GAO says the Secret Service skipped policy updates after early drone incidents

The Government Accountability Office told Congress on 3 September that the Secret Service does not consistently write down why a security incident is allowed to pass without a change in protection policy. The report, GAO-26-108455, covers fiscal years 2015 through 2025. In that window the agency logged 83 incidents and updated policy after 25 of them.

GAO contact on the study is Nathan Tranquilli. The findings that will travel are the drone ones. The Service saw civilian drone incidents in 2015, 2016 and 2021. It did not rewrite protection policy for civilian drones after any of those three. The rewrite came after July 2024, when Thomas Crooks flew a drone to map the Butler, Pennsylvania, rally site hours before he shot at Donald Trump.

What the forms do not capture

A May 2026 incident-reporting rule, OPO-19, gives personnel seven days to file a form that includes whether an immediate policy change was made. The form does not require a written reason when the answer is no. Officials told GAO that the missing reason would matter, because it would show the incident had been fully read. Without it, later reviewers cannot tell a considered decision from a shrug.

The Service could not even find forms for four incidents, two of them in fiscal 2018 and 2024 at the White House complex and at a protected site of then-former President Trump in Nashville. After GAO asked, officials said in April 2026 that they were building a cleaner intake method. A Protective Readiness section was stood up in 2025. Guidance issued in February 2026 tells the agency to watch incidents continuously for repeated risks, on top of the annual reviews already on the books.

Advance plans that aged out

Appendix tables in the report list 22 domestic and foreign advance-planning policies. As of July 2026, eight of those 22 had not been updated or reauthorized inside the four-year window the Service set for itself. One vice-presidential foreign-advance policy still carried an effective date of 16 July 2001.

DHS sent a management reply on 18 August. The department said it welcomed the review. Separate inspector-general work earlier in 2026 had already flagged weak cyber practice on agents phones and delays in counter-drone kit. Those papers are not this GAO study. Together they describe an agency that writes new sections after a shock and lets older sections sit.

The Butler drone is the political fact that made the older 2015, 2016 and 2021 incidents look different in hindsight. GAO is saying the Service should not need hindsight to fill in a reason box. That is a paperwork recommendation with a body count behind it.