Background

Certain characteristics of commercial trucks and buses make them  inherently vulnerable to terrorist attacks and therefore difficult to secure.  The commercial trucking and bus industries are open by design, with  multiple access points and terminals so that vehicles can move large  numbers of people and volumes of goods quickly. The openness of this  sector and the large numbers of riders and quantities of goods on vehicles  with access to metropolitan areas or tourist destinations also make them  both difficult to secure and attractive targets for terrorists because of the  potential for mass casualties and economic damage and disruption. In  addition, the multitude of private commercial truck and bus companies  and their diversity in size and cargo complicate efforts to develop security  measures and mitigation strategies that are appropriate for the entire  industry.
Between 1997 and 2008 there were 510 terrorist-related commercial truck  and bus bombing attacks worldwide, killing over 6,000 people, with 106  bombings occurring during 2007 alone, killing over 2,500 people. Of the  510 bombings since 1997, 364 have been bus bombings and 146 have been  truck bombings; 156 have been in Iraq and 354 have been in countries  other than Iraq. In 2007, the use of truck bombs as a terrorist tactic more  than tripled and resulted in 2072 deaths. While trucks were involved in  just 29 percent of the bombings since 1997, they accounted for 56 percent  of the deaths. Vehicle Borne Improvised Explosive Devices (VBIEDs) are  vehicles loaded with a range of explosive materials that are detonated  when they reach their target. VBIEDs can also be used to explode  flammable fuel trucks, and disperse toxic substances. Terrorists have used  a variety of trucks—rental, refrigerator, cement, dump, sewerage, gasoline  tanker, trucks with chlorine and propane tanks, and fire engines—to  attack a broad range of critical infrastructure, including police and military  facilities, playgrounds, childcare centers, hotels, and bridges. Worldwide,  commercial buses have also been attacked numerous times, including in  Israel, England, Iraq, the Philippines, Lebanon, Sri Lanka, India, Russia,  and Pakistan. In the United States, terrorists used a commercial truck  containing fertilizer-based explosives to attack the World Trade Center in  1993, killing 6 and injuring 1,000 people. Two years later, a similar attack  occurred at the Alfred P. Murrah Federal Building in Oklahoma City,  Oklahoma, killing 168 people and injuring more than 800. Terrorists have  also targeted overseas U.S. military personnel with commercial VBIEDs at  the Marine barracks in Lebanon (1983), Khobar Towers in Saudi Arabia  (1996), and at U.S. embassies in Kuwait (1983), Lebanon (1984), Kenya  (1998), and Tanzania (1998). Figure 2 charts the number of worldwide  bombings involving commercial truck or buses since the 1997. See  appendix II for more information on truck and bus bombing incidents.

		Stakeholder Roles and Responsibilities

DHS and DOT share responsibility for securing the commercial vehicle  sector. Prior to the terrorist attacks of September 11, 2001, DOT was the  primary federal entity involved in regulating commercial vehicles. In  response to September 11, 2001, Congress passed the Aviation and  Transportation Security Act (ATSA) of 2001, which created and conferred  upon TSA broad responsibility for securing all transportation sectors. In  2002, Congress passed the Homeland Security Act, which established DHS,  transferred TSA into DHS, and gave DHS responsibility for protecting the  nation from terrorism, including securing the nation’s transportation  systems. Although TSA is the lead agency responsible for the security of  commercial vehicles, including those carrying hazardous materials, DOT  maintains a regulatory role with respect to hazardous materials.  Specifically, DOT continues to issue and enforce regulations governing the  safe transportation of hazardous materials. In addition, the Homeland  Security Act expanded DOT’s responsibility to include ensuring the  security, as well as the safety, of the transportation of hazardous  materials. Accordingly, within DOT, PHMSA is responsible for  developing, implementing, and revising security plan requirements for  carriers of hazardous materials, while FMCSA inspectors enforce these  regulations through reviews of the content and implementation of these  security plans.
In 2004, based on a recommendation we made, DHS and DOT entered into  a memorandum of understanding (MOU) to delineate the agencies’ roles  and responsibilities with respect to transportation security. In 2006, TSA  and PHMSA completed an annex to the MOU related to the transportation  of hazardous materials. This annex identifies TSA as the lead federal entity  for the security of the transportation of hazardous materials, and PHMSA  as responsible for promulgating and enforcing regulations and  administering a national program of safety and security related to the  transportation of hazardous materials. In addition, the 9/11 Commission  Act requires that, by August 2008, DHS and DOT complete an annex to the  MOU that would govern the roles of the two agencies regarding the  security of commercial motor vehicles.
State and local governments also play a key role in securing commercial  vehicles. States own, operate, and have law enforcement jurisdiction over  significant portions of the infrastructure—including highways, tunnels,  and bridges—that commercial vehicles use. Further, state and local  governments respond to emergencies involving commercial vehicles  which travel within and through their jurisdictions daily. Many states also  have departments of homeland security with firsthand knowledge of  hazardous materials shippers and routing, local smuggling operations, and  individuals and groups to be monitored for security reasons. Some states  also have fusion centers that collect relevant law enforcement and  intelligence information to coordinate the dissemination of alerts and  assist in emergency response. State transportation and law enforcement  officials also conduct vehicle safety inspections and compliance reviews,  sometimes in coordination with FMCSA.
Although all levels of government are involved in the security of  commercial vehicles, primary responsibility for securing commercial  vehicles rests with the individual commercial vehicle companies  themselves. Truck and bus companies have responsibility for the security  of day-to-day operations. As part of these operations, they ensure that  company personnel, vehicles, and terminals---as well as all of the material  and passengers they transport----are secured. Faced with tight competition,  low margins, and, in some sectors, high driver turnover, some industry  officials that we interviewed stated that devoting resources to security has  remained a challenge. A variety of national organizations represent  commercial trucking and motor coach industry interests. Many of these  organizations disseminate pertinent security bulletin information from  DHS and DOT to their members. Some have also developed and provided  their members with security information and tools—such as security  check lists and handbooks—to meet members’ security needs. See  appendix III for a list of the major industry associations representing the  truck and motor coach industries interviewed by GAO.

		Legislation and Regulations Governing the Security of Commercial Vehicles

Although ATSA, passed in November 2001, includes numerous  requirements for TSA regarding securing commercial aviation, it does not  include any specific requirements related to the security of land  transportation sectors.  However, with regard to all sectors of  transportation, ATSA generally requires TSA to:  receive, assess, and distribute intelligence information related to  transportation security;    assess threats to transportation security and develop policies, strategies,  and plans for dealing with those threats, including coordinating  countermeasures with other federal organizations; and,    enforce security-related regulations and requirements.
Other legislation, specifically the USA PATRIOT Act and the 9/11  Commission Act, requires TSA to take specific actions to ensure the  security of commercial vehicles. The USA PATRIOT Act provides that a  state may not issue to any individual a license to transport hazardous  materials unless that individual is determined not to pose a security risk.  TSA regulations require that drivers who transport hazardous materials  undergo a security threat assessment that consists of an evaluation of a  driver’s criminal history, immigration status, mental capacity, and  connections to terrorism to determine if the driver poses a security risk.  The 9/11 Commission Act also requires that the Secretary of Homeland  Security, by August 2008, submit a report to Congress that includes, among  other things, a security risk assessment on the trucking industry, an  assessment of industry best practices to enhance security, and an  assessment of actions already taken by both public and private entities to  address identified security risks. The act also mandates that the Secretary  develop a tracking program for motor carrier shipments of hazardous  materials by February 2008. With regard to intercity buses, the act  requires that the Secretary issue regulations by February 2009 requiring  high-risk, over-the-road bus operators to conduct vulnerability  assessments and develop and implement security plans. The act further  mandates that the Secretary of Homeland Security issue regulations by  February 2008 requiring all over-the-road bus operators to develop and  implement security training programs for frontline employees, and that the  Secretary establish a security exercise program for over-the-road bus  transportation. The act also requires DOT to take specific actions related  to the security of commercial vehicles. For example, the Act requires that  the Secretary of Transportation, by August 2008, analyze the highway  routing of hazardous materials, and develop guidance to identify and  reduce safety and security risks.
DOT’s PHMSA has issued regulations intended to strengthen the security  of the transportation of hazardous materials. The regulations require  persons who transport or offer for transportation certain hazardous  materials to develop and implement security plans. Security plans must  assess the security risks associated with transporting these hazardous  materials and include measures to address those risks. At a minimum, the  plan must include measures to (1) confirm information provided by job  applicants hired for positions that involve access to and handling of  hazardous materials covered by the security plan, (2) respond to the  assessed risk that unauthorized persons may gain access to hazardous  materials, and (3) address the assessed risk associated with the shipment  of hazardous materials from origin to destination. The regulations also  require that all employees who directly affect hazardous materials  transportation safety receive training that provides awareness of security  risks associated with hazardous materials transportation and of methods  designed to enhance transportation security. Such training is also to  instruct employees on how to recognize and respond to possible security  threats. Additionally, each employee of a firm required to have a security  plan must be trained concerning the plan and its implementation.
DHS funding for commercial vehicle security consists of a general  appropriation to TSA for its entire surface transportation security  program, which includes commercial vehicles and highway infrastructure,  rail and mass transit, and pipeline, as well as and appropriations to the  Federal Emergency Management Administration (FEMA) for truck and  bus security grant programs. Annual appropriations to TSA for surface  transportation security for fiscal years 2006 through 2009 are presented in  table 1.
The number of TSA full-time employees (FTEs) dedicated to highway and  motor carrier security—which includes both commercial vehicles and  highway infrastructure—has remained at about 19 FTEs annually since  fiscal year 2002.

		Commercial Trucking Industry

TSA estimates that there are approximately 1.2 million commercial  trucking companies in the United States. Trucks transport the majority of  freight shipped in the United States: by tonnage, 65 percent of total  domestic freight; by revenue, 75 percent. According to TSA, 75 percent of  U.S. communities depend solely on trucking to transport commodities.  Trucks and buses have access to nearly 4 million miles of roadway in the  United States. Trucking companies range in size from a single truck to  several thousand trucks. According to DOT 2004 data, which are the most  current available, 87 percent of trucking companies operated 6 or fewer  trucks, while 96 percent operated 20 or fewer. DOT estimates that about  40,000 new commercial trucking companies enter the industry annually.  As of August 2008, nearly 11.9 million commercial trucks were registered  with DOT. Trucks come in a large variety of configurations and cargo body  types to perform a wide range of tasks. Some trucks are used for local  tasks such as construction, landscaping, or local package delivery, while  others are used for transporting cargo over-the-road or for long hauls. For  a more complete summary of DOT data on commercial trucking and bus  firms, trucks and buses, and drivers, see appendix V.
The trucking industry is diverse, involving several different sectors and  including for-hire and private fleets, truckload and less-than-truckload  carriers, bulk transport, hazardous materials, rental and leasing, and  others. For-hire firms are those for which trucking is their primary  business, while private fleets are generally used to support another  business activity, such as grocery chains and construction. According to a  2002 DOT survey, for-hire trucks represented 47 percent of the industry,  while private fleets represented 53 percent. While truckload carriers  move loads from point to point, less-than-truckload carriers pick up  smaller shipments and consolidate them at freight terminals. Bulk  transport firms move bulk commodities such as gasoline, cement and corn  syrup in large trailers specifically designed for each type of commodity.  Truck rental and leasing companies also are part of the commercial  trucking industry. Consumer rental companies rent trucks to walk-in  customers for short periods of time and represent 15 percent of the rental  and leasing industry. Commercial rental and leasing companies generally  lease trucks for a year or longer and account for the remaining 85 percent  of the rental and leasing industry.
With respect to the transportation of hazardous materials, of an estimated  1.2 million commercial vehicle firms, 60,682 are registered as hazardous  materials carriers, or about 5 percent of the commercial vehicle industry,  and 1,778,833 drivers are licensed to transport hazardous materials.  Hazardous materials are transported by truck almost 800,000 times a day,  and 94 percent of hazardous material shipments are by trucks, which  transport approximately 54 percent of hazardous materials volume (tons).  DOT PHMSA classifies hazardous materials under 9 different classes of  hazards. Most hazardous materials shipments by truck involve flammable  liquids such as gasoline (81.8 percent), followed by gases (8.4 percent) and  corrosive materials (4.4 percent). Class 6 toxic poisons include Toxic  Inhalation Hazards (TIH) but comprise only 0.2 percent of hazardous  materials transported by truck. The shipment of security sensitive  hazardous materials such as Toxic Inhalation Hazards is of particular  concern to TSA, although the agency estimates that they represent just  .000058 percent of the commercial vehicle industry. Eighty-one percent of  the Toxic Inhalation Hazards transported by truck is anhydrous ammonia  and 10 percent is chlorine.

		Commercial Bus Industry

Commercial bus companies represent less than 1 percent of the  commercial vehicle industry, but according to TSA estimates, carry 775  million passengers annually. Intercity buses, or motor coaches, include  buses with regularly scheduled routes, as well as tour and charter bus  companies. In August 2008, DOT reported that there were 3,948 motor  coach carriers, with 75,285 buses. Of these carriers, fewer than 100 are  intercity bus companies, which transport passengers from city to city on  scheduled routes, while the remaining carriers operate tour and charter  buses. Most bus companies (95 percent) are small operators with fewer  than 25 buses. Intercity buses, or motor coaches, serve all large  metropolitan areas and travel in close proximity to some of the nation’s  most visible and populated sites, such as sporting events and arenas,  major tourist attractions, and national landmarks. A few intercity bus  carriers also travel internationally to Canada and Mexico. According to a  study commissioned by DOT, the accessibility and open nature of the  motor coach industry make it difficult to protect these assets, and the level  of security afforded to the infrastructure of the motor coach industry is  relatively low compared to the commercial aviation sector, despite the fact  that the motor coach industry handles more passengers a year.

		Risk Management Approach to Guide Homeland Security Investments

HSPD-7 directed the Secretary of DHS to establish uniform policies,  approaches, guidelines, and methodologies for integrating federal  infrastructure protection and risk management activities. Recognizing that  each sector possesses its own unique characteristics and risk landscape,  HSPD-7 designates Federal Government Sector-Specific Agencies (SSAs)  for each of the critical infrastructure sectors to work with DHS to improve  critical infrastructure security. On June 30, 2006, DHS released the  National Infrastructure Protection Plan (NIPP), which developed—in  accordance with HSPD-7—a risk-based framework for the development of  Sector-Specific (SSA) strategic plans. The NIPP defines roles and  responsibilities for security partners in carrying out critical infrastructure  and key resources protection activities through the application of risk  management principles. Figure 3 illustrates the several interrelated  activities of the risk management framework as defined by the NIPP,  including setting security goals and performance targets, identifying key  assets and sector information, and assessing risk information including  both general and specific threat information, potential vulnerabilities, and  the potential consequences of a successful terrorist attack. The NIPP  requires that federal agencies use this information to inform the selection  of risk-based priorities and continuous improvement of security strategies  and programs to protect people and critical infrastructure through the  reduction of risks from acts of terrorism.
The NIPP risk management framework consists of the following  interrelated activities:    Set security goals: Define specific outcomes, conditions, end points, or  performance targets that collectively constitute an effective protective  posture.  Identify assets, systems, networks, and functions: Develop an inventory of  the assets, systems, and networks that comprise the nation’s critical  infrastructure, key resources, and critical functions. Collect information  pertinent to risk management that takes into account the fundamental  characteristics of each sector.
Assess risks: Determine risk by combining potential direct and indirect  consequences of a terrorist attack or other hazards (including seasonal  changes in consequences, and dependencies and interdependencies  associated with each identified asset, system, or network), known  vulnerabilities to various potential attack vectors, and general or specific  threat information.
Prioritize: Aggregate and analyze risk assessment results to develop a  comprehensive picture of asset, system, and network risk; establish  priorities based on risk; and determine protection and business continuity  initiatives that provide the greatest mitigation of risk.  Implement protective programs: Select sector-appropriate protective  actions or programs to reduce or manage the risk identified, and secure  the resources needed to address priorities.
Measure effectiveness: Use metrics and other evaluation procedures at the  national and sector levels to measure progress and assess the  effectiveness of the national Critical Infrastructure and Key Resources  protection program in improving protection, managing risk, and increasing  resiliency.

	TSA Has Begun Conducting Risk Assessments of the Commercial Vehicle Sector, but Has Not Completed These Efforts or Fully Used the Results to Support Its Security Strategy

TSA has taken actions to assess the security risks associated with the  commercial vehicle sector, including assessing threats, initiating  vulnerability assessments, and developing best security practices, but  more work remains to fully assess the security risks of commercial trucks  and buses, and to ensure that this information is used to inform TSA’s  security strategy. Although TSA has completed a variety of threat  assessments and is in the process of developing several threat scenarios  with likelihood estimates, its key annual threat assessments do not include  information about the likelihood of a terrorist attack method on a  particular asset, system or network, as required by the NIPP. However, in  September 2008, TSA reported that in response to the 9/11 Commission  Act mandate that it submit a risk assessment report on commercial  trucking security TSA was planning to use threat scenarios with likelihood  assessments for highway and motor carriers. TSA has also cosponsored a  large number of vulnerability assessments through a pilot initiative in the  state of Missouri. However, TSA has made limited progress and has not  established a plan or time frame for conducting a vulnerability assessment  of the commercial vehicle sector nationwide. Moreover, TSA has not  determined how it will address the June 2006 recommendations of the  Missouri Pilot Program evaluation report regarding the ways in which  future vulnerability assessments can be strengthened. As a result, the  agency cannot ensure that its CSR efforts will fully identify the  vulnerabilities of the sector. Standards for internal controls in the federal  government require that findings and deficiencies reported in audits and  other reviews be promptly reviewed, resolved, and corrected within  established time frames.  In addition, TSA has not conducted assessments  of consequences of a terrorist attack on the commercial vehicle sector, or  developed a plan to conduct sectorwide consequence assessments. The  TSSP calls for a sectorwide approach and strategies to managing security  risks, and TSA has identified one of its strategic goals as conducting an  inventory of the security status of the nation’s highway and motor carrier  systems. In addition, standard practices in program and project  management call for developing a road map, or a program plan, to achieve  programmatic results within a specified time frame or milestones. TSA has  not completed a sectorwide risk assessment of the commercial vehicle  sector or determined the extent to which additional risk assessment  efforts are needed, nor has it developed a plan or a time frame for doing  so, including an assessment of the resources required to support these  efforts. In addition, TSA has not fully used available information from its  ongoing risk assessments to develop and implement its security strategy.  As a result, TSA cannot be assured that its approach for securing the  commercial vehicle sector is aligned with the highest priority security  needs. Moreover, TSA has not completed a report as required by the 9/11  Commission Act on various aspects of commercial vehicle security.

		TSA Developed Threat Assessments of the Commercial Vehicle Sector, but Generally Did Not Identify the Likelihood of Specific Threats as Required by the NIPP

TSA has and continues to conduct threat assessments of the commercial  vehicle sector by reviewing known terrorist goals and capabilities, and is  in the process of strengthening its efforts by developing more specific  threat likelihood information to inform agency risk assessment efforts.  TSA’s Office of Intelligence (OI) develops a variety of products identifying  the threats from terrorism, from annual threat assessments on each  transportation sector to weekly field intelligence summaries and daily  briefings. OI also disseminates additional threat and suspicious incident  information to key federal and nonfederal stakeholders as needed related  to the commercial vehicle sector. To date, these threat assessments have  found an increase in truck and bus terrorist incidents abroad and that  VBIEDs were the most likely tactic. TSA OI officials stated that they  continue to regard common VBIEDs as a greater threat than attacks using  hazardous materials such as chlorine. OI further reported that the July  2005 bus bombing in London demonstrated the capability and intent of  terrorists to bomb passenger buses in Western nations.
While TSA’s threat assessments provide detailed summaries of recent  attacks and incidents of interest, and are useful to TSA in informing its  strategy for securing commercial vehicles, they do not include information  on the likelihood of various types of threats. The NIPP requires that in the  context of terrorist risk assessments, the threat component of the analysis  be calculated based on the estimated likelihood of a terrorist attack  method on a particular asset, system, or network. The estimate of this  likelihood is to be based on an analysis of intent and capability of a  defined adversary, such as a terrorist group. However, TSA has not  included likelihood estimates in its annual threat assessments for the  highway and motor carrier sector. In 2006, TSA developed rankings of the  likelihood of various tactics—such as attacks using VBIEDs, VBIED- assisted hazardous materials, and other threats—for highway and  commercial vehicles. However, TSA subsequently excluded these  likelihood assessments in its 2008 annual threat assessment for the  highway sector and did not provide us with the rationale for this decision.  OI told us that it developed likelihood estimates for specific threat  scenarios used in the draft National Transportation Sector Risk  Assessment (NTSRA). NTSRA is being conducted by TSA to assess risks  across the entire U.S. transportation system and contains nine high-level  scenarios and threat likelihood estimates related to commercial vehicles.  Of these high-level scenarios, eight involve VBIEDs, and one involves  hazardous materials. OI rated the intent and capability of terrorists to  perform each threat scenario to provide their estimate of the relative  likelihood of each scenario. However, TSA officials could not identify  when the NTSRA will be finalized. In addition, in June 2008, OI reported  that it would provide likelihood assessments for threat scenarios that were  to be conducted in response to a mandate in the 9/11 Commission Act that  DHS submit a risk assessment report on the commercial trucking sector.
While more extensive threat scenarios are being developed for the  commercial vehicle sector, including likelihood estimates, TSA’s annual  threat assessments do not include information on the likelihood of threat.  HMC officials stated that this lack of specific threat information continues  to challenge agency risk managers. Without more information on the  likelihood of the various threats, there is limited assurance that TSA is  focusing its efforts on the activities that pose the greatest threat. Officials  stated that they may incorporate likelihood estimates in the annual  highway and motor carrier threat assessments in the future, but did not  have specific plans to do so.

		TSA Has Begun to Conduct Industry Vulnerability Assessments of the Commercial Vehicle Sector, but Its Efforts Are in the Early Stages

TSA has begun conducting vulnerability assessments of the commercial  vehicle sector, but its efforts are in the early stages. In addition, the agency  has not determined the extent to which additional vulnerability  assessments are needed, and does not have a strategy or time frame for  assessing sectorwide vulnerabilities. HSPD-7 requires each Sector-Specific  Agency to conduct or facilitate vulnerability assessments of its sector. In  addition, the NIPP states that DHS is responsible for ensuring that  comprehensive vulnerability assessments are performed for critical  infrastructure and key resources that are deemed nationally critical, and  the TSSP further emphasizes a sectorwide system-based approach to risk  management. To determine the vulnerability of commercial vehicles as  targets or as weapons to attack critical infrastructure in the United States,  TSA has begun conducting vulnerability assessments known as Corporate  Security Reviews (CSRs). TSA initiated the CSR program in November  2005 to: (1) develop best practices for securing the commercial vehicle  industry through discussions with carrier representatives and site visits to  carrier facilities; (2) collect and maintain data that will allow TSA HMC to  assess various aspects of security across the trucking and motor coach  industries through statistical analysis of survey data; (3) identify security  gaps and opportunities for improvement; (4) promote security awareness  and collaboration with the commercial vehicle industry; (5) provide  guidance to motor carriers on their relative level of risk exposure; and (6)  determine the costs and benefits of risk mitigation activities.
As of September 2008, TSA had conducted 100 CSRs of motor carriers,  including 15 motor coach companies, 20 school bus companies/districts,  and 65 trucking companies. These CSRs were of large firms that were  identified by industry stakeholders as having the best security practices in  the industry and that agreed to participate in the CSRs on a voluntary  basis. TSA conducts these reviews by sending teams of two to four people  from TSA headquarters to a trucking or bus company, for one or two days,  to analyze the company security plan and mitigation procedures, and make  informal recommendations to strengthen security based on a draft of best  security practices TSA developed. At the conclusion of the CSRs, TSA  prepares summary reports of its findings and informal recommendations.  TSA also developed a draft best security practices in February 2006 for  trucking firms based on the results of early CSRs, as well as on TSA staff  expertise, industry stakeholder input, and best security practices from  other transportation sectors such as rail and pipeline, according to  officials.  These draft best practices include measures companies can  take to conduct threat, vulnerability, and consequence assessments. They  also provide guidance on developing a security plan and strengthening  personnel security, training, hazardous materials storage, physical security  countermeasures, cyber security, and emergency response exercises.  However, according to TSA officials, the agency has delayed issuing these  draft best practices in final form until it can complete and incorporate  public and industry comments on draft security guidance specifically for  carriers of hazardous materials. The 9/11 Commission Act requires that  DHS, by August 2008, submit a report to Congress that includes, among  other things, an assessment of trucking industry best practices to enhance  security. TSA reported that as of September 2008, it had not finalized these  best practices, but they hoped to complete a template within 4 months.  Officials stated that they plan to develop a flexible list of best practices  that firms can adapt based on their line of work, size, and circumstances.
TSA began a second CSR effort in April 2006 through a pilot project with  the state of Missouri which greatly expanded the number of firms  reviewed, and extended the reviews to smaller, more diverse firms.  Objectives of the pilot were to promote security awareness, collect  information on the security status of participating firms, and promote  public and private collaboration among federal, state, and private sector  stakeholders. TSA partnered with the State of Missouri, FMCSA’s Motor  Carrier Safety Assistance Program, and the Commercial Vehicle Safety  Alliance (CVSA) to train Missouri state safety inspectors to conduct these  CSRs. DOT funded the CSRs and assisted Missouri in the selection of  firms to be reviewed and interviewed. The CSRs performed by TSA  headquarters staff were of large companies known to have more robust  security measures in place, while the Missouri CSRs were generally  conducted on small firms that are most common in the industry.  Reviewing the security practices of these small firms can require  inspectors to travel to remote locations all over the state. For example,  one Missouri CSR we attended assessed a small landscaping company with  12 trucks, while another CSR assessed an owner-operator with a single  truck in front of his house (fig. 4). Although these reviews remained  voluntary, they were conducted in conjunction with mandatory safety  reviews that Missouri inspectors routinely conduct on commercial vehicle  trucking and motor coach firms. Motor carriers were selected for Missouri  CSRs based on either their safety records as evaluated by FMCSA, or  because they were newly registered firms. TSA officials stated that  partnering with the state’s safety inspections enabled TSA to review a  more diverse group of firms than it did during the original CSRs. Typically,  the Missouri pilot CSRs involved site visits with structured interviews  using a questionnaire based on TSA’s draft best security practices, and  generally lasted less than an hour compared to one or two days as was the  case with the original CSRs. The Missouri CSR pilot concluded in February  2007; however, TSA has continued to partner with Missouri and FMCSA to  implement a permanent CSR program in the state. TSA told us that as of  September 2008, 3,420 CSRs had been completed in Missouri.
In September 2006, TSA awarded a contract to evaluate the extent to  which the Missouri CSR pilot program met its objectives, and whether the  firms reviewed had implemented effective security measures. The report  reviewed the 1,251 CSRs conducted by Missouri inspectors from April  2006 through February 2007, including 1,231 trucking companies (98.4  percent), 18 motor coach companies (1.4 percent), and 2 school bus  operators (0.2 percent). The evaluation reviewed each firm’s responses to  the CSR questionnaire and assigned it an overall security score based on  the security measures the firm reported having in place that were  consistent with TSA’s draft best security practices. The contractor  reported on the results of the study in June 2007 and concluded among  other things, that:  the interviewed carriers did not have extensive security procedures in  place;    small carriers and owner operators had implemented fewer security  measures than larger carriers; and    hazardous materials carriers identified by the contractor had implemented  most of the security measures on the TSA CSR questionnaire.
The evaluation report also found that while both motor coaches and  nonpassenger motor carriers had low scores, motor coaches scored  somewhat higher than nonpassenger motor carriers. The report concluded  that the program had achieved its objectives of promoting security  awareness, collecting information on the security status of participating  commercial vehicle firms, and promoting public and private sector  collaboration among federal, state, and private sector stakeholders.  However, the report also concluded that the Missouri sample was not  representative of the commercial vehicle industry in Missouri or of the  industry nationwide. The report further concluded that since the CSRs  were based on best practices developed for much larger firms, the CSR  data did not completely reflect overall security practices and capabilities  for small carriers. Missouri officials we interviewed concurred that the  CSR sample was not representative of Missouri firms since the majority of  carriers that do not encounter safety problems would not be included in  their CSR reviews. The evaluation report of the Missouri CSR pilot made a  number of recommendations to TSA to expand and improve the CSR  program. These recommendations included that TSA:  review and address CSR pilot program deficiencies;    develop a set of best practices and baseline security standards that is risk- based and appropriate for different sizes and types of firms;  improve the CSR questionnaire to make it more effective in capturing  security practices and vulnerabilities of both small and large carriers;    develop a deployment strategy to expand the Missouri pilot program to  other carriers and other states;    develop a statistically sound methodology for selecting companies for  CSRs as it evaluates the commercial vehicle industry nationwide by  conducting a random sample of motor carriers;    work with FMCSA to leverage each other’s resources and possibly merge  security inspection programs; and    develop a CSR Web portal to provide a more tailored CSR questionnaire to  address different industry sector security needs.
Two years after these recommendations were made, TSA has taken limited  steps to implement them, although officials stated that they were  continuing to review the recommendations. As a result, the agency cannot  ensure that its CSR efforts will fully identify sector vulnerabilities.  Standards for internal controls in the federal government require that  findings and deficiencies reported in audits and other reviews be promptly  reviewed, resolved, and corrected within established time frames. The  Missouri evaluation report’s recommendation that TSA develop a  statistically sound methodology for selecting companies to review was  consistent with TSA’s original goal that CSRs collect data that enable  statistical analysis. In September 2008, TSA officials stated that they had  worked out agreements with Michigan and Colorado to begin conducting  CSRs in these states, beginning with training officers in October 2008.  However, TSA did not have a plan in place or time frame for assessing  industry-wide vulnerabilities. The lead official for risk assessment with  TSA HMC stated that the agency would like to conduct a vulnerability  assessment of a valid nationwide sample of the commercial vehicle  industry, but that it lacked the resources to do so. TSA officials further  stated that to further expand its CSR efforts, it has initiated a program to  train Federal Security Director  personnel (FSDs) at 3 airports to conduct  CSRs on commercial vehicles in the airports’ surrounding areas. Officials  told us that FSDs had completed 5 CSRs during fiscal year 2008.
Without completing industry vulnerability assessments as required by  HSPD-7 and the NIPP, TSA cannot complete an overall assessment of the  industry security risks. For example, instead of assessing the  vulnerabilities of the entire commercial vehicle sector, at the direction of  TSA management, TSA HMC is currently focusing all of their CSR efforts  on the hazardous materials transportation sector. However, TSA’s pilot  study on Missouri firms found that hazardous materials transportation  companies reviewed by the contractor performed much better than other  companies in terms of implementing security measures to mitigate  potential vulnerabilities.

		TSA Has Not Begun to Conduct Consequence Assessments of the Commercial Vehicle Sector

TSA has collected some relevant information necessary for estimating the  impact of potential attacks involving the commercial vehicle sector, but  has not conducted consequence assessments of potential terrorist attacks  or leveraged the consequence assessment efforts of others. The DHS NIPP  defines consequence assessment as the worst reasonable adverse impact  of a successful terrorist attack. According to the NIPP, risk assessments  should include consequence assessments to measure the negative effects  on public health and safety, the economy, public confidence in  institutions, and the functioning of government that can be expected if an  asset, system, or network is damaged, destroyed, or disrupted by a  terrorist attack. The TSA’s TSSP also requires that risk analysis include a  consideration of consequences. Terrorism involving commercial vehicles  can affect a broad range of targets, including not only trucks and buses,  but also freight and passengers, terminals, truck stops, and rest areas. In  addition to the commercial vehicle system being attacked, commercial  vehicles can be used to attack other assets. When used as VBIEDs with  explosives or fuel, for example, commercial vehicles can be used to target  highway, buildings, and other critical infrastructure. A powerful truck  bomb can destroy from a considerable distance. For example, Khobar  Towers was attacked from 80 feet away (fig. 5).
Truck VBIED attacks can also target large numbers of people, as was the  case with the coordinated attack of several truck bombs in Northern Iraq  on August 14, 2007, that killed approximately 500 people, or to assassinate  individuals such the former Lebanese Prime Minister Rafik Hariri.  Worldwide, buses have been the target of bombings---some involving  suicide bombers---on numerous occasions, such as the attack on former  Prime Minister Benazir Bhutto at a mass rally in Pakistan.
TSA officials stated that they cannot conduct consequence assessments of  the commercial vehicle sector because truck bombs can be used to attack  most of the nation’s critical infrastructure. Accordingly, officials stated  that the number of potential consequences of terrorist attacks is too great  to practically assess. Although TSA has not conducted consequence  assessments of the commercial vehicle sector, the agency has acquired  data from the Bureau of Alcohol, Tobacco and Firearms (ATF) and the  U.S. Army on evacuation distances for various-sized shipments of  explosives and flammable substances, and PHMSA’s Emergency Response  Guidebook for first responders to hazardous materials incidents that could  be applied to future consequence assessments. TSA officials  acknowledged that obtaining data on evacuation distances is only a first  step in conducting consequence assessments. Evacuation distance  provides one measure of the potential consequences of a terrorist attack  by defining the danger zone surrounding an attack by a particular type and  size of explosive or flammable materials. For example, according to U.S.  Army data, the building evacuation distance for such a worst case scenario  truck bomb would be a minimum of 1,570 feet, and the minimum outdoor  evacuation of people would be 7000 feet. Using another example, a fireball  from a fuel truck can threaten both structures and people; accordingly,  ATF guidance suggests a minimum evacuation distance of 6,500 feet. In  comparison, a tank truck of anhydrous ammonia, which represents 81  percent of Toxic Inhalation Hazard (TIH) shipments, has a smaller  recommended standoff distance of 2,112 feet, and the recommended  standoff distance for chlorine, which is the next most common form of  Toxic Inhalation Hazard, is 3,168 feet. However, other guidance, such as  the PHMSA’s Emergency Response Guidebook, provides different data  based on initial isolation distances and much larger maximum nighttime  protective action distances. TSA reported that it is working with various  federal partners and industry stakeholders to establish a uniform and  scientific assessment of potential consequences of VBIEDs and the  discharge of TIH materials. Although TSA has not conducted consequence  assessments of the commercial vehicle sector, OI officials stated that, in  their judgment, the likely consequences of common VBIED attacks were  greater than VBIED attacks using TIH materials because attempts to date  to use VBIEDs to vaporize chlorine into a gaseous inhalation hazard have  been largely unsuccessful, have caused little damage, and resulted in few  casualties. On the other hand, according to officials, VBIEDs using a  number of different explosives and incendiary materials have repeatedly  been successfully used to kill people.
TSA officials stated that the agency also has not leveraged DHS’s ongoing  nationwide risk assessment efforts to obtain consequence information.  For example, recognizing that each sector of our country’s critical  infrastructure possesses its own unique characteristics, operating models,  and risk landscape, pursuant to HSPD-7, the NIPP designates 18 critical  infrastructure sectors and the agencies responsible for each of the sectors  to work with DHS to implement a risk management framework for the  sector and develop protective programs. Each of the 18 sectors has issued  Sector Annual Reports (SARs) of their risk management activities,  including consequence assessments, which HMC could draw upon to  support the assessment of VBIED and hazardous materials consequences  for other critical infrastructure sectors. For example, the 2007 sector  annual reports identified the following for select sectors:  Commercial Nuclear Power Sector: The Department of Energy employs a  Comprehensive Review Program to analyze facilities that it considers  potential terrorist targets. The Nuclear Sector Annual Report indicated  that as of May 2007, reviews had been completed of the vulnerabilities and  potential consequences of an attack on 52 of 65 commercial nuclear  reactors.
Dams Sector: The 2007 Dams Sector Annual Report identified that all  security measures were in place at 152 of 254 Army Corps of Engineers  dams, and the Federal Energy Regulatory Commission reported having  completed risk assessments on its 1,200 most security-sensitive dams. The  report also called for improved blast-damage estimates for VBIEDs on  certain dams and levees that are potential targets for terrorist attacks.
The Chemical Sector: The 2007 Chemical Sector Annual Report, which  was based in part on industry risk assessments, identified that VBIEDs are  a particular concern because of their portability, size, and potential to  cause grave damage.
In addition, DHS’s 2007 Strategic Homeland Infrastructure Risk  Assessment (SHIRA) assessed the highest risk scenarios targeting the  nation’s 18 critical infrastructure/key resources sectors, and highlighted  attack methods with cross-sector implications. The SHIRA used threat  assessments from the intelligence community and vulnerability and  consequence assessments from the SSAs to identify the attack methods  that pose the highest risk to the respective sectors. TSA HMC could use  the SHIRA data to identify which sectors are most at risk from VBIEDs  and hazardous materials and then coordinate with those SSAs on their  vulnerability and consequence assessment efforts. TSA HMC could also  use a variety of other relevant assessments to obtain consequence  information. These include the agency’s Aviation Domain Risk Assessment  which also considers consequences for a wide range of attack scenarios  including VBIEDs, the Department of Energy’s risk assessments of nuclear  weapons facilities, and the Nuclear Regulatory Commission’s assessments  of commercial nuclear power plants. Similar information is also available  from the Federal Risk Assessment Working Group, a federal risk  assessment information clearinghouse that shares information about  completed and ongoing risk assessments through regular meetings and a  Web portal. TSA did not comment on why it has not developed a plan for  completing consequence assessments, or why it was not leveraging the  analysis of potential consequences included in these risk assessments.

		An Incomplete Risk Assessment Impedes TSA’s Ability to Identify Effective Risk Reduction Efforts

As discussed earlier in this report, TSA has identified one of its strategic  goals as taking an inventory of the security status of the nation’s highway  and motor carrier systems, but it has not developed a plan or a time frame  for completing a risk assessment of the commercial vehicle sector. Based  on general guidance in the NIPP, the TSSP states that TSA’s plan for risk  assessment should use a combination of both expert and field-level risk  assessment techniques to guide its risk management efforts. Expert risk  assessments are based on national risk priorities and strategic risk  objectives, scenario analyses and the expert judgment of agency officials,  national assessments, and annual threat assessments. Field-level risk  assessments include state and local assessments, and field inspections  such as TSA’s CSRs and DOT Security Contact Reviews (SCRs). Expert  assessments and field assessments have the same goal of identifying  where the greatest risk mitigation measures are needed.
As previously discussed, TSA is conducting nine high-level scenarios  related to commercial vehicles, and has contracted to have more threat  scenarios conducted to assess commercial trucking security risks in  response to a mandate in the 9/11 Commission Act. While these expert  assessments, if implemented effectively, should give TSA insights into the  security risks of the industry, they will likely provide limited information  on what sectors or companies are most at risk and what mitigation  practices are currently in place, unless they are further supported by field- level risk assessments consistent with the TSSP.
As stated previously, TSA is in the early stages of conducting CSRs and the  majority of CSRs have to date been conducted in a single state, Missouri.  Although TSA is working to expand both its threat scenarios and CSRs,  progress to date has been limited. TSA also has not reported on the scope  and method of risk assessments required for the commercial vehicle  sector. Specifically, it has not reported what mix of expert and field-level  risk assessments it intends to use and how it plans to integrate the two.
Standard practices in program and project management include  developing a road map, or a program plan, to achieve programmatic  results within a specified time frame or milestones. TSA officials  recognize that the agency needs more complete and accurate risk  assessment information to inform its security strategy. However, TSA has  not developed a plan or a time frame for completing a risk assessment of  the commercial vehicle sector, including the level of resources required to  complete the assessment and the appropriate scope of the assessment  including determining the combination of threat scenarios and field-level  vulnerability assessments it intends to use.
The NIPP requires that it and the TSSP be reviewed and undergo periodic  interim updates as required, and reviewed and reissued every 3 years or  more frequently as needed and directed by the Secretary of Homeland  Security. Accordingly, the TSSP states that it will undergo periodic  updates and eventually align with the NIPP triennial update cycle. The  Highway Infrastructure and Motor Carrier Modal Annex also states that  the Government Coordination Council (GCC) and SCC are to submit  revisions to the annex on an annual basis, and the GCC and SCC are to  conduct a complete revision of the annex every 3 years. HMC began its  revision process by updating the TSSP Highway Infrastructure and  Motorcarrier Annex in 2008 to allow time for the revised strategy to be  reviewed by the GCC, SCC, and various working groups and will submit it  for review by the third quarter of 2009. The quality of this and future  revisions of the annex will depend in large measure on the progress of risk  assessments of the commercial vehicle sector and their utilization by TSA  managers to inform their risk mitigation efforts.
HMC officials stated that without complete risk assessments, they were  directed by TSA and DHS leadership to base their strategy for securing the  commercial vehicle sector on an examination of the security risks posed  by the shipment of hazardous materials. However, agency officials could  not identify why TSA and DHS leadership made this distinction, and the  rationale for this directive is unclear. HMC officials also cited several  additional reasons for focusing their security efforts on commercial  vehicles transporting hazardous materials, including the professional  judgment of its staff in the motor carrier industry; risk assessments TSA  conducted for other transportation sectors, particularly rail; and legislative  requirements, in particular the USA PATRIOT Act. However, the  applicability of rail risk assessments to highways is unclear because  VBIEDs trucks can directly access and attack most buildings in the United  States, whereas rail cannot. Rail shipments also typically ship freight,  including Toxic Inhalation Hazards, in far larger quantities than can be  carried on a truck. Regarding congressional direction, the USA PATRIOT  Act required TSA to perform a background check for all applicants for an  endorsement of their commercial driver’s licenses to allow them to carry  hazardous materials, but did not direct TSA to focus its commercial  vehicle security efforts on hazardous materials. Moreover, available risk  assessment information suggests alternatives or additions to the agency’s  current focus on commercial vehicle transport of hazardous materials.  TSA OI officials have consistently reported that VBIEDs are a greater  threat to the United States than hazardous materials, including Toxic  Inhalation Hazards. In addition, the evaluation of the Missouri CSR found  that truck companies that transport hazardous materials stood out from  other truck companies as having implemented most of TSA’s security  procedures, and concluded that hazardous materials transporting  companies were leaders related to the commercial vehicle sector. In  addition, in October 2007 DHS Secretary Chertoff stated that IEDs  remained a terrorist weapon of choice since they were easy to make,  difficult to defend against, and could cause untold destruction. TSA OI  officials stated that they continue to regard common VBIEDs as a greater  threat than attacks using hazardous materials such as chlorine. Evacuation  data also suggest that VBIEDs can have potentially broader impact than  trucks carrying many forms of Toxic Inhalation Hazards. Without an  existing strategy that is based on available risk assessment information,  TSA cannot be assured that its current approach, which is focused on  hazardous materials, is aligned with the highest priority security needs of  the commercial vehicle sector.

	Government and Industry Have Taken Actions to Strengthen the Security of Commercial Vehicles, but TSA Has Not Completely Assessed the Effectiveness of Its Actions

Key government and industry stakeholders have taken actions to  strengthen the security of the commercial vehicles sector, but TSA has not  assessed the effectiveness of its actions. At the federal level, DHS and DOT  have implemented a number of programs designed to strengthen  commercial vehicle security, particularly programs for the protection of  hazardous materials. States, individually and collectively, through their  state transportation and law enforcement associations, have also worked  to strengthen the security of commercial vehicles. In addition, most of the  private truck and motor coach industry associations we contacted stated  that they were assisting their members in strengthening security by  providing those members with guidance on best practices. TSA also  contracted for an evaluation of the Missouri pilot CSRs that found the  industry security practices were not extensive, but noted that the sample  of firms in the pilot was not representative of the entire industry. Our site  visits to 26 commercial truck and bus companies found that most had  implemented basic security measures, including some form of personnel  security and background checks, terminal security, locks and access  controls, trailer seals, and communications and tracking equipment. TSA  has begun developing output-based performance measures to gauge  progress on achieving milestones and other program activities for its  security programs, but the agency has not developed measures and data to  monitor outcomes, that is, the extent to which these programs have  mitigated security risks and strengthened commercial vehicle security.  The TSSP identifies that performance measures of strategic goals and  objectives should be outcome-based, but notes that interim output  measures may be used during the early years of the program when  baseline data on the program’s performance are being acquired. Without  more complete performance measures, TSA will be limited in assessing  the effectiveness of federal commercial vehicle security programs. TSA  officials agreed that opportunities exist to develop outcome-based  performance measures for its commercial vehicle security programs, and  stated that they would like to do so in the future.

		The Federal Government, States, and Private Industry Have Taken Action to Enhance the Security of Commercial Vehicles

A variety of federal programs have been implemented to enhance the  security of the commercial vehicle sector. Several of these programs have  been implemented by TSA and other DHS components, others by DOT,  and several jointly by DHS and DOT. Overall, these programs are designed  to assess commercial vehicle industry security risks, develop guidance on  how to prevent and deter attacks, improve security planning for an  effective response to a potential terrorist attack, enhance cost-effective  risk mitigation efforts, and support research on commercial vehicle  security technology. States, both individually and as members of  transportation alliances with other states, have expanded their activities to  secure the commercial vehicle sector as a part of broader homeland  security activities. In addition, many commercial vehicle companies  receive guidance on security awareness and best practices from industry  associations. According to TSA’s pilot study of CSRs in Missouri, except  for firms transporting hazardous materials, most commercial vehicle  companies have implemented a limited number of security measures.

			DHS and DOT Security Programs

In addition to CSRs, TSA and other DHS components have a number of  programs underway designed to strengthen the security of commercial  vehicles: the Truck Security Grant Program (TSP), the Intercity Bus  Security Grant Program, Security Action Items (SAIs), and Hazardous  Materials Driver Background Check Program. The TSP provides grants  that fund programs to train and support drivers, commercial vehicle firms,  and other members of the commercial vehicle industry in how to detect  and report security threats, and how to avoid becoming a target of  terrorist activity. TSP is administered by DHS’s Federal Emergency  Management Agency’s Grant Programs Directorate. From fiscal years 2004  through 2008, the principal activity funded by the TSP was the American  Trucking Associations’ Highway Watch Program, which provided drivers  with security awareness training and support. In May 2008, however, a  new grantee was selected. DHS also established an Intercity Bus Security  Grant Program to distribute grant money to eligible stakeholders for  protecting intercity bus systems and the traveling public from terrorism.  Current priorities focus on enhanced planning, passenger and baggage  screening programs, facility security enhancements, vehicle and driver  protection, and training and exercises. In addition, TSA is consulting with  industry stakeholders and PHMSA to develop SAIs, or voluntary security  practices and standards, intended to improve security for trucks carrying  security-sensitive hazardous materials. The SAIs are intended to allow TSA  to communicate the key elements of effective transportation security to  the industry as voluntary practices, and TSA will use CSRs to gauge  whether voluntary practices are sufficient or if regulation is needed. TSA  released its voluntary SAIs for hazardous materials carriers in June 2008.  For example, it recommended using team drivers for shipments of the  most security sensitive explosives, toxic inhalation hazards, poisons, and  radioactive materials.
The USA PATRIOT Act passed in October 2001 prohibited states from  issuing Hazardous Materials Endorsements (HME) for a commercial  driver’s license to anyone not successfully completing a background  check. In response, DHS developed rules regarding how the background  checks will be conducted and implemented a hazardous materials driver  background check assessment program to determine whether a driver  poses a security risk. We have previously reported on the problem of  drivers who have job-hopped to circumvent the drug testing results  associated with background checks, including hazardous materials  drivers. As of October 2008, TSA had completed background checks for  990,961 out of approximately 2.7 million hazardous materials drivers, and  8,699 applicants have been denied HMEs since the beginning of the  program.
In addition to DHS, at the federal level, DOT has several commercial  vehicle security programs underway: Security Contact Reviews (SCR),  Security Sensitivity Visits (SSV), and the Hazardous Materials Safety  Permit Program. FMCSA conducts SCRs, or compliance reviews, of  commercial vehicle firms carrying hazardous materials. PHMSA  regulations require shippers and carriers of certain hazardous materials to  develop and implement security plans.  At a minimum, these plans must  address personnel, access, and enroute security. FMCSA SCRs review  company security plans as part of ongoing safety inspections. FMCSA also  conducts SSVs, or educational security discussions, with carriers of small  amounts of hazardous materials that do not require posting hazardous  materials placards on their trucks. As of September 2008, FMCSA had  conducted 7,802 SCRs and 13,411 SSVs since the inception of the  programs. Federal law also directed DOT to implement the Hazardous  Materials Safety Permit Program to produce a safe and secure  environment to transport certain types of hazardous materials. The  Hazardous Materials Safety Permit Program requires certain motor  carriers to maintain a security program and establish a system of enroute  communication.
In addition to CSRs, TSA and DOT also work collaboratively on several  projects involving the security of commercial vehicles, including FMCSA  and TSA research and development efforts for commercial vehicle security  technologies. Both FMCSA and TSA have also completed pilot studies of  tracking systems for commercial trucks carrying hazardous materials. For  example, FMCSA completed a study of existing technologies in December  2004 evaluating wireless communications systems, including global  positioning satellite tracking and other technologies that allow companies  to monitor the location of their trucks and buses. TSA is testing tracking  and identification systems, theft detection and alert systems, motor  vehicle disabling systems, and systems to prevent unauthorized operation  of trucks and unauthorized access to their cargos. The 9/11 Commission  Act requires that DHS provide a report to Congress by August 2008, that  includes, among other things, assessments of (1) the economic impact that  security upgrades of trucks, truck equipment, or truck facilities may have  on the trucking industry, including independent owner-operators; (2)  ongoing research by public and private entities and the need for additional  research on truck security; and (3) the current status of secure truck  parking. TSA officials stated that they are working on developing this  report but have not completed it. The 9/11 Commission Act also required  that DHS develop a tracking program for motor carrier shipments of  hazardous materials by February 2008. TSA officials reported that they  worked with DOT and implemented a program to facilitate truck tracking  in January 2008. However, TSA stated that while the 9/11 Commission Act  mandated the tracking program and authorized $21 million over 3 years for  its activities, it was never implemented because no funds were  appropriated for the program.
The 9/11 Commission Act also had a number of mandates regarding the  security of over-the-road buses, including that DHS issue regulations by  February 2008 requiring all over-the-road bus operators to develop and  implement security training programs for frontline employees, and that  DHS establish a security exercise program for over-the-road bus  transportation. The 9/11 Commission Act further requires that DHS issue  regulations by February 2009 requiring high-risk over-the-road bus  operators to conduct vulnerability assessments and develop and  implement security plans. TSA officials stated that they were preparing a  Notice of Proposed Rulemaking that, if finalized, would require high-risk,  over-the-road bus operators to conduct vulnerability assessments, and  develop security plans and training plans.

			State Actions

States are responsible for securing highway infrastructure, including  highways, bridges, and tunnels, and for ensuring the security and safety of  these roadways. State officials work on security issues within their  individual states and with other states through several national  associations. State transportation officials— through the American  Association of State Highway and Transportation Officials (AASHTO)—  and state law enforcement officials— through the Commercial Vehicle  Safety Alliance (CVSA)— have worked collectively to strengthen the  security of commercial vehicles and highway infrastructure through  various expert committees and the implementation of joint initiatives with  TSA and DOT. AASHTO formed a Special Committee on Transportation  Security that has sponsored highway and commercial vehicle security  research at the National Academies of Science. AASHTO also conducts  surveys of state DOT security efforts, priorities, and identified needs.  AASHTO’s August 2007 survey found that many state departments of  transportation still needed basic training on integrating homeland security  considerations in the planning process; detecting, deterring, and mitigating  homeland security threats; and assessing transportation network  homeland security vulnerabilities and risks. CVSA’s state law enforcement  members have also organized committees on Transportation Security,  Information Systems, Intelligent Transportation Systems, Hazardous  Materials, Passenger Carrier, and Training to pool and provide expertise to  promote best practices, new programs, and the consistent application of  regulations. For example, the purpose of the CVSA’s Transportation  Security Committee is to enhance homeland security by providing a forum  to identify, develop, implement, and evaluate education, enforcement, and  information-sharing strategies for enhancing commercial motor vehicle  security. CVSA’s Program Initiatives committee originated the idea of  conducting a CSR pilot in Missouri.
We interviewed transportation, law enforcement, and homeland security  officials responsible for commercial vehicle security from eight states to  determine the nature and extent of their security efforts. These officials  stated that they generally focused on law enforcement, protection of  highway infrastructure, conducting inspections of commercial vehicles,  and monitoring threats of all kinds. Officials in each state stated that they  understood the major transportation security risks in their state. For  example, officials from one state that has numerous chemical plants  expressed particular concern about the shipment of these chemicals,  while officials from another state with extensive military bases expressed  concern about shipments of nuclear weapons and waste. Officials from yet  another state with numerous explosives plants were more concerned  about the transportation of explosives. State and local authorities have  also created 58 fusion centers around the country to blend relevant law  enforcement and intelligence information analysis and coordinate federal,  state, and local security measures in order to reduce threats in local  communities. DHS analysts work with state and local authorities at fusion  centers to facilitate the two-way flow of information on all types of  hazards. DHS has provided staff and more than $254 million to state and  local governments to support these centers and facilitate the two-way flow  of information between DHS and the states. Although states have a  number of security efforts involving the commercial vehicle sector, none  of the state officials whom we interviewed (with the exception of those  from Missouri) reported conducting formal vulnerability assessments of  the commercial vehicle sector in their states.

			Private Sector Security Actions

Industry associations we interviewed were actively assisting their  members in strengthening the security of the commercial vehicle sector.
We met with 12 of the industry associations representing the commercial  vehicle industry, including trucking, motor coaches, shipping, and unions,  9 of which were members of TSA’s SCC. TSA relies on the SCC and its  industry association members to facilitate communications between the  agency and the commercial vehicle industry, and to assist in the  development of sector strategies, plans, and policies. Eight of these  industry associations reported that they regularly provided federal  officials with their industry’s perspective on proposed regulations and  legislation. Additionally, 8 of the 12 associations reported that they were  proactively providing security guidance to their members, which included  guidance on security best practices, security awareness, and security self- assessments. In addition, about a third of the associations we reviewed  reported providing training, security bulletins, and 24-hour hotlines for  their members. TSA supports several of these industry initiatives,  including working with trade associations to develop and distribute  security brochures for their members.
As discussed earlier in this report, the Missouri CSR Pilot evaluation  showed that firms carrying hazardous materials were complying with  regulations and implementing more security measures to mitigate their  risks than other commercial vehicle firms. In contrast, the study further  found that truck companies not transporting hazardous materials were  implementing few of TSA’s best security practices. During our site visits to  20 truck and 6 bus companies, ranging in size from the nation’s largest  commercial vehicle company with 27,453 trucks to an owner-operator  with a single truck, we found that most had some form of personnel  security procedures and background checks in place, as well as terminal  security, communications systems, and truck tracking systems. Overall,  the types of security practices among the commercial trucking companies  we visited were similar, but the prevalence and sophistication of these  practices varied. The range of security practices that companies were  using included requiring drivers to lock doors and inspect cargo; cargo  seals; driver background checks; vehicle tracking technology; terminal  fencing, cameras, and gates; access controls, such as employee  identification badges, sign-in and sign-out sheets, or electronic key cards;  en route security measures; and driver training. Large corporations and  small one-truck owner-operators generally used differently scaled security  approaches to the same problem. For example, while a cell phone can  suffice for the communications needs of a small operator, a large company  may invest in integrated communications and tracking technologies.  Conversely, where a large company may have a well-lit, gated terminal  monitored by security cameras and guards, a small operator may lock the  door of the vehicle and have a watch dog on the premises. In another  example, small, independent owner-operator firms may rely solely on  emergency responders such as 911 and state patrol hotlines, while larger  firms may have dispatchers and in-house security specialists on duty 24  hours a day.

		TSA Uses Performance Measures to Monitor Its Efforts in Securing Commercial Vehicles, but Lacks Effectiveness Measures for Key Security Programs

TSA has begun developing measures that gauge the completion of its  program activities, but could improve its efforts by collecting data that  would measure the effectiveness of its programs in strengthening  commercial vehicle security. Performance measures are indicators,  statistics, or metrics used to gauge program performance. Output  measures summarize the direct products and services delivered by a  program, while outcome measures try to gauge the results of products and  services delivered by a program. TSA has begun developing and using  performance measures to assess the progress of commercial vehicle  security programs, but does not have outcome data to monitor how  effectively its programs are achieving their intended purpose, as suggested  by GPRA. The TSSP also states that performance measures of strategic  goals and objectives should be outcome-based, but notes that interim  output measures may be used during the early years of the program while  baseline data on the program’s performance are being acquired. The TSSP  also requires that TSA form a Performance Measurement Joint Working  Group to recommend the appropriate mix of output and outcome  measures for agency programs, outcome monitoring techniques, and  standardize measures across transportation sectors. As of August 2008,  TSA had formed the transportation sectorwide working group, and  according to officials the group was instrumental in developing and  reporting on the transportation sector’s core, programmatic, and  partnership metrics required by the NIPP. However, the joint  measurement group for the highway and motor carrier sector had not been  formed to develop outcome measures for commercial vehicle security  programs.
Currently, TSA HMC collects performance data on its own programs,  while other commercial vehicle security programs are monitored by other  DHS or DOT components. At our suggestion, TSA officials stated they plan  to work out an agreement with DOT to receive performance measurement  data for DOT security programs, stating that performance data for these  programs are important and necessary for an overall view of the impact of  federal security programs. TSA officials stated they would request that  TSA and DOT share performance measurement data for commercial  security programs as the DHS and DOT MOU is updated. The annex to  improve coordination and data sharing between TSA and PHMSA was  signed in October 2008. Table 2 summarizes the various federal  commercial vehicle security programs and the agency responsible for  administering the program and measuring its progress.
TSA’s HMC established output measures for all five of its commercial  vehicle security programs to assist the agency in gauging the performance  of these programs. As of September 30, 2008, TSA reported that it had  completed:    100 percent of the target goal of 24 CSRs per year,    100 percent of the SAI goal of developing voluntary guidelines to reduce  risk and enhance the security of high-risk hazardous materials,    52 percent of hazardous materials driver’s license endorsement security  threat assessment background checks, and    100 percent of the work in developing a pilot Truck Tracking Center.
Output-based measures can be useful to TSA for program management  purposes, as they can identify whether programs are producing a desired  level of output and meeting established milestones. However, they do not  measure TSA’s success in achieving the ultimate goal of enhancing the  security of the commercial vehicle sector. For example, while TSA tracks  the number of CSRs completed by its staff or as part of the Missouri CSR  program, it has not attempted to measure the effect these programs are  having. Missouri officials have suggested that a sample of firms that  participated in the CSR program should be revisited to determine the  extent to which their security-related practices improved after completing  a CSR. Such information could provide TSA with a measure of the  effectiveness of its key commercial vehicle security program. In January  2009, TSA stated that it was planning to conduct baseline and follow-on  CSRs on hazardous material transporters to measure changes in  preparedness.
We recognize that TSA faces challenges in developing outcome measures  to monitor and evaluate the effectiveness of its security programs that rely  on the participation of many public and private entities. In addition, it can  be difficult to develop performance measures to gauge the impact of a  program in deterring terrorism. Nonetheless, outcome measures of  programs designed to mitigate vulnerabilities and consequences are  possible. For example, the domain awareness of drivers could be  measured both before and after participating in the Trucking Security  Grant program.
Furthermore, as we have previously reported, a focus on results as  envisioned by GPRA means that federal agencies are to look beyond their  organizational boundaries and coordinate with other agencies to ensure  that their efforts are aligned. The planning processes under GPRA provide  a means for agencies to ensure that their goals for crosscutting programs  complement those of other agencies; program strategies are mutually  reinforcing; and, as appropriate, common or complementary performance  measures are used. High-performing organizations use their performance  management systems to strengthen accountability for results, specifically  by placing greater emphasis on fostering the necessary collaboration both  within and across organizational boundaries to achieve results.
TSA officials agreed that opportunities exist to develop outcome  performance measures for the agency’s commercial vehicle security  programs, and stated that they would like to do so in the future. We  previously reported that DHS often lacked the performance information to  determine where to target program resources to improve performance, but  was taking steps to strengthen their performance measures. GAO is  currently working with DHS, including TSA, to provide input on the  department’s performance measurement efforts based on our work at the  department.

	TSA Has Strengthened Efforts to Coordinate with Federal, State, and Industry Stakeholders Regarding the Security of the Commercial Vehicle Sector, but Further Actions Can Enhance Coordination

While TSA has taken actions to improve coordination with federal, state,  and industry stakeholders to strengthen commercial vehicle security, more  can be done to ensure that these coordination efforts enhance security for  the sector. Leading practices for collaborating agencies that we have  previously identified offer suggestions for strengthening coordination with  other public and private sector stakeholders. These key practices include,  for example, defining common outcomes and complementary strategies;  agreeing on roles and responsibilities; leveraging stakeholder resources;  and developing mechanisms to monitor, evaluate, and report on the results  of the collaborative effort. DHS and DOT signed an agreement that  established broad areas of responsibility regarding the security of the  transportation network, as we previously recommended. TSA supported  the creation of an intergovernmental and industry council to gather  feedback and input about security planning, among other efforts. TSA has  made limited progress in leveraging FMCSA resources and resolving  potentially duplicative security inspections, but in October 2008 signed an  agreement to enhance coordination with FMCSA. Although TSA has  successfully leveraged resources in the State of Missouri to conduct CSR  vulnerability assessments, it has made limited progress in coordinating the  expansion of CSRs to other states. Some state and industry officials we  interviewed expressed concerns about TSA’s coordination and  communication with the sector on developing a security strategy, and fully  defining roles and responsibilities for the industry. Since many owner  operators are hard to contact, some suggested that TSA enhance its Web  site to better communicate directly with the industry’s many small  operators. Moreover, the Missouri CSR pilot evaluation similarly suggested  that TSA consider developing a two-way Web portal to allow firms to fill  out CSR questionnaires. TSA officials stated that they have taken steps to  interact with industry regarding the security of the sector, and have also  leveraged industry expertise to strengthen security. However, TSA has not  developed a means to monitor the effectiveness of its coordination actions  with this very large and diverse sector. Without enhanced coordination,  TSA will have difficulty expanding its vulnerability assessments to other  states.

		DHS and DOT Have Entered into Formal Agreements and Taken Other Actions to Enhance Coordination

DHS and DOT have taken actions toward coordinating their efforts to  strengthen commercial vehicle security. In September 2004, DHS and DOT  signed a MOU that established broad areas of responsibility for each  department related to the security of the transportation sector, and  specified roles and responsibilities to strengthen their cooperation and  coordination. For instance, under the MOU, DOT recognized that DHS has  primary responsibility for transportation security while it plays a  supporting role, providing technical assistance and supporting DHS in the  implementation of its security policies as allowed by DOT statutory  authorities. Furthermore, the MOU states that DHS is to establish national  transportation security performance goals and, to the extent practicable,  appropriate security measures for each transportation sector to achieve an  integrated national transportation security system. The MOU responds to  our previous work which emphasized the need for greater coordination  between DOT and DHS on transportation security efforts and  recommended that the two departments establish an MOU to, among other  things, delineate the roles, responsibilities, and funding authorities of the  each department.
In August 2006, TSA and PHMSA signed an annex to the DHS and DOT  MOU, identifying their respective roles and responsibilities related to  research and development, training, outreach, risk assessments, and  technical assistance involving hazardous materials transportation security.  According to this agreement, the parties commit themselves to seeking  consensus on measures to reduce risk and minimize consequences of  emergencies, sharing information that may concern the interests of the  other party, and coordinating the development of transportation security- related guidelines. The annex further specified that TSA and PHMSA will,  among other things:    base security planning on risk, seek consensus concerning measures to  reduce risk, and coordinate in the development of standards, regulations,  guidelines, and directives;    coordinate on observations and recommended security measures;    explore opportunities for collaboration in inspection and enforcement    share information during an emergency.
Consistent with this agreement, PHMSA and TSA worked together to  develop recommended security measures for hazardous materials carriers.
As we have previously identified, an effectively implemented leveraging of  stakeholder resources is a key practice for enhancing collaboration.  According to leading practices for collaborating agencies, such parties  bring different levels of resources and capacities to the collective effort;  therefore, the parties should identify the types of resources necessary to  initiate or sustain their collective effort, as well as assess each party’s  relative strengths and limitations. In 2003, working with TSA, PHMSA  established a set of security plan requirements for hazardous materials  carriers that addressed the elements of en route security, unauthorized  access, and personnel security. TSA later expanded upon PHMSA’s  requirements and, in consultation with PHMSA, drafted a set of voluntary  security standards, called Security Action Items (SAIs), specifying the  level of security suggested for each type of security-sensitive hazardous  materials, or hazardous materials transported by motor vehicles whose  potential consequences from an act of terrorism may result in detrimental  effects to the economy, communities, critical infrastructure, or individuals  of the United States. TSA reported that these SAIs were finalized in June  2008 and distributed to stakeholders. TSA further worked with PHMSA to  develop guidance on security-sensitive hazardous materials.
TSA also established a GCC in April 2006 to monitor and evaluate the  results of federal highway and motor carrier security programs, as  required by the NIPP. We previously identified the need for collaborating  agencies to create a mechanism to monitor and evaluate their efforts and  to assist them in identifying areas for improvement. If implemented  effectively, reporting on these collaborative activities can help key  decision makers obtain feedback for improving both policy and  operational effectiveness. The GCC consists of federal agencies and  associations representing state and local transportation and law  enforcement officials, and motor vehicle administrators with  responsibilities directly related to commercial vehicle security. (For a  complete list of GCC members, see app. VI). The GCC is intended to  coordinate strategies, activities, and communications among its member  entities, and establish policies, guidelines, metrics, and performance  criteria. The highway sector GCC meets approximately once monthly,  and both FMCSA and PHMSA officials expressed general satisfaction with  the GCC.

		DHS and DOT Can Strengthen Efforts to Leverage Resources and Avoid Duplication of Effort

Although DHS and DOT have established agreements and developed  complementary strategies to strengthen security of the commercial  vehicles sector, gaps remain that hamper their ability to more effectively  coordinate their efforts. Specifically, the two departments have not fully  agreed on a strategy to leverage resources and eliminate potential  duplication of effort and to share inspection information for monitoring  security programs.
TSA and FMCSA have shared roles and responsibilities regarding the  enhancement of commercial vehicle security, but have different  capabilities and resources. TSA HMC has a staff allocation of 19 FTEs.  These staff are responsible for all aspects of commercial vehicle and  highway infrastructure security including developing best practices,  conducting risk assessments, and establishing policy. HMC is also  responsible for school bus security. FMCSA has 650 to 700 staff deployed  in the field nationwide to conduct inspections, enforce Federal Motor  Carrier safety regulations and hazardous materials transportation safety  and security regulations, and coordinate with state safety inspectors.  Moreover, TSA and FMCSA have similar inspection programs, both of  which are currently focused on hazardous materials transportation. As  discussed earlier in this report, TSA operates the CSR program designed to  review the security efforts and vulnerabilities of all types of commercial  vehicle firms, and FMCSA conducts security compliance inspections  (SCRs) of hazardous materials carriers.
The 9/11 Commission Act requires that DOT consult with DHS to limit, to  the extent practicable, duplicative reviews of the hazardous materials  security plans.  TSA and FMCSA officials stated that they have discussed  how best to leverage FMCSA’s ongoing inspections programs and the  feasibility of merging the two inspection programs. Officials reported that  their interactions to date have focused on how best to take advantage of  the similarities between these programs to more efficiently and effectively  use agency resources, reduce potentially duplicative efforts, and minimize  the burden on the industry. TSA officials stated that one obstacle to  merging the two programs is that hazardous materials transportation  companies are required to participate in FMCSA’s SCRs because they are  subject to DOT’s hazardous materials regulations, while TSA’s CSRs are a  voluntary effort. However, both agencies’ programs share voluntary and  mandatory aspects. For example, along with SCRs, FMCSA also conducts  Security Sensitivity Visits, which as discussed earlier in this report are  voluntary, educational security reviews of firms carrying small amounts of  hazardous materials. Moreover, TSA’s Missouri pilot successfully  demonstrated that voluntary security reviews could be appended to  mandatory safety reviews, and that state safety inspectors could be trained  to conduct CSR security reviews. TSA officials further stated that the  agency’s CSR reviews include a detailed assessment of the adequacy of  security plans, whereas FMCSA reviews are intended to ensure a firm’s  compliance with its written security plan, but are not an assessment of its  adequacy. Another obstacle, according to TSA officials, is associated with  how the two agencies view their missions and resource sharing. TSA  believes utilizing FMCSA resources, infrastructure, and databases may be  cost effective. However, DOT officials told us that the primary role of  FMCSA’s inspectors is safety rather than security. One industry  association we interviewed stated that they were working with FMCSA  and TSA to merge their commercial vehicle security programs because  association officials believed it would reduce duplication and be more  efficient for both government and industry. By leveraging resources with  FMCSA, TSA may be able to address other priorities, such as conducting  additional vulnerability assessments, improving security mitigation  programs beyond the hazardous materials sector, and addressing highway  infrastructure protection.
TSA and FMCSA also do not have a process in place to share information  important to monitoring the results of security programs, consistent with  leading practices for collaborating agencies. For example, the agencies are  not comparing and contrasting their findings from commercial vehicle  security inspections. Both TSA and FMCSA concurred that they could  benefit from better sharing of information and have discussed developing  a unified database for storing and sharing information on CSR and SCRs.  Without a process in place to share information on the results of their  security programs, TSA will not have a complete picture of the  effectiveness of federal programs to secure the sector. FMCSA also  maintains other data and information that could potentially be useful to  TSA in its effort to understand and analyze the commercial trucking and  motor coach industries. For example, the Missouri CSR program selected  carriers with particularly bad safety records for review, but TSA does not  have general, direct access to these data. FMCSA also maintains the  Motor Carrier Management Information System (MCMIS) database of all  interstate, and some intrastate companies, and all carriers of hazardous  materials. Access to MCMIS data could assist TSA in addressing the NIPP  requirement that the agency develop an inventory of assets as a basis for  conducting vulnerability and consequence assessments. In addition, as  TSA expands its CSRs of hazardous materials transporters, DOT may  benefit from knowing which firms TSA has reviewed to avoid duplication  of effort.
Although TSA and PHMSA have signed an annex detailing how they will  collaborate, TSA and FMCSA officials stated that they did not establish a  similar agreement because the agencies coordinated with each other well,  and an annex was not necessary. However, with enactment of the 9/11  Commission Act, TSA and FMCSA were required to complete an annex by  August 2008 that defined the processes that will be used to promote  communications and efficiency, and avoid duplication of effort. An annex  to the MOU between TSA and FMCSA might help reduce possible  duplication of effort in inspection programs, as well as facilitate the  development of a process for sharing data to monitor program results. TSA  and FMCSA officials signed an annex to the MOU in October 2008.
The TSSP also requires that the GCC and the SCC create several joint  working groups for research and development, performance  measurement, intelligence, and risk. These groups are to improve  coordination and prioritization of TSA’s research and development efforts,  address the inherent difficulties in measuring and assessing the  performance of security mitigation programs, develop sector-specific  metrics, and coordinate and integrate intelligence efforts. However, the  creation of these committees has been delayed, according to TSA officials.  Without promptly developing joint working groups, TSA increases the risk  that collaborative work and progress in these areas will be delayed. TSA  officials stated that as of September 2008, the Joint Working Groups for  Highway and Motor Carrier had not been officially approved.

		TSA Has Increased Vulnerability Assessments by Collaborating with the State of Missouri, but Has Not Developed a Plan to Expand the Approach to the Other States

TSA has leveraged resources to enhance its capabilities to perform CSR  vulnerability assessments through collaboration with the state of Missouri,  and recently reached agreements with Michigan and Colorado to conduct  CSRs, but has faced challenges in expanding this collaborative effort to  other states. These state coordination challenges have the potential to  significantly delay progress in expanding vulnerability assessments to  other states. TSA officials stated that it was continuing to explore  opportunities to expand the CSR program from Missouri to other states,  and to leverage state field inspector and law enforcement resources.
TSA also does not have a direct mechanism for coordinating its strategy  with the states related to commercial vehicle security planning, and some  state officials we spoke to expressed dissatisfaction with TSA’s  coordination efforts. The agency relies on several GCC-member  associations that represent state and local transportation and law  enforcement officials to coordinate with states. However, all of these state  GCC stakeholders identified concerns about the adequacy of TSA  coordination efforts. For example, CVSA, which represents state law  enforcement officials at the GCC, stated that the GCC is not an effective  means of communication and coordination, and that direct  communication with the states was minimal. As a result, CVSA  transportation security officials stated that they were not fully informed  about TSA’s risk management strategy. CVSA officials further stated, in  September 2008, that while coordination with TSA had improved after  TSA’s staffing stabilized, they continued to be concerned that the federal  government was more engaged in helping states ensure safety rather than  security. They also questioned whether TSA had dedicated sufficient  resources to commercial vehicle security, or had the expertise to lead  federal efforts to expand vulnerability assessments nationwide. CVSA  officials stated that since DOT had the resources but not the authority to  oversee commercial vehicle security, it is difficult for either agency to  assist the states.
Another key association, AASHTO, which represents state transportation  officials at the GCC, stated that state security planners are given  insufficient attention and information by TSA and other DHS components  relating to security. Specifically, AASHTO officials stated that TSA had not  communicated its strategy or initiatives to secure commercial vehicles,  and that while AASHTO has tried to discuss what role the states play in  transportation security with DHS and TSA, neither has been responsive in  providing fully defined roles. Several officials we spoke with during our  interviews with state DOTs also expressed concerns regarding whether  the GCC is a sufficient mechanism for TSA to coordinate with the 50 states  and were also critical of TSA’s leadership and communication related to  commercial vehicle security. For example, one state noted that TSA’s slow  pace in providing guidance was causing it to delay the implementation of  its programs for fear such programs would conflict with TSA initiatives.  TSA officials stated that the agency had coordinated with states to the  extent possible with available resources—having one staff member  responsible for federal, state, and industry coordination.

		TSA Has Worked to Strengthen Partnerships with the Commercial Vehicle Industry, but Stakeholders Identified Coordination Challenges, and the Effects of Existing Coordination Efforts Are Unknown

TSA has made progress in involving industry in their strategy for  strengthening commercial vehicle security by supporting the formation of  an industry stakeholder council and through ongoing outreach efforts and  meetings with industry officials. However, as discussed earlier in this  report, industry officials we interviewed stated that they generally desired  greater communication with TSA. More specifically, the officials noted  that they did not fully understand TSA’s strategy for securing the  commercial vehicle sector, or what roles and responsibilities the agency  expected from industry. Additionally, TSA does not have any measures of  the effectiveness of its efforts to coordinate with its many stakeholders,  which limits its ability to determine whether its ongoing efforts to  collaborate are appropriate and adequate for this very large and diverse  transportation sector. Without strengthening communication and  coordination with industry, TSA will not be able to fully leverage the  resources of its stakeholders. Four of the leading practices for  collaborating agencies we previously identified to help improve  coordination among federal agencies could also be applied to improve  federal collaboration with industry stakeholders—defining a common  outcome and complementary strategies, agreeing on roles and  responsibilities, leveraging stakeholder resources, and monitoring results.
TSA coordinates with the commercial vehicles sector through an industry  council and industry associations. To (1) overcome the challenge of  working in partnership with such a large and diverse group of  stakeholders, (2) understand the current security practices of these  industries, and (3) gather industry input and feedback, TSA supported the  creation of the Highway and Motor Carrier Sector Coordinating Council  (SCC) in June 2006. The SCC represents three private industry groups:  highway passenger and school bus carriers, highway freight carriers, and  highway infrastructure owners and builders, and facilitates  communications within the industry and between the industry and TSA.  According to members, its purpose is to represent a broad cross-section of  the industry, and there is no limit on the number of organizations that can  participate. As of September 2008, the SCC had convened eight times since  its first meeting in August 2006, and holds separate meetings to address  issues requiring a quick response. Apart from the SCC, TSA has also  collaborated with several industry trade associations to develop and  distribute security brochures and guides for their membership. For  example, TSA assisted the Truck Rental and Leasing Association in  developing its Security Awareness and Self-Assessment Guide.
Although TSA has made progress in coordinating with industry  stakeholders, challenges remain. Specifically, SCC officials stated that the  council was dissatisfied with TSA’s level of coordination with the SCC on  the development of a strategy for enhancing commercial vehicle security.  For example, the SCC leadership stated that the SCC was excluded from  key stages of drafting revisions to the initial TSSP annex. The TSSP states  that its initial goals and objectives would be developed by TSA, and be  informed by comments and suggestions from the SCC, and going forward  the TSSP annex states that the GCC and SCC are to prepare future  revisions of the TSA strategy in the TSSP annex. SCC officials said that  TSA did not consult with them regarding the development of key strategic  objectives, known as Strategic Risk Objectives, or the Highway and Motor  Carrier Annual Report regarding progress made and goals for the next  year. These officials stated that overall coordination was better on  trucking issues than for motor coach. Furthermore, industry and company  officials we interviewed also expressed concerns about TSA’s  coordination efforts regarding its strategy Specifically, officials from 9 of  the 12 industry associations and 20 of the 26 truck and bus companies we  interviewed, some of whom were also members of the SCC, stated that  they were not familiar with TSA’s strategy and/or ongoing efforts to secure  the commercial vehicle sector, and that TSA could strengthen its  coordination with industry. Officials stated that in some cases, a lack of  information led industry associations to hesitate in implementing security  actions and dedicating resources to additional security measures that TSA  may determine are not necessary or identify other required measures that  must be implemented instead. Finally, SCC officials stated that TSA had  not explicitly defined roles and responsibilities for the committee, its  members, or the industry. Several industry association representatives  also expressed similar confusion over their responsibilities and roles in  securing the commercial vehicle sector. TSA officials stated that the SCC  was not consulted in the development of the Highway and Motorcarrier  Annex because TSA did not have enough time to include them. However,  the SCC disagreed stating that TSA had received an extension on when the  annex was due. TSA officials also said that they were not surprised by the  uncertainty about their strategy for securing the sector because TSA’s  focus has been largely on developing security programs rather than  communicating its security strategy to industry. TSA officials stated that  going forward, they will work with the SCC as it revises the Highway and  Motor Carrier Annex to the TSSP. The SCC leadership stated that during  the revision to the latest HMC annual report, TSA was much more open to  SCC’s input.
Our previous work on effective interagency collaboration has  demonstrated that to achieve a common outcome, collaborating agencies  need to establish strategies that work in concert with those of their  partners or are joint in nature. Our prior work has further shown that  collaboration can be enhanced when parties work together to define and  agree on their respective roles and responsibilities, including how the  collaborative effort will be led. Responsibility for securing the commercial  vehicle sector involves collaboration between governmental and  nongovernmental entities that typically have not worked together before  on these issues. A fully defined outcome and strategy facilitates  overcoming significant differences in organizational missions, cultures,  and established ways of doing business. Without defining a common  outcome and strategy, individual organizations increase the risk of  developing strategies for securing the commercial vehicles industry that  differ and conflict rather than help organizations better align their  activities and resources to accomplish a common outcome. Fully defining  and clarifying respective roles and responsibilities will be important to  ensure that TSA and industry understand who will do what regarding  securing the commercial vehicle sector, and help to reconcile differing  perceptions of leadership that exist among stakeholders.
SCC representatives stated that TSA has not maintained active  communication with the committee, resulting in missed opportunities to  take advantage of their potential contributions, including leveraging of  their expertise and resources. TSA officials stated that given the SCC’s  recent establishment, it may be too soon to fairly assess the effectiveness  of their interactions with the council. Most companies we spoke with  stated that they rarely heard from TSA if at all, although they were  generally much more familiar with FMCSA with whom they have worked  for years. Some company officials suggested that TSA develop a direct  means of communicating with the industry, such as through e-mail or a  robust Web page. The Missouri Pilot Program Evaluation Report also  recommended that TSA develop a Web portal to improve coordination and  communication with the industry. The lack of communications and  coordination could limit the effectiveness of standards and measures  meant to enhance the security of commercial vehicles.
TSA officials stated that the agency has conducted outreach with private  industry to, among other things, coordinate its overall strategy and roles  and responsibilities. According to officials, TSA has made numerous  resources available to private industry stakeholders through the Homeland  Security Information Network and more recently through TSA’s Highway  and Motor Carrier Web site link. Additionally, TSA reported that officials  from the HMC are continually attending association conferences and  workshops to educate and share TSA’s strategy, goals, and policies. To  further improve communications, TSA reported that it has conducted 14  monthly conference calls since 2007 with attendees varying from 10 to 20  stakeholder participants. TSA officials stated that, while minor issues  regarding specific lines of communication may have existed, in their  opinion, the general level of coordination with the industry has been  successful and that they were unaware of any significant private sector  stakeholder misunderstandings of the agency’s security strategy, efforts,  or their own roles and responsibilities.
While TSA’s actions should help strengthen coordination with the  commercial vehicle industry, the extent of any effect of these efforts is  unknown because, according to TSA officials, the agency has not  developed an approach to evaluate the effectiveness of its coordination  efforts. Specifically, TSA does not have measures of how coordination  efforts such as its current Web site, its participation in conferences, its  efforts to coordinate with states, the GCC, and SCC result in a better  understanding of TSA strategy and definitions of roles and responsibilities  within the commercial vehicle sector. We have previously reported that  collaborative efforts can be enhanced and sustained when they include  mechanisms for monitoring and evaluation to assist stakeholders in  identifying areas for improvement. Without such an evaluation, TSA will  be hindered in determining whether its ongoing efforts to collaborate with  the commercial vehicle industry are appropriate and effective for  enhancing the security of this very large and diverse transportation sector.

	Conclusions

The nature, size, and complexity of the nation’s commercial vehicle sector  highlights the need for federal and state governments and the private  sector to work together to secure this transportation sector. The  importance of the nation’s commercial trucking and motor coach  industries and concerns about their security, coupled with finite homeland  security resources, underscores the need for TSA to employ a risk  management approach to prioritize its security efforts so that an  appropriate balance between costs and security is obtained. TSA has taken  steps in implementing a risk management approach by assessing threats to  and from the commercial vehicle sector, conducting some vulnerability  assessments, and initiating the development of best practices to secure the  sector. Despite these achievements, much work remains to fully address  the security risks of commercial trucks and motor coaches, and to ensure  that this information is used to inform TSA’s security strategy. TSA has not  yet completed annual threat assessments with estimations of the  likelihood of various threats or tactics, nor established a plan and a time  frame for completing vulnerability assessments of the commercial vehicle  industry and its diverse sectors and firms, to include considering the  recommendations of the Missouri Pilot Program Evaluation. TSA also has  not developed a plan to conduct consequence assessments, or leveraged  the consequence assessments of other sectors. Further, TSA has not  determined the extent to which additional risk assessments are needed, or  the resources needed to support these efforts. Although TSA is having  threat scenarios conducted to inform a preliminary risk assessment of the  industry, these assessments will likely provide limited information on what  sectors or companies are most at risk, and what mitigation practices are  currently in place, unless they are further supported by field-level risk  assessments, such as CSRs, consistent with the TSSP. As a result of not  having specific threat assessments or complete vulnerability and  consequence assessments, the agency is limited in its ability to determine  the most pressing security needs, and to use this information to guide its  security strategy. While working to develop complete risk assessments, it  is important that TSA assess and use available information as the basis for  its interim decisions. For example, information currently available from  existing threat, vulnerability, and consequence assessments suggest  alternatives or additions to the agency’s current focus on commercial  vehicle transport of hazardous materials. TSA has recently begun the  process of revising its strategy for 2009 and beyond; however, without  completed risk assessments, its revised strategy may not be appropriately  targeted. Until TSA completes assessments of this very large and highly  diverse transportation sector, and uses this information to inform its  security strategy, it will be limited in its ability to assure Congress that  existing funds are being spent in the most efficient and effective manner.
TSA has developed a range of programs to strengthen truck and bus  security, but has not developed outcome measures to assess how  effectively the programs have improved security. Without such  performance measures, TSA cannot monitor and evaluate whether or not  these programs are achieving results in enhancing commercial vehicle  security, nor communicate this progress to industry stakeholders,  Congress, policymakers, and taxpayers.
With 50 states and over a million diverse industry stakeholders, securing  commercial vehicles can pose considerable communication challenges  and lead to confusion about roles and responsibilities. Ultimately, the  security of the industry is maintained by the companies themselves, and if  TSA is to secure the sector it must do so by working with the industry.  Coordination and communications techniques that might work well in  other transportation sectors may be insufficient for the larger, more  complex commercial vehicle industry. TSA has taken steps to coordinate  with government and industry stakeholders, and has had some noteworthy  successes such as the Missouri CSR program. However, both industry and  state officials we interviewed stated that more needed to be done to  enhance federal leadership and better ensure that federal, state, and  industry actions and investments designed to enhance security are  properly focused and prioritized. TSA communicates with states primarily  through associations of state law enforcement and transportation officials  who participate in the GCC. However, opportunities exist for more  effective coordination with states to expand the Missouri CSR to other  states, and for TSA to leverage FMCSA’s resources in conducting field  inspections. TSA could address industry concerns about communication  of its strategy, roles, and responsibilities, as well as better leverage  industry expertise, by working more collaboratively with industry  representatives and improving communication with the nation’s many  small owner-operators and midsized firms. In addition, because TSA does  not monitor and measure the effectiveness of its coordination and  communications efforts, it cannot be sure that it is addressing stakeholder  concerns. By improving coordination with DOT, the states, and the  industry, TSA could build a solid foundation for strengthening the security  of the commercial vehicle sector.

	Recommendations for Executive Action

To assist the Transportation Security Administration in more fully  evaluating, selecting, and implementing commercial vehicle security risk  mitigation activities, and to help strengthen the security of commercial  vehicles in the United States and leverage the knowledge and practices  employed by key federal and nonfederal stakeholders, we recommend that  the Assistant Secretary for the Transportation Security Administration  take the following four actions:  1.  Establish a plan and a time frame for completing risk assessments of  the commercial vehicle sector, and use this information to support  future updates to the Transportation Sector Strategic Plan, to include  conducting:  to the extent feasible, assessments that include information about the  likelihood of a terrorist attack method on a particular asset, system, or  network as required by the National Infrastructure Protection Plan;  a vulnerability assessment of the commercial vehicle sector, including:    assessing the scope and method of assessments required to gauge  the sector’s vulnerabilities;    considering the findings and recommendations of the Missouri pilot  evaluation report to strengthen future Corporate Security Reviews;  and    enhancing direct coordination with state governments to expand  the Transportation Security Administration’s field inspection  Corporate Security Review capacities;    consequence assessments of the commercial vehicle sector, or  developing alternative strategies to assess potential consequences of  attacks, such as coordinating with other Sector-Specific Agencies to  leverage their consequence assessment efforts.  2.  In future updates to the Highway Infrastructure and Motor Carrier  Annex to the Transportation Sector Security Plan, clarify the basis for  the agency’s security strategy of focusing on the transportation of  hazardous materials, the relative risk of vehicle-borne improvised  explosive devices to the sector, and, based on the relative risk of these  threats, any risk mitigation activities to be implemented to address  them.  3.  Develop outcome-based performance measures, to the extent possible,  to assess the effectiveness of federal programs to enhance the security  of the commercial vehicle sector.  4.  Establish a process to strengthen coordination with the commercial  vehicle industry, including ensuring that the roles and responsibilities  of industry and government are fully defined and clearly  communicated; new approaches to enhance communication are  considered; and monitoring and assessing the effectiveness of its  coordination efforts.

	Agency Comments and Our Evaluation

We provided a draft of this report to DHS and DOT for review and  comment. On January 15, 2009, DOT provided technical oral comments  which we incorporated as appropriate. On February 6, 2009, we received  written comments on the draft report from DHS, which are reproduced in  full in appendix II. DHS concurred with our findings and recommendations  and discussed efforts underway to address them.
Regarding our recommendation that TSA establish a plan and a time frame  for completing risk assessments of the commercial vehicle sector, and use  this information to support future updates to the Transportation Sector  Strategic Plan, DHS concurred and stated that TSA is actively conducting  risk assessments of the major components of the commercial vehicle  sector as required by the Implementing Recommendations of the 9/11  Commission Act of 2007, and provided a timetable for completing these  scenario-based risk assessments. According to TSA, these assessments  will examine specific scenarios involving the commercial vehicle sector  and will include information on the likelihood of a terrorist attack. We are  pleased that TSA is beginning to conduct risk scenario assessments on  various parts of the industry. However, we continue to believe that TSA  needs to expand its use of threat likelihood estimates to the extent  feasible. For example, we believe that TSA should address the feasibility  of annual sector threat assessments including likelihood estimates. TSA  also stated that it is planning to conduct annual field-level vulnerability  assessment CSRs on a statistically valid sample of hazardous materials  carriers. While we support these efforts, as we noted in the report carriers  transporting hazardous materials represent only a small fraction of the  industry. Therefore, we believe that TSA should also assess the scope and  method of its vulnerability assessments for the entire sector, beginning  with establishing the mix of expert scenarios and field assessments it  deems most appropriate. In response to our recommendation that TSA  conduct consequence assessments of the commercial vehicle sector or  develop alternative strategies to assess potential consequences of attacks  such as coordinating with other sector-specific agencies to leverage their  consequence assessment efforts, TSA concurred and stated that it will  examine consequence information based on the scenarios that have been  developed, consult with public and private sector subject matter experts,  and, when appropriate, consult with sector-specific agencies.
DHS concurred with our recommendation that in future updates to the  Highway Infrastructure and Motor Carrier Annex to the Transportation  Sector Security Plan, they should clarify the basis for the agency’s security  strategy of focusing on the transportation of hazardous materials, the  relative risk of vehicle-borne improvised explosive devices in the sector,  and, based on the relative risk of these threats, any risk mitigation  activities that should be implemented to address them. TSA stated that it  intends to include risk-based clarification of the security strategies in  future updates to the plan. According to TSA, for the past 2 years it has  focused primarily on the transportation of hazardous materials. However,  ongoing industry risk assessments and regulatory efforts may shift the  current strategies, and communicating these strategies in the annex to all  stakeholders will be critical to successful implementation of the plan. We  believe that these efforts will help strengthen TSA’s strategy for securing  the sector. We further believe that it will be important for TSA to clarify  the basis for its strategy and any shift in that strategy based on  assessments of the relative risks.
DHS concurred with our recommendation that TSA develop, to the extent  possible, outcome-based performance measures to assess the  effectiveness of federal programs to enhance the security of the  commercial vehicle sector. DHS stated that TSA recognizes the  importance of establishing outcome-based performance measures and  described ongoing efforts. TSA stated that it intends to conduct annual  CSRs on hazardous materials motor carriers to measure changes in  industry security. While these activities will help TSA strengthen its ability  to assess the effectiveness of ongoing security measures, we believe that  the impact of TSA’s programs on the progress of the rest of the  commercial vehicle sector should be measured as well.
DHS also concurred with our recommendation that TSA establish a  process to strengthen coordination with the commercial vehicle industry,  including ensuring that the roles and responsibilities of industry and  government are fully defined and clearly communicated; new approaches  to enhance communication are considered; and the effectiveness of its  coordination efforts are monitored and assessed. DHS noted that TSA  recognizes the importance of strong working relationships with both  industry and other government agencies, and that through its work with  coordination councils TSA has established a coordination process that  continues to mature and develop. Finally, DHS noted that these  coordination efforts are only 17 months old, hence performance  measurement processes continue to be refined. We believe that given the  size and complexity of the commercial vehicle sector, and the concerns  expressed by various stakeholders, new approaches to enhance  communication are important. As such, TSA should develop a process to  monitor and assess the effectiveness of its coordination efforts.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this report. At that time, we will send copies of this report to the  Secretary of Homeland Security, the Secretary of the Department of  Transportation, and other interested parties. This report will also be  available at no charge on our Web site at http://www.gao.gov. Should you  or your staff have any questions concerning this report, please contact me  at (202) 512-3404 or berrickc@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix VIII.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to answer the following questions:   (1) To what extent has TSA assessed the security risks associated with  commercial vehicles and used this information to develop and implement  a security strategy? (2) What security actions have key government and  private sector stakeholders taken to mitigate identified risks to  commercial vehicle security, and to what extent has TSA measured the  effectiveness of its actions? (3) To what extent has TSA coordinated its  strategy and efforts for securing commercial vehicles with other federal  entities, states and private sector stakeholders?

	Federal Risk Assessment Activities

To review the extent to which the federal government has assessed  security risks associated with commercial vehicles and used this  information to develop and implement its security strategy, we analyzed  DHS and DOT strategic and security planning documents such as the  NIPP, the TSSP and its Highway and Motor Carrier Annex; performance  documents including annual reports such as DHS’s 2008 Performance  Budget Overview and TSA HMC’s Annual Reports and quarterly risk  reduction reports; and risk assessment documentation—including  assessments of threat, vulnerability, and standoff and evacuation  distances. We interviewed officials from DHS National Protection and  Programs Directorate; TSA’s Office of Highway and Motor Carriers, Office  of Risk Management and Strategic Planning, Office of Intelligence, and  Office of Cargo Policy; DOT’s Office of Intelligence and Security; PHMSA’s  Office of Hazardous Materials Safety; FMCSA’s Office of Emergency  Preparedness and Security; and DOT’s Bureau of Transportation Statistics.
To assess TSA’s threat assessments, we analyzed its annual threat  assessments and other intelligence products, and met with officials of  TSA’s Office of Intelligence. We also assessed documentation and  interviewed TSA’s HMC officials regarding the agency’s use of the threat  assessments for planning its vulnerability and consequence assessments.  We also met with TSA’s Risk Management Division and reviewed its use of  estimates regarding the likelihood of certain types of specific threats for  high-level NTSRA scenarios, and more systematic use of threat scenarios  and likelihood estimates for the Aviation Domain Risk Assessment. To  evaluate TSA’s vulnerability assessments, we reviewed TSA’s draft best  practices, its vulnerability assessments known as Corporate Security  Reviews (CSRs), and CSR questionnaires and reports. We also met with  TSA HMC officials and interviewed officials from truck and bus companies  that had undergone CSRs. To assess TSA’s CSR pilot program, we  attended two Missouri Pilot CSRs and analyzed the TSA-sponsored  evaluation report of the CSR pilot. At the conclusion of the two CSRs we  observed, we interviewed company officials about what they learned from  the CSR, how germane it was to their security needs, and how appropriate  TSA’s suggested security measures were for their operating and business  environment. We also met with Missouri state department of  transportation and law enforcement officials and FMCSA field officers in  Missouri to discuss their experiences with implementing the pilot and  conducting CSRs. We also discussed the usefulness of the CSRs with  officials from 12 leading industry trade associations representing the  different sectors of the industry including, trucking companies, owner- operators, private truck companies, the bus industry, tank truck operators,  hazardous materials shippers, rental and leasing firms, and unions. To  review DOT’s SCR inspections of hazardous material security plan  implementation, we reviewed the SCR questionnaire, gathered data from  agency Performance and Accountability Reports regarding their annual  progress, and met with DOT FMCSA’s Office of Emergency Preparedness  and Security. We also analyzed FMCSA-sponsored vulnerability  assessment of the U.S. motor coach Industry. We also reviewed the  completeness of DOT MCMIS and BTS data on the population, or national  inventory, of commercial vehicle firms, trucks, and drivers, because to  determine industry vulnerabilities requires the development of a well- defined inventory or population of industry firms and assets. For more  information, see appendix V.
To evaluate TSA’s consequence assessments, we analyzed DHS, DOD, and  ATF data about standoff distances for VBIED explosions, tanker fuel truck  fireballs, and TIH evacuation distances. We also interviewed officials from  TSA’s HMC and DHS’s National Protection and Programs Directorate  about their consequence assessment efforts. To explore the feasibility of  TSA leveraging the consequence efforts of other sectors, we also reviewed  the 17 Critical Infrastructure Sector Annual Reports for 2006 and 2007, and  the Strategic Homeland Infrastructure Risk Assessment report which  identifies the sectors most at risk from VBIEDs.
To determine how, if at all, TSA used its risk assessments to inform its  strategy for securing commercial vehicles, we reviewed its strategic plan,  the TSSP annex, annual reports, and other related documents. We also  interviewed HMC officials, and compared their actions to DHS risk  management guidance in the NIPP and TSSP. The quality of TSA’s CSR  inspection data was previously assessed by the Missouri Pilot Evaluation.  We reviewed the pilot evaluation and concurred with its conclusion that  the Missouri sample was not representative of the commercial vehicle  industry in Missouri or of the industry nationwide. To evaluate the extent  to which TSA had a plan or a time frame to complete a comprehensive risk  assessment of the commercial vehicle sector, we used standard practices  in program and project management, which include developing a road map  or a program plan to achieve programmatic results within a specified time  frame or milestones. To evaluate TSA’s progress in addressing the  Missouri CSR Pilot evaluation, we used GAO’s standards for internal  controls in the federal government, which require that findings and  deficiencies reported in audits and other reviews be promptly reviewed,  resolved, and corrected within established time frames.

	Government and Private Sector Security Actions

To determine the actions the federal government and state and local  governments have taken to mitigate commercial vehicle security risks, and  the extent to which these actions are consistent with TSA’s security  strategy, we reviewed documentation and interviewed officials from TSA’s  Office of Highway and Motor Carrier and the Office of Cargo Policy; DOT  PHMSA’s Office of Hazardous Materials Safety; FMCSA’s Office of  Emergency Preparedness and Security; FHWA Transportation Security  Office; and the FTA Office of Safety and Security. We also interviewed  officials from eight states and conducted site visits to five. We selected  the states in a nonprobability sample based on their characteristics,  proximity to critical infrastructure and potential terrorist targets, such as  large population centers, and the amount of hazardous materials (in tons)  originating in the state. As a result, we cannot generalize the results to all  states. However, we believe that observations obtained from these visits  provided us with a greater understanding of the states’ operations and  perspectives. We gathered information from each regarding their actions  to mitigate security risks, and any challenges they face in strengthening  security.
To identify industry actions taken to secure the commercial vehicle sector,  we analyzed TSA’s draft best practices and Security Action Items, and  reviewed TSA CSR and FMCSA SCR and SSV inspection data. We also  interviewed officials from 12 industry associations that represent trucking  firms and truck drivers, truck manufacturers, truck rental and leasing  companies, hazardous materials shippers, and intercity and tour bus  companies to see what actions, if any, the association and its members  were taking. We also reviewed security guidance industry trade  associations had developed and provided to their members. To  supplement what federal and industry associations told us and to observe  industry operations firsthand, we also conducted site visits to 26  commercial truck and bus owner-operators. These companies were  selected by a nonprobability sample based on:    size, using the number of vehicles (tractors, or power units for trucking  companies, and buses for motor coach companies) as an indicator;    geographic location, noting the region’s characteristics, proximity to  critical infrastructure and potential terrorist targets such as large  population centers, and the amount of hazardous materials (in tons)  originating in the state; and  type of operations, using the quantity of hazardous materials transported  as an indicator for trucking companies.
Because we used a nonprobability sample of owner-operators and states,  the information we obtained from these interviews and visits cannot be  generalized to all commercial vehicle companies. However, we believe  that observations obtained from these visits provided us with a greater  understanding of the industry’s operations and perspectives. The 20  trucking companies we visited included hazardous materials carriers,  nonhazardous materials carriers, and carriers that transported both  hazardous materials and nonhazardous materials. The 6 motor coach  companies we visited included companies that offer intercity services, and  tour and charter services, as well as companies that do both. During our  site visits to bus and trucking companies, we interviewed officials and  inspected a range of security measures.
To assess how the effectiveness of federal programs to reduce risk was  being monitored, we analyzed DHS and DOT strategic planning and  budgeting documents and performance data and interviewed officials from  TSA’s HMC, the Transportation Sector Network Management Business  Management Office, and the DHS Federal Emergency Management  Agency’s (FEMA) Grants Program Directorate. To determine what  performance measurement data DOT had developed that TSA could  potentially use to monitor the progress of these commercial vehicle  security programs, we interviewed officials from FMCSA’s Analysis  Division and Strategic Planning and Program Evaluation Division. We also  compared TSA’s efforts to evaluate its programs with guidance on  performance measurement contained in the GPRA and the TSSP.

	Coordination and Collaboration Efforts

To review the extent to which the federal government has coordinated its  strategy for securing commercial vehicles internally and with private  sector stakeholders, we analyzed DHS’s memorandum of understanding  with DOT and subsequent annex with PHMSA that identifies the roles and  responsibilities of DHS and DOT related to commercial vehicle and  hazardous materials transportation security. In addition, we reviewed  statutes related to DHS and DOT roles and responsibilities, as well as  regulations and associated comments provided during rulemaking  procedures for commercial vehicle security programs and requirements.  We also interviewed officials from TSA’s Office of Intelligence, Risk  Management Division, the Office of Highway and Motor Carrier, and the  Office of Cargo Policy; and DOT’s PHMSA and FMCSA to obtain  information on their current and planned efforts to secure commercial  vehicles, as well as their collaborative efforts across agencies and with the  private sector. We also interviewed members of the SCC and the private  firms we visited to obtain their views regarding the effectiveness of TSA’s  coordination efforts, and discussed their views with TSA officials. Finally,  we compared TSA’s efforts to collaborate and coordinate with  stakeholders to key practices that we had previously developed as leading  practices of collaborating agencies.
We conducted this performance audit from September 2006 through  February 2009 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. (The methodology used to  gather our data on the incidents of truck and bus bombing is summarized  in app. II).

Appendix II: Incidents of Truck and Bus Bombings from 1997 to 2008

This appendix provides information on the analysis we conducted to  determine the incidents of truck and bus bombings presented in this  report. It provides information on the methodology used to identify  incidents worldwide and the detailed results of our analysis.

	Methodology Used to Identify Bombing Incidents

We used open sources, such as press and wire service reports, to  determine the extent of bus and truck bombings. We first reviewed the  general strengths and weakness of different open-source databases and  consulted open source search experts. We reviewed eight databases and  chose to use four based on the breadth and completeness of their media  sources, years, and geographic coverage; whether they contained  sufficient detail to verify that the event was a truck or bus bombing; and  whether they allowed for independent verification of source information.  We also wanted databases that had, or enabled, control methods to ensure  minimization of false positives and duplicates, and standardized criteria  for incident inclusion.
We narrowed our selection of databases to the Open Source Center (OSC),  Nexis, Global Terrorism Database (GTD), and Dialog databases. OSC is  the official open-source clearinghouse for the U.S. government that  monitors, translates, and disseminates within the U.S. government openly  available news and information from non-U.S. media sources. It has state  of the art language translation capabilities, so articles are usually  translated into English by native-speaker linguists. Nexis, Major World  Newspapers provides access to 5 billion searchable documents from more  than 40,000 legal, news, and business sources. GTD is an open-source  database gathering information on terrorist incidents around the world  since 1970. We made limited use of the earlier, first version called GTD 1  and only for 1997 when we could corroborate the incidents it identified  with additional sources found in Nexis. Our primary database was the  more rigorous GTD2, which currently covers terrorism events from 1998  to 2004. GTD2 is based on the OSC and Nexis databases, which it  evaluated as the best general databases. GTD2 entries have to be based on  multiple independent open-source reports or a single “highly credible”  source. GTD2 has a configurable definition of terrorism that includes more  than one definition of the phenomenon; control methods in place to  ensure minimization of false positives; a standardized criteria for incident  inclusion that is documented in a formal and publicly available codebook;  and a ranking system for media sources. Dialog is an online database that  allows for an extensive search of a variety of databases and collections  using powerful search language. Dialog’s ability to identify very specific  information made it an ideal second source to search for additional  documentation on known but not fully documented events.
We then explored the capabilities of these databases over time with a  small pilot, conducting searches on truck and bus bombings in one  individual year in each of three decades, specifically the years 1987, 1996,  and 2002, and explored which search terms and strategies produced the  best results for each database. We assessed the possible threats to validity  and confirmed that these were the pertinent issues with an open-source  terrorism data expert. Our analysis plan addressed a variety of threats to  validity and their mitigation:    False positives – Unclassified data on terrorist events are largely gathered  through open-source data, typically press reports. Since press reports may  not be the most reliable, we used several databases that use reputable  sources and decision rules for the inclusion of their entries. Entries we  accepted had to be based on a highly reliable source, or multiple sources.  Supporting articles had to directly confirm whether the incident was a  truck or bus bombing as well as the incident date, location, and the  number killed.
History – Electronic search engines and archives have improved over time.
Therefore, data across 25 years, since the 1983 Marine barracks bombing,  may not be comparable. Based on our pilot data, we only included  incidents from 1997, by which time both Nexis and GTD were well  developed and reliable.
Language - All languages may not be equally covered. GTD uses the Open  Source Center which is based entirely on foreign sources and has strong  translation capabilities among its staff.
Synonyms - Multiple English terms may be used for bus, truck and bomb  (e.g., bus vs. lorry). GTD uses extensive Boolean search terms with search  strings using hundreds of terms and synonyms. Nexis and Dialog enable  similar searches with wildcard strings. We applied GTD search strings to  Nexis and Dialog to cover more current events not yet included in GTD.
Geography - Some areas (e.g. Africa) may not be covered as well.
However, we looked for a very particular type of incident that was highly  likely to be the lead story where it occurred and picked up by the wires.
Dates -Reporting date vs. actual dates. Reporting dates on global time can  lead to confusion. GTD and OSC have date protocols to minimize date  error. Since our unit of analysis is years, this error was of little risk.
Breaking reports vs. “final” reports - Initial reports usually have less  confirmation of the number killed. When conflicting reports cannot be  reconciled, we used the lower number of reported killed. GTD also uses  the lowest number.  Incidents in a military area may not be terrorism - The GTD makes a  distinction between combatants and noncombatants. We screened out  events involving active combatants. However, we included incidents  directed at civilians or other targets in active war zones such as Iraq and  Afghanistan.  Incident duplication – Using multiple sources could inadvertently lead to  incident duplication. GTD has a protocol to eliminate duplicates and Nexis  also enables electronic duplication vetting. In addition, duplications were  screened manually and the entire dataset was verified by independent  staff.

	Search strategy

We originally hoped to list the incidents since the Beirut bombings of 1983,  but given the less rigorous methodology of GTD1, the limited archival  coverage of Nexis prior to 1996, and the limitations of other databases we  decided to drop 1983 through 1996. Due to the evolving coverage of these  databases, we had to employ three different search strategies to cover the  years from 1997 to 2007.
Time period: 1997   Primary search database: Global Terrorism Database “GTD1”  Secondary search database: Nexis’ Major World Newspapers  By 1997, Nexis sources were sufficiently developed and available online to  augment GTD1, which did not list supporting sources.
Time period: 1998-2004   Primary search database: Global Terrorism Database “GTD2”  GTD2 incorporates OSC and Nexis in a systematic manner and additional  searches of these sources were not necessary.
Time period: 2005-present  Primary search database: Nexis’ Major World Newspapers  Secondary search database: Individual newswires database in Dialog  Third search database: Open Source Center  For our study we searched the GTD2 for attacks utilizing or against a  commercial vehicle, either truck, bus, or bus station or bus stand,  specifically with explosives (VBIEDs, IED’s, suicide bomber(s), bombs,  grenades, roadside bombs, landmines, and rockets). When searching Nexis  we used the same search factors but with a Boolean search string. For  years in our study outside the GTD year range, we duplicated their search  and inclusion methodology. As a final check, we compared our results  with Department of State and Department of Defense terrorism lists and  timelines. We believe that these various steps successfully mitigated the  various threats to validity and enabled us to compile information on the  incidents of truck and bus bombings since 1997 with confidence.
The results of our search are summarized in figure 2 and detailed in table 3  below. Some additional trends are summarized in the figures below. Truck  and bus bombings are compared in figure 6, which shows that while bus  bombings have historically been more common, the incidence of truck  bombings has sharply increased since 2004 and peaked in 2007.
Figure 7 summarizes how the sharp increase in bombing deaths in 2007  was due to the increase in truck bombings.
We only counted incidents involving noncombatants, but most of the sharp  rise in deaths in truck and bus bombings that occurred in 2007 was due to  bombings in Iraq.

Appendix III: Commercial Vehicle Industry Trade Associations GAO Contacted

American Chemistry Council  (ACC)
American Federation of Labor and  Congress of Industrial  Organizations (AFL-CIO)
American Trucking Associations  (ATA)
Chlorine Institute (CI)
International Brotherhood of  Teamsters (IBT)
National Private Truck Council  (NPTC)
National Tank Truck Carriers  (NTTC)
Owner-Operator Independent  Drivers Association (OOIDA)
Truck Manufacturers Association  (TMA)
Truck Rental and Leasing  Association (TRALA)
United Motorcoach Association  (UMA)

Appendix IV: DHS and DOT Commercial Vehicle Security Programs Designed to Strengthen Commercial Vehicle Security

In addition to Corporate Security Reviews, TSA and DHS have four key  programs designed to strengthen the security of the commercial vehicle  industry. DOT also has four programs underway to strengthen commercial  vehicle security and TSA and DOT are working collaboratively on several  projects for securing commercial vehicles. Each of these programs and  projects are discussed below.

	DHS Security Programs

Trucking Security Program: The Trucking Security Program (TSP)  provides grants that fund programs to train and support the members of  the commercial vehicle industry in how to detect and report security  threats, and how to avoid becoming a target for terrorist activity. TSP is  administered by the Federal Emergency Management Agency’s Grant  Programs Directorate within DHS. As of May 2008, DHS has provided  nearly $78 million in TSP grants since 2003. Congress appropriated $16  million to fund this trucking security grant program for fiscal year 2008,  and $8 million for fiscal year 2009. For fiscal years 2004-2008 the principal  activity funded by the TSP was the American Trucking Associations’  Highway Watch program to improve security awareness in the commercial  vehicle industry. In May 2008, however, a new grantee, the HMS Company  of Alexandria, Virginia was selected.
Security Action Items (SAIs): TSA consulted with DOT and industry  stakeholders to develop SAIs, or voluntary security practices, intended to  improve security for trucks carrying security-sensitive hazardous  materials. TSA eventually plans to also develop SAIs for motor coaches  and school buses. According to TSA officials, the SAIs will allow TSA to  communicate the key elements of effective transportation security as  voluntary practices; TSA officials will use CSRs to gauge whether  voluntary practices are sufficient or if regulation is needed.
Hazardous Materials Driver Background Check Program: A  Hazardous Materials Endorsement (HME) authorizes an individual to  transport hazardous materials for commerce. The USA PATRIOT Act,  enacted in October 2001, prohibits states from issuing HMEs for a  commercial driver’s license to applicants who have not successfully  completed background checks. In response, TSA implemented the  hazardous materials driver security threat assessment program which  evaluates the hazardous materials driver’s criminal history, immigration  status, mental capacity, and connection with terrorism to determine  whether that driver poses a security risk.
Intercity Bus Security Grant Program: This DHS program distributes  grant money to eligible stakeholders to protect intercity bus systems and  the traveling public from terrorism. Current priorities focus on enhanced  security planning, passenger and baggage screening programs, facility  security enhancements, vehicle and driver protection, as well as training  and exercises. A total of $11.5 million was appropriated for fiscal year 2008  and $12 million for fiscal year 2009. A total of $11.5 million was  appropriated for fiscal year 2008 and $12 million for fiscal year 2009.

	DOT Security Programs

Security Plans and Training: DOT regulations require shippers and  carriers of certain hazardous materials to develop and implement security  plans.  The regulations permit a company to implement a security plan  tailored to its specific circumstances and operations. At a minimum, a  security plan must address personnel, access, and en route security. All  shippers and carriers must also ensure that employee training includes a  security awareness component. In response to an industry petition that  certain hazardous materials posing little or no security risk be removed  from the list of hazardous materials for which security plans are required,  DOT is reevaluating the security plan regulations.
Security Contact Reviews (SCRs): Through its SCRs, FMCSA conducts  compliance reviews of the security plans for hazardous materials transport  required by DOT hazardous materials regulations. FMCSA conducts SCRs  on all hazardous materials motor carriers that transport placardable  amounts of hazardous materials. As of September, 2008, FMCSA had  conducted 7,802 SCRs since the inception of the programs.
Hazardous Materials Safety Permit Program: Federal law directed  FMCSA to implement the hazardous materials permit program to produce  a safe and secure environment to transport certain types of hazardous  materials. The program requires certain motor carriers to maintain a  security program and establish a system of enroute communication. This  program uses the SCRs to collect data on motor carrier ability to secure  hazardous materials.
Sensitive Security Visits (SSVs): FMCSA conducts SSVs as educational  security discussions with motor carriers that carry small amounts of  hazardous materials that do not require posting hazardous materials  placards on their trucks. These visits discuss best practices for hazardous  materials transportation and provide informal suggestions for  improvement. As of September, 2008, FMCSA had conducted 13,411 SSVs  since the inception of the programs.

	TSA and DOT Joint Security Programs

TSA Missouri CSR Pilot: This pilot program conducts abbreviated CSRs  of trucking and motor coach companies using state inspectors. For more  details of the Missouri CSR program, see pages 26-31.
FMCSA and TSA Truck Tracking Security Pilots: FMCSA and TSA  have concluded hazardous materials truck-tracking pilots. FMCSA  completed a study of existing technologies in December 2004, evaluating  wireless communications systems, including global positioning satellite  (GPS) tracking and other technologies that allow companies to monitor  the location of their trucks and buses. TSA also tested tracking and  identification systems, theft detection and alert systems, motor vehicle  disabling systems, and systems to prevent unauthorized operation of  trucks and unauthorized access to their cargos. The 9/11 Commission Act  mandated that the Secretary develop a tracking program for motor carrier  shipments of hazardous materials by February 2008. TSA officials  reported that they worked with DOT to meet this mandate and completed  a program to facilitate truck tracking on January 10, 2008.
Hazardous Materials Research Involving Security Initiatives: DOT  and DHS sponsor research on emerging technology that could potentially  be used to enhance the safety and security of hazardous materials  transportation. This research involves evaluation of potential truck- disabling technologies, radiation detection devices, hazardous materials  routing, and software to assist in hazardous materials incident response.
Additional Programs: DHS and TSA also have a number of smaller  programs to augment motor carrier security and programs in the planning  stages. TSA has several projects on screening applicants for Commercial  Drivers Licenses (CDLs) and Hazardous Materials Endorsements on CDLs.  These include the Universal CDL Vetting Project, which will assess the  feasibility of implementing watch list checks of 9 million commercial  driver records. Through the Rental Truck Vetting Operational Study and  Analysis, TSA is assessing technologies to screen rental truck customers  against the DHS and FBI Watch List. To address the lack of security- related domain awareness, TSA and DHS also have developed several  projects: Federal Law Enforcement Training Center (FLETC) Roadside  Law Enforcement Transportation Security Awareness, and the Hazmat  Motor Carrier Security Self-Assessment Training Project which distributed  security self-assessment training on CDs to approximately 75,000  hazardous materials motor carriers and shippers. Through the Commercial  Truck Insurance Initiative, TSA is coordinating with insurance companies  to develop methods and measures to provide companies incentives to  improve security.

Appendix V: DOT Data on the Commercial Vehicle Industry

DOT maintains data on carriers and commercial vehicles registered with  DOT. However, the data on intrastate operations is incomplete and  unreliable because FMCSA does not have authority to regulate intrastate  operations that are not involved in the transport of hazardous materials.  Firms that operate exclusively within a single state do not have to register  with DOT unless they are in the 25 states that require all commercial  vehicles to register with DOT, or transport hazardous materials. This  means that DOT does not have data on approximately half the nation’s  intrastate carriers. Second, firms frequently do not keep their registrations  current, and as a result the currency and accuracy of DOT’s records are  not assured and many of its registrations are inactive. “Inactive” means  that carriers had no inspections, crashes, enforcement actions, compliance  reviews, safety audits, or registration applications with DOT for 3 years.  DOT does not know which firms have gone out of business and which  have simply failed to maintain their registrations. These incomplete data  on the population of commercial vehicle firms will present some  additional challenges to TSA for conducting a truly representative sample  of industry assessments.

Appendix VI: Highway and Motor Carrier GCC Membership List

Appendix VII: Comments from the Department of Homeland Security

Appendix VIII: GAO Contact and Staff Acknowledgments

	Acknowledgments

Glenn Davis and Robert White, Assistant Directors, and Dan Rodriguez  and Jason Schwartz, Analysts-in-Charge worked with Cathleen Berrick to  manage this assignment. Gary Malavenda made significant contributions  to many aspects of the work. Tracey King provided legal and regulatory  support. Shamia Woods analyzed federal, state, and industry actions.  Jennifer Cooper analyzed TSA’s cooperation efforts. Elizabeth Curda  provided assistance on performance measurement and collaboration.  Anish Bhatt and Joanna Berry helped in the design, methodology, and pilot  test of the incidents of bus and truck bombings. Colleen Candrl helped in  the design and conducted the searches on the incidents of bus and truck  bombings. Evan Gilman, Virginia Chanley, and Anna Maria Ortiz provided  additional design and methodological support.

Summary:
Why GAO Did This Study

Numerous incidents around the world have highlighted the vulnerability of commercial vehicles to terrorist acts. Commercial vehicles include over 1 million highly diverse truck and intercity bus firms. Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) has primary federal responsibility for ensuring the security of the commercial vehicle sector, while vehicle operators are responsible for implementing security measures for their firms. GAO was asked to examine: (1) the extent to which TSA has assessed security risks for commercial vehicles; (2) actions taken by key stakeholders to mitigate identified risks; and (3) TSA efforts to coordinate its security strategy with other federal, state, and private sector stakeholders. GAO reviewed TSA plans, assessments, and other documents; visited a nonrandom sample of 26 commercial truck and bus companies of varying sizes, locations, and types of operations; and interviewed TSA and other federal and state officials and industry representatives.

What GAO Found

TSA has taken actions to evaluate the security risks associated with the commercial vehicle sector, including assessing threats and initiating vulnerability assessments, but more work remains to fully gauge security risks. Risk assessment uses a combined analysis of threat, vulnerability, and consequence to estimate the likelihood of terrorist attacks and the severity of their impact. TSA conducted threat assessments of the commercial vehicle sector and has also cosponsored a vulnerability assessment pilot program in Missouri. However, TSA's threat assessments generally have not identified the likelihood of specific threats, as required by DHS policy. TSA has also not determined the scope, method, and time frame for completing vulnerability assessments of the commercial vehicle sector. In addition, TSA has not conducted consequence assessments, or leveraged the consequence assessments of other sectors. As a result of limitations with its threat, vulnerability, and consequence assessments, TSA cannot be sure that its approach for securing the commercial vehicle sector addresses the highest priority security needs. Moreover, TSA has not developed a plan or time frame to complete a risk assessment of the sector. Nor has TSA completed a report on commercial trucking security as required by the Implementing Recommendations of the 9/11 Commission Act (9/11 Commission Act). Key government and industry stakeholders have taken actions to strengthen the security of commercial vehicles, but TSA has not assessed the effectiveness of federal programs. TSA and the Department of Transportation (DOT) have implemented programs to strengthen security, particularly those emphasizing the protection of hazardous materials. States have also worked collaboratively to strengthen commercial vehicle security through their transportation and law enforcement officials' associations, and the establishment of fusion centers. TSA also has begun developing and using performance measures to monitor the progress of its program activities to secure the commercial vehicle sector, but has not developed measures to assess the effectiveness of these actions in mitigating security risks. Without such information, TSA will be limited in its ability to measure its success in enhancing commercial vehicle security. While TSA has also taken actions to improve coordination with federal, state, and industry stakeholders, more can be done to ensure that these coordination efforts enhance security for the sector. TSA signed joint agreements with DOT and supported the establishment of intergovernmental and industry councils to strengthen collaboration. TSA and DOT completed an agreement to avoid duplication of effort as required by the 9/11 Commission Act. However, some state and industry officials GAO interviewed reported that TSA had not clearly defined stakeholder roles and responsibilities consistent with leading practices for collaborating agencies. TSA has not developed a means to monitor and assess the effectiveness of its coordination efforts. Without enhanced coordination with the states, TSA will have difficulty expanding its vulnerability assessments.