Reported Injuries to U.S. Personnel in Cuba: State Should Revise Policies to Ensure Appropriate Internal Communication of Relevant Incidents

U.S. diplomats and their families in Havana, Cuba, were affected by incidents that were associated with injuries, including hearing loss and brain damage. Over State has reported that over 20 U.S. diplomats and family members in Havana have suffered from medical conditions believed to be connected to the incidents, which began in late 2016 and have continued into 2017. By law, State is generally required to convene an ARB within 1260 days of incidents that result in serious injury at, or related to, a U.S. mission abroad, but the Secretary of State can determine that a 60 day extension is necessary. According to State's policy, M/PRI is responsible for initiating and leading State's ARB incident vetting process.

This report is part of a broader request to review State's response to the incidents in Cuba. In this report, GAO examines the extent to which State's ARB policy ensures that M/PRI is made aware of incidents that may meet the ARB statute criteria. GAO analyzed relevant federal laws, State policies, and other State documents. GAO also interviewed cognizant State officials.

The Department of State's (State) Accountability Review Board (ARB) policy does not ensure that the responsible office—State's Office of Management Policy, Rightsizing, and Innovation (M/PRI)—is made aware of incidents that may meet the ARB statute criteria, such as those that occurred in Cuba and were associated with injuries to U.S. personnel. According to State policy, as soon as M/PRI becomes aware of potentially qualifying incidents, M/PRI will start the process for considering whether the incident warrants an ARB. M/PRI relies on informal communication to identify potentially qualifying incidents to begin the vetting process because State does not have a policy, procedure, or process for internal communication of such incidents to M/PRI, according to State officials and GAO analysis. As illustrated in the figure below, other State entities began responding to the incidents in early 2017, but M/PRI was not made aware of the incidents until mid-August 2017, when a former M/PRI official contacted the office after seeing media reports. If M/PRI is not aware of incidents, it cannot initiate State's ARB incident vetting process. This situation puts State at risk of not meeting statutory time frames for convening an ARB and could result in State being less able to improve security programs and practices at other U.S. diplomatic posts. Standards for Internal Control in the Federal Government call for internal communication to achieve the entity's objectives and note that management should document responsibilities through policy.

GAO recommends that State revise its policies to define responsibilities for internal communication to M/PRI of relevant incidents. State concurred with GAO’s recommendation.

In late 2016, U.S. government personnel and their families in Havana,  Cuba, began reporting incidents associated with acoustic or sensory  phenomena. These individuals suffered serious injuries, including brain  damage and hearing loss, however the cause of the injury has not been  determined. The Department of State (State) reported that over 20 U.S.  personnel and family members in Havana have suffered from medical  conditions believed to be connected to the incidents. On September 29,  2017, State ordered the departure of non-emergency personnel assigned  to the embassy and their family members to minimize the number of U.S.  diplomats at risk of exposure to harm. In June 2018, the Secretary of  State noted that the precise nature of the injuries and the cause had not  yet been established. State is generally required by law to convene an  Accountability Review Board (ARB) within a specified time period after  the occurrence of an incident that results in serious injury, loss of life, or  significant destruction of property at, or related to, a U.S. mission  abroad. An ARB seeks to determine accountability for such incidents and  promote and encourage improved security programs and practices at  U.S. missions abroad.

As part of a broader request, you asked us to review the process by  which State convened an ARB in response to the incidents in Cuba. This  report examines the extent to which State’s ARB policy ensures that the  Office of Management Policy, Rightsizing, and Innovation (M/PRI) is  made aware of incidents that may meet the ARB statute criteria. To  address our objective, we analyzed relevant federal laws and State  policies, including the Foreign Affairs Manual (FAM) and Foreign Affairs  Handbooks, to understand State’s responsibilities in convening an ARB  and how State’s components are organized and directed to implement the  law. In addition, we analyzed internal State communications—such as  diplomatic cables—and congressional testimony by State officials on  these incidents for information about the timeline of the incidents, State’s  response to the incidents, and when various State entities became aware  of the incidents. We also interviewed cognizant officials in State’s Bureau  of Diplomatic Security (DS); Bureau of Medical Services (MED); Bureau  of Western Hemisphere Affairs (WHA); Office of the Under Secretary of  State for Management; Office of Foreign Missions; M/PRI; and Crisis  Management and Strategy (CMS) in the Executive Secretariat.

We conducted this performance audit from March 2018 to July 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

U.S. Law Requires State to Convene an ARB after Certain Types of Incidents

Federal law generally requires the Secretary of State to convene an ARB  not later than 60 days after the occurrence of an incident that resulted in  serious injury, loss of life, or significant destruction of property at, or  related to, a U.S. mission abroad unless the Secretary determines the  incident clearly involves only causes unrelated to security. This time period can be extended for an additional 60-day period if the Secretary  determines that the additional period is necessary for the convening of  the board. Whenever the Secretary convenes an ARB, the Secretary shall  promptly inform the Chairman of the Committee on Foreign Relations in  the Senate and the Speaker of the House of Representatives. Federal  law specifies that an ARB will consist of five members appointed by the  Secretary of State and one appointed by the Director of National  Intelligence. It also states that the ARB shall submit its findings to the  Secretary of State. According to State’s FAM, the ARB is a mechanism  to foster more effective security of U.S. missions and personnel abroad  by ensuring a thorough and independent review of security-related  incidents. Through its investigations and recommendations, the ARB  seeks to determine accountability and promote and encourage improved  security programs and practices.

M/PRI Is Responsible for Conducting the ARB Incident Vetting Process

M/PRI—the central management analysis organization of State’s Under  Secretary of State for Management—is responsible for initiating and  shepherding the incident vetting process to identify incidents that may  warrant an ARB, according to the FAM. The FAM states that M/PRI will  begin the ARB incident vetting process once M/PRI becomes aware of an  incident abroad that could involve loss of life, injury, or destruction of  property. This process includes consultation with the Office of the Legal  Adviser (Legal), DS, and other offices as appropriate to evaluate whether  the ARB statute criteria apply. If the ARB statute criteria are deemed  applicable or if the applicability is questionable, M/PRI is responsible for  calling a meeting of State’s ARB Permanent Coordinating Committee.  See figure 1 for members of the Permanent Coordinating Committee and  other State offices and bureaus involved in responding to the incidents in  Cuba. If M/PRI decides the ARB statute criteria are not applicable, M/PRI will notify committee members in writing, providing a summary of the  incident and an explanation as to why the criteria do not apply. If any  member disagrees, M/PRI will call a Permanent Coordinating Committee  meeting. According to the FAM, the committee will review the available  facts and recommend to the Secretary of State whether or not to convene  an ARB as quickly as possible after an incident occurs. The Secretary of  State makes the final decision on whether to convene an ARB.

The U.S. Embassy in Havana Is Supported by Several State Entities

WHA, DS, and MED, among other State entities, support the U.S.  Embassy in Havana by providing advice and guidance on policy, security,  and other issues.

WHA. Reporting to the Under Secretary of State for Political Affairs,  WHA oversees the U.S. Embassy in Havana and is responsible for  managing and promoting U.S. interests in the region. Embassy  officials, including senior leadership, report to WHA and its Office of  the Coordinator for Cuban Affairs through diplomatic cables, email,  and phone calls.

DS. Reporting to the Under Secretary of State for Management, DS  oversees security at diplomatic posts and is responsible for providing  a safe and secure environment for the conduct of U.S. foreign policy.  Embassy Regional Security Officers are required to report security  incidents through different systems, including diplomatic cables,  SPOT Reports, or the Security Incident Management Analysis  System, depending on the type of incident. Regional Security Officers  are also in regular contact with DS via phone and email, according to  State officials.

MED. Reporting to the Under Secretary of State for Management,  MED ensures that U.S. government employees and their families who  are assigned to diplomatic posts have access to healthcare and  advises State management about health issues around the world. The  U.S. Embassy in Havana has a medical unit, including U.S. direct-hire  and locally hired staff. MED approves requests to medically evacuate  U.S. personnel and family members from diplomatic posts.

Other State entities. Other State entities provide support to the U.S.  embassy in Havana on specific issues. For example, CMS, within  State’s Executive Secretariat, gathers, assesses, and disseminates  information to State senior management about events that threaten  the security of U.S. missions and their personnel. The Office of  Foreign Missions, which reports to the Under Secretary of State for  Management, seeks fair treatment for U.S. personnel abroad while  ensuring that foreign diplomats based in the United States receive the  same treatment that their respective governments provide to U.S.  personnel abroad in return.

State’s ARB Policy Does Not Ensure that the Office Responsible Is Made Aware of Incidents That May Meet ARB Criteria, Such as Those That Occurred in Cuba

Although M/PRI is responsible for initiating and leading State’s ARB  incident vetting process, State’s ARB policy does not define how M/PRI  should become aware of incidents that may involve injury, loss of life, or  destruction of property. Regarding Cuba, the U.S. embassy and several  State entities responded to incidents that were later associated with  various injuries in early 2017. As of June 2018, State officials remained  uncertain of the cause or perpetrator of the incidents and injuries. M/PRI  officials said they did not know about the incidents in Cuba until August  2017, when the media began to report on the incidents.

State’s ARB Policy Does Not Define How M/PRI Should Become Aware of Incidents That May Involve Injury

Although M/PRI is responsible for initiating and leading the ARB incident  vetting process, State’s polices do not define responsibilities for internal  communication to M/PRI of incidents that may involve injury, loss of life,  or destruction of property. According to the FAM, M/PRI and the  Permanent Coordinating Committee are responsible for evaluating  whether incidents meet the ARB statute criteria. However, M/PRI can only  initiate the process after it is made aware of potentially qualifying  incidents, and the FAM does not outline how M/PRI should be notified of  these types of incidents or which, if any, State entities are responsible for  notifying M/PRI. In contrast, the FAM outlines other specific reporting  responsibilities for Regional Security Officers. According to State  officials and our analysis, State’s FAM and Foreign Affairs Handbooks do  not establish a policy, procedure, or process for internal communication of  such incidents to M/PRI. In 2006, the Under Secretary of State for  Management issued a cable requiring U.S. diplomatic posts to report  potential ARB incidents directly to M/PRI. However, the cable did not  identify who at post was responsible for reporting, and instructed posts to  report to an individual who is no longer in M/PRI. Moreover, State officials  we met with were unaware of the cable.

M/PRI officials said that information about potentially qualifying incidents  is not directed to them through State’s established reporting mechanisms,  such as diplomatic cables. State’s cable system does not have a caption,  channel, or tag that would direct information to M/PRI about incidents that  may involve injury, loss of life, or damage to property. State’s Office of  the Inspector General previously found deficiencies in State’s internal  communication of incidents that may meet ARB criteria. Despite the  2006 cable on potential ARB incident reporting, in 2013, State’s Inspector  General found that State had no systematic process ensuring immediate  notification of security-related incidents to M/PRI, and that DS did not  routinely provide security reports to M/PRI. The Inspector General made  an informal recommendation that DS should include M/PRI as an  addressee on all security-related incident reports. In 2015, the Inspector  General noted that DS, in response to the recommendation, said that  such a blanket inclusion of M/PRI on all security-related incident reports  would result in M/PRI being inundated with a large number of irrelevant  reports.

Because State has no policy that ensures M/PRI becomes aware of  incidents that may involve injury, loss of life, or destruction of property,  M/PRI officials said they typically become aware of potentially qualifying  incidents—such as explosions at diplomatic facilities—when such  incidents are discussed internally and widely publicized. M/PRI officials  also told us they occasionally became aware of potentially qualifying  incidents through informal communication, such as during senior staff  meetings with the Under Secretary of State for Management. If M/PRI  officials are not aware of incidents, they cannot initiate State’s ARB  incident vetting process. This situation puts State at risk of not meeting  statutory time frames for convening an ARB and could result in State  being unable to improve security programs and practices at other U.S.  diplomatic posts, which could affect the response to similar incidents  elsewhere.

Standards for Internal Control in the Federal Government call for internal  communication to achieve the entity’s objectives and note that  management should document responsibilities through policy. The FAM  requires internal controls, which includes as an objective that programs  are efficiently and effectively carried out in accordance with applicable law  and management policy. The FAM also states that the Under Secretary  of State for Management is responsible for, among other things,  developing and executing management policies; the organization,  operations, and assignment of functions within State; and directing and  administering worldwide information resources.

The U.S. Embassy in Havana and Several State Entities Responded to Unexplained Incidents in Cuba Associated with Serious Injury to U.S. Personnel

In January 2017, U.S. embassy and State officials began responding to  incidents in Cuba that were later associated with various injuries. In June  2018, the Secretary of State noted that the precise nature of the injuries  and the cause had not yet been established. According to congressional  testimony by State officials, in late 2016, U.S. personnel in Havana first  reported incidents, typically involving sounds and resulting in various  medical symptoms, to the embassy’s Regional Security Officer and Chief  of Mission. Embassy officials reported the incidents to DS and the  National Security Council as a new type of harassment in early January  2017, according to State documents. The embassy’s Medical Officer first  evaluated a U.S. official related to the incidents on December 30, 2016,  and others in January 2017. Starting in late March 2017, the embassy  held several meetings with U.S. personnel to share the limited information  it had about the incidents, according to State officials. In April 2017, the  embassy held Emergency Action Committee meetings regarding the  incidents.

CMS communicated with State senior management about the incidents  beginning in April 2017. To ensure that State senior management were  aware of how the embassy was responding, CMS distributed among  various State entities, including M/PRI, one of the embassy’s April 2017  diplomatic cables reporting on an Emergency Action Committee  meeting. According to CMS officials, the cable that CMS distributed was  unclear about what incidents had occurred and did not include detailed  information about the incidents or associated injuries. According to M/PRI  officials, M/PRI was on CMS’s distribution list because M/PRI was  responsible for monitoring the implementation of a previous ARB  recommendation that called for State to review embassy risk  management decisions. According to a former M/PRI official, M/PRI did  not review these CMS communications for other purposes, including to  identify incidents that may meet ARB statute criteria. In addition, in April  and May 2017, CMS included multiple cables on the situation in Cuba in  its daily Safety Overseas Summary for State senior management.

In response to the incidents, U.S. embassy and WHA officials met with  Cuban officials to emphasize to the Cuban government its responsibilities  to ensure the safety of foreign diplomats in Cuba, according to testimony  by State officials. In mid-February 2017, U.S. officials met with Cuban  officials in Havana and Washington, D.C., about the incidents, citing the  Vienna Convention requirements to provide for the safety and security of  diplomats, according to State officials. Following additional incidents  reported in March and April 2017, U.S. officials met again with Cuban  officials in Havana and Washington, D.C. In May 2017, State expelled two  Cuban diplomats from the United States to underscore the Cuban  government’s responsibility to protect U.S. personnel in Cuba, according  to testimony by State officials. In September 2017, State ordered the  departure from Cuba of non-emergency U.S. embassy personnel and, in  October, expelled 15 Cuban diplomats from Washington, D.C. to  underscore to Cuba its obligations to protect U.S. personnel, according to  testimony by State officials.

According to State officials, by May 2017, the embassy, WHA, DS, and  MED were aware of 16 U.S. personnel and family members in Havana  who had been injured, although unable to determine the cause. In  January 2018, State’s Medical Director testified to Congress that by May  1, 2017, State had determined that several of those individuals had  serious injuries. Between February and May 2017, a specialist at the  University of Miami evaluated 80 members of the embassy community.  MED arranged for the medical evacuations of about 40 U.S. personnel  from Cuba to Miami, Florida, for evaluations with the specialist, and the  specialist subsequently conducted additional evaluations at the embassy  in Havana. According to State testimony to Congress, the specialist  identified 16 individuals who had symptoms and medically verifiable  clinical findings similar to mild traumatic brain injury. In June 2018, the  Secretary of State noted that the precise nature of the injuries and the  cause had not yet been established.

M/PRI Became Aware of the Incidents in Cuba after Media Reports

M/PRI officials said they became aware of the incidents in Cuba after  media reports in August 2017. According to M/PRI officials, a State  official—who previously worked in M/PRI—contacted M/PRI in early  August after seeing media reports to inquire whether they were aware of  the incidents in Cuba. Although several State entities were aware of the  incidents, WHA, DS, and MED did not report the incidents to M/PRI and it  was unclear whether the incidents met the criteria for convening an ARB,  according to officials. However, our analysis shows that State’s policies  do not instruct State entities to evaluate whether incidents meet the ARB  criteria before reporting such incidents to M/PRI. Instead, State’s FAM  requires M/PRI to lead the process for evaluating incidents that may  involve injury, loss of life, or destruction of property. According to the  FAM, M/PRI will call a Permanent Coordinating Committee meeting if the  ARB statute criteria apply or if the applicability is questionable. The  committee will, as quickly as possible after an incident occurs, review the  available facts and recommend to the Secretary whether to convene an  ARB. M/PRI initiated State’s incident vetting process in August 2017, as  shown in figure 2 below.

As a result of the incidents in Cuba, M/PRI officials told us they realized  that they may not be aware of all incidents that may involve injury to U.S.  diplomats. In an initial attempt to address this concern, M/PRI officials  said they requested that CMS add M/PRI officials to the distribution list for  the Safety Overseas Summary to try to increase M/PRI’s awareness of  potential incidents. CMS told us that it added M/PRI officials to the  distribution list in October 2017.

According to M/PRI officials and a timeline provided by M/PRI, once these  officials became aware of the incidents in August 2017, the office began  the ARB incident vetting process, as described in the FAM. In August  2017, these officials initially consulted with DS and MED about the  incidents. In further discussion with Legal, the officials determined that  they did not have sufficient information to determine whether the incidents  met the ARB statute criteria. Given the uncertainties surrounding the  incidents, in mid-September 2017, they decided to call a meeting of the  Permanent Coordinating Committee, which included representatives from  M/PRI, WHA, DS, MED, Legal, the Bureau of Intelligence and Research,  the Bureau of Counterterrorism, and the Intelligence Community. The  committee initially met on September 28, 2017, to review the available  facts against the ARB statute criteria, and concluded that it needed  additional time to determine whether the ARB statute criteria had been  met. On November 28, 2017, the committee met again and  recommended to the Secretary of State that an ARB be convened. The  Secretary of State concurred with the recommendation on December 11,  2017, and convened the ARB on January 12, 2018. The ARB officially  began its work in early February 2018.

An ARB is intended to result in improved security programs and practices  at U.S. missions abroad. While State has directed M/PRI to initiate the  incident vetting process—including convening the Permanent  Coordinating Committee to evaluate the facts—State’s policies do not  define responsibilities for internal communication to M/PRI of incidents  that may involve injury, loss of life, or destruction of property at U.S.  missions abroad. Although M/PRI officials may receive information  through informal channels, this approach does not ensure that M/PRI will  be made aware of relevant incidents. With regard to the incidents in  Cuba, M/PRI could not begin the incident vetting process for determining  whether the ARB statute criteria had been met until it became aware of  them in August 2017. When M/PRI is not aware of incidents that may  meet the ARB statute criteria, it cannot initiate the incident vetting process  for convening ARBs. Until State establishes policies that ensure the  appropriate office is promptly aware of potentially relevant incidents—for  example, policies that identify formal internal communication procedures  and document responsibilities for such communication—State is at risk of  failing to comply with the ARB statute. Improving its security programs at  U.S. diplomatic posts is all the more imperative given recent reports of  similar incidents, such as in Guangzhou, China.

To ensure that State’s process allows it to initiate its ARB incident vetting  process in a timely manner, the Secretary of State should revise State’s  policies to define responsibilities for internal communication to M/PRI of  incidents that may involve injury, loss of life, or destruction of property at,  or related to, U.S. missions abroad. (Recommendation 1)

We provided a draft of this report to State. In its written comments, State  concurred with our recommendation. State said it will improve its  processes for ensuring effective internal communication. We have  reprinted State’s comments in their entirety in appendix I. State also  provided technical comments, which we incorporated as appropriate.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees and the Secretary of State. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you and your staff have any questions about this report, please contact  me at (202) 512-5130 or mazanecb@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix II.

Appendix I: Comments from the Department of State

In addition to the contact named above, Judith McCloskey (Assistant  Director), Ashley Alley, Debbie Chung, Thomas Costa, Marcia Crosse,  Neil Doherty, Justin Fisher, Christopher Hayes, Brandon Hunt, Joseph  Kirschbaum, and George Ogilvie made key contributions to this report.

Over 20 U.S. diplomats and family members in Havana, Cuba, have suffered injuries—including brain damage—believed to be connected to unexplained incidents starting in 2016. A similar incident has also been reported in Guangzhou, China.

After incidents involving serious injury, the State Department is generally required to convene an Accountability Review Board (ARB) to assess State's response and improve security at diplomatic posts.

However, the State office responsible for convening ARBs learned of the incidents in Cuba from media reports, months after they began. We recommended improving internal communication about such incidents.


Defense Nuclear Enterprise: Processes to Monitor Progress on Implementing Recommendations and Managing Risks Could Be Improved

In 2014, the Secretary of Defense directed two reviews of DOD's nuclear enterprise. These reviews identified problems with leadership, organization, investment, morale, policy, and procedures, as well as other shortcomings that adversely affected the nuclear deterrence mission. The reviews also made recommendations to address these problems. In 2015, DOD conducted a review focused on NC3 systems, which resulted in additional recommendations.

The National Defense Authorization Act for Fiscal Year 2017 includes a provision for GAO to review DOD's processes for addressing these recommendations, and House Report 114-537 includes a provision for GAO to review changes to DOD's nuclear personnel reliability assurance programs. This report addresses the extent to which DOD and the military services have (1) made progress in implementing recommendations to improve the nuclear enterprise and (2) made changes to their personnel reliability assurance programs. GAO reviewed relevant documents and interviewed agency officials from DOD and the military services. This is a public version of a classified report GAO issued in August 2017. It omits information DOD deemed classified.

The Department of Defense (DOD) has made progress in implementing the recommendations from the 2014 nuclear enterprise reviews and the 2015 nuclear command, control, and communications (NC3) systems report.

In December 2016, the Office of Cost Assessment and Program Evaluation (CAPE) provided the military services with guidance that emphasizes using performance measures and milestones to evaluate progress to aid them in tracking and analyzing their implementation of the recommendations from the 2014 nuclear enterprise reviews. However, CAPE's guidance does not require the military services and other DOD components to identify and document risks as part of its recommendation tracking processes. As a result, DOD does not consistently identify and document risks, and it may not be identifying and communicating potential risks related to the nuclear enterprise. One of the 2014 nuclear enterprise reviews found that the avoidance of managing risks by many leaders within the enterprise adversely affected the mission. Developing additional guidance on identifying and documenting risks could enhance DOD's ability to provide oversight of its efforts to monitor progress and make informed responses to address any identified risks.

For recommendations made in the 2015 NC3 report, DOD's Office of the Chief Information Officer (DOD CIO) uses an internal spreadsheet to track implementation but has not yet identified performance measures, milestones, or risks. DOD CIO has drafted a template that, once it has been approved and implemented, will provide a form that could be used for documenting performance measures, milestones, and risks. By identifying and communicating this information, DOD CIO could improve its efforts to track the progress of DOD's actions, evaluate their effects, and formulate responses to risks.

DOD and the military services have implemented changes to their personnel reliability assurance programs in response to recommendations from the 2014 nuclear enterprise reviews. These programs are intended to ensure that DOD personnel who work with nuclear weapons and nuclear weapons systems, NC3 systems and equipment, and special nuclear material are trustworthy, reliable, and capable of performing their assigned nuclear weapons-related mission. The 2014 nuclear enterprise reviews found that these personnel reliability assurance programs were overly complex and administratively burdensome and that frequent and intrusive inspections left nuclear units more focused on preparing for and responding to inspections than on ensuring personnel reliability. DOD and the services have updated their guidance for personnel reliability assurance programs, including focusing on nine essential elements of reliability. For example, the Air Force has incorporated these elements into the standards it uses for its security forces. Additionally, the Air Force has centralized some of its administrative processes, and the Joint Staff has updated inspection procedures in a way that may ease the burden on personnel being inspected.

DOD should develop additional guidance on identifying and documenting risks, and should identify and communicate performance measures and risks. DOD concurred and provided information about planned actions to implement them.

In 2014, as a response to incidents involving the nation’s nuclear  deterrent forces and their senior leadership, the Secretary of Defense  directed both an internal Department of Defense (DOD) review and an  independent review of the DOD nuclear enterprise. The DOD nuclear  enterprise includes Air Force Intercontinental Ballistic Missiles; Air Force  nuclear-capable bombers and tactical fighters; Navy ballistic missile  submarines; and the supporting infrastructure to build, maintain, and  control these assets. The two reviews examined DOD’s nuclear deterrent  mission, and the resulting reports—Internal Assessment of the  Department of Defense Nuclear Enterprise and Independent Review of  the Department of Defense Nuclear Enterprise—identified problems with  leadership, organization, investment, morale, policy, and procedures, as  well as other shortcomings that were adversely affecting the mission.  The Commander of U.S. Strategic Command also identified some  additional areas for improvement in a memorandum. Together, the two  nuclear enterprise review reports and the Strategic Command  Commander’s memorandum (hereafter referred to collectively as the  2014 nuclear enterprise reviews) included recommendations to address  DOD’s management of nuclear personnel, security requirements for  nuclear weapons, and the availability of key equipment and support parts,  among other issues. In 2015, DOD conducted a review focused on  nuclear command, control, and communications (NC3) systems, which  resulted in an additional report with recommendations (hereafter referred  to as the 2015 NC3 report).

The National Defense Authorization Act for Fiscal Year 2017 includes a  provision for us to review—during each of fiscal years 2017 through  2021—DOD’s processes for addressing the recommendations of the two  nuclear enterprise reviews and other assessments of the nuclear  enterprise, including the 2015 NC3 report, and to provide a briefing to the congressional defense committees on the results of our review. In July  2016, we reported that the process DOD had developed for tracking the  2014 reviews’ recommendations generally appeared consistent with  relevant criteria from the Standards for Internal Control in the Federal  Government—including using and effectively communicating quality  information and performing monitoring activities. Additionally, the House  Armed Services Committee report accompanying a bill for the National  Defense Authorization Act for Fiscal Year 2017 includes a provision for us  to review matters related to the changes that DOD and the military  services have made to their nuclear personnel reliability assurance  policies and implementing programs. This includes information on (1) the  Air Force’s shift away from using the Personnel Reliability Program as its  sole nuclear personnel reliability assurance program and toward using  Arming and Use of Force as a second personnel reliability assurance  program for its security forces and (2) the Navy’s continued use of the  Personnel Reliability Program as its sole personnel reliability assurance  program.

This report evaluates the extent to which DOD and the military services  have  1.  made progress in implementing recommendations to improve the  nuclear enterprise, identified performance measures and milestones  to track the progress of its implementation actions, and identified  associated risks and  2.  made changes to their personnel reliability assurance programs to  address the personnel reliability recommendations from the nuclear  enterprise reviews, and the effects of any such changes.

This report is a public version of a classified report that we issued in  August 2017. The Department of Defense deemed some of the  information in our August report to be classified, which must be protected  from loss, compromise, or inadvertent disclosure. Therefore, this report  omits classified information about some findings from DOD’s classified  nuclear enterprise review reports. Although the information provided in  this report is more limited, the report addresses the same objectives as  the classified report and uses the same methodology.

To evaluate the extent to which DOD and the military services have made  progress in implementing recommendations to improve the nuclear  enterprise, identified performance measures and milestones to track the  progress of its implementation actions, and identified associated risks, we  reviewed documents that establish the recommendations, including the  internal and independent nuclear enterprise reviews, U.S. Strategic  Command’s action plan, and the 2015 NC3 report; guidance such as the  Secretary of Defense’s memo (Nuclear Enterprise Review Corrective  Action Implementation); and additional documents from the Office of Cost  Assessment and Program Evaluation (CAPE), Office of the Chief  Information Officer (CIO), and the military services that outline their  processes for implementing, tracking, and evaluating the implementation  of the recommendations to improve the defense nuclear enterprise. We  compared these processes to relevant criteria from Standards for Internal  Control in the Federal Government—including assessing and responding  to risk, using and effectively communicating quality information, and  performing monitoring activities.

To evaluate the extent to which DOD and the military services have made  changes to their personnel reliability assurance programs to address the  personnel reliability recommendations from the nuclear enterprise  reviews, and the effects of any such changes, we reviewed the personnel  reliability assurance program requirements for DOD personnel in the  Navy, the Army, the Air Force, the Marine Corps, and DOD guidance and  other documents. We then compared these requirements to those in  prior DOD documents and service-specific guidance. We conducted  interviews with officials involved in overseeing and implementing the  department’s and the services’ nuclear personnel reliability assurance  programs. We also reviewed training documents, reports, and other  documents that DOD and the services used to implement changes to  their personnel reliability assurance programs and to educate their  personnel on these changes.

We interviewed officials from the following offices to discuss progress in  implementing the recommendations to improve the nuclear enterprise,  including changes to personnel reliability assurance programs:

Office of the Assistant Secretary of Defense for Nuclear, Chemical,  and Biological Defense Programs (Nuclear Matters)

Secretary of the Air Force, Office of the Inspector General

Air Force Headquarters: Manpower, Personnel, and Services (A1),  Security Forces (A4S), and Strategic Deterrence and Nuclear  Integration (A10)

Air Force Personnel Reliability Program Administrative Qualification

90th Missile Wing, F.E. Warren Air Force Base

11th Security Forces Group, Joint Base Andrews

628th Security Forces Squadron, Joint Base Charleston

Deputy Under Secretary of the Navy for Policy

Chief of Naval Operations: Nuclear Policy (N514) and Undersea  Warfare (N97)

Marine Corps Headquarters: Plans, Policies, and Operations-Security

Department of the Army Headquarters, Operations, Plans, and  Training (G3/5/7)

U.S. Army Nuclear and Countering Weapons of Mass Destruction  We conducted this performance audit from July 2016 to August 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. We subsequently worked with  DOD from August 2017 to October 2017 to prepare this unclassified  version of the original classified report for public release. This public  version was also prepared in accordance with these standards.

Oversight of 2014 Nuclear Enterprise Reviews’ Recommendations

In November 2014, the Secretary of Defense directed DOD to address  the 2014 nuclear enterprise reviews’ recommendations and directed  CAPE to track and assess these implementation efforts. The Joint Staff,  Navy, Air Force, offices within the Office of the Secretary of Defense, and  U.S. Strategic Command are supporting CAPE’s efforts. The Secretary  also established the Nuclear Deterrent Enterprise Review Group  (NDERG), a group of senior officials chaired by the Deputy Secretary of  Defense and including the Vice Chairman of the Joint Chiefs of Staff, to  oversee and make decisions regarding implementation of the nuclear  enterprise reviews’ recommendations. The NDERG is supported by a  Nuclear Deterrent Working Group, which meets biweekly and reviews the  status of recommendations, and a Nuclear Deterrent Senior Oversight  Group, which meets quarterly and reviews any recommendations that the  Working Group believes are ready for the NDERG to close. The Deputy  Secretary of Defense updates the Secretary of Defense on NDERG  progress as requested.

CAPE compiled the recommendations from the two 2014 nuclear  enterprise reviews and a memorandum from the Commander of U.S.  Strategic Command that identified several additional recommendations.  In total, CAPE identified 175 distinct recommendations from the three  documents. CAPE then identified 247 sub-recommendations from  recommendations directed to multiple services (or other DOD  components)—for example, if a recommendation was directed to the Air  Force and the Navy, then one sub-recommendation was made to the Air  Force and one sub-recommendation was made to the Navy.

CAPE then worked with the services to identify offices of primary  responsibility for implementing actions to address the recommendations,  any offices of coordinating responsibility, and any resources necessary to  implement each recommendation. CAPE has developed a tracking tool to  collect information on progress in meeting milestones and metrics. This  tracking tool identifies offices of responsibility, implementation actions,  milestones, and metrics to measure the effectiveness of the actions taken  toward implementing each of the recommendations. The tracking tool  currently contains hundreds of unique milestones and metrics, and  according to CAPE officials, additional milestones and metrics are  included as they are identified. The Air Force and the Navy also  developed their own methods of tracking their service-specific  recommendations.

We reviewed DOD’s processes for implementing the 2014 nuclear  enterprise reviews’ recommendations and issued a report on July 14,  2016. We found that the process DOD had developed for implementing  and tracking the 2014 nuclear enterprise reviews’ recommendations  generally appeared consistent with relevant criteria from the Standards  for Internal Control in the Federal Government—including using and effectively communicating quality information and performing monitoring  activities.

As we reported in July 2016, CAPE officials stated that it would take  about 3 years to see measurable improvements in the health of the  nuclear enterprise and 15 years to implement the great majority of the  recommendations and measure whether they have had their intended  effects. CAPE and service officials have noted that it would take years for  some of the recommended cultural changes to manifest.

NC3 is a large and complex system comprised of numerous land-, air-,  and space-based components used to assure connectivity between the  President and nuclear forces. NC3 is managed by the military  departments, nuclear force commanders, and the defense agencies and  provides the President with the means to authorize the use of nuclear  weapons in a crisis.

NC3 systems support five important functions:

Force management: assignment, training, deployment, maintenance,  and logistics support of nuclear forces before, during, and after any  crisis.

Planning: development and modification of plans for the employment  of nuclear weapons and other options.

Situation monitoring: collection, maintenance, assessment, and  dissemination of information on friendly forces, adversary forces and  possible targets, emerging nuclear powers, and worldwide events of  interest.

Decision making: assessment, review, and consultation that occur  when the employment or movement of nuclear weapons is  considered.

Force direction: implementation of decisions regarding the execution,  termination, destruction, and disablement of nuclear weapons.

Oversight of 2015 NC3 Report Recommendations

As recommended in the 2015 NC3 report, the Council on Oversight of the  National Leadership Command, Control, and Communications System  (the Oversight Council) has taken a lead role in providing oversight and  making the final determination on the implementation status of that  report’s 13 recommendations. The Oversight Council is co-chaired by  the Under Secretary of Defense for Acquisition, Technology, and  Logistics and the Vice Chairman of the Joint Chiefs of Staff and its  members are the Under Secretary of Defense for Policy; the Commander,  U.S. Strategic Command; the Commander, North American Aerospace  Defense Command/U.S. Northern Command; the Director, National  Security Agency; and the DOD Chief Information Officer. Additional  organizations, such as CAPE, may participate in the Oversight Council’s  meetings to provide subject matter expertise. The Oversight Council is  supported by the Executive Management Board—a functional  governance committee chaired by the DOD Chief Information Officer.  DOD CIO tracks the implementation of the 2015 NC3 report’s  recommendations, among other activities.

DOD and the military services set standards to ensure that personnel who  work with nuclear weapons and nuclear weapons systems, NC3 systems  and equipment, and special nuclear material are reliable, trustworthy, and  capable of performing their assigned nuclear weapons-related mission.  Nuclear surety generally refers to DOD’s efforts to ensure that nuclear  weapons and materials are safe, secure, reliable, and controlled. DOD  and the military services use personnel reliability assurance programs— the Personnel Reliability Program and the Air Force’s Arming and Use of  Force program for Air Force security forces—to implement these nuclear  surety requirements for personnel.

When personnel are assigned to a nuclear unit, relevant unit  commanders certify that those personnel meet the personnel reliability  assurance program standards. Commanders can also suspend or  decertify personnel from working with nuclear weapons if they fail to meet  these standards during their service. Factors that may lead to suspension  or decertification include medical issues; personal conduct; emotional,  mental and personality disorders; financial problems such as an inability  or unwillingness to satisfy debts or the presence of unexplained wealth;  criminal conduct; sexual harassment or assault; misuse of drugs or  alcohol; and security violations. According to DOD data, as of  December 31, 2016, there were 10,603 DOD personnel certified under  the Personnel Reliability Program and 36,464 security forces personnel  certified under the Air Force’s Arming and Use of Force program.  Together, there were a total of 47,067 personnel that met the personnel  nuclear surety requirements of a personnel reliability assurance program  (see table 1).

Progress Made in Implementing Recommendations, but Identifying Additional Performance Measures, Milestones, and Risks Can Aid in Tracking and Evaluating Efforts

DOD and the military services have made progress in implementing  recommendations to improve the defense nuclear enterprise but could  improve their efforts by identifying additional performance measures,  milestones, and associated risks. CAPE and DOD CIO have separate  processes for tracking and evaluating DOD’s progress in implementing  the recommendations from the 2014 nuclear enterprise reviews and the  2015 NC3 report, respectively.

DOD Continues to Implement the Recommendations from the 2014 Nuclear Enterprise Reviews

The NDERG has closed 77 of the 247 sub-recommendations from the  2014 nuclear enterprise reviews following CAPE’s assessment of  implementation actions that had been taken by the military services and  other DOD components (see fig. 1). For example, with regard to Nuclear  Weapons Technical Inspections, the independent 2014 nuclear enterprise  review recommended that inspection teams not focus on auditing records  but instead examine the processes in place to inform commanders of  Personnel Reliability Program issues. In response, DOD, the Air Force,  and the Navy have made changes to their inspection processes and the  Joint Chiefs of Staff have updated the Nuclear Weapons Technical  Inspections guidance to de-emphasize records reviews in favor of  knowledge checks and scenario-based discussion during the Personnel  Reliability Program portion of these inspections. After reviewing these  actions, the NDERG closed this recommendation in December 2016. The  77 closed sub-recommendations make up 62 of the initial 175  recommendations from the 2014 nuclear enterprise reviews.

DOD Has Made Progress in Implementing Recommendations from the 2015 NC3 Report

According to DOD CIO officials, as of March 2017, the Oversight Council  has closed two of the 13 recommendations from the 2015 NC3 report,  and DOD is making progress in implementing the remaining 11  recommendations (see fig. 2). The two closed recommendations are to  (1) make the Oversight Council the synchronizing body to evaluate, track,  and resolve the findings and recommendations made in that report and  (2) broaden Air Force Global Strike Command’s responsibilities to include  serving as the lead command for all of the Air Force-owned portions of  the NC3 systems. DOD has made progress in implementing the  remaining 11 recommendations. For example, the 2015 NC3 report  recommended that U.S. Strategic Command review and validate the  availability requirements of one of the NC3 systems, which the command  has now completed. Additional detail about DOD’s progress is omitted  because the information is classified.

DOD’s Processes for Tracking and Evaluating Its Progress Can Be Improved by Identifying Additional Performance Measures, Milestones, and Risks

DOD’s processes for tracking and evaluating its progress in implementing  the 2014 nuclear enterprise reviews’ recommendations do not  consistently identify and document risks, and its processes for tracking  and evaluating its progress in implementing the 2015 NC3 report’s  recommendations do not identify performance measures, milestones, or  risks. Identifying performance measures, milestones, and associated risks  can help an agency to track and evaluate its progress toward completing  tasks over time and can help to inform decision makers of potential issues  that need to be addressed. We have previously reported that by tracking  and developing a performance baseline for all performance measures,  agencies can better evaluate whether they are making progress and their  goals are being achieved. Similarly, Standards for Internal Control in the  Federal Government emphasizes using performance measures and  milestones to assess performance over time. We have also derived  leading practices from the Government Performance and Results Act of  1993 (GPRA) and the GPRA Modernization Act of 2010, such as clearly  defining performance measures and milestones and assessing program  results against them. Additionally, Standards for Internal Control in the  Federal Government states that management should identify, analyze,  and respond to risks related to achieving the defined objectives and  should use and internally communicate the necessary quality information  in meeting those objectives.

DOD Has Identified Performance Measures and Milestones for Evaluating the Implementation of the 2014 Nuclear Enterprise Reviews’ Recommendations, but Additional Guidance for Identifying and Documenting Risks Could Improve Oversight

CAPE is working with the military services and other DOD components to  track and evaluate the implementation actions taken in response to the  recommendations from the 2014 nuclear enterprise reviews; however,  risks associated with these actions are not consistently identified and  documented. In July 2016, we reported on CAPE’s use of a centralized  tracking tool that contains relevant information about the status of the  actions taken in response to those recommendations. CAPE continues to  use this tool, and it remains accessible to the services and other DOD  entities on DOD’s classified network. As shown in figure 3, it includes  fields for the underlying problem statement, or root cause, for the  recommendation; time frames with milestones for implementing the  recommendations; and performance measures (referred to as metrics in  the tracking tool) to assess the effectiveness of the actions taken. The  tracking tool also contains a field for Key Risks and Issues, but we found  that this field has not been used consistently.

According to CAPE officials, CAPE is using the tracking tool to track  progress in meeting milestones and record the metrics it has identified to  assess both the progress (through “process metrics”) and the  effectiveness of the implementation actions (through “outcome metrics”).  The outcome metrics are selected to aid CAPE in determining whether  implemented recommendations have addressed the underlying problem  that was the impetus for the original recommendation. CAPE used the  outcome metrics to inform its assessment of each of the 77 sub- recommendations that the NDERG then closed. According to CAPE  officials, CAPE’s approach to measuring effectiveness is to gather  supporting data from the services and measure the effectiveness of each  recommendation separately. However, these officials noted that until a  recommendation has been implemented, CAPE cannot fully assess the  effectiveness of the implementation actions. Some recommendations— including changing a service’s culture or morale—will take time to  evaluate. According to CAPE officials, the tracking tool currently contains  389 unique metrics and 370 unique milestones to aid in the assessment  of the implementation actions. For each of these metrics and milestones,  the tracking tool includes expected completion dates and indicates which  have been met and which are behind schedule. Additional milestones,  particularly for actions more than 18 months out, and additional metrics to  aid in measuring the effectiveness of actions taken, are still being  identified, according to CAPE officials.

In December 2016, the Deputy Secretary of Defense issued a  memorandum that directed the transition of the tracking and analysis  responsibilities related to implementing the 2014 nuclear enterprise  reviews’ recommendations from CAPE to the military departments and  other DOD entities. However, CAPE remains responsible for providing  guidance to inform the analyses conducted by other DOD entities,  overseeing the analyses, and assessing recommendations for closure.  The aim of these changes was to enhance ownership and embed the  principles of robust analysis, continuous monitoring, and responsibility  throughout the department.

As part of this transition, CAPE provided the military departments and  other DOD entities with guidance to aid in their tracking and analysis of  the recommendations from the 2014 nuclear enterprise reviews, but this  guidance does not require the military services and other DOD  components to identify and document risks prior to bringing a  recommendation for closure. This guidance emphasizes using  performance measures and milestones to track and measure the  progress of implementation actions. It includes sections tailored to  specific groups of recommendations from the 2014 nuclear enterprise  reviews. It also calls for the consideration of potential risks that  unintended consequences could occur when a recommendation is  brought for closure, but it does not call for risks to be identified, assessed,  or documented prior to that time.

According to officials from CAPE and the military services, the  department considers risks in a number of ways and does capture  information about some risks. For example, CAPE has supplemented its  review of the military services’ proposed budgets by conducting a review  of funding risks related to the nuclear enterprise in areas such as  modernization, investment, and personnel. CAPE briefs the results of this  review to senior leadership within the NDERG to provide them information  about whether the services are including funds to address these items in  their yearly budget requests. Additionally, CAPE personnel have identified  key risks regarding some of the recommendations and have entered this  information into the centralized tracking tool. According to CAPE officials,  63 of the 247 sub-recommendations include information in the Key Risks  and Issues field in the tracking tool. However, these officials told us that  none of the remaining 184 sub-recommendations include information in  this field, because either no key risks or issues were identified or the risks  that were identified were not formally documented within the tool.

Additionally, risks that are introduced as a result of actions taken to  implement a recommendation are not consistently included in the  centralized tracking tool or otherwise documented by CAPE. For  example, according to Navy and CAPE officials regarding a  recommendation to increase the number of skilled shipyard workers to  keep up with the maintenance demands of ballistic missile nuclear  submarines, the centralized tracking tool documents the risks as the need  to complete hiring and training of new shipyard personnel. However,  according to Navy officials, the risks resulting from the prioritization of  maintenance of ballistic missile nuclear submarines over other vessels  not associated with the nuclear deterrent mission, such as fast attack  submarines and nuclear aircraft carriers, were discussed and accepted by  the Navy, but not documented in the centralized tracking tool. Similarly,  the risks associated with recommendations that the Air Force provide  additional incentive pay for personnel serving in nuclear positions were  identified but not documented in the centralized tracking tool prior to  implementation and closure. According to a CAPE official, the Nuclear  Deterrent Working Group determined that implementing incentive pay  could negatively affect morale, because some Air Force personnel in  nuclear positions are not eligible to receive this additional pay. The official  stated that the Nuclear Deterrent Senior Oversight Group was briefed on  this risk and responded by requesting updates from the Air Force’s  annual review on the effectiveness of this incentive pay.

The department is not consistently identifying and documenting risks  associated with the recommendations, because CAPE’s guidance does  not direct the military services and DOD components to document and  update information on risk in the centralized tracking tool. According to  CAPE officials, since the release of the December 2016 memorandum  directing the transition of the tracking and analysis responsibilities for the  2014 nuclear enterprise reviews’ recommendations from CAPE to the  military departments and other DOD components, the military services  have not, to date, formally identified any key risks for inclusion in the  centralized tracking tool. According to one Air Force official, the Air Force  identifies and responds to risks through its day-to-day operations;  however, this information is not captured by the tracking tool or otherwise  documented. According to a CAPE official, additional guidance on  documenting risk could encourage the military services and DOD  components to capture risks that they have identified in the tracking tool.

In a November 2014 memo announcing the department’s response to the  nuclear enterprise reviews, the Secretary of Defense stated that the  nuclear deterrent plays a critical role in assuring U.S. national security  and that it is DOD’s highest priority mission. The Independent Review of  the Department of Defense Nuclear Enterprise found that the avoidance  of managing risks by many leaders within the enterprise resulted in  adverse impacts to the mission. The review noted that avoiding risk by  avoiding the problem until it becomes a major issue is a near inevitable  outcome of risk-averse cultures and that, too often, it takes a significant  event for the leadership to recognize major problems within the force.  Similarly, the Internal Assessment of the Department of Defense Nuclear  Enterprise stated that many of the senior leaders within DOD and the  military services were not cognizant of the problems faced by the  enterprise. According to that review, many issues were already being  reported through internal self-assessments, but many senior leaders  within DOD and the military services were not aware of the conclusions of  these self-assessments and so were unable to take action to address  them. Given the critical role the nuclear enterprise plays in national  security, and given the challenges the Independent Review of the  Department of Defense Nuclear Enterprise identified with respect to  managing risks and communicating them across the defense nuclear  enterprise, it is essential that risks be consistently identified and  documented. By documenting information on risks in its centralized  tracking tool, DOD could enhance its ability to provide oversight of the  recommendations throughout its review processes in the military services,  the Nuclear Deterrent Working Group, the Nuclear Deterrent Senior  Oversight Group, and the NDERG. By developing additional guidance for  identifying and documenting information about these risks, CAPE can  also aid the components of the defense nuclear enterprise in their efforts  to communicate and formulate responses to the risks—either by  deliberately determining to accept the risk or by taking steps to avoid,  reduce, or share the risk across the enterprise.

Identifying Performance Measures, Milestones, and Associated Risks could Improve DOD CIO’s Efforts to Evaluate the Actions Taken in Response to the 2015 NC3 Report

DOD CIO uses an internal spreadsheet to track the implementation of the  13 recommendations from the 2015 NC3 report, but it has not identified  performance measures, milestones, or associated risks to evaluate these  actions. This spreadsheet includes fields for indicating whether an  execution plan exists, the operational impact from implementing the  recommendation, forecast closeout (which lists the responsible DOD  component or designates the status of the recommendation), and follow- up actions to be taken after a recommendation is closed. Figure 4 shows  the layout of this spreadsheet.

According to DOD CIO officials that we met with, DOD CIO shares  information about the status of the 2015 NC3 report recommendations  through meetings with the DOD entities with primary responsibility for  implementing the recommendations. However, there is currently no  centralized collection of metrics, milestones, and other information with  the same level of detail that CAPE had developed and is using for the  2014 nuclear enterprise reviews’ recommendations. According to DOD  CIO officials, they are working with the offices of primary responsibility to  expand on the current content of the internal tracking spreadsheet. These  officials stated that while they had drafted a template to contain the  expanded content, it has not yet been approved by the Oversight Council.  This draft template contains fields similar to those CAPE developed and  the department uses for tracking the department’s progress in  implementing the recommendations from the 2014 nuclear enterprise  reviews. When approved and implemented, this template will provide a  form that could be used for documenting performance measures,  milestones, and risks for these 2015 recommendations, once this  information is identified.

Identifying and sharing performance measures, milestones, and risks  could aid DOD CIO in tracking and evaluating DOD’s efforts to implement  the 2015 NC3 report recommendations. DOD CIO could improve its  efforts to track DOD’s progress in addressing the recommendations by  identifying performance measures and milestones as part of the effort it  has initiated to expand on the content of its tracking spreadsheet. DOD  CIO could also use performance measures to evaluate the actions DOD  has taken and determine whether the actions have fully addressed the  root cause of the recommendation. DOD officials leading some of the  recommendation implementation efforts told us that a number of the  issues identified in the 2015 NC3 report stem from enduring problems.  These officials noted that an overemphasis on identifying easily attainable  performance measures and closing recommendations quickly may  improve the overall percentage of recommendations implemented but  also could result in underlying root causes continuing to go unaddressed.  Our prior work on performance measurement has identified several  important attributes—such as the inclusion of baseline and trend data— that performance measures must have if they are to be effective in  monitoring progress and determining how well programs are achieving  their goals.

Additionally, by identifying and communicating risks to NC3 stakeholders,  DOD leadership may be in a better position to formulate responses to  these risks—including deliberately determining to accept the risk or take  steps to avoid, reduce, or share the risk across the defense nuclear  enterprise. Promoting the sharing of quality information on the status of  the recommendations and potential risks from the 2015 NC3 report  among the services and other DOD components with a role in NC3 could  help DOD to integrate its nuclear deterrent efforts and help decision  makers to formulate responses to any potential risks.

The DOD CIO officials that we met with said that it will be important to  incorporate performance measures and milestones into their tracking and  evaluation process and to consider operational risk and its management  when discussing effects on the nuclear enterprise and its NC3 systems.

The draft template that DOD CIO is developing, once it is finalized and  implemented, could aid the department in identifying performance  measures and milestones for these 2015 recommendations in the same  way that the centralized tracking tool CAPE developed has been used to  collect performance measures and milestones for the 2014  recommendations. In addition, including an assessment of risks  associated with the implementation of the recommendations from the  2015 NC3 report similar to the follow-up to the recommendations of the  2014 nuclear enterprise reviews could enhance DOD’s ability to provide  oversight of the recommendations and make informed responses to  address any identified risks throughout its review processes, all the way  to their closure by the Oversight Council.

DOD and the Military Services Have Implemented Recommended Changes to their Personnel Reliability Assurance Programs to Reduce Administrative Burdens

DOD and the military services have implemented changes to their  personnel reliability assurance programs in response to 17  recommendations from the 2014 nuclear enterprise reviews. DOD has  identified nine essential elements of reliability and released updated  guidance to refocus personnel reliability on these elements. Additionally,  the Air Force has incorporated these nine essential elements into its  Arming and Use of Force program, allowing the Air Force to use this  program to ensure that its security forces meet nuclear surety  requirements. The Air Force has also created a new office within the Air  Force Personnel Center, the Personnel Reliability Program Administrative  Qualification Cell, to assist with the administrative review process for  personnel newly assigned to Personnel Reliability Program positions or  returning to Personnel Reliability Program positions after working  elsewhere. In response to both the personnel recommendations and the  inspections-related recommendations of the 2014 nuclear enterprise  reviews, the Joint Staff, the Navy, and the Air Force have made changes  to the procedures they use to conduct nuclear personnel reliability  inspections at nuclear facilities.

DOD and the Military Services Have Altered Personnel Reliability Standards to Focus on Nine Essential Elements of Reliability

In response to recommendations from the 2014 nuclear enterprise  reviews, the Joint Staff led a review of the department’s guidance on the  personnel reliability assurance program. The Joint Staff, with the  assistance of the military services, identified nine elements from DOD’s  personnel reliability assurance requirements that it considered essential  to ensure that personnel working with nuclear weapons fully met nuclear  surety standards of reliability and trustworthiness.

These nine essential elements are that an individual must  1.  be a U.S. citizen  2.  have a security clearance and be reinvestigated every five years  3.  be fully qualified for the position in which he or she will serve  4.  have reliability verified by the commander before being assigned to a  Personnel Reliability Assurance Program position  5.  be continuously monitored by peers, supervisors, and commander for  issues that could affect reliability  6.  have his or her personnel file checked for issues that could affect  7.  undergo a medical evaluation to identify any conditions that could  8.  have a personal interview with the commander who will be assessing  9.  exhibit the character and competence to do the job, including  allegiance to the United States and a positive attitude toward nuclear  weapons  In response to the Joint Staff review, the Office of the Assistant Secretary  of Defense for Nuclear Matters, through the Office of the Under Secretary  of Defense for Acquisition, Technology and Logistics, issued a new  version of the Personnel Reliability Program manual in January 2015,  followed by a reissue and renaming of the overarching DOD instruction— changing the name to DOD Nuclear Weapons Personnel Reliability  Assurance—in April 2016. This guidance requires that all DOD  personnel occupying positions subject to nuclear personnel reliability  assurance program standards must meet the nine essential elements of  reliability. Additionally, the revised guidance removed a procedure for  temporary decertification, which under the previous guidance was to  occur immediately on receipt of information that was, or appeared to be, a  reason for decertification. The manual also makes it clear that personnel  reliability assurance programs are the commanders’ programs, and the  commander is exclusively accountable for determining the fitness for duty  of individuals subject to the program. The updated manual also provides  some clarity regarding requests for reinstatement by personnel who had  previously been decertified from the Personnel Reliability Program.

The military services have responded to DOD’s changes by updating their  own guidance. The Navy has released a new version of its department- specific Personnel Reliability Program manual, applicable to the Navy and  Marine Corps, and Army officials told us that the Army plans to release a  new version of its manual in early 2018. The Air Force has released a  new version of its Personnel Reliability Program manual, in addition to  other guidance changes.

Specifically, in response to a provision in DOD’s updated personnel  reliability guidance that authorizes the military departments to develop  reliability guidance specific to their security force personnel guarding  nuclear weapons, the Air Force has made changes to its Arming and Use  of Force program. Air Force Arming and Use of Force standards include  qualification requirements under which all Air Force security forces,  whether assigned to a nuclear facility or a non-nuclear facility, are  authorized to carry a weapon as part of their official duties. In addition, Air  Force nuclear security forces no longer require separate Personnel  Reliability Program certification, as they previously did. The 2014 nuclear  enterprise reviews determined that requiring nuclear security forces to  meet the standards of two reliability programs at the same time was  redundant. Air Force officials told us that utilizing the two reliability  programs caused manning problems for the Air Force, because the  availability of security force personnel qualified under both programs was  limited. As a result of the changes to DOD’s guidance, the Air Force  rewrote its Arming and Use of Force guidance to incorporate a new  chapter that outlines procedures for assessing security forces against  each of the nine essential elements of reliability. This change has allowed  the Air Force to use its Arming and Use of Force program as its sole  method of establishing personnel reliability assurance for Air Force  security force personnel. The Air Force continues to use its Personnel  Reliability Program to certify nuclear operators and maintainers.

Prior to the implementation of its new version of Arming and Use of Force  standards, the Air Force conducted an assessment of the new Arming  and Use of Force reliability standards as the sole standard for security  forces at six Air Force installations (four nuclear installations and two non- nuclear installations), to identify any gaps or areas for improvement of the  new guidance prior to its Air Force-wide implementation. The assessment  found that the new Arming and Use of Force standard adequately  addressed the nine essential elements required of a personnel reliability  assurance program, streamlined monitoring of security forces for  commanders by merging the Arming and Use of Force standards with the  Air Force Personnel Reliability Program standards, and held the security  force personnel to a higher standard to perform armed duty. The Air  Force fully implemented its new version of Arming and Use of Force  standards across the service in February 2016.

As a result of the Air Force’s changes to its Arming and Use of Force  guidance, Air Force security forces are now qualified to serve at nuclear  facilities and do not need to certify under the Personnel Reliability  Program (see fig. 5). Air Force officials told us that requiring security  forces to qualify under Arming and Use of Force standards had helped to  address manning challenges among nuclear security forces, as well as  allowing the Air Force to move experienced security forces personnel  from non-nuclear facilities to nuclear assignments. According to several  Air Force officials in command of security forces at non-nuclear  installations, the changes to the Arming and Use of Force guidance have  led to a slight increase in administrative work but have been an overall  positive development, in part due to improvements in communication with  medical personnel about factors that may affect a determination that an  airman should not be armed.

All Air Force security force personnel are required to meet the standards  of Arming and Use of Force to carry a firearm and perform many of their  duties. The Air Force implemented the new version of the Arming and  Use of Force standards in 2016. According to Air Force officials, during  the implementation, the Air Force decided that security force personnel  who were, at that time, disqualified or permanently decertified under the  Personnel Reliability Program would not be allowed to certify under the  new version of Arming and Use of Force until they had been restored to  eligibility for the Personnel Reliability Program. In early 2016, the Air  Force conducted a review of 3,167 security force personnel who had  previously been decertified or disqualified from the Personnel Reliability  Program. The Air Force determined that 2,628 of these personnel were  able to attain Personnel Reliability Program eligibility during this review,  while 539 were not. Because qualifying under the new version of Arming  and Use of Force is now a positional requirement, Air Force officials  noted that those who do not qualify must retrain for a different job or  separate from the Air Force. Air Force officials told us that the security  forces career field received a greater number of new security forces  personnel than they had been allocated in previous years to account for  the loss of personnel who were unable to qualify under the new Arming  and Use of Force standards.

The Air Force tracks metrics from the Personnel Reliability Program and  from the Arming and Use of Force program on an annual basis. Air Force  officials told us that they have not yet reviewed the extent to which the  changes to Arming and Use of Force made in February 2016 have been  effective. Air Force and DOD officials told us that they are waiting until  sufficient data are available before making additional changes to the  guidance for their personnel reliability assurance program. The Air Force  is currently developing a nuclear enterprise health assessment, which will  include further assessment of the effects of the changes the Air Force has  made to its Personnel Reliability Program and Arming and Use of Force  guidance. Air Force officials told us that data collection for this  assessment began in the spring of 2017 and that the first summary report  will be released in September-October 2017. Once implemented, this Air  Force nuclear health assessment will provide an overarching assessment  on a periodic basis, similar to a biennial assessment that the Navy  conducts of the Navy nuclear enterprise.

Unlike the Air Force, the Navy and the Army have opted not to develop  separate guidance on nuclear personnel reliability assurance for their  security forces personnel. Navy and Army officials told us that there was  no reason to create separate guidance for their security forces personnel  because, unlike the Air Force, they have not faced manning challenges or  administrative burdens related to these positions. The Air Force has a  much larger nuclear security force, and personnel transfer between  nuclear and non-nuclear facilities more frequently within the Air Force  than the other services. The Navy fills security forces positions at the two  Navy nuclear facilities with Navy and Marine Corps personnel who report  directly from training. According to a Marine Corps official, once these  personnel move on to non-nuclear assignments, they generally do not  return to nuclear security positions. Army officials told us that their nuclear  security forces are highly specialized, very few in number, and serve at  only one facility.

The Air Force Has Created a Personnel Reliability Program Administrative Qualification Cell to Facilitate the Assignment Process for Personnel New to Personnel Reliability Program Positions

The Air Force has taken additional steps to improve the Personnel  Reliability Program by creating the Air Force Personnel Reliability  Program Administrative Qualification Cell to aid with the review of non- security force personnel (e.g., operations personnel, maintenance  personnel) as they transition into Personnel Reliability Program positions.  Personnel transferring into these positions are subject to an  administrative qualification process, which includes a review of their  personnel file, medical information, and security clearance information as  well as an interview by the new, gaining, commander to assess them for  factors that affect their reliability.

Prior to October 2015, the commander for the unit that the individual was  leaving reviewed the individual’s administrative paperwork and then  provided an assessment of the individual’s reliability under the Personnel  Reliability Program standards to the commander of the gaining unit.  Because this initial review was often conducted by commanders outside  of the nuclear field, they had less experience than nuclear commanders in  conducting such an assessment. According to Air Force officials, this lack  of experience often resulted in the standards being applied either too  stringently or too loosely and the initial reviews often being completed  late. Additionally, although Air Force guidance indicated that personnel  transferring directly from one Personnel Reliability Program position to  another were not required to undergo administrative qualification, one of  the 2014 nuclear enterprise reviews found that some administrative file  reviews were occurring.

As of November 2016, the Air Force Personnel Reliability Program  Administrative Qualification Cell has been staffed by personnel  experienced with the standards, and they assist in conducting reviews of  many of the Air Force personnel moving to nuclear assignments. The cell  performs the administrative review formerly conducted by the commander  of the individual’s losing unit and provides a recommendation to the  commander of the gaining unit before that commander makes an  assessment (see fig. 6).

As a result, according to Air Force officials, the qualification process is  now completed more quickly, and the administrative burden on  commanders has been lessened. Officials from the Air Force Personnel  Center told us that the Personnel Reliability Program Administrative  Qualification Cell was currently assisting all Air Force Major Commands  but had not yet begun working with all Personnel Reliability Program  units.

In addition, in response to a recommendation from the 2014 nuclear  enterprise reviews, the Air Force has eliminated administrative reviews  that some commands were conducting of personnel transferring directly  from one Personnel Reliability Program position to another, but which  were not required in the Air Force’s guidance. These personnel have  remained subject to continuous monitoring, so they do not require new  administrative qualification reviews.

DOD, the Air Force, and the Navy Have Made Changes to the Inspections Processes for Their Personnel Reliability Programs

DOD, the Air Force, and the Navy also made changes to their nuclear  inspections processes in response to the 2014 nuclear enterprise  reviews. Nuclear units are subject to a number of different inspections.  For example, Joint Staff guidance requires that each of the services  conduct Nuclear Weapon Technical Inspections biennially at each of their  nuclear units. These inspections are intended to examine every aspect  of the nuclear mission at that unit, including the processes of the  personnel reliability assurance program. Because of the importance of  maintaining nuclear surety by keeping nuclear weapons safe and secure,  units that receive an unsatisfactory rating on an inspection may be  decertified from conducting operations or have a portion of their nuclear  capabilities withdrawn and retain only a limited nuclear capability in  mission areas that would not jeopardize the safety, security, or reliability  of the nuclear weapons.

The 2014 nuclear enterprise reviews found that inspections of nuclear  forces occurred too frequently, and that the procedures for inspections of  personnel reliability assurance programs had become overly burdensome  because of their focus on records review. The reviews found that, as a  result, these personnel reliability assurance programs had become  dominated by processes that were intended to prepare for inspections,  rather than to ensure personnel reliability. Before the 2014 nuclear  enterprise reviews, DOD personnel working with nuclear weapons were  subject to frequent inspections by multiple organizations. According to  DOD officials, Air Force major commands and Navy commands were  performing inspections at nuclear units under their control every 18  months. One such inspection was conducted as a combined military  service and Defense Threat Reduction Agency inspection. Each service  inspected additional specific areas. For Navy units, the Navy inspectors  would accept the Defense Threat Reduction Agency inspection report and  the Navy inspectors would review additional, service-specific items; this  resulted in a larger number of inspectors present. For Air Force units, the  combined inspection was performed concurrently, with the Air Force  inspecting the same items as the Defense Threat Reduction Agency  inspectors as well as reviewing additional, service-specific items; this  resulted in two separate inspection teams. The 2014 nuclear enterprise  reviews found that a mistake by a single individual could result in an  entire submarine or wing receiving an unsatisfactory rating—even in  cases not involving a clear, critical error—potentially leading to the  withdrawal of their nuclear weapons capabilities. The Independent  Review of the Department of Defense Nuclear Enterprise found that the  high frequency of inspections resulted in nuclear units spending  significant time preparing for inspections rather than focusing on  performing their mission.

The Independent Review of the Department of Defense Nuclear  Enterprise also stated that the portions of these inspections concerned  with the personnel reliability assurance program were heavily focused on  records review, especially at Air Force nuclear units. During each  inspection, inspectors would review hundreds of personnel files and  medical records to assess whether the commander and medical staff had  made the correct decision in determining an individual to be reliable. Air  Force officials told us that commanders and their medical staffs could be  found deficient for improperly certifying individuals as reliable even if  these individuals had been able to perform their duties without any  issues—for example, after routine medical procedures like a regular  check-up with an eye doctor. As a result, commanders and medical staff  at these units implemented additional procedures beyond those outlined  in DOD guidance, such as temporarily suspending personnel from  Personnel Reliability Program duties for every off-base medical  appointment regardless of whether it could affect their reliability.  Additionally, according to the Internal Assessment of the Department of  Defense Nuclear Enterprise, inspectors also cited minor administrative  deficiencies that were unrelated to personnel reliability, such as using the  improper color of ink to fill out a form.

To address the recommended improvements identified by the 2014  nuclear enterprise reviews, DOD has updated its inspection procedures.  The Joint Staff has updated the Nuclear Weapons Technical Inspections  guidance to reduce the frequency of inspections at nuclear units from  every 18 months to every 24 months. DOD’s Defense Threat Reduction  Agency no longer conducts joint inspections with the services but is  responsible for providing oversight of the services’ inspectors on behalf of  the Chairman of the Joint Chiefs of Staff. For the portion of the  inspection concerned with personnel reliability assurance, the updated  guidance de-emphasizes records reviews in favor of focusing on  processes and procedures through observation, interviews, and scenario- based discussions. The Navy and the Air Force have also updated their  inspection procedures to implement these changes in DOD’s guidance.  For example, Air Force inspectors do not conduct records checks unless  the interviews and scenario-based discussions reveal a lack of procedural  knowledge. Similarly, Navy officials stated that Navy inspectors review  additional records as needed if a lack of procedural knowledge is  revealed. To aid the Navy in assessing the overall effectiveness of the  updated inspection procedures, the Navy has opted to also review a  sample of the health records of personnel recently certified or reinstated  into the Personnel Reliability Program.

According to Air Force officials at one nuclear wing that had recently  undergone a Nuclear Weapons Technical Inspection, the changes to  inspection procedures for their personnel reliability assurance programs  that DOD and the Air Force have implemented have had a positive effect.  These officials stated that the increased use of scenario-based  discussions and knowledge checks, combined with inspectors taking a  less adversarial and more conversational discussion approach to their  inspection inquiries, has resulted in an environment where personnel feel  more comfortable self-disclosing problems or mistakes, and where the  focus of the inspection is on process improvement rather than on  identifying administrative errors, independent of whether the errors were  substantive deficiencies.

DOD has taken steps to improve the defense nuclear enterprise in  response to the 2014 nuclear enterprise reviews and the 2015 NC3  report. The processes CAPE has developed to track and evaluate  continuing progress to improve the defense nuclear enterprise—including  changes in DOD’s and the military services’ approaches to administering  their personnel reliability assurance programs—provide a good  framework for continually monitoring the department’s efforts. This  framework is also a good example of how similar efforts to implement and  oversee actions on department-wide improvements on a wide range of  subjects could be made effectively. By developing additional guidance to  identify and document risks associated with implementing the  recommendations from the 2014 nuclear enterprise reviews and  identifying and communicating performance measures, milestones, and  risks for the 2015 NC3 report recommendations, the department— particularly through the NDERG and the Oversight Council for NC3— would be better positioned to ensure that progress continues to be made,  underlying problems are addressed, and risks are mitigated or accepted  after considering the predictable and desirable results.

We are making the following two recommendations to DOD:  CAPE, in coordination with the military departments and other DOD  entities serving as offices of primary responsibility for implementing the  recommendations, develop additional guidance for these offices to  identify associated risks and document information about these risks in  the centralized tracking tool. (Recommendation 1)

DOD CIO—in coordination with CAPE, the military departments, Joint  Staff, and U.S. Strategic Command—as the draft template and any other  additional tools to aid in their approach are finalized, identify and  communicate to NC3 stakeholders performance measures and  milestones to assist in tracking the progress of implementation of the  recommendations from the 2015 NC3 report and evaluating the outcomes  of implementation actions, and risks associated with the implementation  of the recommendations from the 2015 NC3 report. (Recommendation 2)

We provided a draft of the classified report to DOD for comment. In its  comments, reproduced in appendix I, DOD concurred with both of our  recommendations. In response to our first recommendation, DOD  indicated that the Director, CAPE, will issue supplementary guidance for  the relevant DOD components to identify and document key risks related  to implementation of recommendations from the 2014 reviews, risks  related to implementation of alternate approaches, and potential  unintended consequences. In response to our second recommendation,  DOD stated that DOD CIO will work with the stakeholders of the Council  on Oversight of the National Leadership Command, Control, and  Communications System to identify and document performance  measures and milestones associated with progress toward the  recommendations from the 2015 NC3 report, as well as the risks related  to implementation of these recommendations. We are encouraged that  DOD is planning to take these actions and believe that, once they have  been completed, the department will be better positioned to ensure that  progress in implementing the recommendations from both the 2014  nuclear enterprise reviews and the 2015 NC3 report continues to be  made, underlying problems within the defense nuclear enterprise are  addressed, and risks are mitigated or accepted after deliberate  consideration. DOD also provided technical comments, which we  incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, and to the Secretary of Defense; the Under Secretary of  Defense for Acquisition, Technology, and Logistics; the Chairman of the  Joint Chiefs of Staff; the Secretaries of the Army, of the Navy, and of the  Air Force; the Commandant of the Marine Corps; the Commander, U.S.  Strategic Command; the Department of Defense Chief Information  Officer; and the Director of the Office of Cost Assessment and Program  Evaluation. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov  If you or your staff have any questions about this report, please contact  me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Defense

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, key contributors to this report  were Penney Harwell Caramia, Assistant Director; Chris Cronin; R. Scott  Fletcher; Jonathan Gill; Brent Helt; Douglas Hunker; Joanne Landesman;  Marc Molino; Amie Lesser; Pamela Davidson; and Michael Shaughnessy.

Nuclear Weapons Sustainment: Budget Estimates Report Contains More  Information than in Prior Fiscal Years, but Transparency Can Be  Improved. GAO-17-557. Washington, D.C.: July 20, 2017.

Nuclear Weapons: DOD Assessed the Need for Each Leg of the Strategic  Triad and Considered Other Reductions to Nuclear Force. GAO-16-740.  Washington, D.C.: September 22, 2016.

Defense Nuclear Enterprise: DOD Has Established Processes for  Implementing and Tracking Recommendations to Improve Leadership,  Morale, and Operations. GAO-16-597R. Washington, D.C.: July 14, 2016.

Nuclear Weapons Sustainment: Improvements Made to Budget Estimates  Report, but Opportunities Remain to Further Enhance Transparency.  GAO-16-23. Washington, D.C.: December 10, 2015.