Is the State Department doing enough to keep U.S. personnel safe? U.S. personnel overseas can be targets of terrorism, violence, and crime—particularly while in transit. From 1998 to 2015, State Department personnel were attacked more than 100 times while traveling outside of embassy compounds, with many of the worst attacks occurring while victims were in motorcades, official vehicles, or other forms of transportation. The Department of State has taken steps to protect personnel in transit, but we found opportunities to enhance transportation policies, training, and communications, and made multiple recommendations to that end. What GAO Found The Department of State (State) has established policies related to transportation security for overseas U.S. personnel, but gaps exist in guidance and monitoring. GAO reviewed 26 posts and found that all 26 had issued transportation security and travel notification policies. However, policies at 22 of the 26 posts lacked elements required by State, due in part to fragmented implementation guidance on what such policies should include. State also lacks a clear armored vehicle policy for overseas posts and procedures for monitoring if posts are assessing their armored vehicle needs at least annually as required by State. These gaps limit State's ability to ensure that posts develop clear policies that are consistent with State's requirements and that vehicle needs for secure transit are met. While State provides several types of training related to overseas transportation security, weaknesses exist in post-specific refresher training. Regional security officers (RSO) receive required training related to transportation security in special agent courses, and nonsecurity staff reported receiving relevant training before departing for posts—including on topics such as defensive driving and the importance of taking personal responsibility for one's security—as well as new arrival briefings at posts. At most of the 9 posts GAO visited, however, staff had difficulty remembering key details covered in new arrival briefings or described the one-time briefings as inadequate. State's requirements for providing refresher briefings are unclear, potentially putting staff at greater risk. State uses various systems at overseas posts to communicate time-sensitive information related to transportation security, but several factors hinder its efforts. RSOs and other post officials are responsible for communicating threat information to post personnel. However, at 4 of the 9 posts it visited, GAO learned of instances in which staff did not receive important threat information in a timely manner for various reasons. In one case, this resulted in an embassy vehicle being attacked with rocks and seriously damaged while traveling through a prohibited area. In addition, while all 9 of the posts GAO visited require that personnel notify the RSO before traveling to certain locations, personnel at more than half of the 9 posts said they were unaware of these requirements or had difficulty accessing required travel notification systems. Timely communication is critical for managing transportation security risks, and failure to communicate important transportation-related information and receive such information promptly could leave overseas personnel facing avoidable security risks. Why GAO Did This Study U.S. diplomatic personnel posted overseas continue to face threats to their security. According to State, personnel and their families are particularly vulnerable when traveling outside the relative security of diplomatic work facilities or residences. In many serious or fatal attacks on U.S. personnel over the last three decades, victims were targeted while in motorcades, official vehicles, or otherwise in transit. GAO was asked to review how State manages transportation-related security risks to U.S. diplomatic personnel overseas. For this report, GAO evaluated the extent to which State, with regard to transportation security at overseas posts, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time-sensitive information. GAO reviewed agency documents and met with key officials in Washington, D.C. GAO also reviewed policies from a judgmental sample of 26 posts—primarily higher-threat, higher-risk locations—and conducted fieldwork and met with officials at 9 of these posts. This is the public version of a sensitive but unclassified report issued in September 2016. What GAO Recommends GAO is making eight recommendations in this report to help State improve its management of transportation-related security risks by enhancing associated policies, guidance, and monitoring; clarifying its requirements for refresher briefings; and better communicating time-sensitive information. State agreed to take steps for all but one recommendation—the need to clarify its requirements for refresher briefings. GAO continues to believe this is needed as discussed in the report.

U.S. diplomatic personnel posted overseas continue to face threats to their security. According to State, personnel and their families are particularly vulnerable when traveling outside the relative security of diplomatic work facilities or residences. In many serious or fatal attacks on U.S. personnel over the last three decades, victims were targeted while in motorcades, official vehicles, or otherwise in transit. GAO was asked to review how State manages transportation-related security risks to U.S. diplomatic personnel overseas. For this report, GAO evaluated the extent to which State, with regard to transportation security at overseas posts, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time-sensitive information. GAO reviewed agency documents and met with key officials in Washington, D.C. GAO also reviewed policies from a judgmental sample of 26 posts-primarily higher-threat, higher-risk locations-and conducted fieldwork and met with officials at 9 of these posts. This is the public version of a sensitive but unclassified report issued in September 2016.

U.S. diplomatic personnel posted overseas continue to face threats to their security. According to State, personnel and their families are particularly vulnerable when traveling outside the relative security of diplomatic work facilities or residences. In many serious or fatal attacks on U.S. personnel over the last three decades, victims were targeted while in motorcades, official vehicles, or otherwise in transit. GAO was asked to review how State manages transportation-related security risks to U.S. diplomatic personnel overseas. For this report, GAO evaluated the extent to which State, with regard to transportation security at overseas posts, has (1) established policies, guidance, and monitoring; (2) provided personnel with training; and (3) communicated time- sensitive information. This is the public version of a sensitive but unclassified report issued in September 2016. GAO is making eight recommendations in this report to help State improve its management of transportation-related security risks by enhancing associated policies, guidance, and monitoring; clarifying its requirements for refresher briefings; and better communicating time-sensitive information.

What GAO Found The Department of State (State) conducts a range of activities to assess risks to residences overseas. For instance, State tracks information on overseas residences in its property database, establishes threat levels at overseas posts, develops security standards for different types of residences and threat levels, and requires posts to periodically conduct residential security surveys. However, 17 of the 68 surveys for residences GAO reviewed were untimely or missing. Without up-to-date security surveys of all its overseas residences, State's ability to identify and address vulnerabilities or make informed decisions about where to allocate resources for security upgrades is limited. State has taken steps to update its residential security standards; however, these updates have not been timely, and the standards are difficult to use. According to State officials, updating residential security standards should take about 75 days, but all three updates since 2005 took more than 3 years each. State is making efforts to improve the timeliness of such updates in response to a prior GAO recommendation. In addition, while federal internal control standards state that policy standards should be clear and consistent to support good decision making, State's standards and other security-related guidance for residences have gaps and inconsistencies, complicating posts' efforts to determine and apply the appropriate security measures and potentially leaving some residences at risk. State addresses security vulnerabilities at residences by installing various upgrades intended to help residences meet security standards, but 38 of the 68 residences GAO reviewed did not meet all applicable standards. For example, 8 residences did not meet the standards for perimeter barriers. When residences do not and cannot meet all applicable security standards, posts are required to request exceptions, which identify steps the posts will take to mitigate vulnerabilities. However, State had an exception on file for only 1 of the 38 residences that did not meet all applicable standards. As a result, State lacks key information that could provide it with a clearer picture of security vulnerabilities at residences and enable it to make better risk management decisions. State manages risks to schools and other soft targets overseas in several ways, but its efforts may be constrained by limited awareness of relevant guidance and tools. In fiscal years 2010 through 2015, State awarded almost 400 grants in total for security upgrades at schools and other soft targets. While federal internal control standards call for timely communication of relevant information to staff responsible for program objectives, officials at most of the posts GAO visited were unaware of some guidance and tools for securing schools and other soft targets. As a result, State may not be fully leveraging existing programs and resources for addressing security needs at these facilities. Why GAO Did This Study Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive “soft targets.” GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015. What GAO Recommends GAO recommends that State, among other things, institute procedures to ensure residential security surveys are completed as required, clarify its standards and security-related guidance for residences, develop procedures to ensure residences either meet standards or have exceptions on file, and take steps to ensure posts are aware of existing guidance and tools regarding the security of schools and other soft targets. State concurred with all of GAO's recommendations.

"Since the 1998 East Africa bombings, U.S. diplomatic personnel working overseas have faced increasing threats to their safety and security. State has built many new embassies and consulates since 1998 and enhanced security measures at others. Increased security at such facilities has raised concerns that residences, schools, and other places where U.S. diplomatic personnel and their families congregate may be viewed by terrorists as more attractive 'soft targets.' GAO was asked to review the security of residences and other soft targets overseas. GAO evaluated (1) how State assesses risks to U.S. diplomatic residences overseas; (2) the timeliness, clarity, and consistency of residential security standards; (3) how State addresses security vulnerabilities at residences; and (4) how State manages risks to other soft targets. GAO reviewed agency documents; met with officials in Washington, D.C.; and conducted fieldwork at a judgmental sample of seven higher-threat, higher-risk posts in four of State's six geographic regions. This is the public version of a sensitive but unclassified report issued in June 2015"--Preliminary page.

" U.S. policy can call for U.S. personnel to be posted to high-threat, high-risk posts overseas. To maintain a presence in these locations, State has often relied on older, acquired (purchased or leased), and temporary work facilities that do not meet the same security standards as more recently constructed permanent facilities. GAO was asked to review how State assures the security of these work facilities. GAO evaluated (1) how State manages risks at work facilities overseas; (2) the adequacy of State's physical security standards for these facilities; (3) State's processes to address vulnerabilities when older, acquired, and temporary overseas facilities do not meet physical security standards; and (4) the extent to which State's activities to manage risks to its overseas work facilities align with State's risk management policy and with risk management best practices. GAO reviewed U.S. laws and State's policies, procedures, and standards for risk management and physical security. GAO reviewed facilities at a judgmental sample of 10 higher-threat, higher-risk, geographically dispersed, overseas posts and interviewed officials from State and other agencies in Washington, D.C., and at 16 overseas posts, including the 10 posts at which GAO reviewed facilities. "

U.S. policy can call for U.S. personnel to be posted to high-threat, high-risk posts overseas. To maintain a presence in these locations, State has often relied on older, acquired (purchased or leased), and temporary work facilities that do not meet the same security standards as more recently constructed permanent facilities. GAO was asked to review how State assures the security of these work facilities. GAO evaluated (1) how State manages risks at work facilities overseas; (2) the adequacy of State's physical security standards for these facilities; (3) State's processes to address vulnerabilities when older, acquired, and temporary overseas facilities do not meet physical security standards; and (4) the extent to which State's activities to manage risks to its overseas work facilities align with State's risk management policy and with risk management best practices. GAO reviewed U.S. laws and State's policies, procedures, and standards for risk management and physical security. GAO reviewed facilities at a judgmental sample of 10 higher-threat, higher-risk, geographically dispersed, overseas posts and interviewed officials from State and other agencies in Washington, D.C., and at 16 overseas posts, including the 10 posts at which GAO reviewed facilities. GAO is making 13 recommendations for State to address gaps in its security-related activities, standards, and policies (detailed on the following page).