Summary

Established in March 2002, the Homeland Security Advisory System was designed to disseminate information regarding the risk of terrorist acts to federal, state, and local government agencies and the public. However, this system generated concern among federal, state, and local government agencies regarding whether they are receiving the necessary information to respond appropriately to heightened alerts and about the amount of additional costs protective measures entail. Congress requested that we review (1) the operations of the Homeland Security Advisory System, including the decision making process for changing the national threat level, notifications to federal, state, and local government agencies of changes in the threat level, and ongoing revisions to the system; (2) guidance and information that federal, state, and local government agencies reportedly used to determine any protective measures to implement when the threat level is raised to high--or code-orange--alert; (3) any protective measures these agencies implemented during code-orange alert periods; (4) any additional costs these agencies reported incurring to implement such measures; and (5) any threat advisory systems that federal, state, or local government agencies had in place before the creation of the Homeland Security Advisory System.

Based on analyses of intelligence, the Secretary of Homeland Security, in consultation with members of the Homeland Security Council, determines whether the national threat level should be elevated or lowered. Once the Secretary makes this decision, DHS and others begin the process of notifying federal, state and local government agencies, through various means, such as conference calls. The department has not yet documented its protocols for executing notification. DHS officials told us they are working to develop such documentation. However, they could not provide us with a specific time frame as to when they expect to complete this effort. Federal, state, and local government agencies we met with expressed concern about hearing of threat level changes from media and other sources prior to receiving notification from DHS. DHS officials maintain that the Homeland Security Advisory System is evolving and that they are continually adjusting it to provide additional information regarding specific threats. Various sources, including the Federal Emergency Management Agency (FEMA), provided guidance and information to federal, state, and local government agencies to assist them in developing plans for responding to each of the advisory system's five threat levels following establishment of the system in March 2002. Additionally, DHS and others provided federal, state, and local government agencies with guidance and information to assist them in determining actions to take in response to each codeorange alert occurrence. Federal agencies responding to our questionnaire indicated that they maintain a high security posture and, as a result, did not need to implement a substantial number of additional protective measures to respond to code-orange alerts. For the most part, these 15 federal agencies reported enhancing protective measures they already had in place to respond to the code-orange alerts, such as increasing the frequency of facility security patrols. To a lesser degree, these federal agencies indicated that they continued existing protective measures at their pre-code orange alert levels, such as the use of intrusion detection systems. To ensure that protective measures operate as intended, federal agencies for which we received questionnaire responses reported conducting tests on the functionality and reliability of protective measures. They also reported receiving confirmation of the enhancement or implementation of measures from component entities, offices, or personnel. Thirteen federal agencies, one state, and six localities provided information on the additional costs incurred during at least two of the three orange alert periods in our review. The cost information the federal agencies provided was generally estimates. Some federal, state, and local government agencies we contacted reported that they have threat advisory systems in place to ensure government agencies are notified of impending emergencies such as natural disasters or terrorist threats, allowing them to prepare a response. These systems, which were generally in place before the creation of the Homeland Security Advisory System, are similar to the Homeland Security Advisory System or have been revised to conform to it and include threat levels with associated protective measures. For example, one federal agency told us that it had developed its own five-level alert system 8 years ago to ensure protection of critical national security assets. While federal, state, and local government agencies said they raise or lower their systems' threat levels to correspond to changes in the national threat level, they also independently change threat levels to respond to specific threats or for large public events.