State Conducts a Range of Activities to Assess Risks to Residences Overseas, but Weaknesses Exist in Security Surveys at Posts

State assesses risks to U.S. diplomatic residences overseas using a  range of activities, but many security surveys were not completed for  residences we visited. We found that State (1) records and monitors  information on overseas residences in its property database, (2)  establishes threat levels at overseas posts, (3) develops security  standards for residences, and (4) uses these standards to conduct  security surveys of residences to identify vulnerabilities. Without up-to-date security surveys of all its overseas residences, State  has limited ability to effectively and efficiently identify vulnerabilities or  make informed decisions about where to allocate resources for security  upgrades to address such vulnerabilities. State’s Updates of Security Standards for Residences Have Not Been Timely, and the Standards Are Difficult to Use

Over the last decade, State has taken steps to develop or revise several  sets of OSPB residential security standards. Moreover, the OSPB  standards and other security-related guidance for residences are  confusing in nature and contain gaps and inconsistencies, thereby  complicating posts’ efforts to apply the appropriate security measures and  potentially leaving residences at risk. According to DS officials, it should take about 75  days to make an update to the OSPB standards. Relevant Security Standards and Other Security-Related Guidance for Residences Are Confusing in Nature and Contain Gaps and Inconsistencies, Making Them Difficult to Use

According to federal internal control standards, policy standards should  be clear, complete, and consistent in order to facilitate good decision  making in support of agency objectives. In instances when a residence does not and cannot  meet the applicable security standards, posts are required to either seek  other residences or request exceptions, which identify steps the posts will  take to mitigate vulnerabilities. Without all necessary exceptions in place, State  lacks information that could provide decision makers with a clearer picture  of security vulnerabilities at residences and enable them to make better  risk management decisions. State Uses Security Upgrades to Address Residential Security Vulnerabilities

State addresses security vulnerabilities at residences by installing various  kinds of upgrades intended to help residences meet, or in some cases  exceed, the applicable standards. Nearly All of the Residences We Visited That Did Not Meet All Mandatory Standards Were Missing Required Exceptions

Of the 38 residences we reviewed that did not meet all of the applicable  mandatory standards, DS had an exception on file for only 1. State Has Taken Steps to Manage Risks to Schools and Other Soft Targets, but Its Efforts May Be Constrained by Limited Awareness of Relevant Guidance and Tools

State’s efforts to protect U.S. personnel and their families at schools and  other soft targets include funding physical security upgrades, providing  threat information and security-related advice, and conducting security  surveys of various soft target facilities. However, RSOs at most of the  accompanied posts we visited were unaware of some guidance and tools  for securing these facilities. State has  established guidance for RSOs regarding the security of schools and  other soft targets as well as tools to assist RSOs’ security-related  outreach with schools, but half of the RSOs we met with at the six  accompanied posts stated that the only guidance or tools they were  aware of with respect to schools and soft targets was a cable with  information on the types of items that can be funded through the Soft  Target Program. Because of limited awareness of the guidance and tools for securing  schools and other soft targets, State may not be fully leveraging its  existing programs and resources for addressing the security needs of  schools and other soft targets. While State has taken significant measures to enhance  security at its embassies and consulates since the 1998 East Africa  embassy bombings, these same actions have given rise to concerns that  would-be attackers may shift their focus to what they perceive as more  accessible targets, such as diplomatic residences, schools, and other  places frequented by U.S. personnel and their families. Institute procedures to improve posts’ compliance with requirements  for conducting residential security surveys. Develop procedures for ensuring that all residences at posts overseas  either meet applicable standards or have required exceptions on file. Appendix I: Objectives, Scope, and Methodology

The objectives of our report were to evaluate (1) how the Department of  State (State) assesses risks to residences overseas; (2) the timeliness,  clarity, and consistency of State’s security standards for residences; (3)  how State addresses security vulnerabilities at residences; and (4) how  State manages risks to other soft targets overseas.
Why GAO Did This Study

Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive “soft targets.” GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015.

What GAO Found

The Department of State (State) conducts a range of activities to assess risks to residences overseas. For instance, State tracks information on overseas residences in its property database, establishes threat levels at overseas posts, develops security standards for different types of residences and threat levels, and requires posts to periodically conduct residential security surveys. However, 17 of the 68 surveys for residences GAO reviewed were untimely or missing. Without up-to-date security surveys of all its overseas residences, State's ability to identify and address vulnerabilities or make informed decisions about where to allocate resources for security upgrades is limited.
State has taken steps to update its residential security standards; however, these updates have not been timely, and the standards are difficult to use. According to State officials, updating residential security standards should take about 75 days, but all three updates since 2005 took more than 3 years each. State is making efforts to improve the timeliness of such updates in response to a prior GAO recommendation. In addition, while federal internal control standards state that policy standards should be clear and consistent to support good decision making, State's standards and other security-related guidance for residences have gaps and inconsistencies, complicating posts' efforts to determine and apply the appropriate security measures and potentially leaving some residences at risk.
State addresses security vulnerabilities at residences by installing various upgrades intended to help residences meet security standards, but 38 of the 68 residences GAO reviewed did not meet all applicable standards. For example, 8 residences did not meet the standards for perimeter barriers. When residences do not and cannot meet all applicable security standards, posts are required to request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, State had an exception on file for only 1 of the 38 residences that did not meet all applicable standards. As a result, State lacks key information that could provide it with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions.
State manages risks to schools and other soft targets overseas in several ways, but its efforts may be constrained by limited awareness of relevant guidance and tools. In fiscal years 2010 through 2015, State awarded almost 400 grants in total for security upgrades at schools and other soft targets. While federal internal control standards call for timely communication of relevant information to staff responsible for program objectives, officials at most of the posts GAO visited were unaware of some guidance and tools for securing schools and other soft targets. As a result, State may not be fully leveraging existing programs and resources for addressing security needs at these facilities.

What GAO Recommends

GAO recommends that State, among other things, institute procedures to ensure residential security surveys are completed as required, clarify its standards and security-related guidance for residences, develop procedures to ensure residences either meet standards or have exceptions on file, and take steps to ensure posts are aware of existing guidance and tools regarding the security of schools and other soft targets. State concurred with all of GAO's recommendations.