Background Resellers maintain large, sophisticated databases with consumer information that can include credit histories, insurance claims, criminal records, employment histories, incomes, ethnicities, purchase histories, and interests. As shown in figure 1, resellers largely obtain their information from public records, publicly available information (such as directories and newspapers), and nonpublic information (such as from retail loyalty cards, warranty registrations, contests, and web browsing). Consumer information can be derived from mobile networks, devices (including smartphones and tablets), operating systems, and applications. Resellers also may obtain personal information from the profile or public information areas of websites, including social media sites, or from information on blogs or discussion forums. Depending on the context, information from these sources may be publicly available or nonpublic. In 1973, a U.S. government advisory committee first proposed the Fair Information Practice Principles for protecting the privacy and security of personal information. While these principles are not legal requirements, they provide a framework for balancing privacy with other interests. In 2013, the Organisation for Economic Co-operation and Development (OECD) developed a revised version of the principles (see table 1). The Fair Information Practice Principles served as the basis for the Privacy Act of 1974—which governs the collection, maintenance, use, and dissemination of personal information by federal agencies. The principles also were the basis for many Federal Trade Commission (FTC) and Department of Commerce privacy recommendations and for a framework for consumer data privacy the White House issued in 2012. Several Laws Apply in Specific Circumstances to Consumer Data That Resellers Hold As we reported in 2013 and as continues to be the case, no overarching federal privacy law governs the collection, use, and sale of personal information among private-sector companies, including information resellers. There are also no federal laws designed specifically to address all the products sold and information maintained by information resellers. Federal laws addressing privacy issues in the private sector are generally narrowly tailored to specific purposes, situations, types of information, or sectors or entities—such as data related to financial transactions, personal health, and eligibility for credit. These laws include provisions that limit the disclosure of certain types of information to a third party without an individual’s consent, or prohibit certain types of data collection. The primary laws include the following: Fair Credit Reporting Act (FCRA). FCRA protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for credit, insurance, or employment. It applies to consumer reporting agencies that provide consumer reports. Accordingly, FCRA applies to the three nationwide consumer reporting agencies (commonly called credit bureaus) and to any other information resellers that resell consumer reports for use by others. FCRA limits resellers’ use and distribution of personal data—for example, by allowing consumers to opt out of allowing consumer reporting agencies to share their personal information with third parties for prescreened marketing offers. Gramm-Leach-Bliley Act (GLBA). GLBA protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain. GLBA sharing and disclosure restrictions apply to financial institutions or entities that receive nonpublic personal information from such institutions. For example, a third party that receives nonpublic personal information from a financial institution to process consumers’ account transactions may not use the information or resell it for marketing purposes. Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA establishes a set of national standards to protect certain health information. The HIPAA privacy rule governs the use and disclosure of an individual’s health information for purposes including marketing. With some exceptions, the rule requires an individual’s written authorization before a covered entity—a health care provider that transmits health information electronically in connection with covered transactions, health care clearinghouse, or health plan—may use or disclose the information for marketing. The rule does not directly restrict the use, disclosure, or resale of protected health information by resellers or others not considered covered entities under the rule. Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA and its implementing regulations apply to the collection of information— such as name, email, or location—that would allow someone to identify or contact a child under 13. Covered website and online service operators must obtain verifiable parental consent before collecting such information. COPPA may not directly affect information resellers, but the covered entities are potential sources of information for resellers. Electronic Communications Privacy Act of 1986 (ECPA). ECPA prohibits the interception and disclosure of electronic communications by third parties unless an exception applies (such as one party to the communication consenting to disclosure). For example, the act would prevent an internet service provider from selling the content of its customers’ emails to a reseller for marketing purposes, unless the customers had consented to disclosure. However, ECPA provides more limited protection for information considered to be “non-content,” such as a customer’s name and address. Federal Trade Commission Act (FTC Act), Section 5. The FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce. Although the act does not explicitly grant FTC the specific authority to protect privacy, FTC has interpreted it to apply to deceptions or violations of written privacy policies. For example, if a retailer’s written privacy policy stated customers’ personal information would not be shared with resellers and the retailer later sold information to such parties, FTC could bring an enforcement action against the retailer for unfair and deceptive practices. Some states also have enacted laws designed to regulate resellers’ sharing of personal information about consumers. For example, in 2018, Vermont passed a law that contains, among other requirements, consumer protection provisions related to data brokers. Among other things, the law requires data brokers to register annually and prohibits the acquisition and use of brokered personal information through certain means and for certain uses. Gaps Exist in the Consumer Privacy Framework The scope of consumer privacy protections provided under federal law has remained narrow in relation to (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; (3) new technologies; and (4) some regulatory authorities. The examples in the following sections are drawn from our earlier reports and remain pertinent today. Federal Law Provides Individuals Limited Ability to Access, Control, and Correct Their Personal Data In our 2013 report, we found that no federal statute that we examined generally requires resellers to allow individuals to review personal information (intended for marketing purposes), control its use, or correct it. The Fair Information Practice Principles state that individuals should be able to know about and consent to the collection of their information and have the right to access the information, request correction, and challenge the denial of those rights. We also reported in 2013 that no federal statute provides consumers the right to learn what information is held about them and who holds it for marketing or look-up purposes. FCRA provides individuals with certain access rights, but only when information is used for credit eligibility purposes. And GLBA’s provisions allowing consumers to opt out of having their personal information shared with third parties apply only in specific circumstances. Otherwise, under federal law, individuals generally cannot require that their personal information not be collected, used, and shared. Also, no federal law we examined provides correction rights (the ability to have resellers and others correct or delete inaccurate, incomplete, or unverifiable information) for marketing or look-up purposes. Laws Largely Do Not Address Data Collection Methods, Sources, and Types Our 2013 report also found that federal privacy laws are limited in addressing the methods by which, or the sources from which, resellers collect and aggregate personal information, or the types of information collected for marketing or look-up purposes. The Fair Information Practice Principles state that personal information should be relevant, limited to the purpose for which it was collected, and collected with the individual’s knowledge or consent. Federal laws generally do not govern the methods resellers may use to collect personal information. For instance, resellers, advertisers, and others use software to search the web for information about individuals and extract and download bulk information from websites with consumer information. Resellers or retailers also may collect information indirectly (by combining information from transactions). Current federal law generally allows resellers to collect personal information from sources such as warranty registration cards and surveys and from online sources such as discussion boards, social media sites, blogs, and web browsing histories and searches. Current federal law generally does not require disclosure to consumers when their information is collected from these sources. The federal laws that address the types of consumer information that can be collected and shared are not comprehensive. Under most circumstances, information that many people may consider very personal or sensitive can be collected, shared, and used for marketing. This can include information about physical and mental health, income and assets, political affiliations, and sexual habits and orientation. For health information, HIPAA rule provisions generally apply only to covered entities, such as health care providers. Privacy Framework Largely Has Not Kept Pace with Changes in Technology The current privacy framework does not fully address new technologies such as facial recognition technology, privacy issues raised by online tracking and mobile devices, and activities by financial technology firms. The original enactment of several federal privacy laws predates these trends and technologies. But in some instances existing laws have been interpreted to apply to new technologies. For example, FTC has taken enforcement actions under COPPA and revised the statute’s implementing regulations to account for smartphones and mobile applications. Facial Recognition Technology One example of how privacy law has not kept pace with changes in technology is the use of facial recognition technology, which involves the collection of facial images and may be employed in a wide range of commercial applications. In our 2015 report we concluded that the future trajectory of this technology raised questions about consumer privacy. We found that federal law does not expressly address the circumstances under which commercial entities can use facial recognition technology to identify or track individuals, or when consumer knowledge or consent should be required for the technology’s use. Furthermore, in most contexts federal law does not address how personal data derived from the technology may be used or shared. The privacy issues stakeholders raised about facial recognition technology and other biometric technologies in use at the time of our 2015 report served as yet another example of the need to adapt federal privacy law to reflect new technologies. As such, we reiterated our 2013 recommendation that Congress strengthen the current consumer privacy framework to reflect the effects of changes in technology and the marketplace. Activities by Financial Technology Firms The rise of financial services provided by nonfinancial firms—often referred to as fintech—is another example of how new technology may create privacy concerns. For example, fintech lenders offer a variety of loans such as consumer and small business loans and operate almost exclusively online. In our 2018 report, we noted that while these lenders may still assess borrowers’ creditworthiness with credit scores, they also may analyze large amounts of additional or alternative sources of data to determine creditworthiness. We also found that some fintech firms may collect more consumer data than traditional lenders. For example, fintech lenders may have sensitive information such as consumers’ educational background or utility payment information, and according to certain stakeholders, these data may contain errors that cannot be disputed by consumers under FCRA. Furthermore, some data aggregators may hold consumer data without disclosing what rights consumers have to delete the data or prevent the data from being shared with other parties. A leak of these or other data held by fintech firms may expose characteristics that people view as sensitive. GLBA generally requires fintech firms and traditional financial institutions to safeguard nonpublic personal information about customers. Our 2018 report discussed that some fintech firms use new technologies or mobile device features to mitigate data privacy risks and that some regulators have issued guidance to consumers publicizing practices that help maintain privacy when using online products and services, including those provided by fintech firms. Regulators also have issued GLBA guidance to businesses, including fintech firms, recommending that they adopt policies and procedures to prevent, detect, and address privacy threats. Internet Privacy Issues Online tracking. In our 2013 report, we found that no federal privacy law explicitly addresses the full range of practices to track or collect data from consumers’ online activity. Cookies allow website operators to recall information such as user name and address, credit card number, and purchases in a shopping cart. Resellers can match information in cookies and their databases to augment consumer profiles. Third parties also can synchronize their cookie files with resellers’ files. Advertisers can use third-party cookies—placed on a computer by a domain other than the site being visited—to track visits to the websites on which they advertise. While current federal law does not, with some exceptions, explicitly address web tracking, FTC has taken enforcement actions related to web tracking under its authority to enforce the prohibition on unfair or deceptive acts. For example, in 2011, FTC settled charges with Google for $22.5 million after alleging that Google violated an earlier privacy settlement with FTC when it misrepresented to users of Apple’s Safari web browser that it would not track and serve targeted advertisements to Safari users. Google agreed to disable its advertising tracking cookies. Mobile devices. In 2013, we also explained that no federal law comprehensively governs applications software for mobile devices. Application developers, mobile carriers, advertisers, and others may collect an individual’s information through services provided on a mobile device. However, FTC has taken enforcement action against companies for use of mobile applications that violate COPPA and FCRA. The agency also has taken action under the FTC Act. We and others have reported that the capability of mobile devices to provide consumer’s location engenders privacy risks, particularly if companies use or share location data without consumers’ knowledge. ECPA might not apply if location data were not deemed content and would not govern entities that are not covered by ECPA. But FTC could pursue enforcement action if a company’s collection or use of the information violated COPPA. More recently, in January of this year, we issued a report on internet privacy that reinforces what we reported in 2013. To varying extents, internet content providers and internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes. Consumers access such services through mobile phones and tablets, computers, and other internet- connected devices. However, there is no comprehensive federal privacy statute with specific standards. FTC has been addressing internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry- specific statutes. We concluded that recent developments regarding internet privacy suggest that this is an appropriate time for Congress to consider comprehensive internet privacy legislation. To address such privacy concerns, states and other countries have adopted privacy rules. For example, the European Union’s General Data Protection Regulation, which came into force in May 2018, is a set of privacy rules that give consumers control over the collection, use, and sharing of their personal information, and California passed its own privacy law in June 2018 that becomes effective in 2020. Regulatory Authorities under Current Law May Be Limited In February of this year, we reported that FTC does not have civil penalty authority for initial violations of GLBA’s privacy and safeguarding requirements, which, unlike FCRA, includes a provision directing federal regulators and FTC to establish standards for financial institutions to protect against any anticipated threats or hazards to the security of customer records. To obtain monetary redress for these violations, FTC must identify affected consumers and any monetary harm they may have experienced. However, harm resulting from privacy and security violations (such as a data breach) can be difficult to measure and can occur years in the future, making it difficult to trace a particular harm to a specific breach. As a result, FTC lacks a practical enforcement tool for imposing civil money penalties that could help to deter companies from violating data security provisions of GLBA and its implementing regulations. We recommended that Congress consider giving FTC civil penalty authority to enforce GLBA’s safeguarding provisions. Additionally, in our January 2019 report, we found that FTC had not yet issued regulations for internet privacy other than those protecting financial privacy and the internet privacy of children, which were required by law. FTC uses its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity. In addition, under this authority, FTC can generally only levy civil money penalties after a company has violated an FTC final consent order. In our recommendation that Congress consider developing comprehensive internet privacy legislation, we also suggested that such legislation consider providing rulemaking and civil money penalty authorities to the proper agency or agencies. In summary, new technologies have vastly changed the amount of personal information private companies collect and how they use it. But our current privacy framework does not fully address these changes. Laws protecting privacy interests are tailored to specific sectors and uses. And, consumers have little control over how their information is collected, used, and shared with third parties for marketing purposes. As a result, current privacy law is not always aligned with the Fair Information Practice Principles, which the Department of Commerce and others have said should serve as the foundation for commercial data privacy. Thus, the privacy framework warrants reconsideration by Congress in relation to consumer interests, new technologies, and other issues. Chairman Crapo, Ranking Member Brown, and Members of the Committee, this concludes my statement. I would be pleased to respond to any questions you may have. GAO Contacts For further information on this statement, please contact Alicia Puente Cackley at 202-512-8678 or cackleya@gao.gov. Contact points for our offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact above, Jason Bromberg (Assistant Director), William R. Chatlos, Rachel DeMarcus, Kay Kuhlman (Assistant Director), Christine McGinty (Analyst in Charge), Barbara Roesmann, and Tyler Spunaugle contributed to this statement. Other staff who made key contributions to the reports cited in the testimony are identified in the source products. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background Responsibilities of the Coast Guard’s Deployable Specialized Forces The Coast Guard has 11 statutory missions, which are divided into homeland security and non-homeland security missions (see appendix II). The Coast Guard’s units that conduct operations to achieve its statutory missions are organized into shore-based forces such as boat stations, maritime patrol forces such as cutters and icebreakers, and Specialized Forces—the latter of which can serve as a force multiplier for the other units, such as by deploying for added capacity during homeland security missions, including port security, drug interdiction, and defense readiness. Table 1 details Specialized Forces teams, types of operations they conduct, and an example of an operation. Specialized Forces units deploy from their home locations, such as major U.S. port areas, to conduct operations in U.S. coastal waters and internationally. For example, some units such as MSRTs, MSSTs and PSUs deploy with specialized boats on trailers that can be towed or air lifted to the site of an antiterrorism patrol or defense readiness operation. Other Specialized Forces units do not maintain the vessels, such as cutters, or air assets, such as helicopters, from which they carry out operations. TACLETs, for example, do not maintain any boats and rely on and deploy via U.S. Navy or Allied vessels, as well as Coast Guard cutters, to conduct drug interdiction operations. Figure 1 shows Coast Guard personnel conducting a drug interdiction operation that included a TACLET member boarding a foreign, semi-submersible vessel, which resulted in seizing 17,000 pounds of cocaine. The Coast Guard is the lead federal maritime law enforcement agency on waters beyond 12 nautical miles offshore of the U.S. coast. The Coast Guard shares responsibility for patrolling the U.S. maritime borders and territorial sea (i.e., maritime approaches 12 nautical miles seaward of the U.S. coast) to interdict drugs and foreign nationals illegally entering the United States with U.S. Customs and Border Protection’s Air and Marine Operations and Border Patrol. Outside of DHS, the Department of Defense (DOD) is the lead federal agency for the detection and monitoring of the aerial and maritime transit of illegal drugs into the United States, and it operates systems, such as radar, that can be used in support of DHS and other federal, state, and local law enforcement activities. Figure 2 depicts the geographic areas in which Specialized Forces operate and resources, such as vessels or aircraft, used to support their operations. Coast Guard Reorganized its Deployable Specialized Forces in 2007 and 2013 In July 2007, the Coast Guard reorganized the command structure of its Specialized Forces and aligned them as an independent Coast Guard command—the Deployable Operations Group. The Deployable Operations Group was intended to enhance operational effectiveness and interagency coordination in responding to a range of national emergencies and events, such as terrorist threats or natural disasters. Prior to the Deployable Operations Group, Specialized Forces aligned geographically under Atlantic Area and Pacific Area commands. In 2010, we found that the unified command structure achieved its intended benefits of standardized training and centrally managing assets. We also reported in 2010 that the Deployable Operations Group faced human resource challenges such as selecting qualified candidates and achieving and maintaining qualifications to perform certain high-skill techniques, such as vertical insertion from a helicopter onto the deck of a ship during maritime interdiction missions. Because of the ongoing program changes at that time, we did not make recommendations. In 2010, a DHS Inspector General report recommended a systematic review and analysis of the MSST program to determine, in part, the optimal staffing levels, training, and competency mix needed. The Coast Guard agreed and cited planned MSST program changes in its response to the Inspector General report. The Coast Guard’s Fiscal Year 2011 budget included a proposal to close five MSSTs and consolidate those forces to achieve cost savings, among other things. A 2011 Coast Guard report recommended that the Coast Guard integrate Specialized Forces units across the Coast Guard, balance the capacity of the Specialized Forces with proficiency and safety levels, and manage risk. In April 2013, the Coast Guard disbanded the Deployable Operations Group, and Specialized Forces units returned to regional commands. Figure 3 shows the evolution of Coast Guard Specialized Forces units since 1970. The April 2013 reorganization of the Coast Guard’s Specialized Forces units under regional commands more closely aligns with its original command structure that existed prior to the 2007 creation of the Deployable Operations Group. Figure 4 details the three command structures—pre-Deployable Operations Group, Deployable Operations Group, and Post-Deployable Operations Group. Coast Guard Applied Some Key Practices when Reorganizing its Deployable Specialized Forces, but Has Not Fully Analyzed Workforce Needs or Operational Capabilities The Coast Guard generally applied three of five key practices for agency reform and partially applied two of five when developing its report that recommended the 2013 reorganization of its Specialized Forces units. Table 2 identifies the extent to which the Coast Guard’s reorganization applied key practices and considerations. Coast Guard Generally Applied Three of Five Key Practices for Reorganizing its Deployable Specialized Forces Coast Guard generally applied three of five key practices for Specialized Forces reorganization, including establishing goals and outcomes, involving employees and key stakeholders, and addressing high risk areas and longstanding management challenges. Establish Goals and Outcomes of Reforms Establishing goals and outcomes of reforms can help decision makers determine what problems genuinely need to be fixed, how to balance differing objectives, and what steps need to be taken to create long-term gains. The Coast Guard generally applied this key practice in its analysis of Specialized Forces units. For example, the Coast Guard’s 2011 report cites personnel safety as a main reason to reform Specialized Forces operations. According to Coast Guard officials, part of the rationale for this focus was because of a training mishap and a problem with equipment requirements. Specifically, officials stated that in 2010, a Coast Guard member drowned while training when he entered the water without self-inflating flotation equipment. Coast Guard officials told us that at the time of the incident, members of Specialized Forces units would carry in excess of 100 pounds of specialized gear and equipment. Officials also noted that at that time there were concerns that members’ self-inflating flotation devices could inflate onboard aircraft, which in the event of a crash in the water could result in personnel being unable to exit the aircraft. The Coast Guard subsequently established a goal for its reorganization to mitigate this safety risk by decreasing gear weight and personal flotation devices. Further, the report recommended reducing or eliminating inconsistencies between the Specialized Forces units and the rest of the Coast Guard. For example, a Coast Guard official told us that integration between the Deployable Operations Group and the rest of the Coast Guard was inconsistent, training programs were not standardized, and training took place at 15 different locations. This resulted in difficulties sharing assets, such as aircraft and boats, for use during training sessions. As a result of the report findings and its recommendation, the 2013 reorganization realigned Specialized Forces units under regional operational commands to integrate its logistics with the rest of the Coast Guard (fig 2.). Involve Employees and Key Stakeholders in Developing Reforms Involving employees and key stakeholders in the process of developing reforms is part of an integrated approach that helps facilitate the development of reform goals and objectives, as well as incorporate insights from a frontline perspective and increase customer acceptance of any changes. The Coast Guard generally applied this key practice because it involved senior officials representing the agency to develop the goals of the reorganization, how to address them, and to make reform recommendations to improve the efficiency and effectiveness of Specialized Forces operations. The Coast Guard’s 2011 report included and incorporated input from a broad range of subject matter experts including high level officers representing a comprehensive mix of Coast Guard units, with a diverse mix of experience, and it reflected different programs throughout the Coast Guard to ensure a comprehensive review. During site visits, Coast Guard officials told us the reorganization from the Deployable Operations Group to Specialized Forces had a positive effect by helping to ensure tactics, training, and techniques became standardized and ensuring better cooperation within the Coast Guard as well as with other agencies. For example, Coast Guard officials told us that because their area of responsibility is large and busy, they use MSSTs to augment their local capabilities and to apply the MSST’s specialized capabilities that the local unit does not have. Coast Guard officials also emphasized an increase in safety, particularly with a decrease in a risk of drowning while in tactical gear. Address High Risk Areas and Longstanding Management Challenges Addressing long standing weaknesses in how some federal programs and agencies operate is a key practice, which can improve the effectiveness and responsiveness of the federal government. The Coast Guard generally applied this key practice because it considered high risk areas when considering Specialized Forces reorganization. Specifically, the Coast Guard addressed retention and training, which it identified in its 2011 report to be high risk areas and longstanding management challenges. For example, the Coast Guard’s 2011 report identified the need for additional subject matter expertise and made recommendations to implement training standardization across the Specialized Forces. Our work has also identified retention and training as challenges. We found in 2010 that the Coast Guard was unable to retain qualified Specialized Forces personnel, in part because of additional training requirements. For example, while personnel working on a cutter may need a boat driver certification, an MSST or MSRT member would need an additional tactical boat driver course. The Coast Guard subsequently developed detailed guidance for Specialized Forces units that includes standardized training, requirements, and qualifications to be followed regardless of the unit location and to be applied consistently across organizational commands. During site visits to units in the Pacific and Atlantic Areas, we observed that equipment was standardized across Specialized Forces, and officials we spoke with described the benefits of the standardized training and equipment. Figure 5 shows Coast Guard MSST personnel conducting standardized training, which officials said has the added benefit of providing potential deterrence of illegal activities, such as drug smuggling, in the geographic area of the training. Coast Guard officials also told us that, prior to the 2007 reorganization to the Deployable Operations Group, Coast Guard personnel working in Specialized Forces units could not remain in those units and be competitive for promotions. Coast Guard officials told us that this was because the Coast Guard has certain requirements for career progression, including personnel working in various assignments within a given career path. In 2010, we reported that the Coast Guard had developed a career path for maritime law enforcement personnel—who are part of operations that generally address the Coast Guard’s homeland security missions. Coast Guard officials told us that this change was a response to challenges the agency faced retaining law enforcement personnel. Officials said this change created a maritime law enforcement career path within the Specialized Forces community. Coast Guard officials we spoke with also told that us the career path has helped them retain qualified Specialized Forces personnel. Coast Guard Has Not Fully Used Data to Assess Workforce Needs or Evaluated Potential Overlap or Gaps in the Capabilities of its Deployable Specialized Forces Use Data and Evidence to Assess Workforce Needs Coast Guard partially applied two of five key practices for agency reorganization, including using data and evidence, and considering to some extent the possibility of fragmentation, duplication, and overlap. However, it has not used data and evidence to fully assess Specialized Forces workforce needs and has not comprehensively evaluated the potential for overlaps or gaps in the capabilities among them. We have reported that agencies are better equipped to address management and performance challenges when managers use reliable data and evidence, such as evidence from program evaluations and performance data that provide information on how well a program or agency is achieving its goals. We have previously reported that when reforming a given program, the use of data and evidence is critical for setting program priorities and allocating resources. The Coast Guard used some data and evidence related to a specific management challenge—training mishaps—but did not use data and evidence to fully assess Specialized Forces workforce needs. As previously mentioned, the Coast Guard analyzed equipment weight data and scenarios and made recommendations based on the results of these analyses to reduce the risk of drowning. The 2011 report affirmed the locations of the Specialized Forces units to ensure that unit capabilities were geographically distributed, but it recommended additional analyses of some unit locations, such as TACLETs. The Coast Guard found that the geographic distribution of the Specialized Forces, at the time of the analysis, provided coverage for their tactical law enforcement and waterside operations and did not recommend changes to the geographic locations of these units. The Coast Guard partially applied this key practice because, when it reorganized its Specialized Forces command structure in 2013, it did not assess Specialized Forces workforce needs with regard to the number of personnel required to conduct its operations. The Coast Guard’s 2011 report identified some capability and capacity shortfalls, including inadequate capacity to conduct certain security operations, and recommended an analysis of staffing levels for all Specialized Forces units. Similarly, a 2012 Homeland Security Studies and Analysis Institute peer review of the Coast Guard’s 2011 report on its Specialized Forces noted the need for a more comprehensive analysis of all of the units to ensure the effective use of their specialized capabilities. In the eight years since the Coast Guard study recommended workforce needs analyses, the Coast Guard has not assessed the overall Specialized Forces workforce needs or established such an analysis as a priority. The Coast Guard conducted a unit level analysis of its PSUs in January 2014, but it did not use the results because the analysis focused on non-deployed personnel. Officials stated the analysis identified gaps in personnel and recommended that the Coast Guard expand the size of the units to be able to fulfill mission requirements. However, Coast Guard officials said they did not act on the recommendations of the study to request different resource levels. Officials told us that leadership changes among Specialized Forces can result in units, such as PSUs, getting study results based on scope decisions with which the new leader disagrees. We found that the Coast Guard might not have the right mix and number of personnel relative to the mix and number of operations Specialized Forces conduct to meet mission demands. Our analysis of Specialized Forces data for fiscal years 2016 through 2018 and planned for 2019 found variation in the number of operations requested of some units during this period, even though the number of personnel remained relatively constant. For example, our analysis of Coast Guard data found that PSU requests—and the number of operations carried out—changed from three operations in 2016 to six in 2018, with two operations planned in 2019, spread among a constant of approximately 1,000 personnel. In another example, our analysis of Coast Guard data found that the of number operations requested for MSSTs varied from 85 in 2016 to 67 in 2018, and 39 planned for 2019. Our analysis of Coast Guard data found that the number of MSST operations carried out was 152 in 2016, 141 in 2018, and 379 planned operations in 2019, while the number of personnel assigned to MSSTs decreased from 562 in 2016 to 547 planned for 2019. Such variations may affect the extent to which Specialized Forces units are used efficiently. Officials from some units we interviewed indicated that they experienced periods of underutilization, while other similar units turned down operations for lack of available personnel. For example, an official at one unit described efforts to increase the number of operations carried out by the unit, with officials describing outreach efforts to other Coast Guard units to encourage those units to call on them for specialized assistance. Officials at another unit conducted similar outreach, including passing out flyers describing Specialized Forces capabilities and contact information should the other Coast Guard units need assistance. In contrast, officials from a different Specialized Forces unit described instances where they had to decline operations because they did not have enough personnel to meet the demand. Further, an official from one Area Command responsible for assigning some of the Specialized Forces operations stated approximately 5 percent of requests for Specialized Forces assistance went unfulfilled. Without an analysis of the Specialized Forces units as a whole, the Coast Guard does not have the assurance that it has the requisite number of personnel in the right units to conduct the required missions. Such an analysis would better position the Coast Guard to identify capability gaps between mission requirements and mission performance caused by deficiencies in the numbers of personnel available, as required by the Coast Guard Authorization Act of 2015. Coast Guard officials from Specialized Forces units we interviewed in 2019 acknowledged that an analysis of each unit would be useful and in August 2019, officials from headquarters affirmed this and stated the Coast Guard aims to conduct analyses of the individual units. We found that these analyses consider each unit individually and do not comprehensively consider similar units, such as Specialized Forces. Therefore, without analyzing the Specialized Forces program as a whole, the Coast Guard may miss opportunities to optimize the allocation of personnel among Specialized Forces units, as well as the number of units. Using data and evidence to comprehensively assess workforce needs across Specialized Forces units would better position the Coast Guard to prioritize its Specialized Forces efforts to more effectively achieve desired outcomes. Address Fragmentation, Overlap, and Duplication, If Any Exists and is Unnecessary As we have reported since 2011, agencies may be able to achieve greater efficiency or effectiveness by reducing or better managing programmatic fragmentation, overlap, and duplication. We have also reported that these issues should be considered during agency reform efforts. We found that the Coast Guard partially considered how to reduce potential duplication and overlap when reorganizing the Specialized Forces units. The 2011 Coast Guard report identified some duplication of one specialized unit and challenges associated with uncoordinated training and fragmented guidance. The Coast Guard recommended the elimination of one Specialized Forces unit with that specialized capability, and to change training requirements to reduce the duplication of roles within one specific Specialized Forces unit. Further, the report recommended training standardization and associated guidance, which the Coast Guard subsequently addressed by updating its guidance and standardizing training requirements. In addition, the Coast Guard report recommended changes to the capabilities maintained by some units, such as MSSTs. Specifically, the report recommended that the Coast Guard focus MSSTs on waterside security capabilities and eliminate law enforcement roles, among others, to reduce duplicative training costs. Further, according to officials, in response to the Coast Guard Authorization Act of 2010, the Coast Guard eliminated the MSST in San Diego, California and replaced it with MSRT West, a second MSRT. The Coast Guard also placed all regional dive lockers under MSRT West. According to Coast Guard officials, structuring regional dive lockers under a single command in a single geographic location is safer and more efficient, because dive operations require a high level of subject matter expertise in the command as well as personnel actually participating in the dives. However, the Coast Guard partially applied this practice because it has not conducted the analyses necessary to fully identify potential overlap and the extent to which it could be unnecessarily duplicative. The Coast Guard categorizes Specialized Forces missions, such as drug interdiction or defense readiness, as primary, secondary or collateral, and assigns different levels of capabilities according to these categories. Specifically, multiple Specialized Forces are used to support the same Coast Guard missions, which often require similar capabilities from the units, such as the ability to perform enhanced law enforcement boardings. Figure 6 provides a visual representation of the Specialized Forces missions, the capabilities to carry out operations in support of those missions, and the units that address the mission areas. As shown in figure 6, MSSTs and PSUs primary and secondary missions overlap, as do the capabilities necessary to conduct three of the same missions—Ports, Waterways, and Coastal Security; Defense Readiness; and Search and Rescue. MSSTs and PSUs have operational differences, but there may be benefits to assessing when to use PSUs in place of MSSTs or vice versa, such as when one Specialized Force can be deployed more rapidly, or because Specialized Forces are located in close proximity. For example, MSSTs maintain the ability to deploy almost immediately to carry out an operation, while PSUs generally require around 24 months to deploy. PSUs generally have a deployment preparation cycle of at least 24 months and up to 48 months. Moreover, the variance in Specialized Forces utilization and the overlapping capabilities units maintain underscores a challenge and an opportunity, particularly given the close proximity of Specialized Forces units. For example, given that there are certain instances where Specialized Forces units appear to be substitutable, assessing the extent to which co-located units could be better leveraged could help the Coast Guard more efficiently manage its resources. Figure 7 shows the locations of Coast Guard Specialized Forces units and the close proximity of some units, such as co-located MSSTs and PSUs, which have overlapping primary and secondary defense readiness and ports waterways and coastal security missions (fig. 6) and related capabilities. In March 2019, as previously noted, Coast Guard leadership again called for a review of PSUs, citing overlap, personnel shortages, and excessive distance to training areas (such as waterways and weapon ranges). The challenge this new PSU study seeks to address underscores the importance of a contemporary and comprehensive assessment of these units’ workforce needs. It also presents the Coast Guard with an opportunity to consider whether it could more effectively use its co- located Specialized Forces. For example, instead of deploying a PSU within commuting distance of an operation occurring in San Francisco, CA that required surge capacity, the Coast Guard deployed an MSST from Seattle, WA for 7 days, even though both Specialized Forces are to maintain the same capabilities needed for the operation. Coast Guard officials stated that they decided to send the MSST to meet a surge capacity instead of the local PSU because Ports, Waterways and Coastal Security is a secondary mission for PSUs and PSUs do not bring law enforcement capability of boarding officers, among other things. According to Coast Guard officials, each PSU costs around $1 million a year to operate when not deployed to Guantanamo Bay, and two of eight PSUs are deployed annually. Assessing Specialized Forces workforce needs to determine the optimal mix of units and analyzing trade-offs, such as eliminating underutilized units, could identify opportunities for the Coast Guard to save millions of dollars over time. Elimination of even one PSU could save around a million dollars annually. Because the exact amount of savings would depend on the outcomes of those analyses and currently available cost data is not available for making estimates, we cannot precisely estimate the value of potential savings. However, given that the Coast Guard has begun an assessment of PSUs, it is reasonable to expect that a comprehensive analysis of Specialized Forces could find unnecessary duplication and could recommend PSU closures. Coast Guard officials did not state that they are considering this review as part of a comprehensive review of Specialized Forces that would include assessing the overlapping capabilities of other Specialized Forces units. In August 2019, Coast Guard officials told us that overlap or gaps in Specialized Forces’ capabilities could exist. Coast Guard officials also stated that some overlapping capability could be beneficial. While overlap may be beneficial, overlapping capabilities, if unnecessary, could indicate inefficiencies, such as excess capacity in some areas, including geographic areas, to the detriment of others where there may be capability gaps. The Coast Guard is not currently positioned to take action to reduce the risk of some potentially unnecessary overlap or duplication among the Specialized Forces units because it has yet to comprehensively assess the Specialized Forces program. Specifically, as reported above, Coast Guard officials stated that the Coast Guard has conducted some staffing analyses of standalone Specialized Forces units, but has not evaluated the Specialized Forces’ workforce or operations as a whole. Until the Coast Guard comprehensively assesses Specialized Forces’ needs, the Coast Guard will lack a complete picture of the extent to which overlapping capabilities are necessary or appropriate, or where there are capability gaps or areas where certain Specialized Forces units could be better leveraged to meet mission requirements. Assessing the extent to which unnecessary overlap or duplication exists among Specialized Forces’ capabilities, would better position the Coast Guard to identify capability gaps and reallocate resources, as needed, to use them more efficiently. Conclusions The Coast Guard’s Specialized Forces units include a range of specialized capabilities that are vital to the agency’s ability to fulfill its mission, and they constitute a significant force multiplier to maintain readiness throughout major U.S. ports and cities. The Coast Guard faces the difficult decision of determining how best to invest its limited resources. Without having assessed its operational needs and mix of personnel for Specialized Forces units, the Coast Guard does not have the information it needs to ensure that it is investing its resources efficiently. GAO’s key practices and considerations provide a framework for agency reorganization and a decision-making approach that can help ensure that resources are allocated efficiently and do not result in unnecessary overlap or duplication. The Coast Guard did not fully apply these practices when reorganizing the Specialized Forces. By comprehensively assessing Specialized Forces’ workforce needs and determining the extent to which overlapping capabilities are necessary, or whether capability gaps may exist, the Coast Guard may be able to more efficiently allocate resources for its Specialized Forces. Recommendations The Coast Guard should conduct a comprehensive analysis of its Deployable Specialized Forces’ workforce needs. (Recommendation 1) The Coast Guard should assess the extent to which unnecessary overlap or duplication exists among Deployable Specialized Forces’ capabilities. (Recommendation 2) Agency Comments and Our Evaluation We provided a draft of this report to DHS for comment. DHS provided technical comments, which we incorporated as appropriate. On November 5, 2019, DHS also provided comments, reproduced in full in appendix III. DHS concurred with one of our two recommendations, and described actions planned to address it, but did not concur with the other. DHS concurred with our first recommendation that the Coast Guard should conduct a comprehensive analysis of its Specialized Forces’ workforce needs. DHS stated in its comments that the Coast Guard will conduct individual unit analyses, prioritizing for units that were not previously examined. Initial requests, according to the comments, will be submitted to staff responsible for the analyses by January 31, 2020, and estimated completion dates for the analyses are expected to be determined after assessing the availability of funding to support the analyses. These actions, if fully implemented, should address the intent of the recommendation. DHS did not concur with our second recommendation that the Coast Guard assess the extent to which unnecessary overlap or duplication exists among Specialized Forces’ capabilities. In its comments, DHS stated that when the priority of the missions, capabilities, and subsequent geographic operating areas are appropriately considered for each DSF unit type, unnecessary overlap or duplication does not exist among DSF capabilities. DHS further stated that our conclusions illustrate a fundamental misunderstanding of the corresponding missions of DSF units. We note in our report that the way in which the Coast Guard deploys certain Specialized Forces units may not result in overlap, but overlapping capabilities amongst units could indicate inefficiencies in how they are used, such as excess capacity in some areas, including geographic areas, and missed opportunities for use in others. As noted in our report, the Coast Guard has not conducted the analyses necessary to fully identify potential overlap amongst units’ capabilities and the extent to which opportunities may exist to use the units more efficiently. The Coast Guard categorizes Specialized Forces missions, such as drug interdiction or defense readiness, as primary, secondary, or collateral, and assigns different levels of capabilities according to these categories. We found that multiple Specialized Forces are used to support the same Coast Guard missions, which often require similar capabilities from the units, such as the ability to perform enhanced law enforcement boardings. Further, as stated in our report, in August 2019, Coast Guard officials told us that overlap or gaps in Specialized Forces’ capabilities could exist and that some overlapping capability could be beneficial. While overlap may be beneficial, overlapping capabilities, if unnecessary, could indicate inefficiencies, such as excess capacity in some areas, including geographic areas. Also in its comments, DHS stated that we have not identified any substantive examples of unnecessary overlap or duplication nor provided any other compelling reasons for how implementing this recommendation could enhance Coast Guard mission effectiveness. DHS cited our use of MSST and PSU potential overlap as an example of misunderstanding DSF unit missions and active versus reserve personnel. However, MSST and PSU potential overlap is a prime example of why potential unnecessary overlap should be examined by the Coast Guard. Specifically, as noted in our report, MSST and PSU primary and secondary missions overlap, as do the capabilities necessary to conduct three of the same missions—Ports, Waterways, and Coastal Security; Defense Readiness; and Search and Rescue. MSSTs and PSUs have operational differences due to active versus reserve personnel status, but there may be benefits to assessing when to use PSUs in place of MSSTs or vice versa, such as when one Specialized Force can be deployed more rapidly, or when Specialized Forces are located in close proximity. Beyond the MSST and PSU potential overlap, active duty units such as MSSTs and MSRTs provide an additional example. As shown in Figure 6 of our report, MSRTs and MSSTs share the primary missions of Ports, Waterways, and Coastal Security, as well as common secondary missions, including Drug and Migrant Interdiction. Additionally, MSRT- San Diego and MSST-Long Beach are within close proximity to one another, offering an opportunity to examine potential overlap. Also, as noted in our report, officials from some units we interviewed indicated that they experienced periods of underutilization, while other similar units turned down operations for lack of available personnel. For example, an official at one unit described efforts to increase the number of operations carried out by the unit, with officials describing outreach efforts to other Coast Guard units to encourage those units to call on them for specialized assistance. Officials at another unit conducted similar outreach, including passing out flyers describing Specialized Forces capabilities and contact information should the other Coast Guard units need assistance. In contrast, officials from a different Specialized Forces unit described instances where they had to decline operations because they did not have enough personnel to meet the demand. Given that there are certain instances where Specialized Forces units appear to be substitutable, assessing the extent to which units could be better leveraged could help the Coast Guard more efficiently manage its resources. In addition, in March 2019, Coast Guard leadership called for a review of PSUs, citing overlap, personnel shortages, and excessive distance to training areas (such as waterways and weapon ranges). As noted in our report, the challenge this new PSU study seeks to address underscores the importance of a contemporary and comprehensive assessment of these units’ workforce needs and presents the Coast Guard with an opportunity to consider whether it could more effectively use its co- located Specialized Forces. According to Coast Guard officials, each PSU costs around $1 million a year to operate when not deployed to Guantanamo Bay, and two of eight PSUs deploy annually. Assessing Specialized Forces workforce needs to determine the optimal mix of units and analyzing trade-offs, such as eliminating or moving underutilized units, could identify opportunities for the Coast Guard to save millions of dollars over time. As noted in our report, because the exact amount of savings would depend on the outcomes of those analyses and cost data that is not currently available for making estimates, we cannot precisely estimate the value of potential savings. However, given that the Coast Guard has begun an assessment of PSUs, it is reasonable to expect that a comprehensive analysis of Specialized Forces could provide either a defensible basis for the existing structure or find unnecessary duplication and could recommend changes to the number and location of Specialized Forces. In summary, as we state in our report, a comprehensive assessment of Specialized Forces’ needs would, among other things, help the Coast Guard have a more complete picture of the extent to which certain Specialized Forces units could be better leveraged to meet mission requirements. Assessing the extent to which unnecessary overlap or duplication exists among Specialized Forces’ capabilities would better position the Coast Guard to identify capability gaps and reallocate resources, as needed, to use them more efficiently. We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Homeland Security, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-3841 or AndersonN@gao.gov. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Coast Guard Deployable Specialized Force Cost and Operations Data from 2016 to 2019 and Unit Locations This appendix provides Coast Guard data on Deployable Specialized Force (Specialized Forces) personnel, operations, costs, and resource hours showing a mix of operational tempos, including variation in the number of operations requested of some units such as Tactical Law Enforcement Teams (TACLETs) and Port Security Units (PSUs), but relatively constant numbers of personnel assigned to them. Table 3 provides operational and cost details for Coast Guard Specialized Forces units for fiscal years 2016 through 2018 and planned for 2019. Appendix II: The Coast Guard Missions This appendix details the Coast Guard’s 11 missions, which are characterized as non-homeland security and homeland-security missions (see Table 4). Appendix III: Comments from the Department of Homeland Security Appendix IV: GAO Contact and Staff Acknowledgements GAO Contact Nathan J. Anderson, (202) 512-3841 or AndersonN@gao.gov. Staff Acknowledgements In addition to the contact above, Ben Atwater (Assistant Director), Andrew Curry (Analyst-in-Charge), Chuck Bausell, David Dornisch, Michele Fejfar, Tracey King, and Calaera Powroznik made key contributions to this report. Also contributing were: Jason Berman, Dominick Dale, Eric Hauswirth, and Jan Montgomery.