Background It is DOD policy that installations, property, and personnel shall be protected and that the authority of a DOD commander to take reasonably necessary and lawful measures to maintain law and order and to protect installation personnel and property includes the individuals’ removal from or denial of access to, an installation when those individuals threaten the orderly administration of the installation. The Under Secretary of Defense for Intelligence develops overall security policy, including requirements for the DOD Physical Security Program, and the secretaries of the military departments and heads of DOD components establish policies and procedures to implement the Under Secretary’s policies. DOD’s Process for Determining Whether to Grant Unescorted Access to Individuals Seeking Access to DOD Installations Individuals may seek unescorted, escorted, or trusted traveler access to DOD installations. As previously mentioned, this report focuses on individuals seeking unescorted access. Unescorted installation access requires, with limited exceptions, individuals seeking access to establish their identity, be determined fit for access, and establish an acceptable purpose for their presence on the installation. DOD components’ security forces establish the identity of individuals at authorized installation control points by using identification credentials, specifically a DOD-issued common access card or other credentials listed in DOD guidance. DOD’s Identity Matching Engine for Security and Analysis (IMESA), which is maintained by the Under Secretary of Defense for Personnel and Readiness, helps security forces make current fitness-for-access determinations for installations that have PACS that connect to IMESA. IMESA electronically links PACS to federal government (including DOD’s) and local population databases to verify information contained in individuals’ credentials and to search for derogatory information. IMESA continuously vets individuals for fitness- for-access determinations against these authoritative government databases every 24 hours. If derogatory information is found, IMESA is to send an alert to the PACS so that security forces can take appropriate action if and when those individuals next seek access to installations. Individuals without a common access card or another acceptable credential who seek access to installations with PACS are sent through the installations’ visitor control process where security forces are to (1) authenticate the individuals’ identity, (2) establish an acceptable purpose for their presence on the installations, and (3) make fitness-for-access determinations using any derogatory information from authoritative government databases. These databases could include those accessible through IMESA, where available and as applicable. Figure 1 illustrates the process for gaining unescorted access to installations with PACS that connect to IMESA—both for individuals with and without acceptable credentials. Types of PACS That DOD Components Have Fielded and IMESA’s Capabilities DOD components have fielded the following types of PACS at their domestic installations: DBIDS. DMDC developed DBIDS and it is used by the Air Force, the Navy, the Marine Corps, and DLA to control access to their respective installations. DBIDS consists of hardware and software—specifically, computers, servers, badge printers, and handheld identification devices. DBIDS has the capability to electronically connect to authoritative government databases using IMESA. AIE. The Army developed AIE to control access to its installations. AIE consists of hardware and software—specifically, computers, servers, badge printers, and handheld identification devices. AIE also includes additional hardware such as gate arms and automated pedestals where individuals can scan their own credentials. AIE has the capability to electronically connect to authoritative government databases using IMESA. RAPIDGate. RAPIDGate is a legacy system that according to DMDC officials is no longer being fielded to DOD installations and, according to Army officials, as of October 2018 was in use at only four domestic Army installations. RAPIDGate does not have the capability to electronically connect to authoritative government databases. Deployed by DOD in 2014, IMESA verifies enrolled individuals’ information against (1) DOD’s Defense Enrollment Eligibility Reporting System to determine if the credentials have been revoked; (2) the Federal Bureau of Investigation’s National Crime Information Center’s Wanted Persons file to determine if there are records on the individuals for an outstanding felony warrant; (3) the Federal Bureau of Investigation’s Terrorist Screening Database to determine if the individuals are known or suspected terrorists; and (4) the local population database, according to an OUSD(I) official, to determine if credentials issued by installations have been revoked or have expired. Individuals with enrollable credentials are enrolled in IMESA when their credentials are scanned by PACS for the first time. According to DMDC officials, once individuals are enrolled, IMESA continuously vets them against these authoritative government databases every 24 hours and it takes approximately 2 seconds for each individual’s credential to be vetted through IMESA. Figure 2 illustrates the process of using PACS to electronically connect to IMESA to validate individuals’ identity and continuously vet individuals’ fitness for access to DOD installations. Roles and Responsibilities Related to Physical Access Controls The Under Secretary of Defense for Intelligence is responsible for establishing department-wide physical access control standards, procedures, and guidance, consistent with DOD guidance and applicable laws, to include developing processes for establishing the identity of individuals seeking access to installations. The Under Secretary of Defense for Personnel and Readiness is responsible for designing and maintaining IMESA, and establishing and executing a plan to integrate IMESA with PACS at all DOD installations. DMDC is a center within the Office of the Under Secretary of Defense for Personnel and Readiness that provides identity management services and oversees the fielding and maintenance of DBIDS. DOD components issue their own component- and installation-specific requirements for physical access control. These include physical access barrier requirements such as fences, as well as the use of PACS. Each DOD component has designated a program manager to supervise and oversee its physical security program, to include PACS. According to DOD component guidance and officials: The Army Acquisition Corps, Product Manager for Force Protection Systems, is responsible for the procurement and fielding for the Army’s PACS. The Army Office of the Provost Marshal General develops PACS requirements based on DOD and Army policies for the Army’s physical security program. The Commander Navy Installations Command is responsible for the Navy’s PACS. The Air Force Security Forces Center is responsible for the Air Force’s PACS. The Office of the Deputy Chief of Staff for Logistics, Engineering, and Force Protection, Directorate of Security Forces, is responsible for developing service-wide access control policies. The Commander, Marine Corps Installations Command, is responsible for the Marine Corps’ PACS. The Deputy Commandant, Plans, Policies, and Operations establishes policies, sets requirements, and is responsible for the Marine Corps’ Physical Security Program. DLA Information Operations and Installation Support Security and Emergency Services Staff Directors share responsibility for the DLA’s PACS. Additionally, DOD component installation commanders are responsible for the physical security of their installations, including for the use of PACS. DOD Has Issued Guidance on Physical Security, Fielded or Planned to Field PACS, and Identified Future Enhancements DOD Has Recently Issued Department-wide Guidance for Controlling Installation Physical Access, and Fielded or Planned to Field PACS at All Domestic Installations OUSD(I) issued a physical security manual in January 2019 that addresses minimum department-wide standards for access to DOD installations. The manual incorporates and cancels Directive-Type Memorandum 09-012, the interim policy for DOD physical access control that was in effect for about 9 years. The manual directs DOD components to, among other things, implement procedures for all populations to gain access to component installations; field electronic PACS at all DOD installations; and fund the continued operation, maintenance, and enhancement of IMESA with additional government data sources. The manual also states that new electronic PACS and existing electronic PACS undergoing significant upgrades (valued at more than 50 percent of replacement cost) must interface with IMESA. Each DOD component had also issued guidance on installation physical access control standards that pre-date the January 2019 physical security manual. For example, DLA Manual 5200.08 Volume 1 identifies DBIDS as DLA’s PACS and requires certain installation commanders to incorporate and maximize the use of electronic credential authentication. In another example, Army Regulation 190-13 assigns installation commanders responsibility for implementing AIE, when available, and states that deviations from the Army AIE standards and specifications are not authorized without written approval from Army headquarters. DOD component officials said that they will update their guidance to incorporate the DOD installation access control standards contained in OUSD(I)’s 2019 physical security manual. To implement these department-wide access control standards, according to OUSD(I) and DOD component officials, each DOD component has fielded or plans to field PACS that connect to IMESA at all their domestic installations. According to DOD component officials, as of February 2019, the Air Force, the Navy, the Marine Corps, and DLA have fielded DBIDS at all of their domestic installations. Specifically, according to DOD component officials, DBIDS is fielded at: 67 Air Force installations 16 Marine Corps installations According to Army officials, as of February 2019, AIE was fielded at 35 of the Army’s domestic installations. The officials stated that the Army currently plans to field AIE at an additional 60 installations by September 2019, and at all of its remaining domestic installations by the end of fiscal year 2021. However, Army officials told us that, at the direction of the Secretary of the Army, AIE is undergoing additional testing and assessment to inform a comparison with DBIDS. The Secretary of the Army is expected to make a decision sometime in summer 2019 on which PACS to field at remaining Army installations. DMDC Has Identified Future Enhancements to IMESA and DBIDS, and the Army Has Identified Future Enhancements to AIE DMDC plans to enhance IMESA’s capabilities to allow for increased information sharing and vetting, and to expand the type of credentials that DBIDS can scan. Specifically, the Under Secretary of Defense for Intelligence has identified additional authoritative government databases that IMESA will connect with to access derogatory information. For example, the Under Secretary of Defense for Intelligence directed the secretaries of the military departments to develop a plan to vet individuals seeking unescorted access to domestic installations for disqualifying derogatory information in additional files within the National Crime Information Center’s database and the Interstate Identification Index by September 30, 2019. According to an OUSD(I) official, IMESA will be able to access two additional National Crime Information Center files by 2020: the National Sexual Offender Registry File and the Violent Persons File. The official also stated that there are plans to connect IMESA to DOD’s Automated Biometric Identification System by 2020. DMDC plans to expand the types of credentials that DBIDS can scan, to include all credentials listed in DOD’s 2019 physical security manual. For example, according to DMDC officials, scheduled enhancements to DBIDS will enable security forces to scan cards and driver’s licenses compliant with the REAL ID Act of 2005 by the end of fiscal year 2019. Moreover, according to DMDC officials, this enhancement will eliminate the time and expense to annually issue and print hundreds of thousands of temporary DBIDS credentials. The officials also stated that DMDC has plans to enable DBIDS handheld devices to read military veterans’ health identification cards, although no time frame for implementation has been set. Army Office of the Provost Marshal General officials told us that AIE can already scan identification cards and driver’s licenses compliant with the REAL ID Act. This capability allows individuals with these credentials to be vetted and enrolled in IMESA in the access control lane without having to go the visitor control center. According to Army officials, this “in-lane” initial vetting and IMESA enrollment takes approximately 30 seconds by checking the National Crime Information Center database and Interstate Identification Index for criminal history and active warrants. Further, these officials told us that the Army has also identified future enhancements to AIE, such as transitioning to a cloud-based version. The officials told us that a cloud-based version of AIE will allow for quicker and more cost- effective fielding because of fewer installation prerequisites and reduced computer hardware requirements. Army officials are also considering other enhancements, such as self-service kiosks and web-based registration options, to streamline and expedite initial visit registrations. The Air Force and DLA Have Monitored the Use of PACS, but the Army, the Navy, and the Marine Corps Have Not The Air Force and DLA monitor their installations’ use of PACS and the Army, the Navy, and the Marine Corps do not. As a part of our work, we conducted numerous site visits to domestic installations to observe the DOD components’ use of PACS, but details concerning our findings associated with these visits are omitted because the information was deemed sensitive by DOD. Air Force and DLA officials stated they routinely collect data on PACS use and the number of credentials scanned at their installations and provide those data to their leadership. Additionally, the Air Force is using these data to brief installation commanders on the risks associated with not using DBIDS at their installations. Army, Navy and Marine Corps officials stated they do not monitor PACS use at their installations because there is not a requirement to do so. Our review of DOD guidance also found no such requirement. DOD component officials emphasized the importance of installation commanders having discretion to make risk-based decisions regarding access control in general, and in deciding when or when not to use PACS. Nevertheless, OUSD(I), Army, Navy, and Marine Corps officials agreed that monitoring installations’ use of PACS would be beneficial and could be readily accomplished without significant cost using existing technology. For example, Army, Navy, and Marine Corps officials stated that their installations could collect monthly scanning data using existing PACS reporting mechanisms to identify below average use and determine if actions are needed to increase use. One OUSD(I) official further stated that, depending on the extent to which installations are not using PACS, changes to guidance might be warranted to require monitoring of the use of PACS. DOD Instruction 5010.40, Managers’ Internal Control Program Procedures directs the Office of the Secretary of Defense and DOD component heads to implement a comprehensive system of internal controls that provides reasonable assurance that programs are operating as intended and to periodically evaluate the effectiveness of those controls. Furthermore, Standards for Internal Control in the Federal Government for performing monitoring activities states that management should monitor and evaluate the results of its internal control systems by obtaining relevant data on a timely basis, and determine appropriate control actions for any identified deficiencies. Because the Army, the Navy, and the Marine Corps do not monitor the use of PACS and because OUSD(I) does not require that they do so, those military services do not know the extent to which PACS are being used at more than 100 installations. Consequently, the military services do not have the data they need to evaluate the effectiveness of PACS and inform risk-based decisions to safeguard personnel and mission– critical, high-value installation assets. Demonstrating the importance of using PACS that connect to IMESA, we note that, according to DMDC, IMESA has identified more than 42,000 instances of individuals who were granted access to a DOD installation and were subsequently issued a felony warrant. DMDC and the Army Have Approaches for Resolving PACS Technical Issues, but DMDC Has Not Assessed the Performance of Its Approach While the Army Has DMDC and the Army Have Approaches and Helpdesks for Resolving PACS Technical Issues Installation security forces call the DMDC helpdesk for assistance in resolving DBIDS technical issues. According to DMDC officials, this helpdesk handles technical issues for more than 100 DMDC applications and programs, including DBIDS, and is staffed 24 hours a day, 7 days a week. DMDC helpdesk staff classify DBIDS technical issues into one of three tiers, based on complexity and the estimated time to resolve an issue. According to DMDC officials, tier I issues tend to be the least complex and typically take the least time to resolve, whereas tier III issues tend to be the most complex and typically take the longest time to resolve. Tier II issues fall between tier I and tier III issues with respect to complexity and anticipated resolution time. Below are examples of issues that are experienced in each tier: Tier I. Unresponsive computer screens, passwords that need to be reset, and relatively simple network printer issues. Tier II. Handheld device battery charging issues, network synchronization issues, and problems installing fingerprint readers. Tier III. Handheld devices not connecting to servers, locked user accounts, and equipment that needs to be replaced. According to DMDC officials, all calls to the helpdesk are initially handled by a tier I customer service representative. The tier I representative triages the issue using DBIDS reference materials, and if he or she is unable to resolve the issue it is passed to a tier II customer service representative. If the tier II representative is unable to resolve the issue using DBIDS reference materials, then, with a supervisor’s review and approval, the call is transferred to the tier III group. The issue is then assigned to either the tier III hardware group or the tier III software/application group, depending on the nature of the technical issue. According to DMDC officials, the tier III hardware group is located in Ashburn, Virginia, and the tier III software/application group is located at DMDC’s offices in Seaside, California. The Army also has instituted a tiered approach for resolving AIE technical issues through its helpdesk. The AIE helpdesk is also staffed 24 hours a day, 7 days a week. Similar to DBIDS, the Army classifies AIE technical issues into one of three tiers, based on complexity and time to resolve. According to Army officials, all Army installation security forces’ calls to the helpdesk are initially handled by a tier I customer service representative who tries to resolve the issue using AIE reference materials. If the tier I representative is unable to resolve the issue, the issue is passed to a tier II field service representative. The field service representative is expected to contact the installation within 24 hours and attempt to resolve the issue by email or phone. If the field service representative is unable to resolve the issue remotely, the representative will make an in-person service visit to attempt to resolve the issue. If the issue cannot be resolved, then the customer service representative classifies the issue as tier III and transfers the issue to AIE system engineers for resolution. According to Army officials, tier III issues are usually Army-wide issues, such as problems associated with software updates. DMDC Has Not Assessed the Performance of Its DBIDS Helpdesk but the Army Has Developed Performance Measures and Goals to Assess AIE’s Performance DMDC has collected data on DBIDS technical issues; however, DMDC has not been able to assess its performance due to a lack of performance measures and associated goals. Table 1 shows the number of DBIDS technical issues and the average time it took to resolve them, by tier, from January 2016 through July 2018. Specific details regarding the number of issues and the resolution time were omitted because the information was deemed sensitive by DOD. The Army collects data on AIE technical issues and has developed performance measures and associated goals to assess AIE performance. Specifically, the AIE Reliability Analytics Model tracks real-time information on operational availability with a goal of 100 percent, the number and age of open helpdesk tickets with a goal of resolving tier II issues within 48 hours, and field service representative performance with a goal of a 100 percent closure rate for tier II issues. According to Army officials, the Army is currently developing specific targets for its tier I and tier III technical issues. The Army has used data on AIE technical issues to improve AIE performance. For example, due to the age and number of tickets, the Army analyzed 646 AIE helpdesk tickets generated from October 2017 through February 2018 and determined that the root causes of the most prevalent technical issues were site server and handheld device failures. As a result of its analysis, the Army implemented an AIE software update and has begun fielding a more reliable brand of handheld device to installation security forces. According to Army officials, AIE operational availability has increased and technical issues are resolved more quickly since the AIE Reliability Analytics Model came online in September 2017. For example, from September 2017 through August 2018, AIE’s operational availability increased from 93 percent to 98 percent and the average ticket age for all tiers decreased by 33 percent. Increased AIE operational availability allows for increased continuous vetting of individuals seeking access to Army installations. Army officials at all levels have access to the model, and the Army Product Manager for Force Protection Systems sends weekly emails to Army leadership highlighting AIE performance achievements and challenges. We have previously reported, that by tracking performance and developing performance measures, agencies can better evaluate whether they are making progress and achieving their goals. Further, to fully address challenges agencies must be able to demonstrate progress achieved through corrective actions, which is possible through the reporting of performance measures. Characteristics of effective performance measures include having baseline or trend data, setting measurable program goals, and establishing time frames for achieving goals. Program goals communicate what results the agency seeks and allow agencies to assess or demonstrate the degree to which those desired results are achieved. Both performance measures and goals give managers crucial information to identify gaps in program performance and plan any needed improvements. Although user agreements between DMDC and the DOD components state that DMDC will provide helpdesk and maintenance support, the agreements do not include performance measures and associated goals regarding DBIDS’ operational availability and the timely resolution of technical issues. DMDC officials acknowledged that performance measures and associated goals would likely reduce the time it takes to resolve DBIDS technical issues, particularly for tier II and tier III issues. However, until DMDC develops performance measures and goals, its ability to systematically address the underlying issues negatively affecting DBIDS’ operational availability is hindered. Conclusions Although according to DOD officials DOD has fielded or plans to field PACS that connect to IMESA at all domestic installations, only the Air Force and DLA have monitored PACS use at their installations. The Army, the Navy, and the Marine Corps at more than 100 installations have not monitored the use of PACs because, as stated by officials, there is not a requirement to do so. As a result, these components do not have the data necessary to evaluate PACS effectiveness and inform risk-based decisions regarding PACS use to safeguard personnel and mission- critical, high-value installation assets. Further, DOD component and installation officials told us about their dissatisfaction with the time it takes to resolve DBIDS’ technical issues. Although the Army has developed performance measures and associated goals for its helpdesk that have improved the ability to resolve technical issues and overall AIE operational availability, DMDC has not. Without such performance measures and associated goals, DMDC is unable to systematically evaluate how well DBIDS is performing and address underlying issues negatively affecting DBIDS’ operational availability. Recommendations for Executive Action We are making the following five recommendations to the Department of Defense: The Secretary of Defense should ensure that the Under Secretary of Defense for Intelligence requires that DOD components (including the military departments and DLA) monitor the use of PACS at their installations. (Recommendation 1) The Secretary of the Army should ensure that the Office of Provost Marshal General monitors the use of PACS at Army installations. (Recommendation 2) The Secretary of the Navy should ensure that the Commander, Navy Installations Command, monitors the use of PACS at Navy installations. (Recommendation 3) The Secretary of the Navy, in coordination with the Commandant of the Marine Corps, should ensure that the Commander, Marine Corps Installations Command, monitors the use of PACS at Marine Corps installations. (Recommendation 4) The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness develops appropriate performance measures and associated goals for the timely resolution of DBIDS technical issues to facilitate improved PACS performance. (Recommendation 5) Agency Comments and Our Evaluation We provided a draft of this report to DOD for comment. In its written comments, reproduced in appendix II, DOD concurred with our five recommendations and identified actions that it was taking or planned to take to implement our recommendations. Regarding our second recommendation, DOD concurred with that recommendation to monitor the use of PACS at Army installations, and on the basis of the department’s written comments we modified the recommendation to indicate that the Army Office of the Provost Marshal General is responsible for monitoring the use of PACS at Army installations. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and the Under Secretary of Defense for Intelligence. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology In this report we (1) describe actions the Department of Defense (DOD) has taken to develop guidance on physical access to domestic installations and to field physical access control systems (PACS) at these installations, (2) evaluate the extent to which DOD components have monitored the use of fielded PACS at these installations, and (3) evaluate the extent to which DOD has implemented an approach for addressing PACS technical issues and assessing associated performance. This report is a public version of a sensitive report that we issued on May 31, 2019. The sensitive report included an objective related to the extent to which security forces at various DOD domestic installations used fielded PACS. DOD deemed a significant portion of the information related to this objective to be sensitive, necessitating protection from public disclosure. This public report omits information related to our observations of PACS use at these installations and the risks associated with not using PACS. As a result of this omission, we updated the wording of the second objective to focus on DOD components’ efforts to monitor the use of fielded PACS at installations. Although the second objective and the information associated with it in this public report is more limited, we relied on the same methodology to support our findings and the excluded information does not impact our recommendations. The first and third objectives in this report are the same as in the sensitive report and use the same methodology as in the sensitive report. DOD deemed some of the detailed information presented in conjunction with the third objective to be sensitive, necessitating protection from public disclosure. As a result, this public report omits specific details regarding the technical issues of PACs. This report focuses on physical access controls at authorized access control points at DOD’s domestic installations that are owned and operated by the Army, the Navy, the Air Force, the Marine Corps, and the Defense Logistics Agency (DLA). We did not consider actions DOD has taken to prevent unauthorized access to its domestic installations by means such as tunneling under or climbing over perimeter barriers. For objective one, we analyzed key Office of the Under Secretary of Defense for Intelligence (OUSD(I)) and DOD component policies outlining physical access control requirements. The key guidance documents we analyzed are listed in table 2. Additionally, we interviewed officials from OUSD(I), the Joint Staff, each of the DOD components, and the U.S. Northern Command to discuss the guidance documents and any efforts to update, revise, or draft new guidance on the use of installation PACS. We also reviewed DOD component documentation and interviewed OUSD(I) and DOD component officials to determine the extent to which PACS was fielded at domestic installations and to identify ongoing efforts to field PACS at additional domestic installations. Finally, we interviewed DOD officials to identify any planned future enhancements to PACS and the Identify Matching Engine for Security and Analysis (IMESA). For our second objective, we focused on individuals seeking unescorted access to DOD domestic installations. We reviewed and analyzed OUSD(I), DOD component, and installation-specific guidance on the use and monitoring of PACS. We conducted site visits to six domestic installations to meet with installation command and security force officials to discuss their experiences using PACS and to observe their use of PACS. We then compared the guidance and our observations with Standards for Internal Control in the Federal Government for monitoring activities, which states that management should obtain data on a timely basis so that they can be used for effective monitoring. Although findings from these six installations are not generalizable to all DOD domestic installations, they are illustrative of how PACS are used, and more generally, how installation access is controlled. In selecting the six installations to visit we considered installation ownership to ensure that we included an installation from each DOD component, geographic proximity among installations, and the type of PACS used by the installation. We also visited an installation where no PACS was installed. We limited our site selection to active-duty installations in the continental United States. Based on this methodology we visited Fort Stewart, Georgia; Moody Air Force Base, Georgia; Naval Station Mayport, Florida; Marine Corps Support Facility Blount Island, Florida; Tobyhanna Army Depot, Pennsylvania; and DLA Distribution Center Susquehanna, Pennsylvania. For our third objective, we reviewed DOD user agreements to determine the support agreement terms, requirements, and responsibilities for addressing PACS technical issues. We analyzed DOD component data on the number and type of Defense Biometric Identification System (DBIDS) helpdesk technical issues reported from January 2016 through July 2018, and compared the data with provisions in the user agreements that discuss the PACS helpdesk. We also compared the steps the Army and DMDC have taken or planned to address helpdesk technical issues with Standards for Internal Control in the Federal Government for developing performance measures, which states that management should establish performance measures and indicators. We interviewed officials from DOD components and the installations we visited to discuss their experiences with PACS helpdesks, and their views on the performance and reliability of PACS. We assessed the reliability of the helpdesk technical issue data by interviewing knowledgeable officials about the data and by testing the raw data to determine the accuracy of the summary data provided by DOD. Additionally, we collected and analyzed the raw data to determine whether calculations were made correctly. We determined that the data were sufficiently reliable for our understanding the number and types of PACS technical issues. To address our three reporting objectives, we met with officials from the DOD organizations listed in table 3. We conducted this performance audit from February 2018 to August 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We subsequently worked with DOD from July 2019 to August 2019 to prepare this public version of the original sensitive report. This public version was also prepared in accordance with these standards. Appendix II: Comments from the Department of Defense Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact name above, GAO staff who made key contributions on this report include Brian Lepore, Director (retired); Jason Bair, Acting Director; Marc Schwartz, Assistant Director; Shawn Arbogast, Analyst-in-Charge; Jamilah Moon; Richard Hung; Mae Jones; Amie Lesser; Serena Lo; Amber Lopez Roberts; and Carter Stevens.


Background JOM Program Eligibility and Administration The JOM program provides supplementary financial assistance, through contracts, to meet the unique and specialized educational needs of eligible American Indian and Alaska Native students. Eligible students, under Interior’s regulations, are generally Indian students age 3 through grade 12 who are either a member of an Indian tribe or at least one- quarter degree Indian blood descendant of a member of an Indian tribe. BIE contracts with tribal organizations, Indian corporations, school districts, and states—which we collectively refer to as JOM contractors as that is the term used by Interior—that administer local JOM programs and disburse funds to schools or other programs providing JOM services. Most JOM funds are distributed through tribal contractors, according to BIE. BIE generally relies on BIA officials to disburse JOM funds, as noted previously (see fig. 1). BIE’s director is generally responsible for directing and managing JOM functions, including establishing policies and procedures, coordinating technical assistance, and approving the disbursement of JOM funds. In 2014, BIE established one centralized position dedicated solely to administering JOM as part of a broader re-structuring initiative and the position has been consistently staffed since 2018. The current JOM program specialist is responsible for planning, developing, administering, and coordinating the JOM program. It is the federal government’s policy to fulfill its trust responsibility for educating Indian children by working with tribes to ensure that education programs are of the highest quality. In 2016, Congress found in the Indian Trust Asset Reform Act that “through treaties, statutes, and historical relationship with Indian tribes, the United States has undertaken a unique trust responsibility to protect and support Indian tribes and Indians.” As further stated in the Act, the fiduciary responsibilities of the United States to Indians are also founded in part on specific commitments made in treaties and agreements, in exchange for which Indians surrendered claims to vast tracts of land. JOM Program Requirements and Implementation The JOM program is the only federally-funded Indian educational program that allows for student, parent, and community involvement in identifying and meeting the educational needs of American Indian and Alaska Native students, according to the National Johnson-O’Malley Association—a tribally led organization which advocates for JOM programs. The JOM regulations require prospective contractors to formulate an education plan in consultation with an Indian Education Committee, generally made up of parents of American Indian and Alaska Native students, and to submit the plan to BIE. Indian Education Committees have the authority to, among other things, participate fully in planning, developing, implementing, and evaluating their local JOM programs. According to BIE officials, JOM funds can be used to support a wide variety of supplemental education programs. For example, these funds support programs providing Native cultural and language enrichment; academic support; dropout prevention; and the purchase of school supplies, according to BIE (see fig. 2). JOM programs, particularly for students who are not living near tribal land, may be the only way students can access tribal language and cultural programs. According to BIE officials, JOM funding is primarily disbursed to contractors through three different funding mechanisms: self- determination contracts, self-governance compacts, and 477 plans. Most JOM contractors—over 200—are funded through self-determination contracts, according to data provided by BIE. These three funding mechanisms result in different oversight authority for Interior. However, the Johnson-O’Malley Supplemental Indian Education Program Modernization Act (Modernization Act)—enacted on December 31, 2018—requires all JOM contractors to submit annual reports to the Secretary of the Interior with the number of eligible Indian students during the previous fiscal year, an accounting of the amounts expended, and the purposes for which those amounts were expended. BIE officials said some contractors can also be subject to site visits to oversee the program. JOM Program Funding Under regulations, JOM funds are to be distributed to contractors by a formula that factors in the number of eligible students to be served and average per-student operating costs. Interior conducted its most recent official JOM student count in 1995. As a result, subsequent JOM distributions have been based on the number of students served by contractors in 1995—271,884 students. BIE officials said that the total number of eligible students has increased since 1995, although no official count has been completed. As a result, the funding contractors receive may not reflect changes in the number of students served by contractors. The size of JOM contracts currently ranges from less than $1,000 to nearly $4 million, according to data provided by BIE. The Modernization Act requires BIE to determine the number of eligible students served or potentially served and to complete a rulemaking process to, among other things, modernize program rules. BIE published a preliminary report on its initial determination of eligible students in October 2019 and is continuing to work on finalizing its count of eligible students. Additionally, in response to the Modernization Act, Interior promulgated new final JOM program regulations that became effective March 26, 2020. BIE Lacks Key Information on the JOM Program Needed for Oversight BIE Does Not Have a Complete and Accurate List of JOM Contractors BIE does not maintain a complete and accurate list of all JOM contractors. BIE officials said JOM funds are disbursed by awarding officials in various BIA offices in different locations, and there is no systematic process to identify and collect information on all the awarded contracts. BIE began efforts to identify all the contractors and the amount of their awards in May 2019 after we asked for this information. As of December 2019, BIE said they identified more than 340 contractors. BIE officials said they have not verified the accuracy and completeness of their current list of contractors. According to federal internal control standards, an agency should have relevant, reliable information to run and control its operations. BIE officials said their current list of JOM contractors is incomplete because some Interior officials responsible for administering and disbursing JOM funds did not respond to their requests for information. In addition, BIE officials said they may not have contacted all the relevant officials within Interior when they developed the list. BIE officials also said they do not know how many contractors may be missing from their list. Further, they said they did not validate the accuracy of the information they received on JOM contractors. Our analysis of BIE’s list of JOM contractors identified data reliability concerns. For example, we found 19 contractors that were listed twice, meaning the total number of contractors provided by BIE contained duplicates and was not an accurate count. BIE officials said that maintaining a complete list of contractors would be very helpful in their efforts to oversee and administer the JOM program, including allowing them to share program information more effectively with all contractors. For example, BIE did not inform all contractors about four consultation sessions it was holding in July 2019 on a proposed rule to change JOM regulations because BIE did not have contact information for all contractors, according to a BIE official. As a result, some contractors may have missed the opportunity to participate in the consultation sessions. Two JOM school contractors we interviewed told us they were not informed by BIE about the consultation sessions that took place in their state. These contractors said they had to create their own networks of contractors to inform each other about JOM-related developments and events because they cannot rely on communication from BIE. In addition, BIE officials said that a complete and accurate list of contractors would help them determine the number of eligible JOM students, as mandated by the Modernization Act. In the two previous efforts to update the count, BIE relied on contractors to submit the number of eligible students they serve. However, BIE officials acknowledged that the last effort to complete a count in 2014 failed, in part, because some contractors never received any communication that BIE was conducting a count. As a result, these contractors never submitted a count of students. Without a systematic process for maintaining a complete and accurate list of contractors, BIE may continue to face barriers administering the program. BIE Does Not Routinely Track the Timeliness of Payments to Contractors BIE does not have a process for tracking and monitoring the timeliness of JOM disbursements to contractors. According to BIE officials, the bureau does not establish a target date for disbursing funds to JOM contractors. JOM contractors and BIA and BIE officials we interviewed said the disbursements of JOM funds to some contractors are routinely provided later than expected based on contractors’ past experience. For example, 27 school contractors did not receive a portion of their calendar year 2018 funding until September 2019, according to the BIA official primarily responsible for disbursing the contractors their funds. Further, some of these contractors did not receive any disbursement in the 2019 calendar year until August, months after funds are typically disbursed. Delays in disbursing funds can hinder contractors’ ability to effectively manage their JOM programs and serve students. For example, the three JOM school contractors we interviewed told us that delays in disbursements have negatively affected their ability to plan their JOM activities because they do not know when they will receive their funding. The contractors also said their JOM programs are not as robust as they could be because they regularly delay spending and retain prior disbursements to use in the following year in anticipation of future delays in disbursements. Even with these carry-over funds, contractors said they have had to delay JOM programs for students due to late disbursements of funds, which negatively affect students who depend on JOM for educational support. We were unable to determine the full extent to which Interior disburses JOM funds in a timely manner because BIE and other Interior offices do not track and monitor the timeliness of JOM disbursements to contractors. Federal internal control standards state that agency management should design control activities to achieve objectives and respond to risks, such as by comparing actual performance to planned or expected results and analyzing significant differences. BIE, however, has not established target disbursement dates for contracts and therefore has no standard against which to measure the timeliness of disbursements. Furthermore, BIE does not systematically track the time between receiving its appropriation and the disbursement of contractor funds. BIE officials acknowledged that establishing a target date for disbursing funds to contractors and tracking progress in meeting that date could help ensure funds are provided in a timely manner. In an effort to monitor the disbursement of contractor funds, BIE officials said they have recently started to track the balance of JOM funds at each Education Resource Center. However, they acknowledged that tracking the balance of funds has limited usefulness in tracking the timeliness of disbursements because the information about fund balances does not include whether or not individual contractors have received their funds. BIE officials said having more detailed information on the disbursement of JOM funds would be helpful to ensure funds are provided in a timely manner. In addition, we recently reported that funds associated with self- determination contracts and self-governance compacts for tribes, which include JOM funds, are not always disbursed in a timely manner. We recommended that the Assistant Secretary of Indian Affairs should establish a process to track and monitor the disbursement of funds to tribes that are associated with self-determination contracts and self- governance compacts. However, this recommendation does not address all JOM contractors because non-tribal contractors are not eligible for self-determination contracts or self-governance compacts, and not all tribal contractors receive JOM funds through these mechanisms. Without also establishing a process for tracking and monitoring the disbursement of JOM funds through multiple funding mechanisms, BIE does not have reasonable assurance that funds will be disbursed in a timely manner. BIE Has Not Formally Assessed the JOM Information It Collects from Contractors or Updated Its Related Forms BIE has not formally assessed the usefulness of the information it has collected from JOM contractors for over 25 years. One contractor questioned whether the information was useful for the agency’s administration of the program because they never received any feedback or comments from BIE about the information they submitted. The contractor said they spent a considerable amount of time completing their annual report, which totaled over 60 pages and included information and signatures from over 40 different Indian Education Committees that oversee local JOM programs funded by the contract. In addition, all four contractors we interviewed that submitted annual reports said the information requested in the forms could be streamlined. For example, BIE’s annual report form asks each school or project site to report both the “number of eligible students actually served” and “the number of students actually served.” No instructions are provided to distinguish between the two populations, and the contractors said the reported number is identical since students must be eligible to be served by JOM. All four contractors we met with that said they submitted an annual report and renewal application also told us the information collection forms were burdensome to complete. For example, they said the forms were difficult to fill out, in part because they are not compatible with computer word processing programs, and as a result, responses have to be handwritten or completed with a typewriter. All of the forms BIE uses to collect information from contractors subject to JOM reporting requirements are also out of date. For example, the JOM renewal application form expired in 1993, meaning the Office of Management and Budget’s (OMB) approval to collect the information has lapsed. Agencies are required to submit all proposed information collections to OMB for approval. OMB reviews the proposal to assess the need for collecting the information and whether its collection minimizes burden on the public, among other things. Federal internal control standards also state that management should have a process to continually identify information requirements. In a 2015 presentation, BIE officials recognized the need to update the outdated forms to reflect technological developments and reduce the paperwork burden for contractors, but no revisions to the forms have been made. BIE officials said they plan to update the JOM application and reporting documents through the formal OMB review and approval process, but they do not have a timeline for doing so. We have previously reported that outdated forms may not be necessary or useful and may be an unnecessary burden on the public. Until BIE updates the forms, some contractors will continue to struggle to complete them. Further, by assessing the usefulness of the information they are collecting from JOM contractors, BIE may identify opportunities to both collect information that could improve program management and streamline information requests. BIE Has Not Developed JOM Training BIE has not provided or developed training for JOM contractors, according to BIE officials. National Johnson-O’Malley Association officials told us that BIE and BIA used to provide training that was helpful to JOM contractors on topics such as filling out annual reports and applications for JOM contracts, particularly to new staff managing these programs, but they no longer do so. A nonprofit organization for Indian education we interviewed also said JOM contractors need training on a range of issues, including how to complete JOM annual reports and other documentation, and on how to operate following implementation of the Modernization Act. According to the nonprofit organization, regular training on JOM is particularly important because certain aspects of the program, such as conducting annual assessments to determine the learning needs of Indian children served by the program, can be technically challenging. Officials from one tribal contractor we interviewed said the tribe provides its own training to school staff that implement local JOM programs on such topics as how to conduct Indian Education Committee meetings, how to fill out reimbursement claims, and how to organize and maintain financial records for program administrators and parents on Indian Education Committees. The contractor said that BIE training on topics, including how to conduct and how often to hold Indian Education Committee meetings, would be particularly helpful. Another tribal contractor we interviewed, which BIE data identified as receiving among the largest amount of JOM funds of all contractors, said that other contractors they interact with do not have sufficient program knowledge or resources to provide training and could benefit from BIE training. According to a BIE official, a former JOM Program Specialist, the need for training for JOM contractors is particularly important as there is frequent turnover among contractor staff responsible for administering programs. Officials from the nonprofit organization for Indian education also told us that high turnover rates among administrators of local JOM programs necessitates regular training for new staff. They added that more senior staff working on local JOM programs would also benefit from regular training because they may be implementing their programs inefficiently or ineffectively. BIE officials told us they have provided program updates and answered questions at conferences hosted by organizations representing JOM contractors. Not all contractors, however, are able to attend these conferences given their limited resources, according to three contractors we interviewed. Internal controls standards state that management should develop training based on the needs of individuals’ roles. BIE officials acknowledged that developing and providing training is needed, but they told us they are currently focused on other aspects of managing the JOM program and have not prioritized training. For example, the agency has set a goal in its strategic plan to develop a JOM program handbook by July 1, 2020. By providing training, BIE can ensure that contractors have the information they need to better serve their students. BIE Has Not Clearly Defined or Identified All the Roles and Responsibilities of BIE and Other Interior Staff Involved in Administering the Program BIE has not clearly defined roles and responsibilities or identified the staff necessary for conducting critical JOM functions. According to federal internal control standards, management should establish an organizational structure, assign responsibility, and delegate authority to achieve the entity’s objectives. BIE’s lack of defining or identifying roles and responsibilities related to administering contracts, reviewing the appropriateness of contract types, and conducting program oversight is described in the following bullets. Administering contracts. BIE did not identify staff to administer some contracts, which has contributed to some JOM programs affected by these contracts going unfunded. According to BIE and BIA officials, BIE did not assign any staff to administer at least 20 contracts in California, including helping contractors renew their contracts when they expired, typically after 3 years. As a result, these contracts—totaling over $300,000—expired and were not renewed, disrupting JOM services. A BIE official informed us there were lapses in administering these contracts because BIE closed the office responsible for administering them as a result of its reorganization which began in 2014, and never assigned anyone to assume responsibility for the contracts associated with that office. BIE has not assessed whether similar lapses in coverage may have occurred in other states or regions. BIE officials identified the unallocated funds from California in September 2019. In October 2019, BIE officials began efforts to identify and contact officials responsible for all the JOM programs whose contracts lapsed in California due to gaps in BIE’s administration of the program and began the process to start new JOM programs in the future. However, without identifying staff to administer all JOM contracts, problems with renewing and awarding contracts may persist. Reviewing the appropriateness of contract types. Interior’s Office of the Solicitor does not have a role in reviewing the issuance of new JOM contracts, according to a senior attorney in that office. The Office of the Solicitor’s lack of a role in reviewing JOM contracts increases the risk that contracts are not used appropriately. For example, we found that BIE has been using self-determination contracts to disburse JOM funds to non-tribal contractors, which is not authorized by the Indian Self Determination and Education Assistance Act. Under the Act, only Indian tribes and tribal organizations are eligible to enter into self-determination contracts; these contracts may not be used for non-tribal entities, such as school districts and states. The use of self- determination contracts for contractors that are not eligible to receive them can result in costs to the government. Self-determination contracts include provisions that would not otherwise be included in non-tribal JOM contracts, according to a senior attorney in the Office of the Solicitor. For example, self-determination contracts may include contract support costs and extend the Federal Tort Claims Act to tribal government employees administering the federal program(s) under these contracts. Therefore, school contractors that were disbursed JOM funds through self-determination contracts may have received contract support costs and legal protections they would not have been eligible to receive, according to the senior attorney. BIE officials told us that they have not determined how long self- determination contracts have been used to disburse JOM funds to non-tribal entities, how many non-tribal contractors were awarded these contracts, or whether the government has incurred costs as a result of using the wrong types of contracts. They said this information will be difficult to obtain because it is not systematically collected. After we found that BIE was using self-determination contracts to disburse JOM funds to school contractors, a senior attorney in the Office of the Solicitor said that her office would provide assistance as requested to BIE in transitioning these contracts to appropriate contracts. By systematically including the Office of the Solicitor in the process for reviewing JOM contracts, BIE can ensure that its contracts are the appropriate type and can minimize the risk of future inappropriate costs to the federal government. Conducting JOM oversight activities. BIE has not defined the roles and responsibilities related to overseeing JOM programs or identified staff dedicated to this function. For example, BIE has not identified staff at Education Resource Centers or other BIE offices with the capacity to conduct site visits and review JOM annual reports submitted by contractors. As a result, the bureau’s oversight of JOM contractors is done on an ad-hoc basis and sometimes not done at all, according to BIE officials. For example, in an internal memo addressed to BIE’s Director, a senior BIE official said that because the bureau has not identified staff with the capacity to conduct site visits, most Education Resource Centers have not conducted any site visits in at least 5 years. Officials from one tribal JOM contractor that said it is subject to BIE oversight told us that BIE has not conducted a site visit of their program in 10 years. They noted that BIE’s past site visits resulted in recommendations that improved their program activities and procedures and changed how they defined student eligibility. In addition, the head of an Education Resource Center said that JOM oversight activities are collateral duties that his staff do not have time to fulfill. Further, the responsibilities of officials who are charged with overseeing JOM programs have not been clearly defined. For example, BIE has not defined the responsibilities related to conducting site visits, such as what aspects of the program should be reviewed and which contractors should be selected for site visits. This lack of clearly defined responsibilities has resulted in inconsistencies in how officials are conducting oversight activities and potential gaps in coverage of contractors that are subject to oversight. BIE’s lack of oversight may also increase the risk of misuse and abuse of JOM funds. According to Interior’s Office of Inspector General, there have been three identified cases of theft related to the JOM program that occurred between 2004 and 2010. For example, a program coordinator of a JOM contract stole program funds as part of an embezzlement fraud scheme and was ordered to pay nearly $36,000 in restitution. By identifying staff who have the capacity to carry out oversight activities and clearly defining related responsibilities such as conducting site visits and reviewing JOM annual reports, BIE could provide support to contractors in improving their program activities and procedures and reduce the risk of potential fraud and abuse of JOM funds. Senior BIE officials acknowledged that they have not identified the staff necessary for conducting these critical JOM functions and, in November 2019, the Director of BIE approved hiring three additional JOM specialists. The core responsibilities of the new specialist positions, according to a knowledgeable BIE official, will be to support the administration of contracts, oversee contractors, and provide technical assistance. However, the exact roles and responsibilities for the new employees and the extent to which BIE staff in the Education Resource Centers will continue their role in providing programmatic support have not yet been determined. An official knowledgeable about the new JOM specialist positions added that defining the specific roles and responsibilities for these positions will be an iterative process in which BIE will assess the new staffs’ capacity to assume all the JOM responsibilities that are currently assigned to other staff. Until all the roles and responsibilities related to JOM program management have been identified and clearly defined, challenges in administering contracts, reviewing the appropriateness of contract types, and overseeing the program may persist. Conclusions American Indian and Alaska Native students have unique educational and cultural needs, which can include learning Native languages, cultures, and histories, and obtaining additional academic support. The JOM program is intended to address these needs that may not otherwise be provided through the public school system. BIE plays a critical role in administering the JOM program, which is central to the bureau’s mission of providing Indian students quality education opportunities starting in early childhood in accordance with a tribe’s needs for cultural and economic well-being. However, BIE lacks key JOM program information necessary for effective oversight, including complete information on which contractors are participating in JOM. BIE also has not assessed the usefulness of the information it collects from contractors, and relies on outdated forms to collect data. Without improved program data, BIE cannot effectively oversee the program. In addition, BIE does not provide training for JOM contractors. This lack of training may result in contractors misinterpreting JOM regulations and managing their programs inconsistently. Further, BIE has not clearly defined the roles and responsibilities of staff involved in administering the JOM program, which has resulted in gaps in program management and oversight. Until staff roles and responsibilities are clearly defined and identified, gaps in managing and overseeing the program may persist, resulting in an increased risk of potential misuse or abuse of JOM funds. Without taking steps to improve the management and oversight of the JOM program in these key areas, BIE cannot ensure that the program is truly serving the educational needs of eligible American Indian and Alaska Native students. Recommendations for Executive Action We are making the following five recommendations to Interior: The Director of the Bureau of Indian Education should develop a systematic process for identifying JOM contractors and maintaining an accurate and complete list of contractors and other relevant information about contractors, such as the amount of JOM funds they receive and their current points of contact. (Recommendation 1) The Director of the Bureau of Indian Education, in coordination with the Bureau of Indian Affairs as needed, should establish a process to track and monitor the timeliness of JOM disbursements to non-tribal contractors, including identifying a target date for disbursing funds to these contractors. (Recommendation 2) The Director of the Bureau of Indian Education should develop a timeline to assess the usefulness of the information they are collecting from JOM contractors and update JOM information collection forms, including converting them to an electronic format to reduce the burden on contractors to complete them. (Recommendation 3) The Director of the Bureau of Indian Education should develop and provide training to contractors on administering the JOM program. (Recommendation 4) The Director of the Bureau of Indian Education should clearly define the roles and responsibilities and identify the staff necessary for conducting critical JOM functions, including administering contracts, reviewing the appropriateness of contract types, and overseeing those contractors that are subject to BIE oversight. (Recommendation 5) Agency Comments and Our Evaluation We provided a draft of this report to Interior for review and comment. We also provided relevant report sections to and requested technical comments from the National Indian Education Association and the National Johnson-O’Malley Association. In its comments reproduced in appendix I, Interior concurred with our five recommendations and described actions BIE and BIA plan to take to address them. In our draft report, we recommended that BIE needs to clearly define the roles and responsibilities and identify the staff necessary for conducting technical assistance, among other critical JOM functions. We removed reference to technical assistance from our report because, after we provided our draft report, Interior promulgated new, final JOM program regulations that include a new process for requesting and providing technical assistance. We did not receive any comments from the nonprofit organizations. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Interior, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (617) 788-0534 or emreyarrasm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. Appendix I: Comments from the Department of the Interior Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Beth Sirois (Assistant Director), Brian Schwartz (Analyst-in-Charge), Ben DeYoung, and Alex Galuten made key contributions to this report. Additional assistance was provided by Edward Bodine, Gina M. Hoover, Thomas M. James, Grant M. Mallie, Sheila R. McCoy, Anna Maria Ortiz, Jeanette M. Soares, Joy K. Solmonson, Curtia O. Taylor, and William T. Woods.