue where they were going to restrict their
access, would they be issued an additional credential, a
different color, a different code on there, which I think is
important? How would that be handled?
Mr. Marshall. No, sir. If derogatory information reached
us, and it was deemed to be good information, we would
deactivate their card, both their card and also the access
system. We would bring them in and read them out, if they had a
security clearance, we would read them out.
So they would not only not have access to Classified
information any longer, they would also not have access to
facilities. An added step that we would take, once we would
deactivate their access, we would also do something called a
``do not admit''. That is a couple of different things. We
would go into our personnel security system, which is an
enterprise system, and make a notation in their record in the
personnel security system that they no longer have a clearance
or access to facilities.
We would also notify the buildings or the locations where
that person primarily has a mission responsibility, and we
would send a flyer with that individual's picture on it and
circumstances surrounding that person's removal of access to
that facility. So everybody would be notified.
Mr. Duncan. Yes. I think this has some implications with
how we deal with TSA and access Air Force training Mr. Hudson
may get into. Because I think we are looking at the whole scope
of access and whatnot.
Just my last question--you told the subcommittee staff at a
recent meeting that DHS lacks information on access control
systems across the DHS facilities. Headquarters is in the
process of compiling this information from its components. But
10 years after the Department's creation, it is unclear to me
why DHS headquarters would not know how to access DHS
facilities, how that is controlled throughout the Department.
So what is going on now? Is there some sort of uniformity,
some sort of activity now to--listen, I go to a lot of Federal
buildings here in this city and I know that access to every
building is different. Whether they are DHS-coordinated or
whether GSA handles that.
So what is going on? Are we looking for uniformity? Are we
looking for changes to those systems? If you could just tell me
that.
Mr. Marshall. Yes, sir. That is exactly what we are doing,
Congressman. We are moving towards a federated system.
Obviously, you know DHS is a legacy agency. We are formed
of agencies that were already in existence. As a result of that
legacy heritage, everybody had their own PACS systems, their
own access controls systems, and they are all completely
different.
So the first order of business when the Homeland Security
Presidential Directive 12 was implemented was to issue the PIV
cards. Because there is no sense in changing out all the
readers unless everybody had the card to use on the reader.
So that was a heavy lift. We issued over 250,000 PIV cards
with the help of the components. Everybody has a PIV card now.
So then the next step, the next phase was to roll out an
implementation of these legacy systems and eliminating them
altogether. Last fall, I issued a--with the help of my staff--
issued a PACS modernization strategy for DHS, which includes
headquarters and the eight components. That directed all the
components' chief security officers to develop implementation
plans on their strategy for switching out the PACS systems and
the readers.
They were required to submit implementation plans by early
2013. They all did. Now we are moving towards the roll out, the
switching out of the readers.
Headquarters, which I have oversight over, direct oversight
over, we have 34 facilities. All 34 facilities have been
switched out. We now have HSPD-12 compliant readers in all the
headquarters facilities.
FLETC, which is one of our components, it switched out all
their facilities. FEMA, which I am happy to say is leading the
effort with this, were the first to switch out all their
readers.
So we have--we are at various degrees of completion in this
whole process. I know ICE has started to switch out their
readers. They are at approximately 12 percent of switching out,
so they have begun their roll out.
I know TSA has begun their roll out. They are approximately
at 12 percent. Citizen Immigration Service, they are right
behind TSA and ICE, they are at about 9 percent.
So mostly the larger agencies like CBP and Coast Guard and
the Secret Service, to some degree, they are following close
behind. But the important thing to know for this committee is
that we have already begun that roll out and a lot of the
components are looking for funding streams to accelerate the
roll out, but we are well on our way.
Mr. Duncan. Yes, well, let me just say that I understand
the enormity of the number of Federal buildings across the
Nation that you are charged with trying to protect. It is going
to take a while. But I am glad to see a task force is looking
at that.
My final question--you mentioned 3,200 personnel security
guards have been trained. Where are they trained? Is that
private training and what is the process of certifying that
training facility? Or do they go to FLETC? Are they trained by
some sort of Governmental agency? Or is it all private?
Mr. Marshall. Is that question for me, sir?
Mr. Duncan. Yes.
Mr. Marshall. Okay.
Mr. Duncan. I think you are the one that said 3,200
officers have been trained.
Mr. Marshall. That wasn't me, sir.
Mr. Duncan. Okay. Was that Director Patterson?
Mr. Patterson. I am sorry. What was the context of the
question, sir? I am sorry.
Mr. Duncan. Well, regardless, how are the contract
personnel, the officers, trained? Are they trained at FLETC or
are they trained by private contractors? How is that facility
certified? I don't care who answers.
Mr. Patterson. Yes, sir, I can answer that. Yes. Our 13,000
contracting guards are trained in a couple of ways. One, much
of the training is done in-house by the contractor. But second,
we also, as FPS, our inspectors also are trained as trainers to
go out and provide much of the--some of the training as well.
For instance, firearms training is conducted by the
contractor, but overseen by a firearms instructor from FPS. So
there is some oversight where they are in fact doing the
training. So there are a number of training venues where you
have the contractor who is providing the training, but FPS is
providing oversight for that training.
Mr. Duncan. They are looking at the total curriculum, not
just firearms training?
Mr. Patterson. Yes, sir. That is exactly--yes, we look
across the spectrum. Now, there are some things that we just
leave to the contractor. It might be CPR. We probably don't
need to be involved in that and a few other things, but for the
most part, yes, we do have oversight.
Mr. Duncan. Thank you.
The Chairman will recognize Mr. O'Rourke, the acting
Ranking Member, for questions.
Mr. O'Rourke. I want to thank the Chairman again for making
today's hearing possible. I recognize that the true Ranking
Member has just arrived. I am going to keep my questions brief,
and then we will yield this chair to him.
But on this issue of balance, almost each of you mentioned
a risk-based approach and trying to balance the costs and
benefits both in dollars and security, and what it is we get
out of that. So, for Director Patterson, what kind of metrics
do you have or what numbers do you use to know whether or not
we have struck that right balance?
Then I want to ask a follow-up question on what you are
doing to implement some of the recommendations made by the GAO
with respect to that. But first, I would like to ask you to
respond to that question about balance and how you measure
that.
Mr. Patterson. Sure. Well, you know, we have over 9,500
Federal facilities that we are responsible for protecting. Of
those facilities, there are a large number that are what we
call facilities, security level 4, which really are a very high
priority. So we have to take a look at how we dedicate
resources to those facilities and doing assessments at those
facilities over a period of time.
So, we have a metric there that we look at those number of
facilities and how often we get to take a look at and use a
risk-based method, if you will, for how often we do surveys at
those facilities. Currently, we are surveying those facilities,
doing security facility security assessments approximately
every 3 years at our most sensitive and vulnerable, what we
feel to be, high-risk facilities.
But however, we are applying a risk-based model to look at,
you know, what are the real vulnerabilities there; what is the
threat; and do we really have to continue to expend really
scarce resources on doing it every 3 years, or could we extend
that out a little bit? So, we do have a metric there to look at
and work with the security council at those facilities to look
at what is the right mix of service that we provide relative to
the assessment process.
Mr. O'Rourke. Let me ask you a question, sorry to interrupt
you.
Mr. Patterson. Yes.
Mr. O'Rourke. You know, on one end of the spectrum, you
could pat down every single person who enters a Federal
facility; search every square inch of their cars they are
driving into a Federal garage. On the other end, you could wave
everybody through without taking any precautions. When you have
an event like the Navy Yard's shooting, how does that change
your assessment? How does that factor into looking at what you
are already doing right now? How does that change your
procedures and your policies? How does that change what you are
willing to spend on it or what you are willing to ask for to be
spent on it?
Mr. Patterson. Yes, we look at that very carefully. I will
tell you, you know, when an individual is given a PIV card,
there is a level of trust that the Government says that we are
giving to you based upon a background investigation. We still
have confidence in that background investigation process until
we find out that it is not serving us well. We still think--
believe that it has served us well.
So, as far as doing anything that would be beyond, or
moving beyond the current process that we utilize to bring
people into the building, we are looking at our processes. We
are evaluating them, but we think that they still hold true
relative to the protection that they provide us based on the
background investigation.
Mr. O'Rourke. Last question. In terms of GAO findings that
we weren't assessing risk at a number of Federal facilities;
some of the training issues that the Chairman has brought up,
do you agree with those conclusions and findings? Is your plan
over the coming year to actively address those based on those
conclusions reached in that report?
Mr. Patterson. Yes, sir. We have been addressing these
since 2010. What we are looking at is a multitude of ways that
we can approach the myriad of challenges that we have in this
area. We are looking at how we leverage technology. We are
looking at how we bring on more folks in specialized areas like
contract oversight that will help us to better understand what
is going on in our contracts.
We are looking at how we refocus the day-to-day efforts of
our inspectors to help us better understand how we can move
forward in providing a better service to our customers. So yes,
sir, we are, but we have been working on this since 2010 and we
have still got some ways to go, but I think we are making a lot
of progress.
Mr. O'Rourke. Thank you.
Mr. Chairman, I yield back.
Mr. Duncan. I thank the gentleman from Texas, and now
recognize the gentleman from North Carolina, the Chairman of
the Transportation Security Subcommittee, Mr. Hudson, for 5
minutes.
Mr. Hudson. Thank you, Mr. Chairman.
I want to thank our panel for being here today. I
appreciate your time and expert testimony.
Director Patterson, thank you for your service to our
country. One of the statements you made was that PSOs are
constrained by State law in terms of what they can do in
response to an incident. Can you help me understand that, maybe
give me an example of a State law that would prevent PSOs from
engaging an active shooter?
Mr. Patterson. Yes, sir. That would be in the use of
firearms. They are regulated--the States regulate the way that
they--what they can do and the use of their firearms. So,
because they are not Federal law enforcement officers, they
don't carry the same statutory authority as we do to go in and
take charge of searches in certain situations.
So, State laws will dictate whether or not a PSO has the
authority to go in and take certain actions that would normally
be performed by a law enforcement officer.
Mr. Hudson. Has there been any analysis of the impacts of
that? I assume, you know, there are certain States that we are
all aware of that have more strict gun control laws.
Mr. Patterson. Right. As a result of the Navy Yard
shooting, we are looking at that and working with our
contracting office. We are working with the legal folks, as
well as internally within DHS to take a look at, is there
something that we can do to maybe move beyond where we are now
to actually provide our contracting guards active-shooter
training so that it will in fact allow them to go out, pursue,
and function as a law enforcement officer would?
Mr. Hudson. I appreciate that.
I guess the follow-up question would be, as you look at, I
guess each State has different ways you can respond. I am still
concerned, though, that there is not--seems to be widespread-
enough active-shooter training for these guards, even if you
can't engage with a firearm. It seems like running through
scenarios and having training on how to deal with this type of
scenario would still be beneficial.
Mr. Patterson. Yes, sir. I totally agree. We are doing
that. We are looking at what training--we are working with the
security companies now to look at, you know, how we can deliver
that training and what training would be beneficial to them.
Yes, sir, we are doing that.
Mr. Hudson. Great. I think that is important.
What role did FPS play in the Navy Yard shooting
specifically? Could you maybe give us a little more details,
sort-of how that played out and what your role was in that
incident?
Mr. Patterson. Yes, sir. Well, we didn't play an active
role. What we did is when we received a notification that in
fact there was an active shooter at the Navy Yard, we did
recognize at that point--well, first of all, we were part of
the incident command center where the District of Columbia,
where the Defense Department and other Federal agencies had a
command center to more or less--information would pass back and
forth. So we put someone there so that we were in full
cognizance of what was going on.
We also recognized at that point that we had a Federal
facility that was adjacent, the Department of Transportation is
adjacent to the Navy Yard.
So we immediately contacted and worked with the Federal
folks there, and looked at whether or not we needed to shut
down the building and control access, and we did.
So, from that standpoint, what we did was we ensured that
we had complete control of the Federal facilities around the
Navy Yard, so that there was no egressor or someone coming in
that we--that shouldn't, as well as standing by for any
assistance that the folks at the Navy Yard might need.
Eventually, they did call us and ask for some canine
support that we provided. So we sent over a couple of our bomb
dogs to assist with their activities over there, as they were
working--going through the buildings to assess whether or not
the shooter had left some explosive devices.
Mr. Hudson. Thank you.
Mr. Marshall, according to several news reports, radios
failed law enforcement once they got inside the facility that
day. What has been done or is being done to ensure this problem
doesn't exist for Federal Protective Service or other Federal
partners?
Is there a radio interoperability issue that we need to be
aware of?
Mr. Marshall. Well, let me caveat my answer, Congressman,
with, first of all, I haven't been briefed on the Navy Yard
incident first-hand, so everything I know about what happened
there, is anecdotal.
But I--what I can speak on interoperability to some degree:
We learned some lessons, obviously, from 9/11, about the
inability of the NYPD and FDNY to interoperate during that
incident, so much so that it caused a lot of State and local
police departments around the United States to address that
issue.
In my former agency, I was actually in charge of addressing
that issue, going to an 800-megahertz radio system so that we
could interoperate with our regional partners and our allied
law enforcement agencies.
Specifically to your question, I did hear, second-hand,
that there were some interoperability problems at the Navy
Yard. I can speak, first-hand, about what actions I have taken
with respect to that issue at DHS headquarters.
I am fortunate enough at headquarters to have a cadre of
law enforcement officers who are FLETC-trained with full arrest
powers. We work in conjunction with the Federal Protective
Service and the contract guard force there.
We also have a great relationship with the Metropolitan
Police Second District that services the facility on the
Nebraska Avenue complex.
So I asked that question right after the Navy Yard. There
are some interoperability issues that we are addressing.
The first thing we did was, we have an opportunity to join
the regional police mutual aid radio network, also known as
PMARS. I first became acquainted with PMARS when I was a U.S.
Capitol police officer, back in the 1980s. So the U.S. Capitol
Police is a member of that organization.
So I have petitioned the Metropolitan Council of
Governments to become a member of the PMARS system. I believe
our application will be accepted, and hopefully when that is
implemented, we will be able to push a button, or somebody will
be able to push a button and everybody can go to a single talk
group and be able to address any kind of incident that might
occur.
Mr. Hudson. Appreciate that.
Mr. Chairman, I see I am out of time, so I yield back.
Mr. Duncan. I thank the gentleman.
Now, the Chairman will recognize the Ranking Member, the
gentleman from Arizona, Mr. Barber. Welcome to the committee
hearing. I know you had a mark-up today. As we mentioned
earlier, a lot of Members did. But I am glad you were able to
make it, and I recognize you for 5 minutes.
Mr. Barber. Thank you, Mr. Chairman.
Thanks to the witnesses. I am sorry I wasn't here to hear
your testimony in person, but I do have a couple questions.
They may have been asked and answered, but I would like to
explore them.
Let me start, if I could, with Mr. Goldstein.
The question, first of all, is: Based upon your review of
the security screening processes at Federal facilities, what is
your view of a need for a uniform standard, no matter what the
facility, where it is? Do you believe that we need to have that
imposed across all Federal facilities?
Mr. Goldstein. We haven't looked specifically at whether
that policy would be beneficial or not. But I can tell you that
the variety of systems used throughout the Federal facilities
combined with the fact that many officers, contract guard
officers have not been fully trained, certainly does not give
FPS or the public or workers, Federal employees, assurance that
the facilities are well-protected.
Those things combined I think do create problems for the
Government.
Mr. Barber. Well, let me follow up on what you just said
about training and the perhaps inadequacy of the training,
particularly with the companies under contract to provide
security services.
Could you give a couple of examples--you may have already
done it in your earlier testimony--of what you found in regard
to the training, of deficiencies with the security companies
that have been under contract with DHS?
Mr. Goldstein. Yes, sir. We found in our review, in the
report that is being released today, that several contract
guard companies that we interviewed did not have any experience
with FPS providing them the active-shooter training or the
screener training, both of which are required in their
contracts.
Mr. Barber. Having said that, let me ask Mr. Patterson a
follow-up question regarding that.
Every contract that the Federal Government lets has
expectations, I presume has performance standards. Could you
tell us what the expectations and the performance standards are
for contractors with regards to training of their personnel?
Mr. Patterson. Yes, sir. We have an expectation that every
guard who stands post at a magnetometer or X-ray machine will
be trained. Period.
Now, there are not X-ray machines and magnetometers at
every post. So, there could conceivably be, quite frankly, a
number of posts, a number of guards, who aren't necessarily
trained on X-ray and magnetometer services who are serving on
duty because they are not at one of those posts.
But our expectation is that if you are standing post at an
X-ray or magnetometer, you will be trained in that service.
Mr. Barber. Beyond that, I assume the contracts have some
specificity regarding other aspects of training the personnel.
Mr. Patterson. Yes, sir. There are about 13 certifications
that each PSO must have in order to take a position as a
contract guard, from firearms to CPR to, in some cases,
magnetometer and X-ray machine, safety, and things of that
nature.
Mr. Barber. So in order to get out in front of a problem
that apparently has been identified by the GAO, in other words,
finding those companies that have not fully met their
commitments under the contract, what can you, what have you
been doing proactively to find out where those deficiencies are
identified?
What, if any, contract requirements, in terms of any
reimbursement to the Federal Government or any potential loss
of contract--what happens, first of all, do you find it;
second, what happens when you find there is a problem with a
contract agency?
Mr. Patterson. Yes, sir. There are a number of things that
we do. First of all, our inspectors conduct what we call post
inspections. That means they go out to the facilities and they
talk to the guards and validate through a number of ways their
training. They actually--we are required--it is an FPS
requirement for us to review at least 10 percent per month of
all of the contractor training records for a particular
geographic area.
So if we, within a particular FPS region, that regional
director is required to go out and review at least 10 percent
of those records.
One of the challenges that we have had is that there have
been some inconsistencies in the process in which we review
those records. So we are getting that together now and figuring
out and going about a, or moving forward in a more uniform
manner in how we review those records.
Currently, I have directed a--we are conducting a 100
percent audit in four of the regions to take a look at how--and
when I say 100 percent, I am talking about 100 percent right
now. We are not gonna wait 10 percent, 10 percent, 10 percent.
It is 100 percent within the next few months--2 months, within
4 of our regions, so that we can validate and look at what, in
fact, our contractors are delivering to us, relative to the
training that they say that they are.
So, we are also developing, working with the Department of
Homeland Security Science and Technology group a way that we
can electronically validate and track this, so that I don't
have 600 of my law enforcement guys out trying to track down
over 160,000 training records, okay?
It is inefficient and ineffective right now.
So what we are trying to do is better--instead of having to
plow through these records every month, to create an electronic
system where these records can be folded into the system and
then we can review them that way without having to send our
folks to physically go and touch each record. Because it takes
a lot of time. Quite frankly, the records can change. Records
expire, they change. So in effect, when you have got 160,000
records at any given time, some of those records can be out of
date, just because they expire over time.
Mr. Barber. Well, I thank you. My time is up, but I just
want to urge you to continue this aggressive action to make
sure that everyone is trained to a standard, because that is
one way for sure that we can hope for the protection to be
universal across all Federal facilities.
Thank you, Mr. Chairman. I yield back.
Mr. Duncan. I thank the gentleman.
The Chairman will now recognize Ms. Jackson Lee, the
gentlelady from Texas, for 5 minutes.
Ms. Jackson Lee. Mr. Chairman, let me thank both you and
Mr. Barber for your courtesies and how timely a meeting this
is. I thank you so very much.
I hope that the witnesses, let me thank you for your
testimony, will view the work of this committee, this
subcommittee in particular, but the full committee Chairman and
Ranking Member, as partners in excellence. I see this hearing
as an attempt for excellence on behalf of the American people.
Certainly, although we know that the jurisdiction of the
Navy Yard falls in particular under DOD, and we know that there
is a pending investigation, let me just say for the record two
things before I pose my questions.
One, I hope that this committee will have another--I know
that we had some conversation, a secured briefing on the Navy
Yard circumstances. Second, as a Member of Congress, I am
always disturbed no matter what administration it is to rebuff
members by talking about a pending investigation. We are sworn
as officers of this Nation. We take an oath. We take a signed
statement on Classified information. But more importantly, that
is an easy way to hinder our oversight, which is it is a
pending investigation.
Well, a pending investigation could last for eternity. As I
reflect on having been here for 9/11, what we discovered and
should have been discovered--maybe it should have been
discovered preceding the heinous and horrific tragedy if there
was the appropriate interaction between the levels of
government with the Members of Congress both House and Senate.
So, I hope that the pending investigation of the Navy Yard
will either move quickly or that the persons engaged will
recognize that we, as Members of Congress, have a
responsibility to the American people and those lost souls to
be able to provide immediate solutions and resolutions. Which
lies in the questioning that I wish to pose and hopefully will
have the time to do so, as I thank all of the Members who are
here.
One, like the Ranking Member of the full committee, I
believe that we should be enormously concerned of the securing
of the Federal buildings that are throughout America. You could
look at the Navy Yard as a Federal entity. It had a different
jurisdiction, but it was penetrated, as was the Fort Hood in my
State, which we continue to mourn the loss of military
personnel and civilians who should have technically been on the
safest place--one of the safest places in America.
So, my question is to follow up on the training of those
who protect. I am reminded of the Holocaust Museum, which is I
guess semi-private, semi-public, but let me go further into how
do we get a handle on training those who are then contracted-
out on these Federal buildings? FPS contracts out. How do we
get a handle? Is there an inventory of all of these
contractors? Is there a set training structure for all of those
contractors? One question.
The second question is: Do we do continuous training of
these individuals that are hired? I want to say to those in the
Mickey Leland Building in Houston and FPS, we respect and thank
you for your great service. We want to make it better.
Last, this is a discussion I had with Chairman Duncan. I
would like to know from Homeland Security how you would
perceive having the responsibility of doing your background
check? Do you do your own background check? Could it not be
placed under the Office of Management to be able to have
control over the contractors that you contract, and also your
employees?
It is a simple task. Mr. Chairman, I know that I am down at
the limit, but I would ask for the ability for these
individuals to answer the question.
Mr. Duncan. I will grant a little leeway.
Ms. Jackson Lee. I thank you.
I haven't told--I will start with the gentleman from GAO,
but I would like a response from the interagency and others who
jump in on this last question dealing with the background
checks.
Mr. Goldstein. Ma'am, the work we have done that we are
presenting to the committee today doesn't actually get into the
issue of background checks. It was focused on the training and
the certification of the contract guards. So I am not really in
a position to answer that.
Ms. Jackson Lee. Yes, I wasn't asking you that. You answer
the question that you are able to do, which is the training of
the contractors and how often. I want other members to answer
the background checks question. Thank you.
Mr. Goldstein. Certainly.
We do feel that more attention to training and
certification on the part of FPS is required. Much of the
training that the contract guard companies say they are not
getting is training related to active shooters and to other
screening that is presented by FPS.
To some degree, there has been an issue of shortages among
personnel to get out to all the contractors, but to be fair,
they have had a number of years. We first raised the issue of
screener training about 4 years ago when we did penetration
testing at Federal facilities around the country and were able
to get bomb-making materials into 10 Federal buildings in 4
cities.
So this has been an open issue now for a number of years.
So, to still have Federal Protective Service contract guards at
Federal facilities who don't have the required training to be
in front of the machines they are using, this does not bode
well.
Ms. Jackson Lee. Again, the rest of the members there,
answer the question about do you do your internal background
checks, do you continuously have background checks on your
contractors? Do you believe with a structural change, maybe the
collaboration of this committee to internalize the background
checks on both contractors and on your own staff for homeland
security?
Mr. Marshall. Yes, ma'am, I can answer that question.
Everybody who works for the Department of Homeland
Security, both the Federal employee or contract employee, has
to have either a suitability determination or a fitness
determination. Essentially what that is is that even though
they are called two different things, the criteria is the same.
We are trying to determine if that person belongs in DHS and is
suitable for employment, and is in the best interest of the
agency and for the efficiency of Government.
We look at things like conduct in past employment, criminal
history, alcohol and drug abuse, that type of thing; whether or
not the person has engaged in any activities that are contrary
to U.S. interests and so forth.
With respect to contractors, they undergo the fitness. We,
DHS, we adjudicate for that fitness determination. If that
contractor has to have a security clearance, a National
security clearance, that is conducted by the Department of
Defense, Defense Security Service. They have jurisdiction over
those investigations under the National Industrial Security
Program.
So, we do the fitness and we do the adjudication for the
fitness to determine if that person is suitable, but any kind
of security clearance falls under the purview of the Department
of Defense.
Ms. Jackson Lee. So after you do your clearance, if they do
not need a National security clearance, that person is hired.
Mr. Marshall. Correct.
Ms. Jackson Lee. Do you do it for the contractors as well?
Mr. Marshall. Yes, ma'am. That is correct. If there is no
derogatory information developed, that person is deemed to be
suitable to enter on duty and they can come on-board.
Ms. Jackson Lee. May I ask Ms. Durkovich, you were tasked
by President Clinton to--the agency was tasked to set certain
standards for Federal buildings. Where is that in terms of its
implementation and oversight of the security of Federal
buildings throughout the Nation, I assume, working on the
security protocols for all of the Federal buildings?
Ms. Durkovich. Thank you. That is a very good question,
Congresswoman.
We have been hard at work for the last 17 years working
with our 53 member agencies to develop a set of physical
security criteria that is included in our risk-management
process for Federal facilities. This is applicable to 399,000
non-military Federal buildings across the United States. Our
member companies--our member organizations are responsible for
developing these standards.
Our risk-based process for Federal facility standards
includes six key elements, the first of which is establishing
the Federal security level for a building. That is driven by
the function of that particular building, the agencies that
reside in it, the people who pass through it, the iconic and
historical significance of that building.
Once that physical security level is set, we look at the
baseline standards and measures and mitigation measures that
are applicable to that building, and then look at 31 different,
what we call design basis threat scenarios. So it ranges from
active-shooter scenarios to arson to water to small aircraft.
Based on those scenarios and physical--the facility security
level, the facility is responsible for implementing the
physical security criteria.
All of the member agencies, according to the Executive
Order, shall comply with the standards that they develop. So I
would say over the course of the last 17 years, we have been
very successful in helping implement a baseline security
standard for non-military Federal facilities.
Ms. Jackson Lee. What is the oversight? Who is checking?
Ms. Durkovich. At this juncture, we do not have the
resources to do formal compliance. Many of our member agencies
have developed risk assessment tools that allow them to ensure
that they are in compliance with these standards.
We are looking at ways to begin more of a soft compliance
effort, but again, the Executive Order requires our member
agencies to comply with the standards that this interagency
body develops.
Mr. Duncan. Ms. Jackson Lee, we may have time for another
round of questions. So I----
Ms. Jackson Lee. But can I just thank you very much for
your courtesies? I would just like to put one question on the
record. I will not ask for an answer. I didn't hear from Mr.
Patterson. That one question on the record, if we could get an
answer, is: Does FPS do--FPS, does it do continuing background
checks on its contractors once the contract is given? Is there
an on-going check on the individuals that are utilized?
Mr. Chairman, Mr. Barber, thank you for your courtesy.
Mr. Duncan. Thank you, Ms. Jackson Lee.
That is a question we can have answered.
I am going to go into a second round of questioning. I know
Members do have a lot of interest in this subject, including
myself.
I want to follow up on--I recognize myself for 5 minutes--I
want to follow up on an issue that Mr. Hudson brought up about
the radios, because I think that is important, communications
inside of a building and communication with local law
enforcement is tremendously important.
In my State, the Palmetto State, South Carolina, we learned
after Hurricane Hugo that law enforcement needs to be able to
communicate all across the State. I believe with a homeland
security grant back after 9/11, the State of South Carolina
went to an 800-megahertz radio system that we had highway
patrol and DNR, and local sheriffs' agencies were all able to
communicate in the event of an emergency.
I understand that inside the District of Columbia, FPS may
not want to hear all the chatter that is going on on the Hill
and at the White House and at every other Federal building.
That could be a little overwhelming if you were having to
monitor all of that. But in the event of an active shooter, can
they communicate with other law enforcement personnel about
what is actually going on?
So I am going to ask Mr. Marshall if you could just follow
up on that. What are we doing? What steps are we taking to
address the issue raised by the gentleman from North Carolina?
Mr. Marshall. Congressman, I would like nothing better than
to have an 800-megahertz radio capability within DHS. Speaking
first-hand, like I said, I have implemented that in the local
police department here in Maryland, a neighboring police
department. The capabilities are tremendous with an 800-
megahertz radio system.
You don't have to listen to, like you said, all the chatter
at the Federal buildings and so forth. But in the event of an
active shooter, you would be notified to go to a specific talk
group, everybody involved in that incident, say. Let's use the
DHS headquarters, for example, on Nebraska Avenue. If, God
forbid, something were to happen at DHS headquarters, we can
notify our colleagues at the Federal Protective Service,
Metropolitan Police Second District, my force protection group,
to all go to a specific talk group to handle that incident.
You are absolutely right. That capability is vital in any
kind of incident.
Mr. Duncan. Would something like an 800-megahertz system be
able to penetrate most of the walls so most of the Federal
facilities would be able to communicate?
Mr. Marshall. Yes, sir. In my experience now, obviously, we
would have to do something called acceptance testing. We would
have to--once we were able to acquire that capability, we would
have to go to certain spots on a grid and test the radio to
find out where those dead spots might be. But from my
experience, it works in like 99 percent of the locations, at
least where I came from.
But again, that capability is vital. So if that is
available, I know those 800-megahertz frequencies are like
hen's teeth. They are hard to get your hands on, because I
think most of them are taken up. But I believe the Metropolitan
Police is on an 800-megahertz system. If for some reason we
could--or some, you know, capability to attach ourselves to the
Metropolitan Police or, for that matter, Federal Protective
Service or any other Federal Government agency who has that
800-megahertz frequency, that would be the ideal situation in
the District of Columbia.
Mr. Duncan. Right. Well, thanks for that. I may have taken
Mr. Hudson's question, but it was on my mind.
I want to ask you one other thing. Mr. Marshall, what have
we learned about background checks and information flow that
would affect clearances like we saw with the Navy Yard shooter,
where local law enforcement, even supervisory positions within
the agency they worked for, they had indicators?
So how does that--what have we learned? How does that
information flow down to the person that makes the decision on
who gets clearances or not? Just tell me what we have learned
and how we are applying it.
Mr. Marshall. Okay. First of all, you mentioned the local
agencies. One of the things I have always been troubled with
with respect to local agencies is that there are roughly
between 18,000 and 20,000 police departments or law enforcement
agencies, sheriffs, local police, State police, and Federal
agencies within the United States.
The thing that has troubled me about what, the information
we receive from the State and locals and the Federals, is that
not all of those agencies contribute to, like, the FBI CJIS
system. A person can be arrested in your State, the Palmetto
State, and some small police department. They may not be a
contributor to the FBI database. So that when we go to do our
agency checks and our fingerprint checks, we may not have
access to that information of that person's arrest within South
Carolina.
So, that is a gap. That is a gap that I think can be
remedied. I don't know what it would take, maybe legislation
perhaps, but that if we can get more of these agencies--and I
don't know what percentage that are out there that don't
contribute. But I believe it is large enough that we could
probably close that gap somewhat by maybe encouraging,
legislating for these folks to contribute, particularly if they
get Homeland Security money.
Now, with respect to the second part of your question,
again, I wasn't briefed on the Navy Yard shooting specifically.
But what I know through the media accounts and some anecdotal
comments or conversations I have had with other people, from
what I know, Mr. Alexis had a security clearance with the Navy.
When he left the Navy, it was still an in-scope clearance,
meaning that the investigation was within the required time
frame in order for the organization he was going to to accept
that investigation on reciprocity.
We are required by Executive Order in the Federal
Government to accept security clearances on reciprocity if
there is an investigation that we can point to. The one thing
about reciprocity is that we are also required to accept it on
its face. We are not allowed to do any additional checks unless
we have information--derogatory information to the contrary.
So, it looks to me, not having been briefed, that the
contracting company accepted Mr. Alexis's security clearance on
reciprocity, which was one gap, without having to do additional
checks. That also there was a faulty investigation. There was
information within the investigation that was done by a private
contractor that wasn't accurate.
So, it was almost like a perfect storm. It was a gap that
was--it was unfortunately hard to overcome.
Mr. Duncan. Yes, we are human. I get that.
Mr. Marshall. Yes, sir.
Mr. Duncan. Timing is everything. So, I don't have any
further questions. I will ask the gentleman from North Carolina
if he would like to follow up with a 5-minute question.
Mr. Hudson. Thank you, Mr. Chairman.
I guess I would like to maybe get back to this issue of
communications between, you know, FPS and the local and State
agencies. Mr. Marshall mentioned there are 18,000 to 20,000 law
enforcement agencies around the United States.
In terms of passing along warnings, intelligence,
information about suspects, could you, Mr. Marshall, and also
Director Patterson answer if you like, maybe talk about what
the gaps are that exist there, whether it is information flow
from DHS down or from local law enforcements up, FPS, back and
forth.
What are the gaps in communications? What are the real
challenges?
I know some were highlighted with the Boston bombing
incident, others may--we may have learned lessons from the Navy
Yard. But what are some of the challenges we are facing when it
comes to that up-and-down communication?
Mr. Marshall. Well, Congressman, we are very fortunate in
the Washington, DC, area to have so many law enforcement
agencies, both Federal and local, and, of course, the regional
county police departments.
We are all members of that fraternity here, within this
region. I believe we communicate very well together. We are all
part of different working groups and organizations,
intelligence organizations.
So, I believe our sharing capability is a good one here,
within this region.
Where I have seen some gaps during my time here is when you
get outside of this D.C. area and you deal with people who are
coming in from other parts of the country. We don't always
communicate well in that regard.
We rely heavily on information from the criminal justice
information system. If we see somebody suspicious, obviously,
we would rely on a radio check for, you know, a criminal
history check or a radio check, wants and wanted type of BOLOs
and so forth.
But regionally, I think we are okay. It is when we get
outside of this region where I don't think we share often as
well as we should.
Mr. Hudson. Director Patterson.
Mr. Patterson. Yes, sir. I would agree with Mr. Marshall
that within the region here, I think we do a pretty good job.
Part of the challenges that we have in FPS is that, as you
well know, we are in 50 States. Some of our inspectors have to
travel a very long way to move from facility to facility,
sometimes between States.
The challenge there sometimes is that the radio--the
connectivity that they have when they leave one State to go to
another State, we lose it.
So we have to work within those States or with other
Federal agencies to try to help us bridge between the
facilities, sometimes, that our inspectors may travel.
On the intelligence side of things, though, I think we do
pretty well, because we try to link up with each one of the
States' fusion centers, as many as we can. We have people that
are linked and members of the joint terrorism task forces.
So relative to threat information and those kind of things,
we think we move that information fairly well up and down and
have pretty good access.
It is sometimes--what concerns me sometimes is just the
ability and officer safety issue of, can my officer or can my
inspector communicate or call for help if, in fact, he runs
into a problem, if he is maybe somewhere in the northern tier,
where it is--he is right out in the middle of nowhere and help
is a bit of ways away, and he has got to figure out which radio
he is or how he is gonna communicate back to ask for help?
We are working that. We are working within the Department,
and we are working with State and local as well as other
Federal agencies, again, to bridge those gaps where we
recognize them.
Mr. Hudson. Appreciate that. Obviously I think this
committee is very concerned about this issue, so please keep us
informed as you move forward with this.
Just to sort-of redirect a little bit, Ms. Durkovich, you
talked a little bit about sort-of different facilities that are
leased or owned by GSA and the different security level
depending on the type of facility.
You talked about the fact that ISC has set security
standard guidelines for these non-Federal--or non-military
Federal facilities.
How well does the Federal Protective Service, in your
opinion, follow these policies? Does their adherence differ
based on the different type of location of the Federal
facilities?
Ms. Durkovich. Let me begin--and, first of all, thank you
very much for that question--but by saying that FPS is an
active member of the Interagency Security Committee.
We have worked over the course of the last several years,
both at--within the Office of Infrastructure Protection, but
certainly with--within ISC to help them understand and
implement the various standards, guidelines, and practices that
we develop. Certainly, as they have worked to develop their own
assessment tool, it has been done with the ISC standards in
mind.
I would say that they do a very good job. Again, it varies
on the facility security level and the measures that are
implemented at each of those facilities. But they have to work
very closely with the facility security committee within each
of those buildings to ensure that they are providing a level of
security that is consistent with the Federal security level and
the standards that are outlined by the ISC.
They are, again, a very active participant in the ISC. They
sit on a number of our standing committees, on a number of our
working groups, to include the active-shooter working group.
They recently chaired a working group on prohibited Federal
items, which has become a standard for Federal facilities
across the Nation, and have worked very closely with us with
some best practices on armed security guards.
So they are an active, robust member, again of the ISC, and
I think do a very good job of implementing the standards and
best practices that we promulgate.
Mr. Hudson. Thank you.
Mr. Chairman, thanks for the leeway. I will yield back.
Mr. Duncan. Thank you, Mr. Hudson.
The Chairman will recognize the Ranking Member for the last
and final questions.
Mr. Barber. Thank you, Mr. Chairman.
Once again, thanks to our witnesses this morning for your
testimony and for the work you are doing to make sure that
Federal facilities, the people who work in them, and the people
who come to them are properly protected.
I just wanted to continue with a question for Mr. Patterson
regarding what you are doing proactively, I guess, to probe and
test how well safety and security standards are being
implemented.
Within the context of this open hearing, you may not be
able to say all, but what can you tell us about what you are
doing proactively to find out whether or not these facilities
are following the standards that have been established?
What do you do when you find that they are not?
Mr. Patterson. Sir. Yes, sir.
Well, one of the things that we are doing proactively is
that we are creating something called a portfolio approach for
each one of our inspectors. That means that the inspector will
take ownership of a series of buildings, okay, and within those
buildings will have responsibility to ensure that he or she are
meeting with the facility security committees and others in
there to ensure that we are, No. 1, in compliance or that they
are in compliance with whatever standards that have been set
forth for that facility.
So that is a very proactive approach by us to ensure that
we don't miss anything in a movement forward to better
understand how we can, if you will, better do our job.
We are working with the NASCO, the National Association of
Security Companies, in looking at how we can collaborate, how
we can partner in working in training our PSOs, relative to
giving them the best training, better training, and to fill in
the gaps that were pointed to today by the General Accounting
Office, so that the next time that we come before this
committee, we are not talking about some of the challenges that
we are having there, because we have, in fact, taken a
proactive approach in filling that, because we are working
collaboratively with the security companies.
We are also looking at partnering with local law
enforcement in areas, departments, to help us in our response
times, to ensure that when there are challenges for our
inspectors to get to Federal facilities, that we do have an
agreement and a partnership with them that they will respond
sometimes when we cannot.
So there are a myriad of things that we are looking for as
moving forward to ensure that we have a very comprehensive
approach to how the people, which are the most important thing,
are protected in those facilities in the event of something
bad, if you will.
Mr. Barber. Does your proactive work include deliberately
trying to breach these securities?
Mr. Patterson. Yes, sir, we have a program called the
covert testing program, where we actually have--we have a
number of scenarios that we introduce through the system when
we, through the magnetometer, X-ray, and it is done by our
special agents, who are trained in introducing these objects.
Once--you know, if there is a failure, then what we do is
we work with the contractor to, No. 1, that we have identified
a failure. Then we work to train those individuals so that
there is an understanding of what just happened, what did we
just do? How do we fix this? How do we rectify the situation so
that it doesn't happen again?
Sometimes we have to do it more than once, quite frankly,
to--it is the process of standing behind a magnetometer X-ray
machine, it can be a perishable skill if you are not doing it
often.
So one of the things that we are doing proactively is to
work with the contractors to look at, you know, how often this
training is being delivered to them? Then we are gonna look at
how often we are testing that, and then using a metric there to
see how well we are performing in that area.
Mr. Barber. Let me just ask you one last question before my
time expires.
Mr. Patterson. Sure.
Mr. Barber. Obviously, every Federal agency has been asked
to not only tighten their belt but cinch it up so tight you can
hardly breathe.
What impact have budget cuts or appropriation reductions
had on your ability to get the job done?
Mr. Patterson. We are still able to get the job done, sir.
You know, we have to work smarter. We look to how we leverage
technology to do things that maybe we had done using an
individual, and now--so, we are getting the job done, even with
the sequestration and some of the budget cuts that have been
coming. I am confident that we will continue to be able to
effectively get the job done as we move forward.
Mr. Barber. Thank you, Mr. Chairman. I yield back.
Mr. Duncan. I want to thank the committee Members for their
participation today, and thank the witnesses. As we mentioned,
I think the goal of the hearing was to provide oversight of the
DHS, and what it is currently doing to make sure that we
protect Federal facilities, and what steps, if any, need to be
taken to make sure that instances like the Navy Yard don't
happen at any other Federal facilities.
I want to thank you for your leadership and your valuable
testimony today. You answered a lot of questions for us as we
delved into that. So I want to thank you for that, and the
Members for their valuable questions.
Members of the subcommittee may have additional questions.
We ask that you respond to those in writing.
Without objection--any other questions, or without
objection, the subcommittee will stand adjourned.
[Whereupon, at 11:11 a.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Question From Chairman Jeff Duncan for L. Eric Patterson
Question. What is the status of the standardized National Lesson
Plan for guards, and the revising of the Security Guard Information
Manual (SGIM)?
When will the National Lesson Plan for guards be implemented?
Answer. The Federal Protective Service (FPS) recognizes that
ensuring that Protective Security Officers receive quality training is
key to the success of the FPS protective mission. As such, FPS is
working with the National Association of Security Companies (NASCO) to
conduct a curriculum review of all Protective Security Officer (PSO)
training. This review will consider long-standing requirements
pertaining to PSO training and will result in a comprehensive PSO basic
training curricula complete with written and performance measures. FPS
anticipates that the PSO National Lesson Plan will be finalized and
available for implemention in fiscal year 2015. The Security Guard
Information Manual (SGIM) is undergoing a complete revision and will be
released as the FPS Protective Security Officer Security Manager and
Resource Tool (SMART) Book. An updated version of the SMART Book is
expected to be released by the end of the second quarter of fiscal year
2014.
Questions From Ranking Member Ron Barber for L. Eric Patterson
Question 1. Does FPS conduct on-going evaluations of both its
contract guards and Federal workforce?
Answer. The Federal Protective Service (FPS) conducts rigorous and
continuous Protective Security Officer (PSO) contract performance
monitoring through various methods, including post inspections,
administrative audits, monitoring of contractor-provided training and
firearms qualifications, penetration tests, and obtaining customer
feedback. FPS adheres to policies and procedures to ensure proper
contract monitoring, including FPS Directive 15.9.1.3 ``Contract
Protective Security Force Performance Monitoring'' and Office of
Procurement Operations (OPO) Procurement Operating Procedure (POP)
403R4 ``Contractor Performance Assessment Reporting and Procedure''.
FPS Contracting Officers have the ability and authority to take
contractual actions to address contractor performance that does not
comply with contract terms and conditions. Specifically, FPS employs
remedies available under the Federal Acquisition Regulations and within
the terms of its contracts to address contractor performance issues. A
number of remedies are available for a contractor's non-performance or
unacceptable performance in FPS PSO contracts. Remedies include, but
are not limited to monitoring of contractor corrective action plans,
assessing monetary deductions, directing removal of a contractor
employee from performing under a contract, electing not to exercise a
contract option, or terminating a contract for default or cause.
To ensure robust contractor oversight, FPS is currently in the
process of hiring and training 39 Contracting Officer Representatives
(COR). CORs will assist FPS Contracting Officers in identifying adverse
contract performance and taking timely corrective action.
FPS adheres to the performance management regulations established
by the Office of Personnel Management, and guidelines of the Department
of Homeland Security and National Protection Programs Directorate to
evaluate Federal employee performance.
Question 2. Mr. Patterson, what protocols are used by FPS' facility
security officers and facility security committee members to determine
which standards to implement at Federal facilities?
Answer. The Federal Protective Service (FPS) provides Facility
Security Committee members with recommendations as part of the FPS's
Facility Security Assessment (FSA) process. FPS designed its FSA
process to meet the requirements of the Interagency Security
Committee's (ISC) Risk Management Process for Federal Facilities. The
FSA report provided by FPS includes an assessment of threats and
vulnerabilities, and a comparison of the baseline level of protection
called for in the ISC process with the existing level of protection at
the facility, and FPS's recommendations for countermeasures to mitigate
risk.
FPS has also established an FSA steering committee to ensure
consistency in implementation of the FSA program. The primary mission
of the Steering Committee is the coordination of all FSA-related
standards, programs, and operational applications. The Steering
Committee serves as the FSA consultation entity, providing
clarification and updates on development of the FPS FSA program. The
Steering Committee also assists FPS Regions with guidance on the
implementation of FSA reports, policies, and applications.
Question 3. How does FPS intend to address the shortcomings of its
risk assessment methodology as identified by GAO, particularly its
absence of a component to assess consequence?
Answer. The Federal Protective Service (FPS) has incorporated the
Interagency Security Committee's (ISC) Risk Management Process for
Federal Facilities into its current Facility Security Assessment (FSA)
process. Specifically, the FSA process includes the ISC's Facility
Security Level (FSL) Determinations, Physical Security Criteria for
Federal Facilities, and the Design Basis Threat as incorporated into
the Modified Infrastructure Survey Tool to identify and mitigate
vulnerabilities. FPS also conducts a threat assessment and provides a
Threat Assessment Report as part of each FSA, to ensure that
stakeholders have an understanding of the threats they face.
While potential impacts are considered as part of the FSL
determination, FPS is continuing to explore the inclusion of
consequence into the process. Quantifying applicable categories of
consequence for Federal facilities and incorporating them into an
algorithm in an assessment tool, however, is currently not feasible as
there is not a body of work existing to facilitate such development.
FPS continues to work with the ISC to explore consequences and impacts
in the context of Federal facilities and missions.
Question 4a. FPS has a long history of budget woes due to its
reliance on fees, and a workforce that has too many contract guard
staff. Further, GAO has documented that FPS' contract guard staff has
been about 13,000 since 2001.
What is the current ratio of contract guard to Federal guard staff
at FPS?
Question 4b. What elements are contained in FPS' contracts
pertaining to the training curriculum used by private firms to train
and certify guards?
Answer. To accomplish its protective mission, the Federal
Protective Service (FPS) employs Law Enforcement Personnel as well as
contract Protective Security Officers (PSOs) who work in tandem to
attend to daily security needs at Federal facilities and respond to
threats directed against the facilities or the personnel working within
them. Law Enforcement Personnel and PSOs have separate, but
complementary, roles and responsibilities in ensuring Federal facility
security.
FPS directly employs approximately 1,007 Law Enforcement Personnel
who are trained physical security experts and sworn law enforcement
officers employed directly by the Federal Government. Law Enforcement
Personnel perform a variety of critical functions, including conducting
comprehensive security assessments of vulnerabilities at facilities,
developing and implementing protective countermeasures, and providing
uniformed police response and investigative follow-up. FPS Law
Enforcement Personnel also conduct PSO guard post inspections on a
daily basis.
FPS also contracts approximately 13,000 PSOs, often referred to as
``security guards.'' PSOs are responsible for controlling access to
Federal facilities, detecting and reporting criminal activities, and
responding to emergency situations.
PSOs also ensure prohibited items, such as firearms, explosives,
knives, and other dangerous weapons, do not enter Federal facilities.
It is important to note that PSOs are not sworn Law Enforcement
officers. FPS works with the private guard companies to ensure the
guards have met the certification, training, and qualification
requirements specified in the contracts. These include, but are not
limited to, FPS orientation, National Weapons Detection training,
weapons qualification for both lethal and non-lethal weapons, FPS Basic
Training, which covers subject areas such as defensive tactics, legal
authorities, and response to incidents such as workplace violence, and
bomb threats, and any State, local, and customer-specific requirements.
It is important to note that the FPS does not unilaterally
determine the total number of PSOs Nationally. Rather, the FPS works in
partnership with tenant Facility Security Committees to build a
consensus regarding the number of guard posts appropriate for each
individual facility. The number of posts is determined by a number of
factors, including a facility's security level, Facility Security
Assessment, and the security needs and preferences of tenant agencies.
Questions From Chairman Jeff Duncan for Caitlin Durkovich
Question 1. Ms. Durkovich, in your role as chair of the Interagency
Security Committee, what steps are you taking to make sure that Federal
agencies are compliant in utilizing the committee's standards for
physical security?
Answer. Executive Order (EO) 12977 states that each executive
agency and department shall cooperate and comply with the policies and
recommendations of the Interagency Security Committee (ISC) issued
pursuant to the order, but at this time the committee does not have the
resources to carry out enforcement for nearly 400,000 facilities
Nation-wide. The ISC relies on agencies to conduct their own compliance
as required by the EO.
That said, the ISC is examining potential options to support
agencies' compliance efforts and is currently reviewing internal member
agencies' best practices and lessons learned to develop a strategy to
propose to the ISC membership. This work is being conducted through the
ISC's Lessons Learned and Best Practices Working Group; a group
established as a result of Government Accountability Office (GAO)
Recommendation Report GAO 12-901 Federal Real Property Security--
Interagency Security Committee Should Implement a Lessons Learned
Process.
Additionally, the ISC has also developed a strategy for Federal
departments and agencies to ensure risk assessment data tools are
compliant with ISC standards. To date, one tool has been certified as
ISC compliant and another tool is in the queue for certification.
Question 2. Please explain the actions your staff is taking to
increase the rate of utilization of the committee's standards.
Answer. The ISC is developing an outreach strategy to improve
engagement, marketing, and training efforts. The plan defines the goals
and objectives of future outreach efforts; specifies the target
audience of outreach activities; and describes outreach options. This
strategy also consists of a number of on-line training programs,
personal interaction, printed materials, and on-line communications.
The ISC currently relies on Chief Security Officers (CSOs) and
working group representatives to share information about ISC standards
and best practices. The ISC is developing an enhanced outreach plan to
increase awareness and improve marketing and training efforts. The plan
will increase marketing activities, providing CSOs with materials they
can share with their facilities, as well as new on-line training
programs, on-line communications, and greater personal interaction.
Question 3. How do you evaluate the outcomes of your agency's
outreach efforts in terms of measuring Federal agencies' usage of the
Interagency Security Committee's standards?
Answer. As noted above, the ISC is currently assessing and
enhancing its outreach efforts. The Interagency Security Committee
Outreach Strategic Plan will provide a foundation for the ISC's
implementation of outreach activities to increase awareness,
understanding, and use of the ISC Standards, guidelines, best
practices, and white papers among Federal agencies. The ISC developed a
plan that defines the goals and objectives of future outreach efforts;
specifies target audiences; and describes three categories of outreach
options: Printed materials, personal interaction, and on-line
communications which is consistent with the GAO's recommendations. An
important aspect of the ISC's outreach is training and the ISC is
currently doubling training available to Federal agencies. Both on-line
and in-person training will be amplified through implementation of the
plan. The implementation of the outreach plan will enable the ISC to
better measure the most effective and efficient approach for increasing
awareness, understanding, and application of the ISC standards.
Question From Chairman Jeff Duncan for Greg Marshall
Question. During the October 30 hearing, you discussed remotely
deactivating access credentials if a change in an individual's
suitability occurs. To clarify, how long does the deactivation process
take? Can it be done in real time to avoid potential threat?
Answer. The deactivation process can be done in real time and from
remote locations. Execution of this access removal process includes the
revocation of the individual's Personal Identification Verification
Card (PIV card) in the Identity Management System (IDMS), suspension of
access in the electronic physical access control system (PACS) that
services the component who employs the individual, and updates to
security guard post orders to include ``Do Not Admit'' instructions
associated with the individual. Manual notifications are provided via
email and/or telephone to all respective organizational points of
contact to support facilities where either visual inspection or
electronic verification is performed. Automated PIV card revocation
checks is a functionality that is supported by the IDMS. DHS is
currently working to deploy this capability to all the components.
Questions From Ranking Member Ron Barber for Greg Marshall
Question 1. Mr. Marshall, please explain to the committee what
standards are involved in granting individuals' access to Federal
facilities. Also, what process is used to identify and individual as
being suitable for Federal employment?
Question 2. Also, please describe to the committee how the mental
health of an individual is taken into consideration when making a
determination about his or her suitability for Federal employment?
Answer. All individuals working for or on behalf of the DHS must
undergo a background investigation with favorable results. In order for
an individual to gain access to a DHS facility, a criminal history
check with favorable results must be completed. For issuance of a PIV
card, the background investigation must be initiated in accordance with
Homeland Security Presidential Directive 12 requirements.
DHS adheres to all Federal regulations and guidelines for
suitability for Federal employment. DHS uses the criteria set forth in
5 Code of Federal Regulations, Part 731, to assess an individual's
suitability. The individual completes security paperwork, Standard Form
(SF) 85P, and undergoes a background investigation. Based on the
suitability criteria, an adjudicative determination is made whether the
individual will promote the integrity and efficiency of the service.
Currently, there are no requirements for individuals to report
mental health information when applying for Federal employment for non-
cleared positions; however, OPM does permit agencies to use the SF 85P-
S supplemental form for positions that require the carrying of a
firearm. This supplemental questionnaire does require individuals to
report consultation with mental health professionals and/or health care
providers regarding a mental health condition. Otherwise, when DHS
adjudicates a background investigation, the mental health condition of
an individual is only considered to determine eligibility for access to
National security information. It is reviewed when the individual
chooses to report this information on standard security form SF-86, or
during investigative interviews and other records checks. In cases
where mental health information is not reported in an investigation by
the individual, references, or by review of records, potential mental
health issues are not examined. This poses a vulnerability and risk to
the Department.
In National security clearance investigations, DHS can obtain
mental health records when the information is reported either on the
security forms or through investigative interviews. This is in
accordance with Executive Order 12968, Access to Classified Information
and its implementing guidance. Additionally, the Adjudicative
Guidelines for Determining Eligibility for Access to Classified
Information requires DHS to evaluate an individual's ability to handle
and protect National security information. DHS renders adjudicative
determinations for access to classified material.
When evaluating the information, DHS must apply the adjudicative
criteria, which includes evaluating whether an individual's mental
health condition adversely affects the individual's judgment and
trustworthiness to safeguard classified information.
Question 3. Mr. Marshall, what authority and access do you as a
security professional have to the mental health records of individuals
seeking approval for access into Government facilities, or to be
cleared for Federal employment?
Answer. As a security professional, I do not have categorical
access to mental health records for the approval of access into DHS
facilities or to be cleared (suitable) for Federal employment. In
National security clearance investigations, DHS can only obtain mental
health records when the information is reported either on security
forms or through investigative interviews, and then only with the
consent of the individual being investigated and the cooperation of the
provider. At DHS, when applicants submit their security forms, included
in their packages are signed release forms that allow investigators the
ability to pursue information reported by the applicants on their SF 86
or other security/suitability questionnaire. The applicant's signature
signals ``consent'' and the intent of the applicant for mental health
providers to ``cooperate'' with any investigation. This is in
accordance with Executive Orders and implementing guidance.
Question 4. With regard to suitability assessments, does the
Department contract with private firms to conduct background checks? If
so, who is responsible for vetting contractors who conduct the checks?
Answer. Yes, the Department does contract with private firms to
conduct background checks. The Office of Personnel Management and the
Department of Defense have oversight responsibility for the background
investigation contract workforce. OPM delegates investigative authority
to certain DHS components, who then employ contract background
investigators. It is a requirement of the delegation that contract
investigators must have been appropriately adjudicated. The Department
of Defense has responsibilities regarding the security clearance
adjudications of contract employees under the National Industrial
Security Program. DHS accepts reciprocity of the investigation and
adjudication of contract background investigators.
Questions From Chairman Jeff Duncan for Mark Goldstein
Question 1. Your testimony noted that taxpayer dollars may be put
at risk because of problems with FPS's risk assessment process.
Specifically, you said that these problems may result in facilities
with too much or too little protection.
On this issue, I think back to earlier in the year when many were
alarmed by FPS's presence at protests outside IRS buildings. How does
the risk assessment process impact FPS's responses to specific events,
such as peaceful protests?
Answer. Risk assessments, which are among FPS's physical security
responsibilities, allow FPS to determine which protective measures
should be in place at a facility. Responding to events/incidents, such
as peaceful protests, is among FPS's law enforcement responsibilities.
While the risk assessment process does not directly influence how FPS
responds to specific events, it allows FPS to determine whether and
what types of protective measures are needed to help mitigate the risks
associated with these events.
Question 2. How does the fact that FPS collects fees for certain
services impact the oversight performed by DHS? Do you think because
FPS collects fees for certain security services that less oversight is
conducted by DHS than if the programs were based on appropriations?
Answer. We have not conducted the work necessary to answer this
question. For information on FPS's fee design, proposed alternatives,
and challenges related to FPS and customer agency budget formulation,
please see GAO's May 2011 report Budget Issues: Better Fee Design Would
Improve Federal Protective Service's and Federal Agencies' Planning and
Budgeting for Security (GAO-11-492).
Questions From Ranking Member Ron Barber for Mark Goldstein
Question 1. Mr. Goldstein, is there a need to impose a uniform
physical security screening standard across the Federal Government?
Also, should the Capitol Hill standard of administering a full
screening of all personnel and visitors to Federal facilities
regardless of their security clearance status be adopted?
Answer. We have not conducted the work necessary to answer this
question.
Question 2. What process do agencies and departments use to
determine which physical screening standards to apply throughout the
Federal Government?
Answer. To determine which physical screening measures to implement
at Federal facilities, Federal agencies generally conduct risk
assessments. These assessments evaluate the threat, vulnerability, and
consequence of undesirable events (such as terrorist attacks or other
acts of violence) occurring at a facility. After the assessments are
completed, the information is used to determine risk and to recommend
countermeasures, such as physical screening measures, to mitigate it.