Introduction On March 18, 2020, the American Civil Liberties Union (ACLU) sent a letter to Attorney General William Barr and Bureau of Prisons (BOP) Director Michael Carvajal asking them to release federal prisoners who might be at risk of serious illness due to coronavirus disease 2019 (COVID-19) infection and to reduce the intake of new prisoners to reduce overcrowding. The ACLU called on BOP to utilize authorities granted to it, such as compassionate release and home confinement for elderly offenders, to reduce the number of at-risk prisoners in the federal prison system. The ACLU also asked the Department of Justice (DOJ) to direct the U.S. Marshals Service (USMS) to release from custody any individuals who are at risk of serious illness related to COVID-19, such as those who are elderly and/or have chronic health conditions. Multiple Members of Congress have additionally urged DOJ and its BOP to take steps "to reduce the incarcerated population and guard against potential exposure to coronavirus," and legislation has been introduced that would require the release of some prisoners during a national emergency relating to a communicable disease. BOP data indicate that COVID-19 has become widespread in the federal prison system. As of April 22, 2020, BOP reported that 566 federal prisoners and 342 BOP staff members in 47 prisons and 16 Residential Reentry Centers had tested positive for COVID-19 and 24 prisoners have died from the disease (no BOP staff have died). Prior to these positive tests, BOP released a COVID-19 action plan. The action plan, discussed below, largely focuses on restricting access to federal prisons and limiting the movement of prisoners. In addition, the Attorney General has issued three memoranda outlining how DOJ will use the legal authorities available to address the COVID-19 pandemic. Two of the memoranda direct BOP to use available authorities to place more prisoners on home confinement and the other memorandum provides directives for prosecutors when deciding whether to seek pretrial detention for federal defendants. This report provides information on DOJ's response to the threat of COVID-19 as it pertains to federal prisons and the authorities that may permit the release of some federal prisoners because of the pandemic. The report starts with a brief overview of why the prison environment is conducive to the spread of COVID-19 and the federal prisoners who might be at risk of serious complications if they contract the virus. Next, the report provides an overview of BOP's COVID-19 action plan. The report then turns to a discussion of current authorities that could allow for some federal prisoners to be released and directives from the Attorney General on how DOJ is to use those authorities to respond to the COVID-19 pandemic. The report concludes with a review of legislation introduced in the House and the Senate that would alter the operation of some of those authorities. Background on People Confined in the Federal Criminal Justice System USMS is responsible for initially confining people who have been arrested and charged for a federal offense and are not granted pre-trial release. USMS does not operate any of its own jails. Rather, prisoners in USMS custody are housed in a combination of BOP-operated facilities, as well as state, local, and private facilities. While most facilities operated by BOP are prisons that hold people who have been convicted of federal offenses and sentenced to a period of incarceration, BOP operates a series of facilities that largely function in a manner similar to local jails (i.e., they hold people who have not been convicted and are awaiting the resolution of their case or people who have been convicted but are awaiting transfer to a prison where they will serve their sentence). These facilitiesâreferred to as Metropolitan Detention Centers, Metropolitan Correctional Centers, or Federal Detention Centersâare generally located in metropolitan areas and can hold prisoners of any security designation (i.e., high, medium, low, or minimum). The majority of prisoners in USMS custody are housed in state and local facilities; data from USMS indicate that in FY2019, approximately 16% of USMS prisoners were housed in BOP-operated facilities. USMS says it "relies on state and local jails as well as Bureau of Prisons detention facilities to provide medical care inside the facilities." Therefore, defendants in the custody of USMS would be subject to any plan that the facility they are housed in implements to prevent the spread of COVID-19. For example, a USMS prisoner held in BOP-operated facility would be subject to BOP's COVID-19 action plan, outlined below, while a prisoner held in a local jail would be subject to any steps that facility takes to prevent the spread of COVID-19 in its facility. If a defendant is convicted of or pleads guilty to a federal offense, USMS is to turn the prisoner over to the custody of BOP, which is responsible for confining the prisoner until completion of his or her sentence. BOP is to assign prisoners to one of its facilities based on a series of factors, including the level of security and supervision the prisoner requires, the level of security and staff supervision the facility is able to provide, and the prisoner's program needs (i.e., sex offender, substance abuse treatment, educational/vocational training, individual counseling, group counseling, or medical/mental health treatment). COVID-19 and the Prison Environment According to the Vera Institute of Justice, "it is not a matter of if, but when, coronavirus shows up in courts, jails, detention centers, prisons, and other places where the work of the criminal and immigration systems occur." While prisons may appear to be closed environments, because prisoners cannot leave and return to the facility on their own volition, there are opportunities for the disease to be introduced into any prison. COVID-19 could be introduced by the prison's staff, who could be exposed when they are not at the prison and subsequently introduce it to the facility when they come to work. COVID-19 could also be transmitted to a prisoner though face-to-face visits with family, friends, or attorneys. Also, while prisoners cannot freely leave the facility, they do travel outside it for things such as court appearances or medical appointments. The introduction of COVID-19 into a prison raises the concern that the nature of the prison environment can facilitate its spread. Prisons typically hold hundreds of prisoners who live in close proximity to one another. In some facilities, prisoners might live in dormitory-style housing where many share the same space. Even if prisoners are housed in individual cells, they typically share the same ventilation system with prisoners in other cells. There are also concerns about hygiene. Prisoners might not have regular access to soap and water to wash their hands, and hand sanitizer can be considered contraband because it contains alcohol. These concerns are especially acute for prison systems that are operating over capacity. There are also concerns about whether prisoners will have access to adequate medical care if a prison's staff is hit hard by the disease. If COVID-19 were to spread among prison staff resulting in wide spread quarantines, there could be fewer medical staff to deliver care or fewer correctional staff available to transport critically ill prisoners to outside medical facilities. Also, prison infirmaries tend to have fewer medical resources, such as isolation beds, compared to hospitals. However, one expert at the National Commission on Correctional Health Care believes that the prisons are prepared to handle potential COVID-19 infections because prisons have experience with preventing the spread of communicable diseases. As of April 16, 2020, BOP has approximately 172,300 prisoners under its jurisdiction, who are held in a combination of BOP-operated facilities (122 in total), privately operated prisons, Residential Reentry Centers (RRCs; i.e., halfway houses), and state prisons. While the federal prison population decreased by approximately 42,000 prisoners (19%) from FY2013 to FY2019, the federal prison system operated at 12% over its rated capacity in FY2019. According to USMS, in FY2019 they received approximately 248,900 prisoners and their average daily detention population was approximately 61,500 prisoners. While BOP does not publish data on the number of prisoners that have health conditions that might make them more susceptible to serious complications if they were to contract COVID-19, as of April 18, 2020, approximately 10,200 prisoners (6% of all prisoners) under BOP's jurisdiction were age 61 or older. BOP also notes, "the average age of offenders in BOP-managed facilities is 41 years and average length of sentence is 128 months. The average age of offenders in BOP facilities has increased by 8 percent over the past decade. Approximately 45 percent of offenders have multiple chronic conditions that, despite management with medications and other therapeutic interventions, will progress and may result in serious complications." USMS does not publish data on the age or health issues of prisoners in their custody. BOP's COVID-19 Action Plan BOP's COVID-19 action plan was announced on March 13, 2020. BOP has modified its action plan as the situation in the federal prison system has dictated. On March 19, 2020, BOP clarified that while there are restrictions on the movement of prisoners between facilities, BOP will transfer prisoners if necessary to properly manage the prison population, subject to certain conditions. On March 31, 2020, BOP announced that effective April 1, 2020, all prisoners would be placed on lockdown, meaning that they may not leave their assigned cell unless it is to attend programs or services offered as a part of normal operating procedures, such as educational programs or mental health treatment. On April 14, 2020, BOP announced that its action plan, which was initially set to expire on April 12, 2020, would be extended until May 18, 2020. BOP's action plan includes the following measures: Sus pending social visits . BOP has suspended social visits for prisoners. To allow prisoners to maintain social ties while social visits are suspended, BOP is allowing prisoners to have 500 minutes per month (compared to the usual 300 minutes) of telephone time. Suspe nding attorney . Like social visits, BOP is suspending visits from attorneys, though BOP is to allow visits from attorneys on a case-by-case basis. Prisoners are to still be allowed to have confidential phone calls with their attorneys, which do not count against the 500 minutes per month limit. Limiting movement of prisoners . BOP is suspending transferring prisoners between facilities, with the exception of transfers for forensic studies, writs, Interstate Agreements on Detainers, medical or mental health treatment, and transfers to pre-release custody. BOP will continue to accept new prisoners, though BOP is working with USMS to limit the number of prisoners transferred from jail facilities to BOP's custody. Prisoners who are moved from one facility to another must have been in BOP's custody for at least 14 days. Prisoners are also to be screened for COVID-19 symptoms (e.g., fever, cough, shortness of breath) before being transferred, and those who present symptoms or have a temperature greater than 100.4 degrees are not to be transferred and instead are to be placed in isolation. Limiting official travel . BOP is suspending official staff travel, with the exception of relocation. Suspending tours . BOP is suspending prison tours, though it can grant exceptions on a case-by-case basis. Reducing staff training . BOP is suspending all staff training, with the exception of basic staff training for new employees at the Federal Law Enforcement Training Center. Limiting contractor access to prisons . BOP is only allowing access for contractors who are providing essential services or those who provide maintenance on essential systems. Essential services include medical or mental health care, religious services, and critical infrastructure repairs. Limiting volunteer access to prisons . BOP is suspending visits to prisons from volunteers, though it can grant some exceptions on a case-by-case basis. Alternative means of communication (e.g., telephone calls) will be provided to prisoners who want to speak privately with a religious volunteer. It is not clear if telephone calls with volunteers count against a prisoner's 500 minutes per month limit. Screening employees . BOP is instituting advanced health screenings of employees at prisons in areas with "sustained community transmission" as determined by the Centers for Disease Control and Prevention (CDC). Advanced health screening involves self-reporting of possible exposure to COVID-19 and temperature checks. Volunteers, contractors, attorneys, and tour participants who are granted access to a prison are subject to the same screening procedures. Screening prisoners . BOP maintains an infectious disease management program as a matter of course, but in response to the COVID-19 pandemic BOP has instituted practices specific to mitigating the spread of the disease in its facilities. All new arrivals to the prison are to be screened for COVID-19 exposure risk factors and symptoms, asymptomatic prisoners with noted exposure risk factors are quarantined, and symptomatic prisoners with noted exposure risk factors are to be isolated and tested for COVID-19. Modifications to operations . BOP is making modifications to its operations, if the facility's population and physical layout make modifications feasible, to allow for social distancing and to limit group gatherings. For example, prisons might stagger meal and recreation times. USMS has not released a COVID-19 prevention plan, but as discussed above, USMS does not operate its own jail system and prisoners are subject to any plans developed and implemented by the facility in which they are housed. However, if a prisoner develops complications from COVID-19 that could not be adequately treated in the facility in which he or she is housed, USMS would assume the cost of transporting the prisoner to a local medical facility and covering the cost of the medical care provided. Existing Authorities to Grant Release to Prisoners DOJ lacks the authority to grant early release to prisoners for the specific purpose of mitigating the transmission of a communicable disease. However, there are authorities that may provide avenues for some federal prisoners to be released in response to the COVID-19 pandemic. These authorities include statutory provisions allowing (1) federal courts to reopen pretrial detention hearings or permit temporary release of prisoners under certain circumstances, (2) for federal prisoners to be released before completing their sentences, and (3) for federal prisoners to be placed in the community to serve the final portion of their sentences. Additionally, the President retains constitutional authority to grant clemency for federal offenses, which can include commuting a prisoner's sentence to time served. Pretrial Detention and Release A person arrested for a federal offense must be brought before a judge "without unnecessary delay," and the judge "shall order that such person be released or detained, pending judicial proceedings." 18 U.S.C. Section 3142 governs the circumstances under which a person charged with a federal offense may be ordered released or incarcerated pending trial. The statute reflects a preference for release on personal recognizance or unsecured appearance bond, subject to limited conditions, "unless the judicial officer determines that such release will not reasonably assure the appearance of the person as required or will endanger the safety of any other person or the community." However, if after a hearing the judge finds by clear and convincing evidence that no condition or combination of conditions will reasonably assure the defendant's appearance and the safety of others, the judge must order the detention of the person before trial. Though the statute purports to establish an order of preference favoring release for federal criminal defendants, it appears that the majority of defendants accused of federal crimes and presented to a judge are, in fact, incarcerated. Two provisions of Section 3142 provide means to seek court-ordered release from pretrial detention after a detention determination has been made. First, under Section 3142(f)(2) a detention hearing may be "reopened" at any time prior to trial if the judge "finds that information exists that was not known to the movant at the time of the hearing and that has a material bearing on the issue" of whether any conditions of release would reasonably assure the defendant's appearance and the safety of others. Second, under Section 3142(i) a judge who has entered a detention order may issue a subsequent order permitting the "temporary release" of the accused where "necessary for preparation of the person's defense or for another compelling reason." Thus, release under either provision is necessarily dependent on judge-made determinations that may be highly case- and fact-specific. Multiple federal courts have addressed requests for release under these provisions of Section 3142 in light of COVID-19 concerns, considering factors including "(1) the original grounds for the defendant's pretrial detention, (2) the specificity of the defendant's stated COVID-19 concerns, (3) the extent to which [a] proposed release plan is tailored to mitigate or exacerbate other COVID-19 risks to the defendant, and (4) the likelihood that the defendant's proposed release would increase COVID-19 risks to others." The courts' responses to the requests have been mixed. In one case, the U.S. District Court for the Southern District of New York ruled that both provisions of Section 3142 supported a defendant's release subject to conditions of home incarceration and electronic location monitoring. At the outset, the court viewed the "unprecedented and extraordinarily dangerous nature of the COVID-19 pandemic," in conjunction with new information that had come to light about the defendant's dangerousness, as sufficiently changed circumstances bearing on risk to the community to necessitate reconsideration of the defendant's detention. And in light of those changed circumstances, the court determined that the weight of the evidence now clearly and convincingly tipped in favor of concluding that the defendant did not pose a danger to the community and should be conditionally released. The court also ruled that the impact of the COVID-19 outbreak on the defendant's ability to prepare his defense constituted a "compelling reason" justifying temporary release under Section 3142(i), noting that BOP's suspension of visits except on a case-by-case basis limited the defendant's access to his attorney. By contrast, other federal courts have rejected arguments that the COVID-19 pandemic justifies release under Section 3142. In one case, where the defendant argued that his "advanced age" and medical conditions (which included a history of stroke and heart attack) warranted temporary release under Section 3142(i) in response to the ongoing outbreak, the court recognized that that provision has been used only "sparingly" and noted that (1) the defendant's medical conditions appeared to be "well managed," (2) there were no reported incidents of COVID-19 within the defendant's detention center, and (3) BOP was taking "system-wide precautions to mitigate the possibility of infection within its facilities." Accordingly, the court concluded that the possibility of an outbreak in the facility was not a "compelling" reason under Section 3142(i). Likewise, a district court in Maryland, while acknowledging that the health risk from COVID-19 can constitute new information with a material bearing on release under Section 3142(f)(2) and may even implicate constitutional concerns under the Due Process Clauses if conditions of confinement expose a defendant to serious illness, ruled that a defendant charged with a serious crime and who has an extensive criminal history should be detained despite health conditions like high blood pressure and diabetes. The court in that case viewed defendant's health conditions as insufficient on their own to rebut the government's proffer that precautionary measures were being implemented at the defendant's detention center to protect detainees from exposure to COVID-19. In short, although a significant number of federal defendants have sought release under Section 3142 in light of the COVID-19 outbreak, the highly individualized and fact-specific nature of the inquiry makes Section 3142 a somewhat limited avenue for the release of federal prisoners in response to COVID-19. Compassionate Release Once a person has been convicted of a federal offense and sentenced to a term of imprisonment, a federal court can reduce the sentence under 18 U.S.C. Section 3582(c)(1)(A) and impose a term of probation or supervised release, with or without conditions, equal to the amount of time remaining on the prisoner's sentence if the court finds that "extraordinary and compelling reasons warrant such a reduction," or, for certain offenders, if the prisoner is at least 70 years of age, the prisoner has served at least 30 years of his or her sentence, and a determination has been made by BOP that the prisoner is not a danger to the safety of any other person or the community. A petition for compassionate release can be filed by BOP itself. In the alternative, a prisoner can file such a petition if he or she has fully exhausted all administrative rights to appeal BOP's refusal to bring a motion on the prisoner's behalf or upon a lapse of 30 days from the receipt of such a request by the warden of the prisoner's facility, whichever is earlier. Sentence reductions under Section 3582(c)(1)(A) must be consistent with any applicable policy statements issued by the U.S. Sentencing Commission. Under the current sentencing guidelines, "extraordinary and compelling reasons" for a sentence reduction include the following: The prisoner is suffering from a terminal illness (i.e., a serious and advanced illness with an end of life trajectory). A specific prognosis of life expectancy (i.e., a probability of death within a specific time period) is not required. The prisoner is suffering from a serious physical or medical condition, suffering from a serious functional or cognitive impairment, or experiencing deteriorating physical or mental health because of the aging process that substantially diminishes the ability of the prisoner to care for himself or herself while incarcerated and the prisoner is not expected to recover from the condition. The prisoner is at least 65 years old, is experiencing a serious deterioration in physical or mental health because of the aging process, and has served at least 10 years or 75% of his or her term of imprisonment, whichever is less. The caregiver of the prisoner's minor child or minor children dies or is incapacitated. The prisoner's spouse or registered partner is incapacitated, and the prisoner is the only available caregiver. BOP determines that there is an extraordinary and compelling reason other than, or in combination with, the reasons described above. There are limits on whether a prisoner can be released from BOP's custody using compassionate release. First, BOP cannot unilaterally release elderly or terminally ill offenders under this authority; a petition for compassionate release has to be approved by a federal court, based on consideration of multiple case-specific factors. Also, only certain prisoners 70 years of age or older can be released without a finding that there is a compelling and extraordinary circumstance for their release. While the compassionate release statute allows for prisoners who are under the age of 70 to be released from prison before completing their sentence, in cases where the prisoner would potentially be released for reasons related to the prisoner's health, the prisoner must be seriously ill. A prisoner's ability to seek release from a federal court is also limited by the requirement contained in Section 3582 that the prisoner exhaust all administrative rights of review or wait 30 days. Courts have split on whether that requirement may be waived in the context of the COVID-19 pandemic. The U.S. Court of Appeals for the Third Circuit has viewed the exhaustion requirement as unwaivable, characterizing a prisoner's failure to comply with the requirement as "a glaring roadblock foreclosing compassionate release" and observing that "strict compliance" with the statutory obligation is of "critical ... importance" even during the ongoing pandemic. However, other lower federal courts have concluded that they have the discretion to waive the exhaustion requirement, indicating (among other things) that Congress could not "have intended the 30-day waiting period of 3582(c)(1)(A) to rigidly apply in the highly unusual" circumstances of the COVID-19 pandemic. Assuming the exhaustion requirement is not an impediment to judicial relief, a court still might not consider people with underlying medical conditions such as hypertension, heart disease, lung disease, or diabetes, which might make them more likely to suffer from serious complications if they were to contract COVID-19 to meet any of the "extraordinary and compelling reasons" specified in the U.S. Sentencing Guidelines. Multiple federal courts have rejected requests for release under Section 3582 in light of COVID-19 transmission risk. For instance, a prisoner in one case argued that he should be released to home confinement in part because the conditions of his confinement in a federal prison facility created "the ideal environment for the transmission" of COVID-19 and he was "at a heightened risk" in light of health conditions such as high blood pressure, high cholesterol, asthma, and allergies. The government opposed the prisoner's request, pointing to BOP's "extensive action plan" to address the pandemic, and the court sided with the government. Specifically, the court determined that the prisoner's motion did not meet the requirements for modifying a sentence for extraordinary and compelling reasons because, among other things, the prisoner had "not shown that the plan proposed by the Bureau of Prisons is inadequate to manage the pandemic within [the prisoner's] correctional facility, or that the facility is specifically unable to adequately treat" him. As such, though the court noted that "public health recommendations are rapidly changing," it concluded that at least as of the ruling date, it could not assume that BOP would "be unable to manage the outbreak or adequately treat [the prisoner] should it emerge at his correctional facility while he is still incarcerated." Nevertheless, some other courts have authorized compassionate release because of the COVID-19 pandemic. One federal court, for example, concluded that a prisoner with a compromised immune system had shown an extraordinary and compelling reason justifying release to home incarceration under Section 3582 in light of "the COVID-19 public health crisis," though the government in that case did not oppose the request. Aside from the question of whether COVID-19 transmission risk would be considered an "extraordinary and compelling reason[]" to grant release, which could vary depending on the circumstances before the court considering the request, if a prisoner is granted compassionate release it does not mean that the prisoner is no longer involved in the criminal justice system. The court can impose a term of probation or supervised release for the prisoner, and there might be a question about whether U.S. Probation and Pretrial Services Offices has the necessary resources to handle an unexpected influx of probationers. Early Release Pilot Program Under 34 U.S.C. Section 60541(g), BOP is authorized to conduct a program that places eligible elderly and terminally ill prisoners on home confinement. The Attorney General is authorized to designate the prisons at which the program will be conducted. Elderly prisoners who are eligible for home confinement under the program are those who are at least 60 years old; have never been convicted of a violent, sex-related, espionage, or terrorism offense; are sentenced to less than life; have served two-thirds of their sentence; have not been determined by BOP to have a history of violence, or of engaging in conduct constituting a sex, espionage, or terrorism offense; have not escaped or attempted to escape; received a determination that release to home detention would result in a substantial reduction in cost to the federal government; and received a determination that he or she is not a substantial risk of engaging in criminal conduct or of endangering any person or the public if released to home detention. Terminally ill prisoners who are eligible for early release under the program generally have to meet the same criteria as eligible elderly prisoners, except they can be of any age and have served any portion of their sentences, even life sentences. The ability of BOP to release prisoners under this authority has some limitations similar to those associated with compassionate release, except under this authority BOP can place prisoners on home confinement without the approval of a federal court. Community Confinement Under 18 U.S.C. Section 3624(c), BOP is authorized to place a prisoner in a Residential Reentry Center for up to 12 months at the end of his or her sentence. BOP is also ordinarily authorized to place a prisoner on home confinement for a period of time equal to 10% of his or her sentence or six months, whichever is shorter. Though BOP must make individualized determinations as to whether placement in an RRC or home confinement is appropriate, the statute "grants considerable discretion to the BOP" in making such determinations. The Coronavirus Aid, Relief, and Economic Security Act (the CARES Act; P.L. 116-136 ), permits the BOP Director to lengthen the maximum amount of time for which a prisoner may be placed on home confinement under Section 3624(c)(2) "as the Director determines appropriate" when the Attorney General "finds that emergency conditions will materially affect the functioning" of BOP. The authority is limited, however, to "the covered emergency period," which is defined as the period spanning from the President's declaration of a national emergency with respect to COVID-19 to the date that is 30 days after the date on which the declaration terminates. As discussed below, the Attorney General issued a memorandum to the BOP Director making the requisite finding under the CARES Act and thereby authorizing the director to make expanded use of home confinement. Executive Clemency Under Article II, Section 2 of the U.S. Constitution, the President has broad authority to grant relief from punishment for federal criminal offenses. One form of executive clemency is commutation of a sentence, whereby the sentence imposed by a federal court is replaced by a less severe punishment, such as reducing a prisoner's sentence to time served. While it is not required by the Constitution, there is a process for prisoners who want to have their sentences commuted to submit a petition for executive clemency through DOJ's Office of the Pardon Attorney. Regulations state that prisoners should not submit petitions for commutations if other forms of judicial or administrative relief are available, unless there is a showing of "exceptional circumstances" for submitting the petition. When a petition is received, the Pardon Attorney conducts an investigation to determine the merit of the petition, which can include collecting reports from or using the services of federal agencies, such as the Federal Bureau of Investigation. After the investigation is concluded, the Pardon Attorney submits a recommendation about the merits of the petition to the Attorney General through the Deputy Attorney General. The Attorney General makes a final recommendation to the President about whether the petition for clemency should be granted. Guidance issued by DOJ notes that commuting a sentence is an "extraordinary remedy" and that grounds for considering commutation include "disparity or undue severity of sentence, critical illness or old age, and meritorious service rendered to the government by the petitioner" (such as aiding the government in an investigation) and/or "other equitable factors," such as demonstrating rehabilitation or "exigent circumstances unforeseen by the court at the time of sentencing." The process for applying for executive clemency established by DOJ regulations and guidance does not "restrict the authority granted to the President under Article II, Section 2 of the Constitution." Therefore, the President could grant commutations to federal prisoners who do not submit a petition to DOJ or to those who do not meet the standards outlined by DOJ. Some advocates and commentators have called for the President to exercise this authority to commute federal prison sentences for populations vulnerable to COVID-19. The Attorney General's Directives Regarding DOJ's Response to COVID-19 As of April 6, 2020, Attorney General William Barr has issued three memoranda that provide direction on DOJ's response to the COVID-19 pandemic. Two of the memoranda were to BOP, and they outlined how BOP should use its home confinement authorities to reduce the spread of COVID-19 in federal prisons. The other memorandum was to all components of DOJ, including all U.S. Attorney's Offices, and it provides guidance regarding when prosecutors should seek pretrial detention for federal defendants in light of the risks some people might face if they were jailed pending adjudication of their cases. Memoranda Regarding Home Confinement On March 26, 2020, Attorney General William Barr issued a memorandum to BOP Director Michael Carvajal directing him to "prioritize the use of [BOP's] various statutory authorities to grant home confinement for inmates seeking transfer in connection with the ongoing COVID-19 pandemic." In the memorandum, the Attorney General notes that there are some at-risk prisoners who are incarcerated for nonviolent crimes, pose a minimal risk of recidivism, and might be safer serving their sentences on home confinement rather than in a BOP facility. However, the Attorney General also states that many prisoners will be safer in BOP facilities where the population is controlled and there is ready access to doctors and medical care. The memorandum requires BOP when making a decision about which prisoners to place on home confinement to consider the "totality of the circumstances" for each prisoner, statutory requirements for home confinement, and the following discretionary factors: the age and vulnerability of the prisoner to COVID-19, in accordance with CDC guidelines; the security level of the facility where the prisoner is held, with priority given to prisoners held in low- and minimum-security facilities; the prisoner's conduct in prison, with those who have engaged in violent or gang-related activities while incarcerated or who have been found to have violated institutional rules not receiving priority consideration for home confinement; the prisoner's risk assessment score under BOP's risk and needs assessment system, with prisoners who have more than a minimum score not receiving priority consideration for home confinement; whether the prisoner has a re-entry plan, which includes verification that the conditions under which the prisoner would be confined after release would present a lower risk of contracting COVID-19 than if the prisoner remained incarcerated in a BOP facility; the prisoner's crime of conviction and an assessment of the risk to public safety posed by him or her (the memorandum notes that some offenses, such as sex offenses, will make a prisoner ineligible for home confinement, while convictions for other "serious" offenses should weigh more heavily against placing the prisoner on home confinement). In addition to these factors, prisoners considered for home confinement must be assessed, based on CDC guidance, for risk factors for "severe COVID-19 illness," risks of COVID-19 illness at the prisoner's current facility, and risk of COVID-19 illness at the location where the prisoner would be placed on home confinement. BOP is not to place prisoners on home confinement if it would increase their risk of contracting COVID-19 or increase the risk of spreading COVID-19 in the community. The memorandum also directs BOP to place prisoners in a 14-day quarantine before they are transferred to home confinement. In a subsequent memorandum issued on April 3, 2020, the Attorney General invokes the authority granted under the CARES Act and directs BOP to review all prisoners with risk factors for serious complications related to COVID-19 for possible placement on home confinement. The memorandum directs BOP to focus on prisoners incarcerated at Federal Correctional Institution (FCI) Oakdale, FCI Danbury, and FCI Elkton, and any other "similarly situated facilities where [BOP] determine[s] that COVID-19 is materially affecting operations." BOP is directed to immediately process all prisoners who are deemed to be suitable candidates for home confinement. Prisoners are to be placed on home confinement after a 14-day in-prison quarantine. BOP is also authorized on a case-by-case basis to place prisoners on home confinement without first quarantining them in prison. In these cases, a prisoner would be required to quarantine at home for a 14-day period. The Attorney General warns against potentially spreading COVID-19 by releasing prisoners to home confinement. Thus, BOP is directed to follow the criteria outlined in the March 26 memorandum when making decisions about which prisoners should be released, with the understanding that prisoners "with a suitable confinement plan will generally be approved candidates for home confinement rather than continued detention at institutions in which COVID-19 is materially affecting their operations." In the memorandum, the Attorney General acknowledges that BOP has limited resources to monitor all prisoners on home confinement and the U.S. Probation Office is unable to monitor large numbers of prisoners in the community. Despite these limitations, the Attorney General authorizes BOP to place prisoners on home confinement even if electronic monitoring is not available, "so long as BOP determines in every such instance that doing so is appropriate and consistent with [DOJ's] obligation to protect public safety." Regarding public safety, the Attorney General notes that while DOJ has an obligation to protect federal prisoners, DOJ also has an obligation to protect public safety and cannot "simply release prison populations en masse onto the streets." The Attorney General notes that while he is directing BOP to expand the use of home confinement for prisoners at affected prisons, "it is essential that [BOP] continue making careful, individualized determinations BOP makes in the typical case. Each inmate is unique and each requires the same individualized determinations [that] have always been made in this context." Memorandum Regarding Pretrial Detention On April 6, 2020, the Attorney General issued a memorandum to the U.S. Attorney's Offices and the heads of components of DOJ that provides guidance on when DOJ should seek pretrial detention for defendants. The Attorney General notes that under the Bail Reform Act (BRA), defendants must be detained pending trial where "no condition or combination of conditions will reasonably assure the appearance of the person as required and the safety of any other person and the community" and that for certain crimes it is assumed that "no condition or combination of conditions will reasonably assure the appearance of the person as required and the safety of the community." The Attorney General encourages prosecutors to continue to seek pretrial detention for defendants that pose a risk to public safety or a flight risk as outlined in the BRA. The Attorney General also notes that a defendant's physical and mental condition can be considered when making determinations about pretrial detention under the BRA and prosecutors should consider the "medical risks associated with individuals being remanded into federal custody during the COVID-19 pandemic." The Attorney General directs prosecutors to consider not seeking pretrial detention to the extent that they would under normal circumstances, especially for defendants who have "not committed serious crimes and who pose little risk of flight (but no threat to the public) and who are clearly vulnerable to COVID-19 under CDC Guidelines." The memorandum directs prosecutors to conduct the same analysis when litigating motions filed by defendants who want the court to reconsider its decision to order pretrial detention in light of the pandemic. When considering motions filed by defendants, prosecutors are also directed to consider the risk a defendant poses of spreading COVID-19 in the community if he or she were released. Current Legislation As described previously, Congress has passed legislation in response to the COVID-19 pandemic that modifies one of the authorities addressed in this reportârelease to home confinement under 18 U.S.C. Section 3624(c)(2). However, at least one bill has been introduced that would appear to further facilitate the release of some federal prisoners in the context of a national emergency related to a communicable disease. Introduced legislation would appear to further supplement some of the authorities discussed above. S. 3579 and H.R. 6400 would require that certain federal prisoners in the custody of BOP or USMSâthose who are pregnant, age 50 or older, have certain underlying medical conditions, or have 12 months or less to serveâimmediately be placed in community supervision when a "national emergency relating to a communicable disease" has been declared and for 60 days after it has expired. In making such placements, the directors of BOP and USMS would be obligated to "take into account and prioritize" placements enabling "adequate social distancing," with home confinement given as one example. Individuals falling into qualifying categories would be excepted from placement in community supervision under the bills, however, if the Director of BOP or Director of USMS determines by clear and convincing evidence that they are "likely to pose a specific and substantial risk of causing bodily injury or using violent force against the person of another." It thus appears that S. 3579 and H.R. 6400 would enhance current authorities that permit the release of federal prisoners in response to COVID-19. Specifically, under both bills some federal criminal defendants in pretrial detention would be eligible for immediate release to community supervision (assuming they meet the health or other criteria) without the need to file individual petitions seeking the reopening of their detention hearing based on new information or asserting a "compelling reason" for temporary release. And those detained solely because they were previously determined to be a flight risk would appear to qualify for relief under both bills, as the bills' only exception for those eligible for relief are detainees that are determined to pose a risk of causing bodily injury or using violent force against another. Additionally, for those currently serving federal sentences in BOP facilities, S. 3579 and H.R. 6400 would appear to establish another alternative for release to community confinement in the context of the COVID-19 pandemic beyond 18 U.S.C. Section 3624(c) and 34 U.S.C. Section 60541(g), as BOP would be required to release a prisoner over 50 years old, with a covered health condition, or who is within 12 months of release from incarceration unless the exception applied.


Background CYBERCOM’s Cyber Mission Force In 2012, DOD developed plans to establish 133 CMF teams focused on offensive operations, defensive operations, and DOD network protection. DOD provided budget resources for these teams beginning in fiscal year 2014. It subsequently set goals for reaching initial operational capability and full operational capability. Later in this report we describe how some of the methods used to facilitate these teams’ achievement of full operational capability subsequently affected readiness. Once each CMF team has achieved full operational capability, it is required to certify to its mission at least every 2 years. According to CYBERCOM’s 2017 readiness guidance, in order for each CMF team to achieve the best readiness rating it must certify to its mission every 12 months. According to the DOD Cyber Strategy published in 2015, the first wave of CMF teams will include nearly 6,200 military, civilian, and contractor support personnel from across the military departments and defense components, when they are fully staffed. In February 2017, the commander of CYBERCOM endorsed an Army proposal to present its 21 Reserve component Cyber Protection Teams (11 Army National Guard and 10 Army Reserve) for assignment to U.S. Strategic Command to help address increased mission requirements. These 21 teams represent a second wave of teams, which CYBERCOM has scheduled to achieve full operational capability by September 30, 2024. The second wave of 21 Army Reserve component teams are to include more than 800 personnel once they are fully staffed. The CMF teams are aligned with various DOD organizations, as shown in figure 1. The military service cyber components—Army Cyber Command, Fleet Cyber Command, Marine Corps Forces Cyberspace, and Air Forces Cyber—are CYBERCOM’s service elements and support CYBERCOM in achieving its missions. The personnel on each team represent a variety of specialties, such as intelligence analysts, linguists, and cyber operators and specialists. Figure 2 provides a hypothetical example of how each team might combine personnel from different specialties to carry out its missions. This figure does not show the actual composition of any type of team, but rather provides notional examples of how each team consists of personnel from different specialties who unite to perform cyber missions as part of the CMF. The Four Phases of CMF Training Training personnel for the CMF occurs in four phases and is administered by different entities, as shown in figure 3. Phase one basic training is the initial training performed by the military services that is delivered to any new recruit so that he or she may be assigned a military specialty. As shown in figure 2, CMF personnel draw from a number of different military specialties, including cyber, all-source intelligence, signals intelligence, information technology, and language specialists. Phase one basic training is not necessarily cyber-specific, as it is meant to provide military personnel with the basic skills needed to perform a particular occupation for the service. For example, CMF teams include intelligence professionals who may be assigned to analyze intelligence information that comes from a variety of sources. Training in phases two (foundational), three (collective), and four (sustainment) are focused more directly on the specific skills required to function as a member of the various CMF teams. Key Roles and Responsibilities for Training the CMF To establish and train the CMF teams, DOD has assigned components and senior officials with CMF training roles and responsibilities. The key responsibilities for training the CMF are summarized in table 1 below; a more inclusive list is presented in appendix I. DOD Has Taken Action to Develop a Trained Cyber Mission Force As part of the department’s efforts to develop and maintain trained CMF teams, CYBERCOM and the military services have implemented a number of initiatives. Specifically, CYBERCOM established consistent training standards, developed standard operating procedures for readiness reporting, and established and maintained a series of phase two foundational training courses. Further, CYBERCOM and the military services used existing training capabilities to build CMF teams. However, many of the teams that have been built are not yet fully trained and, according to agency officials, have “generally low” readiness levels. CYBERCOM and the Military Services Have Taken Actions to Train CMF Teams In 2012, CYBERCOM established consistent standards for CMF training phases within its responsibility, and the command has continuously updated those standards, as needed, to meet evolving requirements. Specifically, the command has established and updated the standards for phases two (foundational), three (collective), and four (sustainment) of CMF training. These standards apply to all military personnel regardless of service affiliation or active/reserve status. The standards are contained primarily in two documents. First, CYBERCOM issued and has regularly updated the Joint Cyberspace Training and Certification Standards (JCT&CS) to create standardized joint procedures, guidelines, and standards for individual staff and collective training, and to accurately assess CMF teams’ ability to perform their missions. This document was most recently revised in February 2018, to update, among other things, the tasks and abilities associated with CMF work roles based on feedback from experts within the military services and CYBERCOM. Second, CYBERCOM published the CMF Training and Readiness Manual to serve as the primary training and evaluation guidance for DOD cyber professionals. The CMF Training and Readiness Manual has been updated 13 times since it was originally issued in 2013, and it is CYBERCOM’s authoritative guide to building and maintaining cyber training and readiness for its personnel. It provides graduated levels of evaluated training that teams can use in preparing for certification and in being certified. Additionally, it identifies approved training events and the mission-essential tasks, associated standards, and key duties for members of CMF teams. The manual requires each team to recertify every 2 years, or upon recovery from a 50 percent or higher turnover of CMF team personnel. CYBERCOM Developed Standard Operating Procedures for Readiness Reporting In December 2017, CYBERCOM published standard operating procedures for readiness reporting that CMF teams are to use to assess whether they have the resources and capability to perform their missions. The procedures define CMF readiness reporting guidelines related to personnel, equipment, and training. For example, the document identifies three training metrics that evaluate (1) whether personnel are trained to job qualification standards; (2) whether CMF teams have successfully completed supporting tasks during training exercises, events, or real world operations; and (3) the length of time between formal evaluations. Specifically, the standard operating procedures emphasize that in order to obtain the best training readiness rating, teams must perform an evaluated event or operation at least once every 12 months. CYBERCOM Established and Maintained a Series of Courses for Individual Foundation Training CYBERCOM maintains and coordinates a series of CMF courses for phase two foundational training. It develops and administers these course requirements for all of the CMF work roles and requires personnel to complete courses specific to their job responsibilities. All CMF personnel filling a specific mission and role complete the same foundational courses, regardless of military service, employment status—active duty or reserve—or type of CMF team to which they are assigned. For example, all intelligence analysts on CMF teams are to complete the same 14 courses that are specific to their role on the team. CYBERCOM training directorate officials told us they had to make changes to the training progression over time to adapt to the changing threat environment. Accordingly, CYBERCOM has added, modified, or deleted phase two foundational training courses over the past 4 years. For example, in the past 4 years CYBERCOM consolidated four existing courses into a single introductory cyber course that is taken by all-source intelligence analysts who will be part of CMF teams. In November 2017, the command updated the phase two foundational training requirements by removing three courses that were required for a variety of Cyber Protection Team work roles. CYBERCOM also added a new networking course that is a pre-requisite to a course that comes later in the training progression for Cyber and National Mission Team mission commanders. The most recent update also emphasized that Cyber Protection Team personnel must complete the Intermediate Cyber Core Course, the Cyber Protection Team Core Course, and then their specific methodology courses, in that order. According to officials from the service cyber components, the changes CYBERCOM has made to its phase two foundational training progression have been transparent and have addressed evolving threats. However, the changes have also negatively affected training time frames, particularly for the CMF teams composed of National Guard and Reserve personnel. Because National Guard and Reserve teams are scheduled to achieve full operational capability after the active duty teams, they are more likely to be subject to the newer training progressions, which in some cases require a few additional days of courses. Officials from the National Guard told us that this additional training time is more difficult to schedule for National Guard and Reserve personnel because—unlike the active duty personnel who are available to train full time—National Guard and reservist personnel are available to train only one weekend per month and generally for 2 weeks of annual training. Additionally, most of these personnel must coordinate time off from their full-time jobs to take the required phase two foundational training courses. To help address these challenges, CYBERCOM officials told us they use mobile training teams. The Army Cyber School has also used mobile training teams to provide CMF training opportunities to Reserve personnel. The officials from CYBERCOM and the Army told us that the mobile training teams make training more accessible by avoiding the need for the National Guard and Reserve personnel to travel. CYBERCOM and the Services Used Existing Training Capabilities DOD has used existing training capabilities—including courses, instructors, and facilities—throughout all phases of CMF training. For example: Joint Cyber Analysis Course. The Navy’s Center for Information Warfare Training is the host for the Joint Cyber Analysis Course—a phase one basic training course for personnel designated for cryptologic roles. CYBERCOM recommends this course for many CMF work roles. Cyber and Cryptologic training institutions. CYBERCOM has partnered with the Defense Cyber Investigation Training Academy, the Defense Information Systems Agency, the National Security Agency, and military service schoolhouses to deliver phase two foundational training for the CMF. The Defense Cyber Investigation Training Academy offers almost all of the training courses needed by Cyber Protection Teams, and Army officials said they used the expertise and course materials provided by the Defense Cyber Investigation Training Academy to develop Cyber Protection Team training courses that they offer at the Army Cyber School as well. National Security Agency’s National Cryptologic School provides a majority of the other phase two foundational CMF training courses. According to officials from CYBERCOM and the National Cryptologic School, reliance on existing training capabilities and expertise from the National Security Agency enabled the command to quickly establish CMF capabilities. Operational events. CYBERCOM used both simulated and real-world operational events on networks to support the certification of CMF teams. For example, CYBERCOM officials told us that CYBER KNIGHT is a training event offered periodically by CYBERCOM for CMF teams to exercise national and non-national mission sets. CYBER FLAG and CYBER GUARD, also conducted by CYBERCOM on a periodic basis, utilize a dynamic joint cyber training environment and, according to CYBERCOM officials train all types of CMF teams. In addition to using simulated events through exercises, CYBERCOM and military service officials said that teams were allowed to use real- world operations to meet phase three collective training requirements. The military services and CYBERCOM plan to continue to use existing resources, such as the service school houses, for new and continuous training into the future. For example, as part of their training transition plan, Marine Corps officials reported that they have a contract in place with Navy’s Space and Naval Warfare Systems Command to provide additional training to Marine Corps CMF personnel after they complete the phase two foundational training progression. Additionally, the Army Cyber School, which provides CMF-specific training for the Army, currently trains Marine Corps personnel as well. The Army and Marine Corps have training agreements in place to continue this arrangement. Figure 4 below shows a member of the National Guard participating in a cyber training exercise. Certified Teams Are Not Fully Trained, But CYBERCOM Is Taking Actions to Improve Training and Readiness We found that many of the CMF teams for which DOD has reported achieving full operational capability actually require further training, for varying reasons. For example, officials from many key organizations across the DOD cyber enterprise told us that the services moved some personnel among teams, reducing the readiness for teams from which personnel were transferred. Officials from the Office of the Under Secretary of Defense for Personnel and Readiness, Joint Staff, and the military services cited other challenges affecting CMF team readiness levels as well, including the long time frames needed to obtain the appropriate clearances for CMF personnel and the high pace of operations for the teams, leaving little time for training. The same officials from across DOD’s cyber enterprise affirmed that, taken together, these actions and circumstances have had a negative effect on CMF team resource readiness levels. In April 2018, the commander of CYBERCOM acknowledged in testimony that “much works remains to be done to make the personnel proficient at their duties and the whole team ready and able to perform whatever missions might be directed.” The CMF teams were not fully trained and had lower readiness levels because CYBERCOM and the military services focused primarily on the teams’ achieving full operational capability by October 1, 2018, rather than on building operational readiness. Building operational readiness requires the teams to simultaneously have the appropriate number of sufficiently trained personnel across the force. According to the CMF Training Transition Plan, CYBERCOM’s senior leadership directed the command to achieve full operational capability, and it designated that effort as a higher priority than operational readiness. CYBERCOM officials told us that they recognized the low readiness of the CMF teams and have identified two actions to address the training deficiencies—and associated effects on readiness—for the CMF teams. First, according to the officials, CYBERCOM has developed a system that assigns unique identifiers to each person in the CMF and allows CYBERCOM to easily track when personnel move from one team to another. Second, in December 2017, CYBERCOM issued its readiness reporting standard operating procedure that establishes new readiness reporting guidelines. CYBERCOM officials stated that these guidelines emphasize readiness over the achievement of interim milestones, such as full operational capability. Given that CYBERCOM recently implemented these efforts to improve the readiness of the CMF teams, and that the quarterly readiness reports indicate improved resource readiness for personnel and training metrics, we are not making recommendations related to this issue. Through our body of work on defense cyber issues, we will continue to monitor DOD’s and CYBERCOM’s efforts to maintain a ready CMF. DOD Has Shifted Focus from Building to Maintaining a Trained CMF, but Has Not Taken Key Actions to Maintain Future Training DOD has taken steps to shift its focus from building a trained CMF to maintaining this force, but it has not taken key actions to ensure that the department is poised to maintain CMF training following this transition. Specifically, the military services have not developed plans that include time frames for validating all phase two foundational training courses, or that comprehensively assess their training requirements. Further, as of June 2018, CYBERCOM had not provided a plan for establishing independent assessors to evaluate and certify the completion of phase three collective training for CMF teams. DOD Is Shifting from Building to Maintaining a Trained CMF DOD officials told us that the department is shifting its focus away from building and toward maintaining a trained CMF. For example, the Army is leading the development of a Persistent Cyber Training Environment. The goal of that training environment is to provide on-demand access to scenarios that Army officials told us will enhance the quality, quantity, and standardization of phase three (collective) and phase four (sustainment) training and exercise events. The Persistent Cyber Training Environment is scheduled to provide some operational capability by 2019, and it is expected to continue to evolve to meet training needs. In addition to building a Persistent Cyber Training Environment, the department has developed the CMF Training Transition Plan, which will transfer administration of phase two foundational training from CYBERCOM to the services. Specifically, beginning in October 2018, the military services will assume responsibility for phase two foundational training of CMF personnel, which CYBERCOM has centrally managed since CMF training began in 2013. Officials from the services and CYBERCOM have held quarterly meetings to help guide the implementation of this plan. According to the CMF Training Transition Plan, the transfer is being made in response to a direction in Senate Report 114-49 accompanying a bill for the National Defense Authorization Act for Fiscal Year 2016. The report directed the DOD Principal Cyber Advisor, the Commander, CYBERCOM, and the service secretaries to develop a plan for the military services to complete all required training for the second wave of CMF teams and to maintain individual training capabilities for the existing teams. In January 2017 the Joint Staff and Principal Cyber Advisor published the CMF Training Transition Plan, to transition CMF training to a model that complied with congressional committee direction. The principal goal of this approach is to drive efficiencies and reduce training development and delivery costs. According to the plan, CYBERCOM maintains control of the standards for phase two foundational training, while the Army, Navy, and Air Force are to assume specific joint curriculum lead roles. These roles entail developing joint training plans for the courses under the work roles they are assigned. In addition, the joint curriculum leads (i.e., Army, Navy, and Air Force) are responsible for identifying training gaps and developing learning objectives and courseware based on the CYBERCOM training task list requirements for each of the work roles. For example, under its curriculum lead role, the Army has accepted responsibility for the cyber planner courses. In carrying out this role, the Army developed the Cyber Operations Planners Course and submitted it to CYBERCOM to establish as an approved course for all cyber planners—regardless of service affiliation and of active or reserve duty status—in the CMF. Figure 5 shows the work role categories and responsibilities for which each military service has agreed to be curriculum lead. Military Services’ CMF Training Transition Implementation Plans Do Not Include Time Frames for Validating Courses or Comprehensive Assessments of Training Requirements In November 2017, CYBERCOM directed the military services to develop plans to implement their responsibilities in support of the CMF Training Transition Plan. In accordance with the training transition plan, the military services will assume responsibility for phase two foundational course validation as part of their joint curriculum lead duties. In February 2018, each of the four services provided a plan to CYBERCOM that, at a minimum, highlighted the efforts each service was taking to prepare for its new training transformation responsibilities, including phase two foundational course validation. The purpose of course validation is to determine whether a course adheres to CYBERCOM’s joint training standards as published in the Joint Cyberspace Training and Certification Standards (JCT&CS). CYBERCOM’s draft course validation guidance states that validation involves an examination of both the content of the courses, as well as the instructional methods. The manual states that the content should align with the knowledge, skills, and abilities for the appropriate CYBERCOM work roles and should meet the joint training standard. Further, the manual states that the validation of instructional methods examines how the course is taught and determines whether the methods are appropriate to support desired course outcomes. CYBERCOM’s draft course validation guidance lays out a series of requirements for the validation process, among which are the following: The military service that is submitting the course for validation is responsible for assembling course information, providing back-up data about the course, and securing subject matter experts to review the submission. The military service that is the joint curriculum lead for the course is responsible for reviewing the submissions and offering recommendations for modifications to courses to reflect joint standards. CYBERCOM is responsible for making final determinations of course validity. In this final review, CYBERCOM may hold discussions with key stakeholders, audit the course, review student feedback on the course, or review evaluation data from the course to inform its final validation determination. Our review of the services’ training transition plans found that the Army’s and Air Force’s plans address course validation to some degree, but they do not identify specific time frames for completing course validation. Specifically, the Army’s plan identifies the milestones, dates, and resources for the submission of two of its analyst and planner courses to CYBERCOM for validation, but it does not indicate when the service will submit its Cyber Protection Team Core Training Course for validation. The Air Force’s plan establishes a timeline for developing, finalizing, and distributing course validation guidance, but it does not have time frames or milestones indicating a time for beginning the process of submitting courses to CYBERCOM for validation. Standards for Internal Control in the Federal Government highlights the need to define objectives in specific terms, to include how objectives are to be achieved and time frames for their achievement. For example, the Navy’s plan indicates that the four courses for which it is responsible will be iteratively validated between fiscal years 2019 and 2021. While a 24- month time frame is broad and it may be challenging for CYBERCOM and the other services to know with precision when the Navy will complete its course validation efforts, the plan includes a time frame that CYBERCOM and the services can use for further discussion and planning purposes. The plans submitted by the Army and the Air Force indicate that the course validation time frames for phase two foundational courses are unknown because course validation is still dependent upon CYBERCOM’s review. The Army’s plan includes time frames for submitting to CYBERCOM two of the three courses it is responsible for developing, but one of the courses does not have any time frames. Further, the Air Force plan includes time frames for developing guidance on how to perform course validation that only carry it through September 2018; it does not have time frames for actually carrying out its course validation processes. As the military services assume phase two foundational training responsibilities from CYBERCOM, it is important that they coordinate with CYBERCOM to establish a timeline for course validation, as appropriate. With a clearer idea of which information can appropriately be removed from training courses, the services will be able to make informed decisions to balance the cost-effectiveness of the training with delivering trained cyber personnel to CMF teams more quickly. However, without an established time frame to assess and validate the efficiency and effectiveness of all phase two individual foundational training against established expectations, DOD will not be well positioned to reasonably assure that the phase two foundational training meets the needs of the CMF and its mission. The Military Services’ Plans Do Not Comprehensively Assess Personnel Training Requirements Training plans should be detailed enough to provide insight into the number of people needed to fill specific positions to sustain an organization. As part of the training transition process, CYBERCOM required the military services to submit implementation plans that identify, among other things, training requirements and execution. Also, according to our prior work published in Human Capital: A Guide for Assessing Strategic Training and Development Efforts in the Federal Government, training plans should be designed to determine the skills and competencies a workforce needs to prepare for current, emerging, and future agency needs in pursuit of its missions. These needs include the size of the workforce; its deployment across the organization; and the knowledge, skills, and abilities needed for the agency to pursue its current and future missions. To ensure a strategic workforce planning approach, it is important that agencies consider how hiring, training, and other human capital strategies can be aligned to support mission success. The Army, Navy, and Air Force developed training transition implementation plans to address training requirements and execution to some degree, but the plans do not identify the number of personnel or teams and the specific training activities needed across all phases of training to maintain the CMF. For example, neither the Army nor the Air Force plan identifies the number (average or total) of personnel for each of the work roles described in figure 2 (for example, cyber operators, intelligence analysts, linguists) that the military services need to complete phase two foundational training courses to maintain the appropriate sizing and deployment of personnel across CMF teams. Additionally, the Army and Air Force plans do not identify the number of personnel or teams needed to conduct phase three (collective) and phase four (sustainment) training in future years. In contrast, the Navy’s plan identifies the average number of personnel who would need to take specific phase two foundational courses—including those being developed by other services and CYBERCOM—to maintain its CMF teams. However, the Navy’s plan does not include this same information for phases three and four of training. The Marine Corps did not address training requirements and execution within its implementation plan. According to officials from the Army and the Air Force, the February 2018 documents they provided in response to CYBERCOM’s requirement do not include plans that identify training requirements because submission of that information was not required by CYBERCOM. However, a November 2017 CYBERCOM memorandum clearly directed the military services with joint curriculum lead responsibilities to submit plans that support implementation of the department’s CMF Training Transition Plan, including training requirements execution data. Having a comprehensive plan that identifies the number of personnel or teams needed to accomplish specific training activities would help the services to better manage the number of personnel who need to be rotated into the CMF teams. It would also help the military services coordinate with each other on course offerings by providing situational awareness of the number of personnel from other services who could attend their courses in any given year. For example, the Air Force would know how many Army, Navy, and Marine Corps personnel would attend the courses being offered by the Air Force. Without a plan that comprehensively assesses and identifies the services’ training needs for each type of personnel, DOD cannot reasonably ensure that its training plan will support the transition to a joint training model or be aligned with its stated goal to maintain a trained and ready force. CYBERCOM Was Unable to Provide a Plan for Establishing Independent Assessors for Phase Three Collective Training As of June 2018, CYBERCOM had not provided a plan for establishing independent assessors to evaluate and certify the completion of phase three collective training for CMF teams. CYBERCOM’s CMF Training and Readiness Manual explains that evaluations are necessary to assess readiness and provide commanders with a process to determine a team’s proficiency in the tasks it must perform during a mission. Assessors play an important role in this evaluation process by judging the performance of CMF teams using CYBERCOM’s evaluation forms, which establish common evaluation criteria to determine whether the team being evaluated has met the certification standards. CYBERCOM officials told us that to evaluate teams completing phase three certification through CYBERCOM events (approximately 50 percent, according to agency officials), the command provided a joint team of assessors. CYBERCOM and service officials told us that the services provided their own assessors for teams that completed phase three training through their respective service-hosted exercises. In discussions with Army and Air Force officials, they identified two challenges they have experienced with the services providing assessors to evaluate their own teams, which could lead to subjectivity in CMF team evaluations. First, in some instances the assessors have come from within the same chain of command as the CMF team and thus are not truly independent. Standards for Internal Control in the Federal Government discusses the importance of segregation of duties in designing control activities so that incompatible duties are segregated in order to mitigate the risk of management override of internal control. In this case, having an assessor from the same chain of command evaluate a CMF team’s performance in a certification event presents an increased risk of fraud through management override. Second, while the CMF Training and Readiness Manual includes checklists that assessors can use to evaluate team performance, according to service officials, the manual does not provide clear guidance on how to evaluate whether the tasks and performance standards have been sufficiently met by the team. The absence of such information could lead to subjective evaluations as to whether a team met the desired performance standard. According to one service official, these challenges could be addressed if CYBERCOM were to provide an expert who evaluates the training tasks and performance standards—an action that could lead to a more consistent application of evaluation criteria. When we asked officials from CYBERCOM’s training directorate about whether the command could provide more oversight for certification events, the officials acknowledged that, among other tasks, the command is responsible for ensuring that assigned joint cyber forces are trained, certified, and interoperable with other forces. The officials said that to do this, the command will use established training standards and develop a plan to train and certify CMF team evaluators to a set of standardized criteria. Command officials said they believe this will enable the services and CMF teams to have qualified assessors who are trained and certified by CYBERCOM to consistently evaluate the performance of the CMF teams based on joint standards. With this capability, for example, a Navy Cyber Protection Team assessor can be used by an Army Cyber Protection Team to evaluate that team in an operation, exercise, or training event. This training capacity should enhance the interoperability between the services and allow for consistent evaluation of a team’s performance. However, as of June 2018, CYBERCOM had not provided a plan to train and certify assessors from across the services; as such a plan had not yet been developed. Standards for Internal Control in the Federal Government explains that in defining objectives, management should clearly define what is to be achieved, how it will be achieved, and the time frames for achievement. Documenting these objectives in a plan also will help formalize the new process and ensure that the appropriate managerial emphasis is given to the effort. DOD has used similar mechanisms to implement changes to cyber training in the past, such as developing the CMF Training Transition Plan in response to moving phase two foundational training responsibility from CYBERCOM to the military services. Since phase three certification events act as a quality control mechanism for CMF teams, it is important that the events be independently evaluated to ensure that CMF teams are trained to a consistent standard. Without a documented plan to train and certify assessors to evaluate CMF phase three collective training certification events, the CMF teams will not be consistently evaluated as they are operationally certified. CYBERCOM Has Leveraged Other Cyber Experience to Meet Training Requirements, but It Has Not Established Master Training Task Lists for Courses CYBERCOM Has Established a Training Exemption Process for CMF Personnel Who Have Relevant Prior Experience CYBERCOM assesses the prior experience of CMF personnel to meet training requirements through a process known as individual training equivalency. This process allows personnel to be exempted from specific training courses by showing that they have already met the learning objectives of the course through their prior experience. CYBERCOM established an Individual Training Equivalency Board consisting of subject matter experts and representatives from CYBERCOM, the National Security Agency, and service cyber components who review the applications and recommend whether equivalency should be granted. The Individual Training Equivalency Board reviewed approximately 700 applications for equivalency from September 2013 through April 2018, and more than three-quarters of those applicants had at least one course exemption approved. According to officials from CYBERCOM’s training directorate, which is responsible for administering the individual equivalency process, there are a number of reasons why requests for course exemptions are not approved. For example, some applicants are denied for administrative reasons, such as not filling out the paperwork correctly. Also, applicants are not eligible to receive exemptions for courses that are not part of their work role requirements, but some personnel try to do so. Officials also said that board members do not deem some applicants’ reported experiences as comparable to the knowledge and skills they would obtain from taking courses for which they seek exemptions. Based on our review CYBERCOM’s memorandums that document the approval or disapproval of approximately 700 individual requests for training exemptions, we observed that applicants typically requested exemptions for multiple courses, with some seeking exemptions for up to 16 courses. Altogether during this period, we found that CYBERCOM granted more than 1,400 equivalencies for approximately 90 different phase two foundational training courses. Certain courses were exempted more often than others. For example, the course for which CYBERCOM most frequently granted individual exemptions was the Joint Advanced Cyber Warfare Course. This 4-week course provides an orientation to CYBERCOM, the global cryptologic platform, the intelligence community, and allies and major partners in the conduct of cyber warfare operations, planning, and analysis of effects. Other courses that were commonly granted training exemptions included 1-week courses related to computer network exploitation, cyber offensive and defensive operations, and understanding network and operating system fundamentals. These courses teach the basic skills associated with performing CMF operations. Additionally, we found that CYBERCOM’s Individual Training Equivalency Board approved approximately 50 exemptions for Intermediate Cyber Core, which is an 8- week course that CYBERCOM training officials described as providing the background and proficiency needed to identify, understand, and navigate the digital environment. The officials said that the course also provides an understanding of network operational methods and offensive and defensive cyber operation principles. CYBERCOM Has Not Established Master Training Task Lists for Courses CYBERCOM has not established master training task lists for phase two foundational training, a key set of standards the services are to use in preparing course equivalency standards. The task lists correlate to the knowledge, skills, and abilities that the services will use to develop learning objectives and course materials for training. They are also important in informing the services’ ability to make equivalency application determinations because they form the learning objectives of the courses that may be bypassed. To determine whether an applicant’s experience is equivalent to what would be taught in a course; the entity making the decision must know the learning objectives of the course. However, as of May 2018, CYBERCOM officials were unable to provide evidence that the command had developed master training task lists for phase two foundational CMF training courses, as required. The January 2017 CMF Training Transition Plan required CYBERCOM to provide all mission and support team master training task lists for the phase two foundational training courses to the military services no later than March of 2018. Service and CYBERCOM officials said that they are holding monthly meetings to provide updates related to the training standards and other training transition-related information, but as of May 2018, CYBERCOM officials had not confirmed that they had provided the master training task lists to the services. Officials from the services told us that they need these master training task lists to develop clear decision rules as they assume responsibility for making equivalency decisions for phase two foundational training courses. When we interviewed CYBERCOM in February of 2018, officials told us that they were not aware of the requirement established in the CMF Training Transition Plan, but said they would start developing the master training task lists. Establishing clear standards is particularly important at this time, because the services are scheduled to assume responsibility for administration of the individual training equivalency process for Cyber Protection Team phase two foundational training courses in October 2018. Until CYBERCOM establishes and disseminates the master training task lists for phase two foundational CMF courses, the military services are at risk of developing inconsistent decision rules for their training equivalency processes, and the development of such processes could be delayed, resulting in the funding of training that is unnecessary. Conclusions Developing and maintaining a trained cyber mission force is imperative to DOD’s ability to achieve its missions in the connected world within which it operates. DOD has made progress toward its goals of building and maintaining a trained cyber mission force. As DOD starts to focus on maintaining a ready CMF, addressing gaps in its training plans and structure will help it reach those goals. The Army’s and Air Force’s lack of time frames, like those established by the Navy in its implementation plan, for validating phase two foundational training could contribute to training inefficiency and unnecessarily long time frames for training personnel. Further, the military services, by not clearly identifying the number of personnel they need to train, hinder planning and coordination efforts to ensure that the training infrastructure is sufficient and is used efficiently. In addition, the absence of a plan for CYBERCOM to establish independent assessors for phase three collective training certification events may lead to teams being certified to different standards. Also, not having the master training task lists necessary to establish clear decision rules for granting individual training exemptions for phase two foundational training courses may contribute to inconsistent personnel skill levels and inefficient use of training resources. Focusing on maintaining sustainable readiness, as DOD has already begun to do, and addressing these weaknesses can lead to long-term improvements in the capability and capacity of its CMF. Recommendations for Executive Action We are making eight recommendations to DOD. The Secretary of Defense should ensure that the Army, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 1) The Secretary of Defense should ensure that the Air Force, in coordination with CYBERCOM and the National Cryptologic School, where appropriate, establish a time frame to validate all of the phase two foundational training courses for which it is responsible. (Recommendation 2) The Secretary of the Army should ensure that Army Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Army’s CMF teams. (Recommendation 3) The Secretary of the Navy should ensure that Fleet Cyber Command coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases three (collective) and four (sustainment) in order to maintain the appropriate sizing and deployment of personnel across the Navy’s CMF teams. (Recommendation 4) The Secretary of the Air Force should ensure that Air Forces Cyber coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Air Force’s CMF teams. (Recommendation 5) The Commandant of the Marine Corps should ensure that Marine Corps Forces Cyberspace coordinate with CYBERCOM to develop a plan that comprehensively assesses and identifies specific CMF training requirements for phases two (foundational), three (collective), and four (sustainment), in order to maintain the appropriate sizing and deployment of personnel across the Marine Corps’ CMF teams. (Recommendation 6) The Secretary of Defense should ensure that the commander of CYBERCOM develops and documents a plan for establishing independent assessors to evaluate CMF phase three collective training certification events. (Recommendation 7) The Secretary of Defense should ensure that the commander of CYBERCOM establishes and disseminates the master training task lists covered by each phase two foundational training course and convey them to the military services, in accordance with the CMF Training Transition Plan. (Recommendation 8) Agency Comments We provided a draft of the FOUO version of this product to DOD for review and comment and worked with the department to develop this unclassified product. In its comments on the FOUO version of this, reproduced in appendix II, DOD concurred with our recommendations. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to appropriate congressional committees; the Secretary of Defense, the office of the Principal Cyber Advisor, the Office of the Under Secretary of Defense for Personnel and Readiness, the Office of the Deputy Assistant Secretary of Defense for Cyber Policy, the Commander of CYBERCOM, the leadership of each of the service cyber components, and the director of the National Security Agency’s National Cryptologic School. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Roles and Responsibilities for Cyber Mission Force Training Based on our review of related statutes, Department of Defense (DOD) instructions and directives, and other guidance, we found that various DOD officials have been assigned a variety of CMF training roles and responsibilities, summarized in table 1 below. Appendix II: Comments from the Department of Defense Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the individual named above, Tommy Baril, Assistant Director; Tracy Barnes; Patricia Farrell Donahue; Ashley Houston; Amie Lesser; Randy Neice; Geo Venegas; and Cheryl Weissman made key contributions to this report.