Threat Information and Vulnerability of Potential Targets Inform National and Sector- or Location- Specific Threat Level Decisions

In implementing the Homeland Security Advisory System, DHS assigns  national threat levels and assesses the threat condition of specific  geographic locations and industrial sectors. In addition, HSPD-3 states  that the Homeland Security Advisory System should provide a  comprehensive and effective means to disseminate information regarding  the risk of terrorist acts to federal, state, and local authorities. Moreover, some states reported that their ability to provide credible  information to state and local agencies and the public was hindered  because they did not receive notification from DHS before the media  reported on the threat level changes. Federal Agencies Reported Implementing Few New Protective Measures for Code- Orange Alerts because They Always Operate at High Security Levels, While States Varied Their Responses

The majority of federal agencies responding to our questionnaire indicated  that they maintain high security levels regardless of the national threat  level and, as a result, they did not need to implement a substantial number  of new or additional protective measures to respond to the three periods of  code-orange alert from March 17 to April 16, 2003; May 20 to 30, 2003; and  December 21, 2003, to January 9, 2004. Based on the information provided by federal agencies, total additional  costs reported by federal agencies responding to our questionnaire for the  March 17 to April 16, 2003, and May 20 to 30, 2003, code-orange alert  periods were less than 1 percent of these agencies’ fiscal year 2003  homeland security funding, as reported to OMB. Some federal agencies  responding to our questionnaire indicated they could not quantify these  indirect costs. However, DHS has not yet  officially documented its protocols for communicating changes in the  national threat level, as well as guidance and threat information, to federal  agencies and states. Risk communication experts suggest that warnings should  include the following principles to provide for early, open, and  comprehensive information dissemination and for informed decision  making: (1) communication through multiple methods, (2) timely  notification, and (3) specific information about the nature, location, and  timing of the threat and guidance on actions to take. Recommendations for Executive Action

We recommend that the Secretary of Homeland Security direct the Under  Secretary for Information Analysis and Infrastructure Protection to take  the following two actions: (1) document communication protocols for  notifying federal agencies and states of changes in the national threat level  and for providing guidance and threat information to these entities,  including methods and time periods for sharing information, to better  manage these entities’ expectations regarding the methods, timing, and  content of information shared; and (2) incorporate risk communication  principles into the Homeland Security Advisory System to assist in  determining and documenting information to provide to federal agencies  and states, including, to the extent possible, information on the nature,  location, and time periods of threats and guidance on protective measures  to take in response to those threats. See appendix V for additional information on cost  information reported by federal agencies. We examined this information to identify the methods used by  DHS to collect cost information from states and localities. However, this cost information  does not represent all additional costs incurred by states and localities  during code-orange alert periods. 5. Received? Received? Costs Incurred During the HSAS Code-Orange Alerts

20. 28. 56.
Why GAO Did This Study

Established in March 2002, the Homeland Security Advisory System was designed to disseminate information on the risk of terrorist acts to federal agencies, states, localities, and the public. However, these entities have raised questions about the threat information they receive from the Department of Homeland Security (DHS) and the costs they incurred as a result of responding to heightened alerts. This report examines (1) the decision making process for changing the advisory system national threat level; (2) information sharing with federal agencies, states, and localities, including the applicability of risk communication principles; (3) protective measures federal agencies, states, and localities implemented during high (codeorange) alert periods; (4) costs federal agencies reported for those periods; and (5) state and local cost information collected by DHS.

What GAO Found

DHS assigns threat levels for the entire nation and assesses threat conditions for geographic regions and industrial sectors based on analyses of threat information and vulnerability of potential terrorist targets. DHS has not yet officially documented its protocols for communicating threat level changes and related threat information to federal agencies and states. Such protocols could assist DHS to better manage these entities' expectations about the methods, timing, and content of information received from DHS. To ensure early, open, and comprehensive information dissemination and allow for informed decisionmaking, risk communication experts suggest that warnings should include (1) multiple communication methods, (2) timely notification, and (3) specific threat information and guidance on actions to take. Federal agencies and states responding to GAO's questionnaires sent to 28 federal agencies and 56 states and territories generally indicated that they did not receive specific threat information and guidance, which they believe hindered their ability to determine and implement protective measures. The majority of federal agencies reported operating at heightened security levels regardless of the threat level, and thus, did not need to implement a substantial number of additional measures to respond to code-orange alerts. States reported that they varied in their actions during code-orange alerts. The costs reported by federal agencies, states, and selected localities are imprecise and may be incomplete, but provide a general indication of costs that may have been incurred. Additional costs reported by federal agencies responding to GAO's questionnaire were generally less than 1 percent of the agencies' fiscal year 2003 homeland security funding. DHS collected information on costs incurred by states and localities for critical infrastructure protection during periods of code-orange alert. However, this information does not represent all additional costs incurred by these entities during the code-orange alert periods.