> **Concept of Operations for\
> Testing In-Transit Container\
> Security Enhancements**
>
> Preliminary Version P.1
>
> White Paper

SSD-PL-03-0330

May 2003

*Prepared for:*

![](media/image1.png){width="2.19375in" height="0.31875in"}

*U.S. Department of Transportation*

*Federal Motor Carrier Safety Administration*

*400 Seventh Street, SW*

*Washington, DC 20590*

*Prepared by:*

![](media/image2.wmf){width="0.5833333333333334in"
height="0.7555555555555555in"}

*The Johns Hopkins University*

*Applied Physics Laboratory*

*11100 Johns Hopkins Road*

*Laurel, MD 20723-6099*

**Preliminary Version**

It is important to note that this is a preliminary document. All
sections included are complete and have been reviewed by The Johns
Hopkins University Applied Physics Laboratory (JHU/APL) but not by other
Department of Transportation (DOT) contractors or state/federal
government agencies. The purpose of this issue is to obtain comments and
feedback on this document from those external organizations before a
baseline version is published.

This document is disseminated in the interest of information exchange.
JHU/APL assumes no liability for its contents or use thereof. This
report does not constitute a standard, specification, or regulation.
JHU/APL does not endorse products or manufacturers. Trade and
manufacturer's names appear in this report only because they are
considered essential to the object of this document.

Please send comments to:

> Ms. Valerie B. Barnes
>
> JHU/APL
>
> 118 Park Avenue
>
> Chambersburg, PA 17201
>
> Phone/FAX: 717-261-0635
>
> E-mail: valerie.barnes@jhuapl.edu

**Change Summary:** Concept of Operations for Testing In-Transit
Container Security Enhancements

  ------------ ------------------------------------------------- ---------
  Date         Type                                              Version

  31 Mar 2003  Draft Issue -- for Concept of Operations for      D.1
               In-Transit Container Security                     

  14 April     Second Draft Issue -- Incorporated changes in     D.2
  2003         response to comments received on D.1.             

  7 May 2003   First Preliminary Issue -- Incorporated changes   P.1
               in response to comments received on D.2. Changed  
               title of document.                                
  ------------ ------------------------------------------------- ---------

**Concept of Operations for Testing In-Transit Container\
Security Enhancements**

# Preface {#preface .unnumbered}

There are at least four components of a secure intermodal freight
system: assured integrity of container loading and documentation; secure
transit; accurate, complete, and timely information about the shipments
that is protected from disclosure to unauthorized users; and an adequate
government infrastructure that can screen information about container
shipments and inspect any container that raises a security concern.
**This concept of operations (ConOps) focuses on the second component:
secure transit.** The other components are no less important.

In addressing efforts to test and evaluate ways to reduce the risk of
tampering with a container in transit, the ConOps focuses on testing
options for business practices and exploring the use of technology where
appropriate. Although it would also contribute to reduced tampering,
this ConOps does not address how to assure that only authorized
personnel handle the container, nor does it address performing
background checks on those personnel.

The U.S. Department of Transportation (DOT) Intelligent Transportation
Systems Joint Program Office and the Federal Highway Administration
(FHWA) sponsored the development of this ConOps primarily to assure that
ongoing and upcoming operational tests sponsored by FHWA were moving in
a sensible direction regarding the use of seals or other technologies on
intermodal containers. The U.S. Department of Homeland Security (DHS)
Bureau of Customs and Border Protection (CBP) is expected to use this
ConOps in some of their initiatives/tests (e.g., Customs-Trade
Partnership Against Terrorism). The Transportation Security
Administration may also use this ConOps in Operation Safe Commerce. DOT
had the lead for transportation and freight security matters with
Customs prior to the creation of DHS. After this ConOps is complete, DHS
CBP is expected to assume the leadership role for follow-on activities,
with DOT playing a supporting role.

The ideas expressed in this document are proposed for consideration in
tests that are focused on improving in-transit container security.
Wherever the potential use of technology is discussed, the reader is
cautioned to also consider factors such as product maturity and costs
versus benefits when selecting products for testing. Security technology
is dynamic and there are constant changes to the threat and operational
environment in the post-9/11 world, making it impossible to specify what
processes and technologies might be appropriate for tests in the future.
Lessons learned from ongoing container security tests and initiatives
are expected to help refine this ConOps.

This Page Intentionally Blank

**Concept of Operations for Testing In-Transit Container\
Security Enhancements**

**Table of Contents**

[Preface iii](#preface)

[1. Scope 1--1](#scope)

[1.1 Identification 1--1](#identification)

[1.2 Document Overview 1--1](#document-overview)

[1.3 System Overview for Testing 1--2](#system-overview-for-testing)

[2. References 2--1](#references)

[3. Current Situation 3--1](#current-situation)

[3.1 Background, Objectives, and Scope
3--1](#background-objectives-and-scope)

[3.2 Overview of Existing Policies and Constraints
3--1](#overview-of-existing-policies-and-constraints)

[3.3 Description of the Current Situation
3--1](#description-of-the-current-situation)

[3.4 Modes of Operation Today 3--2](#modes-of-operation-today)

[3.5 Stakeholders 3--2](#stakeholders)

[4. Motivation for Improvement 4--1](#motivation-for-improvement)

[4.1 Security Vulnerabilities and Gaps
4--1](#security-vulnerabilities-and-gaps)

[4.2 Desired Goals and Potential Countermeasures
4--4](#desired-goals-and-potential-countermeasures)

[4.3 Priority Goals and Countermeasures
4--6](#priority-goals-and-countermeasures)

[4.4 Goals and Countermeasures Considered but Not Included
4--7](#goals-and-countermeasures-considered-but-not-included)

[5. Concepts for the Proposed Approach to Testing
5--1](#concepts-for-the-proposed-approach-to-testing)

[5.1 Background, Objectives, and Scope
5--2](#background-objectives-and-scope-1)

[5.2 Operational Policies and Constraints
5--3](#operational-policies-and-constraints)

[5.3 Description of the Proposed System for Testing
5--4](#description-of-the-proposed-system-for-testing)

[5.4 Modes of Operation 5--7](#modes-of-operation)

[5.5 User Classes 5--8](#user-classes)

[6. Operational Test Scenarios 6--1](#operational-test-scenarios)

[6.1 Check and Document Status of Container, Seal, and Sensors
6--2](#check-and-document-status-of-container-seal-and-sensors)

[6.1.1 Container, Seal, and Sensors are Checked; No Security Problem
6--3](#container-seal-and-sensors-are-checked-no-security-problem)

[6.1.2 Container, Seal, and Sensors are Checked; Security Problem
6--3](#container-seal-and-sensors-are-checked-security-problem)

[6.2 Transfer Container 6--4](#transfer-container)

[6.2.1 Transfer Container; No Security Problem
6--4](#transfer-container-no-security-problem)

[6.2.2 Transfer Container; Security Problem
6--5](#transfer-container-security-problem)

[6.3 Container Reports Status Autonomously
6--6](#container-reports-status-autonomously)

[6.3.1 Container Reports Status; No Security Problem
6--7](#container-reports-status-no-security-problem)

[6.3.2 Container Reports Status; Security Problem
6--7](#container-reports-status-security-problem)

[6.4 Check Information About Container
6--8](#check-information-about-container)

[6.4.1 Information is Checked; No Security Problem
6--9](#information-is-checked-no-security-problem)

[6.4.2 Information is Checked; Security Problem
6--9](#information-is-checked-security-problem)

[6.5 Perform Non-Intrusive Inspection
6--10](#perform-non-intrusive-inspection)

[6.5.1 Non-Intrusive Inspection Performed; No Security Problem
6--11](#non-intrusive-inspection-performed-no-security-problem)

[6.5.2 Non-Intrusive Inspection Performed; Security Problem
6--11](#non-intrusive-inspection-performed-security-problem)

[6.6 Open Seal, Check Container Contents
6--12](#open-seal-check-container-contents)

[6.6.1 Seal and Container are Opened; No Security Problem
6--13](#seal-and-container-are-opened-no-security-problem)

[6.6.2 Seal and Container are Opened; Security Problem
6--13](#seal-and-container-are-opened-security-problem)

[6.7 Container Arrives at Destination
6--14](#container-arrives-at-destination)

[6.7.1 Container Arrives at Destination and is Unpacked; No Security
Problem
6--15](#container-arrives-at-destination-and-is-unpacked-no-security-problem)

[6.7.2 Container Arrives at Destination; Security Problem
6--15](#container-arrives-at-destination-security-problem)

[7. Summary of Impacts 7--1](#summary-of-impacts)

[8. Analysis of the Proposed System to be Tested
8--1](#analysis-of-the-proposed-system-to-be-tested)

[8.1 Summary of Goals and Objectives
8--1](#summary-of-goals-and-objectives)

[8.2 Disadvantages and Limitations 8--1](#disadvantages-and-limitations)

[8.3 Alternatives and Trade-offs Considered
8--2](#alternatives-and-trade-offs-considered)

[9. Acronyms and Abbreviations 9--1](#acronyms-and-abbreviations)

[10. Glossary 10--1](#glossary)

# Scope

There are many possible ways to improve the security surrounding a
container in transit. Ultimately, security will be improved in a layered
approach that may involve better containers, business practices,
education and training, information, communications, and security for
personnel, conveyance, information, and workplaces. The concept of
operations (ConOps) expressed in this document focuses on activities and
technologies that could be explored in upcoming tests to reduce some of
the risk that tampering will occur with a container in transit. The
ConOps is intended for use in testing programs sponsored by U.S.
Department of Transportation (DOT), U.S. Department of Homeland Security
(DHS), and other activities.

Please note that in this document, we use "container" to mean an
intermodal container used in multi-modal commerce, including crossing
borders with Canada and Mexico. Trailers used in cross-border single or
dual-mode freight operations are not addressed in this ConOps, although
some of the outcomes of testing may have applicability in those types of
operations. This ConOps does not address the critical activities that
occur prior to sealing the container, nor all activities associated with
assuring that the information about shipments is complete, accurate,
timely and protected from disclosure to unauthorized users. This ConOps
does address the information associated with monitoring the condition of
the container, seal, and sensors en route.

## Identification

This document is titled *Concept of Operations for Testing In-Transit
Container Security Enhancements*.

## Document Overview

The purpose of this document is primarily to communicate ideas about the
kinds of operational changes and uses of technology in the intermodal
freight container system that could be explored in test programs to
improve in-transit security.

The ConOps is expected to be used by the DOT and DHS in selected tests
and initiatives. The agencies will specify separately what
tests/initiatives will adopt this ConOps. The stakeholders involved in
the operations described in this ConOps include, but are not limited to,
DOT; Bureau of Customs and Border Protection (CBP); Transportation
Security Administration (TSA); originators/shippers; transport operators
(rail, dray, over-the-road, vessel); terminal operators; consignees;
third parties (e.g., freight forwarders); subcontractors (e.g.,
consolidators, deconsolidators); bonded warehouses; law enforcement;
technology vendors; and port authorities. DOT developed the ConOps in
consultation with DHS (CBP and TSA); the American Trucking Associations;
the World Shipping Council; the American Association of Port
Authorities; and other members of the interagency Container Working
Group's Security Technologies Subgroup and the Intermodal Freight
Technology Working Group. Participation of those groups does not imply
that everyone in them agrees with every feature of the ConOps.

The scope of this ConOps starts after a container has been loaded and
sealed, and initial shipping documents have been prepared. The ConOps
scope ends when the container has been opened, and the load has either
been removed or deconsolidated. We use "opened" to mean that a seal has
been compromised or removed; some stakeholders would say, instead, that
the seal is "broken." The ConOps will not address supply chain
vulnerabilities beyond that scope (such as the security of the stuffing
process or the stuffing of boxes loaded into the container).

The ConOps allows for testing a variety of potential technology choices.
It is assumed that different methods may be tested to detect and
indicate tampering with a container. Those methods may include, but are
not limited to: high-security mechanical seals, electronic seals, mobile
wide-area communications, and sensor-equipped containers.

The ConOps characterizes, at a very high level, the post-loading
security gaps and vulnerabilities that exist in today's use of
containers for intermodal shipping. The ConOps recommends a concept of
operations for testing business processes, data, and the use of
available or emerging technology to mitigate specifically identified
aspects of those security gaps or vulnerabilities.

## System Overview for Testing

The ConOps is summarized in Figure 1--1. The figure illustrates the key
elements of the proposed concept of operations for testing in-transit
container security enhancements:

-   The shipper seals the container immediately after it is stuffed. The
    container identifier (ID) and seal ID are recorded on the shipping
    documents. The container may be equipped with sensors that help
    assess the security integrity.

-   Container, sensor, and seal status are documented at hand-offs from
    one conveyance to another. The status may also be documented at
    other points of the journey.

-   The seal could be opened for legitimate reasons before the container
    is unloaded (e.g., for government inspections or repair of
    refrigeration equipment). If the seal is opened, it is subsequently
    resealed, and the shipping documents are updated accordingly to
    maintain a valid chain of custody.

![](media/image1.wmf)

Figure 1--1. ConOps for Testing In-Transit Container Security
Enhancements

This Page Intentionally Blank

# References

1.  Johnston, Roger G., Los Alamos National Laboratory Vulnerability
    Assessment Team, *Tamper-Indicating Seals: Practices, Problems, and
    Standards,* For the World Customs Organization Security Meeting,
    February 11--14, 2003.

2.  []{#ref1 .anchor}Transportation Security Administration, Department
    of Transportation Maritime Administration, *Statement on the
    Security of our Seaports*. William G. Schubert, Maritime
    Administrator Before the Committee on the Judiciary Subcommittee on
    Technology, Terrorism and Government Information, United States
    Senate on the Security of our Seaports, February 26, 2002,
    <http://www.tsa.gov/public/display?content=345>.

3.  Transportation Security Administration, Department of Transportation
    United States Coast Guard, *Statement on Container Security*.
    Captain Anthony Regalbuto on Container Security Before The
    Subcommittee on Coast Guard and Marine Transportation U.S. House of
    Representatives, March 13, 2002,
    <http://www.tsa.gov/public/display?content=364>.

4.  []{#ref3 .anchor}Battelle, *HazMat Safety and Security Field
    Operational Test Task 1: Risk/Threat Assessment*, Executive Summary,
    December 4, 2002,
    <http://www.fmcsa.dot.gov/safetyprogs/fot/ExecSum.doc>.

5.  Holcomb, Henry J., "Area Officials Have Adapted a Tracking System to
    Watch Over U.S. Ships in an Age of Terrorism", *Philadelphia
    Inquirer*, posted on March 12, 2003,
    <http://www.philly.com/mld/inquirer/5369951.htm>.

6.  U.S. Customs Service, Joint Industry Group, *Container Security
    Initiative \[CSI\] Status as of January 22, 2003*,
    <http://www.jig.org/advanced_manifest/container_security.htm>.

7.  []{#ref6 .anchor}Online Office of U.S. Senator Fritz Hollings, South
    Carolina, *Legislative Summary: Maritime Transportation Security Act
    of 2002, S.1214,*
    <http://hollings.senate.gov/~hollings/materials/2002B13856.html>.

8.  []{#Ref7 .anchor}U.S. Department of Transportation, and U.S. Customs
    Service, *DOT and* *Customs Launch 'Operation Safe Commerce'
    Program*, November 20, 2002,
    <http://www.dot.gov/affairs/dot10302.htm> or
    <http://www.customs.ustreas.gov/xp/cgov/newsroom/press_releases/112002/11202002_2.xml>.

9.  []{#Ref8 .anchor}U.S. Maritime Administration, *Cargo Handling
    Cooperative Program*, <http://www.marad.dot.gov/programs/chcp/>.

10. []{#Ref9 .anchor}U.S. Department of Homeland Security, "Border &
    Transportation Security" *Securing Our Borders*,
    <http://www.dhs.gov/dhspublic/interapp/editorial/editorial_0089.xml>.

11. []{#Ref10 .anchor}U.S. Government Accounting Office, *Homeland
    Security: Key Elements of a Risk Management Approach*, GAO-02-150T,
    October 12, 2001, <http://www.gao.gov/new.items/d02150t.pdf>.

12. U.S. Government Accounting Office, *Combating Terrorism: Actions
    Needed to Improve DoD Antiterrorism Program Implementation and
    Management*, GAO-01-909, September 19, 2001, <http://www.gao.gov/>
    \[search on "GAO-01-909"; within those results, search on "Actions
    needed improve DoD antiterrorism"\].

13. Transportation Security Administration, Business Opportunities,
    Current Announcements, *Operation Safe Commerce*,
    <http://129.33.119.130/public/interapp/asset_summary/asset_summary_0122.xml>.

14. Transportation Security Administration, Business Opportunities,
    Current Announcements, *Operation Safe Commerce Cooperative
    Agreement Program*,
    <http://129.33.119.130/public/interapp/asset_summary/asset_summary_0122.xml>.

15. Transportation Security Administration, *Request for Applications
    for the Operation Safe Commerce Cooperative Agreement Program*,
    <http://129.33.119.130/interweb/assetlibrary/OSC_RFA_Final_012203.pdf>.

16. U.S. Government Accounting Office, *Container Security: Current
    Efforts to Detect Nuclear Materials, New Initiatives and
    Challenges*, Testimony by JayEtta Hecker, Director Physical
    Infrastructure Issues, Before the Subcommittee on National Security,
    Veterans Affairs, and International Relations, House Committee on
    Government Reform, GAO-03-297T, November 18, 2002,
    <http://www.securitymanagement.com/library/Gao03297t_Container0203.pdf>.

17. World Shipping Council, *Comments of the World Shipping Council
    Submitted to the DOT TSA Regarding Operation Safe Commerce*,
    December 5, 2002,
    <http://www.worldshipping.org/operation_safe_commerce.pdf>.

18. U.S. Bureau of Customs & Border Protection, *Customs-Trade
    Partnership Against Terrorism (C-TPAT)*,
    <http://www.customs.ustreas.gov/xp/cgov/import/commercial_enforcement/ctpat/>.\
    Contains links to many facets of C-TPAT.

19. []{#ref18 .anchor}U.S. Bureau of Customs & Border Protection,
    *Container Security Initiative*, <http://www.customs.ustreas.gov/>.

20. []{#Ref19 .anchor}U.S. Department of State, International
    Information Programs, *Fact Sheet: U.S. Customs Service's Container
    Security Initiative*, February 22, 2002,
    <http://usinfo.state.gov/topical/pol/terror/02022505.htm>.

21. U.S. Customs Service, "Press Releases 2002", *Fact Sheet: U.S.
    Customs Container Security Initiative Forging Ahead*,
    August 8, 2002,
    <http://www.usconsulate.org.hk/pas/pr/2002/081201.htm>.

22. []{#ref21 .anchor}Wolfe, Michael (North River Consulting Group),
    *Technology to Enhance Freight Transportation Security and
    Productivity*, Intermodal Freight Security and Technology Workshop,
    April 27-29, 2002,
    [http://www.ops.fhwa.dot.gov/freight/publications/Security
    Technology Appendix,
    4-25-02.doc](http://www.ops.fhwa.dot.gov/freight/publications/Security Technology Appendix, 4-25-02.doc).

23. Wolfe, Michael (North River Consulting Group), *Electronic Cargo
    Seals: Context, Technologies, and Marketplace*, July 12, 2002,
    <http://www.ops.fhwa.dot.gov/freight/E-SealWPfinalJul12.htm>.

24. Wolfe, Michael (North River Consulting Group), *Freight
    Transportation Security and Productivity Executive Summary*, Fifth
    EU/US Forum on Intermodal Freight Transport, April 11-13, 2002,
    [http://ops.fhwa.dot.gov/freight/publications/Frt Secur, exec summ,
    4-4-02.doc](http://ops.fhwa.dot.gov/freight/publications/Frt Secur, exec summ, 4-4-02.doc).

25. Washington State Department of Transportation Advanced Technology
    Group, *Electronic Container Seals Field Operational Test --
    Statement of Work, Draft,* submitted to FHWA, July 3, 2002.

26. U.S. Department of Transportation, *WSDOT Intermodal Data Linkages
    Freight ITS Operational Test Evaluation Final Report, Part 1:
    Electronic Container Seals Evaluation, EDL \# 13770*,
    [http://www.itsdocs.fhwa.dot.gov/%5CJPODOCS%5CREPTS_TE%5C/13770.html](http://www.itsdocs.fhwa.dot.gov/JPODOCS/REPTS_TE/13770.html).

27. Testimony of Peter W. Hall, US Attorney, District of Vermont, Before
    the Committee on Governmental Affairs, US Senate, *Concerning Cargo
    Container Security*, March 20, 2003,
    <http://www.senate.gov/~gov_affairs/032003hall.htm>.

28. U.S. Customs Service, *Frequently Asked Questions 24-Hour Advance
    Vessel Manifest Rule*, Revised March 19, 2003,
    <http://www.customs.ustreas.gov/ImageCache/cgov/content/import/carriers/24hour_5frule/24hour_5ffaq_2edoc/v4/24hour_5ffaq.doc>.

29. []{#ref28 .anchor}Science Applications International Corporation,
    *Electronic Intermodal Supply Chain Manifest: Field Operational Test
    Evaluation Draft Final Report,* December 2002,
    [http://www.itsdocs.fhwa.dot.gov/\\JPODOCS\\REPTS_TE\\/13769.html](http://www.itsdocs.fhwa.dot.gov/\JPODOCS\REPTS_TE\/13769.html).

30. []{#Ref29 .anchor}[Webster's New Collegiate Dictionary]{.underline},
    copyright 1981 by G&C Merriam Company in Springfield, MA.

31. []{#Ref31 .anchor}U.S. Department of the Treasury, Customs Service,
    *Presentation of Vessel Cargo Declaration to Customs Before Cargo Is
    Laden Aboard Vessel at Foreign Port for Transport to the United
    States*, Final Rule, 19 CFR Parts 4, 113, and 178; published in the
    Federal Register, Vol 67, No 211, October 31, 2002, pages
    66318-66333; RIN 1515-AD11.

This Page Intentionally Blank

# Current Situation

## Background, Objectives, and Scope

Each year, more than 16 million containers arrive in the U.S. by ship,
truck, and rail. In 2001, U.S. Customs processed more than 5.7 million
sea containers. \[[Reference 21](#ref21)\] With heightened concern about
terrorist activities, the U.S. government has stepped up efforts to
develop and implement policies and procedures to reduce the
vulnerability of the intermodal container transportation system to
terrorist threats.

## Overview of Existing Policies and Constraints

There are currently no laws or regulations requiring that the containers
be sealed or instrumented with sensors to detect tampering. However,
container security has long been a concern within this community,
primarily for the purposes of theft deterrence and identification of
illegal cargo. A variety of technologies, systems, and methods have been
developed and deployed by both government and industry for these
purposes.

Effective 2 December 2002, for shipments coming into the U.S., carriers
and/or automated Non Vessel Owning Common Carriers (NVOCC) must submit a
cargo declaration 24 hours before cargo is laden aboard the vessel at a
foreign port. The CBP requires the information to evaluate the risk of
smuggling weapons of mass destruction (WMD) through the use of
oceangoing cargo containers and to facilitate the prompt release of
legitimate cargo following its arrival in the U.S.
\[[Reference 31](#Ref31)\]

## Description of the Current Situation

Several emerging government processes and systems related to improving
cargo security are at least partially in place today. These include
CBP's Container Security Initiative (CSI) and Customs-Trade Partnership
Against Terrorism (C-TPAT). Ongoing or upcoming initiatives and tests
that are exploring or will explore new methods to improve security
include, for instance, the joint CBP/TSA Operation Safe Commerce and the
Federal Highway Administration (FHWA)-supported Electronic Container
Seals Field Operational Test in the Northwest International Trade
Corridor and Border Crossing area.

## Modes of Operation Today

Many containers are sealed. Some containers are equipped with mechanical
seals. A small number of containers are equipped with electronic seals.
Containers equipped with electronic seals may also have mechanical seals
or tamper tape. Most containers have no sensors. Some containers (mostly
in test programs) are equipped with sensors that can detect conditions
such as temperature, intrusion, or the presence of radioactive material.
Some containers (mostly in test programs) are equipped with wide-area
communications devices that can be used to report status information.

The top twenty international mega-ports and some smaller ports are
participating in the CSI. \[[Reference 19](#Ref19)\]

More than 2,400 companies are participating in C-TPAT.

## Stakeholders

The stakeholders involved in intermodal container transportation
include:

-   Government

```{=html}
<!-- -->
```
-   U.S. Customs and Border Protection; Transportation Security
    Administration, Federal Highway Administration, Federal Motor
    Carrier Safety Administration (FMCSA), U.S. Transportation Command,
    U.S. Coast Guard

```{=html}
<!-- -->
```
-   State and local law enforcement

-   Other countries' Customs Administrations and trade regulatory
    agencies

-   Originators/shippers

-   Carriers (rail, dray, over-the-road, vessel)

-   Transport operators

-   Consignees

-   Third parties (e.g., freight forwarders, NVOCCs)

-   Subcontractors (e.g., consolidator, deconsolidator)

-   Bonded warehouses

-   Technology vendors

-   Marine and inland terminal operators

-   Stevedores

-   Container owners and lessors

# Motivation for Improvement

In order to determine an approach for improving in-transit container
security, threats and vulnerabilities need to be analyzed. A threat may
achieve its objective by exploiting the vulnerabilities of the container
transportation system. For this ConOps, a high-level, preliminary threat
and vulnerability analysis focused on terrorism. This analysis examined
transportation system vulnerabilities that terrorists may exploit to add
chemical, biological, and radiological WMD or other illicit items. Theft
of container cargo was also analyzed because of its importance to the
stakeholder community, but is not considered a primary goal of this
ConOps. Likewise, the issue of contraband in the context of container
security, albeit a significant concern, is not addressed as a unique
threat. Security measures tested under this ConOps may provide security
benefits to the secondary goals of reducing cargo theft and preventing
contraband freight movement through the legitimate transportation
system.

Possible scenarios where threats could ultimately be successful were
used to identify potential vulnerabilities. Analyzing the
vulnerabilities identified security gaps that can exist in the
transportation system. Normally, the next step in vulnerability analysis
is to assess consequences and the likelihood that each threat would
succeed. In this analysis, that step was skipped. Here, the next step in
the analysis was to propose, for testing and analysis, potential
countermeasures to reduce selected vulnerabilities and security gaps.
Important in considering options are: evaluation of the inherent
vulnerabilities of the technologies themselves, and relative
cost/benefit analyses.

The scope of this ConOps includes the post-loading vulnerabilities and
security gaps that can exist in intermodal container shipping today. The
analysis does not cover site-specific, mode-specific, or cargo-specific
vulnerabilities that could be identified with more detailed
investigation. It is also important to recognize that system
vulnerabilities should be re-evaluated based on new threat capabilities
and new approaches for countermeasures. Testing may provide additional
ideas about vulnerabilities and countermeasures.

## Security Vulnerabilities and Gaps

The rudimentary analysis summarized here focuses on the vulnerabilities
associated with tampering with a container in transit to add WMD or
steal cargo. It is assumed that the container has been sealed and its
presumed purpose is the transport of legitimate cargo. Potential
vulnerability sources include aspects of the physical environment,
information, personnel, and operations. This preliminary threat and
vulnerability analysis focuses on factors influencing:

-   Ability to detect unauthorized access

-   Ability to defend against unauthorized access

Figure 4--1 identifies scenarios for introducing WMD that ultimately
result in WMD activation. The diagram shows vulnerabilities associated
with not detecting a breach or not detecting the presence of a WMD or
other illicit items. The shaded boxes along the bottom identify
countermeasure goals to reduce risks in the listed scenarios. The goals
that are within the scope of this ConOps are indicated with dashed
borders. It is expected that similar vulnerabilities may exist in
regards to the introduction of contraband after the container is
stuffed, and that similar goals would apply.

![](media/image2.wmf)

Figure 4--2. Preliminary Vulnerability Scenarios for\
Container Tampering by Terrorists

Figure 4--2 identifies scenarios for theft of cargo. The diagram shows
vulnerabilities associated with removing cargo or hijacking the entire
container (and, possibly, the transport vehicle). The shaded boxes along
the bottom identify goals to reduce risks in the theft scenarios shown.
The boxes with dashed borders are those that are within the scope of
this ConOps. Possession and status history information may be useful for
investigating theft incidents.

![](media/image3.wmf)

Figure 4--3. Preliminary Vulnerability Scenarios for\
Container Tampering by Thieves

A comparison of the countermeasure goals for terrorism and theft yields
the following common goals that are within the scope of this ConOps:

-   Reduce risk of unauthorized opening of container

-   Detect tampering and communicate information to authorized personnel

The remaining goals within scope are:

-   Make difficult to add WMD or other illicit items to container

-   Make difficult to remove cargo

-   Detect WMD or other illicit items in container

## Desired Goals and Potential Countermeasures

The goals identified in the previous section shape the proposed ConOps.
Whenever tests using the ConOps are designed, the goals listed above
should be considered.

Those goals can be simplified as follows:

-   Detect terrorist or other illicit activity

-   Defend against terrorist or other illicit activity

-   Detect WMD or other illicit items

In addition to countering the security vulnerabilities, any potential
changes being evaluated should also meet these business goals:

-   Commerce must continue to flow freely and efficiently with
    insignificant numbers of false alarms

-   Implementing the solutions should be commercially practical

We call possible actions, devices, procedures, or techniques to reduce
vulnerability and achieve the goals listed above *countermeasures*. The
possible countermeasures that may enhance security in the goal areas
identified earlier are shown in Figure 4--3.

![](media/image4.wmf){width="6.502777777777778in"
height="5.252083333333333in"}

Figure 4--4. Possible Countermeasures to Improve\
In-Transit Container Security

Some countermeasures involve the use of technology, while others affect
operating processes. Many of the countermeasures are currently in use or
under test by various stakeholders. Improvement of the existing
technologies or processes may further enhance in-transit container
security.

## Priority Goals and Countermeasures

In this analysis, we gave priority to testing those countermeasures that
most directly addressed the goals identified in Sections 4.1 and 4.2.
The goals and the corresponding countermeasures are listed below:

-   Reduce risk of unauthorized opening of container by:

```{=html}
<!-- -->
```
-   Control of access to the container

-   Monitoring the container

```{=html}
<!-- -->
```
-   Detect tampering and communicate information to authorized personnel
    by:

```{=html}
<!-- -->
```
-   Sensors to detect tampering

-   Recording status information

-   Effective communication about detected intrusion

-   Security force detecting terrorist or other illicit activity

-   Inspections of container contents (non-intrusive or physical)

```{=html}
<!-- -->
```
-   Make it difficult to add WMD or other illicit items to container by:

```{=html}
<!-- -->
```
-   Monitoring the container

-   Sensors to detect tampering

```{=html}
<!-- -->
```
-   Make it difficult to remove cargo by:

```{=html}
<!-- -->
```
-   Monitoring the container

-   Sensors to detect tampering

```{=html}
<!-- -->
```
-   Detect WMD or other illicit items in container by:

```{=html}
<!-- -->
```
-   Inspections of container contents (non-intrusive or physical)

-   Fixed sensors in container

The goals listed below are also high priority:

-   Commerce must continue to flow freely and efficiently with
    insignificant numbers of false alarms

-   Implementing the solutions should be commercially practical

## Goals and Countermeasures Considered but Not Included

The following desired goals and potential countermeasures were
considered based on the vulnerability assessment but were not considered
to be within the scope of this ConOps:

-   Enhance structural integrity of container by:

```{=html}
<!-- -->
```
-   Improved containers

-   Physical barriers

```{=html}
<!-- -->
```
-   Reduce risk of suborning personnel by:

```{=html}
<!-- -->
```
-   Personnel security for those involved in chain of custody

-   Controlled access to information

```{=html}
<!-- -->
```
-   Make it difficult to add WMD or other illicit items to container by:

```{=html}
<!-- -->
```
-   Improved containers

-   Physical barriers

-   Controlled access to information

-   Personnel security

```{=html}
<!-- -->
```
-   Make it difficult to remove cargo by:

```{=html}
<!-- -->
```
-   Improved containers

-   Physical barriers

-   Controlled access to information

-   Personnel security

This Page Intentionally Blank

# Concepts for the Proposed Approach to Testing

As described in the previous chapter, there are many possible ways to
improve the security of a container in transit. Ultimately, security may
be improved in a layered approach that involves better containers,
business practices, education and training, information, communications,
and security for personnel, conveyance, information, and workplaces.
This ConOps proposes the testing and analysis of operational changes and
technologies that may reduce some aspects of the risk that tampering
with a container in transit will occur undetected. The key elements of
these concepts include:

-   Tamper-indicating seals or other methods of sealing the container

-   Non-intrusive inspections and/or sensors to detect intrusion into
    and conditions (light, radioisotopes, chemicals, etc.) in the
    container

-   Status checks of the container, seal, and sensors

-   Recording possession and status information throughout the
    container's trip

-   Information checks when the container changes hands

Tampering with a container can sometimes be indicated or detected
through the use of seals and sensors. Research has shown
\[[Reference 1](#ref1)\] that even tamper-indication or
intrusion-detection devices can be defeated. The ConOps proposed here
will not eliminate tampering. But, the ConOps will be used to test and
evaluate possible ways to reduce the risk of tampering and increase the
likelihood of detection.

The ConOps allows for the use of a variety of technologies. There may be
potential benefits to be gained by using some sophisticated
technologies, but only if the technologies are part of a well-conceived
and vetted set of practices, are thoroughly understood and tested, and
are implemented and used correctly. Customs is using sensors in
non-intrusive inspections today; as research and testing continues,
on-board sensors may also provide improved security. This ConOps allows
for the testing of on-board sensors as the technology matures.

Recording possession and status information and checking that
information when the container changes hands are important parts of this
ConOps. The information is recorded to encourage the checks, verify that
they are occurring regularly, support later analysis, and assess the
devices and methods being used in the tests.

## Background, Objectives, and Scope

In this chapter, we describe the proposed approach for testing potential
improvements to the security of the freight container transportation
system by reducing tampering with the container while in transit.

**Definition of Terms**

[Seal]{.underline} = tamper-indicating seal: a tamper-indicating device
designed to leave non-erasable, unambiguous evidence of unauthorized
access or entry. Seals must be inspected before there can be a
determination of whether tampering has taken place. \[from
[Reference 1](#ref1)\]

[Sensor]{.underline}: a device that measures or detects some physical
condition such as motion, light, or a radioactive signature.

[Primary Event Data]{.underline}: data recorded when the container and
seal are inspected and when a sensor reports status. The data include:
container ID, seal ID, container condition, seal condition, transport
type, transport ID, carrier type, carrier ID, event type, date, time,
location, relinquished and received by, comments, and data source for
each element. For each sensor status report, the primary event data
include: sensor type, sensor ID, sensor data, comments, date, time, and
location. Recording may be accomplished manually or electronically.

[Possession and Status History]{.underline}: a collection of records of
primary event data that reflect the possession and status information
recorded about the container throughout its trip. In this ConOps, the
possession and status history is assumed to be part of the shipping
documentation (electronic or paper) for test purposes.

## Operational Policies and Constraints

This section describes operational policies and constraints that may be
considered by those setting the criteria for testing. For some
stakeholders, the policies and constraints will match what they already
do; for others, the policies and constraints will imply changes to be
tested. In order to ensure interoperability, ultimately, governments and
industry must agree on standards for container seals, sensors, and
information sharing. Test planners and participants should adapt the
ConOps after assessing their own test objectives and operational
realities. The statements below describe possible operational policies
and practices to be considered for test purposes.

-   All containers are sealed when stuffed by the originator.

-   As applicable, manufacturers, shippers, or container owners
    instrument containers with sensors to detect intrusion and dangerous
    substances. The sensors may provide output locally and/or remotely.

-   The shipper records information about the seal type and ID,
    container type and ID with other data about the cargo on the
    shipping documents.

-   Each time the container is transferred from one transport operator
    to another, container, seal, and sensor IDs are checked against what
    is expected. The status of the container, seal, and sensors are also
    checked. The information is recorded to encourage the checks, verify
    that they are occurring regularly, support later analysis, and
    assess the devices and methods being used in the tests. In this
    ConOps, we call the information recorded the "primary event data."
    If any discrepancy or tampering is observed during testing, the
    person or system that discovers it informs the carrier, shipper,
    government agencies, and law enforcement agencies participating in
    the test according to the test guidelines.

-   The shipper has the primary responsibility for the goods being
    shipped. As the container is transported, the carriers who handle it
    share responsibility for the security of the container while it is
    in their control. Government and law enforcement are charged with
    maintaining security within their jurisdictions. Thus, all these
    entities have vested interests in preventing and knowing about
    tampering.

-   Personnel who handle, transport, protect, and inspect containers are
    trained to recognize potential tampering attacks and evidence of
    tampering that has already occurred. They are also trained about
    what to do when a problem is detected.

-   Government agencies and law enforcement check containers using a
    combination of visual/physical inspection of the containers and
    their contents, non-intrusive inspection, analysis of the shipping
    documents, and analysis of the possession and status history
    recorded throughout the container's trip.

-   Initially, the possession and status history used by government and
    law enforcement will be collected by the carrier and shipper and
    provided to government/law enforcement test participants upon
    request. In the future, it is envisioned that the primary event data
    is provided electronically through back-office systems to government
    and law enforcement in near-real time as it is collected. To assist
    in thwarting potential terrorist activity, shipment originators will
    provide additional information (beyond the possession and status
    history) to government and law enforcement upon request.

-   Movement of a container that has what appears to be an incomplete or
    inaccurate possession and status history may be delayed by
    government and law enforcement.

-   A container that shows signs of tampering may be held by
    government/law enforcement or the carrier who has current possession
    of the container.

-   A container for which the possession and status history appears to
    be complete, and which shows no evidence of tampering, will be
    handled expeditiously by the carrier and law enforcement, assuming
    there are no other reasons to question it (such as new intelligence
    information) and that the container is not selected for random
    inspection.

## Description of the Proposed System for Testing

Note: in this description there is no requirement that primary event
data be recorded automatically, electronic seals be used, or wide area
communications be part of the container system. Such technology products
are available commercially and can be considered for operational tests.
Simpler technologies will also support the proposed approach. Sensors
used in other applications are being tested for use on containers, and
other sensors are under development; sensors for containers may become
commercially viable. Test planners and participants should assess their
own test objectives and operational realities as they select a set of
system components and related operational practices for a given test.

-   The shipper verifies a clean container, stuffs the container,
    verifies the cargo declaration matches the contents, and seals the
    container. The shipper records the container ID and seal ID as part
    of the shipping documents. It is envisioned that increased use of
    electronic means will be employed over time. The container may be
    equipped with sensors to detect motion in the container, whether the
    container doors have been opened, whether there are any radioactive
    emissions inside the container, a weight change, etc. Note: many of
    the sensors listed are not widely available as commercial products
    for containers as of April 2003. When the technologies mature, they
    could be considered for testing.

-   As the container travels through the country of origin, the status
    of the seal, sensors, and container are checked at each hand-off
    between conveyances by the receiving party. The statuses are
    recorded each time they are checked. If the container is equipped
    with transmitters, the statuses may be reported to a remote site in
    real time. Depending on the technology being used, the checks and
    information recording may be done manually by the transport
    operator, yard personnel, automated systems, or some combination
    thereof.

-   Each carrier follows its own operational practices to check (or not
    check) containers after they have been transferred to its possession
    for transport. For example, the carrier may require periodic checks
    of containers stored between legs of a trip (e.g., at a rail yard),
    checks when personnel shifts change, or checks whenever the
    container has been in an insecure environment (e.g., parked at a
    truck stop during a meal break). Whenever a check is made, the
    checker records the information in a primary event as part of the
    possession and status history according to the test guidelines. For
    testing purposes, carriers are encouraged to check containers
    periodically.

-   If government or law enforcement opens the container as part of the
    test, they record that action as part of a primary event and reseal
    the container. If a mechanical seal or a single-use electronic seal
    was removed, law enforcement places the old seal inside the
    container and records the new seal ID as part of a primary event.
    The government or law enforcement agent reports the opening event to
    the shipper and carrier according to the test guidelines.

-   If some other legitimate party (shipper, carrier, or authorized
    representative) opens the container, they record that action as part
    of a primary event and reseal the container. If a mechanical seal or
    a single-use electronic seal was removed, the opener places the old
    seal inside the container and records the new seal ID as part of a
    primary event. The opener reports the opening activity to the
    shipper and carrier according to the test guidelines.

-   As the container leaves the country of origin, the customs agency
    may open the container to check the contents; check and document the
    status of the seal, sensors, and container; or simply check the
    documentation about the container. The customs agency records
    whatever checks it performs. If a mechanical seal or single-use
    electronic seal was removed, the customs agency places the old seal
    inside the container and records the new seal ID as part of a
    primary event. In some cases, the country-of-origin's customs agency
    may provide U.S. Customs and Border Protection (CBP) access to that
    information.

-   If the container travels or is transshipped through other countries
    prior to arriving in the U.S., similar activities may occur.

-   Under the 24-hour advance manifest regulation, carriers and/or
    automated NVOCCs are required to submit a cargo declaration 24 hours
    before cargo is laden aboard the vessel at a foreign port for
    containers entering the U.S. via ship. CBP screens all such data
    before vessel loading at the foreign port. Customs may issue "do not
    load" messages to the carriers/NVOCCs for clear violations of the
    24-hour rule or for the purpose of conducting a security inspection
    of the container before it is loaded aboard the vessel.
    \[[Reference 28](#ref28)\]

-   At ports participating in the Container Security Initiative (CSI),
    CBP may be present while the country-of-origin's customs agency is
    checking the container.

-   For containerized cargo moving through non-CSI ports, CBP prescreens
    the shipment information and may issue "do not load" messages to the
    carrier at the foreign port of loading, but may not have
    arrangements in place to inspect the container at the foreign port.
    In such cases, when the container arrives at a port of entry to the
    U.S., the DHS CBP team checks the container. CBP's checks may
    involve opening the container, non-intrusive inspection, intrusion
    detection, and/or information checks. In some cases, CBP applies a
    new seal. If CBP removes a mechanical seal or single-use electronic
    seal, they place it inside the container. CBP records the opening
    activity and new seal ID as part of a primary event. CBP reports the
    opening activity to the shipper and carrier according to the test
    guidelines.

-   As the container travels through the U.S., the receiving party
    checks the status of the seal, sensors, and container at each
    hand-off between parties or at changes in conveyance. The checkers
    record primary events when they occur.

-   If government or law enforcement in the U.S. opens the container as
    part of the test, they record that action as part of a primary event
    and reseal the container. If a mechanical seal, single-use
    electronic seal, or DHS CBP seal was removed, they place it inside
    the container and record the new seal ID as part of the shipping
    documents. The government or law enforcement agent reports the
    opening activity to the shipper and carrier according to the test
    guidelines.

-   If some other legitimate party (shipper, carrier, or authorized
    representative) opens the container, they record that action as part
    of a primary event and reseal the container. If a mechanical seal,
    single-use electronic seal, or a DHS CBP seal was removed, the
    opener places it inside the container and records the new seal ID as
    part of a primary event. The opener reports the opening event to the
    shipper and carrier according to the test guidelines.

-   When the container arrives at the consignee's destination for
    unpacking or deconsolidating, the consignee checks and records the
    status of the seal, sensors and container. The consignee reports the
    information collected about the status of the shipment to the
    shipper according to the test guidelines.

Other checks could also be performed, but are not included in this
ConOps. For instance, it might also be possible to verify that the
correct driver and vehicle are associated with the container at each
handoff. In addition, today's technology would support an evaluation of
the actual travel time versus expected travel time between handoffs.
These factors are not included in the ConOps document at this time, but
may be added later.

## Modes of Operation

Figure 1--1 summarized the modes of operation for this ConOps. Each mode
is described further below:

**Stuff container, seal, and document.** This phase is outside the scope
of this document. The objective of this phase is to be confident that
cargo was safely loaded into a clean container, the actual contents of
the container are accurately reflected on the manifest, and that an
approved seal is applied correctly.

**Check and document status of container, seal, and sensors.** In this
mode, a person or electronic device(s) checks the status of the
container, the seal, and any on-board sensors. Primary event data are
recorded. Problems are reported to government and law enforcement test
participants, the carrier, and the shipper according to the test
guidelines. The triggers for this check may include, but are not limited
to:

-   The container is being transferred between transport operators.
    Before accepting a container for transport, the operator should
    verify its status.

-   The operator notices a security-related problem.

-   The operator or carrier representative checks the container in
    accordance with the carrier's policies.

-   Government or law enforcement selects the container for inspection.

**Check information about container.** In this mode, a person or
automated process checks the possession and status history of the
container to help determine whether closer scrutiny is warranted.

**Inspect container contents.** During the container's journey,
government agencies, law enforcement or authorized carrier
representatives may have legitimate cause to inspect a container's
cargo. One means is non-intrusive inspection equipment. If physical
inspection is required, law enforcement authorities will open the seal
and examine the contents of the container. If this happens, the opener
records the opening activity as part of a primary event and reseals the
container. If a mechanical seal, or a single-use electronic seal was
removed, the opener places it inside the container and records the new
seal ID as part of a primary event. The opener reports the opening event
to the shipper and carrier and law enforcement according to test
guidelines. The opener reseals the container and records any new seal
information. At the end of the trip, the consignee or deconsolidator
opens the container.

## User Classes

The "users" in the modes of operation listed in the previous section
include:

-   Shippers

-   Transport operators

-   Terminal operators

-   Government agencies and law enforcement

-   Carriers and their agents

-   Consignees and deconsolidators

# Operational Test Scenarios

This chapter describes segments of a trip test scenario that involve
security-related operations. In a particular trip scenario, some
segments may not occur. Both nominal and abnormal situations are
described. Data recording and reporting in the tests may be accomplished
through a combination of manual means, test databases, legacy systems,
and/or interfaces between existing systems. During the tests, the
carrier, shipper, and law enforcement may be notified of problems
through a test database according to the test guidelines.

The scenario segments related to security include:

-   Check and document status of container, seal, and sensors

-   Transfer container

-   Container reports status autonomously (only if container is equipped
    with wide-area communications)

-   Check information about container

-   Perform non-intrusive container inspection

-   Open seal, check container contents or perform authorized activity
    such as maintenance or repair, replace seal, document change

-   Container arrives at destination

Throughout this chapter, the person or system that checks the status is
responsible for recording the primary event data. If security problems
are detected, the person or system that discovers the problems reports
them according to the test guidelines.

## Check and Document Status of Container, Seal, and Sensors

*The container is checked, physically, or remotely, en route.*

![](media/image5.wmf){width="2.678472222222222in"
height="4.848611111111111in"}

Figure 6--5. Check and Document Status of\
Container, Seal, and Sensors

### Container, Seal, and Sensors are Checked; No Security Problem

*The container is checked, physically, or remotely en route. No security
problems are found.*

1.  The container, seal, and sensors are checked physically (i.e., by a
    person) or remotely (i.e., by an electronic device).

```{=html}
<!-- -->
```
32. No physical breach of the container is observed. The seal is intact.
    The container ID and seal ID are verified to be correct. If
    applicable, expected sensors are present and readings are verified
    to indicate nominal conditions. The check may also include
    non-intrusive inspections using x-ray or other techniques. No
    security problems are found.

33. Primary event data related to the check are recorded according to
    the test guidelines.

### Container, Seal, and Sensors are Checked; Security Problem

*The container is checked, physically, or remotely en route. Security
problem(s) are found.*

1.  The container, seal, and sensors are checked physically or remotely.

```{=html}
<!-- -->
```
34. Security problem(s) are found. Security problems may include, but
    are not limited to: container has been breached, seal is open, wrong
    container ID or seal ID, missing sensor(s), sensor(s) indicates
    security problem, or inspection reveals container or cargo anomaly.

35. For the tests, the carrier, shipper, and participating government
    and law enforcement agencies are alerted according to the test
    guidelines.

36. Proceed as directed by government agency, law enforcement, the
    carrier or the shipper (e.g., stop and hold container and await
    further enforcement action, continue shipment).

37. Primary event data are recorded according to the test guidelines.
    The comments in the primary event data should include information
    about what security problem(s) was detected, who was notified, what
    directions were received, and the actions taken.

## Transfer Container

*Possession of the container is transferred.*

![](media/image6.wmf){width="3.0409722222222224in"
height="4.832638888888889in"}

Figure 6--6. Transfer Container

### Transfer Container; No Security Problem

*Possession of the container is transferred. No security problems
occur.*

1.  Possession and status history are checked. No security problem is
    evident.

```{=html}
<!-- -->
```
38. The relinquisher's identification is verified to be authentic and to
    match what is expected. No security problem is found.

39. Container, seal, and sensor status are checked and no security
    problems are found (see Section 6.1.1) prior to transfer.

40. Shipping documents are checked prior to transfer. No security
    problems are found.

41. Possession of the container is transferred.

42. Primary event data documenting the transfer are recorded according
    to the test guidelines.

### Transfer Container; Security Problem

*Possession of the container is transferred. Security problem(s) are
found.*

1.  Possession and status history are checked.

```{=html}
<!-- -->
```
43. The relinquisher's identification is checked to be authentic and
    match what is expected.

44. Container, seal, and sensor status are checked (see Section 6.1.1 or
    6.1.2) prior to transfer.

45. Shipping documents are checked prior to transfer.

46. Security problem(s) are found in one or more of steps 1-4. Security
    problems may include, but are not limited to: false identification,
    party does not match expected; seal is open, wrong container ID or
    seal ID, sensors detect security problem; shipping document (which
    includes the possession and status history) is unreadable,
    erroneous, or unacceptably incomplete.

47. For the tests, the relinquishing and receiving carriers, shipper,
    and participating government and law enforcement agencies are
    alerted according to the test guidelines.

48. Proceed as directed by government agency, law enforcement, the
    carrier, or the shipper (e.g., stop and hold container and await
    further enforcement action, or accept the container and continue
    shipment).

49. Primary event data are recorded according to the test guidelines.
    The comments in the primary event data should include information
    about what security problem(s) was detected, who was notified, what
    directions were received, and the actions taken.

## Container Reports Status Autonomously

*The container autonomously initiates communications to report status or
security problem.*

![](media/image7.wmf){width="2.6243055555555554in"
height="6.020138888888889in"}

Figure 6--7. Container Reports\
Status Autonomously

### Container Reports Status; No Security Problem

*The container autonomously initiates communications to report status.
No security problems are found.*

1.  The container autonomously checks status.

```{=html}
<!-- -->
```
50. Container ID and seal ID are verified to be correct. The seal is
    verified to be closed. Sensors indicate nominal conditions. No
    security problems are found.

51. Primary event data are recorded and reported.

### Container Reports Status; Security Problem

*The container autonomously initiates communications to report status.
Security problem(s) are found.*

1.  The container autonomously checks status.

```{=html}
<!-- -->
```
52. Security problem(s) are found. Security problems may include, but
    are not limited to: seal is open, container senses security problem,
    wrong container ID or seal ID, sensors report security problem,
    unauthorized location.

53. For the tests, the carrier, shipper, and participating government
    and law enforcement agencies are alerted according to the test
    guidelines.

54. Government agency, law enforcement, carrier, or shipper determines
    how to proceed. In some cases, it may be appropriate to contact the
    transport operator and provide directions; in others, enforcement
    may choose to intercept the vehicle or park the container.

55. Proceed as directed (e.g., stop and hold container and await further
    enforcement action, continue shipment).

56. Primary event data are recorded and reported according to the test
    guidelines.

## Check Information About Container

*Information about the container, seal, and sensors is checked en
route.*

![](media/image8.wmf){width="3.042361111111111in"
height="5.510416666666667in"}

Figure 6--8. Check Information About\
Container

### Information is Checked; No Security Problem

*Only information about the container, seal, and sensors is checked en
route by examining the possession and status history and shipping
documents. No security problem found.*

1.  The possession and status history is checked either by a person or
    an automated process. Nothing unusual is detected.

```{=html}
<!-- -->
```
57. The other information that is part of the shipping document is
    checked either by a person or automated process. Nothing unusual is
    detected.

58. Data elements recorded in the shipping documents and the possession
    and status history are consistent. No security problems are
    detected.

59. Primary event data related to the check are recorded according to
    the test guidelines.

### Information is Checked; Security Problem

*Only information about the container, seal, and sensors is checked en
route by examining the possession and status history and shipping
documents. Security problem(s) are found.*

1.  The possession and status history is checked either by a person or
    an automated process.

```{=html}
<!-- -->
```
60. The shipping documents are checked either by a person or automated
    process.

61. Data elements recorded in the shipping documents and the possession
    and status history are checked.

62. Security problem(s) are found in one or more of steps 1-3. Security
    problems may include, but are not limited to: possession and status
    history indicates a security problem occurred in the past, but no
    report was made and no action was taken; security problem with other
    aspects of the shipping documents; mismatch between information in
    the shipping documents and the possession and status history.

63. For the tests, the carrier, shipper, and participating government
    agencies and law enforcement are alerted according to the test
    guidelines.

64. Government agency, law enforcement, carrier, or the shipper
    determines how to proceed. In some cases, it may be appropriate to
    contact the transport operator and provide directions; in others,
    enforcement may choose to intercept the vehicle or park the
    container.

65. Proceed as directed (e.g., stop and hold container and await further
    enforcement action, or continue shipment).

66. Primary event data are recorded according to the test guidelines.

## Perform Non-Intrusive Inspection

*The container is subjected to a non-intrusive inspection.*

![](media/image9.wmf){width="3.5104166666666665in"
height="5.603472222222222in"}

Figure 6--9. Perform Non-Intrusive Inspection

### Non-Intrusive Inspection Performed; No Security Problem

*The container is inspected using non-intrusive techniques. No security
problems are found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1). No security problem is found.

```{=html}
<!-- -->
```
67. The container ID and seal ID are checked against shipping documents.
    No security problem is found.

68. The container is inspected using non-intrusive techniques. No
    security problem is found.

69. Primary event data and inspection results are recorded according to
    the test guidelines. The comments in the primary event data should
    include a pointer to the inspection results.

### Non-Intrusive Inspection Performed; Security Problem

*The container is inspected using non-intrusive techniques. Security
problem(s) are found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1 or 6.1.2).

```{=html}
<!-- -->
```
70. The container ID and seal ID are checked against shipping documents.

71. The seal and container are inspected using non-intrusive techniques.

72. Security problem(s) are found in one or more of steps 1-3. Security
    problems may include, but are not limited to: container was
    breached, seal was opened previously but no record was made, wrong
    container ID or seal ID, sensors indicate anomalous condition, or
    contents of container are inconsistent with what is expected. If
    government or law enforcement decides to open the container, see
    steps in Section 6.6.2. If not, continue with step 5 below.

73. For the tests, the carrier, shipper, and participating government
    agencies and law enforcement are alerted according to the test
    guidelines.

74. Proceed as directed by government, law enforcement, the carrier or
    the shipper (e.g., stop and hold container and await further
    enforcement action, or continue shipment).

75. Primary event data and inspection results are recorded. The comments
    in the primary event data should include information about the
    anomalies, a pointer to the inspection results, who was notified,
    what directions were received, and the actions taken.

## Open Seal, Check Container Contents

*The seal and the container are opened en route.*

![](media/image10.wmf){width="4.5472222222222225in" height="6.3375in"}

Figure 6--10. Open Seal, Check Container Contents

### Seal and Container are Opened; No Security Problem

*The seal and container are opened and inspected en route. No security
problems are found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1). No security problem is found.

```{=html}
<!-- -->
```
76. The container ID and seal ID are checked against shipping documents.
    No security problem is found.

77. The seal and container are opened and inspected. No security problem
    is found.

78. If seal is disposable (mechanical or single-use electronic seal),
    old seal is placed inside container and new seal is used.

79. Container is sealed.

80. If new seal was used, shipping documents are updated to record new
    seal ID.

81. Primary event data and inspection results are recorded according to
    the test guidelines. The comments in the primary event data should
    include information about the seal opening, seal change, and a
    pointer to the inspection results.

### Seal and Container are Opened; Security Problem

*The container is opened and inspected en route. Security problem(s) are
found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1 or 6.1.2).

```{=html}
<!-- -->
```
82. The container ID and seal ID are checked against shipping documents.

83. The seal and container are opened and inspected.

84. Security problem(s) are found in one or more of steps 1-3. Security
    problems may include, but are not limited to: container was
    breached, seal was opened previously but no record was made, wrong
    container ID or seal ID, sensors indicate anomalous condition, or
    contents of container are inconsistent with what is expected.

85. For the tests, the carrier, shipper, and participating government
    agencies and enforcement are alerted according to the test
    guidelines.

86. Proceed as directed by government, enforcement, the carrier, or the
    shipper (e.g., stop and hold container and await further enforcement
    action, or continue shipment).

87. If shipment is to be continued and the seal is disposable
    (mechanical or single-use electronic seal), old seal is placed
    inside container and new seal is used.

88. Container is sealed.

89. If new seal was used, shipping documents are updated to record new
    seal ID.

90. Primary event data and inspection results are recorded according to
    the test guidelines. The comments in the primary event data should
    include information about the seal opening, seal change, a pointer
    to the inspection results, who was notified, what directions were
    received, and the actions taken.

## Container Arrives at Destination

*The container arrives at its final destination and is unpacked or
deconsolidated.*

![](media/image11.wmf){width="2.5319444444444446in"
height="6.108333333333333in"}

Figure 6--11. Container Arrives at\
Destination

### Container Arrives at Destination and is Unpacked; No Security Problem

*The container arrives at its final destination and is unpacked or
deconsolidated. No security problems are found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1). No security problem is found.

```{=html}
<!-- -->
```
91. The container ID and seal ID are checked against shipping documents.
    No security problem is found.

92. The seal and container are opened and inspected. No security problem
    is found.

93. The container is unpacked. Container contents match shipping
    documents and no discrepancies are found.

94. Primary event data and closeout are recorded according to the test
    guidelines.

### Container Arrives at Destination; Security Problem 

*The container arrives at its final destination. Security problem(s) are
found.*

1.  The container, seal, and sensors are checked physically or remotely
    (see Section 6.1.1 or 6.1.2).

```{=html}
<!-- -->
```
95. The container ID and seal ID are checked against shipping documents.

96. The seal and container are opened.

97. The container is unpacked.

98. Security problem(s) are found in one or more of steps 1-4. Security
    problems may include, but are not limited to: container was
    breached, seal was opened previously but no record was made, wrong
    container ID or seal ID, sensors indicate anomalous condition, or
    contents of container are inconsistent with what is expected.

99. For the tests, the carrier, shipper, and participating government
    agencies and law enforcement are alerted according to the test
    guidelines.

100. Proceed as directed by government or enforcement (e.g., stop and
     await further enforcement action, commence investigation).

101. Primary event data and security problem information are recorded
     according to the test guidelines.

This Page Intentionally Blank

# Summary of Impacts

This ConOps proposes a framework for testing operational processes and
appropriate technologies intended to improve security for in-transit
containers. As the ConOps is tried in various test programs, it will be
important for participants and observers to capture information about
the actual impacts of modified operational processes and using different
technologies.

While participating in tests that use this ConOps, shippers, carriers,
terminal operators, and government and law enforcement agencies may
adopt operating procedures that are somewhat different from their norms.
For some participants, adhering to the ConOps may mean collecting and
assessing different information. Other participants may develop new
response scenarios and policies to cover incidents and anomalies
detected during the tests. Opened or missing seals, tripped sensors, and
documentation mismatches are among the many conditions that would
require a response action from law enforcement, the shipper, and/or the
carrier. The test participants will work together to establish effective
and reasonable response scenarios and policies.

A backroom information system or linkages between existing systems may
be needed to support a chain of possession process, as was discovered in
an air cargo security operational test with the shipper, trucking, and
aviation industry. \[[Reference 29](#Ref29)\] The tests that adopt this
ConOps will explore how to record and share possession status and
history information. Test participants will evaluate whether the
possession status and history information suggested is sufficient and
necessary.

The ConOps implies an assumed responsibility for security of the
container during the period of possession. After receiving an intact,
sealed container, the carrier and transport operators are expected to
deliver the container with seal intact to the next party in the supply
chain. If a container is compromised during the period of possession,
the initiative for notifying other test participants and taking
appropriate action lies with the party who has custody of the container.
Checks during possession help to detect and pinpoint security problems.
If a participating government agency or law enforcement opens a seal,
they also accept responsibility for resealing the container, documenting
their actions, and informing the shipper and carrier.

This ConOps should be periodically revised to reflect lessons learned
from ongoing tests and current operations. As acceptable and proven
processes are demonstrated, an architecture and related international
standards could be adopted to insure the uniform practices and
interoperable system components necessary to sustain real security
improvements in international commerce.

This Page Intentionally Blank

# Analysis of the Proposed System to be Tested 

## Summary of Goals and Objectives

The ConOps provides a framework to test potential security benefits of
sealing the container, instrumenting the container with sensors,
performing non-intrusive inspections, and documenting a possession and
status history to deter tampering and improve the capability to detect
containers that have been compromised. Government and law enforcement
agencies may benefit from use of the possession and status history (or
lack thereof) to help identify high-risk containers.

In the event a container is tampered with, the possession and status
history should provide useful information to help focus an
investigation. Legitimate parties in contact with the container could be
identified. Gaps in the possession and status history might suggest when
tampering could have occurred. At least some aspects of the movement
history of a container could be easily reconstructed.

## Disadvantages and Limitations

Although the ConOps is designed to test proposed container security
measures that could increase the probability of detecting and reducing
the risk of tampering in transit, it is important to recognize its
limitations. As with any security method, the concept of operations
described in this document should be tested as a part of a flexible,
adaptive, and layered enforcement approach, as no single technology or
process is a complete solution to the multiplicity of threats.

The scope of this ConOps explicitly excludes the container loading
process. By not addressing the activities prior to sealing the
container, the threat exists that a WMD or other banned cargo has
already been loaded. As stated earlier, a fundamental requirement for a
secure intermodal freight system is the assured integrity of container
loading and documentation. The proposed testing of sensors in the
ConOps, however, may be able to help analyze some aspects of this
threat.

The Los Alamos National Laboratory Vulnerability Assessment Team (VAT)
has analyzed over 200 tamper-indicating seals, including a number of
high-tech seals used in "critical" or "high-security" applications. The
VAT studied methods to defeat the seals, whereby the seal is opened,
then resealed (using the original seal or a counterfeit), without being
detected. On average, the VAT was able to defeat the seals in less than
3 minutes, and the maximum defeat time was 45 minutes. The VAT concluded
that all of the seals studied, as conventionally being used, could be
defeated quickly using only low-tech methods, tools, and supplies
available to almost anyone at low cost. \[[Reference 1](#ref1)\]

Undetected intrusion into the container, by defeating the seal or other
physical breach, is a significant shortcoming to seals. The ConOps will
allow, however, for the testing and analysis of other container security
devices that may detect entry into a container and thus might help
address this shortcoming. If the container is compromised without
detection by the seal and/or sensors, then enforcement action is not
likely. Falsification or alteration of the possession and status history
information (e.g., indicate seal closed when it is open) has the
potential effect of disguising a breach and reducing the likelihood of
follow-up action.

The ConOps does not attempt to establish tests to improve security in
cases where the perpetrator can fully accomplish the crime prior to the
ability of the system to respond and without regard to consequences,
such as post-event discovery. In those circumstances, there may be value
added in supporting post-mortem analysis, but not in thwarting the
event.

## Alternatives and Trade-offs Considered

This ConOps encompasses a range of potential technology solutions to
maintain the flexibility to support testing and evaluation of various
system designs and implementations. By remaining technology-neutral, the
ConOps should also be able to continue to provide a framework for
testing as requirements and technologies change.

A fundamental decision was made not to focus solely on fully-automated
solutions in place of manual processes (e.g., electronic vs. mechanical
seals) in these tests because of the resource costs, logistics hurdles,
and uncertainties associated with advanced technologies in the
commercial operating environment of foreign trade. Although automated
solutions may potentially provide for more complete and efficient data
collection, these options must be tested and evaluated, and the cost and
resource burden on the private sector to implement these measures must
be weighed against the benefits such solutions would achieve. Testing
and follow-on analysis should help to assess different alternatives. It
is envisioned that, initially, the primary possession and status event
data would be collected using a combination of manual and electronic
processes, but potentially the processes could evolve to become fully
automated over time.

# Acronyms and Abbreviations 

This section provides an alphabetical list of acronyms and their
expanded names. Definitions and/or descriptions of selected terms are
given in Section 10.

BTS Border & Transportation Security

CBP Customs and Border Protection

C-TPAT Customs -- Trade Partnership Against Terrorism

CHCP Cargo Handling Cooperative Program

ConOps Concept of Operations

CSI Container Security Initiative

DHS Department of Homeland Security

DoD Department of Defense

DOT Department of Transportation

e-seal electronic seal

FHWA Federal Highway Administration

FMCSA Federal Motor Carrier Safety Administration

GAO Government Accounting Office

ID identifier; identification

ITS Intelligent Transportation Systems

JHU/APL The Johns Hopkins University Applied Physics Laboratory

JPO Joint Program Office

NISC National Infrastructure Security Committee

NVOCC Non Vessel Owning Common Carrier

OSC Operation Safe Commerce

TSA Transportation Security Administration

VAT Vulnerability Assessment Team

WMD Weapons of Mass Destruction

WSDOT Washington State Department of Transportation

This Page Intentionally Blank

# Glossary

This section defines some of the terms relevant to this document.

**Border & Transportation Security (BTS):** One of five
divisions/directorates of the DHS. BTS is responsible for maintaining
the security of our nation's borders and transportation systems. The
largest of the Directorates, it will become home to agencies such as the
TSA, U.S. Customs Service, the border security functions of the
Immigration and Naturalization Service, Animal & Plant Health Inspection
Service, and the Federal Law Enforcement Training Center.
\[[Reference 10](#Ref10)\]

**Cargo Handling Cooperative Program (CHCP):** "Since its inception in
1983, the primary goal of the Maritime Administration sponsored CHCP has
been to increase the productivity of marine freight transportation
companies through cargo handling research and development. The CHCP,
conceived as a public-private partnership, was designed to foster
research and technology development among its members to actively pursue
innovative cargo handling developments to increase the productivity and
cost effectiveness of cargo operations." \[[Reference 9](#Ref9)\]

**Consignee:** The person or company who receives the container at the
end of the trip.

**Container Security Initiative (CSI):** "The U.S. Customs Service
launched the CSI in January 2002 as a response to September 11th. CSI
effectively aims to secure international maritime trade; more
specifically, the initiative promotes detection of high-risk shipments,
i.e., those that may harbor WMD or terrorists, before possible entrance
into American ports. CSI contains four core elements: use of automated
information to target high-risk containers; pre-screening of identified
high-risk containers before arrival in the U.S.; use of non-invasive
detection technology in screening; and continued development of smarter,
tamper-proof containers. By placing U.S. Customs Inspectors at foreign
ports, CSI essentially operates to identify high-risk containers at the
earliest possible point." \[[Reference 6](#ref6)\]

**Customs -- Trade Partnership Against Terrorism (C-TPAT):** a joint
government-business initiative to build cooperative relationships that
strengthen overall supply chain and border security.
\[[Reference 18](#ref18)\]

**Destination:** Location where the container reaches the end of the
trip.

**Maritime Transportation Security Act of 2002:** Public Law 107-295.
"The Maritime Transportation Security Act of 2002\... integrates the
myriad of federal, state, local and private law enforcement agencies
overseeing the security of the international borders at America's
seaports. The bill authorizes more security officers, more screening
equipment, and the building of important security infrastructure at
seaports." \[[Reference 7](#Ref7)\]

**National Infrastructure Security Committee (NISC):** Following
9/11/2001, NISC was established and "tasked with evaluating
transportation infrastructure vulnerabilities, security protocols and
processes and recommending changes to improve security."
\[[Reference 3](#ref3)\]

**Operation Safe Commerce (OSC):** "a program to fund business
initiatives designed to enhance security for container cargo moving
throughout the international transportation system. OSC will provide a
test-bed for new security techniques that have the potential to increase
the security of container shipments. DOT and Customs will use the
program to identify existing vulnerabilities in the supply chain and
develop improved methods for ensuring the security of cargo entering and
leaving the U.S. Those security techniques that prove successful under
the program will then be recommended for implementation system-wide."
\[[Reference 8](#Ref8)\]

**Origin:** Location where the seal was applied to the container.

**Originator:** The entity that stuffs the container and applies the
seal to the container immediately upon conclusion of the stuffing
process.

**Primary event data:** data recorded when the container and seal are
inspected, and when a sensor reports status. The data include: container
ID, seal ID, container condition, seal condition, transport type,
transport ID, carrier type, carrier ID, event type, date, time,
location, relinquished and received by, comments, and data source for
each element. For each sensor status report, the primary event data
include: sensor type, sensor ID, sensor data, comments, date, time, and
location. Recording may be accomplished manually or electronically.

**Seal** (tamper-indicating seal): a tamper-indicating device designed
to leave non-erasable, unambiguous evidence of unauthorized access or
entry. Seals must be inspected before there can be a determination of
whether tampering has taken place. \[from [Reference 1](#ref1)\]

**Sensor:** a device that measures or detects some physical condition
such as motion, light, or a particular radioactive signature.

**Transport operator:** the person who controls the vehicle that is
carrying the container; e.g., may be the truck's driver or the ship's
captain.