Summary

The fiscal year 2005 Department of Homeland Security (DHS) appropriation set aside $25 million, of the $885 million appropriated for the Urban Areas Security Initiative (UASI), for grants to eligible nonprofit organizations that the Secretary of Homeland Security determined to be at high risk of international terrorist attack. This letter responds to the conference report that directed GAO to review the validity of the threat and risk factors used by DHS to allocate discretionary grants to nonprofit organizations in fiscal years 2003, 2004, and 2005. Based on our review of DHS's risk methodology for fiscal year 2006, the criteria in the fiscal year 2005 grant application kit, and conversations with Congressional staff about the conference report, we addressed the following objectives: (1) DHS's methodology for determining risk for urban areas and the nonprofit grant program, and DHS implementation of the program; (2) states' efforts to implement the nonprofit grant program in fiscal year 2005, and (3) whether subgrants were made to nonprofits in fiscal years 2003 and 2004, when funds were not specifically set aside for nonprofits.

To implement the fiscal year 2005 nonprofit grant program, DHS used a two-tiered approach, first determining the urban areas in which nonprofits would be eligible to apply for the funds and then providing guidance to the states on how to allocate the funds to applicants. In the first stage, DHS determined that in the absence of information from federal law enforcement about risk to specific nonprofit organizations, those nonprofits that were located in the highest risk urban areas were most at risk of international terrorist attack. In the second stage of the process, DHS delegated to the states the authority to make subgrants to organizations, but required them to use six risk criteria provided by DHS to determine organizations at high risk of international terrorist attack. These criteria addressed the three elements of risk--threat, vulnerability, and consequences. The criteria did not require actual threats against facilities within the United States. Individual awards were not to exceed $100,000 and were for target hardening only. DHS retained responsibility for managing the grant program and for monitoring the awards it made to the states with the nonprofit funding. The 13 states and the District of Columbia implemented the program using differing approaches. They interpreted the DHS guidance as providing flexibility in implementing the program. They used several approaches in working with their urban areas and required nonprofit applicants to provide varying amounts of risk-related information and organizational capacity information. The threat information provided by the nonprofit applicants varied in specificity and the degree to which it referred to threats from international terrorist groups; none provided reports of threats or attacks by international terrorist organizations against the specific facilities of the nonprofit applicants that were located within the United States. The vulnerability information included some professional assessments. Some applicants claimed proximity to critical infrastructure; others cited the presence of particular individuals as indications of vulnerability. Information on potential consequences generally related to the size of the organization and included number of employees or persons served as indicators of potential consequences. The states and urban areas generally relied on law enforcement to assess threat and vulnerability. Some of the states and urban areas developed formal methods for assessing the nonprofit organizations' risk and capacity to implement the proposed projects. About 400 awards were made, out of 600 applications. Most recipients were religious organizations. Medical and social services were the second and third largest categories. The average amount awarded was about $62,000. State and urban area officials reported a range of views about target hardening for nonprofit organizations. Finally, officials reported that they generally lacked the capacity to conduct the type of vulnerability assessments needed to determine the relative risk to nonprofit organizations within their areas and that in implementing the nonprofit grant program, they needed additional guidance and support from DHS; implementing the program added additional unreimbursable administrative costs; and they varied in the degree to which they could determine that the program reduced the overall risk of terrorist attack to their area. About 18 UASI subgrants were made to nonprofits in fiscal years 2003 and 2004. No funding was set aside specifically for nonprofits in the DHS appropriations for those years. Nonprofits were eligible for subgrants, but many states were unaware that they could make subgrants to nonprofits. The subgrants that were made to nonprofits were generally for citizen preparedness and capability enhancement for emergency response organizations. None were for target hardening.