GAO Covert Testers Use Counterfeit Law-Enforcement Credentials and Forged Building Passes to Breach Federal Buildings (2000-2009)

What happened

Contrary to the framing that this was one recurring 2011 to 2015 GAO program targeting the Capitol and documented in GAO-13-370, the public record shows three distinct GAO engagements between 2000 and 2009, run by two different parts of the agency with two different methods, plus a later set of oversight reports that discuss continued weaknesses without disclosing new breach specifics.

In April and May 2000, the General Accounting Office's Office of Special Investigations bought unauthorized law-enforcement badges on the open market, printed matching credentials, and sent undercover agents who declared themselves armed officers into 19 federal sites and 2 commercial airports. They penetrated all 21, 18 on the first attempt and 3 on a second visit, and their badges were never challenged (GAO/T-OSI-00-10).

In February and March 2002, at the request of the House Committee on Government Reform, agents tested five federal office buildings in Atlanta and breached four. The method was not a badge at a checkpoint. A counterfeit law-enforcement credential and a pretext were used on the office that issues building passes, which produced a genuine pass and an after-hours access code. The team then forged copies of that pass for the rest of the group, cleared the checkpoints on the forgeries, and finally used a forged pass to obtain a second genuine pass, this one carrying the insignia that authorizes its bearer to carry a firearm inside the buildings (GAO-02-668T; House Government Reform hearing, April 30, 2002; GAO-04-133T).

In April and May 2009, a differently designed test carried the components of an improvised explosive device through screening at 10 Level IV federal facilities in four cities. No credential deception was involved. The investigators showed their own genuine state driver's licenses at ordinary visitor screening and put their briefcases on the X-ray belt, and the guards detected nothing. That engagement was run by GAO's Physical Infrastructure Issues team, and the July 2009 testimony reporting it (GAO-09-859T) was explicitly preliminary. The final report is GAO-10-341, April 2010.

GAO's later reports (GAO-11-813T, GAO-12-739, GAO-13-694, GAO-14-235T, GAO-14-623T, GAO-15-445) tracked FPS's contract guard oversight, training, certification and risk assessment problems. Only GAO-15-445 reports covert-test passage rates, and only it explains the withholding: it is the public version of a report DHS and DOJ marked For Official Use Only, and it omits covert and intrusion testing data, the types of tests used, and the names and locations of the buildings visited. GAO-12-739 contains no covert-testing content at all. None of these reports names the U.S. Capitol as a tested site. GAO-13-370T is unrelated: it is February 2013 testimony on DHS's progress after nearly 10 years in operation, and contains no covert testing.

How it worked

The 2000 and 2002 engagements are the credential cases, and they are not the same attack.

In 2000 the deception ran directly at the guard. Teams of two, occasionally three, walked up to a checkpoint, declared themselves law enforcement officers, named a purported agency, stated that they were armed, and in most cases showed a bogus badge and a bogus credential. Sometimes only one agent had to show anything and the guard waved the second one in behind him. In every case they were waved around or through the magnetometer with neither person nor valise screened. The badges came from public sources and included a movie prop police badge and a drug task force badge in similitude to a genuine one. The identification was made with a standard computer graphics program, an ink-jet printer, photographs and a laminator, and GAO recorded that the credentials it created bore no likeness to any genuine law-enforcement credential.

In 2002 the fake credential was aimed at the pass-issuing clerk instead. An agent with no pass used a pretext to get into a building past the magnetometer, met the General Services Administration employee responsible for issuing building passes, and walked out with a genuine yellow pass and an after-hours access code. The next day the same pass got him past screening at a second building, where a GSA contract employee issued him a blue pass and an evening access code for two more buildings, along with the round insignia that tells the marshals its bearer may carry a firearm. The team then copied both passes with commercially available software, inserting their undercover names and photographs, and entered three buildings on the forgeries. The forged holograms were printed images, flat, and would not shift in the light. GAO stated that a physical inspection should have caught them. Nobody inspected them. A later pretext produced a security guard's personal after-hours code, which GAO's investigator described in the hearing as conning the guard into revealing it, and which would have made any after-hours entry trace back to the guard rather than to the intruders. The full loop, in the investigator's own summary to the committee, was a ruse into genuine passes, forgeries made from those, entry on the forgeries, and a genuine pass obtained on the strength of a forgery.

The 2009 test belongs in this file as a contrast, not as a third badge case. The investigators presented their real driver's licenses and walked through the magnetometers like any visitor. Their briefcases containing the IED material went along the X-ray belt and were missed. No secondary search was performed at any of the 10 facilities. At 3 of the 10, the investigators noticed the guard was not looking at the X-ray screen while the components went through. At one facility a guard did question an item in a briefcase, and the material was allowed through anyway. Two of the ten were leased buildings with no guard at the access control point at the time of the test. Investigators then assembled the device in a restroom, in some cases asking employees to let them into locked ones, and walked several floors with it in a briefcase. Nothing about the entry was social engineering. The control that failed was screening.

The lure and the tell

In 2000 the lure was a badge plus a confident verbal claim of armed law-enforcement status, and the record shows the claim itself was the whole of it: at no time were the bogus credentials or badges challenged by anyone. GAO reports one behavior that made the lure cheaper, which is that in some cases a single badge admitted two people. The report draws no psychological conclusion about groups, and neither should we; the observation about one badge covering a second person is GAO's, the inference about confidence displays would be ours.

The reliable tell in 2000 was procedural: no officer arriving on federal business is exempt from having a credential verified, and no visitor bypasses screening on a verbal claim. In 2002 the tell was physical and sitting in plain view, a hologram that did not behave like a hologram, on a pass worn in a plastic pocket that obscured it. In 2009 there was no tell to catch, because nothing presented was false. That is the point of including it.

Outcome

2000: all 21 sites penetrated, 19 federal and 2 airports, 18 on the first attempt. Agents reached the hallway outside a cabinet secretary or agency head's suite at 15 of the 16 sites that had one, entered the suite on all 5 attempts, and at 15 sites entered a restroom near those offices where a valise could have been left. At a federal courthouse they were waved through a magnetometer unscreened, escorted to a gun box room, left alone in it, and told to lock up their weapons with nobody watching whether they did. At one historic site a police officer did apply a rule, telling them that as local rather than federal officers they would have to check their firearms in a basement lock box; they said they had no time and left.

2002: four of the five buildings tested were breached, agents moved freely during day and evening hours, and the committee established that not one call was made to check any of the stories that produced the passes and the codes.

2009: all 10 facilities penetrated with real IED components, devices assembled on site and carried through executive and legislative branch offices. GAO suspended further planned tests after reaching 100 percent results. The accompanying video showed investigators passing an access point and tests of assembled IEDs at national laboratories.

Follow-up is where the record turns hard. FPS ran 53 penetration tests of its own in the six regions GAO visited in the year after July 2009. Guards identified the prohibited items, guns, knives and fake bombs, in 18 of them and missed them in 35. The 1,500 guards in one region who had gone without X-ray and magnetometer training since 2004 still had not received it as of January 2010 and were still working at federal facilities. Of the 663 guard files GAO had reviewed, 435 were fully certified by February 2010, 167 were not, and 61 of those guards were no longer on the contract. FPS took no enforcement action against the seven noncompliant contractors and extended their contracts. DHS concurred with seven of GAO's eight recommendations.

Why it matters

In 2000 a fake badge and a stated claim of authority defeated magnetometers, X-ray belts and armed guard posts at 21 consecutive sites, including the CIA, the Pentagon, the FBI and the State Department. In 2002, when agencies had begun refusing unverified law-enforcement claims at the door, the same team simply moved one step upstream and attacked the desk that issues the credentials the door trusts. That escalation is the more instructive half of this case, and it sets a limit on the obvious fix: verifying a pass against the office that issued it does not help when the office issued it to an impostor. It is the physical mirror of business email compromise, where an assumed position of authority short-circuits a control that is otherwise working.

What the case does not support is a claim that this class of vulnerability cannot be closed. GAO's own 2015 report tested two organizations doing the same screening job in federal buildings and got opposite results. FPS protective security officers passed covert tests on security-screening procedures at a low rate from fiscal years 2011 to 2013. Court security officers under the U.S. Marshals Service passed 83 percent of intrusion tests in fiscal year 2010, 91 percent in 2011, and 92 percent in both 2012 and 2013. The two test regimes are different, covert tests for FPS and intrusion tests for USMS, so the numbers are not strictly comparable and USMS did not meet its own per-building test frequency requirement. But a screening force in the same buildings, tested more often, passed roughly nine times in ten. The lesson that survives the evidence is narrower and more useful than the one usually drawn: outcomes tracked how seriously an organization ran its own testing and used the results, not whether guard-post screening is inherently defeatable.

Defenses

The 2001 follow-up is the cautionary part of the remediation record, and its caveat matters more than its headline. All 43 agencies and airports GAO surveyed responded. Thirty-seven reported specific policy or procedural changes: many of them said that only armed officers on official business may enter, and that officers not on official business must surrender weapons for secure storage and be screened as ordinary visitors. Some began requiring officers on official business to be escorted at all times. Two said they were developing a smart card system that would electronically verify an officer's identity. Four agencies reported making no changes at all, saying their existing procedures were adequate, and two gave nonspecific answers. GAO then wrote the sentence that a red-team case should always quote: it did not verify whether the reported security enhancements actually occurred. The only public record of what changed in 2001 is what the audited agencies said about themselves.

After 2009, according to FPS officials, FPS authorized overtime so guard posts could be inspected outside routine business hours and began running its own penetration tests at access control points. A March 2009 policy directive standardizing inspection requirements across regions predates the July testimony and was accelerated rather than prompted by it. X-ray and magnetometer training was revised afterward, in August 2009: a required DVD on bomb component detection, and a new requirement of 16 hours of training for guards rather than 8, with GAO noting that guards would not all be fully trained until the end of 2010 while remaining deployed.

The durable controls this case argues for: screening applies to everyone with no exception for stated authority; the pass-issuing desk is an access control point and its stories get checked; passes get physically inspected, because the forgeries here were detectable by eye; escorts mean escorts; and covert-test results are analyzed nationally rather than filed at the building where the test failed.