The key component of DOE’s well-established, risk-based security  practices is the DBT, a classified document that identifies the  characteristics of the potential threats to DOE assets. The DBT has been  traditionally based on a classified, multiagency intelligence community  assessment of potential terrorist threats, known as the Postulated Threat. DOE Took Immediate Steps to Improve Security in the Aftermath of September 11, 2001, but the Effectiveness of These Steps Is Uncertain

DOE took immediate steps to improve physical security in the aftermath  of the September 11, 2001, terrorist attacks. With  respect to improved security, DOE security officials believe that the  implementation of SECON levels 2 and 3 has, for example, increased the  visible deterrence at DOE sites by placing more protective forces around  the sites. Studies and analyses have also resulted in different and less  vulnerable storage strategies for some special nuclear material. While some of the SECON  measures, such as vehicle inspection checkpoints, have undergone some  limited performance testing of their effectiveness, most DOE sites  generally have not assessed the SECON level measures in place using the  vulnerability assessment tools, such as computer modeling and full-scale  force-on-force performance tests, that play such a key role in developing  and verifying protective strategies at their sites. Second, increased SECON measures have been expensive. Development of the New DBT Took Almost 2 Years Because of Delays in Developing the Postulated Threat and DOE’s Lengthy Review and Comment Process

Under DOE Order 470.1, the DBT is intended to provide the foundation for  all of DOE’s protective strategies. According to DOE and DOD officials, this delay was the result of other  post September 11, 2001, demands placed on the intelligence community,  as well as sharp debates among the organizations involved with  developing the Postulated Threat over the size and capabilities of future  terrorist threats and the resources needed to meet these projected threats. First, while the May 2003 DBT identifies a larger terrorist group than did  the previous DBT, the threat identified in the new DBT in most cases is  less than the terrorist threat identified in the intelligence community’s  Postulated Threat. Finally, the department’s criteria for determining the severity of  radiological, chemical, and biological sabotage may be insufficient. DOE Has Been Slow to Resolve a Number of Significant Issues That May Affect the Ability of its Sites to Fully Meet the Threat Contained in the New DBT

While DOE issued the final DBT in May 2003, it has been slow to resolve a  number of significant issues that may affect the ability of its sites to fully  meet the threat contained in the new DBT in a timely fashion. Second, DOE also only recently provided additional DBT implementation  guidance. Consequently, the  fiscal year 2006 budget may be the first budget to begin to accurately  reflect the safeguards and security costs of meeting the requirements of  the new DBT. The department plans to complete DBT implementation by the end of  fiscal year 2006. For example, one NNSA site already has developed  detailed plans and budgets to meet the new DBT requirements. Conclusions

DOE took a series of immediate actions in response to the terrorist attacks  of September 11, 2001. Rather,  DOE must press forward with a series of actions to ensure that it is fully  prepared to provide a timely and cost effective defense.
Why GAO Did This Study

A successful terrorist attack on Department of Energy (DOE) sites containing nuclear weapons or the material used in nuclear weapons could have devastating consequences for the site and its surrounding communities. Because of these risks, DOE needs an effective safeguards and security program. A key component of an effective program is the design basis threat (DBT), a classified document that identifies the potential size and capabilities of terrorist forces. The terrorist attacks of September 11, 2001, rendered the then-current DBT obsolete. GAO examined DOE's response to the September 11, 2001, terrorist attacks, identified why DOE took almost 2 years to develop a new DBT, analyzed the higher threat in the new DBT, and identified the remaining issues that need to be resolved in order for DOE to meet the threat contained in the new DBT.

What GAO Found

DOE took a series of actions in response to the terrorist attacks of September 11, 2001. While each of these has been important, DOE must press forward with additional actions to ensure that it is fully prepared to provide a timely and cost effective defense. DOE took immediate steps to improve physical security in the aftermath of the September 11, 2001, terrorist attacks. DOE's most visible effort involved moving to higher levels of security readiness, known as security condition (SECON) levels. While this effort has increased the visible deterrence at DOE sites, it has been expensive and has resulted in fatigue, retention problems, and less training for most sites' protective forces. In addition, the effectiveness of these increased SECON levels generally have not been assessed using the vulnerability assessment tools, such as computer modeling and full-scale force-on-force exercises, that DOE routinely uses to develop protective force strategies for its sites. Development of the new DBT took almost 2 years because of (1) delays in developing an intelligence community assessment--known as the Postulated Threat--of the terrorist threat to nuclear weapon facilities and (2) DOE's lengthy comment and review process for developing policy. In addition, during the DBT development process, there were sharp debates within DOE and other government organizations over the size and capabilities of future terrorist threats and the availability of resources to meet these threats that contributed to the delay. While the May 2003 DBT identifies a larger terrorist threat than did the previous DBT, the threat identified in the new DBT in most cases is less than the threat identified in the intelligence community's Postulated Threat, on which the DBT has been traditionally based. The new DBT identifies new possible terrorist acts such as radiological, chemical, or biological sabotage. However, the criteria that DOE has selected for determining when facilities may need to be protected against these forms of sabotage may not be sufficient. DOE has been slow to resolve a number of significant issues, such as issuing additional DBT implementation guidance, developing DBT implementation plans, and developing budgets to support these plans, that may affect the ability of its sites to fully meet the threat contained in the new DBT in a timely fashion. Consequently, DOE's deadline to meet the requirements of the new DBT by the end of fiscal year 2006 is probably not realistic for some sites.