In addition, we found that DOD does not have a policy in place for military  personnel and DOD affiliated-contractors to provide guidance on when it  would be appropriate to report to base security officials when an  individual is observed carrying a weapon on an installation, especially into  a work environment. However, DOD has not consistently shared information  about these actions throughout the department because DOD personnel  have not consistently used existing mechanisms. Other Actions Taken. Such actions include using random antiterrorism measures,  installing installation mass notification systems, and piloting a  workplace violence risk assessment program. DOD Has Not Consistently Shared Actions to Protect against Insider Threats

While the U.S. installations we visited have taken actions to protect  against insider threats, military services have not consistently shared this  information across the department because DOD officials are not  consistently using existing information sharing mechanisms. Such  mechanisms include working groups, conferences, lessons-learned  information systems, and antiterrorism web portals. DOD guidance and recommendations issued after the 2009 Fort Hood  shooting state that DOD should identify and share leading practices to  enhance the department’s ability to protect the force. Unless the military services share information across the  department on insider threats by consistently using existing mechanisms,  U.S. installations may miss opportunities to enhance the department’s  ability to protect the force against such threats. DOD Is in the Process of Implementing Recommendations from the 2009 and 2013 Official Reviews, but Inconsistent Reporting and Limited Monitoring Prevent Status Assessment

DOD has taken actions to implement the recommendations from the  official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard  shootings; however, we were unable to identify the number of Fort Hood  recommendations fully implemented because DOD and the military  services had inconsistently reported this information and have conducted  limited monitoring of recommendation implementation. In September 2014, as part of its effort to address a  recommendation that DOD integrate its disparate efforts to defend  against internal threats, DOD established policy and assigned  responsibilities for a DOD insider threat program. For example, service headquarters officials from three services  told us that they generally do not monitor implementation of the  recommendations from the reviews of the 2009 Fort Hood shooting at  the installation level. Further, until the Mission  Assurance Coordination Boards and military services consistently monitor  Fort Hood recommendation implementation at the service and installation  level, DOD will be unable to know whether the deficiencies identified in  the independent review of the 2009 Fort Hood shooting have been  addressed on U.S. installations. DOD Has Taken Initial Actions to Implement Washington Navy Yard Recommendations

In response to the official reviews from the 2013 Washington Navy Yard  shootings, the Secretary of Defense and the Secretary of the Navy  issued memorandums directing DOD components to implement the  recommendations and provide progress reports on the status of the  recommendations. For example, in June 2014, DOD issued an  implementation plan that lays out major milestones, timelines,  responsibilities, and resource requirements needed to address the  findings and four recommendations. While we found that 3 of the 10  key force protection policy and guidance documents do not address  insider threat considerations, DOD is taking steps to update these  documents. In response to our recommendation that the Secretary of Defense direct  the DOD leaders on the Mission Assurance Coordination Boards and the  military services to take steps to improve the consistency of reporting and  monitoring of the implementation of recommendations, DOD stated that  the Mission Assurance Senior Steering Group will monitor the status of  Fort Hood recommendations at the military service level to ensure full  implementation. Appendix I: Objectives, Scope, and Methodology

This report evaluates the extent to which the Department of Defense  (DOD) has (1) reflected insider threat considerations in its force protection  policies and other guidance, (2) shared actions that U.S. installations  have taken to protect against insider threats, and (3) implemented  recommendations from the official reviews of the 2009 Fort Hood and  2013 Washington Navy Yard shootings. We reviewed the key policies and other guidance documents to  determine whether DOD had reviewed and updated them to incorporate  recommendations from the independent review of the 2009 Fort Hood  shooting that directed the department to integrate force protection  efforts, such as developing policy and procedures to defend against  insider threats;  insider threat considerations based on annual review requirements  outlined in DOD Instruction 5025.01, DOD Issuances Program;  and  requirements for four minimum training topics addressing insider  threat awareness: the importance of detecting potential insider threats  by cleared employees and reporting suspected activity to insider  threat personnel or other designated officials; methodologies of  adversaries to recruit trusted insiders and collect classified  information; indicators of insider threat behavior and procedures to  report such behavior; and counterintelligence and security reporting  requirements.
Why GAO Did This Study

The attacks at Fort Hood, Texas, on November 5, 2009, and at the Washington Navy Yard, D.C., on September 16, 2013, drew nationwide attention to insider threats at DOD installations. DOD defines an insider threat as the threat that an insider will use her or his authorized access, wittingly or unwittingly, to do harm to the security of the United States.
House report 113-446 included a provision that GAO review DOD's antiterrorism and force protection efforts to address insider threats. This report evaluates the extent to which DOD has (1) reflected insider threat considerations in its force protection policies and other guidance, (2) shared actions that U.S. installations have taken to protect against insider threats, and (3) implemented recommendations from the official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings. GAO reviewed official reviews from the shootings, DOD force protection–related policies, interviewed agency officials, and visited eight nongeneralizable U.S. installations representing all four military services, a joint base, and different geographic locations.

What GAO Found

Since the 2009 Fort Hood shooting, the Department of Defense (DOD) has made efforts to update 7 of 10 key force protection–related policy and guidance documents and is taking steps to revise the remaining 3 to incorporate insider threat considerations. DOD's Fort Hood independent review recommended that the department develop policy and procedures to integrate disparate efforts to protect DOD resources and people against internal threats. GAO also found that DOD does not have a policy for when it would be appropriate for DOD military and contractor personnel to report to DOD base security officials when an individual is observed carrying a weapon on an installation, especially into a work environment. Senior DOD officials acknowledged this policy gap and agreed to take steps to address the issue.
Officials from the eight U.S. installations GAO visited identified actions taken to protect against insider threats. However, DOD has not consistently shared information across the department about the actions it has taken. DOD has issued guidance and recommendations addressing the 2009 Fort Hood shooting stating that DOD should identify and share leading practices to enhance the department's ability to protect the force. For example, installation officials have trained response personnel on active shooter training and piloted a workplace violence risk assessment program. However, DOD is not sharing all the information about such actions because DOD officials are not consistently using existing mechanisms to share information, such as lessons-learned information systems and antiterrorism web portals. Unless the military services consistently use existing mechanisms to share information on insider threats, U.S. installations may miss opportunities to enhance the department's ability to protect the force against such threats.
DOD has taken actions to implement the recommendations from the official reviews of the 2009 Fort Hood and 2013 Washington Navy Yard shootings. However, GAO was unable to identify the number of the 79 Fort Hood recommendations that were fully implemented because DOD has received inconsistent information from the military services and has conducted limited monitoring of recommendation implementation. For example, DOD and military service officials provided differing responses to a questionnaire on the implementation status of some Fort Hood recommendations. In addition, officials from three military services stated that they generally do not monitor the implementation of the recommendations from the Fort Hood independent review at the installation level. Until DOD and the military services improve the consistency of reporting and monitoring of the implementation of recommendations, DOD will be unable to know whether the deficiencies identified in the official review of the 2009 Fort Hood shooting have been addressed. With regard to the official reviews from the 2013 Washington Navy Yard shooting, DOD has taken initial actions towards implementing the four recommendations prioritized by the Secretary of Defense. For example, DOD issued an implementation plan that identifies milestones, timelines, and resource requirements needed to address the four recommendations.

What GAO Recommends

GAO recommends that DOD consistently use existing mechanisms to share information about actions taken to protect against threats, and take steps to improve the consistency of reporting and monitoring of the implementation of the recommendations from the 2009 Fort Hood review. DOD concurred with GAO's recommendations and cited related actions planned or under way.