Mail Security: Incidents at DOD Mail Facilities Exposed Problems That Require Further Actions

GAO-06-757 September 15, 2006
Highlights Page (PDF)   Full Report (PDF, 59 pages)   Accessible Text   Recommendations (HTML)

Summary

In March 2005, two well-publicized and nearly simultaneous incidents involving the suspicion of anthrax took place in the Washington, D.C., area. The incidents occurred at Department of Defense (DOD) mail facilities at the Pentagon and at a commercial office complex (Skyline Complex). While these incidents were false alarms, DOD and other federal and local agencies responded. The Postal Service suspended operations at two of its facilities and over a thousand DOD and Postal Service employees were given antibiotics as a precaution against their possible exposure to anthrax. This report describes (1) what occurred at the Pentagon and Skyline Complex mail facilities, (2) the problems we identified in detecting and responding to the incidents, (3) the actions taken by DOD that address the problems that occurred, and (4) the extent to which DOD's actions address the problems.

Events leading up to the Pentagon incident began when a laboratory that tested samples from the Pentagon's mail-screening equipment informed DOD's mail-screening contractor that test results indicated the presence of anthrax in the mail. By the time the contractor notified DOD 3 days later, suspect mail had already been released and distributed throughout the Pentagon. DOD evacuated its mail-screening and remote delivery facilities, notified federal and local agencies, and dispensed antibiotics to hundreds of employees. The Skyline Complex incident began the same day when Fairfax County, Virginia, emergency personnel responded to a 911 call placed by a Skyline employee that an alarm had sounded on a biosafety cabinet used to screen mail. Local responders closed the complex and decontaminated potentially exposed employees, and DOD dispensed antibiotics to the employees. Similarly, the Postal Service suspended operations at two facilities and dispensed antibiotics to its employees. Laboratory testing later indicated that the incidents were false alarms. Analysis of these incidents reveals numerous problems related to the detection and response to anthrax in the mail. At the Pentagon, DOD's mail-screening contractor did not follow key requirements, such as immediately notifying DOD after receiving evidence of contamination. At the Skyline Complex, DOD did not ensure that the complex had a mail security plan or that it had been reviewed, as required. The lack of a plan hampered the response. DOD also did not fully follow the federal framework--including the National Response Plan, which was developed to ensure effective, participatory decision making. Instead of coordinating with other agencies that have the lead in bioterrorism incidents, DOD unilaterally dispensed antibiotics to its employees. DOD has taken numerous actions that address problems related to the two incidents. At the Pentagon, DOD's actions included selecting a new mail-screening contractor and defining the roles and responsibilities of senior leadership, including those involved in making medical decisions. Related to Skyline, DOD prohibited its mail facilities in leased space within the Washington, D.C., area from using biosafety cabinets to screen mail unless the equipment is being operated within the context of a comprehensive mail-screening program. While DOD has made significant progress in addressing the problems that occurred, its actions do not fully resolve the issues. One remaining concern is whether DOD will adhere to the interagency coordination protocols specified in the national plan for future bioterrorism incidents involving the Pentagon. This concern arises because, more than 1 year after the incident, DOD reiterated that it has the authority to make medical decisions without collaborating or consulting with other agencies. DOD also has not ensured, among other things, that its mail facilities (1) have the required mail security plans and (2) are appropriately using biosafety cabinets for screening mail.



Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Implemented" or "Not implemented" based on our follow up work.

Director:
Team:
Phone:
Katherine A. Siggerud
Government Accountability Office: Physical Infrastructure
(202) 512-6570


Recommendations for Executive Action


Recommendation: To help prepare DOD to effectively respond to future incidents involving the suspicion of biological substances in the mail, the Secretary of Defense should ensure that any future medical decisions reached during potential or actual acts of bioterrorism at the Pentagon Reservation result from the participatory decision-making framework specified in the National Response Plan and National Incident Management System.

Agency Affected: Department of Defense

Status: In process

Comments: On March 6, 2007, the Department of Defense (DOD) published an instruction titled "Emergency Management and Incident Command on the Pentagon Facilities." DOD believes that the instruction, which is marked For Official Use Only, complies with the National Response Plan (NRP) and National Incident Management System (NIMS) structure for making medical decisions. The document specifies that the Pentagon Reservation's Public Health Emergency Official will advise the Incident Commander and the senior DOD leadership in making medical treatment decisions. However, the DOD policy remains at odds with the protocols in both the NRP, which requires a coordinated, public health response led by Health and Human Services and NIMS, which prescribes local-level input into those decisions affecting their jurisdictions.

Recommendation: To help prepare DOD to effectively respond to future incidents involving the suspicion of biological substances in the mail, the Secretary of Defense should ensure that appropriate officials at all of DOD's mail facilities develop effective mail security plans in accordance with GSA's mail management regulation and guidance and DOD's mail manual.

Agency Affected: Department of Defense

Status: In process

Comments: The Defense Department (DOD) is requiring its mail facilities to develop mail security plans. In addition, DOD intends to review the mail security plans to ensure they are consistent with both GSA mail regulations and guidance and DOD's mail manual. Specifically, DOD is building a web-based official mail center informational portal to allow each DOD mail center's plan to be posted on the portal, thereby allowing for easy review of the mail security plan. Once the portal has been populated with mail security plans, DOD postal officials will complete the DOD-wide review of all mail security plans. DOD planned to complete the official mail center portal by Oct 2007, but due to technical challenges, the rolling out of the portal has been delayed. DOD will now be using an Army website instead, and this change delayed the building of web-based portal where DOD had hoped to place security plans for review. The Military Postal Service Agency has set a new target date of January 1, 2009, to have a system to post mail center security plans.

Recommendation: To help prepare DOD to effectively respond to future incidents involving the suspicion of biological substances in the mail, the Secretary of Defense should ensure that a competent DOD authority conducts a DOD-wide review of all of its mail security plans.

Agency Affected: Department of Defense

Status: In process

Comments: The Defense Department (DOD) is requiring its mail facilities to develop mail security plans. In addition, DOD intends to review the mail security plans to ensure they are consistent with both GSA mail regulations and guidance and DOD's mail manual. Specifically, DOD is building a web-based official mail center informational portal to allow each DOD mail center's plan to be posted on the portal, thereby allowing for easy review of the mail security plan. Once the portal has been populated with mail security plans, DOD postal officials will complete the DOD-wide review of all mail security plans. DOD planned to complete the official mail center portal by Oct 2007, but due to technical challenges, the rolling out of the portal has been delayed. DOD will now be using an Army website instead, and this change delayed the building of web-based portal where DOD had hoped to place security plans for review. The Military Postal Service Agency has set a new target date of January 1, 2009, to have a system to post mail center security plans.

Recommendation: To help prepare DOD to effectively respond to future incidents involving the suspicion of biological substances in the mail, the Secretary of Defense should determine (1) whether biosafety cabinets are being used at mail facilities within DOD-leased space in the national capital region and, if so, (2) whether the equipment is being operated within the context of a comprehensive mail-screening program. If the use of biosafety cabinets does not comply with the criteria specified in the Director of Administration and Management's January 2006 directive, ensure that the equipment will not be operated.

Agency Affected: Department of Defense

Status: In process

Comments: The Pentagon Force Protection Agency (PFPA) conducts annual vulnerability assessments of DoD leased buildings with 300 or more DoD occupants. A procedural change now includes a review of the tenant's mail screening program to ensure compliance with a January 2006 memo. The memo prohibited DOD mail facilities in leased space within the national capital region from operating equipment used to screen mail, including biosafety cabinets, unless the facility met five specific operating conditions. The PFPA provides one or more subject matter experts, as required, to evaluate the mail receipt and distribution centers, to include sub-centers or nodes. This new process includes an assessment of mail receipt, mail flow, and any screening or evaluation processes utilized at the distribution center and sub-distribution center levels. Any equipment used for mail/package chemical, biological or radiological evaluation (e.g., bio-safety cabinets) is identified and the use, maintenance, and associated concept of operations are evaluated for compliance with the directive published by DA&M. Assessment reports are prepared and provided to the Director of the PFPA.