Index

·            For Release on Delivery
Expected at 2 p.m., EDT

Thursday,

May 25, 2000

GAO/T-OSI-00-10

security

 

Breaches at Federal Agencies and Airports

 

 

Statement of Robert H. Hast,

Assistant Comptroller General for Investigations

Office of Special Investigations

 


 


 


Testimony

Before the Subcommittee on Crime,
House Committee on the Judiciary

 

United States General Accounting Office

GAO


 

 

 


 

Mr. Chairman and Members of the Subcommittee:

I am pleased to be here today to discuss our findings with respect to the Subcommittee’s request that we investigate the potential security risk to the United States posed by the use of stolen or counterfeit law enforcement badges and credentials. Specifically, you expressed concerns that such badges and credentials are readily available for purchase on the Internet and from other public sources and could be used by criminals, terrorists, and foreign intelligence agents to gain access to secure government buildings and airports.

To address these concerns, you asked us to acquire fictitious law enforcement badges currently available to the public and to create fictitious identification to accompany the badges. You also asked that our special agents, in an undercover capacity, attempt to gain access to secure facilities in such a manner that they could have introduced weapons, explosives, chemical/biological agents, listening devices, or other hazardous material.

 

Scope and Methodology

In conducting our investigation, we collected background information from public sources on various federal government sites in the Washington, D.C., area and other geographical areas. We established a list of potential target locations based upon the sites’ involvement in national security, intelligence, and criminal justice and their symbolic or historic significance. We also included major commercial airports. All sites require screening of visitors. All sites appeared to have magnetometers and x-ray machines at the security checkpoints for screening visitors and valises, e.g., briefcases and baggage.

We visited some of these sites as private citizens, i.e., members of the “general public,” to observe the screening procedures and conduct surveillance from public areas. We set out to determine if some sites employed additional security measures, such as outer-perimeter checkpoints, roving patrols, or countersurveillance teams.

We also developed information about each site based on public source information, the Internet, and pretext telephone calls.

We acquired the counterfeit and/or unauthorized law enforcement badges that you asked us to obtain from public sources. We created multiple counterfeit sets of credentials representing local and federal law enforcement agencies.

In April and May 2000, we performed our undercover work at 19 federal facilities and 2 major commercial airports.

 

Results in Brief

Our undercover agents were 100 percent successful in penetrating 19 federal sites and 2 commercial airports. We were able to enter 18 of the 21 sites on the first attempt. The remaining 3 required a second visit before we were able to penetrate the sites.

At no time during the undercover visits were our agents’ bogus credentials or badges challenged by anyone. At the 21 sites that our undercover agents successfully penetrated, they could have carried in weapons, listening devices, explosives, chemical/biological agents, devices, and/or other such items/materials.

At each visit, our agents carried bogus badges and identification, declared themselves as armed law enforcement officers, and gained entry by avoiding screening. At least one agent always carried a valise.

Sixteen of the sites we visited contained the offices of cabinet secretaries or agency heads. At 15 of these sites, our undercover agents were able to stand immediately outside the suites of the cabinet secretary or agency head. In the 5 instances in which our agents attempted entry into such suites, they were successful. At 15 of the sites, our agents entered a rest room in the vicinity of these offices and could have left a valise containing weapons, explosives, and/or other such items/materials without being detected. Except for one agency, we made no attempt to determine whether any of the cabinet secretaries or agency heads were present at the time we visited their agencies.

At a federal courthouse, our agents were waved through a magnetometer but not screened. A briefcase that one of the agents carried was not checked. The agents were escorted to a gun box room, which they were permitted to enter alone. They were then instructed to lock their weapons, but no one supervised or observed the actual surrender of the agents’ weapons.

At the two airports we visited, our agents used tickets that had been issued in their undercover names for commercial flights. These agents declared themselves as armed law enforcement officers, displayed their spurious badges and identification, and were issued “law enforcement” boarding passes by the airline representative at the ticket counter. Our agents then presented themselves at the security checkpoints and were waved around the magnetometers. Neither the agents nor their valises were screened.

Background

We acquired badges from public sources to use in this case. The badges included a movie prop of a police department badge, which is in similitude to genuine badges. In addition, we acquired a counterfeit federal badge not in similitude to a genuine federal badge and a drug task force badge that is in similitude to a genuine badge.

We created counterfeit law enforcement identification using commercially available software packages or information downloaded from the Internet. We used a standard computer graphics program, an ink-jet color printer, and photographs. After we printed the identifications, we laminated them. The credentials we created bear no likeness to any genuine law enforcement credentials.

 

Sites Penetrated

We penetrated 21 sites—19 federal departments/agencies and 2 commercial airports. (See app. I.) We were successful at each site and our agents’ bogus credentials and badges were not challenged by security. (See app. II.) The sites were selected on the basis of their involvement in national security, intelligence, and criminal justice, and in their symbolic or historic significance. All sites require screening of visitors. All sites appeared to have magnetometers and x-ray machines at the security checkpoints for screening visitors and valises, e.g., briefcases and baggage.

 

How Penetration Was Accomplished

At all but two agencies, our undercover team consisted of two agents. Three agents worked undercover at the other two agencies. In all cases, upon entering the federal facilities, our undercover agents

•       “declared” themselves as law enforcement officers,

•       stated the name of their purported agency,

•       stated that they were armed, and

•       in most cases, displayed both a bogus badge and a bogus credential.

In some cases, only one agent had to show a badge, and the other agent was waved in by a security guard. At least one agent always carried a valise. In all cases, our agents were able to enter the facility by being waved around or through a magnetometer, without their person or valise being screened.

We were able to enter 18 of the 21 sites on the first attempt. The remaining 3 required a second visit before we were able to penetrate the sites.

In all but three sites, escorts were not required and our agents wandered through the buildings without being stopped. At the three sites that required escorts, our undercover agents were permitted to “keep” their declared firearms and carry their unscreened valises. Indeed, at all three of the sites, our agents were able to enter a rest room carrying a valise without the escort. At one of the sites, our agents later separated from their escort and walked through the building for about 15 minutes without being challenged.

At 15 of the 16 locations that contained the offices of cabinet secretaries or agency heads, our agents were able to stand immediately outside the suite of the cabinet secretary or agency head. At the 5 locations at which our agents attempted entry into such suites, they were successful. At 15 sites, our agents entered a rest room in the vicinity of these offices and could have left a valise containing weapons, explosives, and/or other such items/materials without being detected.

In all but two of the agencies we penetrated, the suite numbers of the cabinet head or agency head were listed in public documents.

 

Examples of Sites Penetrated

•       Our agents drove a rented minivan into the courtyard entrance of a department and only one agent showed identification. They and the vehicle were permitted entry without being screened. They parked the van in the courtyard and proceeded to the department head’s office. They entered the office and asked a receptionist whether the head of the department was in and told the receptionist that they were friends of the department head, with whom they had previously worked. They were told that the department head was not in. The agents then requested and received a tour of the agency head’s suite and conference room.

•       Three agents drove a sedan to a site and only the driver showed identification. They were issued a VIP parking pass and parked a few yards from the building entrance. The vehicle was not screened. The agents then walked into the building, avoided the magnetometer, and verbally declared themselves as law enforcement officers. Only one agent showed identification. All three were issued “No Escort Required” visitor passes. Two agents carried valises, which were also not checked. They then proceeded to the hallway outside the Secretary’s office. Two agents briefly entered the Secretary’s suite, before excusing themselves. All three agents were able to enter the Secretary’s conference room and other offices without being challenged.

•       Our agents, one of whom carried a valise, entered a historic site posing as police detective sergeants and were waved past the magnetometer. After a few minutes, they were approached by a uniformed police officer. He said that because they were local police officers, not federal, they would have to check their firearms in a lock box in the basement. Our agents stated that they did not have the time to stay and left the building.

At the two airports we visited, our agents had tickets issued in their undercover names on commercial flights. These agents declared themselves as armed police detective sergeants, displayed their spurious badges and identification, and were issued “law enforcement” boarding passes by the airline representative at the ticket counter. The procedure after checking in at the ticket counter varied at each airport.

•       At one airport, our agents walked unescorted to the airport’s security checkpoint, showed their badges to a contract security guard, and were waved around the magnetometer. A contract guard supervisor was then called to examine the undercover agents’ credentials and law enforcement boarding passes. The agents then “logged” themselves in a book kept behind the security checkpoint. Neither the agents nor their valises were screened and they walked unescorted to their departure gate. At no time were they required to present themselves to an airport police officer.

•       At the second airport, our undercover agents were required to show identification to an airline contract security guard. The airline contract security guard then escorted our undercover agents from the ticket counter to the security checkpoint and called for a local police officer. The contract security guard waited with our agents for about 10 minutes until the police officer arrived.

The police officer then examined our agents’ credentials and escorted them around the magnetometer. Neither the agents nor their valises were screened. They then proceeded unescorted to their departure gate.

 

 

Mr. Chairman, this concludes my prepared statement. We would be happy to answer any questions that you or Members of the Subcommittee may have.

 

Contacts and Acknowledgements

For future contacts regarding this testimony, please contact Patrick Sullivan or Ronald Malfi at (202) 512-6722. Tom Wiley, Woodrow Hunt, Jr., and Bill McDaniel made key contributions to this testimony.

Appendix I

List of Agencies and Airports

Our undercover agents successfully penetrated the following locations and could have carried in weapons, listening devices, explosives, chemical/biological agents, devices, and/or other such items/materials.

Central Intelligence Agency Headquarters

Langley, VA

 

The Pentagon

Arlington, VA

Federal Bureau of Investigation Headquarters

935 Pennsylvania Avenue, NW

Washington, DC

Department of Justice Headquarters

10th and Constitution Avenue, NW

Washington, DC

Department of State Headquarters

2201 C Street, NW

Washington, DC

Department of Energy Headquarters

1000 Independence Avenue, SW

Washington, DC

Immigration and Naturalization Service Headquarters     

425 I Street, NW

Washington, DC

Library of Congress

101 Independence Avenue, SE

Washington, DC

National Archives

700 Pennsylvania Avenue, NW

Washington, DC

Department of Agriculture Headquarters

1400 Independence Avenue, SW

Washington, DC

Department of Education Headquarters

400 Maryland Avenue, SW

Washington, DC

Department of Health and Human Services Headquarters

200 Independence Avenue, SW

Washington, DC

Department of Housing and Urban Development Headquarters

451 7th Street, SW

Washington, DC

Department of Labor Headquarters

200 Constitution Avenue, NW

Washington, DC

Department of Transportation Headquarters

400 7th Street, SW

Washington, DC

Federal Aviation Administration Headquarters

800 Independence Avenue, SW

Washington, DC

Federal Emergency Management Agency Headquarters

500 C Street, SW

Washington, DC

National Aeronautics and Space Administration Headquarters

300 E Street, SW

Washington, DC

U.S. Courthouse and Federal Building

80 North Hughey Avenue

Orlando, FL

Ronald Reagan National Airport

Arlington, VA

Orlando International Airport

Orlando, FL

Appendix II

Summary of Breaches at Federal Agencies and Airports

 

Name of facility

GAO

undercover personnel

Successfully avoided screening

Penetrated to/near suite of cabinet secretary or agency head

Entered suite

Entered rest room near suite

Valises

Personnel

CIA

3

Y

Y

N

N

N

Pentagon

3

Y

Y

Y

Y

Y

FBI

2

Y

Y

Y

N

Y

DOJ

2

Y

Y

Y

Y

Y

State

2

Y

Y

Y

N

Y

Energy

2

Y

Y

Y

N

Y

INS

2

Y

Y

Y

N

Y

Library of Congress

 

2

 

Y

 

Y

 

N/A

 

N/A

 

N/A

Archives

2

Y

Y

N/A

N/A

N/A

USDA

2

Y

Y

Y

N

Y

Education

2

Y

Y

Y

N

Y

HHS

2

Y

Y

Y

Y

Y

HUD

2

Y

Y

Y

N

Y

Labor

2

Y

Y

Y

N

Y

DOT

2

Y

Y

Y

N

Y

FAA

2

Y

Y

Y

Y

Y

FEMA

2

Y

Y

Y

N

Y

NASA

2

Y

Y

Y

Y

Y

US Court House – Orlando

 

2

 

Y

 

Y

 

N/A

 

N/A

 

N/A

National Airport

 

2

 

Y

 

Y

 

N/A

 

N/A

 

N/A

Orlando Airport

 

2

 

Y

 

Y

 

N/A

 

N/A

 

N/A

 

Legend

Y

yes

USDA

Department of Agriculture

N

no

HHS

Department of Health and Human Services

N/A

not applicable

HUD

Department of Housing and Urban Development

CIA

Central Intelligence Agency

DOT

Department of Transportation

FBI

Federal Bureau of Investigation

FAA

Federal Aviation Administration

DOJ

Department of Justice

FEMA

Federal Emergency Management Agency

INS

Immigration and Naturalization Service

NASA

National Aeronautics and Space Administration

 

(600647)

Text Box: Ordering InformationOrders by Internet

For information on how to access GAO reports on the Internet, send an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Text Box: To Report Fraud, Waste, and Abuse in Federal Programs

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)