Background Section 653(a) Reporting Mandates Congress first enacted Section 653(a) in the Foreign Assistance Act of 1971. According to Section 653(a), “not later than thirty days after the enactment of any law appropriating funds to carry out any provision of this Act (other than section 451 or 637) or the Arms Export Control Act, the President shall notify the Congress of each foreign country and international organization to which the United States Government intends to provide any portion of the funds under such law and of the amount of funds under that law, by category of assistance, that the United States Government intends to provide to each.” To provide Congress with the mandated data within the mandated time frame, State and USAID officials review the annual appropriations act and the accompanying joint explanatory statement to identify the congressional instructions contained within them. Although State has the delegated authority to approve the programming of foreign assistance funds and is charged with submitting the Section 653(a) report to Congress, State and USAID have shared responsibilities regarding the administration of certain foreign assistance accounts. Throughout this report we refer to the congressional instructions in the annual appropriations acts and those allocation tables within the joint explanatory statements that are incorporated by reference into the act as “requirements,” and we refer to Congress’s instructions to the agencies presented as additional language in the joint explanatory statement as “directives.” Foreign Assistance Appropriations Accounts Congress funds foreign assistance by appropriating funds to 16 accounts, each of which has a distinct purpose and specific legal requirements, such as the number of years the funds are available for obligation. Table 1 provides a summary of these 16 accounts. These accounts are generally administered individually by State or USAID, or jointly by both agencies. In addition, the period of availability for obligation for these accounts ranges from 1 to 5 years, or in some cases, until funds are expended. Appropriations Requirements and Directives and Administration Priorities The annual appropriations acts have hundreds of specific instructions— both requirements and directives—attached to many of the foreign assistance accounts that State and USAID address in the Section 653(a) report. According to State officials, the annual appropriations acts have become more detailed since the addition of the Section 653(a) mandates in the Foreign Assistance Act of 1971. For example, State officials said that when the Section 653(a) reporting mandate began the annual appropriations act contained fewer requirements and directives. The Foreign Assistance and Related Programs Appropriations Act, 1971, appropriated $2.2 billion in foreign assistance and was 18 pages in length. By contrast, the relevant portion of the annual appropriations act for fiscal year 2018 appropriated $33.7 billion in foreign assistance and was 138 pages in length. In addition, the accompanying joint explanatory statement was 9 pages in 1971 and 31 pages in 2018. As shown in table 2 below, during the 4 fiscal years covered by our review, the total number of requirements and directives addressed in the Section 653(a) reports has varied depending on congressional instructions within the annual appropriations acts and corresponding joint explanatory statements. For example, fiscal year 2016 had 1,056 total requirements and directives, while fiscal year 2018 had 657. The total number of requirements and directives has also varied by account. For instance, the Economic Support Fund, which was appropriated roughly $3.9 billion in fiscal year 2018, had 107 requirements and directives that instructed agencies how to allocate about $2.9 billion. Other accounts appropriated funds in fiscal year 2018 had fewer requirements and directives. For example, the International Disaster Assistance account, which was appropriated about $4 billion in fiscal year 2018, had three requirements and directives. The requirements and directives also vary in their specificity. For instance, of the $8.6 billion appropriated for Global Health Programs in fiscal year 2018, the joint explanatory statement required that $829.5 million be allocated toward maternal and child health. State and USAID were also required to make funds allocated for the Global Health Programs available in specific amounts, such as making $755 million available for activities addressing malaria in fiscal year 2018. State and USAID also balance the requirements and directives with administration priorities. For example, officials from OMB said that they review the Section 653(a) report to ensure that allocations for certain countries— such as Israel and Jordan—are consistent with the administration’s financial commitments to those countries. The text box below provides examples of the types of requirements and directives found in the fiscal year 2018 appropriations act. Foreign Assistance Requirements and Directives Congress includes a variety of instructions to the agencies managing foreign assistance funds in statutes, such as the annual appropriations acts, and in legislative history, such as the joint explanatory statements. These instructions come in two broad categories. Requirements: Congress’s instructions to agencies as contained in the annual appropriations act, including mandatory and non-mandatory spending, and tables within the joint explanatory statement that are required by statute. Directives: Congress’s instructions to agencies presented as additional language in the joint explanatory statement that are not required by statute. Examples Mandatory requirement detailed in law: “Of the funds appropriated by this Act, not less than $400,000,000 shall be made available for water supply and sanitation projects pursuant to the Senator Paul Simon Water for the Poor Act of 2005 (Public Law 109-121), of which not less than $145,000,000 shall be for programs in sub-Saharan Africa, and of which not less than $15,000,000 shall be made available to support initiatives by local communities in developing countries to build and maintain safe latrines.” Mandatory requirement referenced in law but detailed in the joint explanatory statement: Law: “For necessary expenses to carry out the provisions of chapter 4 of part II of the Foreign Assistance Act of 1961, $1,816,731,000, to remain available until September 30, 2019.” Joint explanatory statement: “Funds for certain programs under this heading are allocated according to the following table:” Ambassador-at-Large for Global Women’s Issues Conflict and Stabilization Operations Disability Programs Disability Programs Family Planning/Reproductive Health (U.S. Agency for International Development) House Democracy Partnership Organization of American States Polio Reconciliation Programs Trade Capacity Building 1,900,000 9,000,000 7,500,000 12,000,000 10,000,000 Nonmandatory requirement detailed in law: “Of the funds appropriated by this Act under the heading ‘Economic Support Fund,’ up to $112,500,000 may be made available for assistance for Egypt, of which not less than $35,000,000 should be made available for higher education programs including not less than $10,000,000 for scholarships for Egyptian students with high financial need to attend not-for-profit institutions of higher education.” Nonmandatory directive detailed in the joint explanatory statement: “The State Department Secretary and U.S. Agency for International Development Administrator are directed to provide no assistance to the central Government of the People’s Republic of China under Global Health Programs, Development Assistance, and Economic Support Fund, except for assistance to detect, prevent, and treat infectious diseases.” In addition, requirements and directives can be specific to a country or organization, specific to a sector, or be cross-cutting such that they may be applicable across multiple countries and accounts—as the examples above demonstrate. State submitted Section 653(a) reports that provided mandated data notifications on how foreign assistance funds are allocated by country and account; however, State did not submit the reports within the mandated time frame during fiscal years 2015 through 2018. During the years covered in our review, State’s Section 653(a) reports provided information to Congress on the tens of billions of dollars for foreign assistance accounts specified in the annual appropriations act. In addition to detailing the category of assistance by account, the Section 653(a) reports further delineated funding by the countries and international organizations to which the foreign assistance was directed. State also included supplemental spreadsheets with the reports that outlined how the various requirements and directives in the annual appropriations act were to be addressed. In fiscal years 2015 through 2018, State submitted Section 653(a) reports an average of 169 days after the enactment of the annual appropriations act (or 139 days late). During those 4 fiscal years, State submitted Section 653(a) reports from 80 to 230 days past the 30-day mandated time frame for reporting, as shown in figure 1. During the 4 fiscal years covered by our review, State took the longest amount of time to submit the Section 653(a) report in fiscal year 2015. State officials explained that in fiscal year 2015 and prior years it generally took them longer to submit the report because they first submitted a draft Section 653(a) report to the House and Senate appropriations committees. According to State officials, the appropriations committees’ majority and minority staff then engaged in negotiations with each other and with State on the draft to reach agreement on the final allocation of funds. In addition, the fiscal year 2015 appropriations act allowed State to propose deviations from the requirements in the joint explanatory statement. Thus, the agencies submitted the draft report to the appropriations committees with allocations that, in some cases, varied from the levels Congress included in the tables in the joint explanatory statement. State submitted the draft Section 653(a) report for the fiscal year 2015 appropriations act in April 2015 with the proposed deviations and engaged in a 5-month negotiation process to finalize the allocation of funds in September 2015. According to State, Congress changed the Section 653(a) reporting requirements in the fiscal year 2016 appropriations act to forestall the months-long negotiation process with the appropriations committees that had occurred in prior years. The fiscal year 2016 appropriations act authorized State and USAID to deviate in their allocations by up to 5 percent from the mandated amounts in the tables of the joint explanatory statement. This change allowed State to submit the report in a more timely fashion than in fiscal year 2015. By specifying how much leeway State and USAID were allowed in their allocations, the agencies were able to develop their plans without submitting a draft Section 653(a) report and seeking further agreement from the appropriations committees. As a result, officials submitted the 2016 report in 110 days, compared with 260 days in 2015. State’s Timeliness in Submitting Section 653(a) Reports Was Affected by Its Complex Process, Data Collection Weaknesses, and, in Fiscal Year 2018, Staff Vacancies We found that delays in submitting the Section 653(a) report were primarily attributable to State’s complex process to address appropriation requirements and directives while also reflecting administration priorities, as well as to data collection weaknesses. Nevertheless, State has not reviewed its process to identify and address such issues and other potential inefficiencies. Absent such a review, State is not in a position to improve its process to meet the 30-day mandate. In fiscal year 2018, State officials noted that reaching agreement on priorities within the new administration and staff vacancies also adversely affected the timeliness of the Section 653(a) report submission. State Has a Multistep Process for Responding to the Section 653(a) That Is Not Designed to Meet the Mandated Time Frame State has a multistep process to provide the mandated Section 653(a) report. Pre-appropriation preparatory work. According to State documentation, the process for responding to Section 653(a) mandates begins with State and USAID developing notional allocation estimates in a spreadsheet before the upcoming fiscal year’s annual appropriations act is passed. Allocation analysis and development. After the act is passed, USAID and State review their allocation estimates against the requirements and directives in the act and adjust their spreadsheet containing allocation estimates as necessary, taking into consideration policy direction from State and USAID leadership. According to State and USAID officials, detailed congressional instructions for particular accounts can limit the agencies’ ability to allocate funds according to the administration’s priorities and to consider country-specific foreign assistance needs. For example, Congress appropriated $876 million in fiscal year 2018 for the Nonproliferation, Anti-Terrorism, Demining, and Related Programs account and included 40 associated requirements and directives. State and USAID officials added that in order to satisfy all the requirements and directives they sometimes have to allocate appropriated amounts to address more than one requirement or directive. For instance, in the fiscal year 2018 Section 653(a) report, some of the funds allocated to meet an appropriation requirement for conventional weapons destruction were also designated as an allocation to satisfy a different requirement for humanitarian demining. Further, some amount of those funds satisfied a more specific requirement for humanitarian demining in Laos. State officials noted that by allocating appropriated amounts to more than one requirement or directive, they have greater flexibility to address administration priorities, while also meeting congressional instructions. Allocation negotiation, review, and agreement. State and USAID ensure that input from all the various parties is taken into consideration when further developing allocations. About 200 State and USAID bureaus and overseas posts review the allocations and propose changes in their copies of the spreadsheet that are then returned to State’s Office of U.S. Foreign Assistance Resources. According to State and USAID officials, they consider the proposed changes in light of emerging issues in selected foreign countries that may lead to the redirection of or changes to the proposed allocation of funds. State and USAID also review the proposed changes with agency leadership. OMB review and Section 653(a) report finalization and transmission. Once State and USAID agree on changes to the allocations, State submits the Section 653(a) report to OMB to be reviewed against the policy direction of the Executive Office of the President. State officials indicated that OMB feedback must be resolved before finalizing allocations. Concurrent with OMB’s review, State begins the process of finalizing allocation levels. Once State and USAID’s allocations are complete, State provides final allocation levels to bureaus and overseas posts and submits the Section 653(a) report to the relevant appropriations subcommittees. Given its complexity, State’s process is not designed to meet the mandated 30-day time frame. For example, in fiscal year 2018, State planned to complete the Section 653(a) process in 85 days. Figure 2 below outlines the stages of the Section 653(a) report development process and the targeted number of days for each stage during fiscal year 2018. The data developed for the Section 653(a) report plays a critical role in the obligation of tens of billions of dollars in foreign assistance funds appropriated annually. According to State and USAID officials, the agencies are constrained from obligating funds until the report is completed because a number of pre-obligation requirements are based on allocations in the Section 653(a) report. While the submission of the Section 653(a) report does not legally affect State’s ability to obligate foreign assistance funds, according to State and USAID officials, consultations, spend plans, and congressional notifications cannot be completed until allocation amounts are finalized through the Section 653(a) process. As a result, State and USAID officials said the amount of time it takes to submit the Section 653(a) report affects the obligation of funds. Data Collection Weaknesses Lead to Data Discrepancies and Hinder Efficiency of State’s Process State officials indicated that their process for collecting appropriations- related feedback and information from various offices, bureaus, and overseas posts necessitates significant staff time to correct data entry errors. Throughout the Section 653(a) process, State officials use a spreadsheet to consolidate information. For example, after State develops its initial allocations in the spreadsheet, it sends the spreadsheet out to about 200 bureaus and overseas posts to review and make appeals related to account and country allocations, which State and USAID then take into consideration as they continue to modify the allocations. According to State officials, reviewing suggested changes to allocations from about 200 bureaus and overseas posts is time consuming. This process is further complicated when they sometimes find mistakes in the returned spreadsheets, such as incorrect formulas and currency formats. Occasionally, returned spreadsheets also include additional data columns that were not in the original documents. Such discrepancies make it difficult to merge and process all of the suggested changes and identify how the changes interact with the various requirements and directives. State officials said that these discrepancies occur because they do not have controls in place to prevent modification of the spreadsheet. For example, the formulas and format of the spreadsheet can be manipulated by the various individuals reviewing the document. In addition, the spreadsheet does not automatically verify that the changes proposed by the bureaus and overseas posts comply with the requirements and directives. Instead, officials have to individually compare the changes with the requirements and directives and ensure that they are in compliance. State officials indicated that it takes them time and resources to discover and correct the errors, merge all of the spreadsheets, and ensure compliance, which contributes to delays in developing the Section 653(a) report. According to State’s Foreign Affairs Manual, State must maintain effective systems of management control that are designed to provide reasonable assurance regarding the prevention of or prompt detection of errors and irregularities. State officials indicated that while they do correct errors and validate the data in the Section 653(a) report for accuracy before final submission, it takes time and resources to do so, which adds to the total amount of time it takes to produce the report. Given the individual account and country allocations, and number of stakeholders involved in providing feedback, State officials acknowledged that their spreadsheet-based system is inadequate for the complexity of the task. State officials said that their existing data information system—the Foreign Assistance Coordination and Tracking System Info Next Generation—could potentially be modified to automate the distribution and collection of appropriations-related feedback from their offices and overseas posts, as well as to ensure that the changes comply with the annual appropriations act’s requirements and directives. Currently, State uses this system during the last phase of the Section 653(a) process to input the final allocations and share the Section 653(a) report with bureaus and overseas posts and the appropriations committees. While State officials said that they are exploring options to improve this process, they have not yet decided how to address weaknesses in their data collection system. State Views Its Current Section 653(a) Process as Necessary but Has Not Reviewed It to Identify Potential Inefficiencies State officials said that the Section 653(a) process that they developed is necessary to address congressional instructions and administration priorities and because they use the allocations in the report as a basis for spend plans required for the obligation of funds. Federal standards for internal control state that management should set objectives to meet the requirements of applicable laws and regulations. State officials noted that it might be possible to meet the 30-day mandate but that doing so would be inefficient because the subsequent report would need major revisions before finalizing allocations. According to officials, that alternative process, while it would meet the 30-day mandate, would be likely to further delay the development of spend plans and obligation of funds. State officials told us that they have informally suggested to the congressional appropriations committees that the mandated time frame for delivering the report should be extended, but they said they have not formally requested that Congress amend the 30-day reporting mandate. State officials said that they would also need to engage in conversations with authorizing committees responsible for making changes to the reporting mandate in the Foreign Assistance Act. GAO’s guidance on business process reengineering states that agencies should model their processes to identify problem areas and non–value- added activities that need to be changed or eliminated, such as excessive reviews. State officials said that, while they have made adjustments to improve their Section 653(a) process, they have not conducted a systematic review of their process since it changed in fiscal year 2016. Such a review could identify changes to expedite the completion and submission of the mandated report. Given that State’s process is not designed to meet the Section 653(a) 30-day reporting mandate, absent changes to its processes or Section 653(a), State is unlikely to meet the 30-day reporting mandate in the future. In Fiscal Year 2018, State Officials Noted That Agreeing on Administration Priorities and Staff Vacancies Also Affected Timeliness in Submitting the Section 653(a) Report Agreeing on Administration Priorities According to State officials, reaching agreement on administration priorities affected the timeliness of their Section 653(a) report in fiscal year 2018. The current Secretary of State and USAID Administrator both had their first experience with the Section 653(a) process during fiscal year 2018, which led to more detailed review within both agencies than in previous years, according to State officials. In addition, State officials said that USAID recommended unanticipated and significant changes to the proposed allocations before OMB’s review. USAID officials said that significant changes were necessary since USAID disagreed with the allocations State proposed for USAID’s appropriations within the Global Health Programs, Development Assistance, and the Economic Support Fund accounts. In fiscal year 2018, it took State and USAID 110 days to complete the allocation negotiation, review, and agreement step of the Section 653(a) process. According to State and USAID officials, they used 46 of the 110 days to reach agreement on the changes that USAID proposed. OMB officials noted that they needed to resolve policy issues concerning the administration’s foreign assistance priorities, which also contributed to delays. Once State sent the report to OMB in August 2018, OMB officials said that they approved the report after 36 days. In previous years, OMB officials explained that they usually approved the report within 15 days. However, they said that they were working to resolve a policy issue with other offices in the Executive Office of the President, and were therefore delayed in approving the fiscal year 2018 report. In total, it took State and USAID 189 days to produce the Section 653(a) report in fiscal year 2018. In fiscal year 2018, State planned to complete the Section 653(a) process in about 85 days after the enactment of the appropriations act—which exceeds the 30-day reporting, as shown in figure 3. In 2018, staffing gaps in State’s Office of U.S. Foreign Assistance Resources also affected the development of the Section 653(a) report. State’s Office of U.S. Foreign Assistance Resources is staffed by State and USAID-funded personnel and provides supervision and direction of State and USAID’s foreign assistance funding and programs. While the development of the Section 653(a) report is a critical task for the Office of U.S. Foreign Assistance Resources, the office and its staff are also responsible for developing a U.S. foreign assistance strategy, annual country-specific assistance operational plans, consolidated strategic and program plans, and operational budgets. State’s Office of U.S. Foreign Assistance includes two subordinate offices involved in developing the Section 653(a) report, both of which had vacancies in 2018. Within the Office of U.S. Foreign Assistance, the Resources and Appropriations office has primary responsibility for reviewing and identifying the Section 653(a) requirements and directives, but in 2018, five of 13 full-time equivalent positions, or 38 percent, were vacant. In addition, 10 of 41 full-time equivalent positions within the Regional and Global Affairs office, or 24 percent, were vacant. This office provides geographic and functional expertise to help develop and adjudicate allocations for the report. According to State officials, these vacant positions affected the timeliness of the Section 653(a) report in 2018 because the staff in both these offices assist with developing the report throughout the Section 653(a) process. As previously shown in figure 3, most of the delays in the fiscal year 2018 process occurred during the allocation negotiation, review, and agreement phase—which relies heavily on officials from the offices experiencing staffing gaps. According to State officials, the staff shortfall affecting the development of the fiscal year 2018 Section 653(a) report was due to the State hiring freeze that affected the entire agency, as well as vacancies among USAID personnel assigned to State’s Office of U.S. Foreign Assistance Resources. State’s hiring freeze took effect in January 2017 and was lifted in May 2018. In addition, State officials said that USAID has not filled USAID-funded vacancies within State’s Office of U.S. Foreign Assistance Resources. In fiscal year 2018, nine of the 13 full-time equivalent positions in State’s Resources and Appropriations office were funded by USAID, of which four were vacant, and 21 of the 41 full-time positions in Regional and Global Affairs office were funded by USAID, of which six were vacant. Our 2019 High-Risk Series report calls for agencies to design and implement action plans for closing skills gaps, which can include when an agency has an insufficient number of people to complete its work. The report states that the action plan should define the root cause of all skills gaps within an agency and provide suggested corrective measures, including steps necessary to implement solutions. State officials said that they have received permission to fill the vacant State positions, and USAID has provided permission to advertise two vacant USAID positions within State’s Office of U.S. Foreign Assistance Resources. Thus, that office is requesting additional State full-time equivalent positions. Despite these efforts, State and USAID officials said that they do not have an action plan to address the vacancies. Without a plan to fill these vacancies, a lack of staff resources will likely continue to impact the timeliness of the Section 653(a) reports. Conclusions Congress appropriates tens of billions of dollars for foreign assistance annually and mandates the President to report to Congress on how the U.S. government will allocate funds for foreign countries, by category of assistance, within 30 days of the enactment of the annual appropriations act. State and USAID have developed a complex process to balance how their allocations will meet the detailed requirements and directives within the annual appropriations acts, the administration’s priorities, and country-specific foreign assistance needs. However, State has been unable to meet the mandated time frame for submitting the Section 653(a) report for various reasons. Most importantly, State’s process for completing the various phases of the Section 653(a) process is not designed to meet the mandated 30-day deadline. Moreover, State officials have not systematically reviewed their process since it changed in fiscal year 2016, to identify areas that can be streamlined or eliminated to expedite the completion and submission of the report. Additionally, State’s system for collecting input on foreign assistance allocations from its various offices, bureaus, and overseas posts is prone to data entry errors that take extra time to correct, contributing to delays in submitting the Section 653(a) report. Further, State’s two offices primarily responsible for managing the Section 653(a) process had a substantial number of positions vacant in 2018 but did not have a formal plan to address the resulting skills gaps. Absent addressing these challenges, State and USAID will likely continue to be in violation of their legal mandate for submitting Section 653(a) reports to Congress within 30 days after the annual appropriations act is enacted. Recommendations for Executive Action We are making a total of three recommendations to State. The Secretary of State should ensure that the Director of State’s Office of U.S. Foreign Assistance Resources conducts a review of the Section 653(a) process to identify process steps that can be streamlined or eliminated and determine the time frame needed to prepare the annual Section 653(a) report. If State determines that the time frame exceeds 30 days, the office should coordinate with other appropriate officials to submit a legislative proposal to Congress to extend the mandated time frame for submitting Section 653(a) reports. (Recommendation 1) The Secretary of State should ensure that the Director of State’s Office of U.S. Foreign Assistance Resources improves the data collection from the many sources contributing to the Section 653(a) reports, such as by enhancing their data information systems. (Recommendation 2) The Secretary of State should develop a plan to address vacancies within State’s Office of U.S. Foreign Assistance Resources, consulting with the USAID Administrator as appropriate. (Recommendation 3) Agency Comments We provided a draft of this report to State, USAID, and OMB for review and comment. State and USAID provided written comments about the draft, which are reprinted in appendix II and appendix III, respectively. State also provided technical comments about the draft report, which we incorporated as appropriate. OMB did not provide comments on the draft report. State concurred with our three recommendations. USAID concurred with our first two recommendations; however, USAID’s written comments indicate that they do not believe staffing shortages at State were responsible for the chronic delays in the submission of the Section 653(a) report. While we do not report that staffing gaps were the primary reason for State not meeting reporting deadlines, we did find them to be a contributing factor to the delays in fiscal year 2018. State officials indicated that staffing gaps in their Office of U.S. Foreign Assistance Resources affected the development of the Section 653(a) report, contributing to delays. We are sending copies of this report to the appropriate congressional committees, the Secretary of State, the Administrator of USAID, the Acting Director of OMB, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6881 or bairj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology This report examines (1) the extent to which the Department of State (State) met the data notification and timeliness mandates under Section 653(a) of the Foreign Assistance Act of 1961 (Foreign Assistance Act) for fiscal years 2015 through 2018, and (2) the factors that affected State’s ability to address Section 653(a) mandates for fiscal years 2015 through 2018. To examine the extent to which State has met the data notification and timeliness mandates under Section 653(a) of the Foreign Assistance Act, we reviewed State’s Section 653(a) reports for fiscal years 2015 through 2018 to assess whether they documented the amounts of U.S. foreign assistance to be provided to each foreign country and international organization, as well as the amounts provided by category of assistance. To determine the timeliness associated with the development and submission of State’s Section 653(a) reports for fiscal years 2015 through 2018, we also reviewed documentation to identify when the Department of State, Foreign Operations, and Related Programs Appropriations Acts were enacted, the mandated submission dates, and compared those dates with the dates that State submitted the reports to Congress. We used this information to generate a figure that shows the actual submission time frames for Section 653(a) reports during those years compared with the 30-day reporting mandate. We also interviewed officials from State, the U.S. Agency for International Development (USAID), and the Office of Management and Budget (OMB) to better understand how the agencies address the Section 653(a) mandates. To examine the factors that affected State’s ability to address Section 653(a) mandates for fiscal years 2015 through 2018, we reviewed State and USAID documents. We also interviewed State, USAID, and OMB officials to get their views on what factors, if any, affected the timeliness of the Section 653(a) reports. For those factors that we identified, we requested and analyzed additional information as described below. In reviewing State’s Section 653(a) process, we analyzed State and USAID guidance documents and reports developed to address Section 653(a) mandates. We reviewed State’s analyses that identified the requirements and directives in the annual appropriations acts and joint explanatory statements for fiscal years 2015 through 2018. These requirements and directives outline how the agencies should allocate the funding for programs and for countries and international organizations. In addition, we reviewed State’s and USAID’s guidance documents that outlined the Section 653(a) process. Based on this information, we summarized State’s process and developed a figure that shows the major steps of State’s process, as well as the amount of time that each step lasted during the development of the fiscal year 2018 Section 653(a) report. We assessed State’s process against federal standards for internal control, which state that management sets objectives to meet the requirements of applicable laws and regulations. We also assessed the process against GAO’s guidance on business process reengineering, which outlines best practices on how agencies should model their processes. To examine the quality of the data State collects during development of the Section 653(a) reports, we reviewed whether State’s analyses followed State’s Foreign Affairs Manual requirement that State must maintain effective systems of management control programs designed to provide reasonable assurance regarding the prevention of or prompt detection of errors and irregularities. We analyzed State’s reports on the requirements and directives in the annual appropriations acts from fiscal year 2015 through 2018. In addition, we validated a judgmental sample of the requirements and directives that State identified to ensure that they were in the applicable appropriations act, joint explanatory statement, and reports from the appropriations committees in the Senate and House of Representatives. Although we identified an error in the appropriated amount recorded for the fiscal year 2016 International Narcotics Control and Law Enforcement account, we did not find errors specific to the requirements and directives State identified. Therefore, we concluded that the analyses were sufficiently reliable for our purpose, and we used State’s analyses to determine the total number of requirements and directives. Moreover, we reviewed the fiscal year 2015 through 2018 appropriations acts to identify the amounts appropriated for the accounts included in the corresponding Section 653(a) reports. We also identified the purpose and the time frame during which the appropriations for each account were available for obligation in the fiscal year 2018 appropriations act. To examine the issue of staff vacancies in fiscal year 2018, we received data from State and USAID on staff vacancies in key offices involved in the development and submission of the Section 653(a) report. In addition, we interviewed State and USAID officials about vacancies and whether they had developed plans to address the vacancies. We assessed whether State had designed and implemented action plans for closing skills gaps, which could include gaps caused by having an insufficient number of people to complete its work—as described in our 2019 High- Risk Series report. We conducted this performance audit from December 2018 to September 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate, evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Department of State Appendix III: Comments from the U.S. Agency for International Development Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Thomas Costa (Assistant Director), Mason Thorpe Calhoun (Analyst in Charge), Katya E. Rodriguez, Ashley Alley, Faisal Amin, David Dayton, Neil Doherty, Justin Fisher, and Melissa Wolf made key contributions to this report.


Background Securing the Mass Transit Environment Mass transit rail operators have primary responsibility for securing their own systems. Unlike the aviation environment, where TSA has operational responsibility for screening passengers and baggage for prohibited items prior to boarding a commercial aircraft, TSA has no operational role for securing mass transit, such as employing screeners or purchasing and acquiring security equipment. Rather, TSA regularly partners with mass transit operators to address their security needs by conducting vulnerability assessments, sharing intelligence information and best practices, and working to mitigate security risks to their systems by assessing commercially available security technologies, among other measures. Mass transit operators which can be public or private entities, administer and manage all transit activities and services, including acquiring and operating any technologies designed to augment their existing security infrastructure. Securing transit systems presents inherent challenges for mass transit operators for numerous reasons. In general, mass transit systems are designed to expedite the movement of large numbers of people through multiple stations, situated along extended routes, and technologies used in the mass transit environment should not disrupt the efficiency of these operations. In addition, individual stations within these systems frequently include multiple points of entrance and exit that vary in the extent to which they may be accessed by passengers. For example, open systems include walk-up platforms with little to no barrier to entry, while other, more closed systems, typically include dedicated points of entry and exit that allow or prohibit entry access through various mechanisms. Given the size and complexity of these systems, it can be difficult for operator personnel to comprehensively monitor them for security threats. Finally, the large number of riders that pass through these systems during peak hours generally makes the sustained use of some security measures and technologies (e.g., metal detectors) difficult because such measures could result in long lines that would disrupt scheduled service. Though mass transit systems are difficult to secure, mass transit operators commonly employ a number of standard security measures for the transit environment, including: public awareness announcements and signage (e.g., reminders to report unattended baggage or suspicious activities to operator personnel immediately); use of canine teams; access controls, such as the use of lasers for intrusion detection; station design (e.g., designing transit stations to limit recess areas where bombs could be hidden, such as under a bench or a ticket machine); and video surveillance, which includes video cameras that transmit a signal to a set of television monitors to display real-time footage of transit system platforms, entrances, exits, etc. (see figure 1). Requirements, Roles, and Responsibilities for Mass Transit R&D Federal requirements for mass transit R&D efforts guide department and agency efforts. Specifically, the Implementing Recommendations of the 9/11 Commission Act of 2007 requires that S&T, in consultation with TSA and the Federal Transit Administration, carry out an R&D program to improve the security of public transportation systems. Additionally, Executive Order 13416, Strengthening Surface Transportation Security, requires the Secretary of Homeland Security to coordinate research, development, testing, and evaluation of technologies related to the protection of surface transportation, including commercial off-the-shelf products. To implement these requirements and other related activities to help secure mass transit systems, DHS, S&T, and TSA, in coordination with mass transit operators, have assumed the following roles and responsibilities: DHS. DHS carries out its requirement to coordinate department-wide R&D (including that for mass transit and other surface transportation modes) through its Integrated Product Team (IPT) process. The IPTs themselves are comprised of officials across DHS components, and are tasked with identifying DHS technology capability gaps, which are defined as differences between a department or agency’s current capabilities and those capabilities needed to perform its mission. Each IPT is responsible for identifying capability gaps related to a broad security area (such as preventing terrorism) and potential R&D efforts to address those gaps. Capability gaps relevant to surface transportation, including mass transit, fall under the Prevent Terrorism IPT and its Explosive Screening sub-IPT. S&T’s Research Council receives IPT information on security gaps and is responsible for prioritizing them across all IPTs. The results are used to inform which R&D research projects S&T and DHS components will undertake (see figure 2). S&T. Once capability gaps are agreed upon and prioritized by DHS components through the IPT process, S&T undertakes R&D projects intended to address the highest prioritized capability gaps. S&T can undertake R&D projects on behalf of any of the department’s components, including TSA, and will either initiate development of a new technology solution or coordinate or adapt existing technologies to meet the project’s needs. Once S&T’s R&D efforts result in a preliminary technology, or prototype, S&T will begin the testing process. S&T’s technology development process includes developmental and operational testing phases that are carried out by staff at laboratories S&T contracts with. Developmental testing is typically conducted in simulated environments, such as laboratories, test facilities, or engineering centers, which can sometimes be representative of the complex operational environment (i.e., an actual subway station). Operational testing includes field tests performed under realistic conditions by actual users (i.e., the transit operators testing in a subway or rail station) and overseen by S&T in order to determine the effectiveness and suitability of a prototype technology. Once testing is complete, S&T contracts with staff at partner laboratories and works with private sector industry partners on further developing the product for the commercial market, where it can be purchased by mass transit operators to help secure their systems. TSA. While TSA does not conduct R&D for mass transit security, it does sponsor testing of commercially available security technologies for the mass transit environment. This testing can take place in both laboratory environments and in operational, real-world environments. Regarding the latter, TSA uses its Surface Transportation Operational Test Bed Program (Operational Test Bed Program) to place commercially available security technologies in surface transportation environments, such as mass transit systems, for performance testing and evaluation. TSA established the program to assess the effectiveness of emerging and existing security technologies in real-world environments; verify prior laboratory testing performance results versus performance in a TSA mass transit system (or other surface transportation mode serving as a test bed); and develop recommendations for use of certain technologies in surface transportation. As part of the program, TSA establishes memorandums of agreement with surface transportation entities that participate in the program and also provides them with logistical support, such as installing technology and providing personnel to help operators with technology training and operating needs. As of 2019, there are nine mass transit operators participating as test beds in the program (test beds), and TSA officials reported working to add two more mass transit agencies as test beds. In addition, there are five other surface transportation test beds, including two pipeline and two freight rail test beds. Mass Transit Operators. Mass transit operators generally do not have dedicated portions of their budgets for, and therefore do not conduct, R&D. However, selected operators work with TSA to test commercially developed technology solutions intended to enhance their system security. In general, mass transit operators must assume security-related expenses for their systems, including the purchase or acquisition of surface security technologies. S&T Has One Surface Transportation R&D Program Under Way, but Is Not Following DHS Guidance to Track Its Progress S&T Is Developing Technologies to Address Explosive Threats within Mass Transit Stations In 2010, S&T’s Explosives Division began work on the Surface Transportation Explosive Threat Detection (STETD) program to address the threat of improvised explosive devices (IED) on persons or in objects within a mass transit station. S&T officials stated that, as of fiscal year 2019, the STETD program remains S&T’s sole R&D program related to surface transportation. In addition, it is the only DHS technology development program focused on developing products to address the threat of IEDs in a mass transit security environment. The STETD program consists of four separate technologies designed to address explosive threats within a mass transit station, each of which is in a different stage of development and maturation. Specifically, the four technologies are known as Forensic Video Exploitation and Analysis (FOVEA), Standoff Detection, Real-Time Threat Detection Agent, and Layered Architecture. The technologies are designed to address unique aspects of the mass transit environment (i.e., multiple access points, lack of access barriers, etc.) while also working together to provide IED detection coverage from the point at which the passenger enters a mass transit station, boards a train, and then finally exits the system. These technologies would allow mass transit operators to scan large unstructured crowds to detect concealed explosives worn or carried on a person (person-borne IED), or placed in stationary objects such as baggage, or intentionally deposited in an unnoticed location for detonation by a timer or remote control (leave-behind IED). S&T intends for STETD technologies to perform without requiring checkpoint baggage screening or other measures that could impede the traveling public moving through mass transit systems during periods of high passenger volume (e.g., rush hour). FOVEA is a software suite designed to interface with video management systems already installed in mass transit systems, and is intended to help operators use recently recorded camera footage to quickly determine a person’s movement through the system. S&T began developing the technology in fiscal year 2013, and it is generally directed at helping operators identify responsible parties when objects are left behind in a mass transit system. Specifically, FOVEA includes a number of tools to enable its video analysis (see figure 3). As of December 2018, the FOVEA video suite has been installed in the Washington Metropolitan Area Transit Authority’s Security Operations Control Center. During our site visit to the control center to view the use of the FOVEA suite, officials told us that FOVEA has enhanced the ability of personnel to analyze video footage for active law enforcement investigations. Officials also told us that because of this functionality, FOVEA is a valuable tool. S&T anticipates it will transition the technology to commercial development in fiscal year 2020. Standoff Detection S&T is developing a set of imaging sensors designed to scan unstructured crowds to detect hidden potential threat items (e.g., a person-borne IED) on travelers without requiring passengers to open bags or remove outerwear. According to S&T, the sensor technology would be placed in walls, near platforms, or other structures. These screening devices are designed to unobtrusively scan for detailed information on possible person-borne threat objects, such as wires connected to a pressure cooker, and provide alerts to operators via the Real-Time Threat Detection Agent (described below). Development of these sensors began in fiscal year 2014, and since 2017, S&T officials have been using the Massachusetts Bay Transportation Authority training facility to test prototypes of the technology. S&T expects to transition the technology to commercial development in fiscal year 2023. Real-Time Threat Detection Agent The Real-Time Threat Detection Agent technology is intended to automatically detect abandoned objects that could be potential threats, and notify transit operators of their existence. Specifically, the system is to analyze live video footage to identify, tag (i.e., mark on the video footage), and track left-behind objects (i.e., baggage possibly containing IEDs), as well as individuals associated with the object, without the need for continuous human monitoring of video footage. To track potential IEDs without human monitoring, the system is intended to have the capability to identify abandoned objects that could be potential threats and compare them against defined criteria for person-borne, as well as leave-behind, IED threats. Based on its analysis, the system would then create alerts and send them to operators, as well as to video review software, such as FOVEA. Development of this system began in fiscal year 2013, and S&T began developmental testing of the technology at Washington Metropolitan Area Transit Authority facilities in October 2018. S&T expects to transition the equipment to commercial development in fiscal year 2021. Layered Architecture Layered architecture, the final component of the STETD program, is intended to have the capability to integrate information from the various existing security technologies utilized by a mass transit system to enable more accurate threat identification. The goal of this component is to gather input from multiple pieces of technology, such as distributed sensors and tools used across a mass transit environment (to include existing sensors and other STETD technologies), to present a consolidated threat profile to operators in a command center. This technological component is the least developed of the STETD program technologies, with ongoing work focused on experimentation with different prototypes. S&T expects to transition the technology to commercial development in fiscal year 2023. STETD Program Funding Since 2013, S&T’s funding for mass transit R&D has decreased, delaying the development of associated technologies. Specifically, during fiscal years 2013 through 2017 funding for the STETD program—the only DHS R&D program focused solely on mass transit security—decreased by 78 percent, but then increased again in fiscal year 2018 (see figure 4). According to S&T officials, one reason funding was reduced during this period was to direct additional funds to R&D for a newly-identified threat. Specifically, in fiscal years 2015 and 2016, following the landing of a gyrocopter on the U.S. Capitol grounds and other incidents, unmanned aerial systems became a significant and emerging threat, and a top DHS priority. At the time, S&T had no funding allocated for a related R&D effort, so S&T leadership subsequently redirected funding from the STETD program toward R&D on unmanned aerial systems. S&T officials told us that, due to fluctuations in funding, in addition to other factors, the program’s completion date has shifted from 2017 to 2023, which has delayed efforts to make the technologies commercially available to mass transit operators. Although S&T began increasing funds for the STETD effort in 2018, according to program officials, decreases in program funding have delayed program deliverables and pushed timelines out. For example, according to S&T officials, lower levels of program funding have made it difficult to employ highly-skilled contract staff at the laboratories S&T partners with to carry out STETD R&D, which has slowed the pace of development. S&T officials also stated that a lack of funding and changes in funding slow down what is already a technically challenging development effort. As S&T officials explained, the STETD program is pushing the performance boundaries and capabilities of existing technologies, and in some cases, inventing entirely new technologies for screening highly trafficked environments. S&T Has Not Developed Milestones to Effectively Track the Program’s Progress S&T is not using milestones that fully adhere to DHS guidance for milestone descriptions to track its progress on developing STETD technologies. Specifically, DHS budget development guidance directs DHS components to develop program milestones that are specific, measurable, results-oriented and relevant, and time-bound. To be results-oriented and relevant, milestones must clearly link to activities in program strategy, budget, or other planning documents. Linking milestones to such activities allows parties reviewing the milestones, such as DHS leadership and Congress, to understand how achieving the milestones move the development process forward overall. We assessed all 22 STETD milestones that S&T has used to report progress on the program from fiscal years 2013 through fiscal year 2018. We found that 17 of the 22 milestones were not results-oriented as required by DHS guidance because they did not clearly link to any key activities described by STETD program documents. Specifically, one STETD program document identified several key activities for completing work on the technologies, including a requirements development phase, developmental testing, and operational testing, but STETD milestones did not clearly link to these activities. For example, One fiscal year 2018 STETD milestone for the layered architecture technology was to conduct a simulation and analysis of layered sensing configurations to optimize sensor placement and system performance, to be completed by the end of fiscal year 2018. While this milestone was specific, measurable, and time-bound, it did not clearly link to a key activity (e.g., developmental or operational testing) identified in the STETD program’s plan, and thus was not results- oriented. Another milestone from 2013 was to demonstrate advanced leave- behind detection software in a mass transit system. The milestone was to be met by the second quarter of fiscal year 2014, and remained unmet as of March 2019. Because the milestone was not results-oriented (i.e., it did not link back to activities in program documents), it was unclear how failing to achieve the milestone impacted, or potentially delayed, the overall technology development process. S&T officials explained because they are dealing with technology innovation and invention, they plan to develop milestones that closely align to program plans after they develop a potential technology solution that is ready for developmental or operational testing. However, according to STETD program plans, it can take several years for STETD technologies to begin developmental testing. For example, one STETD technology (layered architecture) is not expected to begin developmental testing until the fiscal year 2021-2022 time frame. Therefore, under S&T’s current practice, the program would not begin using results-oriented milestones, clearly linked to program plans, for this STETD technology until more than ten years after work on the program was initiated. Furthermore, we found that for one STETD technology (FOVEA), the program did not consistently use results-oriented milestones after the technology began developmental testing. Specifically, in fiscal year 2015 S&T began developmental testing for FOVEA, but, two of three FOVEA milestones reported in fiscal years 2017 and 2018 were not results- oriented. Without milestones for the STETD program that reflect DHS guidance to clearly link the milestone to key events in program planning documents, Congress and DHS decision makers cannot fully assess whether the STETD program is meeting its goals within identified time frames. Additionally, DHS decision makers are not positioned to identify adjustments that may be needed to facilitate the achievement of program goals. We previously recommended in March 2019 that S&T take steps to more fully incorporate DHS’s budget development guidance, to include more results-oriented milestones, for its R&D programs. DHS concurred with this broader recommendation, and as of June 2019, is taking initial steps to ensure its implementation. TSA Prioritizes Tests of Technology Products, but Projected Funding Shortfalls May Reduce the Scope of Future Testing TSA Prioritizes the Testing of Technology Products to Secure Mass Transit Systems through Its Operational Test Bed Program TSA sponsors tests of commercial products at contracted partner laboratories, as well as at mass transit stations and other surface transportation venues through its Operational Test Bed Program. The purpose of these tests is to inform surface transportation operators about different technological products that could address their security needs and to confirm whether the products will operate effectively. As part of the testing process, TSA officials assist in product installation, hold technical demonstrations, and provide training for mass transit officials. Once product testing concludes, TSA officials document test results in written assessments, which they make available to mass transit and other surface transportation stakeholders to review upon request. TSA officials told us they use a number of methods to identify products that are currently available in the commercial marketplace and could be tested. Officials stated they conduct market research on vendors currently making technology products that could potentially meet the needs of mass transit operators, such as portable screening devices used to detect potential person-borne IEDs. To do so, officials maintain and utilize an existing list of vendors, conduct market research on their products, attend relevant symposiums and university conferences on technological advancements, and solicit information on these products and their capabilities from both vendors and operators who have used them. TSA officials also work with national laboratories to assist with relevant research on specific technological products and their capabilities that could be good candidates for testing. To determine which technology products to test, TSA prioritizes technologies that can be used in the mass transit environment. TSA officials told us that because of the level of risk facing mass transit systems, they generally try to ensure that the commercial products that are tested address capability gaps relevant to the mass transit environment. In addition, TSA officials stated that while they try to address all identified surface transportation capability gaps, due to limited resources, they tend to select, on an annual basis, products for testing related to the following gaps: anomaly and explosive detection, high throughput threat detection, intrusion detection, infrastructure protection, and chemical and biological threat security, all of which have applicability to the mass transit environment. Moreover, TSA officials told us that anomaly and explosive detection and high throughput threat detection are the technology gaps that are critical to securing mass transit systems. TSA officials also identify other criteria used for testing, including performance requirements and vendor claims about their products’ ability to address specific capability gaps. Regarding performance requirements, TSA officials told us any products selected for testing must meet a set of minimum performance requirements in order to be considered appropriate for addressing the unique security needs for different surface transportation modalities. For example, for an explosive screening product used in mass transit, TSA officials established requirements for probability of detection and probability of false alarm. TSA officials stated they work with mass transit operators and others to identify these requirements to ensure that IED detection technologies can effectively identify threats without disrupting mass transit operations. Lastly, TSA officials said they also try to select technologies that can be used to secure multiple surface transportation modes. For example, officials said they may select an intrusion detection sensor for testing that could be adapted for securing pipelines or freight rail yards. TSA Tested Approximately 110 Existing Technology Products to Secure Surface Transportation Systems from Fiscal Years 2013 through 2018, but May Have to Reduce the Scope of Future Testing From fiscal years 2013 through 2018, TSA sponsored laboratory and field tests of approximately 110 commercial products that are designed to address identified surface transportation capability gaps (such as intrusion detection and explosive detection). These tests take place in either of two environments—laboratory or field (i.e., within a mass transit venue)—and are designed to address surface transportation security capability gaps. Since 2013, 67 percent of the technology products (72 products) assessed by TSA focused on detection-related gaps, most of which were related to intrusion detection. The remainder of products tested addressed interoperable information systems or a combination of capability gaps, such as anomaly and explosive detection and chemical and biological threat security (see figure 5). Of the products that addressed more than one capability gap, 78 percent (14 of 18) of these products could be used for anomaly and explosive detection, as well as high throughput threat detection. TSA officials told us that because anomaly and explosive detection and high throughput threat detection technologies can be easily transported to different locations within a station, they are of particular interest to mass transit operators. On our site visits to two mass transit operators that TSA utilizes to test technology products, we observed the testing and use of commercial products. These products were designed to detect anomalies on the underside of railcars as well as among persons traversing transit platforms, terminals, and stations. The products were being used to support both normal operations and a national security special event (see figure 6). Mass transit officials told us during our site visits that they considered these commercial technologies to be useful additions to their existing security measures. They also said the test results, which TSA made available to them, were helpful in determining whether to invest in purchasing the products for long-term use. In addition to allowing TSA to perform technology assessments, the program also gives transit operators hands-on experience with technologies they are unfamiliar with. For example, an official from one mass transit test bed told us that equipment often performs differently when the manufacturer’s employees are operating it due to their prior experience with, and dedicated training on, the equipment. This official noted that transit system employees, who often do not have similar experience and training with a particular technology, can sometimes have different performance results when operating this equipment. The official told us that TSA’s Operational Test Bed Program gives transit employees an opportunity to develop structured, hands-on experience with certain products with TSA’s assistance, allowing them to understand the full potential and capabilities of the technology. This official said that, in her case, observing fellow transit employees using a particular technology for several hours convinced her of the product’s application in a real-world environment, and subsequently was an important factor in her decision to recommend its purchase for use by her transit agency. Although mass transit operators we spoke with valued the Operational Test Bed Program, TSA has decreased funding for the program since fiscal year 2013. Specifically, our analysis of program funding showed that the program experienced an approximately 70 percent decrease in funding from fiscal years 2013 through 2018 (see figure 7). TSA officials stated that recent decreases in program funding, coupled with projected funding shortfalls for the Operational Test Bed Program for 2019 through 2024, will limit the program’s capacity to conduct testing and assessments of technologies. Specifically, the TSA program manager for the Operational Test Bed Program told us that the recent decreases in funding for the program to its current level will materially impact the operation of the program moving forward. Furthermore, a TSA May 2019 budget planning document shows that, to fully meet project requirements, the program will require approximately $20 million in additional funding for fiscal years 2019 through 2024. Should the program not receive this funding, TSA officials stated they would not be able to test as many products or address as many surface transportation capability gaps through the program. They also stated that the funding shortfalls would limit TSA’s analysis of technology performance. Program managers are in the process of identifying additional funding requirements for the program through TSA’s internal budget review process. Mass Transit Stakeholders Effectively Collaborate to Identify Capability Gaps and Test Security Technologies, but TSA Does Not Comprehensively Share Technology Assessments S&T, TSA, and Mass Transit Operators Have Effectively Collaborated to Identify Mass Transit Capability Gaps and Test Technology Solutions through Four Key Mechanisms S&T, TSA, and mass transit operators regularly collaborate on issues related to identifying mass transit capability gaps and testing security technologies to address those gaps. During the course of our review, we identified four key mechanisms that S&T, TSA, and mass transit operators use to collaborate on mass transit security issues—the DHS IPT process’s sub-IPT focusing on surface transportation capability gaps (including those pertaining to mass transit); the Intermodal Transportation Systems Research and Development Working Group (RDWG); TSA’s Operational Test Bed Program; and the Transit Policing and Security Peer Advisory Group (PAG) (see table 1). We assessed the effectiveness of collaboration in these four mechanisms using our leading collaboration practices (see side bar) and found that each of them generally followed these practices. We reported in March 2019 that DHS-wide R&D collaboration has improved through the IPT process but some challenges remain, such as ensuring all components participate in the process, among other things. However, as discussed below, we found that S&T and TSA collaborate effectively through the IPT process for identifying mass transit security capability gaps and security technologies. sustained over the long-term? If leadership is shared, have roles and responsibilities been clearly identified and agreed upon? Have participating agencies clarified roles and responsibilities? participants been included? Do they have the ability to commit resources for their agency? mechanism be funded and staffed? Have online collaboration tools been developed? Written Guidance and Agreements: If appropriate, have participating agencies documented their agreement regarding how they will be collaborating? Have they developed ways to continually update and monitor these agreements? Prevent Terrorism sub-IPT on Explosive Screening. S&T and TSA collaborate on identifying surface transportation (including mass transit) capability gaps through the Prevent Terrorism’s sub-IPT on Explosive Screening. At the federal level, we found that TSA and S&T’s ongoing use of this mechanism met several leading collaboration practices, including bridging organizational cultures, leadership, clarity of roles and responsibilities, participants, and written guidance and agreements. Specifically, the Explosive Screening sub-IPT has a formal structure that is outlined in the Prevent Terrorism IPT’s charter. This written agreement establishes leadership and clarifies the roles and responsibilities of each of the participants. As key participants and voting members, S&T and TSA possess the necessary expertise to identify capability gaps for mass transit (i.e., S&T has expertise in technology research and development, and TSA has in-depth knowledge of the mass transit and other surface transportation sectors). Moreover, by requiring S&T and TSA to work together to prioritize capability gaps, the process allows them to operate across agency boundaries (i.e., to bridge their respective organizational structures). In 2012, S&T officials stated that they collaborated with TSA as members of the Explosive Screening sub-IPT to identify anomaly and explosive detection and high-throughput threat detection as the highest priority capability gaps for surface transportation. These gaps were the basis for S&T’s STETD program. RDWG. We also found that the RDWG facilitates effective collaboration between S&T, TSA, and surface transportation stakeholders, including 30 mass transit operators. The RDWG generally follows leading collaboration practices related to bridging organizational cultures, leadership, clarity of roles and responsibilities, participants, resources, and written guidance and agreements. Specifically, the RDWG is a working group with an established charter that brings together federal and surface transportation representatives to operate across agency and sector boundaries to identify surface transportation-related capability gaps, including those for mass transit. The RDWG charter clarifies the participant roles and responsibilities and establishes a framework for nominating new members to ensure all relevant participants are included. TSA, as the designated chair, funds the working group and ensures its continuation. In addition to identifying surface transportation security gaps, an S&T official told us that the members of the RDWG review the prior year’s security capability gaps to determine whether they are still relevant and if there are commercially available technologies to address them. The S&T official explained that they then use the results of these reviews to inform their work on the Explosive Screening sub-IPT, specifically using them as basis for R&D project requirements. For example, S&T officials said that anomaly and explosive and high- throughput threat detection were the gaps identified by the participants of the RDWG and then reported through the DHS IPT process, which ultimately helped inform the scope of S&T’s STETD program. In addition, S&T officials told us that they use the RDWG annual meetings to communicate to surface transportation stakeholders the progress they have made to address these gaps through the STETD program. Operational Test Bed Program. TSA’s Operational Test Bed Program facilitates collaboration between S&T, TSA, and mass transit operators on the testing and evaluation of security technologies. The program, through its memorandums of agreement with mass transit operators, generally follows leading collaboration practices related to collaboration criteria for bridging organizational cultures, clarity of roles and responsibilities, participants, resources, and written guidance and agreements. Specifically, memorandums of agreement serve as a mechanism for TSA and S&T to operate outside of their agency boundaries to test technologies in real-world environments (i.e., mass transit systems). The agreements also clarify the roles and responsibilities and serve as guidance for TSA, S&T, and mass transit operators on how testing is to be carried out. For example, the agreements clarify responsibilities for installing and operating test equipment. The program is funded and managed by TSA, and S&T and mass transit operators leverage TSA’s resources through their participation. Collaboration through the program has led to numerous benefits for TSA, S&T, and mass transit operators. According to TSA officials, the program allows TSA to fulfill federal requirements to test and evaluate mass transit security technologies and to expand the market for these products. Additionally, S&T has used the program’s established agreements with transit systems to facilitate the testing of STETD program prototypes. Lastly, transit operators use the program to obtain first-hand information on the performance of security technologies within their system. For example, an official from one mass transit operator participating in the test bed program told us they purchased two different types of passive millimeter wave scanners that they tested through the program and found to be effective. Transit Policing and Security Peer Advisory Group (PAG). The PAG facilitates collaboration among mass transit stakeholders to share information and meets the bridging organizational cultures, leadership, participants, resources, and written guidance and agreements collaboration key features criteria. Specifically, the PAG follows several practices through its charter, which designates a transit police chief as the chair of the group. The charter also outlines the participating mass transit stakeholders and allows them to share information across agency boundaries on security-related issues, including information on incident response, emerging threats, and other best practices on mitigating security issues. Officials from all nine of the mass transit operators we spoke with are members of the PAG, and seven of them stated that the PAG fosters collaboration between mass transit operators by providing a forum for transit officials to connect and share information. Particularly, one mass transit operator stated that the PAG was beneficial to the safety and security of her system because it has allowed mass transit officials to share experiences and disseminate best practices for responding to threats. Another official said that the PAG helped him stay informed about the current risks facing all of the mass transit operators, and without the group, collaboration probably would not happen. TSA Engages in Collaborative Activities to Share Information on Security Technologies, but Does Not Comprehensively Share Technology Assessment Information TSA engages in a number of collaborative activities to share information on security technologies with mass transit stakeholders to help improve their technology investments. Specifically, TSA disseminates a quarterly newsletter to surface transportation stakeholders (including mass transit operators) which summarizes TSA’s efforts to address various surface transportation security issues. Among other things, the newsletter shares information on the technologies for which TSA has sponsored testing in different mass transit operator systems. Additionally, TSA maintains a collective email account that was created for all mass transit operators to send TSA suggestions for technologies or products to test, among other things. Further, TSA officials stated that they notify and communicate to regional mass transit stakeholders any information on upcoming test bed demonstrations, so these stakeholders can attend in person if they prefer. Finally, according to the TSA program manager, TSA officials utilize the American Public Transportation Association’s annual conference, industry symposiums, and security roundtables to engage with mass transit stakeholders to share information on security threats, capability gaps, and technology. In addition, to assist transit operators, TSA produces a number of assessments and reports (products) that include performance information on a range of technologies. These products include: TSA’s Market Survey. TSA officials regularly update a market survey, which contains a list of commercial vendors who develop technological products capable of addressing surface transportation security issues. This list, which does not contain sensitive information and may be readily shared with operators, includes vendors and their associated products that TSA believes may be applicable to mass transit security; it does not catalog the list of products TSA has sponsored testing for. TSA officials populate this list by attending relevant symposiums and university conferences, as well as soliciting input from partner laboratories. Surface Transportation Sensor Catalog. The Surface Transportation Sensor Catalog documents the technology assessments performed by TSA and contains summaries of various security technologies evaluated since 2007. In addition to evaluated products, it also contains summaries of the vendor product demonstrations received by TSA since fiscal year 2016. TSA officials stated that the catalog is updated each year with new entries for recently evaluated products, and is intended as a resource for both TSA and its stakeholders to have greater awareness of technologies and help them make more informed technology investment decisions. State of Technology Reports. TSA publishes a State of Technology report that provides a detailed overview of a specific challenge to surface transportation stakeholders (such as person-borne IEDs) and gives a high-level summary of available products that could address it, and a technology maturation roadmap (with objectives) that needs to be implemented in order to meet surface transportation stakeholders’ operational and security needs to address those specific threats. Although these TSA products contain technology assessment and other information that would benefit mass transit operators seeking to purchase and implement security technologies, mass transit operators may not be receiving them. Specifically, TSA shares these products with transit operators upon request. However, officials from seven of the nine mass transit operators that we spoke with said they wanted more technical assessment information on commercially available security technologies, indicating that they may not be routinely requesting, and therefore not receiving, the TSA products that would provide this information. In addition, four of the nine said they would like TSA’s assessment information on technologies to be more accessible. Finally, an official from one mass transit system who previously worked for TSA on mass transit issues, and thus has knowledge of the broader mass transit community, stated that many operators would benefit from the Surface Transportation Sensor Catalog, but smaller operators are not aware of this resource and therefore do not know how to request it. TSA officials stated they do not routinely share information on security technologies with mass operators for two reasons. First, TSA officials explained that many of the in-depth reports that result from its testing of security technologies contain sensitive information and cannot be distributed without first assessing whether the requester is eligible to receive it. However, officials from most of the mass transit operators we spoke with said they would like more technical assessment information. Therefore it could be useful for mass transit operators to know when TSA publishes these reports so they can request the full report for review. This notification could consist of non-sensitive, high-level information on technologies assessed so that mass transit operators could request the information in full. Second, the TSA program manager responsible for these assessments told us that his office does not have sufficient resources to develop and maintain a centralized, web-based repository that would allow mass transit operators to search and retrieve sensitive information independently, such as the sensor catalog and technology assessment reports. Despite these limitations, in the past, TSA has shared information related to technology assessments routinely with mass transit operators. For example, TSA used to post a verified technology list on a Federal Emergency Management Agency web page. A TSA official stated that the information posted on the website included summary information on technology evaluations and other technology information. Further, TSA received feedback from surface transportation (including mass transit) stakeholders that the information posted was useful. TSA no longer posts information on the web page because the Federal Emergency Management Agency no longer maintains the website. In addition, TSA officials stated that they had plans to include more comprehensive information about TSA’s technology assessments within an online information resource known as the DHS Responder Knowledge Base—a department-wide database previously developed to house information for first responders. In April 2019 officials from DHS’s Countering Weapons of Mass Destruction Directorate said they had plans to reach out to TSA and other DHS components on how to utilize the Responder Knowledge Base as a repository for their reports and other sensitive information. Furthermore, officials from that directorate told us that the database is about 2 years from being launched, and they do not have a specific completion date. Standards for Internal Control in the Federal Government states that management should communicate externally to their stakeholders through the appropriate means. Further, the 2013 National Infrastructure Protection Plan states that in order to ensure that situational awareness capabilities keep pace with the evolving risk environment, officials should improve practices for sharing information that will improve security and resilience. Until the Responder Knowledge Base is operational, mass transit operators could benefit from TSA routinely sharing appropriate information on the technology assessments and other performance information at its disposal. For example, TSA could leverage the resources of existing coordination mechanisms, like the PAG, or develop a listserv to automatically notify a more comprehensive group of mass transit operators of the existence of a new technology assessment or sensor catalog. Notifying more mass transit operators on an ongoing basis that this information is available would help ensure they have the benefit of all relevant TSA information when making strategic security technology investments. Further, doing so would help mass transit operators to better use their limited resources to acquire proven technologies that could enhance the overall security posture of their systems. Conclusions Monitoring and securing surface transportation systems continues to present unique challenges. With respect to mass transit systems, for example, operators must balance the need to efficiently move passengers through the system with the need to screen for explosives and other threats. Since 2010, S&T’s STETD program has been the only DHS R&D program that has developed technologies to address these challenges. Although S&T has made progress, as of fiscal year 2019, none of the technologies associated with the STETD program have matured enough to undergo commercial development, and the program’s completion date has been extended from fiscal year 2017 to fiscal year 2023. While fluctuations in the program’s funding have contributed to delays, S&T has not followed DHS guidance for developing milestones that would help officials understand whether the program is achieving key activities identified in planning documents when faced with funding and other challenges. Without milestones that clearly convey an understanding of the program’s progress, DHS decision makers are not positioned to identify any adjustments that may be needed to facilitate the achievement of program goals. S&T, TSA, and mass transit operators effectively collaborate through a number of stakeholder groups to identify mass transit security gaps and to test possible technology solutions that could address them. TSA also supports greater awareness of available technologies by publishing key information on commercially available products (such as technology assessment results) and making it available to mass transit operators upon request. However, TSA does not comprehensively or routinely share this information, and seven of the nine mass transit operators we spoke with stated they wanted more technology assessment information. Without a mechanism to share technology assessments and related information with more mass transit operators and on a routine basis, TSA cannot ensure that mass transit operators will be fully informed about available technologies they could use to secure their systems. Moreover, without this information, mass transit operators may not be positioned to make the best possible use of the limited funding available for purchasing these technologies. Recommendation for Executive Action We are making two recommendations, one to DHS and one to TSA. The Deputy Secretary of Homeland Security should ensure that S&T take steps to more fully incorporate practices for developing milestones within DHS’s budget preparation guidance, into the Surface Transportation Explosive Threat Detection program. (Recommendation 1) The Administrator of TSA should develop a mechanism to more routinely and comprehensively share appropriate information on the performance of mass transit security technologies (such as the annual sensor catalog and security technology assessments) with mass transit operators and stakeholders until DHS completes work on a more permanent information sharing resource. (Recommendation 2) Agency Comments and Our Evaluation We provided a draft of this report to S&T and TSA for review and comment. DHS provided written comments which are reprinted in appendix I. In its comments, DHS concurred with both recommendations and described actions planned to address them. S&T and TSA also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the acting Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact William Russell at (202) 512-8777 or russellw@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix II. Appendix I: Comments from the U.S. Department of Homeland Security Appendix II: GAO Contact and Staff Acknowledgments William Russell (202) 512-8777 or RussellW@gao.gov. Staff Acknowledgments In addition to the contact named above, Christopher Ferencik (Assistant Director), Mona Nichols Blake (Analyst in Charge), Jason Blake, Frederick K. Childers, Michele Fejfar, Jonathan G. Felbinger, Eric Hauswirth, Tracey King, Kristiana D. Moore, Claire Peachey, Jack Sheehan, Sarah Veale, and Robert Ward made key contributions to this report.