DOD Installations: Monitoring Use of Physical Access Control Systems Could Reduce Risks to Personnel and Assets

In November 2009, an Army officer killed or wounded 45 people at Fort Hood, Texas; 4 years later in September 2013, a Navy contractor killed or wounded 16 people at the Washington Navy Yard in Washington, D.C. Independent reviews conducted in the aftermath of these shootings identified physical access control weaknesses at DOD installations.

The conference report accompanying the National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to assess DOD's installation access control efforts. GAO (1) described actions DOD has taken to develop guidance on physical access to domestic installations and to field PACS at these installations, (2) evaluated the extent to which DOD has monitored the use of fielded PACS at these installations, and (3) evaluated the extent to which DOD has implemented an approach for addressing PACS technical issues and assessing associated performance. GAO analyzed DOD guidance on physical access control requirements, and visited installations to discuss with installation command and security force officials their experiences using PACS. This is a public version of a sensitive report that GAO issued in May 2019. Information that DOD deemed sensitive has been omitted.

The Department of Defense (DOD) has issued guidance on accessing its domestic installations and strengthening physical access control systems (PACS)—used to scan credentials to authenticate the identity and authorize individuals to access DOD installations. Specifically, DOD has recently issued guidance directing the fielding of PACS and has fielded or plans to field such systems at domestic installations. The Defense Manpower Data Center (DMDC) developed the PACS used by the Air Force, the Navy, the Marine Corps, and the Defense Logistics Agency. The Army developed its own PACS. Both types of PACS electronically connect to DOD's Identity Matching Engine for Security and Analysis (IMESA). IMESA accesses authoritative government databases to determine an individual's fitness for access (i.e., whether an individual is likely a risk to an installation or its occupants), and continually vets this fitness for subsequent visits (see fig.).

The Air Force and DLA have monitored their installations' use of PACS, but the Army, the Navy, and the Marine Corps have not. Army, Navy, and Marine Corps installation officials stated that they do not monitor PACS use at their installations because there is no requirement to do so. Because the Army, the Navy, and the Marine Corps do not monitor PACS use and DOD does not require that they do so, those military services do not have the data they need to evaluate the effectiveness of PACS and make informed risk-based decisions to safeguard personnel and mission-critical, high-value installation assets. DOD, Army, Navy, and Marine Corps officials agreed that monitoring installations' use of PACS would be beneficial and could be readily accomplished without significant cost using existing technology.

The Army and DMDC have used a tiered approach and established helpdesks to address PACS technical issues. The Army has established performance measures and goals to assess its approach, which has improved the ability to resolve technical issues. DMDC, however, does not have performance measures and goals, and thus lacks the information needed to evaluate its PACS' performance and address issues negatively affecting operational availability.

GAO made five recommendations, including that DOD monitor installations' use of PACS and develop appropriate performance measures and goals for resolving technical issues to improve PACS performance. DOD concurred with GAO's recommendations.

In November 2009, an Army officer killed or wounded 45 people at Fort  Hood, Texas; 4 years later in September 2013, a Navy contractor killed or  wounded 16 people at the Washington Navy Yard in Washington, D.C.  Independent reviews conducted in the aftermath of the Fort Hood and  Washington Navy Yard shootings identified weaknesses in physical  access controls at Department of Defense (DOD) installations. DOD  subsequently has taken action to strengthen physical access controls to  protect personnel and resources on its installations.

Physical access control systems (PACS) comprise integrated hardware  and software systems that security forces use at installation access  control points to scan credentials (i.e., identification cards) to authenticate  the identity and authorize access for individuals seeking access to DOD  installations. DOD’s Defense Manpower Data Center (DMDC) manages  the PACS called the Defense Biometric Identification System (DBIDS)  fielded at Air Force, Navy, Marine Corps and Defense Logistics Agency  (DLA) installations. The Army manages the PACS called Automatic  Installation Entry (AIE) that are fielded at Army installations.

The conference report accompanying the National Defense Authorization  Act for Fiscal Year 2018 contained a provision for us to evaluate, among  other things, DOD installation access control initiatives. Our objectives  were to (1) describe actions DOD has taken to develop guidance on  physical access to domestic installations and to field PACS at these  installations, (2) evaluate the extent to which DOD components have  monitored the use of fielded PACS at these installations, and (3) evaluate  the extent to which DOD has implemented an approach for addressing  PACS technical issues and assessing associated performance.

This report is a public version of a sensitive report that we issued on May  31, 2019. The sensitive report included an objective related to the extent  to which security forces at various DOD domestic installations used  fielded PACS. DOD deemed a significant portion of the information  related to this objective to be sensitive, necessitating protection from  public disclosure. This public report omits information related to our  observations of PACS use at these installations and the risks associated  with not using PACS. As a result of this omission, we updated the  wording of the second objective to focus on DOD components’ efforts to  monitor the use of fielded PACS at installations. Although the second  objective and the information associated with it in this public report is  more limited, we relied on the same methodology to support our findings  and the excluded information does not impact our recommendations. The  first and third objectives in this report are the same as the objectives in  the sensitive report and each uses the same methodology as in the  sensitive report. DOD deemed some of the detailed information presented  in conjunction with the third objective to be sensitive, necessitating  protection from public disclosure. As a result, this public report omits  specific details regarding technical issues of PACs.

We examined physical access controls at authorized access control  points at DOD domestic installations that are subject to the jurisdiction,  the administration, or in the custody of the Army, the Navy, the Air Force,  the Marine Corps, and DLA (which we refer to collectively as the DOD  components). We focused on DOD’s physical access controls for  individuals seeking “unescorted access” at authorized access control  points.

For objective one, we reviewed and analyzed key Office of the Under  Secretary of Defense for Intelligence (OUSD(I)) and DOD component  policies outlining physical access control requirements and DOD  component documentation, and interviewed officials from these  organizations to discuss planned PACS enhancements.

For objective two, we analyzed OUSD(I), DOD component, and  installation guidance on PACS use, and selected and conducted site  visits to six domestic installations to meet with installation command and  security force officials to discuss their experiences using PACS. In  selecting the six installations, we considered one from each DOD  component, geographic proximity among installations, and the type of  PACS used by the installation. Of the six installations, five had fielded  PACS at the time of our visit. We also reviewed OUSD(I) and DOD  component policies that govern access control for standalone facilities  and enclaves, but we did not evaluate the standalone facilities’ and  enclaves’ use of PACS. We then compared the guidance on the use of  PACS and our observations of the five selected installations’ use of PACS  with Standards for Internal Control in the Federal Government, which  states that management should obtain data on a timely basis so that they  can be used for effective monitoring.

For objective three, we analyzed DOD component data on the number  and type of PACS’ technical issues reported by DOD installations from  January 2016 through July 2018. We also compared the steps the Army  and DMDC have taken or planned to address helpdesk technical issues  with Standards for Internal Control in the Federal Government for  developing performance measures. We interviewed officials from DOD  components and the installations we visited to discuss their experiences  with PACS helpdesks, and their views on the performance and reliability  of PACS. We assessed the reliability of the technical issue data by  interviewing knowledgeable officials about steps taken to verify the data’s  accuracy, and tested the raw data to determine the accuracy of the  summary data provided by DOD. We determined that the data were  sufficiently reliable for our understanding of the number and types of  PACS technical issues. More detailed information on our objectives,  scope, and methodology can be found in appendix I of this report.

We subsequently worked with DOD from June 2019 to August 2019 to  prepare this public version of the original sensitive report. This public  version was also prepared in accordance with these standards.

It is DOD policy that installations, property, and personnel shall be  protected and that the authority of a DOD commander to take reasonably  necessary and lawful measures to maintain law and order and to protect  installation personnel and property includes the individuals’ removal from  or denial of access to, an installation when those individuals threaten the  orderly administration of the installation. The Under Secretary of  Defense for Intelligence develops overall security policy, including  requirements for the DOD Physical Security Program, and the secretaries  of the military departments and heads of DOD components establish  policies and procedures to implement the Under Secretary’s policies.

DOD’s Process for Determining Whether to Grant Unescorted Access to Individuals Seeking Access to DOD Installations

Individuals may seek unescorted, escorted, or trusted traveler access to  DOD installations. As previously mentioned, this report focuses on  individuals seeking unescorted access.

Unescorted installation access requires, with limited exceptions,  individuals seeking access to establish their identity, be determined fit for  access, and establish an acceptable purpose for their presence on the  installation. DOD components’ security forces establish the identity of  individuals at authorized installation control points by using identification  credentials, specifically a DOD-issued common access card or other  credentials listed in DOD guidance. DOD’s Identity Matching Engine for  Security and Analysis (IMESA), which is maintained by the Under  Secretary of Defense for Personnel and Readiness, helps security forces  make current fitness-for-access determinations for installations that have  PACS that connect to IMESA. IMESA electronically links PACS to federal government (including DOD’s) and local population databases to  verify information contained in individuals’ credentials and to search for  derogatory information. IMESA continuously vets individuals for fitness- for-access determinations against these authoritative government  databases every 24 hours. If derogatory information is found, IMESA is  to send an alert to the PACS so that security forces can take appropriate  action if and when those individuals next seek access to installations.

Individuals without a common access card or another acceptable  credential who seek access to installations with PACS are sent through  the installations’ visitor control process where security forces are to (1)  authenticate the individuals’ identity, (2) establish an acceptable purpose  for their presence on the installations, and (3) make fitness-for-access  determinations using any derogatory information from authoritative  government databases. These databases could include those accessible  through IMESA, where available and as applicable. Figure 1 illustrates  the process for gaining unescorted access to installations with PACS that  connect to IMESA—both for individuals with and without acceptable  credentials.

Types of PACS That DOD Components Have Fielded and IMESA’s Capabilities

DOD components have fielded the following types of PACS at their  domestic installations:

DBIDS. DMDC developed DBIDS and it is used by the Air Force, the  Navy, the Marine Corps, and DLA to control access to their respective  installations. DBIDS consists of hardware and software—specifically,  computers, servers, badge printers, and handheld identification  devices. DBIDS has the capability to electronically connect to  authoritative government databases using IMESA.

AIE. The Army developed AIE to control access to its installations.

AIE consists of hardware and software—specifically, computers,  servers, badge printers, and handheld identification devices. AIE also  includes additional hardware such as gate arms and automated  pedestals where individuals can scan their own credentials. AIE has  the capability to electronically connect to authoritative government  databases using IMESA.

RAPIDGate. RAPIDGate is a legacy system that according to DMDC  officials is no longer being fielded to DOD installations and, according  to Army officials, as of October 2018 was in use at only four domestic  Army installations. RAPIDGate does not have the capability to  electronically connect to authoritative government databases.

Deployed by DOD in 2014, IMESA verifies enrolled individuals’  information against (1) DOD’s Defense Enrollment Eligibility Reporting  System to determine if the credentials have been revoked; (2) the Federal  Bureau of Investigation’s National Crime Information Center’s Wanted  Persons file to determine if there are records on the individuals for an  outstanding felony warrant; (3) the Federal Bureau of Investigation’s  Terrorist Screening Database to determine if the individuals are known or  suspected terrorists; and (4) the local population database, according to  an OUSD(I) official, to determine if credentials issued by installations  have been revoked or have expired. Individuals with enrollable  credentials are enrolled in IMESA when their credentials are scanned by  PACS for the first time. According to DMDC officials, once individuals are  enrolled, IMESA continuously vets them against these authoritative  government databases every 24 hours and it takes approximately 2  seconds for each individual’s credential to be vetted through IMESA.  Figure 2 illustrates the process of using PACS to electronically connect to  IMESA to validate individuals’ identity and continuously vet individuals’  fitness for access to DOD installations.

Roles and Responsibilities Related to Physical Access Controls

The Under Secretary of Defense for Intelligence is responsible for  establishing department-wide physical access control standards,  procedures, and guidance, consistent with DOD guidance and applicable  laws, to include developing processes for establishing the identity of  individuals seeking access to installations. The Under Secretary of  Defense for Personnel and Readiness is responsible for designing and  maintaining IMESA, and establishing and executing a plan to integrate  IMESA with PACS at all DOD installations. DMDC is a center within the  Office of the Under Secretary of Defense for Personnel and Readiness  that provides identity management services and oversees the fielding and  maintenance of DBIDS. DOD components issue their own component-  and installation-specific requirements for physical access control. These  include physical access barrier requirements such as fences, as well as  the use of PACS.

Each DOD component has designated a program manager to supervise  and oversee its physical security program, to include PACS. According to  DOD component guidance and officials:

The Army Acquisition Corps, Product Manager for Force Protection  Systems, is responsible for the procurement and fielding for the  Army’s PACS. The Army Office of the Provost Marshal General  develops PACS requirements based on DOD and Army policies for  the Army’s physical security program.

The Commander Navy Installations Command is responsible for the  Navy’s PACS.

The Air Force Security Forces Center is responsible for the Air  Force’s PACS. The Office of the Deputy Chief of Staff for Logistics,  Engineering, and Force Protection, Directorate of Security Forces, is  responsible for developing service-wide access control policies.

The Commander, Marine Corps Installations Command, is  responsible for the Marine Corps’ PACS. The Deputy Commandant,  Plans, Policies, and Operations establishes policies, sets  requirements, and is responsible for the Marine Corps’ Physical  Security Program.

DLA Information Operations and Installation Support Security and  Emergency Services Staff Directors share responsibility for the DLA’s  PACS.

Additionally, DOD component installation commanders are responsible  for the physical security of their installations, including for the use of  PACS.

DOD Has Issued Guidance on Physical Security, Fielded or Planned to Field PACS, and Identified Future Enhancements DOD Has Recently Issued Department-wide Guidance for Controlling Installation Physical Access, and Fielded or Planned to Field PACS at All Domestic Installations

OUSD(I) issued a physical security manual in January 2019 that  addresses minimum department-wide standards for access to DOD  installations. The manual incorporates and cancels Directive-Type  Memorandum 09-012, the interim policy for DOD physical access control  that was in effect for about 9 years. The manual directs DOD  components to, among other things, implement procedures for all  populations to gain access to component installations; field electronic  PACS at all DOD installations; and fund the continued operation,  maintenance, and enhancement of IMESA with additional government  data sources. The manual also states that new electronic PACS and  existing electronic PACS undergoing significant upgrades (valued at more  than 50 percent of replacement cost) must interface with IMESA.

Each DOD component had also issued guidance on installation physical  access control standards that pre-date the January 2019 physical security  manual. For example, DLA Manual 5200.08 Volume 1 identifies DBIDS  as DLA’s PACS and requires certain installation commanders to  incorporate and maximize the use of electronic credential authentication.  In another example, Army Regulation 190-13 assigns installation  commanders responsibility for implementing AIE, when available, and  states that deviations from the Army AIE standards and specifications are  not authorized without written approval from Army headquarters. DOD  component officials said that they will update their guidance to  incorporate the DOD installation access control standards contained in  OUSD(I)’s 2019 physical security manual.

To implement these department-wide access control standards,  according to OUSD(I) and DOD component officials, each DOD  component has fielded or plans to field PACS that connect to IMESA at  all their domestic installations. According to DOD component officials,  as of February 2019, the Air Force, the Navy, the Marine Corps, and DLA  have fielded DBIDS at all of their domestic installations. Specifically,  according to DOD component officials, DBIDS is fielded at:

16 Marine Corps installations  According to Army officials, as of February 2019, AIE was fielded at 35 of  the Army’s domestic installations. The officials stated that the Army currently plans to field AIE at an additional 60 installations by September  2019, and at all of its remaining domestic installations by the end of fiscal  year 2021. However, Army officials told us that, at the direction of the  Secretary of the Army, AIE is undergoing additional testing and  assessment to inform a comparison with DBIDS. The Secretary of the  Army is expected to make a decision sometime in summer 2019 on which  PACS to field at remaining Army installations.

DMDC Has Identified Future Enhancements to IMESA and DBIDS, and the Army Has Identified Future Enhancements to AIE

DMDC plans to enhance IMESA’s capabilities to allow for increased  information sharing and vetting, and to expand the type of credentials that  DBIDS can scan. Specifically, the Under Secretary of Defense for  Intelligence has identified additional authoritative government databases  that IMESA will connect with to access derogatory information. For  example, the Under Secretary of Defense for Intelligence directed the  secretaries of the military departments to develop a plan to vet individuals  seeking unescorted access to domestic installations for disqualifying  derogatory information in additional files within the National Crime  Information Center’s database and the Interstate Identification Index by  September 30, 2019. According to an OUSD(I) official, IMESA will be  able to access two additional National Crime Information Center files by  2020: the National Sexual Offender Registry File and the Violent Persons  File. The official also stated that there are plans to connect IMESA to  DOD’s Automated Biometric Identification System by 2020.

DMDC plans to expand the types of credentials that DBIDS can scan, to  include all credentials listed in DOD’s 2019 physical security manual.

For example, according to DMDC officials, scheduled enhancements to  DBIDS will enable security forces to scan cards and driver’s licenses  compliant with the REAL ID Act of 2005 by the end of fiscal year 2019.  Moreover, according to DMDC officials, this enhancement will eliminate  the time and expense to annually issue and print hundreds of thousands  of temporary DBIDS credentials. The officials also stated that DMDC has  plans to enable DBIDS handheld devices to read military veterans’ health  identification cards, although no time frame for implementation has been  set.

Army Office of the Provost Marshal General officials told us that AIE can  already scan identification cards and driver’s licenses compliant with the  REAL ID Act. This capability allows individuals with these credentials to  be vetted and enrolled in IMESA in the access control lane without having  to go the visitor control center. According to Army officials, this “in-lane”  initial vetting and IMESA enrollment takes approximately 30 seconds by  checking the National Crime Information Center database and Interstate  Identification Index for criminal history and active warrants. Further, these  officials told us that the Army has also identified future enhancements to  AIE, such as transitioning to a cloud-based version. The officials told us  that a cloud-based version of AIE will allow for quicker and more cost- effective fielding because of fewer installation prerequisites and reduced  computer hardware requirements. Army officials are also considering  other enhancements, such as self-service kiosks and web-based  registration options, to streamline and expedite initial visit registrations.

The Air Force and DLA Have Monitored the Use of PACS, but the Army, the Navy, and the Marine Corps Have Not

The Air Force and DLA monitor their installations’ use of PACS and the  Army, the Navy, and the Marine Corps do not. As a part of our work, we  conducted numerous site visits to domestic installations to observe the  DOD components’ use of PACS, but details concerning our findings  associated with these visits are omitted because the information was  deemed sensitive by DOD. Air Force and DLA officials stated they  routinely collect data on PACS use and the number of credentials  scanned at their installations and provide those data to their leadership.  Additionally, the Air Force is using these data to brief installation  commanders on the risks associated with not using DBIDS at their  installations. Army, Navy and Marine Corps officials stated they do not  monitor PACS use at their installations because there is not a  requirement to do so. Our review of DOD guidance also found no such  requirement.

DOD component officials emphasized the importance of installation  commanders having discretion to make risk-based decisions regarding  access control in general, and in deciding when or when not to use  PACS. Nevertheless, OUSD(I), Army, Navy, and Marine Corps officials  agreed that monitoring installations’ use of PACS would be beneficial and  could be readily accomplished without significant cost using existing  technology. For example, Army, Navy, and Marine Corps officials stated  that their installations could collect monthly scanning data using existing  PACS reporting mechanisms to identify below average use and  determine if actions are needed to increase use. One OUSD(I) official  further stated that, depending on the extent to which installations are not  using PACS, changes to guidance might be warranted to require  monitoring of the use of PACS.

DOD Instruction 5010.40, Managers’ Internal Control Program  Procedures directs the Office of the Secretary of Defense and DOD  component heads to implement a comprehensive system of internal  controls that provides reasonable assurance that programs are operating  as intended and to periodically evaluate the effectiveness of those  controls. Furthermore, Standards for Internal Control in the Federal  Government for performing monitoring activities states that management  should monitor and evaluate the results of its internal control systems by  obtaining relevant data on a timely basis, and determine appropriate  control actions for any identified deficiencies.

Because the Army, the Navy, and the Marine Corps do not monitor the  use of PACS and because OUSD(I) does not require that they do so,  those military services do not know the extent to which PACS are being  used at more than 100 installations. Consequently, the military services  do not have the data they need to evaluate the effectiveness of PACS  and inform risk-based decisions to safeguard personnel and mission– critical, high-value installation assets.

Demonstrating the importance of using PACS that connect to IMESA, we  note that, according to DMDC, IMESA has identified more than 42,000  instances of individuals who were granted access to a DOD installation  and were subsequently issued a felony warrant.

DMDC and the Army Have Approaches for Resolving PACS Technical Issues, but DMDC Has Not Assessed the Performance of Its Approach While the Army Has DMDC and the Army Have Approaches and Helpdesks for Resolving PACS Technical Issues

Installation security forces call the DMDC helpdesk for assistance in  resolving DBIDS technical issues. According to DMDC officials, this  helpdesk handles technical issues for more than 100 DMDC applications  and programs, including DBIDS, and is staffed 24 hours a day, 7 days a  week. DMDC helpdesk staff classify DBIDS technical issues into one of  three tiers, based on complexity and the estimated time to resolve an  issue. According to DMDC officials, tier I issues tend to be the least  complex and typically take the least time to resolve, whereas tier III  issues tend to be the most complex and typically take the longest time to  resolve. Tier II issues fall between tier I and tier III issues with respect to  complexity and anticipated resolution time. Below are examples of issues  that are experienced in each tier:

Tier I. Unresponsive computer screens, passwords that need to be  reset, and relatively simple network printer issues.

Tier II. Handheld device battery charging issues, network  synchronization issues, and problems installing fingerprint readers.

Tier III. Handheld devices not connecting to servers, locked user  accounts, and equipment that needs to be replaced.

According to DMDC officials, all calls to the helpdesk are initially handled  by a tier I customer service representative. The tier I representative  triages the issue using DBIDS reference materials, and if he or she is  unable to resolve the issue it is passed to a tier II customer service  representative. If the tier II representative is unable to resolve the issue  using DBIDS reference materials, then, with a supervisor’s review and  approval, the call is transferred to the tier III group. The issue is then  assigned to either the tier III hardware group or the tier III  software/application group, depending on the nature of the technical  issue. According to DMDC officials, the tier III hardware group is located  in Ashburn, Virginia, and the tier III software/application group is located  at DMDC’s offices in Seaside, California.

The Army also has instituted a tiered approach for resolving AIE technical  issues through its helpdesk. The AIE helpdesk is also staffed 24 hours a  day, 7 days a week. Similar to DBIDS, the Army classifies AIE technical  issues into one of three tiers, based on complexity and time to resolve.  According to Army officials, all Army installation security forces’ calls to  the helpdesk are initially handled by a tier I customer service  representative who tries to resolve the issue using AIE reference  materials. If the tier I representative is unable to resolve the issue, the  issue is passed to a tier II field service representative. The field service  representative is expected to contact the installation within 24 hours and  attempt to resolve the issue by email or phone. If the field service  representative is unable to resolve the issue remotely, the representative  will make an in-person service visit to attempt to resolve the issue. If the  issue cannot be resolved, then the customer service representative  classifies the issue as tier III and transfers the issue to AIE system  engineers for resolution. According to Army officials, tier III issues are  usually Army-wide issues, such as problems associated with software  updates.

DMDC Has Not Assessed the Performance of Its DBIDS Helpdesk but the Army Has Developed Performance Measures and Goals to Assess AIE’s Performance

DMDC has collected data on DBIDS technical issues; however, DMDC  has not been able to assess its performance due to a lack of performance  measures and associated goals. Table 1 shows the number of DBIDS  technical issues and the average time it took to resolve them, by tier, from  January 2016 through July 2018. Specific details regarding the number of  issues and the resolution time were omitted because the information was  deemed sensitive by DOD.

The Army collects data on AIE technical issues and has developed  performance measures and associated goals to assess AIE performance.  Specifically, the AIE Reliability Analytics Model tracks real-time  information on operational availability with a goal of 100 percent, the  number and age of open helpdesk tickets with a goal of resolving tier II  issues within 48 hours, and field service representative performance with  a goal of a 100 percent closure rate for tier II issues. According to Army  officials, the Army is currently developing specific targets for its tier I and  tier III technical issues.

The Army has used data on AIE technical issues to improve AIE  performance. For example, due to the age and number of tickets, the  Army analyzed 646 AIE helpdesk tickets generated from October 2017  through February 2018 and determined that the root causes of the most  prevalent technical issues were site server and handheld device failures.  As a result of its analysis, the Army implemented an AIE software update  and has begun fielding a more reliable brand of handheld device to  installation security forces. According to Army officials, AIE operational  availability has increased and technical issues are resolved more quickly  since the AIE Reliability Analytics Model came online in September 2017.  For example, from September 2017 through August 2018, AIE’s  operational availability increased from 93 percent to 98 percent and the  average ticket age for all tiers decreased by 33 percent. Increased AIE  operational availability allows for increased continuous vetting of  individuals seeking access to Army installations. Army officials at all  levels have access to the model, and the Army Product Manager for  Force Protection Systems sends weekly emails to Army leadership  highlighting AIE performance achievements and challenges.

We have previously reported, that by tracking performance and  developing performance measures, agencies can better evaluate whether  they are making progress and achieving their goals. Further, to fully  address challenges agencies must be able to demonstrate progress  achieved through corrective actions, which is possible through the  reporting of performance measures. Characteristics of effective  performance measures include having baseline or trend data, setting  measurable program goals, and establishing time frames for achieving  goals. Program goals communicate what results the agency seeks and  allow agencies to assess or demonstrate the degree to which those  desired results are achieved. Both performance measures and goals give  managers crucial information to identify gaps in program performance  and plan any needed improvements.

Although user agreements between DMDC and the DOD components  state that DMDC will provide helpdesk and maintenance support, the  agreements do not include performance measures and associated goals  regarding DBIDS’ operational availability and the timely resolution of  technical issues. DMDC officials acknowledged that performance  measures and associated goals would likely reduce the time it takes to  resolve DBIDS technical issues, particularly for tier II and tier III issues.  However, until DMDC develops performance measures and goals, its  ability to systematically address the underlying issues negatively affecting  DBIDS’ operational availability is hindered.

Although according to DOD officials DOD has fielded or plans to field  PACS that connect to IMESA at all domestic installations, only the Air  Force and DLA have monitored PACS use at their installations. The  Army, the Navy, and the Marine Corps at more than 100 installations  have not monitored the use of PACs because, as stated by officials, there  is not a requirement to do so. As a result, these components do not have  the data necessary to evaluate PACS effectiveness and inform risk-based  decisions regarding PACS use to safeguard personnel and mission- critical, high-value installation assets. Further, DOD component and  installation officials told us about their dissatisfaction with the time it takes  to resolve DBIDS’ technical issues. Although the Army has developed  performance measures and associated goals for its helpdesk that have  improved the ability to resolve technical issues and overall AIE  operational availability, DMDC has not. Without such performance  measures and associated goals, DMDC is unable to systematically  evaluate how well DBIDS is performing and address underlying issues  negatively affecting DBIDS’ operational availability.

We are making the following five recommendations to the Department of  Defense:  The Secretary of Defense should ensure that the Under Secretary of  Defense for Intelligence requires that DOD components (including the  military departments and DLA) monitor the use of PACS at their  installations. (Recommendation 1)

The Secretary of the Army should ensure that the Office of Provost  Marshal General monitors the use of PACS at Army installations.  (Recommendation 2)

The Secretary of the Navy should ensure that the Commander, Navy  Installations Command, monitors the use of PACS at Navy installations.  (Recommendation 3)

The Secretary of the Navy, in coordination with the Commandant of the  Marine Corps, should ensure that the Commander, Marine Corps  Installations Command, monitors the use of PACS at Marine Corps  installations. (Recommendation 4)

The Secretary of Defense should ensure that the Under Secretary of  Defense for Personnel and Readiness develops appropriate performance  measures and associated goals for the timely resolution of DBIDS  technical issues to facilitate improved PACS performance.  (Recommendation 5)

We provided a draft of this report to DOD for comment. In its written  comments, reproduced in appendix II, DOD concurred with our five  recommendations and identified actions that it was taking or planned to  take to implement our recommendations. Regarding our second  recommendation, DOD concurred with that recommendation to monitor  the use of PACS at Army installations, and on the basis of the  department’s written comments we modified the recommendation to  indicate that the Army Office of the Provost Marshal General is  responsible for monitoring the use of PACS at Army installations. DOD  also provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Defense, and the Under Secretary of  Defense for Intelligence. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-9627 or maurerd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

In this report we (1) describe actions the Department of Defense (DOD)  has taken to develop guidance on physical access to domestic  installations and to field physical access control systems (PACS) at these  installations, (2) evaluate the extent to which DOD components have  monitored the use of fielded PACS at these installations, and (3) evaluate  the extent to which DOD has implemented an approach for addressing  PACS technical issues and assessing associated performance.

This report is a public version of a sensitive report that we issued on May  31, 2019. The sensitive report included an objective related to the extent  to which security forces at various DOD domestic installations used  fielded PACS. DOD deemed a significant portion of the information  related to this objective to be sensitive, necessitating protection from  public disclosure. This public report omits information related to our  observations of PACS use at these installations and the risks associated  with not using PACS. As a result of this omission, we updated the  wording of the second objective to focus on DOD components’ efforts to  monitor the use of fielded PACS at installations. Although the second  objective and the information associated with it in this public report is  more limited, we relied on the same methodology to support our findings  and the excluded information does not impact our recommendations. The  first and third objectives in this report are the same as in the sensitive  report and use the same methodology as in the sensitive report. DOD  deemed some of the detailed information presented in conjunction with  the third objective to be sensitive, necessitating protection from public  disclosure. As a result, this public report omits specific details regarding  the technical issues of PACs.

This report focuses on physical access controls at authorized access  control points at DOD’s domestic installations that are owned and  operated by the Army, the Navy, the Air Force, the Marine Corps, and the  Defense Logistics Agency (DLA). We did not consider actions DOD has  taken to prevent unauthorized access to its domestic installations by  means such as tunneling under or climbing over perimeter barriers.

For objective one, we analyzed key Office of the Under Secretary of  Defense for Intelligence (OUSD(I)) and DOD component policies outlining  physical access control requirements. The key guidance documents we  analyzed are listed in table 2.

Additionally, we interviewed officials from OUSD(I), the Joint Staff, each  of the DOD components, and the U.S. Northern Command to discuss the  guidance documents and any efforts to update, revise, or draft new  guidance on the use of installation PACS. We also reviewed DOD  component documentation and interviewed OUSD(I) and DOD  component officials to determine the extent to which PACS was fielded at  domestic installations and to identify ongoing efforts to field PACS at  additional domestic installations. Finally, we interviewed DOD officials to  identify any planned future enhancements to PACS and the Identify  Matching Engine for Security and Analysis (IMESA).

For our second objective, we focused on individuals seeking unescorted  access to DOD domestic installations. We reviewed and analyzed  OUSD(I), DOD component, and installation-specific guidance on the use  and monitoring of PACS. We conducted site visits to six domestic  installations to meet with installation command and security force officials  to discuss their experiences using PACS and to observe their use of  PACS. We then compared the guidance and our observations with  Standards for Internal Control in the Federal Government for monitoring  activities, which states that management should obtain data on a timely  basis so that they can be used for effective monitoring. Although findings  from these six installations are not generalizable to all DOD domestic  installations, they are illustrative of how PACS are used, and more  generally, how installation access is controlled.

In selecting the six installations to visit we considered installation  ownership to ensure that we included an installation from each DOD  component, geographic proximity among installations, and the type of  PACS used by the installation. We also visited an installation where no  PACS was installed. We limited our site selection to active-duty  installations in the continental United States. Based on this methodology  we visited Fort Stewart, Georgia; Moody Air Force Base, Georgia; Naval  Station Mayport, Florida; Marine Corps Support Facility Blount Island,  Florida; Tobyhanna Army Depot, Pennsylvania; and DLA Distribution  Center Susquehanna, Pennsylvania.

For our third objective, we reviewed DOD user agreements to determine  the support agreement terms, requirements, and responsibilities for  addressing PACS technical issues. We analyzed DOD component data  on the number and type of Defense Biometric Identification System  (DBIDS) helpdesk technical issues reported from January 2016 through  July 2018, and compared the data with provisions in the user agreements  that discuss the PACS helpdesk. We also compared the steps the Army  and DMDC have taken or planned to address helpdesk technical issues  with Standards for Internal Control in the Federal Government for  developing performance measures, which states that management  should establish performance measures and indicators. We interviewed  officials from DOD components and the installations we visited to discuss  their experiences with PACS helpdesks, and their views on the  performance and reliability of PACS. We assessed the reliability of the  helpdesk technical issue data by interviewing knowledgeable officials  about the data and by testing the raw data to determine the accuracy of  the summary data provided by DOD. Additionally, we collected and  analyzed the raw data to determine whether calculations were made  correctly. We determined that the data were sufficiently reliable for our  understanding the number and types of PACS technical issues.

To address our three reporting objectives, we met with officials from the  DOD organizations listed in table 3.

We conducted this performance audit from February 2018 to August 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We subsequently worked with  DOD from July 2019 to August 2019 to prepare this public version of the  original sensitive report. This public version was also prepared in  accordance with these standards.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact name above, GAO staff who made key  contributions on this report include Brian Lepore, Director (retired); Jason  Bair, Acting Director; Marc Schwartz, Assistant Director; Shawn Arbogast,  Analyst-in-Charge; Jamilah Moon; Richard Hung; Mae Jones; Amie  Lesser; Serena Lo; Amber Lopez Roberts; and Carter Stevens.

In November 2009, an Army officer shot 45 people at Fort Hood, Texas. Four years later, a Navy contractor shot 16 people at the Navy Yard in Washington, D.C.

DOD increasingly uses physical access control systems to screen people who want to enter military installations. The systems scan credentials and check them against FBI and other government databases. However, we found that DOD didn't know the extent to which its installations were using these systems because the Army, Navy, and Marine Corps have not monitored their use.

We recommended that DOD monitor the use of these systems and resolve technical issues to improve their performance.