FEMA had obligated all  $150 million of its Recovery Act PSGP funds as of September 29, 2009. In  addition to requiring certain actions by specified agencies such as  Immigration and Customs Enforcement, Customs and Border Protection,  and the Coast Guard, the directive provides that other DHS component  heads not specifically identified—where appropriate based on the extent  of use of SSI—should appoint an official to serve as the component’s SSI  Program Manager, who is to be responsible for, among other things,  developing component-specific SSI identification and procedural guidance  as necessary, and conducting self-inspections of the component for the  effective management and practical application of SSI, and consistent and  appropriate application and use of SSI at least once every 18 months. Recovery Act Recipient Reporting Process

To promote transparency and accountability, the Recovery Act requires  recipients of Recovery Act funds, such as PSGP recipients, to report each  calendar quarter on the use of funds, and further requires that this  reporting continue for every quarter in which the recipient receives  Recovery Act funds from the federal government. FEMA has appointed an SSI Program Manager. FEMA’s GPD has appointed an SSI Coordinator. Reviewing these justifications  and marking them immediately as SSI could help the SSI Coordinator  ensure that GPD personnel are better positioned to safeguard them from  inadvertent unauthorized disclosure. The training did not provide  this information. We have previously reported on a number of factors that  managers should consider when assessing training. Given that Recovery Act PSGP staff were unclear  about the application of SSI to their work and attendees at GPD’s initial  SSI training requested examples to illustrate how SSI pertains to their  work, providing grant-specific examples in its SSI training could help  FEMA ensure that all GPD staff, including Recovery Act PSGP staff, are  better positioned to identify, mark, and safeguard SSI within their  programs. FEMA Has Taken Initial Steps to Develop and Document a Review Process, but Additional Controls Could Help Prevent the Unauthorized Disclosure of SSI

FEMA has implemented an agencywide standard operating procedure  governing the safeguarding of SSI within FEMA; however, this is a broad  policy that does not specifically address aspects related to the Recovery  Act PSGP recipient report review process. Further, while FEMA GPD staff  have taken steps to outline their recipient review process, GPD  management has not approved the procedure and the draft does not  include key controls for reducing the risk of error. FEMA Lacks a Procedure for Comparing Recipient Reports Against SSI Criteria

FEMA’s standard operating procedure does not include a method for its  Recovery Act PSGP recipient report reviewers to safeguard SSI as required  of covered persons in SSI regulations. A TSA security official who reviewed our sample of 61 PSGP recipient  reports available on Recovery.gov for the reporting period with data  available as of February 2010, informed us that none contained SSI;  however, FEMA should consider a cautious approach when reviewing this  material in advance and inform recipients if their draft submissions  contain SSI. While our review showed that none of the Recovery Act  PSGP recipient reports for the single reporting period in our review  contained SSI, developing a management-approved policy for reviewing  Recovery Act PSGP recipient reports that includes steps to compare  submissions against SSI criteria and properly safeguard it could reduce the  risk that SSI is made publicly available on Recovery.gov in subsequent  reporting periods. Specifically, the  director instructed him to use boilerplate language when commenting  back to the recipients, with the following notification statement: “Due to  the public nature of this report, please adjust the Award Description to:  American Recovery and Reinvestment Act Port Security Grant Program  (ARRA PSGP).” This official stated that he did not develop standard  criteria to determine what “too much detail” meant, nor does he compare  the information contained in these quarterly reports against SSI criteria  while conducting his data quality review. FEMA Has Not Provided Instruction to Recipients on Safeguarding SSI While Reporting Project Details in a Transparent Manner for Posting on Recovery.gov

During the Recovery Act quarterly reporting process, under federal SSI  regulations, both recipients—who submit the initial information—and  FEMA personnel—who review the information—are considered to be  covered persons with a duty to safeguard SSI. According to FEMA, the sensitive nature of port security information  affects the transparency of PSGP recipient reporting. Namely, by describing the information to include in narrative  fields that ultimately will be posted on Recovery.gov and informing  recipients of their duty to protect SSI as covered persons, FEMA could  help ensure that recipients consider both the need to report on funded  activities and expected outcomes in a transparent manner while  safeguarding SSI when reporting information on issues that ultimately will  be posted on Recovery.gov. Further, FEMA intends to  enhance its current SSI training to ensure that it is relevant to FEMA  personnel.
Why GAO Did This Study

The American Recovery and Reinvestment Act of 2009 (Recovery Act) requires recipients to report, among other things, project descriptions on Recovery.gov, the federal Recovery Act Web site. Within the Department of Homeland Security, the Federal Emergency Management Agency's (FEMA) Grant Programs Directorate administers the Port Security Grant Program (PSGP) to strengthen ports against risks from terrorist attacks. FEMA received and obligated $150 million in Recovery Act PSGP funds in 2009, and, as of September 2010, recipients have drawn down over $10 million. To facilitate recipient reporting, FEMA must consider the need both for transparency and for protection of Sensitive Security Information (SSI), which could be detrimental to transportation security if disclosed. As requested, GAO assessed FEMA's: (1) controls to ensure Recovery Act PSGP staff consistently follow SSI policies, and (2) steps to ensure PSGP recipients have not disclosed SSI on Recovery.gov. GAO reviewed relevant laws, regulations, guidance, and a random sample of PSGP Recovery Act recipient reports available as of February 2010, and interviewed agency officials.

What GAO Found

FEMA has taken steps to ensure Recovery Act PSGP staff consistently follow the Department of Homeland Security's SSI policies and processes, but key actions have not been taken. For instance, FEMA has appointed an SSI Program Manager--responsible for FEMA-wide SSI oversight--and an SSI Coordinator to facilitate the Grant Programs Directorate's use of SSI. Also, the SSI Program Manager provided SSI training to FEMA's Grant Programs Directorate staff; however, the training did not include FEMA-specific examples to illustrate the application of SSI, which the staff requested. GAO has previously reported that, when assessing training, managers should consider whether the training includes both the theoretical basis of the material--such as context and principles--and the practical application of the issues. Including FEMA-specific examples could help FEMA ensure Recovery Act PSGP staff have the necessary knowledge to handle and safeguard SSI. In addition, the SSI Coordinator has not assessed whether SSI documents have been appropriately labeled, in accordance with SSI regulations. For example, FEMA has determined that certain materials grant recipients submit to FEMA during the application process to describe how their projects will address current gaps and deficiencies are SSI, but has not marked them as such. While these documents have not been posted to Recovery.gov, immediately reviewing and marking them as SSI could improve safeguards and help prevent the information contained therein from inadvertent disclosure. FEMA has taken steps to develop a quarterly review process for Recovery Act PSGP recipient reports--prior to their public release on Recovery.gov--but does not have key controls to help prevent public disclosure of SSI. For instance, FEMA staff drafted a procedure for reviewing recipient reports, but FEMA management has not approved it and the draft does not include a procedure to verify the reviews' accuracy. Further, while GAO found that SSI had not been disclosed in Recovery Act recipient reports posted on Recovery.gov for the single reporting period GAO reviewed--with data publicly available as of February 2010--FEMA lacks a process for comparing recipient reports to SSI criteria, and a protocol that informs recipients when FEMA determines that their reports contain SSI. Introducing these measures could help Grant Programs Directorate staff consistently review reports, identify when they contain SSI, reduce the risk of SSI disclosure on Recovery.gov, and reinforce recipients' obligations to safeguard SSI. In addition, GAO found wide variation in the level of detail about the awards' descriptions among the recipient reports sampled from Recovery.gov as of February 2010, although the majority provided minimal detail. According to FEMA, the sensitive nature of PSGP information affects the transparency of PSGP recipient reporting. By providing instruction to recipients on what should and should not be reported due to SSI requirements, FEMA could help recipients report project details in a transparent manner on the expenditure of Recovery Act funds while protecting information that could otherwise jeopardize transportation security if released.

What GAO Recommends

GAO recommends that FEMA improve SSI training, ensure proper marking of SSI, enhance recipient report review controls, and instruct recipients on safeguarding SSI while reporting on funded activities and expected outcomes in a transparent manner. FEMA concurred.