GAO and the 201 Exercises That Blinded Washington to Conventional Terror

By Harlan Pryce ·

In 1999, an audit of 201 federal drills found a systemic failure to prepare for no-notice attacks and conventional weapons, leaving a gap in readiness that persisted until 2001.

The people who die in the gap between a plan and a practice are never the ones who wrote the plan. For the victims of conventional terror, the cost of a scheduled drill is a body count that could have been avoided if the state cared more about reality than its own checklists.

What survives in the archive is a curated description of the record rather than the full report pages. The record is a June 1999 report from the U.S. General Accounting Office—the federal agency within the legislative branch that provides auditing and investigative services to Congress in an independent capacity—published in Washington, D.C., the federal capital. The document provides a statistical autopsy of 201 counterterrorism exercises conducted in the three years following the signing of Presidential Decision Directive 39, the policy mandate designed to coordinate the federal response to terrorism.

The WMD Mirage

Of the 201 exercises audited by the GAO, the record finds that "more than two-thirds of the scenarios dealt with weapons of mass destruction (WMD)," while the remaining third focused on conventional weapons and explosives. This distribution is not a neutral statistical fact; it is a map of the American security state's imagination. Washington was not preparing for the world as it was, but for a ghost story from the Cold War.

The preoccupation with WMDs reveals a hidden line connecting the U.S. security apparatus to its obsession with the collapse of the Soviet Union. The public record establishes that the Federal Security Service (FSB)—the principal security agency of Russia and the main successor to the KGB—inherited the remnants of a superpower's nuclear and chemical arsenal. The fear that this hardware would migrate into the hands of non-state actors drove the policy priorities of the late nineties. By focusing on the FSB's legacy and the specter of a suitcase nuke, the U.S. government effectively ignored the low-tech, high-impact tools of conventional terror.

The pattern suggests that the preoccupation with WMD scenarios created a strategic blind spot for conventional attacks. When two-thirds of your training is dedicated to the apocalypse, a truck bomb or a hijacked aircraft looks like a footnote. The record shows a government that was so afraid of the extraordinary that it became incompetent in the face of the probable.

Document imagery from nsarchive.gwu.edu From the files: nsarchive.gwu.edu

No-Notice Failures

Preparation is not the same as readiness. The GAO report notes a critical flaw in the 201 exercises: "few of the exercises involved ‘no-notice’ deployments of personnel and resources." In the world of the auditor, this is a procedural deficiency. In the world of the target, it is a death sentence.

A "no-notice" deployment is the only metric that matters in a real-world crisis. It is the difference between a staged performance and a stress test. If an agency knows the drill is coming, it can move its best people into place, clear the schedules, and ensure the paperwork is tidy. It creates a curated image of competence that satisfies a supervisor in Washington, D.C., but fails the citizen on the street.

The desk's reading is that operational readiness was treated as a compliance exercise rather than a stress test of actual agility. The agencies were not training to fight terrorists; they were training to pass a GAO audit. By avoiding the chaos of the unplanned, the federal government built a facade of security that relied on the assumption that the enemy would provide a schedule. This institutional preference for the predictable over the possible is the hallmark of a bureaucracy that values the appearance of control over the reality of protection.

Crisis vs. Consequence

Even when the drills did occur, they were fractured by an institutional schism. The record finds that "very few of these exercises dealt simultaneously with the twin issues of crisis management—stopping the attack—and consequence management—caring for the injured."

This distinction is the core of the failure. Crisis management is the domain of the operator—the agent, the soldier, the intelligence officer tasked with neutralizing the threat. Consequence management is the domain of the responder—the medic, the firefighter, the emergency manager tasked with the wreckage. By treating these as separate exercises, the U.S. government admitted that its left hand did not know what its right hand was doing.

If the agencies tasked with stopping a bomb do not train alongside the agencies tasked with treating the blast victims, the result is a catastrophic failure of coordination. The pattern suggests a deep institutional schism existed between the agencies tasked with neutralizing threats and those tasked with disaster recovery. This was not a mere lack of scheduling; it was a reflection of a hierarchy that prioritized the "hunt" over the "heal." The record reveals a security state that viewed the injured not as the primary objective of the mission, but as a secondary logistical problem to be handled after the "real" work of crisis management was complete.

The PDD-39 Gap

The GAO report was not an isolated warning; it was part of a series of audits. Only days after this analysis, the GAO published further "Observations on Growth in Federal Programs" regarding counterterrorism. The overarching reality was that the mandates of PDD-39 were not reaching the field.

The gap between the policy mandates of PDD-39 and actual field implementation was known but not corrected. The GAO's role was to audit 201 exercises and find systemic procedural failures, but the report does not record a corrective pivot. It records a state of affairs: the exercises were too narrow, too scheduled, and too fragmented. The record shows that the federal government had the data to know it was unprepared for a conventional, no-notice attack that required simultaneous crisis and consequence management, yet it continued to run the same flawed drills.

If this file is shaped the way it looks, the withheld pages and the subsequent inaction protect a specific kind of professional vanity. To admit that 201 exercises were fundamentally flawed would be to admit that the entire counterterrorism architecture of the late nineties was a performance. It is more comfortable to maintain the fiction of readiness than to endure the embarrassment of a total overhaul.

The desk's reading is that the 1999 GAO report represents a lost opportunity to redefine American security. By ignoring the warnings about the WMD blind spot and the failure of no-notice readiness, the administration ensured that when the conventional attack finally arrived in 2001, the response would be exactly what the drills had practiced: fragmented, slow, and dangerously disconnected from the human cost on the ground. The people who paid for this institutional vanity were not the auditors in Washington, D.C., but the thousands who fell into the gap where the plan ended and the reality began.

Sources

  1. GAO,Combating Terrorism: Analysis of Federal Counterterrorist Exercises, June 1999, (Washington, D.C.: U.S. General Accounting Office, 1999). — National Security Archive (GWU)
  2. Document PDF (GAO,Combating Terrorism: Analysis of Federal Counterterrorist Exercises, June 1999, (Washington, D.C.: U.S. General Accounting Office, 1999).)
  3. Background: Federal Security Service — Wikipedia