What We Did:
The objective of this audit was to determine whether the Defense Counterintelligence and Security Agency completed DoD security vetting (vetting) of International Military Students (IMS) enrolled in U.S.-based training programs, and their accompanying family members (accompanying family), according to DoD policy and communicated the results of its analysis to appropriate DoD stakeholders.
What We Found:
The Screening Center communicated 100 percent of its IMS vetting results to all relevant DoD stakeholders. Specifically, we determined that the Screening Center prepared reports containing derogatory information.
However, the Screening Center did not complete vetting and continuous reviews, as required by DoD policy, for all IMS participating in U.S.-based training programs. Specifically, the Screening Center did not perform vetting procedures for 2 of the 59 IMS we reviewed, in accordance with DoD guidance. This occurred because two SCOs did not provide all the biographic information that the Screening Center requires to vet an IMS. Additionally, the two SCOs issued travel orders to the IMS although the vetting was not complete. This allowed these two IMS to travel to their DoD training location without first being vetted as required by DoD guidance. We also found that the Security Cooperation-Training Management System (SC-TMS), the computer system the DoD uses for managing IMS and issuing travel orders, did not have sufficient internal controls to prevent these SCOs from incorrectly issuing the travel orders before the Screening Center completed vetting.
We also determined the Screening Center did not complete on-time continuous reviews for 54 of the 57 IMS we reviewed. This occurred because the DSCA and the Screening Center did not have procedures for communicating when these continuous reviews were due.
As a result of the Screening Center’s effective communication of IMS vetting results, the DoD prohibited four high-risk and one moderate-risk IMS from attending U.S.-based training. However, because the Screening Center did not vet all the IMS in our sample prior to the IMS traveling to the United States, the DoD experienced increased risk that it could have granted credentialed recurring access (CRA) to an IMS who posed a threat to U.S. personnel. Because the Screening Center did not complete on-time continuous reviews, there was also an increased risk that the DoD would not detect behavior indicating that an IMS who was previously granted CRA had radicalized and posed a threat to U.S. personnel.
What We Recommend:
We recommend that the Director of the DSCA direct his staff to:
• develop internal controls which will prevent an SC-TMS user from issuing a travel order to an IMS before the Screening Center reports favorable vetting results; and
• develop and implement a formal procedure establishing that DSCA personnel must alert the Screening Center when continuous review of an IMS needs to begin.