Controls Over Firearms and Other Sensitive Assets OFFICE OF INSPECTOR GENERAL October 25, 2017 DHS OIG HIGHLIGHTS DHS’ Controls Over Firearms and Other Sensitive Assets October 25, 2017 What We Found Why We Did This Audit Component personnel do not always safeguard sensitive assets that, if lost, would result in critical mission impact or loss of life. Between fiscal years 2014 and 2016, the Department of Homeland Security personnel lost a total of 2,142 highly sensitive assets — 228 firearms; 1,889 badges; and 25 secure immigration stamps. Although this represents a slight improvement from our last audit, more than half of the lost items we reviewed (65 of 115) revealed that component personnel did not follow policy or used poor judgment when safeguarding these assets. In these cases, components did not always hold personnel accountable nor did they receive remedial training for failing to safeguard these sensitive assets. Since issuing the 2010 Office of Inspector General report, DHS’ Controls over Firearms, lost or stolen Federal firearms continue to be used to commit serious crimes. We conducted this follow-up audit to determine whether DHS implemented effective controls to ensure component personnel properly safeguard firearms and other sensitive assets to prevent loss, theft, or unauthorized use. What We Recommend We made six recommendations to improve the tracking and safeguarding of sensitive assets. For Further Information: Furthermore, components are not effectively tracking sensitive assets, and practices surrounding non-law enforcement badges may be resulting in unnecessary risk. These issues are caused in part by insufficient guidance, but also because DHS lacks reliable data and oversight to effectively manage the program. Without oversight and policy improvements, highly sensitive assets will continue to be subject to loss or theft and the safety of the general public will be at risk. DHS Response DHS concurred with all six of our recommendations and has already implemented corrective actions, resulting in the resolution and closure of recommendation 3. The remaining recommendations are considered open and resolved. Contact our Office of Public Affairs at (202) 254-4100, or email us at DHS-OIG.OfficePublicAffairs@oig.dhs.gov www.oig.dhs.gov OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov October 2 5 , 2017 MEMORANDUM FOR: The Honorable Claire M. Grady Senior Official Performing the Duties of the Deputy Secretary Department of Homeland Security FROM: John Roth ~ ...... Inspector General SUBJECT: DHS' Controls Over Firearms and Other Sensitive Assets \,.,.,~\(_o~ Attached for your action is our final report, DHS' Controls Over Firearms and Other Sensitive Assets. We incorporated the formal comments from the Department in the final report. The report contains six recommendations aimed at improving the program's overall effectiveness. DHS concurred with all six of our recommendations and has already implemented corrective actions, resulting in the resolution and closure of recommendation #3. The remaining recommendations are considered open and resolved. Once your office has fully implemented the recommendations, please submit a formal closeout letter to us within 30 days so that we may close the recommendations. The memorandum should be accompanied by evidence of completion of agreed upon corrective actions and of the disposition of any monetary amounts. Please send your response or closure request to OIGAuditsFollowup@oig.dhs.gov. Consistent with our responsibility under the Inspector General Act, we will provide copies of our report to congressional committees with oversight and appropriation responsibility over the Department of Homeland Security. We will post the report on our website for public dissemination. Please call me with any questions, or your staff may contact John E. McCoy II, Acting Assistant Inspector General for Audits, or Donald Bumgardner, Deputy Assistant Inspector General for Audits, at (202) 254-4100. Attachment OFFICE OF INSPECTOR GENERAL Department of Homeland Security Table of Contents Background .................................................................................................... 1 Results of Audit ............................................................................................. 3 Components Do Not Properly Safeguard Sensitive Assets ....................... 4 Components Do Not Effectively Track Sensitive Assets ........................... 6 Insufficient Guidance over Badges May Be Contributing to Significant Losses and Resulting in Unnecessary Risk............................................. 8 Department Needs to Improve Oversight and Enforce Policy ................ 10 Conclusion ......................................................................................... 11 Recommendations......................................................................................... 11 Appendixes Appendix A: Objective, Scope, and Methodology ................................. 15 Appendix B: Department’s Comments to the Draft Report .................... 17 Appendix C: FY 2014–2016 Components’ Lost Firearms, Badges, and Stamps ….. ...................................................................... 20 Appendix D: Office of Audits Major Contributors to This Report ........... 21 Appendix E: Report Distribution .......................................................... 22 Abbreviations CAPSIS CBP ECD ICE OCRSO TSA USCIS www.oig.dhs.gov Consolidated Asset Portfolio and Sustainability Information System U.S. Customs and Border Protection Estimated Completion Date U.S. Immigration and Customs Enforcement Office of Chief Readiness Support Officer Transportation Security Administration U.S. Citizenship and Immigration Services OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Background As the Nation’s largest law enforcement agency, the Department of Homeland Security maintains an inventory of sensitive law enforcement equipment that, if lost, could pose a danger to the public or significantly impact the Department’s mission. Sensitive assets are defined as all items, regardless of value, that require special control due to unusual rates of loss, theft, or misuse. Such assets include weapons, ammunition, explosives, law enforcement equipment, and secure immigration stamps.1 Figure 1: DHS Sensitive Assets The Department faced challenges in the past safeguarding sensitive assets. In 2010, the Office of Inspector General published the audit, DHS’ Controls over Firearms (OIG-10-41), which determined that Department personnel did not adequately safeguard its firearms; losing 289 handguns, rifles, and shotguns over a 3-year period. We recommended that DHS implement department-wide policies and procedures for safeguarding and controlling firearms. DHS satisfied the recommendations in 2013, Source: DHS OIG implementing new policy, additional monitoring controls, and an enhanced data system for accountable assets.2 Department’s Role in Managing Sensitive Assets The Office of Chief Readiness Support Officer (OCRSO) is responsible for managing the Personal Property Asset Program across the Department. OCRSO is charged with providing oversight by setting policy, conducting program reviews, and recommending corrective action to components. At the end of 2016, the Department reported approximately 2.6 million accountable assets in its inventory costing more than $27 billion, of which approximately $2 billion represent the Department’s most highly sensitive assets. The Department determines an asset’s level of sensitivity by evaluating the potential impact a loss could have on the safety, security, and operation of the Department’s mission. DHS classifies assets as level one through five. Level one assets are the most sensitive and, if lost, would result in a critical mission impact or loss of life. Our review focused on the following level one assets: 1 Secure immigration stamps are used to document admission or denial to the United States and other immigration services. The stamps are issued with security ink to prevent counterfeiting false impressions. 2 Accountable property is either: (1) an asset with an expected useful life of 2 years or longer and an asset value of $5,000 or more; (2) that is classified as sensitive; (3) for which accountability or property control records are maintained; (4) or otherwise warrants tracking in the property system of record. www.oig.dhs.gov 1 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security firearms; badges;3 and secure immigration stamps. Table 1 shows the total number of these assets across the Department. Table 1: Total Firearms, Law Enforcement Badges, and Stamps Component Firearms Customs and Border Protection Immigration and Customs Enforcement United States Coast Guard United States Secret Service Federal Law Enforcement Training Centers National Protection and Programs Directorate Federal Emergency Management Agency Science and Technology Directorate U.S. Citizenship and Immigration Services Total 99,920 82,262 46,140 15,999 10,674 2,966 713 417 - 259,091 Badges 140,879 17,715 80 14,033 18 1,161 317 0 - 174,203 Stamps 24,436 43,027 67,463 Source: DHS OIG analysis of component-generated property management data as of June 2017. We did not test the reliability of this data and are presenting the information as provided. We did not include the number of firearms and law enforcement badges for Transportation Security Administration because the information is protected Sensitive Security Information under 49 CFR 1520.5(b)(8(ii)). Policy and Procedures for Personal Property Management In 2013, OCRSO issued the Personal Property Asset Management Program Manual to provide components with uniform standards, policies, and procedures to manage personal property. The policy established specific requirements to ensure proper accountability, tracking, and reporting of all sensitive assets. Appendix F of the manual contains the DHS Firearms Policy, which provides additional safeguarding instruction and clarification for firearms. Specifically, it requires components to establish procedures for safe storage of issued firearms. The component’s procedures must account for safeguarding firearms both on and off duty, as well as the use of a safety locking device. In addition, components must ensure that all law enforcement officers receive annual training in accountability and safeguarding of firearms. Personal Property Data System The Department created the Consolidated Asset Portfolio and Sustainability Information System (CAPSIS) as DHS’ system of record and to provide visibility over its assets. CAPSIS is a centralized data warehouse populated from each component’s personal property system. It is not used for inventory purposes, but rather as a tool that enables DHS to monitor compliance with policy and procedures through monthly reporting requirements. 3 Badges for purposes of our review include badges and credentials because not all components track the items individually. www.oig.dhs.gov 2 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Crimes Committed with Sensitive Assets Figure 2: CBS Local News San Francisco Even with new controls designed to strengthen the security of sensitive assets, lost or stolen Federal firearms continue to be used to commit serious crimes. For instance, a media article reported a September 2015 robbery in which an attacker killed a man with an Source: http://sanfrancisco.cbslocal.com Immigration and Customs Enforcement (ICE) firearm that was stolen from an unattended vehicle. The ICE agent failed to properly secure the weapon inside the vehicle in a high crime area (figure 2). We conducted this follow-up audit to determine whether the Department implemented effective controls to ensure components properly safeguard firearms and other sensitive assets to prevent loss, theft, or unauthorized use. Results of Audit Component personnel do not always safeguard sensitive assets to prevent loss, theft, or unauthorized use. DHS maintains an inventory of law enforcement equipment and other sensitive assets that, if lost, would result in critical mission impact or loss of life. Between fiscal years 2014 and 2016, Department personnel lost a total of 2,142 highly sensitive assets — 228 firearms; 1,889 badges; and 25 secure immigration stamps. Although this amount is a slight improvement from our last audit, more than half of the 115 lost cases that were reviewed revealed that component personnel lost firearms, badges, and secure immigration stamps due to poor safeguarding practices. In these cases, components did not always hold officers4 accountable nor did officers receive remedial training for failing to safeguard these sensitive assets. Furthermore, components are not effectively tracking sensitive assets, and practices surrounding non-law enforcement badges may be resulting in unnecessary risk. These issues are caused in part by insufficient guidance, but also because DHS lacks reliable data and oversight to effectively manage the program. Without oversight and policy improvements, highly sensitive assets will continue to be subject to loss or theft and the safety of the general public will be at risk. 4 This term includes both law enforcement and non-law enforcement officers. www.oig.dhs.gov 3 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Components Do Not Properly Safeguard Sensitive Assets Components are not always safeguarding sensitive assets. The Department lost a total of 228 firearms; 1,889 badges;5 and 25 immigration stamps between fiscal years 2014 and 2016 (see appendix C for a breakdown by component). Specifically, of the 115 lost case files reviewed, 65 officers (57 percent) did not properly safeguard their sensitive asset, 27 did not include sufficient detail to determine whether the officer properly safeguarded the asset, and 23 occurred due to circumstances beyond the officer’s control or despite reasonable precautions taken. Additionally, officers were not always held accountable or did not receive remedial training for failing to safeguard these sensitive assets. As a result, DHS assets have fallen into the hands of criminals and been used to commit crimes, putting the public at risk. Component Personnel Used Poor Judgment Safeguarding Sensitive Assets In the 65 cases, officers either disregarded policy or used poor judgment. According to the Department’s policy, sensitive assets must receive a higher level of safety and security. Each employee is obligated to properly care for, handle, and protect governmentFigure 3: Results from 115 Case Files issued assets at or away from the office. Firearms and other sensitive assets must be properly secured to prevent loss, damage, theft, and unauthorized use at all times. Figure 3 shows the breakdown of the types of assets reviewed that were not properly safeguarded. Source: DHS OIG analysis of component lost case files. Assets were typically lost or stolen from vehicles, residences, or public locations. Component policy requires firearms to be secured using a safety locking device or any reasonable measures when left unattended. The following are descriptions of the most egregious circumstances surrounding some of the losses in which officers did not follow policy or take reasonable measures to safeguard assets: x Two off duty ICE officers left their firearms unsecured and unattended in backpacks while on a beach in Puerto Rico. When the officers returned the bags were gone. x An ICE officer left his firearm, badge, and credential unsecured in his hotel room while on vacation. As he slept, his overnight guest stole his belongings. Lost badge totals included both law enforcement and non-law enforcement badges since components do not make the distinction on the lost reports. 5 www.oig.dhs.gov 4 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security x A Customs and Border Protection (CBP) officer left his backpack containing his wallet and government badge in an unlocked public gym locker. When he returned, his belongings were gone. x A CBP officer left his firearm in a bag at a friend’s house. When he returned 2 days later, the gun could not be located. x A Transportation Security Administration (TSA) officer left his firearm in a bag in the backseat of his vehicle while having dinner with his family. The rear passenger side window was shattered and the bag was taken. x A CBP officer left his firearm and other law enforcement equipment in an unlocked vehicle overnight. The following day he realized his firearm and two magazines were no longer in the vehicle. x A U.S. Citizenship and Immigration Services (USCIS) officer did not secure her immigration stamp in the provided lockbox and did not know the asset was missing until the time of the annual physical inventory. In 27 cases, the file did not include sufficient detail to determine whether the officer properly safeguarded the asset. The Department requires a Report of Survey be submitted to record the circumstances surrounding the loss. Officers are also required to file a police report upon discovery of a lost or stolen firearm; however, the policy does not require police reports to be included with the file. Case files with police reports attached provided greater detail than the Report of Survey alone. Without the appropriate level of detail, reviewing officials cannot make an informed decision whether the officers followed policy when securing their assets. Officers Not Always Held Accountable for Poor Safeguarding Figure 4: Disciplinary Action in 65 Assets Not Safeguarded Components do not always hold officers accountable for failing to safeguard sensitive assets. Of the 65 cases in which officers did not safeguard their sensitive assets, 22 officers (34 percent) did not receive any disciplinary action, and 9 officers (14 percent) only received oral counseling. Figure 4 provides a breakdown of the disciplinary action taken in the 65 cases reviewed. Source: DHS OIG analysis of component disciplinary Additionally, none of the officers received action data. any type of remedial training for failing to safeguard sensitive assets. Although, www.oig.dhs.gov 5 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security the Department’s policy does not require officers to attend remedial training, at a minimum, training reinforces component’s policy on proper behavior and conduct. Each component is responsible for setting its own table of penalties and disciplinary action is left to the supervisor’s discretion. Without proper disciplinary action and training, officers may misinterpret poor safeguarding as acceptable behavior and these practices will go uncorrected. The Department has a responsibility to oversee the program and take corrective action to ensure compliance with safeguarding requirements. DHS Sensitive Assets Found in the Hands of Criminals DHS cannot ensure its sensitive assets do not fall into the hands of criminals or pose additional risk to national security and public safety. In fact, of the cases we reviewed, police recovered three firearms and one badge from convicted felons. Police recovered one firearm from an individual in possession of heroin; another from a suspect charged with attempted armed robbery; and the last from a convicted felon at a pawn shop. Police recovered a badge during a raid nearly 2 years after it was reported missing. Components Do Not Effectively Track Sensitive Assets Components do not effectively track and record sensitive assets. Specifically, components did not update property records or track secure immigration stamps and security ink in a system of record as required by policy. Without accurate inventory records, components may not be able to locate an asset. Components Did Not Have Accurate Property Records Components did not have accurate property records at the 21 locations tested. We conducted physical inventory verifications of 3,961 randomly selected firearms, badges, and secure immigration stamps; and found 454 assets (11 percent) did not match the name or physical location of the information recorded in the component’s inventory system. According to DHS policy, property records must be updated no later than 7 business days from when the asset changes users, the property is moved from one area to another, or when the asset has been disposed. The policy also requires components to include a physical location for firearms. Without accurate property records, components may not be able to locate an asset, which may cause it to appear lost. The following are instances of sensitive assets that could not be immediately located or were found in the wrong location during physical inventory verifications: x At a CBP regional armory, 208 firearms could not be physically located. The property custodian researched the situation, and approximately 2 www.oig.dhs.gov 6 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security weeks later provided documentation of the actual physical locations for each firearm, which included various lockers and storage vaults across CBP’s field offices. x At a USCIS office, officials could not locate a secure immigration stamp recorded as unassigned in the component’s inventory. Further review of property receipts indicated the asset was assigned to an immigration officer nearly 5 months earlier, but the property custodian never updated the inventory. x At a TSA office, 11 firearms stored in the storage vaults were not included on the inventory. The property custodian had possession of some of the firearms for more than a year without updating the property records. x At a CBP office, the property custodian was unable to immediately locate firearms from the inventory. After searching the facility, the property custodian discovered the firearms in a random file cabinet, stored haphazardly in boxes (see figure 5). Figure 5: Unassigned Firearms in File Cabinet Source: DHS OIG photo taken during site visit. However, not all locations visited were disorganized (figure 6 illustrates some best practices observed during physical inventory verifications). Figure 6: General Observations during Physical Inventory Verifications Unassigned Firearms Vault Vehicle Lockbox Secure Stamp Lockers Source: DHS OIG photos taken during site visit. www.oig.dhs.gov 7 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security CBP Did Not Track Secure Immigration Stamps in an Official System CBP does not track secure immigration Figure e 7: CBP Secure Immigration St Stamp a stamps in an official inventory system as required by the Department’s policy, and instead uses informal Excel spreadsheets. In addition, CBP does not record any information regarding security ink. Officers assigned to Ports of Entry are issued secure stamps and security ink to Source: e: CBP Guidebook document admission into the United States and prevent counterfeit impressions (see figure 7). The Department’s policy requires all sensitive assets to be tracked in an official system of record. However, CBP is not following the Department guidance. During the review, CBP issued an email to all local property officers requiring secure immigration stamps and security ink to be uploaded into CBP’s system of record, the Firearms, Armor, and Credentials Tracking System. Since these assets are categorized as highly sensitive and can be a threat to public safety or national security if lost or stolen, proper tracking is critical to ensure they are controlled and accounted for to prevent unauthorized use. Without using an official tracking system, DHS cannot ensure CBP is complying with physical inventory requirements or reporting these assets when lost or stolen. Insufficient Guidance over Badges May Be Contributing to Significant Losses and Resulting in Unnecessary Risk Components lost 8 times as many badges as firearms — 1,889 and 228, respectively. Although the size and nature makes it more susceptible to loss, the Department’s lack of guidance may also be a contributing factor. The Department’s policy requires components to account for safeguarding firearms both on and off duty; however, the same detailed requirements are not provided for badges. More than 50 percent (38 of 75) of the badges in our sample were lost off duty. These losses occurred at a variety of public venues including sporting events, grocery stores, and amusement parks. Lost and stolen badges potentially allow criminals or terrorists unauthorized access to secure areas and sensitive information, and provide the means to impersonate law enforcement officials. Components issue badges to both law enforcement and non-law-enforcement personnel. However, not all components classify non-law enforcement badges as a level one sensitive asset. The Department’s policy does not specify how non-law enforcement badges should be classified. ICE and USCIS consider these badges to be a level three asset, but CBP assigns a level one to all www.oig.dhs.gov 8 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security badges. Level three assets are not inventoried, tracked, or reported with the same rigor as level one law enforcement badges. TSA classifies the badges as security sensitive property and does not use the Department’s classification system. As illustrated in figure 8, badges issued to non-law enforcement personnel look similar to law enforcement badges and, if lost, pose the same risk. Figure 8: Non-Law Enforcement vs. Law Enforcement Badge TSA ICE CBP USCIS & LOCAL Non-Law Enforcement Law Enforcement Source: DHS OIG analysis of component provided photos. Since USCIS does not have law enforcement badges, we used the City of Bakersfield’s police badge for comparative purposes (www.bakersfieldcity.us/gov/depts/police). Each badge, regardless of who it is issued to, poses a risk of loss, theft, or unauthorized use if not properly safeguarded. Components have approximately 137,942 non-law enforcement badges, ranging in cost from $40 to $75 per badge, as listed in table 2. Components issue non-law enforcement badges to a variety of positions that do not have arrest authority, for example: x x x x CBP Agriculture Specialists, Import Specialists, and Attorneys; ICE Attorneys and Intelligence Officers; TSA Transportation Security Officers, Managers, and Inspectors; and USCIS Immigration Officers. The Department has not assessed the need, nor has it required components to submit justifications for non-law enforcement badges, although some officers may not use them. For example, during a site visit to a USCIS service center, a senior immigration official said that Immigration Officers in positions that approve or deny applications without meeting with the public do not use their badge. As of July 2017, the Department spent approximately $6 million on non-law enforcement badges. Components plan to hire a significant number of new employees in the upcoming years. If DHS discontinues the use of these badges, it could potentially save millions while also reducing unnecessary risk. www.oig.dhs.gov 9 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Components may also save an unmeasurable amount of time and resources spent inventorying, tracking, and recording non-law enforcement badges. Table 2: Component Non-Law Enforcement Badge Cost as of July 2017 Component CBP ICE TSA USCIS Total Badge Count 6,040 1,800 120,000 10,102 137,942 Badge Cost $56 $58 $40 $75 Total Cost $338,240 $104,400 $4,800,000 $757,650 $6,000,290 Source: DHS OIG analysis of component inventory data and badge cost information. Badge cost includes the cost of the badge and other associated costs such as, credential shell, credential case, and laminate. Department Needs to Improve Oversight and Enforce Policy The Department lacks effective oversight to ensure components are complying with all critical property management policies. Specifically, DHS did not have reliable data, did not enforce policy, or conduct adequate reviews. As a result, DHS cannot make strategic property management decisions or ensure components are properly tracking and safeguarding all sensitive assets. Incomplete and Unreliable Property Management Data The Department does not have complete and accurate property management data to provide effective oversight and make informed decisions. As the responsible official for managing the Department’s sensitive assets, OCRSO must have a complete picture of the total number of sensitive assets across all components. OCRSO uses CAPSIS as a tool to manage its assets; however, the system did not contain complete and accurate information. For instance, CAPSIS data was missing the following: x x x x firearms, badges, and credentials inventory information for TSA and United States Coast Guard; secure immigration stamp inventory information for CBP; serial numbers for some reported lost or stolen assets; and submission and adjudication dates for some Reports of Surveys. DHS Did Not Enforce Policy DHS also did not ensure components submit required reports, such as annual inventory certifications and asset accountability control plans. DHS requires components to submit these reports to outline additional internal controls over sensitive assets and to certify an annual inventory was completed. Although DHS established these requirements as a way to provide oversight, it did not hold components accountable when information was not submitted. www.oig.dhs.gov 10 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security In addition, when OCRSO did receive the reports, it did not always conduct a thorough review. Reports had obvious math errors and inconsistencies that warranted additional follow up. Even though OCRSO officials stated that they do not have resources to thoroughly review or correct issues with CAPSIS data, the information in these reports is critical to effectively manage sensitive property and prevent losses. Conclusion The highly sensitive nature and potential for public harm intensifies the significance of each lost firearm, badge, and secure immigration stamp. It is crucial for DHS officers entrusted to protect the public to set the standard by adhering to policy and properly safeguarding high-risk assets. The Department needs to strengthen its policy and improve oversight to better ensure it can make well-informed and cost-efficient property management decisions. Additionally, all levels must work together to successfully reduce the number of losses and protect the public’s safety. Recommendations Recommendation 1: We recommend that the Under Secretary for Management strengthen the Personal Property Asset Management Program Manual. At a minimum, the policy should: x require that each component establish procedures for (a) the safeguarding of all level one assets including procedures for safeguarding during on and off duty time, and (b) issuance of safety locking devices and policies on their use, as applicable; x require additional safeguarding training for individuals who do not properly safeguard sensitive assets; x provide examples of level of detail that should be recorded on the Report of Survey and require supervisors to adhere to the standards set; and x as applicable, require police reports to be submitted along with the Report of Survey and be included in the lost case file. Recommendation 2: We recommend that the Under Secretary for Management require components to re-train property custodians and employees on timeframes for updates to the property inventory records. Recommendation 3: We recommend that the Under Secretary for Management ensure that CBP complies with the Department’s policy to track, inventory, and record secure immigration stamps and security ink in an official system of record. www.oig.dhs.gov 11 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Recommendation 4: We recommend that the Under Secretary for Management standardize law enforcement and non-law enforcement badges as a level one asset and require components to safeguard these assets accordingly. Recommendation 5: We recommend that the Under Secretary for Management require that components assess the need and submit justifications to the Department for badges issued to non-law enforcement personnel and recommend components discontinue the use of non-law enforcement badges without adequate justification. Recommendation 6: We recommend that the Under Secretary for Management improve the oversight activities by specifically requiring the Office of Chief Readiness Support Officer to: x x leverage component internal inspection units as a force multiplier to ensure inventory and property reporting requirements are followed; and summarize all component Lost Damaged Destroyed data semiannually and disseminate results throughout the Department to increase awareness and remind officers to properly safeguard all sensitive assets. DHS Comments and OIG Analysis In its response to our draft report, DHS concurred with all six of our report recommendations. We incorporated the Department’s comments, responses to our recommendations, and our analysis with the applicable recommendations in the report. We also included a copy of the management comments in their entirety in Appendix B. DHS also provided technical comments to our draft report, which we considered in our analysis. DHS reported that it remains committed to exploring ways to further the progress made in strengthening their policy and oversight of the Department’s personal property assets. For example, the Department continues to work closely with each component through the Personal Property Committee, led by OCRSO, which meets on a bi-monthly basis in a collaborative forum to provide guidance, discuss policy, and coordinate current and planned initiatives. DHS Response to Recommendation 1: Concur. The DHS OCRSO will work with components to develop updated policy, require procedures to implement that policy, and implement training for components that are non-compliant. Estimated Completion Date (ECD): June 30, 2018. OIG Analysis: The Department’s corrective action is responsive to the recommendation. The recommendation will remain open and resolved until the Department provides evidence to support that corrective actions are completed. www.oig.dhs.gov 12 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security DHS Response to Recommendation 2: Concur. OCRSO will provide direction and guidance to components to re-train property officials and employees, as applicable, on DHS policy regarding updates to personal property records. ECD: June 30, 2018. OIG Analysis: The Department’s corrective action is responsive to the recommendation. The recommendation will remain open and resolved until the Department provides evidence to support that corrective actions are completed. DHS Response to Recommendation 3: Concur. The U.S. Customs and Border Protection’s Office of Facilities and Asset Management recently provided evidence to support that it is now compliant with this requirement. OIG Analysis: The OIG reviewed the documentation provided and confirmed that CBP is compliant with the Department’s policy to track, inventory, and record secure immigration stamps and security ink in an official system of record. As a result, we consider this recommendation closed and resolved. DHS Response to Recommendation 4: Concur. OCRSO will update the DHS Personal Property Asset Management Program Manual to identify law enforcement and non-law enforcement badges as an Equipment Control Class 1 level asset to be safeguarded accordingly. ECD: June 30, 2018. OIG Analysis: The Department’s corrective action is responsive to the recommendation. The recommendation will remain open and resolved until the Department provides evidence to support that corrective actions are completed. DHS Response to Recommendation 5: Concur. DHS leadership agrees that a review is necessary to determine the need for non-law enforcement badges. OCRSO will work with the DHS Headquarters offices and components to determine the appropriate office to lead the review and develop a process for obtaining and reviewing justifications, as appropriate. ECD: September 30, 2018. OIG Analysis: The Department’s corrective action is responsive to the recommendation. The recommendation will remain open and resolved until the Department provides evidence to support that corrective actions are completed. DHS Response to Recommendation 6: Concur. OCRSO will work with each component to identify their respective internal inspection units and review the assessments conducted by these units for compliance with inventory and property reporting requirements. For example, USCIS plans to create an Office of Professional Responsibility, which will include an Inspection Division responsible for ensuring that, among other things, inventory and reporting requirements are satisfied. OCRSO will also consolidate lost, damaged, and www.oig.dhs.gov 13 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security destroyed data on a semi-annual basis and report these results throughout the Department. ECD: June 30, 2018. OIG Analysis: The Department’s corrective action is responsive to the recommendation. The recommendation will remain open and resolved until the Department provides evidence to support that corrective actions are completed. www.oig.dhs.gov 14 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix A Objective, Scope, and Methodology The Department of Homeland Security Office of Inspector General was established by the Homeland Security Act of 2002 (Public Law 107ï296) by amendment to the Inspector General Act of 1978. This discretionary audit was included in our FY 2017 annual performance plan and is a follow-up review to the OIG report, DHS’ Controls over Firearms (OIG-10-41). We conducted this audit to determine whether the Department has implemented effective controls to ensure components properly safeguard firearms and other sensitive assets to prevent loss, theft, or unauthorized use. We limited our review to high-risk assets that, if lost, have the potential impact of loss of life and critical mission impairment. We selected firearms, badges, credentials, and secure immigration stamps. To achieve our objective, we reviewed Federal, departmental, and component guidance on personal property management, including the DHS Personal Property Asset Management Program Manual. We interviewed Headquarters officials from DHS Office Chief Readiness and Support Office; U.S. Customs and Border Protection; U.S. Immigration and Customs Enforcement; Transportation Security Administration; United States Secret Service; Federal Emergency Management Agency; National Protection and Programs Directorate; Federal Law Enforcement Training Centers; United States Coast Guard; U.S. Citizenship and Immigration Services; and Science and Technology Directorate. We reviewed the CAPSIS database and component inventory data to determine the Department’s inventory of sensitive assets. We identified incomplete and inaccurate CAPSIS data; therefore, we determined that the CAPSIS data was unreliable and instead used component data to determine the total inventory of selected sensitive assets. We tested the reliability of component-generated data during fieldwork and found some inaccurate property records as discussed in the report. Nevertheless, we determined the information was sufficiently reliable to support the audit’s conclusions. We reported law-enforcement badges and credentials as a combined total because some components do not track these assets separately in the inventory system. Using risk assessment we selected four components, CBP, ICE, TSA, and USCIS for additional testing. We evaluated risk factors such as total inventory, total lost and stolen assets, and policies and procedures. To perform the physical inventory tests, we conducted a total of 21 site visits to the selected component field offices in Dallas, TX; Los Angeles, CA; and San Diego, CA. We also visited component firearm armories in Atlantic City, NJ; Altoona, PA; and Harpers Ferry, WV. At each location we conducted a physical inventory of www.oig.dhs.gov 15 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security assigned and unassigned assets using component inventory data. We compared randomly selected assets with the component’s official inventory system of record and noted any discrepancies. Additionally, we observed safeguarding practices, when possible. We reviewed the CAPSIS data to identify the reported cases of lost firearms, badges, and secure immigration stamps. We performed limited testing to verify the accuracy of the CAPSIS information for lost assets. Specifically, we compared the serial number field in CAPSIS to the serial numbers from component’s source data and determined the data sufficiently reliable. From the CAPSIS data, we selected 115 case files and obtained component source documentation to conduct a more in-depth review. Table 3 provides a breakdown of case files reviewed. Table 3: Total Number of Case Files Reviewed for Each Component Component Badges Firearms Stamps CBP 53 12 0 ICE 12 14 0 TSA 10 12 0 USCIS 0 0 2 Total 75 38 2 Total 65 26 22 2 115 Source: DHS OIG case file sample. Specifically, we reviewed each case file to determine circumstances surrounding the loss and to verify compliance with reporting requirements. We based our safeguarding conclusions using component source data and not from CAPSIS-generated information. Additionally, we requested the disciplinary action of our cases from each component. We did not conduct an in-depth analysis of components’ discipline policy or process. We conducted this performance audit between October 2016 and August 2017, pursuant to the Inspector General Act of 1978, as amended, and according to generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based upon our audit objectives. www.oig.dhs.gov 16 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix B Department’s Comments to the Draft Report www.oig.dhs.gov 17 OIG-18-05 ART OFFICE OF INSPECTOR GENERAL (?inset Department of Homeland Security "ry i0 Attachment: DHS Management Response to Recommendations Contained in Project No. OIG-17-010-AUD-DHS The OIG recommended that the DHS Under Secretary for Management: Recommendation 1: Strengthen the Personal Property Asset Management Manual. At a minimum, the policy should: 0 require each component establish procedures for the safeguarding of all level one assets including procedures for safeguarding during on- and off-duty time and issuance of safety locking devices and policies on their use, as applicable; 0 require additional safeguarding training for individuals who do not properly safeguard sensitive assets; 0 provide examples of level of detail that should be recorded on the Report of Survey and require supervisors to adhere to the standards set; and as applicable, require police reports to be submitted along with the Report of Survey and be included in the lost case ?le. Response: Concur. The DHS OCRSO will work with Components to develop updated policy, require procedures to implement that policy, and implement training for Components that are non-compliant. Estimated Completion Date (ECD): June 30, 2018. Recommendation 2: Require Components to re?train property custodians and employees on timeframes for updates to the property inventory records. Response: Concur. OCRSO will provide direction and guidance to Components to re- -train property of?cials and employees, as applicable, on DHS policy regarding updates to personal property records. ECD: June 30,2018. Recommendation 3: Ensure that CBP complies with the Department?s policy to track, inventory, and record secure immigration stamps and security ink in an of?cial system of record. Response: Concur. The US. Customs and Border Protection?s (CBP) Of?ce of Facilities and Asset Management has noted that it is now compliant with this requirement. OCRSO will obtain documentation to con?rm this and forward it to the Of?ce of Inspector General. ECD: December 31, 2017. Recommendation 4: Standardize law enforcement and non-law enforcement badges as a level one asset and require Components to safeguard these assets accordingly. Response: Concur. OCRSO will update the DHS PPAMM to identify law enforcement and non-law enforcement badges as an Equipment Control Class 1 level asset to be safeguarded accordingly. ECD: June 30, 2018. Recommendation 5: Require that Components assess the need and submit justi?cations to the Department for badges issued to non-law enforcement personnel and recommend components discontinue the use of non-law enforcement badges without adequate justi?cation. oig. dhs. gov 1 8 OIG- 1 8-05 ART Ll "Ty a0 OFFICE OF INSPECTOR GENERAL ?at-mow Department of Homeland Security Response: Concur. DHS leadership agrees that a review is necessary to determine the need for non-law enforcement badges. OCRSO will work with the DHS Headquarters of?ces and Components to determine the appropriate of?ce to lead the review and develop a process for obtaining and reviewing justi?cations, as appropriate. ECD: September 30, 2018. Recommendation 6: Improve the oversight activities by speci?cally requiring the Of?ce of Chief Readiness Support Of?cer to: leverage component internal inspection units as a force multiplier to ensure inventory and property reporting requirements are followed; and summarize all component Lost Damaged Destroyed data semi-annually and disseminate results throughout the Department to increase awareness and remind of?cers to properly safeguard all sensitive assets. Response: Concur. OCRSO will work with each Component to identify their respective internal inspection units and review the assessments conducted by these units for compliance with inventory and property reporting requirements. For example, USCIS plans to create an Of?ce of Professional Responsibility, which will include an Inspection Division responsible for ensuring that, among other things, inventory and reporting requirements are satis?ed. OCRSO will also consolidate lost, damaged, and destroyed data on a semi-annual basis and report these results throughout the Department. ECD: June 30, 2018. oig. dhs. gov 1 9 OIG- 1 8-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix C FY 2014–2016 Components’ Lost Firearms, Badges, and Stamps CBP ICE TSA USCIS Total Universe Percent Firearm Badge Stamp 103 956 0 47 250 N/A 28 538 N/A N/A 61 25 178 1,805 25 228 1,889 25 78% 96% 100% Totals 1,059 297 566 86 2,008 2,142 94% Source: DHS OIG analysis of CAPSIS data. www.oig.dhs.gov 20 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix D Office of Audits Major Contributors to This Report Yesenia Starinsky, Director Lindsey Koch, Audit Manager Barry Bruner, Auditor Audrey Van, Auditor Michael Scoffone, Auditor Felipe Rodriguez, Auditor Amber Carlson, Program Analyst Kevin Dolloson, Communications Analyst Thomas Hamlin, Communications Analyst Ebenezer Jackson, Independent Referencer www.oig.dhs.gov 21 OIG-18-05 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix E Report Distribution Department of Homeland Security Secretary Deputy Secretary Chief of Staff General Counsel Executive Secretary Director, GAO/OIG Liaison Office Assistant Secretary for Office of Policy Assistant Secretary for Office of Public Affairs Assistant Secretary for Office of Legislative Affairs DHS Component Liaison Office of Management and Budget Chief, Homeland Security Branch DHS OIG Budget Examiner Congress Congressional Oversight and Appropriations Committees www.oig.dhs.gov 22 OIG-18-05 Additional Information and Copies To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov. Follow us on Twitter at: @dhsoig. OIG Hotline To report fraud, waste, or abuse, visit our website at www.oig.dhs.gov and click on the red "Hotline" tab. If you cannot access our website, call our hotline at (800) 323-8603, fax our hotline at (202) 254-4297, or write to us at: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Hotline 245 Murray Drive, SW Washington, DC 20528-0305