October 9, 2002
Madame Chairwoman, Senator Kyl, and Members of the Subcommittee on Technology, Terrorism, and Government Information:
I appreciate the opportunity to appear before the Subcommittee on Technology, Terrorism, and Government Information to discuss the Office of the Inspector General's (OIG) recent audit of the Federal Bureau of Investigation's (FBI) counterterrorism program. Our full 131-page audit, which is classified at the "secret" level, was provided last week to the Department of Justice, the FBI, and congressional oversight committees, including this committee. Last week, the OIG also released an unclassified executive summary that highlighted our major findings and recommendations.
Since the September 11, 2001, terrorist attacks, the Attorney General and the Director of the FBI have elevated counterterrorism and the prevention of future attacks against U.S. interests as the top priority of the Department of Justice and the FBI. Consequently, the OIG has undertaken a series of reviews of Department programs and operations that effect counterterrorism issues and national security. The counterterrorism audit that we issued last week, and that I will talk about today, was part of that effort.
Our audit examined certain aspects of the FBI's management of its counterterrorism resources. Specifically, our audit focused on: (1) the FBI's progress toward developing a national-level risk assessment of the terrorist threat to the United States; (2) whether the FBI's strategic planning process provides a sound basis to identify counterterrorism requirements; and (3) the amount of resources dedicated to the FBI's counterterrorism program from 1995 to April 2002. In addition, our review assessed the FBI's management of its training and after-action reporting as they relate to counterterrorism operations.
It is important to note at the outset of my remarks that our audit does not purport to assess all aspects of the FBI's counterterrorism program or how the FBI or other law enforcement and intelligence agencies handled information that may have been related to terrorist activities that resulted in the September 11 attacks. At the request of the FBI Director, the OIG has initiated a separate review that is examining aspects of the FBI's handling of certain intelligence information prior to the September 11 attacks, including allegations regarding the FBI's investigation of suspected terrorist Zacarias Moussaoui, the FBI's handling of information provided by the Phoenix Division about flight schools, and the FBI's handling of other intelligence information.
In sum, the counterterrorism audit that we released last week found that the FBI has not developed a comprehensive written assessment of the risk of a terrorist threat facing the United States despite its statement to Congress in 1999 that it would. We concluded that such an assessment would be useful not only to define the nature, likelihood, and severity of the threat but also to identify intelligence gaps that needed to be addressed. Moreover, we concluded that a comprehensive, written threat and risk assessment would be useful in determining where to allocate attention and resources - both within the FBI and government-wide - on programs and initiatives to combat terrorism.
In addition, the FBI has not yet incorporated into its strategic plan (a document not updated since 1998) a comprehensive assessment of the threat and risk of terrorist attacks.
Our findings should not be interpreted to mean that the FBI has not taken important steps during the past year to improve its counterterrorism program. After the September 11 attacks, the FBI identified as a critical weakness its ability to analyze intelligence and is working to improve its capabilities in this area. In addition, the FBI has reorganized its Counterterrorism Division and has taken other steps to improve its counterterrorism capabilities.
However, we believe that the FBI can and must do more. We are encouraged by the FBI's reaction to our audit findings and recommendations - the FBI called them "constructive guidance" and agreed to implement the recommendations we made. We are hopeful that these corrective actions will assist the Bureau in improving its ability to meet its critical counterterrorism priorities.
I now will summarize the major findings of our audit.
II. THREAT ASSESSMENTS
The FBI has never performed a comprehensive written assessment of the risk of the terrorist threat facing the United States. Such an assessment would be useful not only to define the nature, likelihood, and severity of the threat but also to identify intelligence gaps that need to be addressed. Moreover, we believe that comprehensive threat and risk assessments would be useful in determining where to allocate attention and resources to programs and initiatives to combat terrorism. In response to a September 1999 General Accounting Office (GAO) report, the Department and the FBI agreed that the FBI would conduct a national-level risk assessment of the terrorist threat to the United States.
In March 2001 the FBI said that this assessment, eventually titled "FBI Report on the Terrorist Threat to the United States and a Strategy for Prevention and Response" (Terrorist Threat Report), would address emerging trends, the current threat, the projected threat, FBI initiatives, and future focus. The FBI said the findings in the Terrorist Threat Report would be based on FBI investigations, interagency reporting, public source information, and United States intelligence community publications.
By September 2001, the FBI had developed a draft of a Terrorist Threat Report that described terrorist organizations and State sponsors of terrorism. But this report did not assess the threat and risk of an attack on the United States. In addition, based on our review of the draft report, we concluded that it did not conform to the FBI's assessment guidance, other available guidance on preparing threat and risk assessments, or the FBI's representations as to how it would respond to the GAO's recommendations. Among the report's many omissions were assessments of the training, skill level, resources, sophistication, specific capabilities, intent, likelihood of attack, and potential targets of terrorist groups. Further, the draft report did not discuss the methods that terrorists might use. For example, there was no analysis of terrorists' progress toward developing or acquiring chemical, biological, radiological, and nuclear weapons or any discussion of what the FBI has learned from its past terrorist investigations.
Moreover, contrary to available guidance on conducting threat and risk assessments and the FBI's representations to the GAO and the Congress, the FBI's Terrorist Threat Report did not: (1) provide information to assist FBI management and other government managers in developing counterterrorism strategies and programs and allocating resources on a priority basis; (2) identify critical intelligence requirements; or (3) make recommendations to any level of FBI management. The lack of recommendations in the Terrorist Threat Report underscores the fact that the report was, as one FBI Assistant Director described, "a primer, and not a risk assessment."
We identified a number of causes for the Terrorist Threat Report not adequately addressing these issues. First, the report was the responsibility of at least two different FBI managers and an unknown number of staff, but no single individual was accountable for managing the assessment throughout the process or for maintaining the original reporting objectives. Second, some FBI officials said the FBI lacked the analytical capability or resources to complete such a broad threat assessment. Third, the FBI did not have a system of management controls that ensured compliance with GAO (or OIG) recommendations. Finally, in our judgment, FBI counterterrorism managers had a tendency to rely on their experience and professional judgment regarding the overall terrorist threat and did not value a formal written assessment that uses a structured methodology. In fact, the Terrorist Threat project had such a low profile within the FBI that it took the FBI nearly a month to identify to us anyone who was familiar with the project and the draft report.
Because the FBI has not completed a systematic written assessment of the most likely terrorism scenarios - taking into account terrorist methods, capabilities, and intent - it may not have identified fully the specific nature of the threat so that it could focus its attention and resources to prepare adequately and respond effectively given the assessed risk. A comprehensive national-level written assessment of the threats and risk of terrorism also would aid the FBI Director's objective of moving the FBI from a reactive, crime investigation culture to a more proactive institution that seeks to prevent, deter, and disrupt terrorist acts. Determining what scenarios are most likely to occur in a comprehensive and more formal manner would better position the FBI to meet its new counterterrorism priority.
In addition, any national-level assessment of the terrorist threat would be incomplete without incorporating an assessment of the potential for, and likelihood of, an attack using chemical, biological, radiological, and nuclear materials or weapons. However, the FBI has not performed a full assessment of the threat and risk of a terrorist attack with chemical and biological materials (or with other weapons of mass destruction), despite its representations that it would.
In response to the GAO report, the FBI's Assistant Director, Office of Public and Congressional Affairs, had reported to the Chairman of the House Appropriations Committee in a March 2000 letter that the FBI:
? supported the GAO's September 1999 recommendation for a formal, authoritative intelligence threat assessment;
? concurred that the assessment process must involve a multidisciplinary team of subject-matter experts;
? viewed the assessment as the first step in providing a guide for future program investment for WMD [weapons of mass destruction] countermeasures;
? would determine the specific WMD hazards chosen for evaluation by analyzing intelligence sources, case histories, related assessment data from the scientific and health communities, and current trends in domestic and foreign WMD terrorist activities;
? would develop and rank a list of chemical and biological agents based on the likelihood that a particular agent would be used over another;
? would develop scenarios for the highest threat hazards so that this information may be utilized to determine deficiencies in response capabilities at the national level; and
? agreed that such an assessment would require updating at least every three years.
However, the approach the FBI actually used was, in our view, unresponsive to the GAO recommendation. Further, the FBI failed to follow through on its promise that it would render a formal, authoritative intelligence threat assessment using a multidisciplinary team of experts that specifically assesses the chemical and biological agents that more likely would be used by terrorists domestically.
Instead of performing its own intelligence threat assessment, the FBI joined in an ongoing contractor assessment funded by the National Institute of Justice (NIJ). The NIJ-funded study had different objectives than the FBI's promised assessment and was never designed to meet the FBI's assessment objectives in response to the GAO recommendation; the FBI's more general need to determine which WMD agents to focus its attention and resources; the FBI's responsibility to provide guidance to others as the federal domestic intelligence agency and the lead federal agency for crisis management and response in the event of a terrorist WMD attack; and the need for input to a broader national-level threat and risk assessment that could be used by the FBI and other federal, state, and local agencies to determine and prioritize programs to combat terrorism and focus WMD preparedness efforts.
Rather, the NIJ-funded study was intended to "assist the NIJ and State and local law enforcement in addressing needs for (a) improved means for detecting nuclear, biological and chemical (NBC) hazards and (b) better NBC protective gear." Further, the NIJ-funded study noted that "...classified materials of any sort were not examined nor considered." The draft report of the NIJ-funded study, which explicitly excluded any consideration of intelligence information, did not assess the threat and risk that either foreign-based or domestic terrorists will use a given chemical or biological agent (or even improvised radiological or nuclear devices) in the United States to create mass casualties.
Consequently, we concluded that the NIJ-funded study is of limited use in meeting the fundamental strategic planning needs - including program and intelligence requirements determination, priorities, and resource allocation - of the FBI or other federal, state, and local agencies involved in developing countermeasure strategies and domestic preparedness efforts. In our judgment, only a team consisting of subject matter experts could provide an adequately comprehensive assessment of all relevant factors in potential terrorist use of chemical or biological agents or other WMD. Because the NIJ-funded study did not contain intelligence input, the study is not useful to the FBI for assessing risk (although this is not intended as a criticism of the study for use in meeting its intended purpose). The need remains for an authoritative assessment of what chemical and biological agents, as well as radiological and nuclear devices, are more likely to be used by terrorists against targets in the United States.
Our audit also analyzed the FBI's efforts to identify the nation's critical infrastructure. Protecting critical physical infrastructure assets is an important part of the FBI's counterterrorism program. In an effort to identify and better protect critical infrastructure, the FBI began a Key Asset Program in the 1980s. The program developed slowly, and in 1998 the FBI sought to re-emphasize the effort, now renamed the Key Asset Initiative. However, the FBI's attempt to create a nationwide database of key assets has encountered difficulties. For example, the FBI inconsistently classified the priority of assets and it lacks an adequate database management system to compile and categorize voluminous data on key assets nationwide.
III. STRATEGIC PLANNING
Our audit reviewed the FBI's strategic planning as it relates to its counterterrorism mission. The FBI has developed an elaborate, multi-layered strategic planning system over the past decade. Yet, while the planning system acknowledged a general terrorist threat to the nation, the FBI did not perform and incorporate into its strategic plan a comprehensive assessment of the threat and risk of terrorist attacks on U.S. soil. Similarly, the planning system identified numerous vulnerabilities and weaknesses in the FBI's capabilities to deal with the general terrorist threat, but before September 11 this identification did not result in fundamental changes in the FBI necessary to correct the deficiencies.
The FBI planning system consists of Annual Field Office Reports, which serve as the 56 FBI field offices' strategic plans and identify their counterterrorism program vulnerabilities; FBI division-level Program Plans, which incorporate the results of the field office plans and accompany the annual budget submissions; the Counterterrorism Division's Director's Report to articulate the division's goals; and the FBI Strategic Plan. Since at least 1993, these layers of planning have not been guided by an overall strategic-level assessment of the threat and risk of terrorist attacks on the United States but, rather, by judgments at each level about the general nature of the terrorist threat. Further, the FBI's Strategic Plan has not been updated since 1998 and does not conform to the counterterrorism priorities in the Department's November 2001 Strategic Plan, the FBI Director's new priorities, or the Counterterrorism Division's approach to develop the maximum capacity to deal with the terrorist threat.
After September 11, the FBI Director refocused the FBI's traditional crime-fighting orientation of investigating criminal acts after-the-fact for prosecution to place the highest priority on preventing terrorism. The Director also shifted resources to meet this new priority. However, we concluded that the FBI's strategic planning process lacks management controls to ensure that resources will be requested and allocated consistent with the Director's and the Attorney General's counterterrorism priority, particularly at the field office level. For example, during our audit period foreign language translation requests did not always receive priority over drug-related translation requests. Also, the FBI lacks an effective system of performance measures and standards that holds managers at all levels accountable for achieving the goals and objectives stated in FBI strategic plans. If the new strategic focus on counterterrorism is to be achieved, the existing gap between the formal planning process and actual operations must be narrowed.
Further, we found the FBI had made slow progress in completing its assigned tasks under the 1998 Attorney General's Five-Year Interagency Counterterrorism and Technology Crime Plan. In addition, the FBI has not issued a policy on or developed a system for capturing, disseminating, and using lessons learned from past terrorism incidents, operations, and exercises to improve the FBI's counterterrorism capabilities.
Our report also details the level of resources that the FBI has dedicated to counterterrorism and related counterintelligence between 1995 and 2002. While the exact figures are classified and redacted from our public report's Executive Summary, I can say that those resources have increased dramatically - about threefold - between 1995 and 2002. With the exception of 1996, appropriations for FBI counterterrorism and counterintelligence have increased each year.
Our classified report examines the number of FBI staff dedicated to counterterrorism in the 7-year period from 1995 to 2002. The staffing numbers include headquarters staff of the Counterterrorism Division, counterterrorism squads in the 56 FBI field offices, and support staff both at headquarters and in the field. Our report also includes FBI projections of the size of growth of its counterterrorism staffing in 2003, both in agents and support staff.
Finally, we found that the FBI has not established a core training curriculum and proficiency standards for these new agents working in counterterrorism. Moreover, we found that the type and extent of counterterrorism-related training varies throughout the FBI.
Our audit report offers 14 recommendations to help improve management of the FBI's counterterrorism program, including recommendations that the FBI:
? prepare an authoritative written national-level threat and risk assessment of terrorism with a predictive and strategic view, including the potential use of weapons of mass destruction;
? identify the chemical and biological agents most likely to be used in a terrorist attack and assess fully the threat and risk of terrorists' use of all types of weapons of mass destruction;
? develop criteria for evaluating and prioritizing incoming threat information for analysis, and establish a protocol to guide the distribution of threat information;
? establish a time goal and a process for building a corps of professional, trained, and experienced intelligence analysts for assessing and reporting on threats at both the strategic and tactical levels;
? update the FBI strategic planning process to effectively conform to the current Department of Justice strategic plan and the FBI Director's counterterrorism priority;
? close the gap between planning and operations by establishing an effective system of performance measures and standards and holding managers at all levels accountable for achieving the goals and objectives stated in FBI strategic plans;
? issue a policy on and develop a system for capturing and disseminating lessons learned from counterterrorism incidents, operations, and exercises; and
? establish a core training curriculum and minimum competencies for agents assigned to counterterrorism.
The FBI responded that it concurred with our recommendations and stated that the recommendations provide constructive guidance. The FBI also described the steps it is taking to address the recommendations, including agreeing to draft a comprehensive written national threat assessment; updating the FBI's strategic plan; revising the FBI's performance measures to conform with a prevention-driven counterterrorism program; initiating a system of review for the purpose of gaining "lessons learned" from past major investigations; and designing a core training curriculum and minimum competencies for FBI special agents assigned to counterterrorism investigations.
We believe that completing the national-level threat assessment is critical to the FBI's counterterrorism efforts. The assessment must include an evaluation of the likelihood that specific chemical, biological, radiological, and nuclear weapons of mass destruction will be acquired or developed and used against American targets and citizens. Fully assessing the threat, probabilities, and likely consequences of a terrorist attack by different methods will be of significant benefit, not only to the FBI in allocating resources, but also for targeting domestic preparedness efforts and counterterrorism programs at all levels of government.
Furthermore, we believe that implementing our other recommendations will help improve the effectiveness and efficiency of the FBI's counterterrorism program. These improvements will aid the FBI in making the management changes set in motion by the FBI Director to move the Bureau from a reactive, post-crime investigatory culture to a more proactive organization that seeks to identify and deter terrorists before they can strike.
Our findings are not intended to criticize the expertise of FBI employees and managers who work on counterterrorism matters or the extensive knowledge they have developed through their casework and regular discussions within the FBI and the intelligence community. Yet, we believe that the professional judgment of FBI officials is not a substitute for a formal and comprehensive written strategic assessment of the threat and risk of terrorist attacks in the United States. We believe, as did the GAO when it made the recommendation, that a comprehensive written assessment will provide a better mechanism to analyze and assess the threats facing the United States.