Prior Actions Have Improved Port Security, but Issues Remain

Port security overall has improved because of the development of  organizations and programs such as AMSCs, Area Maritime Security Plans  (AMSPs), maritime security exercises, and the International Port Security  Program, but challenges to successful implementation of these efforts  remain. Additionally, agencies may face challenges addressing the  additional requirements directed by the SAFE Port Act, such as a  provision that DHS establish interagency operational centers at all high- priority ports. AMSCs and the Coast Guard’s sector command centers have  improved information sharing, but the types and ways information is  shared vary. AMSPs, limited to security incidents, could benefit from  unified planning to include an all-hazards approach. Maritime security  exercises would benefit from timely and complete after-action reports,  increased collaboration across federal agencies, and broader port-level  coordination. The Coast Guard’s International Port Security Program is  currently evaluating the antiterrorism measures maintained at foreign  seaports.

		Area Maritime Security Committees Share Information and Coast Guard Plans to Expand Interagency Operational Centers

Two main types of forums have developed for agencies to coordinate and  share information about port security: area committees and Coast Guard  sector command centers. AMSCs serve as a forum for port stakeholders,  facilitating the dissemination of information through regularly scheduled  meetings, issuance of electronic bulletins, and sharing key documents.  MTSA provided the Coast Guard with the authority to create AMSCs— composed of federal, state, local, and industry members—that help to  develop the AMSP for the port. As of August 2007, the Coast Guard had  organized 46 AMSCs. Each has flexibility to assemble and operate in a way  that reflects the needs of its port area, resulting in variations in the number  of participants, the types of state and local organizations involved, and the  way in which information is shared. Some examples of information shared  include assessments of vulnerabilities at specific port locations,  information about potential threats or suspicious activities, and Coast  Guard strategies intended for use in protecting key infrastructure. As part  of an ongoing effort to improve its awareness of the maritime domain, the  Coast Guard developed 35 sector command centers, four of which operate  in partnership with the U.S. Navy.
We have previously reported that both of these types of forums have  helped foster cooperation and information sharing. We further reported  that AMSCs provided a structure to improve the timeliness, completeness,  and usefulness of information sharing between federal and nonfederal  stakeholders. These committees improved upon previous information- sharing efforts because they established a formal structure and new  procedures for sharing information. In contrast to AMSCs, the Coast  Guard’s sector command centers can provide continuous information  about maritime activities and involve various agencies directly in  operational decisions using this information. We have reported that these  centers have improved information sharing, and the types of information  and the way information is shared vary at these centers depending on their  purpose and mission, leadership and organization, membership,  technology, and resources.
The SAFE Port Act called for establishment of interagency operational  centers, directing the Secretary of DHS to establish such centers at all  high-priority ports no later than 3 years after the act’s enactment. The act  required that the centers include a wide range of agencies and  stakeholders and carry out specified maritime security functions. In  addition to authorizing the appropriation of funds and requiring DHS to  provide Congress a proposed budget and cost-sharing analysis for  establishing the centers, the act directed the new interagency operational  centers to utilize the same compositional and operational characteristics  of existing sector command centers. According to the Coast Guard, none  of the 35 centers meets the requirements set forth in the SAFE Port Act.  Nevertheless, the four centers the Coast Guard operates in partnership  with the Navy are a significant step in meeting these requirements,  according to a senior Coast Guard official. The Coast Guard is currently  piloting various aspects of future interagency operational centers at  existing centers and is also working with multiple interagency partners to  further develop this project. DHS has submitted the required budget and  cost-sharing analysis proposal, which outlines a 5-year plan for upgrading  its centers into future interagency operations centers to continue to foster  information sharing and coordination in the maritime domain. The Coast  Guard estimates the total acquisition cost of upgrading 24 sectors that  encompass the nation’s high-priority ports into interagency operations  centers will be approximately $260 million, to include investments in  information system, sensor network, and facilities upgrades and  expansions. According to the Coast Guard, future interagency operations  centers will allow the Coast Guard and its partners to use port surveillance  with joined tactical and intelligence information, and share these data with  port partners working side by side in expanded facilities.
In our April 2007 testimony, we reported on various challenges the Coast  Guard faces in its information-sharing efforts. These challenges include  obtaining security clearances for port security stakeholders and creating  effective working relationships with clearly defined roles and  responsibilities. In our past work, we found the lack of federal security  clearances among area committee members had been routinely cited as a  barrier to information sharing. In turn, this inability to share classified  information may limit the ability to deter, prevent, and respond to a  potential terrorist attack. The Coast Guard, having lead responsibility in  coordinating maritime information, has made improvements to its  program for granting clearances to area committee members and  additional clearances have been granted to members with a need to  know. In addition, the SAFE Port Act includes a specific provision  requiring DHS to sponsor and expedite security clearances for participants  in interagency operational centers. However, the extent to which these  efforts will ultimately improve information sharing is not yet known. As  the Coast Guard expands its relationships with multiple interagency  partners, collaborating and sharing information effectively under new  structures and procedures will be important. While some of the existing  centers achieved results with existing interagency relationships, other  high-priority ports might face challenges establishing new working  relationships among port stakeholders and implementing their own  interagency operational centers. Finally, addressing potential overlapping  responsibilities —such as leadership roles for the Coast Guard and its  interagency partners—will be important to ensure that actions across the  various agencies are clear and coordinated.

		Operations to Provide Overall Port Security Face Resource Constraints

As part of its operations, the Coast Guard has also undertaken additional  activities to provide overall port security. The Coast Guard’s operations  order, Operation Neptune Shield, first released in 2003, specifies the level  of security activities to be conducted. The order sets specific activities for  each port. However, the amount of each activity is established based on  the port’s specific security concerns. Some examples of security activities  include conducting waterborne security patrols, boarding high-interest  vessels, escorting vessels into ports, and enforcing fixed security zones.  When a port security level increases, the amount of activity the Coast  Guard must conduct also increases. The Coast Guard uses monthly field  unit reports to indicate how many of its security activities it is able to  perform. Our review of these field unit reports indicates that many ports  are having difficulty meeting their port security responsibilities, with  resource constraints being a major factor. In an effort to meet more of its  security requirements, the Coast Guard uses a strategy that includes  partnering with other government agencies, adjusting its activity  requirements, and acquiring resources. Despite these efforts, many ports  are still having difficulty meeting their port security requirements. The  Coast Guard is currently studying what resources are needed to meet  certain aspects of its port security program, but to enhance the  effectiveness of its port security operations, a more comprehensive study  to determine all additional resources and changes to strategy to meet  minimum security requirements may be needed.

		Area Maritime Security Plans Are in Place but Need to Address Recovery and Natural Disasters

Implementing regulations for MTSA specified that AMSPs include, among  other things, operational and physical security measures in place at the  port under different security levels, details of the security incident  command and response structure, procedures for responding to security  threats including provisions for maintaining operations in the port, and  procedures to facilitate the recovery of the marine transportation system  after a security incident. A Coast Guard Navigation and Vessel Inspection  Circular (NVIC) provided a common template for AMSPs and specified the  responsibilities of port stakeholders under them. As of September 2007,  46 AMSPs are in place at ports around the country. The Coast Guard  approved the plans by June 1, 2004, and MTSA requires that they be  updated at least every 5 years.
The SAFE Port Act added a requirement to AMSPs that specified that they  include recovery issues by identifying salvage equipment able to restore  operational trade capacity. This requirement was established to ensure  that the waterways are cleared and the flow of commerce through United  States ports is reestablished as efficiently and quickly as possible after a  security incident. While the Coast Guard sets out the general priorities for  recovery operations in its guidelines for the development of AMSPs, we  have found that this guidance offers limited instruction and assistance for  developing procedures to address recovery situations.
The Maritime Infrastructure Recovery Plan (MIRP) recognizes the limited  nature of the Coast Guard’s guidance and notes the need to further  develop recovery aspects of the AMSPs. The MIRP provides specific  recommendations for developing the recovery sections of the AMSPs. The  AMSPs that we reviewed often lacked recovery specifics, and none had  been updated to reflect the recommendations made in the MIRP. The  Coast Guard is currently updating the guidance for the AMSPs and aims to  complete the updates by the end of calendar year 2007 so that the  guidance will be ready for the mandatory 5-year re-approval of the AMSPs  in 2009. Coast Guard officials commented that any changes to the recovery  section would need to be consistent with the national protocols developed  for the SAFE Port Act. Additionally, related to recovery planning, the  Coast Guard and CBP have developed specific interagency actions focused  on response and recovery. This should provide the Coast Guard and CBP  with immediate security options for the recovery of ports and commerce.
Further, AMSPs generally do not address natural disasters (i.e., they do  not have an all-hazards approach). In a March 2007 report examining how  ports are dealing with planning for natural disasters such as hurricanes  and earthquakes, we noted that AMSPs cover security issues but not other  issues that could have a major impact on a port’s ability to support  maritime commerce. As currently written, AMSPs are concerned with  deterring and, to a lesser extent, responding to security incidents. We  found, however, that unified consideration of all risks—natural and man- made—faced by a port may be beneficial. Because of the similarities  between the consequences of terrorist attacks and natural or accidental  disasters, much of the planning for protection, response, and recovery  capabilities is similar across all emergency events. Combining terrorism  and other threats can thus enhance the efficiency of port planning efforts.  This approach also allows port stakeholders to estimate the relative value  of different mitigation alternatives. The exclusion of certain risks from  consideration, or the separate consideration of a particular type of risk,  raises the possibility that risks will not be accurately assessed or  compared, and that too many or too few resources will be allocated  toward mitigation of a particular risk.
As ports continue to revise and improve their planning efforts, available  evidence indicates that by taking a systemwide approach and thinking  strategically about using resources to mitigate and recover from all forms  of disaster, ports will be able to achieve the most effective results. AMSPs  provide a useful foundation for establishing an all-hazards approach. While  the SAFE Port Act does not call for expanding AMSPs in this manner, it  does contain a requirement that natural disasters and other emergencies  be included in the scenarios to be tested in the Port Security Exercise  Program. On the basis of our prior work, we found there are challenges in  using AMSCs and AMSPs as the basis for broader all-hazards planning.  These challenges include determining the extent that security plans can  serve all-hazards purposes. We recommended that DHS encourage port  stakeholders to use the AMSCs and MTSA-required AMSPs to discuss all- hazards planning. DHS concurred with this recommendation.

		Maritime Security Exercises Require a Broader Scope and Participation

The Coast Guard Captain of the Port and the AMSC are required by MTSA  regulations to conduct or participate in exercises to test the effectiveness  of AMSPs annually, with no more than 18 months between exercises.  These exercises—which have been conducted for the past several years— are designed to continuously improve preparedness by validating  information and procedures in the area plan, identifying weaknesses and  strengths, and practicing command and control within an incident  command/unified command framework. In August 2005, the Coast Guard  and the TSA initiated the Port Security Training Exercise Program  (PortSTEP)—an exercise program designed to involve the entire port  community, including public governmental agencies and private industry,  and intended to improve connectivity of various surface transportation  modes and enhance AMSPs. Between August 2005 and October 2007, the  Coast Guard expected to conduct PortSTEP exercises for 40 area  committees and other port stakeholders. Additionally, the Coast Guard  initiated its own Area Maritime Security Training and Exercise Program  (AMStep) in October 2005. This program was also designed to involve the  entire port community in the implementation of the AMSP. Between the  two programs, PortSTEP and AMStep, all AMSCs have received a port  security exercise each year since inception.
The SAFE Port Act included several new requirements related to security  exercises, such as establishing a Port Security Exercise Program to test  and evaluate the capabilities of governments and port stakeholders to  prevent, prepare for, mitigate against, respond to, and recover from acts of  terrorism, natural disasters, and other emergencies at facilities that MTSA  regulates. The act also required the establishment of a port security  exercise improvement plan process that would identify, disseminate, and  monitor the implementation of lessons learned and best practices from  port security exercises.
Though we have not specifically examined compliance with these new  requirements, our work in examining past exercises suggests that  implementing a successful exercise program faces several challenges.  These challenges include setting the scope of the program to determine  how exercise requirements in the SAFE Port Act differ from area  committee exercises that are currently performed. This is especially true  for incorporating recovery scenarios into exercises. In this past work, we  also found that Coast Guard terrorism exercises frequently focused on  prevention and awareness, but often did not include recovery activities.  According to the Coast Guard, with the recent emphasis on planning for  recovery operations, it has held several exercises over the past year that  have either included or consisted solely of recovery activities. It will be  important that future exercises also focus on recovery operations so  public and private stakeholders can cover gaps that might hinder  commerce after a port incident. Other long-standing challenges include  completing after-action reports in a timely and thorough manner and  ensuring that all relevant agencies participate. According to the Coast  Guard, as the primary sponsor of these programs, it faces a continuing  challenge in getting comprehensive participation in these exercises.

		The Coast Guard Is Evaluating the Security of Foreign Ports, but Faces Resource Challenges

The security of domestic ports also depends upon security at foreign ports  where cargoes bound for the United States originate. To help secure the  overseas supply chain, MTSA required the Coast Guard to develop a  program to assess security measures in foreign ports and, among other  things, recommend steps necessary to improve security measures in those  ports. The Coast Guard established this program, called the International  Port Security Program, in April 2004. Under this program, the Coast Guard  and host nations review the implementation of security measures in the  host nations’ ports against established security standards, such as the  International Maritime Organization’s International Ship and Port Facility  Security (ISPS) Code. Coast Guard teams have been established to  conduct country visits, discuss security measures implemented, and  collect and share best practices to help ensure a comprehensive and  consistent approach to maritime security in ports worldwide. The  conditions of these visits, such as timing and locations, are negotiated  between the Coast Guard and the host nation. Coast Guard officials also  make annual visits to the countries to obtain additional observations on  the implementation of security measures and ensure deficiencies found  during the country visits are addressed.
Both the SAFE Port Act and other congressional directions have called for  the Coast Guard to increase the pace of its visits to foreign countries.  Although MTSA did not set a time frame for completion of these visits, the  Coast Guard initially set a goal to visit the approximately 140 countries  that conduct maritime trade with the United States by December 2008. In  September 2006, the conference report accompanying the fiscal year 2007  DHS Appropriations Act directed the Coast Guard to “double the amount”  of its visits. Subsequently, in October 2006, the SAFE Port Act required  the Coast Guard to reassess security measures at the foreign ports every 3  years. Coast Guard officials said they will comply with the more stringent  requirements and will reassess countries on a 2-year cycle. With the  expedited pace, the Coast Guard now expects to assess all countries by  March 2008, after which reassessments will begin.
We are currently conducting a review of the Coast Guard’s International  Port Security Program that evaluates the Coast Guard’s implementation of  international enforcement programs. The report, expected to be issued in  early 2008, will cover issues related to the program, such as the extent to  which the program is using a risk-based approach in carrying out its work,  what challenges the program faces as it moves forward, and the extent to  which the observations collected during the country visits are used by  other programs such as the Coast Guard’s port state control inspections  and high-interest vessel boarding programs.
As of September 2007, the Coast Guard reported that it has visited  109 countries under this program and plans to visit another 29 more by  March 2008. For the countries for which the Coast Guard has issued a  final report, the Coast Guard reported that most had “substantially  implemented the security code,” while a few countries were found to have  not yet implemented the ISPS Code and will be subject to a reassessment  or other sanctions. The Coast Guard also found several facilities needing  improvements in areas such as access controls, communication devices,  fencing, and lighting.
While our review is still preliminary, Coast Guard officials told us that to  plan and prepare for the next cycle of reassessments that are to begin next  year, they are considering modifying their current visit methodology to  incorporate a risk-based approach to prioritize the order and intensity of  the next round of country visits. To do this, they have consulted with a  contractor to develop an updated country risk prioritization model. Under  the previous model, the priority assigned to a country for a visit was  weighted heavily toward the volume of U.S. trade with that country. The  new model being considered is to incorporate other factors, such as  corruption and terrorist activity levels within the countries. Program  officials told us that the details of this revised approach have yet to be  finalized.
Coast Guard officials told us that as they complete the first round of visits  and move into the next phase of revisits, challenges still exist in  implementing the program. One challenge identified was that the faster  rate at which foreign ports will now be reassessed will require hiring and  training new staff—a challenge the officials expect will be made more  difficult because experienced personnel who have been with the program  since its inception are being transferred to other positions as part of the  Coast Guard’s rotational policy. These officials will need to be replaced  with newly assigned personnel.
Reluctance by some countries to allow the Coast Guard to visit their ports  due to concerns over sovereignty was another challenge cited by program  officials in completing the first round of visits. According to these officials,  before permitting Coast Guard officials to visit their ports, some countries  insisted on visiting and assessing a sample of U.S. ports. The Coast Guard  was able to accommodate their request through the program’s reciprocal  visit feature in which the Coast Guard hosts foreign delegations to visit  U.S. ports and observe ISPS Code implementation in the United States.  This subsequently helped gain the cooperation of the countries in hosting  a Coast Guard visit to their own ports. However, as they begin to revisit  countries as part of the program’s next phase, program officials stated that  sovereignty concerns may still be an issue. Some countries may be  reluctant to host a comprehensive country visit on a recurring basis  because they believe the frequency—once every 2 to 3 years—is too high.  Sovereignty also affects the conditions of the visits, such as timing and  locations, because such visits are negotiated between the Coast Guard and  the host nation. Thus the Coast Guard team making the visit could be  precluded from seeing locations that are not in compliance.
Another challenge program officials cite is having limited ability to help  countries build on or enhance their capacity to implement the ISPS Code  requirements. For example, the SAFE Port Act required that GAO report  on various aspects of port security in the Caribbean Basin. We earlier  reported that although the Coast Guard found that most of the countries  had substantially implemented the ISPS Code, some facilities needed to  make improvements or take additional measures. In addition, our  discussions with facility operators and government officials in the region  indicated that assistance—such as additional training—would help  enhance their port security. Program officials stated that while their visits  provide opportunities for them to identify potential areas to improve or  help sustain the security measures put in place, other than sharing best  practices or providing presentations on security practices, the program  does not currently have the resources to directly assist countries with  more in-depth training or technical assistance. To overcome this, program  officials have worked with other agencies (e.g., the Departments of  Defense and State) and international organizations (e.g., the Organization  of American States) to secure funding for training and assistance to  countries where port security conferences have been held (e.g., the  Dominican Republic and the Bahamas). Program officials indicated that as  part of reexamining the approach for the program’s next phase, they will  also consider possibilities to improve the program’s ability to provide  training and capacity building to countries when a need is identified.

	Port Facility Security Efforts Continue, but Additional Evaluation Is Needed

To improve the security at individual facilities at ports, many long-standing  programs are under way. However, new challenges to their successful  implementation have emerged. The Coast Guard is required to conduct  assessments of security plans and facility compliance inspections, but  faces challenges in staffing and training to meet the SAFE Port Act’s  additional requirements such as the sufficiency of trained personnel and  guidance to conduct facility inspections. TSA’s TWIC program has  addressed some of its initial program challenges, but will continue to face  additional challenges as the program rollout continues. Many steps have  been taken to ensure that transportation workers are properly screened,  but redundancies in various background checks have decreased efficiency  and highlighted the need for increased coordination.

		The Coast Guard’s Compliance Monitoring of Maritime Facilities Identifies Deficiencies, but Program Effectiveness Overall Has Not Been Evaluated

MTSA and its implementing regulations required owners and operators of  certain maritime facilities (e.g., power stations, chemical manufacturing  facilities, and refineries that are located on waterways and receive foreign  vessels) to conduct assessments of their security vulnerabilities, develop  security plans to mitigate these vulnerabilities, and implement measures  called for in the security plans by July 1, 2004. Under the Coast Guard  regulations, these plans are to include items such as measures for access  control, responses to security threats, and drills and exercises to train staff  and test the plan. The plans are “performance-based,” meaning that the  Coast Guard has specified the outcomes it is seeking to achieve and has  given facilities responsibility for identifying and delivering the measures  needed to achieve these outcomes.
Under MTSA, Coast Guard guidance calls for the Coast Guard to conduct  one on-site facility inspection annually to verify continued compliance  with the plan. The SAFE Port Act, enacted in 2006, required the Coast  Guard to conduct at least two inspections—one of which was to be  unannounced—of each facility annually. We currently have ongoing work  that reviews the Coast Guard’s oversight strategy under MTSA and SAFE  Port Act requirements. The report, expected later this year, will cover,  among other things, the extent to which the Coast Guard has met its  inspection requirements and found facilities to be in compliance with its  security plans, the sufficiency of trained inspectors and guidance to  conduct facility inspections, and aspects of the Coast Guard’s overall  management of its MTSA facility oversight program, particularly  documenting compliance activities.
Our work is preliminary. However, according to our analysis of Coast  Guard records and statements from officials, the Coast Guard seems to  have conducted facility compliance exams annually at most—but not all—  facilities. Redirection of staff to a higher-priority mission, such as  Hurricane Katrina emergency operations, may have accounted for some  facilities not having received an annual exam. The Coast Guard also  conducted a number of unannounced inspections—about 4,500 in 2006,  concentrated in around 1,200 facilities—prior to the SAFE Port Act’s  passage. According to officials we spoke with, the Coast Guard selected  facilities for unannounced inspection based on perceived risk and  inspection convenience (e.g., if inspectors were already at the facility for  another purpose). The Coast Guard has identified facility plan compliance  deficiencies in about one-third of facilities inspected each year, and the  deficiencies identified are concentrated in a small number of categories  (e.g., failure to follow the approved plan for ensuring facility access  control, record keeping, or meeting facility security officer requirements).  We are still in the process of reviewing the data Coast Guard uses to  document compliance activities and will have additional information in  our forthcoming report.
Sectors we visited generally reported having adequate guidance and staff  for conducting consistent compliance exams, but until recently, little  guidance on conducting unannounced inspections, which are often  incorporated into work while performing other mission tasks. Lacking  guidance on unannounced inspections, the process for conducting one  varied considerably in the sectors we visited. For example, inspectors in  one sector found the use of a telescope effective in remotely observing  facility control measures (such as security guard activities), but these  inspectors primarily conduct unannounced inspections as part of vehicle  patrols. Inspectors in another sector conduct unannounced inspections at  night, going up to the security gate and querying personnel about their  security knowledge (e.g., knowledge of high-security-level procedures). As  we completed our fieldwork, the Coast Guard issued a Commandant  message with guidance on conducting unannounced inspections. This  message may provide more consistency, but how the guidance will be  applied and its impact on resource needs remain uncertain. Coast Guard  officials said they plan to revise their primary circular on facility oversight  by February 2008. They are also planning to revise MTSA regulations to  conform to SAFE Port Act requirements in 2009 (in time for the reapproval  of facility security plans) but are behind schedule.
We recommended in June 2004 that the Coast Guard evaluate its  compliance inspection efforts taken during the initial 6-month period after  July 1, 2004, and use the results to strengthen its long-term strategy for  ensuring compliance. The Coast Guard agreed with this recommendation.  Nevertheless, based on our ongoing work, it appears that the Coast Guard  has not conducted a comprehensive evaluation of its oversight program to  identify strengths or target areas for improvement after 3 years of program  implementation. Our prior work across a wide range of public and private  sector organizations shows that high-performing organizations  continuously assess their performance with information about results  based on their activities. For decision makers to assess program  strategies, guidance, and resources, they need accurate and complete data  reflecting program activities. We are currently reviewing the accuracy and  completeness of Coast Guard compliance data and will report on this issue  later this year.

		TSA Has Made Progress in Implementing the TWIC Program, but Key Deadline Has Been Missed as TSA Evaluates Test Program

To control access to secure areas of port facilities and vessels, the  Secretary of DHS was required by MTSA to, among other things; issue a  transportation worker identification card that uses biometrics, such as  fingerprints. TSA had already initiated a program to create an  identification credential that could be used by workers in all modes of  transportation when MTSA was enacted. This program, called the TWIC  program, is designed to collect personal and biometric information to  validate workers’ identities, conduct background checks on transportation  workers to ensure they do not pose a threat to security, issue tamper- resistant biometric credentials that cannot be counterfeited, verify these  credentials using biometric access control systems before a worker is  granted unescorted access to a secure area, and revoke credentials if  disqualifying information is discovered, or if a card is lost, damaged, or  stolen. TSA, in partnership with the Coast Guard, is focusing initial  implementation on maritime facilities.
We have previously reported on the status of this program and the  challenges that it faces. Most recently, we reported that TSA has made  progress in implementing the TWIC program and addressing problems we  previously identified regarding contract planning and oversight and  coordination with stakeholders. For example, TSA reported that it added  staff with program and contract management expertise to help oversee the  contract and developed plans for conducting public outreach and  education efforts.
The SAFE Port Act required TSA to implement TWIC at the 10 highest-risk  ports by July 1, 2007, conduct a pilot program to test TWIC access control  technologies in the maritime environment; issue regulations requiring  TWIC card readers based on the findings of the pilot; and periodically  report to Congress on the status of the program. According to TSA  officials, the July 1 deadline was not met because the agency and the TWIC  enrollment contractor needed to conduct additional tests of the software  and equipment that will be used to enroll and issue cards to workers to  ensure that they work effectively before implementation. TSA officials  stated that such testing was needed to ensure that these systems will be  able to handle the capacity of enrolling as many as 5,000 workers per day,  conducting background checks on these workers in a timely manner, and  efficiently producing a TWIC card for each worker. In October 2007, TSA  announced that this testing was complete, and the agency reported that it  began enrolling and issuing TWIC cards to workers at the Port of  Wilmington, Delaware, on October 16, 2007, and that implementation  would extend to 11 additional ports by November 2007. TSA has also  begun planning a pilot to test TWIC access control technologies, such as  biometric card readers, in the maritime environment as required by the  SAFE Port Act. According to TSA, the agency is partnering with the port  authorities of Los Angeles, Long Beach, Brownsville, and New York and  New Jersey, in addition to Watermark Cruises in Annapolis, Maryland, to  test the TWIC access control technologies in the maritime environment  and is still seeking additional participants. TSA’s objective is to include  pilot test participants that are representative of a variety of facilities and  vessels in different geographic locations and environmental conditions.  According to TSA, the results of the pilot program will help the agency  issue future regulations that will require the installation of access control  systems necessary to read the TWIC cards. We will also be testifying  before the full Committee on Homeland Security on several key challenges  that can affect the successful implementation of the TWIC program.

		DHS Working to Coordinate Multiple Background Check Programs for Transportation Workers

Since the 9/11 attacks, the federal government has taken steps to ensure  that transportation workers, many of whom transport hazardous materials  or have access to secure areas in locations such as port facilities, are  properly screened to ensure they do not pose a security risk. Concerns  have been raised, however, that transportation workers may face a variety  of background checks, each with different standards. In July 2004, the 9/11  Commission reported that having too many different biometric standards,  travel facilitation systems, credentialing systems, and screening  requirements hampers the development of information crucial for  stopping terrorists from entering the country, is expensive, and is  inefficient. The commission recommended that a coordinating body raise  standards, facilitate information-sharing, and survey systems for potential  problems. In August 2004, Homeland Security Presidential Directive - 11  announced a new U.S. policy to “implement a coordinated and  comprehensive approach to terrorist-related screening—in immigration,  law enforcement, intelligence, counterintelligence, and protection of the  border, transportation systems, and critical infrastructure—that supports  homeland security, at home and abroad.”
DHS components have begun a number of their own background check  initiatives. For example, in January 2007, TSA determined that the  background checks required for three other DHS programs satisfied the  background check requirement for the TWIC program. That is, an  applicant who has already undergone a background check in association  with any of these three programs does not have to undergo an additional  background check and pays a reduced fee to obtain a TWIC card.  Similarly, the Coast Guard plans to consolidate four credentials and  require that all pertinent information previously submitted by an applicant  at a Coast Guard Regional Examination Center will be forwarded by the  center to TSA through the TWIC enrollment process.
In April 2007, we completed a study of DHS background check programs  as part of a SAFE Port Act requirement to do so. We found that the six  programs we reviewed were conducted independently of one another,  collected similar information, and used similar background check  processes. Further, each program operated separate enrollment facilities  to collect background information and did not share it with the other  programs. We also found that DHS did not track the number of workers  who, needing multiple credentials, were subjected to multiple background  check programs. Because DHS is responsible for a large number of  background check programs, we recommended that DHS ensure that its  coordination plan includes implementation steps, time frames, and budget  requirements; discusses potential costs/benefits of program  standardization; and explores options for coordinating and aligning  background checks within DHS and other federal agencies.
DHS concurred with our recommendations and continues to take steps— both at the department level and within its various agencies—to  consolidate, coordinate, and harmonize such background check  programs. At the department level, DHS created SCO in July 2006 to  coordinate DHS background check programs. SCO is in the early stages of  developing its plans for this coordination. In December 2006, SCO issued a  report identifying common problems, challenges, and needed  improvements in the credentialing programs and processes across the  department. The office awarded a contract in April 2007 that will provide  the methodology and support for developing an implementation plan to  include common design and comparability standards and related  milestones to coordinate DHS screening and credentialing programs. Since  April 2007, DHS and SCO have signed a contract to produce three  deliverables to align its screening and credentialing activities, set a method  and time frame for applying a common set of design and comparability  standards, and eliminate redundancy through harmonization. These three  deliverables are as follows:    Credentialing framework: A framework completed in July 2007 that  describes a credentialing lifecycle of registration and enrollment,  eligibility vetting and risk assessment, issuance, expiration and  revocation, and redress. This framework was to incorporate risk-based  levels or criteria, and an assessment of the legal, privacy, policy,  operational, and technical challenges.
Technical review: An assessment scheduled for completion in  October 2007 is to be completed by the contractor in conjunction with  the DHS Office of the Chief Information Officer. This is to include a  review of the issues present in the current technical environment and  the proposed future technical environment needed to address those  issues, and provide recommendations for targeted investment reuse  and key target technologies.
Transition plan: A plan scheduled to be completed in November 2007  is to outline the projects needed to actualize the framework, including  identification of major activities, milestones, and associated timeline  and costs.
Stakeholders in this effort include multiple components of DHS and the  Departments of State and Justice.
In addition, the DHS Office of the Chief Information Officer (CIO) and the  director of SCO issued a memo in May 2007 to promote standardization  across screening and credentialing programs. In this memo, DHS indicated  that (1) programs requiring the collection and use of fingerprints to vet  individuals will use the Automated Biometric Identification System  (IDENT); (2) these programs are to reuse existing or currently planned  and funded infrastructure for the intake of identity information to the  greatest extent possible; (3) its CIO is to establish a procurement plan to  ensure that the department can handle a large volume of automated  vetting from programs currently in the planning phase; and (4) to support  the sharing of databases and potential consolidation of duplicative  applications, the Enterprise Data Management Office is currently  developing an inventory of biographic data assets that DHS maintains to  support identity management and screening processes.
While continuing to consolidate, coordinate, and harmonize background  check programs, DHS will likely face additional challenges, such as  ensuring that its plans are sufficiently complete without being overly  restrictive, and lack of information regarding the potential costs and  benefits associated with the number of redundant background checks.  SCO will be challenged to coordinate DHS’s background check programs  in such a way that any common set of standards developed to eliminate  redundant checks meets the varied needs of all the programs without  being so strict that it unduly limits the applicant pool or so intrusive that  potential applicants are unwilling to take part. Without knowing the  potential costs and benefits associated with the number of redundant  background checks that harmonization would eliminate, DHS lacks the  performance information that would allow its program managers to  compare their program results with goals. Thus, DHS cannot be certain  where to target program resources to improve performance. As we  recommended, DHS could benefit from a plan that includes, at a minimum,  a discussion of the potential costs and benefits associated with the  number of redundant background checks that would be eliminated  through harmonization.

	Container Security Programs Continue to Expand and Mature, but New Challenges Emerge

Through the development of strategic plans, human capital strategies, and  performance measures, several container security programs have been  established and matured. However, these programs continue to face  technical and management challenges in implementation. As part of its  layered security strategy, CBP developed the Automated Targeting System  as a decision support tool to assess the risks of individual cargo  containers. ATS is a complex mathematical model that uses weighted rules  that assign a risk score to each arriving shipment based on shipping  information (e.g., manifests, bills of lading, and entry data). Although the  program has faced quality assurance challenges from its inception, CBP  has made significant progress in addressing these challenges. CBP’s in- bond program does not collect detailed information at the U.S. port of  arrival that could aid in identifying cargo posing a security risk and  promote the effective use of inspection resources. In the past, CSI has  lacked sufficient staff to meet program requirements. C-TPAT has faced  challenges with validation quality and management in the past, in part due  to its rapid growth. The Department of Energy’s Megaports Initiative faces  ongoing operational and technical challenges in the installation and  maintenance of radiation detection equipment at ports. In addition,  implementing the Secure Freight Initiative and the 9/11 Commission Act of  2007 presents additional challenges for the scanning of cargo containers  inbound to the United States.

		Management of the Automated Targeting System Has Improved

CBP is responsible for preventing terrorists and WMD from entering the  United States. As part of this responsibility, CBP addresses the potential  threat posed by the movement of oceangoing cargo containers. To perform  this mission, CBP officers at seaports utilize officer knowledge and CBP  automated systems to assist in determining which containers entering the  country will undergo inspections, and then perform the necessary level of  inspection of each container based upon risk. To assist in determining  which containers are to be subjected to inspection, CBP uses a layered  security strategy that attempts to focus resources on potentially risky  cargo shipped in containers while allowing other oceangoing containers to  proceed without disrupting commerce. ATS is one key element of this  strategy. CBP uses ATS as a decision support tool to review  documentation, including electronic manifest information submitted by  the ocean carriers on all arriving shipments, and entry data submitted by  brokers to develop risk scores that help identify containers for additional  inspection. CBP requires the carriers to submit manifest information 24  hours prior to a United States-bound sea container being loaded onto a  vessel in a foreign port. CBP officers use these scores to help them make  decisions on the extent of documentary review or additional inspection as  required.
We have conducted several reviews of ATS and made recommendations  for its improvement. Consistent with these recommendations, CBP has  implemented a number of important internal controls for the  administration and implementation of ATS. For example, CBP (1) has  established performance metrics for ATS, (2) is manually comparing the  results of randomly conducted inspections with the results of inspections  resulting from ATS analysis of the shipment data, and (3) has developed  and implemented a testing and simulation environment to conduct  computer-generated tests of ATS. Since our last report on ATS, the SAFE  Port Act required that the CBP Commissioner take additional actions to  improve ATS. These requirements included steps such as (1) having an  independent panel review the effectiveness and capabilities of ATS; (2)  considering future iterations of ATS that would incorporate smart  features; (3) ensuring that ATS has the capability to electronically  compare manifest and other available data to detect any significant  anomalies and facilitate their resolution; (4) ensuring that ATS has the  capability to electronically identify, compile, and compare select data  elements following a maritime transportation security incident; and  (5) developing a schedule to address recommendations made by GAO and  the Inspectors General of the Department of the Treasury and DHS.

		CBP’s Management of the In-Bond Cargo System Impedes Efforts to Manage Security Risks

CBP’s in-bond system—which allows goods to transit the United States  without officially entering U.S. commerce—must balance the competing  goals of providing port security, facilitating trade, and collecting trade  revenues. However, we have earlier reported that CBP’s management of  the system has impeded efforts to manage security risks. Specifically, CBP  does not collect detailed information on in-bond cargo at the U.S. port of  arrival that could aid in identifying cargo posing a security risk and  promote effective use of inspection resources.
The in-bond system is designed to facilitate the flow of trade throughout  the United States and is estimated to be widely used. The U.S. customs  system allows cargo to move from the U.S. arrival port, without appraisal  or payment of duties, to another U.S. port for official entry into U.S.  commerce or for exportation. In-bond regulations currently permit  bonded carriers from 15 to 60 days, depending on the mode of shipment,  to reach their final destination and allow them to change a shipment’s final  destination without notifying CBP. The in-bond system allows the trade  community to avoid congestion and delays at U.S. seaports whose  infrastructure has not kept pace with the dramatic growth in trade volume.  In-bond facilitates trade by allowing importers and shipping agents the  flexibility to move cargo more efficiently. Using the number of in-bond  transactions reported by CBP for the 6-month period of October 2004 to  March 2005, we found over 6.5 million in-bond transactions were initiated  nationwide. Some CBP port officials have estimated that in-bond  shipments represent from 30 percent to 60 percent of goods received at  their ports.
As discussed earlier in this testimony, CBP uses manifest information it  receives on all cargo arriving at U.S. ports (including in-bond cargo) as  input for ATS scoring to aid in identifying security risks and setting  inspection priorities. For regular cargo, the ATS score is updated with  more detailed information as the cargo makes official entry at the arrival  port. For in-bond cargo, the ATS scores generally are not updated until  these goods move from the port of arrival to the destination port for  official entry into United States commerce, or not updated at all for cargo  that is intended to be exported. As a result, in-bond goods might transit  the United States without having the most accurate ATS risk score.
Entry information frequently changes the ATS score for in-bond goods.  For example, CBP provided data for four major ports comparing the ATS  score assigned to in-bond cargo at the port of arrival based on the manifest  to the ATS score given after goods made official entry at the destination  port. These data show that for the four ports, the ATS score based on the  manifest information stayed the same an average of 30 percent of the time  after being updated with entry information, ATS scores increased an  average of 23 percent of the time and decreased an average of 47 percent  of the time. A higher ATS score can result in higher priority being given to  cargo for inspection than otherwise would be given based solely on the  manifest information. A lower ATS score can result in cargo being given a  lower priority for inspection and potentially shift inspection resources to  cargo deemed a higher security risk. Without having the most accurate  ATS score, in-bond goods transiting the United States pose a potential  security threat because higher-risk cargo may not be identified for  inspection at the port of arrival. In addition, scarce inspection resources  may be misdirected to in-bond goods that a security score based on better  information might have shown did not warrant inspection.
We earlier recommended that the Commissioner of CBP take action in  three areas to improve the management of the in-bond program, which  included collecting and using improved information on in-bond shipments  to update the ATS score for in-bond movements at the arrival port and  enable better informed decisions affecting security, trade, and revenue  collection. DHS agreed with most of our recommendations. According to  CBP, it is in the process of developing an in-bond weight set to be utilized  to further identify cargo posing a security risk. The weight set is being  developed based on expert knowledge, analysis of previous in-bond  seizures, and creation of rules based on in-bond concepts.
The SAFE Port Act of 2006 contains provisions related to securing the  international cargo supply chain, including provisions related to the  movement of in-bond cargo. Specifically, it requires that CBP submit a  report to several congressional committees on the in-bond system that  includes an assessment of whether ports of arrival should require  additional information for in-bond cargo, a plan for tracking in-bond cargo  in CBP’s Automated Commercial Environment information system, and  assessment of the personnel required to ensure reconciliation of in-bond  cargo between arrival port and destination port. It also requires that the  report include an assessment of the feasibility of reducing transit time  while traveling in-bond, and an evaluation of the criteria for targeting and  examining in-bond cargo. CBP submitted the report to the Congress on  October 17, 2007.  In the report, CBP states its intention to propose various  changes addressing the areas of concern, but it does not propose time  frames for its actions.

		The CSI Program Continues to Mature, but Addressing SAFE Port Act Requirements Adds New Challenges

CBP initiated its CSI program to detect and deter terrorists from  smuggling WMD via cargo containers before they reach domestic seaports  in January 2002. The SAFE Port Act formalized the CSI program into law.  Under CSI, foreign governments sign a bilateral agreement with CBP to  allow teams of U.S. customs officials to be stationed at foreign seaports to  identify cargo container shipments at risk of containing WMD. CBP  personnel use automated risk assessment information and intelligence to  target to identify those at risk of containing WMD. When a shipment is  determined to be high risk, CBP officials refer it to host government  officials who determine whether to examine the shipment before it leaves  their seaport for the United States. In most cases, host government  officials honor the U.S. request by examining the referred shipments with  nonintrusive inspection equipment and, if they deem necessary, by  opening the cargo containers to physically search the contents inside.  CBP planned to have a total of 58 seaports by the end of fiscal year 2007.
Our 2003 and 2005 reports on the CSI program found both successes and  challenges faced by CBP in implementing the program. Since our last CSI  report in 2005, CBP has addressed some of the challenges we identified  and has taken steps to improve the CSI program. Specifically, CBP  contributed to the Strategy to Enhance International Supply Chain  Security that DHS issued in July 2007, which addressed a SAFE Port Act  requirement and filled an important gap—between broad national  strategies and program-specific strategies, such as for CSI—in the  strategic framework for maritime security that has evolved since 9/11. In  addition, in 2006 CBP issued a revised CSI strategic plan for 2006 to 2011,  which added three critical elements that we had identified in our April  2005 report as missing from the plan’s previous iteration. In the revised  plan, CBP described how performance goals and measures are related to  CSI objectives, how CBP evaluates CSI program operations, and what  external factors beyond CBP’s control could affect program operations  and outcomes. Also, by expanding CSI operations to 58 seaports by the  end of September 2007, CBP would have met its objective of expanding  CSI locations and program activities. CBP projected that at the end of  fiscal year 2007 between 85 and 87 percent of all U.S.-bound shipments in  containers will pass through CSI ports where the risk level of the  container cargo is assessed and the contents are examined as deemed  necessary.
Although CBP’s goal is to review information about all U.S.-bound  containers at CSI seaports for high-risk contents before the containers  depart for the United States, we reported in 2005 that the agency has not  been able to place enough staff at some CSI ports to do so. Also, the  SAFE Port Act required DHS to develop a human capital management plan  to determine adequate staffing levels in U.S. and CSI ports. CBP has  developed a human capital plan, increased the number of staff at CSI  ports, and provided additional support to the deployed CSI staff by using  staff in the United States to screen containers for various risk factors and  potential inspection. With these additional resources, CBP reports that  manifest data for all US-bound container cargo are reviewed using ATS to  determine whether the container is at high risk of containing WMD.  However, the agency faces challenges in ensuring that optimal numbers of  staff are assigned to CSI ports, in part because of its reliance on placing  staff overseas at CSI ports without systematically determining which  functions could be performed overseas and which could be performed  domestically.
Also, in 2006 CBP improved its methods for conducting on-site evaluations  of CSI ports, in part by requiring CSI teams at the seaports to demonstrate  their proficiency at conducting program activities and by employing  electronic tools designed to assist in the efficient and systematic collection  and analysis of data to help in evaluating the CSI team’s proficiency. In  addition, CBP continued to refine the performance measures it uses to  track the effectiveness of the CSI program by streamlining the number of  measures it uses to six, modifying how one measure is calculated to  address an issue we identified in our April 2005 report, and developing  performance targets for the measures. We are continuing to review these  assessment practices as part of our ongoing review of the CSI program,  and expect to report on the results of this effort shortly.
Similar to our recommendation in a previous CSI report, the SAFE Port  Act called upon DHS to establish minimum technical criteria for the use of  nonintrusive inspection equipment in conjunction with CSI. The act also  directs DHS to require that seaports receiving CSI designation operate  such equipment in accordance with these criteria and with standard  operating procedures developed by DHS. CBP officials stated that their  agency faces challenges in implementing this requirement due to  sovereignty issues and the fact that the agency is not a standard-setting  organization, either for equipment or for inspections processes or for  practices. However, CBP has developed minimum technical standards for  equipment used at domestic ports, and the World Customs Organization  (WCO) had described issues—not standards—to consider when  procuring inspection equipment. Our work suggests that CBP may face  continued challenges establishing equipment standards and monitoring  host government operations, which we are also examining in our ongoing  review of the CSI program.

		C-TPAT Continues to Expand and Mature, but Management Challenges Remain

CBP initiated C-TPAT in November 2001 to complement other maritime  security programs as part of the agency’s layered security strategy. In  October 2006, the SAFE Port Act formalized C-TPAT into law. C-TPAT is a  voluntary program that enables CBP officials to work in partnership with  private companies to review the security of their international supply  chains and improve the security of their shipments to the United States. In  return for committing to improve the security of their shipments by joining  the program, C-TPAT members receive benefits that result in the  likelihood of reduced scrutiny of their shipments, such as a reduced  number of inspections or shorter wait times for their shipments. CBP uses  information about C-TPAT membership to adjust risk-based targeting of  these members shipments in ATS. As of July 2007, CBP had certified more  than 7,000 companies that import goods via cargo containers through U.S.  seaports—which accounted for approximately 45 percent of all U.S.  imports—and validated the security practices of 78 percent of these  certified participants.
We reported on the progress of the C-TPAT program in 2003 and 2005 and  recommended that CBP develop a strategic plan and performance  measures to track the program’s status in meeting its strategic goals. DHS  concurred with these recommendations. The SAFE Port Act also  mandated that CBP develop and implement a 5-year strategic plan with  outcome-based goals and performance measures for C-TPAT. CBP  officials stated that they are in the process of updating their strategic plan  for C-TPAT, which was issued in November 2004, for 2007 to 2012. This  updated plan is being reviewed within CBP, but a time frame for issuing  the plan has not been established. We recommended in our March 2005  report that CBP establish performance measures to track its progress in  meeting the goals and objectives established as part of the strategic  planning process. Although CBP has since put additional performance  measures in place, CBP’s efforts have focused on measures regarding  program participation and facilitating trade and travel. CBP has not yet  developed performance measures for C-TPAT’s efforts aimed at ensuring  improved supply chain security, which is the program’s purpose.
In our previous work, we acknowledged that the C-TPAT program holds  promise as part of a layered maritime security strategy. However, we also  raised a number of concerns about the overall management of the  program. Since our past reports, the C-TPAT program has continued to  mature. The SAFE Port Act mandated that actions—similar to ones we had  recommended in our March 2005 report—be taken to strengthen the  management of the program. For example, the act included a new goal  that CBP make a certification determination within 90 days of CBP’s  receipt of a C-TPAT application, validate C-TPAT members’ security  measures and supply chain security practices within 1 year of their  certification, and revalidate those members no less than once in every  4 years. As we recommended in our March 2005 report, CBP has  developed a human capital plan and implemented a records management  system for documenting key program decisions. CBP has addressed   C-TPAT staffing challenges by increasing the number of supply chain  security specialists from 41 in 2005 to 156 in 2007.
In February 2007, CBP updated its resource needs to reflect SAFE Port Act  requirements, including that certification, validation, and revalidation  processes be conducted within specified time frames. CBP believes that   C-TPAT’s current staff of 156 supply chain security specialists will allow it  to meet the act’s initial validation and revalidation goals for 2007 and 2008.  If an additional 50 specialists authorized by the act are made available by  late 2008, CBP expects to be able to stay within compliance of the act’s  time frame requirements through 2009. In addition, CBP developed and  implemented a centralized electronic records management system to  facilitate information storage and sharing and communication with   C-TPAT partners. This system—known as the C-TPAT Portal—enables  CBP to track and ascertain the status of C-TPAT applicants and partners to  ensure that they are certified, validated, and revalidated within required  time frames. As part of our ongoing work, we are reviewing the data  captured in Portal, including data needed by CBP management to assess  the efficiency of C-TPAT operations and to determine compliance with its  program requirements. These actions—dedicating resources to carry out  certification and validation reviews and putting a system in place to track  the timeliness of these reviews—should help CBP meet several of the  mandates of the SAFE Port Act. We expect to issue a final report early  next year.
Our 2005 report raised concerns about CBP granting benefits  prematurely—before CBP had validated company practices. Instead of  granting new members full benefits without actual verification of their  supply chain security, CBP implemented three tiers to grant companies  graduated benefits based on CBP’s certification and validation of their  security practices. Related to this, the SAFE Port Act codified CBP’s policy  of granting graduated benefits to C-TPAT members. Tier 1 benefits—a  limited reduction in the score assigned in ATS—are granted to companies  upon certification that their written description of their security profile  meets minimum security criteria. Companies whose security practices  CBP validates in an on-site assessment receive Tier 2 benefits that may  include reduced scores in ATS, reduced cargo examinations, and priority  searches of cargo. If CBP’s validation shows sustained commitment by a  company to security practices beyond what is expected, the company  receives Tier 3 benefits. Tier 3 benefits may include expedited cargo  release at U.S. ports at all threat levels, further reduction in cargo  examinations, priority examinations, and participation in joint incident  management exercises.
Our 2005 report also raised concerns about whether the validation process  was rigorous enough. Similarly, the SAFE Port Act mandates that the  validation process be strengthened, including setting a year time frame for  completing validations. CBP initially set a goal of validating all companies  within their first 3 years as C-TPAT members, but the program’s rapid  growth in membership made the goal unachievable. CBP then moved to a  risk-based approach to selecting members for validation, considering  factors such as a company’s having foreign supply chain operations in a  known terrorist area or involving multiple foreign suppliers. CBP further  modified its approach to selecting companies for validation to achieve  greater efficiency by conducting “blitz” operations to validate foreign  elements of multiple members’ supply chains in a single trip. Blitz  operations focus on factors such as C-TPAT members within a certain  industry, supply chains within a certain geographic area, or foreign  suppliers to multiple C-TPAT members. Risks remain a consideration,  according to CBP, but the blitz strategy drives the decision of when a  member company will be validated. In addition to taking these actions to  efficiently conduct validations, CBP has periodically updated the minimum  security requirements that companies must meet to be validated and is  conducting a pilot program of using third-party contractors to conduct  validation assessments. As part of our ongoing work, we are reviewing  these actions, which are required as part of the SAFE Port Act, and other  CBP efforts to enhance its C-TPAT validation process.

		CBP Has Played a Key Role in Promoting Global Customs Security Standards and Initiatives, but Progress with These Efforts Presents New Challenges for CSI and C-TPAT

The CSI and C-TPAT programs have provided a model for global customs  security standards, but as other countries adopt the core principles of CSI  and programs similar to C-TPAT, CBP may face new challenges. Foreign  officials within the WCO and elsewhere have observed the CSI and            C-TPAT programs as potential models for enhancing supply chain security.  Also, CBP has taken a lead role in working with members of the domestic  and international customs and trade community on approaches to  standardizing supply chain security worldwide. As CBP has recognized,  and we have previously reported, in security matters the United States is  not self-contained, in either its problems or its solutions. The growing  interdependence of nations requires policymakers to recognize the need to  work in partnerships across international boundaries to achieve vital  national goals.
For this reason, CBP has committed through its strategic planning process  to develop and promote an international framework of standards  governing customs-to-customs relationships and customs-to-business  relationships in a manner similar to CSI and C-TPAT, respectively. To  achieve this, CBP has worked with foreign customs administrations  through the WCO to establish a framework creating international  standards that provide increased security of the global supply chain while  facilitating international trade. The member countries of the WCO,  including the United States, adopted such a framework, known as the  WCO Framework of Standards to Secure and Facilitate Global Trade and  commonly referred to as the SAFE Framework, in June 2005. The SAFE  Framework internationalizes the core principles of CSI in creating global  standards for customs security practices and promotes international  customs-to-business partnership programs, such as C-TPAT. As of  September 11, 2007, 148 WCO member countries had signed letters of  intent to implement the SAFE Framework. CBP, along with the customs  administrations of other countries and through the WCO, provides  technical assistance and training to those countries that want to  implement the SAFE Framework, but do not yet have the capacity to  do so.
The SAFE Framework enhances the CSI program by promoting the  implementation of CSI-like customs security practices, including the use of  electronic advance information requirements and risk-based targeting, in  both CSI and non-CSI ports worldwide. The framework also lays the  foundation for mutual recognition, an arrangement whereby one country  can attain a certain level of assurance about the customs security  standards and practices and business partnership programs of another  country. In June 2007, CBP entered into the first mutual recognition  arrangement of a business-to-customs partnership program with the New  Zealand Customs Service. This arrangement stipulates that members of  one country’s business-to-customs program be recognized and receive  similar benefits from the customs service of the other country. CBP is  pursuing similar arrangements with Jordan and Japan, and is conducting a  pilot program with the European Commission to test approaches to  achieving mutual recognition and address differences in their respective  programs. However, the specific details of how the participating counties’  customs officials will implement the mutual recognition arrangement— such as what benefits, if any, should be allotted to members of other  countries’ C-TPAT like programs—have yet to be determined. As CBP goes  forward, it may face challenges in defining the future of its CSI and   C-TPAT programs and, more specifically, in managing the implementation  of mutual recognition arrangements, including articulating and agreeing to  the criteria for accepting another country’s program; the specific  arrangements for implementation, including the sharing of information;  and the actions for verification, enforcement; and, if necessary,  termination of the arrangement.

		DNDO Faces Challenges Testing Radiation Detection Equipment

DHS also has container security programs to develop and test equipment  to scan containers for radiation. Its DNDO was originally created in April  2005 by presidential directive, but the office was formally established in  October 2006 by Section 501 of the SAFE Port Act.  DNDO has lead  responsibility for conducting the research, development, testing, and  evaluation of radiation detection equipment that can be used to prevent  nuclear or radiological materials from entering the United States.  DNDO  is charged with devising the layered system of radiation detection  equipment and operating procedures—known as the “global  architecture”—designed to prevent nuclear smuggling at foreign ports, the  nation’s borders, and inside the United States.
Much of DNDO’s work on radiation detection equipment to date has  focused on the development and use of radiation detection portal  monitors, which are larger-scale equipment that can screen vehicles,  people, and cargo entering the United States.  Current portal monitors  detect the presence of radiation but cannot distinguish between benign,  naturally occurring radiological materials such as ceramic tile, and  dangerous materials such as highly enriched uranium.  Since 2005, DNDO  has been testing, developing, and planning to deploy the next generation of  portal monitors, known as “Advanced Spectroscopic Portals” (ASP),  which can not only detect but also identify radiological and nuclear  materials within a shipping container.  In July 2006, DNDO announced that  it had awarded contracts to three vendors to develop and purchase $1.2  billion worth of ASPs over 5 years for deployment at U.S. points of entry.
We have reported a number of times to Congress concerning DNDO’s  execution of the ASP program.  To ensure that DHS's substantial  investment in radiation detection technology yields the greatest possible  level of detection capability at the lowest possible cost, in March 2006 we  recommended that once the costs and capabilities of ASPs were well  understood, and before any of the new equipment was purchased for  deployment, the Secretary of DHS work with the Director of DNDO to  analyze the costs and benefits of deploying ASPs.   Further, we  recommended that this analysis focus on determining whether any  additional detection capability provided by the ASPs was worth the  considerable additional costs.  In response to our recommendation, DNDO  issued its cost-benefit analysis in May 2006 and an updated, revised  version in June 2006.  According to senior agency officials, DNDO  believes that the basic conclusions of its cost-benefit analysis showed that  the new ASP monitors are a sound investment for the U.S. government.
However, in October 2006, we concluded that DNDO’s cost-benefit  analysis did not provide a sound basis for DNDO’s decision to purchase  and deploy ASP technology because it relied on assumptions of the  anticipated performance level of ASPs instead of actual test data and that  it did not justify DHS’s planned $1.2 billion expenditure.  We also  reported that DNDO did not assess the likelihood that ASPs would either  misidentify or fail to detect nuclear or radiological material.  Rather, it  focused its analysis on reducing the time necessary to screen traffic at  border check points and reduce the impact of any delays on commerce.   We recommended that DNDO conduct further testing of ASPs and the  currently deployed portal monitors before spending additional funds to  purchase ASPs. DNDO conducted this testing of ASPs at the Nevada test  site during February and March 2007.
In September 2007, we testified on these tests, stating that, in our view,  DNDO used biased test methods that enhanced the performance of the  ASPs.  In particular, DNDO conducted preliminary runs of almost all the  materials and combination of materials that it used in the formal tests and  then allowed ASP contractors to collect test data and adjust their systems  to identify these materials.  In addition, DNDO did not attempt in its tests  to identify the limitations of ASPs—a critical oversight in its test plan.   Specifically, the materials that DNDO included in its test plan did not emit  enough radiation to hide or mask the presence of nuclear materials  located within a shipping container.  Finally, in its tests of the existing  radiation detection system, DNDO did not include a critical standard  operating procedure that officers with CBP use to improve the system’s  effectiveness.
It is important to note that, during the course of our work, CBP, DOE, and  national laboratory officials we spoke to voiced concern about their lack  of involvement in the planning and execution of the Nevada test site tests.   For example, DOE officials told us that they informed DNDO in November  2006 of their concerns that the materials DNDO planned to use in its tests  were too weak to effectively mask the presence of nuclear materials in a  container.  DNDO officials rejected DOE officials’ suggestion to use  stronger materials in the tests because, according to DNDO, there would  be insufficient time to obtain these materials and still obtain the DHS  Secretary’s approval for full-scale production of ASPs by DNDO’s self- imposed deadline of June 26, 2007.  Although DNDO has agreed to perform  computer simulations to address this issue, the DNDO Director would not  commit at the September testimony to delaying full-scale ASP production  until all the test results were in.

		DOE Continues to Expand Its Megaports Program

The Megaports Initiative, initiated by DOE’s National Nuclear Security  Administration in 2003, represents another component in the efforts to  prevent terrorists from smuggling WMD in cargo containers from overseas  locations. The goal of this initiative is to enable foreign government  personnel at key foreign seaports to use radiation detection equipment to  screen shipping containers entering and leaving these ports, regardless of  the containers’ destination, for nuclear and other radioactive material that  could be used against the United States or its allies. DOE installs radiation  detection equipment, such as radiation portal monitors and handheld  radioactive isotope identification devices, at foreign seaports that is then  operated by foreign government officials and port personnel working at  these ports.
Through August 2007, DOE had completed installation of radiation  detection equipment at eight ports: Rotterdam, the Netherlands; Piraeus,  Greece; Colombo, Sri Lanka; Algeciras, Spain; Singapore; Freeport,  Bahamas; Manila, Philippines; and Antwerp, Belgium (Phase I).  Operational testing is under way at four additional ports: Antwerp,  Belgium (Phase II); Puerto Cortes, Honduras; Qasim, Pakistan; and Laem  Chabang, Thailand. Additionally, DOE has signed agreements to begin  work and is in various stages of implementation at ports in 12 other  countries, including the United Kingdom, United Arab Emirates/Dubai,  Oman, Israel, South Korea, China, Egypt, Jamaica, the Dominican  Republic, Colombia, Panama, and Mexico, as well as Taiwan and Hong  Kong. Several of these ports are also part of the Secure Freight Initiative,  discussed in the next section. Further, in an effort to expand cooperation,  DOE is engaged in negotiations with approximately 20 additional countries  in Europe, Asia, the Middle East, and Latin America.
DOE had made limited progress in gaining agreements to install radiation  detection equipment at the highest priority seaports when we reported on  this program in March 2005. Then, the agency had completed work at  only two ports and signed agreements to initiate work at five others. We  also noted that DOE’s cost projections for the program were uncertain, in  part because they were based on DOE’s $15 million estimate for the  average cost per port. This per port cost estimate may not be accurate  because it was based primarily on DOE’s radiation detection assistance  work at Russian land borders, airports, and seaports and did not account  for the fact that the costs of installing equipment at individual ports vary  and are influenced by factors such as a port’s size, physical layout, and  existing infrastructure. Since our review, DOE has developed a strategic  plan for the Megaports Initiative and revised it’s per port estimates to  reflect port size, with per port estimates ranging from $2.6 million to  $30.4 million.
As we earlier reported, DOE faces several operational and technical  challenges specific to installing and maintaining radiation detection  equipment at foreign ports as the agency continues to implement its  Megaports Initiative. These challenges include ensuring the ability to  detect radioactive material, overcoming the physical layout of ports and  cargo-stacking configurations, and sustaining equipment in port  environments with high winds and sea spray.

		Secure Freight Initiative Testing Feasibility of Combining Scanning Technologies

The SAFE Port Act required that a pilot program—known as the Secure  Freight Initiative (SFI)—be conducted to determine the feasibility of  100 percent scanning of U.S.-bound containers. To fulfill this requirement,  CBP and DOE jointly announced the formation of SFI in December 2006,  as an effort to build upon existing port security measures by enhancing the  U.S. government’s ability to scan containers for nuclear and radiological  materials overseas and better assess the risk of inbound containers. In  essence, SFI builds upon the CSI and Megaports programs. The SAFE Port  Act specified that new integrated scanning systems that couple  nonintrusive imaging equipment and radiation detection equipment must  be pilot-tested. It also required that, once fully implemented, the pilot  integrated scanning system scan 100 percent of containers destined for the  United States that are loaded at pilot program ports.
According to agency officials, the initial phase of the initiative will involve  the deployment of a combination of existing container scanning  technology—such as X-ray and gamma ray scanners used by host nations  at CSI ports to locate high-density objects that could be used to shield  nuclear materials inside containers—and radiation detection equipment.  The ports chosen to receive this integrated technology are: Port Qasim in  Pakistan, Puerto Cortes in Honduras, and Southampton in the United  Kingdom. Four other ports located in Hong Kong, Singapore, South Korea,  and Oman will receive more limited deployment of these technologies as  part of the pilot program. According to CBP, containers from these ports  will be scanned for radiation and other risk factors before they are  allowed to depart for the United States. If the scanning systems indicate  that there is a concern, both CSI personnel and host country officials will  simultaneously receive an alert and the specific container will be  inspected before that container continues to the United States. CBP  officials, either on the scene locally or at CBP’s National Targeting Center,  will determine which containers are inspected.
Per the SAFE Port Act, CBP is to report by April 2008 on, among other  things, the lessons learned from the SFI pilot ports and the need for and  the feasibility of expanding the system to other CSI ports. Every 6 months  thereafter, CBP is to report on the status of full-scale deployment of the  integrated scanning systems to scan all containers bound for the United  States before their arrival.

		New Requirement for 100 Percent Scanning Introduces New Challenges

Recent legislative actions have updated U.S. maritime security  requirements and may affect overall international maritime security  strategy. In particular, the recently enacted Implementing  Recommendations of the 9/11 Commission Act (9/11 Act) requires, by  2012, 100 percent scanning of U.S.-bound cargo containers using  nonintrusive imaging equipment and radiation detection equipment at  foreign seaports. The act also specifies conditions for potential extensions  beyond 2012 if a seaport cannot meet that deadline. Additionally, it  requires the Secretary of DHS to develop technological and operational  standards for scanning systems used to conduct 100 percent scanning at  foreign seaports. The Secretary also is required to ensure that actions  taken under the act do not violate international trade obligations and are  consistent with the WCO SAFE Framework. The 9/11 Act provision  replaces the requirement of the SAFE Port Act that called for 100 percent  scanning of cargo containers before their arrival in the United States, but  required implementation as soon as possible rather than specifying a  deadline. While we have not yet reviewed the implementation of the  100 percent scanning requirement, we have a number of preliminary  observations based on field visits of foreign ports regarding potential  challenges CBP may face in implementing this requirement:    CBP may face challenges balancing new requirement with  current international risk management approach. CBP may have  difficulty requiring 100 percent scanning while also maintaining a risk- based security approach that has been developed with many of its  international partners. Currently, under the CSI program, CBP uses  automated targeting tools to identify containers that pose a risk for  terrorism for further inspection before being placed on vessels bound  for the United States. As we have previously reported, using risk  management allows for reduction of risk against possible terrorist  attack on the nation given resources allocated and is an approach that  has been accepted governmentwide. Furthermore, many U.S. and  international customs officials we have spoken to, including officials  from the World Customs Organization, have stated that the 100 percent  scanning requirement is contrary to the SAFE Framework developed  and implemented by the international customs community, including  CBP. The SAFE Framework, based on CSI and C-TPAT, calls for a risk  management approach, whereas the 9/11 Act calls for the scanning of  all containers regardless of risk.
United States may not be able to reciprocate if other countries  request it. The CSI program, whereby CBP officers are placed at  foreign seaports to target cargo bound for the United States, is based  on a series of bilateral, reciprocal agreements with foreign  governments. These reciprocal agreements also allow foreign  governments the opportunity to place customs officials at U.S. seaports  and request inspection of cargo containers departing from the United  States and bound for their home country. Currently, customs officials  from certain countries are stationed at domestic seaports, and agency  officials have told us that CBP has inspected 100 percent of containers  that these officials have requested for inspection. According to CBP  officials, the SFI pilot, as an extension of the CSI program, allows  foreign officials to ask the United States to reciprocate and scan  100 percent of cargo containers bound for those countries. Although  the act establishing the 100 percent scanning requirement does not  mention reciprocity, CBP officials have told us that the agency does not  have the capacity to reciprocate should it be requested to do so, as  other government officials have indicated they might when this  provision of the 9/11 Act is in place.
Logistical feasibility is unknown and may vary by port. Many  ports may lack the space necessary to install additional equipment  needed to comply with the requirement to scan 100 percent of U.S.  bound containers. Additionally, we observed that scanning equipment  at some seaports is located several miles away from where cargo  containers are stored, which may make it time consuming and costly to  transport these containers for scanning. Similarly, some seaports are  configured in such a way that there are no natural bottlenecks that  would allow for equipment to be placed such that all outgoing  containers can be scanned and the potential to allow containers to slip  by without scanning may be possible. Transshipment cargo  containers—containers moved from one vessel to another—are only  available for scanning for a short period of time and may be difficult to  access. Similarly, it may be difficult to scan cargo containers that  remain on board a vessel as it passes through a foreign seaport. CBP  officials told us that currently containers such as these that are  designated as high-risk at CSI ports are not scanned unless specific  threat information is available regarding the cargo in that particular  container.
Technological maturity is unknown. Integrated scanning  technologies to test the feasibility of scanning 100 percent of U.S.  bound cargo containers are not yet operational at all seaports  participating in the pilot program, known as SFI. The SAFE Port Act  requires CBP to produce a report regarding the program, which will  include an evaluation of the effectiveness of scanning equipment at the  SFI ports. However, this report will not be due until April 2008.  Moreover, agency officials have stated that the amount of bandwidth  necessary to transmit scanning equipment outputs to CBP officers for  review exceeds what is currently feasible and that the electronic  infrastructure necessary to transmit these outputs may be limited at  some foreign seaports. Additionally, there are currently no  international standards for the technical capabilities of inspection  equipment. Agency officials have stated that CBP is not a standard  setting organization and has limited authority to implement standards  for sovereign foreign governments.
Resource responsibilities have not been determined. The 9/11 Act  does not specify who would pay for additional scanning equipment,  personnel, computer systems, or infrastructure necessary to establish  100 percent scanning of U.S.-bound cargo containers at foreign ports.  According to the Congressional Budget Office (CBO) in its analysis of  estimates for implementing this requirement, this provision would  neither require nor prohibit the U.S. federal government from bearing  the cost of conducting scans. For the purposes of its analysis, CBO  assumed that the cost of acquiring, installing, and maintaining systems  necessary to comply with the 100 percent scanning requirement would  be borne by foreign ports to maintain trade with the United States.  However, foreign government officials we have spoken to expressed  concerns regarding the cost of equipment. They also stated that the  process for procuring scanning equipment may take years and can be  difficult when trying to comply with changing U.S. requirements. These  officials also expressed concern regarding the cost of additional  personnel necessary to (1) operate new scanning equipment, (2) view  scanned images and transmit them to the United States, and (3) resolve  false alarms. An official from one country with whom we met told us  that while his country does not scan 100 percent of exports,  modernizing its customs service to focus more on exports required a  50 percent increase in personnel, and other countries trying to  implement the 100 percent scanning requirement would likely have to  increase the size of their customs administrations by at least as much.
Use and ownership of data have not been determined. The 9/11  Act does not specify who will be responsible for managing the data  collected through 100 percent scanning of U.S.-bound containers at  foreign seaports. However, the SAFE Port Act specifies that scanning  equipment outputs from SFI will be available for review by U.S.  government officials either at the foreign seaport or in the United  States. It is not clear who would be responsible for collecting,  maintaining, disseminating, viewing or analyzing scanning equipment  outputs under the new requirement. Other questions to be resolved  include ownership of data, how proprietary information would be  treated, and how privacy concerns would be addressed.
CBP officials have indicated they are aware that challenges exist. They  also stated that the SFI will allow the agency to determine whether these  challenges can be overcome. According to senior officials from CBP and  international organizations we contacted, 100 percent scanning of  containers may divert resources, causing containers that are truly high risk  to not receive adequate scrutiny due to the sheer volume of scanning  outputs that must be analyzed. These officials also expressed concerns  that 100 percent scanning of U.S.-bound containers could hinder trade,  leading to long lines and burdens on staff responsible for viewing images.  However, given that the SFI pilot program has only recently begun, it is  too soon to determine how the 100 percent scanning requirement will be  implemented and its overall impact on security.

	Agency Comments

We provided a draft of the information in this testimony to DHS. DHS  provided technical comments, which we incorporated as appropriate.
Madam Chairwoman and members of the subcommittee, this completes  my prepared statement. I will be happy to respond to any questions that  you or other members of the subcommittee have at this time.

	GAO Contact and Staff Acknowledgments

For information about this testimony, please contact Stephen L. Caldwell,  Director, Homeland Security and Justice Issues, at (202) 512-9610, or  caldwells@gao.gov. Contact points for our Office of Congressional  Relations and Public Affairs may be found on the last page of this  statement. Individuals making key contributions to this testimony include  Richard Ascarate, Jonathan Bachman, Jason Bair, Fredrick Berry,  Christine Broderick, Stockton Butler, Steven Calvo, Frances Cook,  Christopher Currie, Anthony DeFrank, Wayne Ekblad, Christine Fossett,  Nkenge Gibson, Geoffrey Hamilton, Christopher Hatscher, Virginia  Hughes, Valerie Kasindi, Monica Kelly, Ryan Lambert, Nicholas Larson,  Daniel Klabunde, Matthew Lee, Gary Malavenda, Robert Rivas, Leslie  Sarapu, James Shafer, Kate Siggerud, Daren Sweeney, and April  Thompson.

GAO Related Products

Maritime Security: One Year Later: A Progress Report on the SAFE Port  Act.  GAO-08-171T.  Washington, D.C.: October 16, 2007.
Maritime Security: The SAFE Port Act and Efforts to Secure Our  Nation’s Seaports.  GAO-08-86T.  Washington, D.C.: October 4, 2007.
Homeland Security: Preliminary Information on Federal Actions to  Address Challenges Faced by State and Local Information Fusion  Centers.  GAO-07-1241T.  Washington, D.C.: September 27, 2007.
Combating Nuclear Smuggling: Additional Actions Needed to Ensure  Adequate Testing of Next Generation of Radiation Detection Equipment.  GAO-07-1247T. Washington, D.C.: September 18, 2007.
Department of Homeland Security: Progress Report on Implementation  of Mission and Management Functions. GAO-07-1240T. Washington,  D.C.: September 18, 2007.
Department of Homeland Security: Progress Report on Implementation  of Mission and Management Functions. GAO-07-1081T. Washington,  D.C.: September 6, 2007.
Department of Homeland Security: Progress Report on Implementation  of Mission and Management Functions. GAO-07-454. Washington, D.C.:  August 17, 2007.
Homeland Security: Observations on DHS and FEMA Efforts to Prepare  for and Respond to Major and Catastrophic Disasters and Address  Related Recommendations and Legislation. GAO-07-1142T. Washington,  D.C.: July 31, 2007.
Information on Port Security in the Caribbean Basin. GAO-07-804R.  Washington, D.C.: June 29, 2007.
Department of Homeland Security: Science and Technology Directorate’s  Expenditure Plan. GAO-07-868. Washington, D.C.: June 22, 2007.
Homeland Security: Guidance from Operations Directorate Will  Enhance Collaboration among Departmental Operations Centers.   GAO-07-683T. Washington, D.C.: June 20, 2007.
Department of Homeland Security: Progress and Challenges in  Implementing the Department’s Acquisition Oversight Plan. GAO-07-900.  Washington, D.C.: June 13, 2007.
Department of Homeland Security: Ongoing Challenges in Creating an  Effective Acquisition Organization. GAO-07-948T. Washington, D.C.:  June 7, 2007.
Homeland Security: Observations on DHS and FEMA Efforts to Prepare  for and Respond to Major and Catastrophic Disasters and Address  Related Recommendations and Legislation. GAO-07-835T. Washington,  D.C.: May 15, 2007.
Homeland Security: Management and Programmatic Challenges Facing  the Department of Homeland Security. GAO-07-833T. Washington, D.C.:  May 10, 2007.
Maritime Security: Observations on Selected Aspects of the SAFE Port  Act. GAO-07-754T. Washington, D.C.: April 26, 2007.
Transportation Security: DHS Efforts to Eliminate Redundant  Background Check Investigations.  GAO-07-756. Washington, D.C.: April  26, 2007.
International Trade: Persistent Weaknesses in the In-Bond Cargo System  Impede Customs and Border Protection’s Ability to Address Revenue,  Trade, and Security Concerns. GAO-07-561. Washington, D.C.: April 17,  2007.
Transportation Security: TSA Has Made Progress in Implementing the  Transportation Worker Identification Credential Program, but  Challenges Remain. GAO-07-681T. Washington, D.C.: April 12, 2007.
Customs Revenue: Customs and Border Protection Needs to Improve  Workforce Planning and Accountability. GAO-07-529. Washington, D.C.:  April 12, 2007.
Port Risk Management: Additional Federal Guidance Would Aid Ports in  Disaster Planning and Recovery. GAO-07-412. Washington, D.C.: March  28, 2007.
Combating Nuclear Smuggling: DNDO Has Not Yet Collected Most of the  National Laboratories’ Test Results on Radiation Portal Monitors in  Support of DNDO’s Testing and Development Programs. GAO-07-347R.   Washington, D.C.: March 9, 2007.
Combating Nuclear Smuggling: DHS’s Cost-Benefit Analysis to Support  the Purchase of New Radiation Detection Portal Monitors Was Not Based  on Available Performance Data and Did Not Fully Evaluate All the  Monitors’ Costs and Benefits. GAO-07-133R.  Washington, D.C.: October  17, 2006.
Transportation Security: DHS Should Address Key Challenges before  Implementing the Transportation Worker Identification Credential  Program. GAO-06-982. Washington, D.C.: September 29, 2006.
Maritime Security: Information-Sharing Efforts Are Improving.   GAO-06-933T. Washington, D.C.: July 10, 2006.
Cargo Container Inspections: Preliminary Observations on the Status of  Efforts to Improve the Automated Targeting System. GAO-06-591T.  Washington, D.C.: March 30, 2006.
Combating Nuclear Smuggling: DHS Made Progress Deploying  Radiation Detection Equipment at U.S. Ports of Entry, but Concerns  Remain.  GAO-06-389. Washington: D.C.: March 22, 2006.
Managing for Results: Enhancing Agency Use of Performance  Information for Management Decision Making. GAO-05-927. Washington,  D.C.: September 9, 2005.
Combating Nuclear Smuggling: Efforts to Deploy Radiation Detection  Equipment in the United States and in Other Countries. GAO-05-840T.  Washington, D.C.: June 21, 2005.
Container Security: A Flexible Staffing Model and Minimum Equipment  Requirements Would Improve Overseas Targeting and Inspection  Efforts. GAO-05-557. Washington, D.C.: April 26, 2005.
Homeland Security: Key Cargo Security Programs Can Be Improved.  GAO-05-466T. Washington, D.C.: May 26, 2005.
Maritime Security: Enhancements Made, but Implementation and  Sustainability Remain Key Challenges. GAO-05-448T. Washington, D.C.:  May 17, 2005.
Cargo Security: Partnership Program Grants Importers Reduced  Scrutiny with Limited Assurance of Improved Security. GAO-05-404.  Washington, D.C.: March 11, 2005.
Maritime Security: New Structures Have Improved Information  Sharing, but Security Clearance Processing Requires Further Attention.  GAO-05-394. Washington, D.C.: April 15, 2005.
Preventing Nuclear Smuggling: DOE Has Made Limited Progress in  Installing Radiation Detection Equipment at Highest Priority Foreign  Seaports. GAO-05-375. Washington, D.C.: March 30, 2005.
Protection of Chemical and Water Infrastructure: Federal Requirements,  Actions of Selected Facilities, and Remaining Challenges. GAO-05-327.  Washington, D.C.: March 2005.
Homeland Security: Process for Reporting Lessons Learned from Seaport  Exercises Needs Further Attention. GAO-05-170. Washington, D.C.:  January 14, 2005.
Port Security: Better Planning Needed to Develop and Operate Maritime  Worker Identification Card Program. GAO-05-106. Washington, D.C.:  December 2004.
Maritime Security: Substantial Work Remains to Translate New  Planning Requirements into Effective Port Security. GAO-04-838.  Washington, D.C.: June 2004.
Homeland Security: Summary of Challenges Faced in Targeting  Oceangoing Cargo Containers for Inspection. GAO-04-557T. Washington,  D.C.: March 31, 2004.
Container Security: Expansion of Key Customs Programs Will Require  Greater Attention to Critical Success Factors. GAO-03-770. Washington,  D.C.: July 25, 2003.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

Because the safety and economic security of the United States depend in substantial part on the security of its 361 seaports, the United States has a vital national interest in maritime security. The Security and Accountability for Every Port Act (SAFE Port Act), modified existing legislation and created and codified new programs related to maritime security. The Department of Homeland Security (DHS) and its U.S. Coast Guard, Transportation Security Administration, and U.S. Customs and Border Protection have key maritime security responsibilities. This testimony synthesizes the results of GAO's completed work and preliminary observations from GAO's ongoing work related to the SAFE Port Act pertaining to (1) overall port security, (2) security at individual facilities, and (3) cargo container security. To perform this work GAO visited domestic and overseas ports; reviewed agency program documents, port security plans, and post-exercise reports; and interviewed officials from the federal, state, local, private, and international sectors.

What GAO Found

Federal agencies have improved overall port security efforts by establishing committees to share information with local port stakeholders, taking steps to establish interagency operations centers to monitor port activities, conducting operations such as harbor patrols and vessel escorts, writing port-level plans to prevent and respond to terrorist attacks, testing such plans through exercises, and assessing the security at foreign ports. However, these agencies face resource constraints and other challenges trying to meet the SAFE Port Act's requirements to expand these activities. For example, the Coast Guard faces budget constraints in trying to expand its current command centers and include other agencies at the centers. Similarly, private facilities and federal agencies have taken action to improve security at about 3,000 individual facilities by writing facility-specific security plans, inspecting facilities to determine compliance with their plans, and developing special identification cards for workers to help prevent terrorists from getting access to secure areas. Federal agencies face challenges trying to meet the act's requirements to expand the scope or speed the implementation of such activities. For example, the Transportation Security Administration missed the act's deadline to implement the identification card program at 10 selected ports because of delays in testing equipment and procedures. Federal programs related to the security of cargo containers have also improved as agencies are enhancing systems to identify high-risk cargo, expanding partnerships with other countries to screen containers before they depart for the United States, and working with international organizations to develop a global framework for container security. Federal agencies face challenges implementing container security aspects of the SAFE Port Act and other legislation. For example, Customs and Border Protection must test and implement a new program to scan 100 percent of all incoming containers overseas--a departure from its existing risk-based programs.