Issue  Total funding for Diplomatic Security operations was almost $4.8 billion in  fiscal year 2016. Total funding for Diplomatic Security includes its bureau  managed funds as well as other funding—such as personnel salaries— managed by other bureaus and offices but necessary for Diplomatic  Security operations. In response to a Benghazi Accountability Review Board recommendation,  State established a panel to reexamine Diplomatic Security’s organization  and management. As of May 2017, State was continuing to  address this recommendation. What steps has State taken to  address weaknesses in its waivers and exceptions program? At  overseas posts, the Department  of State’s (State) Bureaus of  Diplomatic Security (Diplomatic  Security)—represented by a  Regional Security Officer  (RSO)—and Overseas Buildings  Operations share responsibility  for the security of residences and  other soft targets overseas. While State has taken measures to enhance security at its  embassies and consulates since the 1998 East Africa embassy  bombings, these same actions have given rise to concerns that would-be  attackers may shift their focus to what they perceive as more accessible  targets, such as diplomatic residences, schools, and other places  frequented by U.S. personnel and their families. State has taken a variety of actions to manage risks to schools and other  soft targets. Issue  State has a robust security awareness training program provided by  Diplomatic Security. State concurred with the recommendations and took steps  to address them. State agreed with all of our recommendations and reported that it has  started to address them. According to State and DOD officials, this represented a  whole-of-government approach to countering threats to U.S. overseas  personnel and facilities. Drawing from existing U.S. Marine Corps and  U.S. Army units, DOD created three dedicated military forces to respond  to crises across Africa and the Middle East: (1) a Special Purpose Marine  Air-Ground Task Force for Crisis Response (SPMAGTF-CR) assigned to  DOD’s U.S. Central Command, which supports U.S. diplomatic missions  in the Middle East; (2) a SPMAGTF-CR assigned to U.S. Africa  Command, which supports U.S. missions in North and West Africa;  and (3) the East Africa Response Force, a U.S. Army force that supports  U.S. diplomatic missions in East Africa. State and DOD officials reported in June 2017  that they have experienced some challenges associated with deploying  the increased MSG units, including obtaining sufficient numbers of  marines to fill the desired number of units and logistical and other support  at some posts. Background Issue  The Department of State’s (State) Diplomatic Security and overseas posts have processes for  Bureau of Diplomatic Security communicating threat information to post personnel (U.S. employees and  (Diplomatic Security) is locally employed staff) as well as U.S. citizens in country. However, these  responsible for disseminating populations do not always receive important threat information in a timely  threat information to posts. Key Findings  State has taken steps to improve RSOs’ reporting of terrorism-related threat  information to headquarters. Foreign intelligence entities from host nations and third parties are  motivated to collect information on a variety of sensitive topics of national  importance, including intelligence, defense, and economic information. Key Findings  State has established several measures to counter the human  intelligence threat at overseas posts. Those measures include  (1) requiring all State and other agency personnel serving at these posts  to report contacts with foreign nationals, particularly those from countries  with critical human intelligence posts; (2) prescreening State personnel  assigned to certain posts against 13 criteria designed to identify  vulnerabilities and directing other agencies to prescreen their personnel;  and (3) briefing personnel about what to expect when working and living  in potentially hostile intelligence environments. 11.) Issue  Since 1997, GAO has designated federal information security as a  government-wide high-risk area and in 2003 expanded this area to  include computerized systems supporting the nation’s critical  infrastructure. State relies on several aging and obsolete technology systems, which  require significant resources to operate and create challenges to ensuring  information security. State has convened 12 ARBs  since 1998. In response  to the attack, the Department of State (State), working with the  Department of Defense, formed Interagency Security Assessment Teams  to evaluate the security at 19 dangerous posts. As of June 2017, State reported having addressed 268 of the  287 recommendations. In December 2012, the ARB that State convened to investigate the  Benghazi attack released the report of its investigation. We used these interviews to refine our key issues, gain  updated information and data, follow up on actions taken regarding our  past recommendations, and identify relevant lessons learned. Diplomatic Security staffing numbers for its workforce of direct-hire  employees, other U.S. government support staff, and contractors. State also collaborates with  other U.S. government agencies to secure U.S. missions overseas. Appendix V: GAO Recommendations regarding the Bureau of Diplomatic Security

Over the course of our work on the Department of State’s (State) Bureau  of Diplomatic Security (Diplomatic Security) and related efforts, we have  identified conditions that affect the success of its programs and  recommended a range of improvements that should be considered in  program planning and implementation. In letters addressed to the Secretary of State, we identified which of these  recommendations we believe should be given high priority for  implementation. Fully implementing GAO’s priority  recommendations on physical security at overseas posts, such as  those regarding risk management associated with physical security of  diplomatic facilities, will improve the safety and security of personnel  serving overseas, particularly in high-threat locations. Countering Overseas Threats: Gaps in State Department Management of  Security Training May Increase Risk to U.S. Enclosure VI: Embassy Crisis and Evacuation Preparedness

Embassy Evacuations: State Should Take Steps to Improve Emergency  Preparedness. Diplomatic Missions

Interagency Coordination: DOD and State Need to Clarify DOD Roles and  Responsibilities to Protect U.S. Enclosure XI: Status of Recommendations Made in Reports following the Benghazi Attack

Diplomatic Security: Overseas Facilities May Face Greater Risks Due to  Gaps in Security-Related Activities, Standards, and Policies.
Why GAO Did This Study

Terrorist attacks against U.S. diplomats and personnel overseas have led to increased attention of State's diplomatic security efforts. In this special publication, GAO identifies key issues affecting Diplomatic Security for Congressional oversight. These issues were identified from a body of related GAO work and State and other reports. GAO also interviewed U.S. officials from State and other agencies to obtain their views on key issues, obtain updated information and data, and follow up on actions they have taken on past GAO and other oversight report recommendations.

What GAO Found

In response to increasing threats to U.S. personnel and facilities at overseas diplomatic posts since 1998, the Department of State (State) has taken a number of steps to enhance its risk management and security efforts. State's Bureau of Diplomatic Security (Diplomatic Security) leads many of these efforts with assistance from other bureaus and U.S. government agencies. Given the ongoing threats and the amount of resources needed to counter them, GAO has identified 11 key issues regarding Diplomatic Security that warrant significant Congressional oversight to monitor the cost, progress, and impact:
Diplomatic Security Funding : Diplomatic Security funding has increased considerably in reaction to a number of security incidents overseas and domestically. In fiscal year 2016, total funding for Diplomatic Security operations--which includes its bureau managed funds as well as other funding such as personnel salaries--was almost $4.8 billion.
Diplomatic Security Staffing Challenges : Diplomatic Security's workforce--including 3,488 direct-hire, 1,989 other U.S. government, and 45,870 contract personnel--continues to grow. However, potential challenges exist regarding the distribution of domestic and overseas positions, posting fully qualified individuals in the assignments with the greatest needs, and ongoing efforts to fill language-designated positions.
Physical Security of U.S. Diplomatic Facilities : Diplomatic Security and the Bureau of Overseas Buildings Operations collaborate to meet safety standards when constructing new embassies and mitigating risks at existing facilities. However, GAO made recommendations to address gaps in State's security related activities and processes.
Physical Security of Diplomatic Residences and Other Soft Targets : State has taken steps to address residential security vulnerabilities and manage risks at schools and other soft targets overseas. However, GAO recommended actions to address weaknesses in State's efforts.
Security Training Compliance : While State has robust security training requirements, it lacks consistent monitoring and enforcement processes, particularly for its Foreign Affairs Counter Threat training and for security refresher briefings at posts.
Embassy Crisis and Evacuation Preparedness : Gaps in State's implementation and monitoring of crisis and evacuation preparedness could endanger staff assigned to overseas posts and the family members accompanying them. GAO has recommended actions to address these issues.
Department of Defense (DOD) Support to U.S. Diplomatic Missions : Following the Benghazi attacks, DOD increased its support to U.S. diplomatic missions by creating dedicated military forces to respond to crises and expanding the Marine Security Guard program at overseas missions. However, State and DOD reported that they have experienced some logistical and other challenges.
Dissemination of Threat Information : State has processes for communicating threat information to post personnel and U.S. citizens in-country. However, post personnel--including locally employed staff--have not always received important information in a timely manner. GAO has recommended steps State needs to take to address this concern.
Countering Human Intelligence Threats : Foreign intelligence entities from host nations and third parties are motivated to collect information on U.S. operations and intentions. State has established measures to counter the human intelligence threat and works with other U.S. government agencies to identify and assess this threat.
Ensuring Information Security : GAO has designated federal information security as a government-wide high-risk area and made recommendations to address these issues. State faces evolving threats and challenges to maintaining obsolete technology, defining clear roles and responsibilities for information security, and overseeing technology contractors.
Status of Recommendations Made in Reports following the Benghazi Attack : In response to the Benghazi attack, State formed interagency teams to evaluate the security at 19 dangerous posts, convened an Accountability Review Board (ARB) to investigate the attack, and established panels to conduct further assessments. As of June 2017, State reported having addressed recommendations as follows: 268 of 287 made by the interagency teams, 26 of 29 by the ARB, and 64 of 75 by the panels.

What GAO Recommends

While State has taken steps to close recommendations made in past GAO reports, GAO identified 27 open recommendations from these reports (as of August 2017) that it believes should be given high priority for implementation. Of the 27 priority recommendations, 24 were related to diplomatic security.