Publicly Released: December 12, 2022
The objective of this audit was to determine whether the Defense Counterintelligence and Security Agency completed DoD security vetting (vetting) of International Military Students (IMS) enrolled in U.S.-based training programs, and their accompanying family members (accompanying family), according to DoD policy and communicated the results of its analysis to appropriate DoD stakeholders.
The DoD typically trains more than 20,000 IMS annually at military institutions in the United States. IMS include any foreign national who is nominated or accepted for training or education on a DoD installation or facility in the United States. IMS may bring accompanying family, such as their spouse or children, to live with them when training in the United States. Examples of DoD training that IMS attend include courses on disaster response, flying aircraft, and explosive ordnance disposal.
The stakeholders responsible for coordinating or implementing DoD vetting requirements for IMS and their accompanying family include the Defense Security Cooperation Agency (DSCA), the Defense Counterintelligence and Security Agency (the Screening Center), the Military Departments, and Security Cooperation Organizations (SCO).
The Screening Center communicated 100 percent of its IMS vetting results to all relevant DoD stakeholders. Specifically, we determined that the Screening Center prepared reports containing derogatory information.
However, the Screening Center did not complete vetting and continuous reviews, as required by DoD policy, for all IMS participating in U.S.-based training programs. Specifically, the Screening Center did not perform vetting procedures for 2 of the 59 IMS we reviewed, in accordance with DoD guidance. This occurred because two SCOs did not provide all the biographic information that the Screening Center requires to vet an IMS. Additionally, the two SCOs issued travel orders to the IMS although the vetting was not complete. This allowed these two IMS to travel to their DoD training location without first being vetted as required by DoD guidance. We also found that the Security Cooperation-Training Management System (SC-TMS), the computer system the DoD uses for managing IMS and issuing travel orders, did not have sufficient internal controls to prevent these SCOs from incorrectly issuing the travel orders before the Screening Center completed vetting.
We also determined the Screening Center did not complete on-time continuous reviews for 54 of the 57 IMS we reviewed. This occurred because the DSCA and the Screening Center did not have procedures for communicating when these continuous reviews were due.
As a result of the Screening Center’s effective communication of IMS vetting results, the DoD prohibited four high-risk and one moderate-risk IMS from attending U.S.-based training. However, because the Screening Center did not vet all the IMS in our sample prior to the IMS traveling to the United States, the DoD experienced increased risk that it could have granted credentialed recurring access (CRA) to an IMS who posed a threat to U.S. personnel. Because the Screening Center did not complete on-time continuous reviews, there was also an increased risk that the DoD would not detect behavior indicating that an IMS who was previously granted CRA had radicalized and posed a threat to U.S. personnel.
We recommend that the Director of the DSCA direct his staff to:
- develop internal controls which will prevent an SC-TMS user from issuing a travel order to an IMS before the Screening Center reports favorable vetting results; and
- develop and implement a formal procedure establishing that DSCA personnel must alert the Screening Center when continuous review of an IMS needs to begin.
Management Actions Taken
During the audit, we told DSCA officials that an internal control weakness existed in the IMS vetting process, specifically, that SC-TMS users could issue travel orders to an IMS before the Screening Center completed its vetting. The officials agreed with our observation and explained that the DSCA was developing a capability that would render the function used to issue travel orders in SC-TMS inoperable until the Screening Center reported favorable vetting results. On October 19, 2022, DSCA personnel showed us various scenarios to demonstrate that this function was operational. F or example, D SCA personnel tried to issue a travel order to multiple IMS for whom the Screening Center had not completed vetting. SC-TMS prevented issuance of the travel order and displayed a message on screen that the lack of vetting was the reason. Based on our observation, we concluded that the capability to block travel order issuance until after vetting was complete was operating as intended. This action addressed our concern; therefore, the recommendation is closed.
We also told DSCA officials that a weakness existed in informing the Screening Center when continuous reviews were due for completion. The officials agreed with our observation and in March 2022, DSCA personnel began sending a list of IMS due for continuous review to the Screening Center. A Screening Center official confirmed that the DSCA began sending a list of upcoming continuous reviews every 3 weeks. The DSCA Chief of International Military Training Education division formally documented this procedure in a memorandum for record addressed to the DSCA’s SC-TMS development team and product owner. We analyzed a nonstatistical sample of 50 continuous reviews that the Screening Center completed in July 2022, which is after the DSCA implemented our recommendation. The DSCA’s actions addressed our concern and had an immediate impact on the timeliness of continuous reviews; therefore, the recommendation is closed.
This report is a result of Project No. (Project No. D2021-D000RG-0124.000).