```

[Senate Hearing 112-164]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 112-164

                     ARE OUR NATION'S PORTS SECURE?
 EXAMINING THE TRANSPORTATION WORKER IDENTIFICATION CREDENTIAL PROGRAM

=======================================================================

                                HEARING

                               before the

                         COMMITTEE ON COMMERCE,
                      SCIENCE, AND TRANSPORTATION
                          UNITED STATES SENATE

                      ONE HUNDRED TWELFTH CONGRESS

                             FIRST SESSION

                               __________

                              MAY 10, 2011

                               __________

    Printed for the use of the Committee on Commerce, Science, and 
                             Transportation

                                _____

                  U.S. GOVERNMENT PRINTING OFFICE
71-433 PDF                WASHINGTON : 2011
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

       SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION

                      ONE HUNDRED TWELFTH CONGRESS

                             FIRST SESSION

            JOHN D. ROCKEFELLER IV, West Virginia, Chairman
DANIEL K. INOUYE, Hawaii             KAY BAILEY HUTCHISON, Texas, 
JOHN F. KERRY, Massachusetts             Ranking
BARBARA BOXER, California            OLYMPIA J. SNOWE, Maine
BILL NELSON, Florida                 JIM DeMINT, South Carolina
MARIA CANTWELL, Washington           JOHN THUNE, South Dakota
FRANK R. LAUTENBERG, New Jersey      ROGER F. WICKER, Mississippi
MARK PRYOR, Arkansas                 JOHNNY ISAKSON, Georgia
CLAIRE McCASKILL, Missouri           ROY BLUNT, Missouri
AMY KLOBUCHAR, Minnesota             JOHN BOOZMAN, Arkansas
TOM UDALL, New Mexico                PATRICK J. TOOMEY, Pennsylvania
MARK WARNER, Virginia                MARCO RUBIO, Florida
MARK BEGICH, Alaska                  KELLY AYOTTE, New Hampshire
                    Ellen L. Doneski, Staff Director
                   James Reid, Deputy Staff Director
                   Bruce H. Andrews, General Counsel
   Brian M. Hendricks, Republican Staff Director and General Counsel
            Todd Bertoson, Republican Deputy Staff Director
                Rebecca Seidel, Republican Chief Counsel

                            C O N T E N T S

                              ----------                              
                                                                   Page
Hearing held on May 10, 2011.....................................     1
Statement of Senator Lautenberg..................................     1
Statement of Senator Ayotte......................................     6
Statement of Senator Klobuchar...................................     7
Statement of Senator Boozman.....................................     7
    Prepared statement...........................................     7
Statement of Senator Begich......................................    55
Statement of Senator Wicker......................................    57
Statement of Senator Snowe.......................................    59
    Prepared statement...........................................    62

                               Witnesses

Hon. John L. Mica, Chairman, Committee on Transportation and 
  Infrastructure, U.S. House of Representatives..................     1
    Prepared statement...........................................     3
Hon. John S. Pistole, Administrator, Transportation Security 
  Administration, U.S. Department of Homeland Security...........     8
    Prepared statement...........................................    10
Rear Admiral Kevin S. Cook, Director of Prevention Policy, U.S. 
  Coast Guard....................................................    11
    Prepared statement...........................................    13
Stephen M. Lord, Director, Homeland Security and Justice Issues, 
  U.S. Government Accountability Office..........................    16
    Prepared statement...........................................    17

                                Appendix

Response to written questions submitted to Hon. John S. Pistole 
  by:
    Hon. Bill Nelson.............................................    71
    Hon. Frank R. Lautenberg.....................................    73
    Hon. Jim DeMint..............................................    75
    Hon. Roger F. Wicker.........................................    77
Response to written questions submitted by Hon. Frank R. 
  Lautenberg to Rear Admiral Kevin Cook..........................    79
Letter dated July 6, 2011 to Hon. Frank R. Lautenberg and Hon. 
  Bill Nelson from Stephen M. Lord, Director, Homeland Security 
  and Justice Issues, U.S. Government Accountability Office......    80

 
                     ARE OUR NATION'S PORTS SECURE?
 EXAMINING THE TRANSPORTATION WORKER IDENTIFICATION CREDENTIAL PROGRAM

                              ----------                              

                         TUESDAY, MAY 10, 2011

                                       U.S. Senate,
        Committee on Commerce, Science, and Transportation,
                                                    Washington, DC.
    The committee met, pursuant to notice, at 2:30 p.m. in room 
SR-253, Russell Senate Office Building, Hon. Frank R. 
Lautenberg, presiding.

        OPENING STATEMENT OF HON. FRANK R. LAUTENBERG, 
                  U.S. SENATOR FROM NEW JERSEY

    Senator Lautenberg. I'm pleased to open this hearing of the 
Committee on Commerce, Science, and Transportation. We've got 
important subjects at hand here.
    And we are pleased to see our colleague from the House of 
Representatives, The Honorable John Mica, who is the Chairman 
of the Committee of Jurisdiction on the House side.
    And, Mr. Mica, we welcome you. And we ask you to give your 
testimony. It's customary to have a 5-minute period for 
presentation, but if there is a need to extend it, please don't 
be unwilling to ask for it. And we'll start the clock, please, 
at the 5-minute level.
    Thank you.
    And, Mr. Mica, the table--the microphone is yours, sir.

    STATEMENT OF HON. JOHN L. MICA, CHAIRMAN, COMMITTEE ON 
       TRANSPORTATION AND INFRASTRUCTURE, U.S. HOUSE OF 
                        REPRESENTATIVES

    Mr. Mica. Well, thank you. And I'm pleased to be on the 
Senate side this afternoon, and also to work jointly with your 
committee.
    And actually, I'm here today because I think the subject 
before you is--well, the title is, ``Are Our Nation's Ports 
Secure? Examining the Transportation Worker Identification 
Credential Program.'' And I think also you're going to focus on 
a GAO report that I had the opportunity to be a co-requester 
with members of this important Senate committee. So, I will try 
to talk about both the GAO report and also the issue at hand of 
credentialing our transportation workers.
    I've submitted a full statement for the record, and I'll 
just give some comments here.
    As you know, Mr. Chairman and other members, for nearly a 
decade now the federal government has struggled to produce a 
transportation worker identification credential. We've tried to 
produce a credential for airport and transportation workers. 
We've attempted to produce a pilot's license. And we've also 
attempted to produce a frequent airline traveler identification 
card. After spending years and nearly half a billion dollars, 
we have, unfortunately, missed the mark. We've spent nearly 
half a billion dollars, and unfortunately, we do not have a 
TWIC card that provides secure identification, as you'll hear 
from GAO today, and also that your committee staff has revealed 
in their report.
    I read your committee report. Being a former Senate 
staffer, I want to thank them. They did some excellent work. 
The report--the key findings are summarized very clearly--it 
says, ``GAO investigators were able to access secure 
facilities''--this is using TWIC cards or fraudulent cards--
they ``were able to access secure facilities at U.S. ports 
during covert tests in which they presented either counterfeit 
TWIC cards, authentic TWIC cards obtained through fraudulent 
means, or falsified reasons for requesting access to the 
security.'' Then they also summarized and said, the--``DHS has 
not adequately assessed the effectiveness of the TWIC Program, 
nor has DHS demonstrated that the current TWIC Program enhances 
port and facility security better than what we've had in the 
past.''
    One other key finding is the GAO--in the GAO report, that 
you cite in your report, is that TSA does not have clear 
criteria for applying discretionary authority to applicants who 
have past criminal convictions.
    These are just the highlights of some of the findings, not 
that I came up with, but that your staff recited from the GAO 
report.
    As Chair of the House Aviation Subcommittee, I helped to 
launch--work with many members on this side--the Transportation 
Security Administration, some years ago, in 2001. Even in that 
first measure, Congress recognized and requested development of 
a secure ID for transportation workers. In 2004, I helped pass 
legislation to require the FAA to replace a paper pilot 
identification card. And we put in the law that we required a 
durable, biometrically-enabled license that also had a 
photograph of the pilot on the--this durable new identification 
license.
    After spending billions--I'm sorry--after--I get used to 
billions today--but, after spending millions, FAA produced a 
license that was durable. However, it didn't have a biometric 
means. And I know there'll be a call today for having some 
unification of these different licenses and IDs, and what 
components they'd have. But, they finally produced, again, a 
card, at millions of dollars, that does not have a biometric 
measure and code--and coding capability. And the only pilots 
that appear on the document, on the license, are Wilbur and 
Orville Wright. I don't know if you've seen this, but this is--
turn the--show them Wilbur and Orville Wright, there. So, 
there's--we spent millions of dollars, we produced this 
license, and it actually is not acceptable with TSA, as an ID. 
It doesn't have a--even a photo of the pilot on it.
    When you talk to FAA about this, they point to Homeland 
Security, and then they point to TSA, for trying to get 
directions.
    So, after spending hundreds of millions of dollars on a 
TWIC card, now we find, this report says, that it can easily 
fraudulently be used.
    We still lack deployment of readers. We've issued about 1.7 
million of these cards, but we don't have a reader. The TWIC 
card does have biometric measures for fingerprint. Iris is on 
its way, we're told. It has a photo. But, we don't have a 
reader capable of confirming the identification of the person 
using the card, and knowing that, in fact, is the same person 
that's on the ID, or carrying the ID.
    With--right now, the U.S. House and also your help in the 
Senate--and this is a very important hearing because I'm hoping 
this will help prod the agencies to soon have a TWIC card with 
full biometric fingerprint and iris capability, and also 
readers capable of a reliable confirmation. However, even with 
that equipment and with that new capability, it will not 
address some of the fraudulent issues that are uncovered by 
GAO.
    So, I'm pleased to come----
    Senator Lautenberg. Mr. Mica, we will put your full 
statement into the record. I made a slight error when I invited 
you to go first without making my own statement. So, we listen 
with interest, have heard your public comments about how you 
saw things, in your testimony, here today. So, I am going to 
make my statement. And if you need a minute more, I'm happy to 
give it to you.
    Mr. Mica. Thank you. I'd like to hear your statement. Thank 
you.
    [The prepared statement of Mr. Mica follows:]

    Prepared Statement of Hon. John L. Mica, Chairman, Committee on 
    Transportation and Infrastructure, U.S. House of Representatives
    Mr. Chairman, Ranking Member Hutchinson, and members of the 
Committee, thank you for the opportunity to testify before you today on 
the progress, or lack thereof, of the Transportation Worker 
Identification Credential--or ``TWIC''--Program. It is a privilege to 
appear before you, and I thank you for your continued and vigilant 
oversight on this important issue.
    As you may know, I am one of the co-requestors of the Government 
Accountability Office (GAO) report that I believe this Committee will 
release today on the weaknesses of the TWIC Program. As Chairman of the 
Transportation and Infrastructure Committee in the House of 
Representatives, I can attest that the Members of my Committee are 
committed to ensuring the security of the transportation workers and 
transportation infrastructure they oversee as part of their role on the 
Committee. As an original author of the legislation that created the 
Transportation Security Administration (TSA) after 9/11, I also feel a 
personal sense of obligation to ensure that this important piece of our 
nation's defense apparatus is operating as the efficient and effective 
security agency it was intended to be.
Government Coordination on Transportation Security
    In the wake of 9/11, the federal government realized how disastrous 
storing information in government silos could be. Information-sharing 
became a top priority and the administration directed departments and 
agencies to work together to ensure all relevant information is on the 
table at all times. During this time, the TSA was transferred from the 
Department of Transportation (DOT) to the newly-created Department of 
Homeland (DHS).
    Homeland Security Presidential Directive-7 directed DHS and DOT to 
``collaborate on all matters relating to transportation security and 
transportation infrastructure protection.'' \1\ In 2004, the two 
Departments entered into a Memorandum of Understanding and jointly 
expressed a desire for a ``strong partnership in order to reduce the 
vulnerability of transportation passengers, employees, and systems to 
terrorism and other disruptions.'' \2\ Each department would have 
regulatory responsibilities in the area of transportation security, and 
would communicate and cooperate on funding for transportation security 
projects.
---------------------------------------------------------------------------
    \1\ ``Homeland Security Presidential Directive-7: Critical 
Infrastructure Identification, Prioritization, and Protection,'' The 
White House. December 17, 2003.
    \2\ ``Memorandum of Understanding between the Department of 
Homeland Security and the Department of Transportation on Roles and 
Responsibilities.'' September 28, 2004.
---------------------------------------------------------------------------
    As evidence of this partnership, TSA officials have appeared before 
the Transportation and Infrastructure Committee more than a dozen times 
since the agency was transferred to DHS at the end of 2002. In January 
2008, former-TWIC Program Director Maurine Fanguy provided an update to 
the Committee on the TWIC Program.
    So you will understand my surprise when TSA Administrator Pistole 
and TWIC Program Manager John Schwartz declined an invitation to 
testify before the Transportation Committee on the same issue in April 
of this year.
    I don't understand what has changed, but I do want to impart to 
Administrator Pistole, who I understand is testifying on the next 
panel, that it is imperative that jurisdictional issues not interfere 
with progress, particularly when money is being poured into flawed 
security programs. As evidenced by my appearance before this Committee 
today, Congress does indeed want to work together on these important 
issues and it is not the role of any government agency to interpret 
jurisdictional boundaries of Congressional Committees.
Transportation Worker Identification Credential (TWIC) Program
    With that said, I did come here today to discuss the TWIC Program. 
According to TSA, 1.86 million people have enrolled, 1.72 million cards 
have been activated,\3\ and $420 million has been provided to the TWIC 
Program. In 2007, DHS estimated that the combined cost to the federal 
government and the private sector may reach $3.2 billion over a ten-
year period--not taking into account the full cost of ``implementing 
and operating readers.''
---------------------------------------------------------------------------
    \3\ ``Transportation Worker Identification Credential (TWIC) 
Program Briefing'' to the House Committee on Oversight and Government 
Reform, Transportation Security Administration. May 2, 2011.
---------------------------------------------------------------------------
    TWIC is turning into a dangerous and expensive experiment in 
security. Nearly half-a-billion dollars have been spent since the 
Maritime Transportation Security Act of 2002 directed the Secretary of 
DHS to issue biometric transportation security cards to maritime 
workers. Yet today, 10 years later, TWIC cards are no more useful than 
library cards. In fact, the only port that GAO investigators were NOT 
able to gain access to using fraudulent means was the port that still 
required port-specific identification for admittance to secure areas.
    We have also learned from GAO that:

        1. Individuals can obtain authentic TWICs using fraudulent 
        identification documentation;

        2. Individuals can gain access to ports using counterfeit 
        TWICs; and that, among other things,

        3. TSA is unable to confirm that TWIC holders maintain their 
        eligibility throughout the life of their TWIC.

    This is a troubling scenario and counterintuitive to the purpose of 
the program. GAO determined that an individual does not have to prove 
who they say they are when enrolling in the program. In other words, an 
individual can present a fraudulent identification document with 
somebody else's name, but provide their own fingerprints to obtain an 
authentic TWIC card. In this instance, the TWIC card transforms into a 
biometric key that unlocks our nation's ports and facilities for any 
individual with the intent and desire to do us harm.
    GAO tells us that DHS has not assessed whether or not the TWIC 
program enhances security or not. In fact, DHS cannot demonstrate that 
TWIC--as implemented and planned--is more effective than the approach 
used to secure ports and facilities before 9/11.
    I believe we must begin to ask if these vulnerabilities in fact 
make our nation less secure.
TSA Needs to Conduct Cost-Benefit and Risk Analyses of Programs Prior 
        to Funding
    The root of this problem is evidenced in many other TSA programs as 
well--this fledgling agency still does not conduct risk assessments and 
cost-benefit analyses of its security programs as required by law.
    TSA's Screening People by Observation Techniques--or ``SPOT''--
program, will require $1.2 billion over the next 5 years, but TSA has 
yet to validate the underlying methodology of the program or to conduct 
a cost-benefit analysis.\4\
---------------------------------------------------------------------------
    \4\ ``Efforts to Validate TSA's Passenger Screening Behavior 
Detection Program Underway, but Opportunities Exist to Strengthen 
Validation and Address Operational Challenges.'' U.S. Government 
Accountability Office, May 2010.
---------------------------------------------------------------------------
    Likewise, GAO found in April of last year that TSA has not 
conducted comprehensive risk assessments across the surface 
transportation sector.\5\ This lack of analysis results in ill-informed 
resource allocations and more importantly calls into question whether 
the highest risk targets are being secured. In light of the plot 
against the U.S. rail sector uncovered in the Bin Laden raid, it is 
alarming that TSA still has not addressed recommendations to close 
these gaps.
---------------------------------------------------------------------------
    \5\ ``Surface Transportation Security: TSA Has Taken Actions to 
Manage Risk, Improve Coordination, and Measure Performance, but 
Additional Actions Would Enhance It's Efforts.'' U.S. Government 
Accountability Office, April 2010.
---------------------------------------------------------------------------
Biometric Pilot Licenses
    TSA is not the only agency that has struggled to develop a 
biometric credential for transportation workers. In April, the Federal 
Aviation Administration (FAA) testified before my Committee on the long 
delayed development of biometric pilot license. Although Congress 
mandated that pilot licenses include biometric identifiers in the 
Intelligence Reform and Terrorism Prevention Act of 2004, FAA has yet 
to produce them. FAA recently spent $2.7 million to issue 700,000 pilot 
licenses that complied with one requirement of the 2004 legislation--
they are now plastic instead of paper and therefore tamper-resistant. 
Unfortunately, the requirements to include a photograph and biometric 
identifiers were not taken into consideration.
    In closed door sessions with my Committee, FAA informed Members 
that they believed TSA was going to produce a biometric standard for 
them, perhaps in the form of a TWIC card.
    Given the testimony that you will hear today, and the results of 
this GAO report, I think it is safe to say that roping additional 
transportation workers into the TWIC Program is an idea destined for 
disaster. While the biometric standard for the TWIC Program, developed 
by the National Institute of Standard and Technology (NISI), works well 
and fulfilled a much-needed mandate, the program itself is poorly 
managed.
    NIST's Director of Information Technology recently informed me that 
the agency is in the process of updating the current biometric standard 
to include iris scanning, an effort which I applaud. I understand that 
this standard will be complete by the end of this year and look forward 
to its inclusion in future personal identify verification cards for the 
federal workforce.
    I want to thank the Committee again for the opportunity to testify 
before you today, and for your important work on the issue of secure 
credentials for transportation workers.

    Senator Lautenberg. Thanks very much. And again, welcome.
    And I'm pleased to have a chance to have this committee 
hearing. We have serious concerns about the government's 
record, and efforts to make America's ports more secure. Our 
maritime facilities are global gateways, and they provide 
American businesses and consumers access to the world 
marketplace. The ports are a vital part of our economy, but 
they've also been identified as special targets for terrorist 
attacks.
    Now, my state is home to--as said by the FBI--to the 
country's most at-risk areas for a terrorist attack, a stretch 
that includes major hubs like the Port of New York and New 
Jersey, which handled more than $140 million in cargo last 
year.
    Now, to improve security at our ports, 9 years ago the 
government created a worker identification program, known as 
TWIC, to try to make sure that access to the nation's ports is 
limited to people who belong there, such as dock workers and 
cargo handlers and other professionals. Now, after several 
delays, the program is now, as you said, up and running, and 
the government has issued almost 2 million TWIC cards.
    But, a recent Government Accountability Office 
investigation raises a disturbing question. Are America's ports 
actually safer now than they were a decade ago? The GAO has 
identified serious problems with TWIC, including startling 
evidence that this program might actually diminish the safety 
of our ports.
    At this committee's request, the GAO conducted covert 
testing. Investigators were able to fraudulently obtain TWIC 
cards and use the cards to access secure locations. Not only 
were they able to access the port facilities, but they were 
able to drive a vehicle with a simulated explosive into a 
secure area. Fraudulent and counterfeit cards, like the ones 
used by investigators, could also be used as identification at 
airports or military facilities.
    The problems don't stop with fraudulent cards. There are 
also issues with criminal background checks, immigration 
checks, and the lack of safeguards to determine if an applicant 
even needs a TWIC card. So, despite these alarming findings, 
the Transportation Security Administration has, so far, been 
unable to close the gaping holes that plague this program.
    Additionally, the Department of Homeland Security, which 
heads the TSA, has not yet conducted a review to determine if 
the card program helps or hinders security at our nation's 
ports. And given the critical importance of our ports, it's 
unacceptable that we're spending hundreds of millions of tax 
dollars on a program that might actually be making the ports 
less safe. So, according to estimates, it could cost as much as 
$3 billion to deploy the cards over a 10-year period. And this 
doesn't include the cost of the sophisticated biometric 
equipment that's needed to read the card. So, we've got to 
thoroughly examine and correct the TWIC Program, and make sure 
we're focusing our resources where they're needed most, the 
areas that present the highest risk.
    So, I look forward, Mr. Mica, to hearing from you and our 
other witnesses about how you see the status of the program and 
how we can best implement changes to make sure our port 
security programs are effective and the money we spent--spend 
is improving at our ports.
    Now, I've got Senators here that are waiting at a chance to 
make their statements. And if you want to add a ex post facto 
thing for just a couple of minutes, Mr. Mica, I'd be----
    Mr. Mica. Sure, I'm here, waiting. Love to hear the other 
Senators, too. Thank you, sir.
    Senator Lautenberg. Thank you. In the order of their 
appearance, Senator Ayotte is here. And we're pleased to see 
you, and invite you to give your statement, please.

                STATEMENT OF HON. KELLY AYOTTE, 
                U.S. SENATOR FROM NEW HAMPSHIRE

    Senator Ayotte. Thank you, Mr. Chairman.
    Thank you, Representative Mica. Thank you so much for 
coming over to testify from the House.
    Security at our nation's ports is critically important to 
our safety and to our economy. Not only would an attack on our 
nation's ports be devastating, in terms of the loss of human 
life, but would also severely impact our national economy.
    It is deeply troubling that the GAO investigators were able 
to access secure facilities at U.S. ports during covert tests 
by presenting counterfeit or fraudulent TWIC cards. This 
represents a significant hole in our national security that 
must be addressed. And we certainly don't want a security 
program in place that gives the appearance of making us more 
secure, but in reality does not, because that can cause people 
to actually act less vigilantly than they should, given the 
situation.
    I look forward to discussing the reasons behind why this 
was able to happen, ways we can prevent this from happening in 
the future, and how this program can be corrected to ensure the 
security of our ports. I also wanted to raise the issue that 
transportation workers who are getting these IDs--they also are 
pretty inconvenienced, in terms of having to make two trips to 
a TWIC enrollment center to obtain their TWIC card, which can 
be time-consuming and expensive for, particularly, workers in 
rural areas that don't live close to an enrollment center, 
which can place an additional financial burden, particularly on 
a program which we have questions about the efficacy of it. I'm 
also interested in discussing ways that this burden could be 
alleviated so that workers don't have to make multiple, costly 
trips in order to receive the TWIC card, while, at the same 
time, ensuring the integrity of the card, which is very 
important.
    As millions of TWICs are going to be coming up for renewal 
in 2012, now is the time for this committee to address this 
issue. And it's critical that we solve these problems right 
away.
    And I look forward to your testimony today.
    Thank you.
    Senator Lautenberg. Senator Klobuchar.

               STATEMENT OF HON. AMY KLOBUCHAR, 
                  U.S. SENATOR FROM MINNESOTA

    Senator Klobuchar. I'm looking forward to hearing from the 
witnesses. Thank you, Mr. Chairman.
    Senator Lautenberg. Senator Boozman.

                STATEMENT OF HON. JOHN BOOZMAN, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Boozman. I think, in the interest of time, Mr. 
Chairman, I will put my statement in the record, with your 
permission.
    [The prepared statement of Senator Boozman follows:]

  Prepared Statement of Hon. John Boozman, U.S. Senator from Arkansas
    Senator Lautenberg, thank you for presiding over this hearing 
today. The results of this GAO study are troubling, including the 
multiple breaches at facilities by investigators using fraudulent and/
or counterfeit TWIC cards. Perhaps the only thing that is positive to 
see is that the Department of Homeland Security agrees with the 
recommendations.
    I look forward to listening to your testimony today, and working 
with both DHS and the Coast Guard in the future to improve the TWIC 
program.

    Senator Lautenberg. We're making haste here, Mr. Mica. 
We've got, if you want, a couple of minutes.
    Mr. Mica. Thank you. I'll just conclude. And again, I 
associate myself with your remarks, and Senators that are here.
    You're looking at TWIC, you're looking at problems we've 
uncovered. The last Senator who spoke indicated that, 2012, 
we'll be renewing these cards. I think it's incumbent on both 
the House and the Senate that we get our act together on these 
IDs. If we've spent a half a billion dollars. We don't have a 
reader. We're on the cusp of getting a second biometric 
measure. And we have transportation workers in other fields--
aviation, for example--where I showed you a card that we have 
for a license, that can't be used for an ID, that doesn't meet 
the criteria that Congress intended. We can, and we must, do a 
better job of getting our whole act together.
    Now, this, folks, too, is not rocket science. There are 
other agencies that already have identification cards. They 
have them with biometrics, both iris and thumb. They have them 
with readers that can confirm that that person is the person 
that has the ID and can be identified. So, we go on spending 
more and more money, and we don't have security at our ports, 
our airports, or other transportation facilities.
    So, I'll work with you. I know you're going to hear from 
Mr. Pistole. He's fairly new at the gate. A lot of this didn't 
happen under his watch. But, we do need to work with him, with 
the administration, and others, to somehow call a halt to 
spending hundreds of millions of dollars and still, 10 years 
later, not having a secure ID.
    Thank you. And I'm pleased to be here.
    Senator Lautenberg. We appreciate your presence here.
    Senator Begich, you've just come in. Can we proceed with 
the witnesses, or----
    Senator Begich. Let me think about it, if you could, Mr. 
Chairman. I have lots of thoughts on my mind.
    Senator Lautenberg. OK.
    Senator Begich. No, go ahead.
    [Laughter.]
    Senator Lautenberg. All right. And I would call the second 
panel to the table: Mr. John Pistole, the Administrator of the 
Transportation Security Administration. You're not so new. And 
we're glad that you've brought your experience and leadership 
to the task. We'll hear from you on the administration's 
efforts to implement the card program. Rear Admiral Kevin Cook, 
Director of Prevention Policy for the United States Coast 
Guard, to testify on the Coast Guard's role in the TWIC 
Program. And Mr. Steve Lord, Director of Homeland Security and 
Justice for the GAO, the Government Accountability Office. And 
your testimony, I understand is going to be on the GAO's 
oversight and investigation of this program.
    So, I thank all of you for coming today.
    And, Mr. Pistole, please begin. We have 5 minutes for your 
testimony.

       STATEMENT OF HON. JOHN S. PISTOLE, ADMINISTRATOR,

            TRANSPORTATION SECURITY ADMINISTRATION,

              U.S. DEPARTMENT OF HOMELAND SECURITY

    Mr. Pistole. Thank you, Chairman Lautenberg. And good 
afternoon, distinguished members of the Committee.
    I appreciate the opportunity to testify today about 
Transportation Security Administration's work with the United 
States Coast Guard on the Transportation Worker Identification 
Credential Program, or TWIC.
    TWIC Program, of course, authorized by the Maritime 
Transportation Security Act of 2002, MTSA, and the SAFE Port 
Act, strengthens the security of our nation's port while 
facilitating trade through the provision of a tamper-resistant 
biometric credential to all port workers requiring unescorted 
access to secure areas of these MTSA-regulated port facilities 
and vessels.
    The purpose of the TWIC Program is to provide a means of 
positively verifying the identify of those seeking access to 
secure areas, and to conduct Security Threat Assessments, or 
STAs, to determine their eligibility, and to deny access to 
unauthorized individuals.
    Like all security procedures, use of TWIC cards help reduce 
or mitigate risk, but do not eliminate risk, as detailed in the 
GAO report. Not only do I agree with the findings and 
conclusions of the GAO report, and have taken initial steps to 
address the first two recommendations--the first three apply to 
TSA, particularly--but, I've asked GAO to follow up with a 
rigorous cost-benefit analysis of the entire TWIC Program, in 
conjunction with DHS, Coast Guard, and TSA. I believe this type 
of comprehensive assessment will help us all make judgments on 
how well we, the U.S. Government and industry, are buying down 
risk, and the best way forward with this program. In other 
words, what's our return on investment?
    To date, TSA has vetted and ruled more than 1.8 million 
TWIC applicants. The majority of transportation workers who 
have no criminal history receive their TWIC within 5 to 10 
calendar days of submitting an application. Applicants with 
criminal histories require a more stringent review, of course, 
and generally receive either their TWIC or notification of a 
potentially disqualifying offense within 30 calendar days of 
submitting an application.
    Now, in accordance with the SAFE Port Act of 2006, a TWIC 
pilot is currently being conducted to evaluate the feasibility, 
as well as technical and operational impact, of implementing a 
transportation security card reader. Formal data collection 
from the pilots is expected to be completed in 3 weeks--the end 
of May. Thereafter, an independent test agent will develop 
individual participant reports for review by TSA and Coast 
Guard. And we also continue to analyze data already collected 
in the pilot. And we'll analyze new data as it is required. We 
have drafted a report required by section 104 of the SAFE Port 
Act, and will continue to make further updates to this report 
until its anticipated delivery to Congress this summer. These 
reports, along with direct feedback from the participants, will 
inform decisions regarding Coast Guard's rulemaking that will 
establish TWIC-reader use requirements.
    I don't believe this testimony would be complete without 
mention of TSA's efforts to harmonize the Security Threat 
Assessments across all modes of transportation. We share the 
goal of Congress and stakeholders that STA programs be 
harmonized to alleviate the burden and inconvenience placed on 
individuals by the need to obtain multiple STAs. To this end, 
we are working on a rulemaking that may further--may propose 
further harmonization of the security threat assessments. To 
achieve the optimal benefit of this rule, new legislation must 
be enacted that would harmonize different statutorily required 
procedures that prevent harmonization and cannot be changed 
through rulemaking. TSA looks forward--I look forward to 
working with this committee, and other committees, to develop 
the needed legislation.
    Mr. Chairman, members of the Committee, I thank you for the 
opportunity to appear before you. I look forward to your 
questions. Thank you.
    [The prepared statement of Mr. Pistole follows:]

      Prepared Statement of Hon. John S. Pistole, Administrator, 
  Transportation Security Administration, U.S. Department of Homeland 
                                Security
    Good morning, Chairman Lautenberg, Ranking Member Hutchison, and 
distinguished members of the Committee. Thank you for the opportunity 
to testify today about the Transportation Security Administration's 
(TSA) work with the United States Coast Guard (USCG) on the 
Transportation Worker Identification Credential (TWIC) program.
    The TWIC program, authorized by the Maritime Transportation 
Security Act of 2002 (MTSA) and the SAFE Port Act, strengthens the 
security of our nation's ports while facilitating trade through the 
provision of a tamper-resistant biometric credential to all port 
workers requiring unescorted access to secure areas of MTSA-regulated 
port facilities and vessels. The mission of the TWIC program is to 
provide a means of positively verifying the identity of those seeking 
access to secure areas, to conduct Security Threat Assessments (STA) to 
determine their eligibility, and to deny access to unauthorized 
individuals.
    TSA began the national deployment of the TWIC program on October 
16, 2007, with the enrollment of maritime workers at the Port of 
Wilmington, DE. A nationwide requirement for individuals to hold a TWIC 
in order to access MTSA-regulated facilities went into effect in April 
2009, and TSA continues to operate approximately 134 enrollment centers 
located in ports and concentrations of maritime activity throughout the 
United States and its territories. These centers serve the diverse 
population of maritime workers, including truckers, suppliers, 
maintenance personnel and others who require a TWIC to allow them 
unescorted access to secure areas of MTSA-regulated facilities and 
vessels.
    The process to obtain a TWIC requires two visits to an enrollment 
center: an initial visit to provide biographic and biometric data, and 
a subsequent visit to activate the credential upon successful 
completion of the STA. While TSA understands that this process can pose 
a burden on transportation workers who do not live within close 
proximity of an enrollment center, the process is critical to verify 
the identity of the individual to whom the credential is to be issued, 
and TSA has made efforts to mitigate this potential burden by operating 
135 enrollment centers nationwide centered around maritime populations. 
In addition, TSA allows more remote area authorities or organizations 
to conduct enrollment and activation operations on their own for their 
defined population. TSA continues to actively engage all stakeholders 
to address issues concerning proximity to enrollment centers as well as 
other challenges faced by the maritime population relating to the TWIC 
program.
    To date, TSA has vetted more than 1.8 million TWIC applicants. The 
majority of transportation workers who have no criminal history receive 
their TWIC within 5 to 10 calendar days of submitting an application. 
Applicants with criminal histories require a more stringent review and 
generally receive either their TWIC or notification of a potentially 
disqualifying offense within 30 calendar days of submitting an 
application. Initially, transportation workers who requested redress 
following an initial determination of ineligibility experienced delays 
in the process necessary to reach a decision. TSA took this issue very 
seriously and, through increased staff and adjudicative process 
improvements, we have been able to significantly reduce the wait time 
for individuals in these scenarios.
    The national implementation of the TWIC as the common credential 
verifying the identity and background suitability significantly 
enhances national maritime security, which previously relied on a 
patchwork of private and public identity verification and threat 
assessment architectures to allow access to secure and restricted 
areas.
    The STA and associated TWIC must be renewed every 5 years and 
preparations are being made in advance of the impending initial five-
year renewal cycle. TSA is in the process of developing policies and 
procedures that will ensure a smooth renewal phase for the 
transportation workers who rely on this card to do their jobs. These 
procedures will both minimize the operational impact at TWIC enrollment 
centers and ensure that individuals who have completed the redress 
process are not required to repeat the process when no new criminal 
information is found. This will help prevent adjudication backlogs that 
the expected surge in renewal enrollments might otherwise cause. 
Throughout this process, TSA will continue to engage the stakeholder 
community in order to minimize the impact of the renewal cycle on 
affected workers.
    In addition to renewing the STA and TWIC every 5 years, TSA 
conducts recurrent checks of TWIC holders against terrorist watchlists 
and has the authority to revoke TWICs based on the results of this 
recurrent vetting.
    In accordance with the SAFE Port Act of 2006, a TWIC pilot is 
currently being conducted to evaluate the feasibility as well as 
technical and operational impact of implementing a transportation 
security card reader system. Biometric identity verification would 
require workers to present their card to a TWIC card reader and place 
their finger on a biometric sensor. The reader would then verify the 
worker's identity by matching the fingerprint presented to the 
fingerprint templates on the TWIC. Based on stakeholder feedback to the 
TWIC Notice of Proposed Rulemaking (NPRM) \1\ as well as its own 
analysis, DHS determined that the maritime commercial environment would 
benefit from an easy, rapid entrance process, not one that included 
entering a Personal Identification Number (PIN) as is required with the 
Federal Personal Identity Verification (PIV) smart card-based standard 
for Federal employees and contractors.\2\ TSA and the Coast Guard 
engaged maritime stakeholders, smart card industry experts, and 
appropriate Federal agency representatives to develop TWIC 
specifications that would meet maritime industry requirements for 
biometric identity verification.
---------------------------------------------------------------------------
    \1\ 71 FR 29396, May 22, 2006.
    \2\ Federal Information Processing Standards Publication 201-1 
March 2006.
---------------------------------------------------------------------------
    Formal data collection from the pilots is expected to be completed 
at the end of this month. Thereafter, an independent test agent will 
develop individual participant reports for review by TSA and the Coast 
Guard. TSA also continues to analyze data already collected in the 
pilot and will analyze new data as it is acquired. TSA has drafted the 
report required by Section 104 of the SAFE Port Act and will continue 
to make further updates to this report until its anticipated delivery 
to Congress this summer. These reports, along with the direct feedback 
from the participants, will inform decisions regarding the Coast 
Guard's rulemaking that will establish TWIC reader use requirements.
    Notwithstanding several factors that contributed to a delay in 
commencing the TWIC Pilot--including the fact that participation in the 
pilot was voluntary, limiting DHS's ability to influence the overall 
pace of the pilot--the pilot officially began with the start of the 
first reader tests during the Initial Technical Testing (ITT) phase on 
August 20, 2008. The Early Operational Assessment (EOA) phase began in 
April 2009 with the installation of readers in the Port of Brownsville, 
TX, and the System Test and Evaluation (ST&E) phase began in November 
2009. Over the course of the pilot, approximately 156 portable and 
fixed readers were in use at participating ports and facilities.
    This testimony would not be complete without mention of TSA's 
effort to harmonize STAs across all modes of transportation. We share 
the goal of Congress and stakeholders that STA programs be harmonized 
to alleviate the burden and inconvenience placed on individuals by the 
need to obtain multiple STAs. To this end, TSA is working on a 
rulemaking that may propose further harmonization of STAs. To achieve 
the optimal benefit of this rule, new legislation must be enacted that 
would harmonize differing statutorily required procedures that prevent 
harmonization and cannot be changed through rulemaking. TSA will work 
with Congress to develop the needed legislation.
    Mr. Chairman, Ranking Member Hutchison, I thank you for the 
opportunity to appear before you today and I look forward to answering 
your questions about progress in the TWIC program.

    Senator Lautenberg. Thanks very much.
    Admiral your turn. And we look forward to your testimony.

       STATEMENT OF REAR ADMIRAL KEVIN S. COOK, DIRECTOR,

             OF PREVENTION POLICY, U.S. COAST GUARD

    Admiral Cook. Well, good afternoon, Mr. Chairman and 
distinguished members of the Committee.
    With your permission, Mr. Chairman, I'd like to have my 
written testimony entered into the record.
    Senator Lautenberg. So it'll be done.
    Admiral Cook. Thank you for the opportunity to speak with 
you today about the progress the Coast Guard, working together 
with the Transportation Security Administration, has made in 
implementation of the TWIC Program, the ongoing TWIC compliance 
efforts for facilities and vessels regulated under the Maritime 
Transportation Security Act, or MTSA, and future plans for card 
readers.
    The Coast Guard remains cognizant of how implementation and 
enforcement of TWIC impacts individuals and their livelihoods 
while balancing security needs with the economic vitality of 
port operations. The TWIC Program, as envisioned under MTSA and 
strengthened by the subsequent requirements of the SAFE Port 
Act, provides an additional layer of security. This is 
accomplished by ensuring all transportation workers and 
credentialed merchant mariners who seek unescorted access to 
secure areas in approximately 2,700 regulated facilities, 
12,000 regulated vessels, and 50 regulated Outer Continental 
Shelf facilities have been vetted and do not pose a security 
risk to our marine transportation system.
    As of April 15, 2009, applicable Coast Guard-credentialed 
mariners, MTSA-regulated facilities and vessels were required 
to be in compliance with the TWIC Program. The Coast Guard, 
through the captain of the port and the area maritime security 
committees, continue to monitor and enforce TWIC regulations by 
working closely with owners and operators.
    Internal guidance documents for training, compliance, and 
enforcement for Coast Guard personnel have been developed and 
shared with our DHS partners, including TSA and CBP, and state 
and local agencies to promote a unified approach to enforcement 
protocols.
    The SAFE Port Act mandates that the Coast Guard conduct two 
security inspections annually at all MTSA-regulated facilities, 
with one inspection being unannounced. During each of these, 
TWICs are checked by Coast Guard personnel either visually or 
using biometric hand-held readers.
    As originally planned with the TWIC rule in 2006, the final 
step of implementation of the TWIC Program is to utilize the 
full security benefits of the card through the use of readers. 
Although the implementation and reader requirements were 
originally combined in one rulemaking, the Coast Guard and TSA 
heard loud and clear from the industry that further research 
and a different approach for readers was necessary, especially 
as it applies to incorporating contactless reader technology. 
Our stakeholders spoke, and we listened, and agreed to split 
the rule so that the first phase of the TWIC Program, that 
we're using now, is based on visual verification. Based on 
industry recommendations, a working specification for the use 
of contactless readers was developed. It is subsequently being 
tested through the reader pilot test that Administrator Pistole 
just mentioned.
    In parallel with the pilot testing, the Coast Guard has 
been working on a proposed rulemaking that will address 
potential requirements for MTSA vessels and facilities to 
utilize electronic card readers. A key component in this will 
be informing with the operational, environmental, and technical 
data from--the TWIC reader pilot program brings to our 
rulemaking. Based on the current status of the pilot program, 
we hope to be able to publish a notice of proposed rulemaking 
toward the end of calendar year 2011 or early in 2012.
    In the meantime, to maximize the security benefits of the 
TWIC, the Coast Guard procured and deployed over 200 hand-held 
readers for use during routine and unscheduled inspections. The 
Coast Guard and TSA developed several supplementary documents 
to help those who are required to comply with the TWIC 
regulations. The latest Policy Advisory Council decision, 01-
11, on the voluntary use of TWIC readers was published in the 
Federal Register on the 15th of March, 2011, to assist the 
marine industry with consistency in the voluntary use of TWIC 
readers.
    Also, we recently directed that our captains of the port 
place a higher priority on review and validation of TWIC 
verification procedures that are conducted during MTSA 
inspections. This is being done through a direct engagement 
with facility security officers to highlight the importance of 
properly trained guards, and remind them of the training aids 
that are available on the Coast Guard's Homeport website.
    In conclusion, Mr. Chairman, the TWIC implementation marked 
a major milestone in the MTSA to protect our maritime 
transportation system. Card readers are a key step in 
maximizing the security benefit. And the Coast Guard is 
anxiously awaiting the pilot test results to help us draft 
effective regulations, minimizing the potential adverse impacts 
of the reader. While we have accomplished a great deal thus 
far, we acknowledge that the process has not been free from 
challenges. We will continue to keep the public interest in 
mind and also keep you informed on our progress.
    Thank you for the opportunity to speak with you today. And 
I would be pleased to take any of your questions.
    [The prepared statement of Admiral Cook follows:]

           Prepared Statement of Rear Admiral Kevin S. Cook, 
            Director of Prevention Policy, U.S. Coast Guard
    Good morning, Chairman Rockefeller, Ranking Member Hutchison and 
distinguished members of the Committee. I am Rear Admiral Kevin Cook, 
U.S. Coast Guard Director of Prevention Policy. It is a pleasure to be 
here today to update you on how the Coast Guard, in partnership with 
the Transportation Security Administration (TSA), continues to 
implement the Transportation Worker Identification Credential (TWIC) 
program, which strengthens the security of our nation's ports while 
facilitating trade by adding a layer of security which allows vetted 
employees with a biometric credential to have unescorted access to 
secure areas.
    TWIC enrollment began in 2007 and today, maritime vessels and 
facilities within all 42 Coast Guard Captain of the Port (COTP) Zones 
are in compliance with the TWIC program. In April of this year, we 
reached more than 1.8 million enrollments for TWIC with no significant 
impact to commerce and the maritime transportation system. Since the 
Coast Guard and TSA published the TWIC requirements on January 25, 2007 
in a Final Rule, we have been developing regulations, policies, systems 
and capabilities to serve as a solid foundation for enrollment and 
compliance. The deliberate process and careful steps taken to lay this 
foundation ensure that we gain the full security benefit from TWIC.
Background
    The TWIC program builds on the security framework established by 
Congress in the Maritime Transportation Security Act (MTSA) of 2002. 
Coast Guard regulations stemming from MTSA established security 
requirements for maritime vessels and facilities posing a high risk of 
being involved in a transportation security incident. The MTSA also 
required the Secretary of Homeland Security to issue a biometric 
transportation security card to all licensed and documented U.S. 
mariners, as well as those individuals granted unescorted access to 
secure areas of MTSA-regulated vessels and facilities. TSA was assigned 
this requirement, and because of our overlapping responsibilities, the 
Coast Guard and TSA formally joined efforts to carry out the TWIC 
program in November 2004. In this partnership, TSA is responsible for 
TWIC enrollment, security threat assessment and adjudication, card 
production, technology, TWIC issuance, conduct of the TWIC appeal and 
waiver process as it pertains to credential issuance, and management of 
government support systems. The Coast Guard is responsible for 
establishing and enforcing TWIC access control requirements for MTSA-
regulated vessels and facilities.
    TSA and the Coast Guard published a joint TWIC Notice of Proposed 
Rulemaking (NPRM) on May 22, 2006. Following the publication of the 
NPRM and the subsequent comment period, Congress enacted the Security 
and Accountability for Every Port Act of 2006 (the SAFE Port Act). The 
SAFE Port Act created new statutory requirements for the TWIC Program, 
including: the commencement of a pilot program to test the viability of 
TWIC cards and readers in the maritime environment; deployment of the 
program in priority ports by set deadlines; inclusion of a provision to 
allow newly hired employees to work while their TWIC application is 
being processed; and concurrent processing of the TWIC and merchant 
mariner applications.
    TSA and the Coast Guard published the TWIC Final Rule on January 
25, 2007, in which the Coast Guard's MTSA regulations and TSA's 
Hazardous Material Endorsement regulations were amended to incorporate 
the TWIC requirements. After receiving many comments regarding 
technology issues of the reader requirements as proposed in the NPRM, 
we removed from the final rule the requirement to install TWIC readers 
at vessels and facilities. This requirement is currently being 
addressed in a second rulemaking, which I will discuss later.
Policy
    The Coast Guard and TSA developed several supplementary documents 
to help those who are required to comply with the TWIC regulation. To 
explain in detail how the Coast Guard intends to apply TWIC 
regulations, we established policy guidance in the form of a Navigation 
and Vessel Inspection Circular (NVIC) and provided answers in 16 Policy 
Advisory Council documents that have been published since November 21, 
2007.
    The Policy Advisory Council was established during the original 
implementation of the MTSA regulations. It is made up of Coast Guard 
representatives from headquarters and field level commands that are 
charged with considering questions from stakeholders and/or field 
offices to ensure consistent interpretation of regulation. The latest 
Policy Advisory Council Decision 01-11 on the voluntary use of TWIC 
readers was published in the Federal Register on March 15, 2011. This 
guidance document will assist the maritime industry and general public 
with TWIC reader requirements and is designed to ensure consistent 
installation for the voluntary use of TWIC readers for electronic 
identity verification across MTSA-regulated facilities and vessels.
Stakeholder Engagement and Outreach
    Engagement with affected stakeholders continues to be crucial to 
successful implementation, and the regulatory process is one of the 
most important vehicles for the public to voice concerns and provide 
comment on the TWIC program. For example, responses received during the 
TWIC NPRM comment period provided valuable insight into the unique 
operational issues facing labor, maritime facilities and vessels 
required to comply with TWIC requirements. Comments regarding the 
technological and economic feasibility of employing the TWIC cards and 
card readers in the maritime environment led to splitting the rule, 
with the card reader requirements forming a separate, pending 
rulemaking. The Coast Guard published the TWIC Reader Requirements 
Advanced Notice of Proposed Rulemaking (ANPRM) on March 27, 2009, which 
again afforded the public and maritime community an opportunity to 
shape future TWIC requirements.
    Since publication of the TWIC Final Rule and TWIC Reader 
Requirements ANPRM, the Coast Guard and TSA have conducted numerous 
outreach events at national venues such as: the American Trucking 
Association; Association of American Railroads; American Short Line and 
Regional Railroad Association; Passenger Vessel Association; American 
Waterways Operators; National Association of Charter Boat Operators; 
National Association of Waterfront Employers; National Petrochemical 
Refiners Association meetings; smart card and biometric industry 
conferences; maritime union meetings; American Association of Port 
Authorities conferences; and many others. In addition, quarterly TWIC 
Stakeholder Communication Committee meetings are being held and remain 
an important avenue for keeping the public informed and creating the 
opportunity for open dialogue.
    The Coast Guard, through COTP and Area Maritime Security 
Committees, continues to closely monitor and encourage enrollment for 
TWIC and work collaboratively with owners and operators of regulated 
facilities and vessels to ensure compliance and enforcement of the TWIC 
program.
Reader Pilot Testing
    In accordance with the SAFE Port Act of 2006, a TWIC pilot is 
currently being conducted to evaluate the feasibility as well as 
technical and operational impact of implementing a transportation 
security card reader system. TSA and the Coast Guard have begun 
operational testing of the TWIC card readers at geographically and 
operationally diverse port and vessel locations and formal data 
collection should be completed on May 31, 2011. Thereafter, individual 
participant reports will be developed by an independent test agent and 
then reviewed by TSA and the Coast Guard. These individual participant-
level reports, along with the direct feedback from the participants, 
will be the primary data source for the Coast Guard to move forward in 
the next phase of the TWIC reader rulemaking.
Reader Requirements
    Per the SAFE Port Act, the Coast Guard is required to use the pilot 
report to inform a final reader rulemaking. The Coast Guard, with the 
support of TSA, is developing a second TWIC reader requirements rule 
that will serve to meet the requirement for electronic TWIC readers in 
the maritime environment. This rulemaking will apply requirements in a 
risk-based fashion to leverage security benefits and capabilities. The 
Coast Guard solicited and received valuable input and recommendations 
from the Towing Safety Advisory Committee, Merchant Marine Personnel 
Advisory Committee, and the National Maritime Security Advisory 
Committee on specific aspects of potential applications of readers for 
vessels and facilities. As in all aspects of the TWIC program, our goal 
is to enhance maritime security while balancing impacts on the 
stakeholders, who are at the forefront of providing that security. As 
we evaluate the economic and operational impact on the maritime 
industry we will continue to seek input and recommendations to develop 
and issue regulations requiring industry compliance.
Compliance
    The Coast Guard has the primary responsibility for ensuring 
compliance with the TWIC regulations. We continue to work extensively 
with our DHS partners, including TSA and U.S. Customs and Border 
Protection, as well as state and local agencies to enhance partnerships 
and develop enforcement assistance protocols.
    All of the approximately 2,700 maritime facilities impacted by the 
TWIC regulations are--and have been--in compliance as of the April 15, 
2009 implementation date. The Coast Guard continues to conduct both 
announced and unannounced spot checks to ensure compliance with the 
TWIC regulations.
    To fully leverage the security benefits of the TWIC and other 
credentials, the Coast Guard has deployed 218 multi-use biometric 
handheld readers nationwide. The use of these readers serves as the 
primary means of TWIC verification during Coast Guard compliance 
activities. Over the past 2 years since the national compliance date, 
the Coast Guard has verified more than 150,000 TWICs through a 
combination of visual and electronic verification methods.
    The use of readers by the Coast Guard and industry alike reduces 
the risk of successful counterfeit attempts and further adds to the 
ability to identify authentic credentials that have been revoked at 
some point after activation and delivery.
The Way Ahead
    The Coast Guard continues to focus on the enforcement of the TWIC 
regulations and deployment of handheld readers will continue to enhance 
these efforts. Approximately 130 additional readers are scheduled for 
deployment in 2011.
    We recently directed our COTPs to place higher priority on review 
and validation of TWIC verification procedures during required MTSA 
inspections. This review and validation is being done through direct 
engagement with Facility Security Officers to highlight the importance 
of properly trained guards and remind them of the training aids 
available.
    Our ongoing compliance efforts in combination with the future 
reader requirements on commercial vessels and facilities through 
rulemaking are critical in ensuring the security of America's maritime 
transportation system.
Conclusion
    We continue to work closely with TSA to facilitate outreach to the 
maritime industry in an effort to enhance the overall TWIC experience 
for workers and maritime operators--from improving the enrollment and 
activation processes to ensuring the necessary guidance and support is 
in place for maritime operator enforcement. We have accomplished 
important milestones, strengthened working relationships with public 
and industry stakeholders, and held a steadfast commitment to securing 
the maritime transportation system while facilitating commerce. As we 
continue to make improvements regarding compliance, enforcement, and 
continued industry engagement, we will ensure Congress remains informed 
of our progress.
    Thank you for the opportunity to testify today. I look forward to 
your questions.

    Senator Lautenberg. Thank you, Admiral Cook.
    And Mr. Steve Lord, we invite you to give your testimony.

            STATEMENT OF STEPHEN M. LORD, DIRECTOR,

             HOMELAND SECURITY AND JUSTICE ISSUES,

             U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Lord. Thank you, Mr. Chairman and distinguished members 
of the Committee.
    I'm really pleased to be here today to discuss the findings 
of our TWIC report, which is being publicly released today. As 
you know, TSA and the Coast Guard jointly manage the TWIC 
Program, which requires maritime workers to obtain a biometric 
ID card to access secure areas of MTSA-regulated facilities and 
vessels.
    Today, I would like to discuss two issues: the internal 
controls governing TWIC enrollment, background checking, and 
use, as well as DHS assessments of the effectiveness of this 
program.
    The main point that I'd like to convey today is that 
internal control weaknesses in the TWIC Program's enrollment 
and background checking process do not provide what we deem as 
reasonable assurance in meeting key security goals; in other 
words, that only qualified individuals are acquiring TWICs. And 
second, once issued a TWIC, TWIC holders maintain their 
eligibility for holding the card. For example, we found that 
the flags raised by enrollment personnel or electronic document 
scanners were not being systematically used during the 
background checking process to verify an applicant's 
identification. This helps explain why our special 
investigators were not detected when using counterfeit or 
fraudulent application documents to acquire TWICs. TSA also 
does not verify that applicants need a TWIC for employment-
related reasons. In other words, there's not employee 
sponsorship, unlike other government credentials. We also found 
that program adjudicators do not use clear criteria when 
reviewing TWIC applicants with extensive, nondisqualifying 
criminal convictions, such as larceny and theft. This is an 
important issue, as about 461,000 TWIC holders have a criminal 
record, based on the results from the FBI. And this is about 27 
percent of the total TWIC-holder population.
    Finally, we also found that program controls did not 
provide reasonable assurance that TWIC holders continue to meet 
immigration eligibility requirements once they acquire TWIC. 
For example, the program does not issue TWICs for a term less 
than 5 years, to match the expiration of a visa. Instead, TSA 
relies on TWIC holders and employers to report if a worker is 
no longer legally present in the country.
    The weaknesses I've discussed may have contributed to the 
breach of MTSA-regulated ports and facilities during the covert 
tests we ran. During these tests, our investigators were 
successful in accessing ports using either counterfeit TWICs or 
real TWICs acquired through fraudulent means, paired with a 
false business case for entering a facility.
    And regarding our second key research objective, in seeking 
to determine the impact of the program, we found that DHS has 
not assessed the program's effectiveness in enhancing port 
security, a key program goal. Thus, it's unclear, at this 
point, whether the program is more effective or less effective 
than prior approaches used to enhance port and vessel security. 
Our report findings would question the other witness' statement 
that the program significantly enhances national maritime 
security.
    Today's report makes several important recommendations to 
address the internal control weaknesses we identified. For 
example, our report is recommending that DHS complete an 
internal control assessment to identify other potential holes 
in the system, as well as identifying cost-effective fixes. We 
also recommended that DHS conduct a formal assessment to 
clarify how the program will improve security, beyond the port 
efforts already in place. We also recommended that the Coast 
Guard improve the quality of the information used to monitor 
and enforce TWIC compliance. The good news I'd like to report 
today, Mr. Chairman, is that the DHS, TSA, and the Coast Guard 
all agreed to implement all our report recommendations.
    In closing, before proceeding on the path to full 
implementation, with potentially billions of dollars at stake, 
it's important that Congress and industry stakeholders fully 
understand the program's current strengths, current weaknesses, 
and the likely cost of mitigating the risks we've identified in 
the report we're releasing today.
    Mr. Chairman, this concludes my prepared testimony. I look 
forward to answering any questions that you or other members of 
the Committee may have.
    Thank you.
    [The prepared statement of Mr. Lord follows:]

Prepared Statement of Stephen M. Lord, Director, Homeland Security and 
         Justice Issues, U.S. Government Accountability Office
    Chairman Rockefeller, Ranking Member Hutchison, and members of the 
Committee:
    I am pleased to be here today to discuss credentialing issues 
associated with the security of U.S. transportation systems and 
facilities. Securing these systems requires balancing security to 
address potential threats while facilitating the flow of people and 
goods that are critical to the U.S. economy and international commerce. 
As we have previously reported, these systems and facilities are 
vulnerable and difficult to secure given their size, easy 
accessibility, large number of potential targets, and proximity to 
urban areas.\1\ The Maritime Transportation Security Act of 2002 (MTSA) 
required regulations preventing individuals from having unescorted 
access to secure areas of MTSA-regulated facilities and vessels unless 
they possess a biometric transportation security card and are 
authorized to be in such an area. MTSA further required that biometric 
transportation security cards be issued to eligible individuals unless 
determined that an applicant poses a security risk warranting denial of 
the card. The Transportation Worker Identification Credential (TWIC) 
program is designed to implement these biometric maritime security card 
requirements.\2\
---------------------------------------------------------------------------
    \1\ See GAO, Transportation Worker Identification Credential: 
Progress Made in Enrolling Workers and Activating Credentials but 
Evaluation Plan Needed to Help Inform the Implementation of Card 
Readers, GAO-10-43 (Washington, D.C.: Nov. 18, 2009).
    \2\ The program requires maritime workers to complete background 
checks to obtain a biometric identification card and be authorized to 
be in the secure area by the owner/operator in order to gain unescorted 
access to secure areas of MTSA-regulated facilities and vessels. Under 
Coast Guard regulations, a secure area, in general, is an area over 
which the owner/operator has implemented security measures for access 
control in accordance with a Coast Guard-approved security plan. For 
most maritime facilities, the secure area is generally any place inside 
the outer-most access control point. For a vessel or outer continental 
shelf facility, such as off-shore petroleum or gas production 
facilities, the secure area is generally the whole vessel or facility. 
Biometrics refers to technologies that measure and analyze human body 
characteristics for authentication purposes. The Department of Homeland 
Security (DHS) has estimated that implementing the TWIC program could 
cost the Federal Government and the private sector a combined total of 
between $694.3 million and $3.2 billion over a ten-year period. 
However, these figures do not include costs associated with 
implementing and operating readers. A pilot on the use of TWIC with 
card readers is currently underway and will inform a proposed TWIC 
regulation, and these figures are to be updated as part of this 
process.
---------------------------------------------------------------------------
    The TWIC program, once implemented, aims to meet the following 
stated mission needs:

        Positively identify authorized individuals who require 
        unescorted access to secure areas of the nation's 
        transportation system.

        Determine the eligibility of individuals to be authorized 
        unescorted access to secure areas of the transportation system 
        by conducting a security threat assessment.

        Ensure that unauthorized individuals are not able to defeat or 
        otherwise compromise the access system in order to be granted 
        permissions that have been assigned to an authorized 
        individual.

        Identify individuals who fail to maintain their eligibility 
        requirements subsequent to being permitted unescorted access to 
        secure areas of the Nation's transportation system and 
        immediately revoke the individual's permissions.

    Within the Department of Homeland Security (DHS), the 
Transportation Security Administration (TSA) and the U.S. Coast Guard 
are responsible for implementing and enforcing the TWIC program. In 
addition, DHS's Screening Coordination Office facilitates coordination 
among the various DHS components involved in TWIC.
    My statement is based on a report we are releasing publicly today 
on the TWIC program.\3\ Like the report, it will discuss the extent to 
which: (1) TWIC processes for enrollment, background checking, and use 
are designed to provide reasonable assurance that unescorted access to 
secure areas of MTSA-regulated facilities and vessels is limited to 
qualified individuals, and (2) DHS has assessed the effectiveness of 
TWIC, and whether the Coast Guard has effective systems in place to 
measure compliance.
---------------------------------------------------------------------------
    \3\ See GAO, Transportation Worker Identification Credential: 
Internal Control Weaknesses Need to be Corrected to Help Achieve 
Security Objectives, GAO-11-657 (Washington, D.C.: May 10, 2011).
---------------------------------------------------------------------------
    For the report, we reviewed applicable laws, regulations, and 
policies, as well as documentation provided by TSA on the TWIC program 
systems and processes. We also reviewed the processes and data sources 
with TWIC program management from TSA and Lockheed Martin (the 
contractor responsible for implementing the program) and met with 
officials from TSA and the Coast Guard, as well as the Criminal Justice 
Information Services Division at the Federal Bureau of Investigation 
(FBI). We then evaluated the processes against the TWIC program's 
mission needs and Standards for Internal Control in the Federal 
Government.\4\ Further, our investigators conducted covert testing at 
enrollment center(s) to identify whether individuals providing 
fraudulent information could acquire an authentic TWIC, and at maritime 
ports with MTSA-regulated facilities and vessels to identify security 
vulnerabilities and program control deficiencies. In addition, we 
reviewed the type and substance of management information available to 
the Coast Guard and compared them to Standards for Internal Control in 
the Federal Government. We conducted this work in accordance with 
generally accepted government auditing standards. We conducted our 
related investigative work in accordance with standards prescribed by 
the Council of the Inspectors General on Integrity and Efficiency.
---------------------------------------------------------------------------
    \4\ GAO, Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
---------------------------------------------------------------------------
Internal Control Weaknesses in DHS's Biometric Transportation ID 
        Program Hinder Efforts to Ensure Security Objectives Are Fully 
        Achieved
    DHS has established a system of TWIC-related processes and 
controls. However, internal control weaknesses governing the 
enrollment, background checking, and use of TWIC potentially limit the 
program's ability to meet the program's stated mission needs or provide 
reasonable assurance that access to secure areas of MTSA-regulated 
facilities is restricted to qualified individuals. Specifically, 
internal controls \5\ in the enrollment and background checking 
processes are not designed to provide reasonable assurance that: (1) 
only qualified individuals can acquire TWICs; (2) adjudicators follow a 
process with clear criteria for applying discretionary authority when 
applicants are found to have extensive criminal convictions; or (3) 
once issued a TWIC, TWIC holders have maintained their eligibility.
---------------------------------------------------------------------------
    \5\ In accordance with Standards for Internal Control in the 
Federal Government, the design of the internal controls is to be 
informed by identified risks the program faces from both internal and 
external sources; the possible effect of those risks; control 
activities required to mitigate those risks; and the cost and benefits 
of mitigating those risks.
---------------------------------------------------------------------------
    To meet the stated program purpose, TSA's focus in designing the 
TWIC program was on facilitating the issuance of TWICs to maritime 
workers. However, TSA did not assess the internal controls in place to 
determine whether they provided reasonable assurance that the program 
could meet defined mission needs for limiting access to only qualified 
individuals. For example, controls that the TWIC program has in place 
to identify the use of potentially counterfeit identity documents are 
not used to routinely inform background checking processes. 
Additionally, controls are not in place to determine whether an 
applicant has a need for a TWIC. For example, regulations governing the 
TWIC program security threat assessments require applicants to disclose 
their job description and location(s) where they will most likely 
require unescorted access, if known, among other things. However, TSA 
enrollment processes do not require that this information be provided 
by applicants.
    In addition, TWIC program controls are not designed to require that 
adjudicators follow a process with clear criteria for applying 
discretionary authority when applicants are found to have extensive 
criminal convictions. Being convicted of a felony does not 
automatically disqualify a person from being eligible to receive a 
TWIC; however, prior convictions for certain crimes are automatically 
disqualifying.\6\ For example, offenses such as espionage or treason 
would permanently disqualify an individual from obtaining a TWIC. Other 
offenses, such as murder or the unlawful possession of an explosive 
device, while categorized as permanent disqualifiers, are also eligible 
for a waiver under TSA regulations. These offenses might not 
permanently disqualify an individual from obtaining a TWIC if TSA 
determines that an applicant does not represent a security threat. As 
of September 8, 2010, the agency reported 460,786 cases where the 
applicant was approved, but had a criminal record based on the results 
from the FBI. This represents approximately 27 percent of individuals 
approved for a TWIC at the time. Although TSA has the discretion and 
authority to consider the totality of an individual's criminal record, 
including the existence of: (1) extensive criminal convictions, (2) 
criminal offenses not defined as a permanent or interim disqualifying 
criminal offense, such as theft or larceny, and (3) certain periods of 
imprisonment, TSA has not developed a definition for what extensive 
foreign or domestic criminal convictions means, or developed guidance 
to ensure that adjudicators apply this authority consistently. In 
commenting on our report, DHS concurred with our related 
recommendation, and consequently may address this weakness as part of 
its efforts to correct internal control weaknesses in the TWIC program.
---------------------------------------------------------------------------
    \6\ Threat assessment processes for the TWIC program include 
conducting background checks to determine whether each TWIC applicant 
poses a security threat. These checks, in general, can include checks 
for criminal history records, immigration status, terrorism databases 
and watchlists, and records indicating an adjudication of a lack of 
mental capacity, among other things. As defined in TSA implementing 
regulations, the term security threat means an individual who TSA 
determines or suspects of posing a threat to national security, to 
transportation security, or of terrorism.
---------------------------------------------------------------------------
    Further, TWIC program controls are not designed to provide 
reasonable assurance that TWIC holders have maintained their 
eligibility once issued TWICs. For example, controls are not designed 
to determine whether TWIC holders have committed disqualifying crimes 
at the Federal or state level after being granted a TWIC. Although 
existing policies may hamper TSA's ability to check FBI-held 
fingerprint-based criminal history records for the TWIC program on an 
ongoing basis after TWIC issuance, TSA has not explored alternatives 
for addressing this weakness, such as informing facility and port 
operators of this weakness and identifying solutions for leveraging 
existing state criminal history information, where available. In 
addition, controls are not designed to provide reasonable assurance 
that TWIC holders continue to meet immigration status eligibility 
requirements. For example, if a TWIC holder's stated period of legal 
presence in the United States is about to expire or has expired, the 
TWIC program does not request or require proof from TWIC holders to 
show that they continue to maintain legal presence in the United 
States. Additionally, although it has regulatory authority to do so, 
the program does not issue TWICs for a term less than 5 years to match 
the expiration of a visa.\7\
---------------------------------------------------------------------------
    \7\ Instead, TSA relies on: (1) TWIC holders to self-report if they 
no longer have legal presence in the country, and (2) employers to 
report if a worker is no longer legally present in the country. TWIC-
related regulations provide, for example, that individuals disqualified 
from holding a TWIC for immigration status reasons must surrender the 
TWIC to TSA. In addition, the regulations provide that TWICs are deemed 
to have expired when the status of certain lawful nonimmigrants with a 
restricted authorization to work in the United States (e.g., H-1B1 Free 
Trade Agreement) expires, the employer terminates the employment 
relationship with such an applicant, or such applicant otherwise ceases 
working for the employer, regardless of the date on the face of the 
TWIC. Upon the expiration of such nonimmigrant status for an individual 
who has a restricted authorization to work in the United States, the 
employer and employee both have related responsibilities--the employee 
is required to surrender the TWIC to the employer, and the employer is 
required to retrieve the TWIC and provide it to TSA.
---------------------------------------------------------------------------
    Internal control weaknesses in TWIC enrollment, background 
checking, and use could have contributed to the breach of selected 
MTSA-regulated facilities during covert tests conducted by our 
investigators. During these tests at several selected ports, our 
investigators were successful in accessing ports using counterfeit 
TWICs, authentic TWICs acquired through fraudulent means, and false 
business cases (i.e., reasons for requesting access). Our investigators 
did not gain unescorted access to a port where a secondary port-
specific identification was required in addition to the TWIC. TSA and 
Coast Guard officials stated that the TWIC card alone is not sufficient 
and that the cardholder is also required to present a business case. 
However, our covert tests demonstrated that having an authentic TWIC 
and a legitimate business case were not always required in practice.
    Prior to fielding the program, TSA did not conduct a risk 
assessment of the TWIC program to identify program risks and the need 
for controls to mitigate existing risks and weaknesses, as called for 
by internal control standards. Such an assessment could help provide 
reasonable assurance that control weaknesses in one area of the program 
do not undermine the reliability of other program areas or impede the 
program from meeting mission needs. TWIC program officials told us that 
control weaknesses were not addressed prior to initiating the TWIC 
program because they had not previously identified them, or because 
they would be too costly to address. However, as we noted in our 
report, officials did not provide: (1) documentation to support their 
cost concerns and (2) did not complete an assessment of whether they 
needed to implement additional compensating controls or of the risks 
associated with not correcting for existing internal control 
weaknesses. In our May 2011 report, we recommended that the Secretary 
of Homeland Security perform an internal control assessment of the TWIC 
program by: (1) analyzing existing controls, (2) identifying related 
weaknesses and risks, and (3) determining cost-effective actions needed 
to correct or compensate for those weaknesses so that reasonable 
assurance of meeting TWIC program objectives can be achieved. This 
assessment should consider weaknesses we identified in this report 
among other things. DHS officials concurred with our recommendation.
TWIC's Effectiveness at Enhancing Security Has Not Been Assessed, and 
        the Coast Guard Lacks the Ability to Assess Trends in TWIC 
        Compliance
    DHS asserted in its 2009 and 2010 budget submissions that the 
absence of the TWIC program would leave America's critical maritime 
port facilities vulnerable to terrorist activities.\8\ However, to 
date, DHS has not assessed the effectiveness of TWIC at enhancing 
security or reducing risk for MTSA-regulated facilities and vessels. 
Further, DHS has not demonstrated that TWIC, as currently implemented 
and planned with card readers, is more effective than prior approaches 
used to limit access to ports and facilities, such as using facility-
specific identity credentials with business cases.
---------------------------------------------------------------------------
    \8\ See DHS, DHS Exhibit 300 Public Release BY10/TSA--
Transportation Worker Identification Credentialing (TWIC) (Washington, 
D.C.: Apr. 17, 2009) and DHS Exhibit 300 Public Release BY09/TSA--
Transportation Worker Identification Credentialing (TWIC) (Washington, 
D.C.: July 27, 2007).
---------------------------------------------------------------------------
    According to TSA and Coast Guard officials, because the program was 
mandated by Congress as part of MTSA, DHS did not conduct a risk 
assessment to identify and mitigate program risks prior to 
implementation. Further, according to these officials, neither the 
Coast Guard nor TSA analyzed the potential effectiveness of TWIC in 
reducing or mitigating security risk--either before or after 
implementation--because they were not required to do so by Congress. 
However, internal control weaknesses raise questions about the 
effectiveness of the TWIC program. Moreover, as we have previously 
reported, Congress also needs information on whether and in what 
respects a program is working well or poorly to support its oversight 
of agencies and their budgets, and agencies' stakeholders need 
performance information to accurately judge program effectiveness. 
Therefore, we recommended in our May 2011 report that the Secretary of 
Homeland Security conduct an effectiveness assessment that includes 
addressing internal control weaknesses and, at a minimum, evaluates 
whether use of TWIC in its present form and planned use with readers 
would enhance the posture of security beyond efforts already in place 
given costs and program risks. DHS concurred with our recommendation.
    Further, Executive Branch requirements provide that prior to 
issuing a new regulation, agencies are to conduct a regulatory 
analysis, which is to include an assessment of costs, benefits, and 
risks. Therefore, DHS is required to issue a new regulatory analysis 
for its proposed regulation on the use of TWIC with biometric card 
readers. Conducting a regulatory analysis using the information from 
the internal control and effectiveness assessments could better inform 
the new regulatory analysis and could help DHS identify and assess the 
full costs and benefits of implementing the TWIC program. Therefore, in 
our May 2011 report, we recommended that the Secretary of Homeland 
Security use the information from the internal control and 
effectiveness assessments as the basis for evaluating the costs, 
benefits, security risks, and corrective actions needed to implement 
the TWIC program. This should be done in a manner that will meet stated 
mission needs and mitigate existing security risks as part of the 
regulatory analysis being completed for the new TWIC biometric card 
reader regulation. DHS concurred with our recommendation.
    Finally, the Coast Guard's approach for monitoring and enforcing 
TWIC compliance nationwide could be improved by enhancing its 
collection and assessment of related maritime security information. For 
example, the Coast Guard tracks TWIC program compliance, but the 
processes involved in the collection, cataloguing, and querying of 
information cannot be relied on to produce the management information 
needed to assess trends in compliance with the TWIC program or 
associated vulnerabilities. The Coast Guard uses its Marine Information 
for Safety and Law Enforcement (MISLE) database to monitor activities 
related to MTSA-regulated facility and vessel oversight, including 
observations of TWIC-related deficiencies. Coast Guard officials 
reported that they are making enhancements to the MISLE database and 
plan to distribute updated guidance on how to collect and input 
information. However, as of May 2011, the Coast Guard had not yet set a 
date for implementing these changes. Further, these enhancements do not 
address all weaknesses identified in our report that hamper the Coast 
Guard's efforts to conduct trend analysis of the deficiencies as part 
of its compliance reviews. Therefore, in our May 2011 report, we 
recommended that the Secretary of Homeland Security direct the 
Commandant of the Coast Guard to design effective methods for 
collecting, cataloguing, and querying TWIC-related compliance issues to 
provide the Coast Guard with the enforcement information needed to 
assess trends in compliance with the TWIC program and identify 
associated vulnerabilities. DHS concurred with our recommendation.
    As the TWIC program continues on the path to full implementation--
with potentially billions of dollars needed to install TWIC card 
readers in thousands of the nation's ports, facilities, and vessels at 
stake--it is important that Congress, program officials, and maritime 
industry stakeholders fully understand the program's potential benefits 
and vulnerabilities, as well as the likely costs of addressing these 
potential vulnerabilities. The report we are releasing today aims to 
help inform stakeholder views on these issues.
    Chairman Rockefeller, Ranking Member Hutchison, and members of the 
Committee, this concludes my prepared testimony. I look forward to 
answering any questions that you may have.
                                 ______
                                 
                               Attachment
 U.S. Government Accountability Office (GAO)--Report to Congressional 
 Requesters--May 2011--Transportation Worker Identification Credential
Internal Control Weaknesses Need to Be Corrected to Help Achieve 
        Security Objectives
Abbreviations

        ATSA--Aviation and Transportation Security Act

        CSOC--Colorado Springs Operations Center

        DHS--Department of Homeland Security

        FBI--Federal Bureau of Investigation

        FEMA--Federal Emergency Management Agency

        IAFIS--Integrated Automated Fingerprint Identification System

        III--Interstate Identification Index

        MISLE--Marine Information for Safety and Law Enforcement

        MSRAM--Maritime Security Risk Analysis Model

        MTSA--Maritime Transportation Security Act

        NCIC--National Crime Information Center

        NIPP--National Infrastructure Protection Plan

        SAFE Port Act--Security and Accountability For Every Port Act

        SAVE--Systematic Alien Verification for Entitlements

        TSA--Transportation Security Administration

        TWIC--Transportation Worker Identification Credential
                                 ______
                                 
                                                       May 10, 2011
                                   Congressional Requesters

    Securing transportation systems and facilities requires balancing 
security to address potential threats while facilitating the flow of 
people and goods that are critical to the United States economy and 
necessary for supporting international commerce. As we have previously 
reported, these systems and facilities are vulnerable and difficult to 
secure given their size, easy accessibility, large number of potential 
targets, and proximity to urban areas.\1\
---------------------------------------------------------------------------
    \1\ See GAO, Transportation Worker Identification Credential: 
Progress Made in Enrolling Workers and Activating Credentials but 
Evaluation Plan Needed to Help Inform the Implementation of Card 
Readers, GAO-10-43 (Washington, D.C.: Nov. 18, 2009); Transportation 
Security: DHS Should Address Key Challenges before Implementing the 
Transportation Worker Identification Credential Program, GAO-06-982 
(Washington, D.C.: Sept. 29, 2006); and Port Security: Better Planning 
Needed to Develop and Operate Maritime Worker Identification Card 
Program, GAO-05-106 (Washington, D.C.: Dec. 10, 2004).
---------------------------------------------------------------------------
    The Maritime Transportation Security Act of 2002 \2\ (MTSA) 
required the Secretary of Homeland Security to prescribe regulations 
preventing individuals from having unescorted access to secure areas of 
MTSAregulated facilities and vessels unless they possess a biometric 
transportation security card and are authorized to be in such an 
area.\3\ MTSA further tasked the Secretary with the responsibility to 
issue biometric transportation security cards to eligible individuals 
unless the Secretary determines that an applicant poses a security risk 
warranting denial of the card. The Transportation Worker Identification 
Credential (TWIC) program is designed to implement these biometric 
maritime security card requirements. The program requires maritime 
workers to complete background checks to obtain a biometric 
identification card and be authorized to be in the secure area by the 
owner/operator in order to gain unescorted access to secure areas of 
MTSA-regulated facilities and vessels.\4\ According to the Coast Guard, 
as of December 2010 and January 2011, there were 2,509 facilities and 
12,908 vessels, respectively, which are subject to MTSA regulations and 
must implement TWIC provisions.\5\
---------------------------------------------------------------------------
    \2\ Pub. L. No. 107-295, 116 Stat. 2064 (2002).
    \3\ Under Coast Guard regulations, a secure area, in general, is an 
area over which the owner/operator has implemented security measures 
for access control in accordance with a Coast Guard-approved security 
plan. For most maritime facilities, the secure area is generally any 
place inside the outer-most access control point. For a vessel or outer 
continental shelf facility, such as off-shore petroleum or gas 
production facilities, the secure area is generally the whole vessel or 
facility.
    \4\ Biometrics refers to technologies that measure and analyze 
human body characteristics--such as fingerprints, eye retinas and 
irises, voice patterns, facial patterns, and hand measurements--for 
authentication purposes.
    \5\ 33 C.F.R. Part 105, for example, governs maritime facility 
security and sets forth general security requirements along with 
requirements for facility security assessments and facility security 
plans, among other things. General maritime security requirements 
pertaining to vessels are set out in 33 C.F.R. Part 104.
---------------------------------------------------------------------------
    Within the Department of Homeland Security (DHS), the 
Transportation Security Administration (TSA) and the U.S. Coast Guard 
are responsible for implementing and enforcing the TWIC program. TSA's 
responsibilities include enrolling TWIC applicants, conducting 
background checks to assess the individual's security threat, and 
issuing TWICs. The Coast Guard is responsible for developing TWIC-
related security regulations and ensuring that MTSA-regulated maritime 
facilities and vessels are in compliance with these regulations. In 
addition, DHS's Screening Coordination Office facilitates coordination 
among the various DHS components involved in TWIC, such as TSA and the 
Coast Guard, as well as the U.S. Citizenship and Immigration Services, 
which personalizes the credentials,\6\ and the Federal Emergency 
Management Agency, which administers grant funds in support of the TWIC 
program.
---------------------------------------------------------------------------
    \6\ A card is personalized when the card holder's personal 
information, such as photograph and name, are added to the card.
---------------------------------------------------------------------------
    In January 2007, a federal regulation (known as the TWIC credential 
rule) set a compliance deadline, subsequently extended to April 15, 
2009, whereby each maritime worker seeking unescorted access to secure 
areas of MTSA-regulated facilities and vessels must possess a TWIC.\7\ 
In September 2008, we reported that TSA, the Coast Guard, and maritime 
industry stakeholders (e.g., operators of MTSA-regulated facilities and 
vessels) had faced challenges in implementing the TWIC program, 
including enrolling and issuing TWICs to a larger population than was 
originally anticipated, ensuring that TWIC access control technologies 
perform effectively in the harsh maritime environment, and balancing 
security requirements with the flow of maritime commerce.\8\ In 
November 2009, we reported that progress had been made in enrolling 
workers and activating TWICs, and recommended that TSA develop an 
evaluation plan to guide pilot efforts and help inform the future 
implementation of TWIC with electronic card readers.\9\ DHS generally 
concurred and discussed actions to implement the recommendations, but 
these actions have not yet fully addressed the intent of all of the 
recommendations. Currently, TWICs are primarily used as visual identity 
cards--known as a flashpass--where a card is to be visually inspected 
before a cardholder is allowed unescorted access to a secure area of a 
MTSA-regulated port or facility.\10\ As of January 6, 2011, TSA 
reported over 1.7 million enrollments and 1.6 million cards issued and 
activated.\11\
---------------------------------------------------------------------------
    \7\ 72 Fed. Reg. 3492 (2007); Extension of deadline to April 15, 
2009 by 73 Fed. Reg. 25562 (2008).
    \8\ GAO, Transportation Worker Identification Credential: A Status 
Update, GAO-08-1151T (Washington, D.C.: Sept. 17, 2008).
    \9\ GAO-10-43.
    \10\ TWIC guidance provides that possession of a TWIC is required 
for an individual to be eligible for unescorted access to secure areas 
of vessels and facilities. With the issuance of a TWIC, it is still the 
responsibility of facility and vessel owners to determine who should be 
granted access to their facilities or vessels.
    \11\ Prior to issuing a TWIC, each TWIC is activated, or turned on, 
after the person being issued the TWIC provides a personal 
identification number.
---------------------------------------------------------------------------
    In response to your request, we evaluated the extent to which TWIC 
program controls provide reasonable assurance that unescorted access to 
secure areas of MTSA-regulated facilities and vessels is limited to 
those possessing a legitimately issued TWIC and who are authorized to 
be in such an area. Specifically, this report addresses the following 
questions:

        1. To what extent are TWIC processes for enrollment, background 
        checking, and use designed to provide reasonable assurance that 
        unescorted access to secure areas of MTSA-regulated facilities 
        and vessels is limited to qualified individuals?

        2. To what extent has DHS assessed the effectiveness of TWIC, 
        and does the Coast Guard have effective systems in place to 
        measure compliance?

    This report is a public version of a related sensitive report that 
we issued to you in May 2011. DHS and TSA deemed some of the 
information in the prior report as sensitive security information, 
which must be protected from public disclosure. Therefore, this report 
omits sensitive information about the TWIC program, including 
techniques used to enroll and conduct a background check on individuals 
and assess an individual's eligibility for a TWIC, and the technologies 
that support TWIC security threat assessment determinations and Coast 
Guard inspections. In addition, at TSA's request, we have redacted data 
on specific enrollment center(s) and maritime ports where our 
investigators conducted covert testing. Although the information 
provided in this report is more limited in scope, it addresses the same 
questions and includes the same recommendations as the sensitive 
report. Also, the overall methodology used for both reports is the 
same.
    To assess the extent to which TWIC program processes were designed 
to provide reasonable assurance that unescorted access to secure areas 
of MTSA-regulated facilities and vessels is limited to qualified 
individuals, we reviewed applicable laws, regulations, and 
policies.\12\ We also reviewed documentation provided by TSA on the 
TWIC program systems and processes, such as the TWIC User Manual for 
Trusted Agents, Statement of Objectives, and Concept of Operations. We 
further reviewed the processes and data sources with TWIC program 
management from TSA and Lockheed Martin (the contractor responsible for 
implementing the program).\13\ We also met with: (1) the Director of 
Vetting Operations at TSA's Colorado Springs Operations Center (CSOC), 
where background checks for links to terrorism and continual vetting of 
TWIC holders is to take place; (2) the Operations Manager for the 
Adjudication Center, where secondary background checks are to be 
conducted for applicants with identified criminal or immigration 
issues; and (3) the Director at DHS's Screening Coordination Office 
responsible for overseeing credentialing programs across DHS. 
Additionally, we met with the Criminal Justice Information Services 
Division at the Federal Bureau of Investigation (FBI) to discuss 
criminal vetting processes and policies. We then evaluated the 
processes against the TWIC program's mission needs and Standards for 
Internal Control in the Federal Government.\14\ As part of our 
assessment of TWIC program controls, we also did the following:
---------------------------------------------------------------------------
    \12\ See, for example, MTSA, Security and Accountability For Every 
Port Act (SAFE Port Act) of 2006 (Pub. L. No. 109-347, 120 Stat. 1884 
(2006)) amendments to MTSA, Navigation and Vessel Inspection Circular 
Number 03-07: Guidance for the Implementation of the Transportation 
Worker Identification Credential Program in the Maritime Sector 
(Washington, D.C.: July 2, 2007), Coast Guard Policy Advisory Council 
(PAC) decisions, and Commandant Instruction M16601.01: Coast Guard 
Transportation Worker Identification Credential Verification and 
Enforcement Guide (Washington, D.C.: Oct. 10, 2008).
    \13\ To assess the reliability of data on the number of TWIC 
enrollments, the number of self-identified U.S. citizens or nationals 
asserting themselves to be born in the United States or in a U.S. 
territory, and the number of TWICs approved after the initial 
background check, we reviewed program systems documentation and 
interviewed knowledgeable agency officials about the source of the data 
and the controls the TWIC program and systems had in place to maintain 
the integrity of the data. We determined that the data were 
sufficiently reliable for the purposes of our report. The data we 
reviewed were collected between October 2007 and December 2010.
    \14\ GAO, Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).

   We visited four TWIC enrollment and activation centers 
        located in areas with high population density and near ports 
        participating in the TWIC pilot to observe how TWIC enrollments 
        are conducted.\15\ The results are not generalizable to all 
        enrollment and activation centers; however, because all centers 
        are to conduct the same operations following the same guidance, 
        the locations we visited provided us with an overview of the 
        TWIC enrollment and activation/issuance processes.
---------------------------------------------------------------------------
    \15\ We visited the Howland Hook enrollment center in Staten 
Island, New York, the Whitehall Ferry Terminal enrollment center in New 
York, New York, the Terminal Island enrollment center in San Pedro, 
California, and the Long Beach enrollment center in Long Beach, 
California.

   We had our investigators conduct covert testing at 
        enrollment center(s) operating at the time to identify whether 
        individuals providing fraudulent information could acquire an 
        authentic TWIC. The information we obtained from the covert 
        testing at enrollment center(s) is not generalizable across all 
        TWIC enrollment centers. However, because all enrollments are 
        to be conducted following the same established processes, we 
        believe that the information from our covert tests provided us 
        with important perspective on TWIC program enrollment and 
        background checking processes, as well as potential challenges 
---------------------------------------------------------------------------
        in verifying an individual's identity.

    Further our investigators conducted covert testing at several 
selected maritime ports with MTSA-regulated facilities and vessels to 
identify security vulnerabilities and program control deficiencies. 
These locations were selected based on their geographic location across 
the country (east coast, gulf coast, and west coast) and port size in 
terms of cargo volume. We also visited or met with officials at each of 
the seven original pilot sites being used to test TWIC card 
readers,\16\ interviewed port security officials at two additional 
ports responsible for implementing TWIC at their port,\17\ and met with 
nine maritime or transportation industry associations \18\ to obtain 
information on: (1) the use of TWIC as a flashpass and with biometric 
readers where they are in use, (2) experiences with TWIC card 
performance, and (3) any suspected or reported cases of TWIC card 
fraud. The information we obtained from the security officials at the 9 
ports or pilot participants we visited is not generalizable across the 
maritime transportation industry as a whole, but collectively, the 
ports we visited accounted for 56 percent of maritime container trade 
in the United States, and the ports our investigators visited as part 
of our covert testing efforts accounted for 54 percent of maritime 
container trade in the United States in 2009. As such, we believe that 
the information from these interviews, site visits, and covert tests 
provided us with important additional perspective and context on the 
TWIC program, as well as information about potential implementation 
challenges faced by MTSA-regulated facilities/vessels, transportation 
workers, and mariners.
---------------------------------------------------------------------------
    \16\ We visited pilot participants at the Ports of Los Angeles, 
Long Beach, and Brownsville, and the Port Authority of New York and New 
Jersey. We also interviewed and or met with officials at vessel 
operations participating in the TWIC pilot, including the Staten Island 
Ferry in Staten Island, New York; Magnolia Marine Transports in 
Vicksburg, Mississippi; and Watermark Cruises in Annapolis, Maryland.
    \17\ We met with officials responsible for implementing TWIC at the 
Port of Baltimore and the Port of Houston. We selected the Port of 
Baltimore based on proximity to large population centers and we 
selected the Port of Houston because it was using TWICs with readers.
    \18\ We interviewed representatives from the Association of the Bi-
State Motor Carriers, the New Jersey Motor Truck Association, the 
Association of American Railroads, the American Public Transportation 
Association, the American Association of Port Authorities, the 
International Liquid Terminals Association, the International Longshore 
and Warehouse Union, the National Employment Law Project, and the 
Passenger Vessel Association. These organizations were selected because 
together they represent the key constituents of port operations.
---------------------------------------------------------------------------
    To assess the extent to which DHS has assessed the effectiveness of 
TWIC, and determine whether the Coast Guard has effective systems in 
place to measure compliance, we reviewed applicable laws, regulations, 
and policies.\19\ We also met with TWIC program officials from TSA and 
the Coast Guard, as well as Coast Guard officials responsible for 
assessing maritime security risk, and reviewed related documents, to 
identify how TWIC is to enhance maritime security.\20\ In addition, we 
met with Coast Guard TWIC program officials, data management staff, and 
Coast Guard officials stationed at four port areas across the United 
States with enforcement responsibilities to assess the agency's 
approach to enforcing compliance with TWIC regulations and measuring 
program effectiveness.\21\ As part of this effort, we reviewed the type 
and substance of management information available to the Coast Guard 
for assessing compliance with TWIC. In performing this work, we 
evaluated the Coast Guard's practices against TWIC program mission 
needs and Standards for Internal Control in the Federal Government.
---------------------------------------------------------------------------
    \19\ See, for example, MTSA, Security and Accountability For Every 
Port Act (SAFE Port Act) of 2006 (Pub. L. No. 109-347, 120 Stat. 1884 
(2006)) amendments to MTSA, Navigation and Vessel Inspection Circular 
Number 03-07: Guidance for the Implementation of the Transportation 
Worker Identification Credential Program in the Maritime Sector 
(Washington, D.C.: July 2, 2007), Coast Guard Policy Advisory Council 
(PAC) decisions, and Commandant Instruction M16601.01: Coast Guard 
Transportation Worker Identification Credential Verification and 
Enforcement Guide (Washington, D.C.: Oct. 10, 2008).
    \20\ See, for example, the Coast Guard's 2008 Analysis of 
Transportation Worker Identification Credential (TWIC) Electronic 
Reader Requirements in the Maritime Sector, and the Homeland Security 
Institute's 2008 Independent Verification and Validation of Development 
of Transportation Worker Identification Credential (TWIC) Reader 
Requirements.
    \21\ We interviewed Coast Guard officials in New York and New 
Jersey; Los Angeles and Long Beach, California; Corpus Christi, Texas; 
and Baltimore, Maryland. We met with these Coast Guard officials 
because the facilities, vessels, and enrollment centers we visited are 
housed in these officials' area(s) of responsibility.
---------------------------------------------------------------------------
    We conducted this performance audit from November 2009 through 
March 2011 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit 
to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. 
We believe that the evidence obtained provides a reasonable basis for 
our findings and conclusions based on our audit objectives. We 
conducted our related investigative work in accordance with standards 
prescribed by the Council of the Inspectors General on Integrity and 
Efficiency.\22\
---------------------------------------------------------------------------
    \22\ During the course of the audit, we provided briefings on the 
preliminary results of our work in May and October 2010.
---------------------------------------------------------------------------
Background
TWIC History and Purpose
    In November 2001, the Aviation and Transportation Security Act 
(ATSA) \23\ was enacted, requiring TSA to, among other things, work 
with airport operators to strengthen access control points to secured 
areas and to consider using biometric access control systems, or 
similar technologies, to verify the identity of individuals who seek to 
enter a secure airport area. In response to ATSA, TSA established the 
TWIC program in December 2001.\24\ In November 2002, MTSA was enacted 
and required the Secretary of Homeland Security to issue a maritime 
worker identification card that uses biometrics to control access to 
secure areas of maritime transportation facilities and vessels.\25\ In 
addition, the Security and Accountability For Every Port Act (SAFE Port 
Act) of 2006 amended MTSA and directed the Secretary of Homeland 
Security to, among other things, implement the TWIC pilot project to 
test TWIC use with biometric card readers and inform a future 
regulation on the use of TWIC with electronic readers.
---------------------------------------------------------------------------
    \23\ Pub. L. No. 107-71, 115 Stat. 597 (2001).
    \24\ TSA was transferred from the Department of Transportation to 
DHS pursuant to requirements in the Homeland Security Act, enacted on 
November 25, 2002 (Pub. L. No. 107-296, 116 Stat. 2135, 2178 (2002)).
    \25\ Prior to TWIC, facilities and vessels administered their own 
approaches for controlling access based on the perceived risk at the 
facility. These approaches, among others, included requiring people 
seeking access to have a reason for entering, facility-specific 
identification, and in some cases, a background check. Some ports and 
port facilities still maintain their own credentials.
---------------------------------------------------------------------------
    In requiring the issuance of transportation security cards for 
entry into secure areas of a facility or vessel as part of MTSA, 
Congress noted in the ``Findings'' section of the legislation that 
ports in the United States are a major location for Federal crime such 
as cargo theft and smuggling, and are susceptible to large-scale acts 
of terrorism.\26\ For example, according to the Coast Guard's January 
2008 National Maritime Terrorism Threat Assessment, al Qaeda leaders 
and supporters have identified western maritime assets as legitimate 
targets.\27\ Moreover, according to the Coast Guard assessment, al 
Qaeda-inspired operatives are most likely to use vehicle bombs to 
strike U.S. cargo vessels, tankers, and fixed coastal facilities such 
as ports. Studies have demonstrated that attacks on ports could have 
serious consequences. For example, a study by the Center for Risk and 
Economic Analysis of Terrorist Events on the impact of a dirty bomb 
attack on the Ports of Los Angeles and Long Beach estimated that the 
economic consequences from a shutdown of the harbors due to the 
contamination could result in significant losses in the tens of 
billions of dollars, including the decontamination costs and the 
indirect economic impacts due to the port shutdown.\28\
---------------------------------------------------------------------------
    \26\ Maritime Transportation Security Act of 2002 (Pub. L. No. 107-
295,116 Stat. 2064 (2002)). The FBI estimates that in the United 
States, cargo crime amounts to $12 billion annually and finds that most 
cargo theft occurs in or near seaports.
    \27\ U.S. Coast Guard Intelligence Coordination Center, National 
Maritime Terrorism Threat Assessment (Washington, D.C.: Jan. 7, 2008).
    \28\ H. Rosoff and D. von Winterfeldt, ``A Risk and Economic 
Analysis of Dirty Bomb Attacks on the Ports of Los Angeles and Long 
Beach,'' Journal of Risk Analysis, vol. 27, no. 3 (2007). This research 
was supported by DHS through the Center for Risk and Economic Analysis 
of Terrorist Events by grant funding.
---------------------------------------------------------------------------
    As defined by DHS, the purpose of the TWIC program is to design and 
field a common credential for all transportation workers across the 
United States who require unescorted access to secure areas at MTSA-
regulated maritime facilities and vessels.\29\ As such, the TWIC 
program, once implemented, aims to meet the following stated mission 
needs:
---------------------------------------------------------------------------
    \29\ This is defined in the TWIC System Security Plan and the DHS 
Budget Justification to Congress for Fiscal Years 2009 and 2010.

   Positively identify authorized individuals who require 
        unescorted access to secure areas of the Nation's 
---------------------------------------------------------------------------
        transportation system.

   Determine the eligibility of individuals to be authorized 
        unescorted access to secure areas of the transportation system 
        by conducting a security threat assessment.

   Ensure that unauthorized individuals are not able to defeat 
        or otherwise compromise the access system in order to be 
        granted permissions that have been assigned to an authorized 
        individual.

   Identify individuals who fail to maintain their eligibility 
        requirements subsequent to being permitted unescorted access to 
        secure areas of the Nation's transportation system and 
        immediately revoke the individual's permissions.
TWIC Program Processes for Ensuring TWIC-Holder Eligibility
    TSA is responsible for enrolling TWIC applicants and conducting 
background checks to ensure that only eligible individuals are granted 
TWICs.\30\ In addition, pursuant to TWIC-related regulations, 
MTSAregulated facility and vessel operators are responsible for 
reviewing each individual's TWIC as part of their decision to grant 
unescorted access to secure areas of their facilities. The Coast Guard 
is responsible for assessing and enforcing operator compliance with 
TWIC-related laws and regulations. Described below are key components 
of each process for ensuring TWIC-holder eligibility.
---------------------------------------------------------------------------
    \30\ TWIC program threat assessment processes include conducting a 
background check to determine whether each TWIC applicant is a security 
risk to the United States. These checks, in general, can include checks 
for criminal history records, immigration status, terrorism databases 
and watchlists, and records indicating an adjudication of lack of 
mental capacity, among other things. TSA security threat assessment-
related regulations define the term security threat to mean an 
individual whom TSA determines or suspects of posing a threat to 
national security; to transportation security; or of terrorism.
---------------------------------------------------------------------------
    Enrollment: Transportation workers are enrolled by providing 
biographic information, such as name, date of birth, and address, and 
proof of identity documents, and then being photographed and 
fingerprinted at enrollment centers by trusted agents. A trusted agent 
is a member of the TWIC team who has been authorized by the Federal 
Government to enroll transportation workers in the TWIC program and 
issue TWIC cards.\31\ Appendix I summarizes key steps in the enrollment 
process.
---------------------------------------------------------------------------
    \31\ Trusted agents are subcontractor staff acquired by Lockheed 
Martin as part of its support contract with TSA for the TWIC program.
---------------------------------------------------------------------------
    Background checking: TSA conducts background checks on each worker 
who applies for a TWIC to ensure that individuals who enroll do not 
pose a security risk to the United States. A worker's potential link to 
terrorism, criminal history, immigration status, and mental capacity 
are considered as part of the security threat assessment. Workers have 
the opportunity to appeal negative results of the threat assessment or 
request a waiver of certain specified criminal offenses, and 
immigration or mental capacity standards. Specifically, the TWIC 
background checking process includes two levels of review.

        First-level review: Initial automated background checking. The 
        initial automated background checking process is conducted to 
        determine whether any derogatory information is associated with 
        the name and fingerprints submitted by an applicant during the 
        enrollment process. This check is conducted against the FBI's 
        criminal history records. These records contain information 
        from Federal and state and local sources in the FBI's National 
        Crime Information Center (NCIC) database and the FBI's 
        Integrated Automated Fingerprint Identification System (IAFIS)/
        Interstate Identification Index (III), which maintain criminal 
        records and related fingerprint submissions. Rather than 
        positively confirming each individual's identity using the 
        submitted fingerprints, the FBI's criminal history records 
        check is a negative identification check, whereby the 
        fingerprints are used to confirm that the associated individual 
        is not on the FBI criminal history list. If an individual is 
        identified as being on the FBI's criminal history list, 
        relevant information is to be forwarded to TSA for 
        adjudication.\32\ The check is also conducted against Federal 
        terrorism information from the Terrorist Screening Data base, 
        including the Selectee and No-Fly Lists.\33\ To determine an 
        applicant's immigration/citizenship status and eligibility, TSA 
        also runs applicant information against the Systematic Alien 
        Verification for Entitlements (SAVE) system. If the applicant 
        is identified as a U.S.-born citizen with no related derogatory 
        information, the system can approve the issuance of a TWIC with 
        no further review of the applicant or human intervention.
---------------------------------------------------------------------------
    \32\ Not all TWIC applicants will have readable fingerprints. As we 
have previously reported, it is estimated that about 2 percent to 5 
percent of people cannot be easily fingerprinted because their 
fingerprints have become dry or worn from age, extensive manual labor, 
or exposure to corrosive chemicals (See GAO, Technology Assessment: 
Using Biometrics for Border Security, GAO-03-174 (Washington, D.C.: 
Nov. 15, 2002).
    \33\ Pursuant to Homeland Security Presidential Directive 6, dated 
September 16, 2003, the Terrorist Screening Center--under the 
administration of the FBI--was established to develop and maintain the 
U.S. government's consolidated terrorist screening database (the watch 
list) and to provide for the use of watch-list records during security-
related screening processes. The Selectee List contains information on 
individuals who should receive enhanced screening (e.g., additional 
physical screening or a hand-search of carryon baggage) before 
proceeding through the security checkpoint at airports. The No Fly List 
contains information on individuals who should be precluded from 
boarding flights. The No Fly and Selectee lists contain applicable 
records from the FBI Terrorist Screening Center's consolidated database 
of known or appropriately suspected terrorists.

        Second-level review: TSA's Adjudication Center Review. A 
        second-level review is conducted as part of an individual's 
        background check if: (1) the applicant has self-identified 
        themselves to be a non-U.S. citizen or non-U.S.-born citizen or 
        national, or (2) the first-level review uncovers any derogatory 
        information. As such, not all TWIC applicants will be subjected 
        to a second-level review. The second-level review consists of 
        staff at TSA's adjudication center reviewing the applicant's 
        enrollment file.\34\
---------------------------------------------------------------------------
    \34\ If an applicant has asserted him/herself to be a non-U.S. 
citizen or non-U.S.-born citizen, TSA staff at the adjudication center 
are to positively identify the individual by confirming aspects of the 
individual's biographic information, inclusive of their alien 
registration number and other physical descriptors, against available 
databases. For those individuals, TSA requires that at least one of the 
documents provided as proof of identity demonstrates immigration status 
or United States citizenship. According to TWIC officials, the program 
is able to validate immigration status and citizenship-related 
documents required of noncitizens and non-U.S.-born citizens--such as 
certificates of naturalization--with the originating source. For 
individuals with derogatory information, staff at the adjudication 
center reviews each applicant's file to determine if the derogatory 
information accurately applies to the individual or includes 
disqualifying information.

    Card use and compliance: Once a TWIC has been activated and issued, 
the worker may present his or her TWIC to security officials when he or 
she seeks unescorted access to a secure area. Currently, visual 
inspections of TWICs are required for controlling access to secure 
areas of MTSAregulated facilities and vessels.\35\ Approaches for 
inspecting TWICs using biometric readers at individual facilities and 
vessels across the nation are being considered as part of a pilot but 
are not yet required. Pursuant to Coast Guard policy,\36\ Coast Guard 
inspectors are required to verify TWIC cards during annual compliance 
exams, security spot checks, and in the course of other Coast Guard 
duties as determined by the Captain of the Port \37\ based on risk and 
resource availability. The Coast Guard's primary means of verification 
is shifting toward the use of biometric handheld readers with the 
continued deployment of readers to each of its Sectors and Marine 
Safety Units.\38\ As of December 21, 2010, the Coast Guard reports to 
have deployed biometric handheld readers to all of its 35 Sectors and 
16 Marine Safety Units.
---------------------------------------------------------------------------
    \35\ Coast Guard regulations require that such an inspection 
include: (1) a match of the photo on the TWIC to the individual 
presenting the TWIC, (2) verification that the TWIC has not expired, 
and (3) a visual check of the various security features present on the 
card to determine whether the TWIC has been tampered with or forged.
    \36\ See United States Coast Guard, Commandant Instruction Manual 
16601.1: Coast Guard Transportation Worker Identification Credential 
(TWIC) Verification and Enforcement Guide (Washington, D.C.: Oct. 10, 
2008).
    \37\ The Captain of the Port is the Coast Guard officer designated 
by the Commandant to enforce within his or her respective areas port 
safety and security and marine environmental protection regulations, 
including, without limitation, regulations for the protection and 
security of vessels, harbors, and waterfront facilities.
    \38\ Coast Guard Sectors run all Coast Guard missions at the local 
and port levels, such as search and rescue, port security, 
environmental protection, and law enforcement in ports and surrounding 
waters, and oversee a number of smaller Coast Guard units, including 
small cutters and small-boat stations.
---------------------------------------------------------------------------
TWIC Regulations and Cost
    In August 2006, DHS officials decided, based on industry comment, 
to implement TWIC through two separate regulations, or rules. The first 
rule, issued in January 2007, directs the use of the TWIC as an 
identification credential, or flashpass. The second rule, the card 
reader rule, is currently under development and is expected to address 
how the access control technologies, such as biometric card readers, 
are to be used for confirming the identity of the TWIC holder against 
the biometric information on the TWIC. On March 27, 2009, the Coast 
Guard issued an Advance Notice of Proposed Rule Making for the card 
reader rule.\39\
---------------------------------------------------------------------------
    \39\ 74 Fed. Reg. 13360 (2009). An advanced notice of proposed 
rulemaking is published in the Federal Register and contains notices to 
the public of the proposed issuance of rules and regulations. The 
purpose of this advanced notice of proposed rulemaking was to encourage 
the discussion of potential TWIC reader requirements prior to the 
rulemaking process.
---------------------------------------------------------------------------
    To inform the rulemaking process, TSA initiated a pilot in August 
2008, known as the TWIC reader pilot, to test TWIC-related access 
control technologies.\40\ This pilot is intended to test the 
technology, business processes, and operational impacts of deploying 
TWIC readers at secure areas of the marine transportation system. As 
such, the pilot is expected to test the feasibility and functionality 
of using TWICs with biometric card readers within the maritime 
environment. After the pilot has concluded, a report on the findings of 
the pilot is expected to inform the development of the card reader 
rule. DHS currently estimates that a notice of proposed rulemaking will 
be issued late in calendar year 2011 and that the final rule will be 
promulgated no earlier than the end of calendar year 2012.
---------------------------------------------------------------------------
    \40\ The pilot initiation date is based on the first date of 
testing identified in the TWIC pilot schedule. This date is not 
inclusive of time taken for planning the pilot prior to the first test. 
The SAFE Port Act required the pilot to commence no later than 180 days 
after the date of enactment (Oct. 13, 2006) of the SAFE Port Act. See 
GAO-06-982.
---------------------------------------------------------------------------
    According to agency officials, from Fiscal Years 2002 through 2010, 
the TWIC program had funding authority totaling $420 million. In 
issuing the credential rule, DHS estimated that implementing the TWIC 
program could cost the Federal Government and the private sector a 
combined total of between $694.3 million and $3.2 billion over a 10-
year period. However, these figures did not include costs associated 
with implementing and operating readers.\41\ Appendix II contains 
additional program funding details.
---------------------------------------------------------------------------
    \41\ See Transportation Worker Identification Credential (TWIC) 
Implementation in the Maritime Sector; Final Rule, 72 Fed. Reg. 3492, 
3571 (2007).
---------------------------------------------------------------------------
Standards for Internal Control
    Standards for Internal Control in the Federal Government 
underscores the need for developing effective controls for meeting 
program objectives and complying with applicable regulations.\42\ 
Effective internal controls provide for an assessment of the risks the 
agency faces from both internal and external sources. Once risks have 
been identified, they should be analyzed for their possible effect. 
Management then has to decide upon the internal control activities 
required to mitigate those risks and achieve the objectives of 
efficient and effective operations. As part of this effort, management 
should design and implement internal controls based on the related cost 
and benefits.
---------------------------------------------------------------------------
    \42\ GAO/AIMD-00-21.3.1.
---------------------------------------------------------------------------
    In addition, internal control standards highlight the need for the 
following:

   capturing information needed to meet program objectives;

   designing controls to assure that ongoing monitoring occurs 
        in the course of normal operations;

   determining that relevant, reliable, and timely information 
        is available for management decisionmaking purposes;

   conducting reviews and testing of development and 
        modification activities before placing systems into operation;

   recording and communicating information to management and 
        others within the entity who need it and in a form and within a 
        time-frame that enables them to carry out their internal 
        control and other responsibilities; and

   designing internal controls to provide reasonable assurance 
        that compliance with applicable laws and regulations is being 
        achieved, and provide appropriate supervisory review of 
        activities to help provide oversight of operations. This 
        includes designing and implementing appropriate supervisory 
        review activities to help provide oversight and analyzing data 
        to compare trends in actual performance to expected results to 
        identify any areas that may require further inquiries or 
        corrective action.

    Internal control also serves as the first line of defense in 
safeguarding assets and preventing and detecting errors and fraud. An 
internal control weakness is a condition within an internal control 
system worthy of attention. A weakness, therefore, may represent a 
perceived, potential, or real shortcoming, or an opportunity to 
strengthen internal controls to provide a greater likelihood that the 
entity's objectives will be achieved.
Internal Control Weaknesses in DHS's Biometric Transportation ID 
        Program Hinder Efforts to Ensure Security Objectives Are Fully 
        Achieved
    DHS has established a system of TWIC-related processes and 
controls. However, internal control weaknesses governing the 
enrollment, background checking, and use of TWIC potentially limit the 
program's ability to provide reasonable assurance that access to secure 
areas of MTSA-regulated facilities is restricted to qualified 
individuals. Specifically, internal controls \43\ in the enrollment and 
background checking processes are not designed to provide reasonable 
assurance that: (1) only qualified individuals can acquire TWICs; (2) 
adjudicators follow a process with clear criteria for applying 
discretionary authority when applicants are found to have extensive 
criminal convictions; or (3) once issued a TWIC, TWIC holders have 
maintained their eligibility. To meet the stated program mission needs, 
TSA designed TWIC program processes to facilitate the issuance of TWICs 
to maritime workers. However, TSA did not assess the internal controls 
designed and in place to determine whether they provided reasonable 
assurance that the program could meet defined mission needs for 
limiting access to only qualified individuals. Further, internal 
control weaknesses in TWIC enrollment, background checking, and use 
could have contributed to the breach of selected MTSA-regulated 
facilities during covert tests conducted by our investigators.
---------------------------------------------------------------------------
    \43\ In accordance with Standards for Internal Control in the 
Federal Government, the design of the internal controls is to be 
informed by identified risks the program faces from both internal and 
external sources; the possible effect of those risks; control 
activities required to mitigate those risks; and the cost and benefits 
of mitigating those risks.
---------------------------------------------------------------------------
TWIC Program Controls Are Not Designed to Provide Reasonable Assurance 
        That Only Qualified Applicants Can Acquire TWICs
    DHS has established a system of TWIC-related processes and controls 
that as of April 2011 has resulted in TWICs being denied to 1,158 
applicants based on a criminal offense, criminal immigration offense, 
or invalid immigration status.\44\ However, the TWIC program's internal 
controls for positively identifying an applicant, arriving at a 
security threat determination for that individual, and approving the 
issuance of a TWIC, are not designed to provide reasonable assurance 
that only qualified applicants can acquire TWICs.\45\ Assuring the 
identity and qualifications of TWIC-holders are two of the primary 
benefits that the TWIC program is to provide MTSA-regulated facility 
and vessel operators making access control decisions. If an individual 
presents an authentic TWIC acquired through fraudulent means when 
requesting access to the secure areas of a MTSA-regulated facility or 
vessel, the cardholder is deemed not to be a security threat to the 
maritime environment because the cardholder is presumed to have met 
TWIC-related qualifications during a background check. In such cases, 
these individuals could better position themselves to inappropriately 
gain unescorted access to secure areas of a MTSAregulated facility or 
vessel.\46\
---------------------------------------------------------------------------
    \44\ TSA further reports that as of April 2011 there have been 
34,503 cases out of 1,841,122 enrollments, or 1.9 percent of TWIC 
enrollments, where enrollees have not been approved for a TWIC because 
TSA has identified that the enrollees have at least one potentially 
disqualifying criminal offense, criminal immigration offense, or 
invalid immigration status, and the enrollee did not respond to an 
initial determination of threat assessment. Under the TWIC vetting 
process, an applicant that receives an initial determination of threat 
assessment is permitted to provide additional information to respond to 
or challenge the determination, or to request a waiver for the 
disqualifying condition, and subsequently be granted a TWIC.
    \45\ For the purposes of this report, routinely is defined as a 
process being consistently applied in accordance with established 
procedure so as to render consistent results.
    \46\ The TWIC program requires individuals to both hold a TWIC and 
be authorized to be in the secure area by the owner/operator in order 
to gain unescorted access to secure areas of MTSA-regulated facilities 
and vessels.
---------------------------------------------------------------------------
    As confirmed by TWIC program officials, there are ways for an 
unqualified individual to acquire an authentic TWIC. According to TWIC 
program officials, to meet the stated program purpose, TSA's focus in 
designing the TWIC program was on facilitating the issuance of TWICs to 
maritime workers. However, TSA did not assess internal controls prior 
to implementing the program. Further, prior to fielding the program, 
TSA did not conduct a risk assessment of the TWIC program to identify 
program risks and the need for controls to mitigate existing risks and 
weaknesses, as called for by internal control standards. Such an 
assessment could help provide reasonable assurance that control 
weaknesses in one area of the program do not undermine the reliability 
of other program areas or impede the program from meeting mission 
needs. TWIC program officials told us that control weaknesses were not 
addressed prior to initiating the TWIC program because they had not 
previously identified them, or because they would be too costly to 
address. However, officials did not provide documentation to support 
their cost concerns and told us that they did not complete an 
assessment that accounted for whether the program could achieve defined 
mission needs without implementing additional or compensating controls 
to mitigate existing risks, or the risks associated with not correcting 
for existing internal control weaknesses.
    Our investigators conducted covert tests at enrollment center(s) to 
help test the rigor of the TWIC enrollment and background checking 
processes. The investigators fully complied with the enrollment 
application process. They were photographed and fingerprinted, and 
asserted themselves to be U.S.-born citizens.\47\ The investigators 
were successful in obtaining authentic TWIC cards despite going through 
the background-checking process. Not having internal controls designed 
to provide reasonable assurance that the applicant has: (1) been 
positively identified, and (2) met all TWIC eligibility requirements, 
including not posing a security threat to MTSA-regulated facilities and 
vessels, could have contributed to the investigators' successes. 
Specifically, we identified internal control weaknesses in the 
following three areas related to ensuring that only qualified 
applicants are able to obtain a TWIC.
---------------------------------------------------------------------------
    \47\ The details related to the means used by the investors in the 
tests could not be detailed here because they were deemed sensitive 
security information by TSA.
---------------------------------------------------------------------------
    Controls to identify the use of potentially counterfeit identity 
documents are not used to inform background checking processes. As part 
of TWIC program enrollment, a trusted agent is to review identity 
documents for authenticity and use an electronic authentication device 
to assess the likelihood of the document being counterfeit.\48\ 
According to TWIC program officials, the trusted agent's review of TWIC 
applicant identity documents and the assessment provided by the 
electronic authentication device are the two steps intended to serve as 
the primary controls for detecting whether an applicant is presenting 
counterfeit identity documents. Additionally, the electronic device 
used to assess the authenticity of identification credentials renders a 
score on the likelihood of the document being authentic and produces an 
assessment report in support of the score. Assessing whether the 
applicant's credential is authentic is one source of information for 
positively identifying an applicant. Our investigators provided 
counterfeit or fraudulently acquired documents, but they were not 
detected.
---------------------------------------------------------------------------
    \48\ As designed, the TWIC program's enrollment process relies on a 
trusted agent--a contract employee--to collect an applicant's 
identification information. The trusted agent is provided basic 
training on how to detect a fraudulent document. The training, for 
example, consists of checking documents for the presence of a laminate 
that is not peeling, typeset that looks legitimate, and seals on 
certain types of documents.
---------------------------------------------------------------------------
    However, the TWIC program's background checking processes are not 
designed to routinely consider the results of controls in place for 
assessing whether an applicant's identity documents are authentic. For 
example, assessments of document authenticity made by a trusted agent 
or the electronic document authentication device as part of the 
enrollment process are not considered as part of the first-level 
background check. Moreover, TWIC program officials agree that this is a 
program weakness. As of December 1, 2010, approximately 50 percent of 
TWICs were approved after the first-level background check without 
undergoing further review.\49\ As an initial step toward addressing 
this weakness, and in response to our review, TWIC program officials 
told us that since April 17, 2010, the comments provided at enrollment 
by trusted agents have been sent to the Screening Gateway--a TSA system 
for aggregating threat assessment data. However, this change in 
procedure does not correct the internal control weaknesses we 
identified.\50\ Attempts to authenticate copies of documents are 
limited because it is not possible to capture all of the security 
features when copies of the identity documents are recorded, such as 
holograms or color-shifting ink. Using information on the authenticity 
of identity documents captured during enrollment to inform the 
background check could help TSA better assess the reliability and 
authenticity of such documents provided at enrollment.
---------------------------------------------------------------------------
    \49\ Of the 1,697,160 enrollments approved for a TWIC, 852,540 were 
approved using TSA's automated process as part of the first-level 
background check without undergoing further review.
    \50\ Details from this section were removed because the agency 
deemed them sensitive security information.
---------------------------------------------------------------------------
    Controls related to the legal status of self-reported U.S.-born 
citizens or nationals.\51\ The TWIC program does not require that 
applicants claiming to be U.S.-born citizens or nationals provide 
identity documents that demonstrate proof of citizenship, or lawful 
status in the United States. See appendix III for the list of documents 
U.S.-born citizens or nationals must select from and present when 
applying for a TWIC.\52\ For example, an applicant could elect to 
provide one document, such a U.S. passport, which, according to TSA 
officials, serves as proof of U.S. citizenship or proof of nationality. 
However, an applicant could elect to submit documents that do not 
provide proof of citizenship. As of December 1, 2010, nearly 86 percent 
of approved TWIC enrollments were by self-identified United States 
citizens or nationals asserting that they were born in the United 
States or a United States territory.\53\
---------------------------------------------------------------------------
    \51\ National means a citizen of the United States or a noncitizen 
owing permanent allegiance to the United States. In general, U.S.-born 
nationals who are not U.S. citizens at birth are individuals born in an 
outlying possession of the United States. Details from this section 
were removed because the agency deemed them sensitive security 
information.
    \52\ Various identity documents can be provided by U.S.-born 
citizens or nationals when applying for a TWIC. For certain documents, 
such as an unexpired U.S. passport, TSA requires one document as a 
proof of identity. For other documents, such as a Department of 
Transportation Medical Card or United States Military Dependents 
Identification Card, TSA requires that TWIC applicants provide two 
identity documents from a designated list, with one being a government-
issued photo identification.
    \53\ As of December 1, 2010, TSA reported that 1,697,160 TWIC 
enrollments have been approved, of which 1,457,337 were self-identified 
United States citizens or nationals asserting that they were born in 
the United States or in a United States territory.
---------------------------------------------------------------------------
    Verifying a U.S.-born citizen's identity and related lawful status 
can be costly and is a challenge faced by U.S. Government programs such 
as passports.\54\ However, reaching an accurate determination of a TWIC 
applicant's potential security threat in meeting TWIC mission needs is 
dependant on positively identifying the applicant. Given such potential 
cost constraints, consistent with internal control standards, 
identifying alternative mechanisms to positively identify individuals 
to the extent that the benefits exceed the costs and TWIC program 
mission needs are met could enhance TSA's ability to positively 
identify individuals and reduce the likelihood that criminals or 
terrorists could acquire a TWIC fraudulently.
---------------------------------------------------------------------------
    \54\ See GAO, State Department: Significant Vulnerabilities in the 
Passport Issuance Process, GAO-09-681T (Washington, D.C.: May 5, 2009) 
and State Department: Improvements Needed to Strengthen U.S. Passport 
Fraud Detection Efforts, GAO-05-477 (Washington, D.C.: May 20, 2005).
---------------------------------------------------------------------------
    Controls are not in place to determine whether an applicant has a 
need for a TWIC.\55\ Regulations governing the TWIC program security 
threat assessments require applicants to disclose their job description 
and location(s) where they will most likely require unescorted access, 
if known, and the name, telephone number, and address of the 
applicant's current employer(s) if the applicant works for an employer 
that requires a TWIC.\56\ However, TSA enrollment processes do not 
require that this information be provided by applicants. For example, 
when applying for a TWIC, applicants are to certify that they may need 
a TWIC as part of their employment duties. However, the enrollment 
process does not request information on the location where the 
applicant will most likely require unescorted access, and enrollment 
processes include asking the applicant if they would like to provide 
employment information, but informing the applicant that employer 
information is not required.
---------------------------------------------------------------------------
    \55\ TWIC is unlike other federally-sponsored access control 
credentials, such as the Department of Defense's Common Access Card--
the agencywide standard identification card--for which sponsorship by 
an employer is required. For these Federal credentialing programs, 
employer sponsorship begins with the premise that an individual is 
known to need certain access as part of their employment. Further, the 
employing agency is to conduct a background investigation on the 
individual and has access to other personal information, such as prior 
employers, places of residency, and education, which they may confirm 
as part of the employment process and use to establish the individual's 
identity.
    \56\ Implementing regulations at 49 C.F.R.  1572.17 require that 
when applying for or renewing a TWIC, the applicant provide, among 
other information: (1) the reason that the applicant requires a TWIC, 
including, as applicable, the applicant's job description and the 
primary facility, vessel, or maritime port location(s) where the 
applicant will most likely require unescorted access, if known; (2) the 
name, telephone number, and address of the applicant's current 
employer(s) if the applicant works for an employer that requires a 
TWIC; and (3) if the applicant works for an employer that does not 
require possession of a TWIC, does not have a single employer, or is 
self-employed, the primary vessel or port location(s) where the 
applicant requires unescorted access, if known. The regulation states 
that this information is required to establish eligibility for a TWIC 
and that TSA is to review the applicant information as part of the 
intelligence-related check.
---------------------------------------------------------------------------
    While not a problem prior to implementing the TWIC program, 
according to TSA officials, a primary reason for not requiring employer 
information be captured by applicant processes is that many applicants 
do not have employers, and that many employers will not accept 
employment applications from workers who do not already have a TWIC. 
However, TSA could not provide statistics on: (1) how many individuals 
applying for TWICs were unemployed at the time of their application; or 
(2) a reason why the TWIC-related regulation does not prohibit 
employers from denying employment to non-TWIC holders who did not 
previously have a need for a TWIC. Further, according to TSA and Coast 
Guard officials, industry was opposed to having employment information 
verified as part of the application process, as industry 
representatives believed such checks would be too invasive and time-
consuming. TSA officials further told us that confirming this 
information would be too costly.
    We recognize that implementing mechanisms to capture this 
information could be time-consuming and involve additional costs. 
However, collecting information on present employers or operators of 
MTSA-regulated facilities and vessels to be accessed by the applicant, 
to the extent that the benefits exceed the costs and TWIC program 
mission needs are met, could help ensure TWIC program mission needs are 
being met, and serve as a barrier to individuals attempting to acquire 
an authentic TWIC through fraudulent means. Therefore, if TSA 
determines that implementing such mechanisms are, in fact, cost 
prohibitive, identifying and implementing appropriate compensating 
controls could better position TSA to positively identify the TWIC 
applicant. Not taking any action increases the risk that individuals 
could gain unescorted access to secure areas of MTSAregulated 
facilities and vessels.
    As of September 2010, TSA's background checking process had 
identified no instances of nonimmigration-related document or identity 
fraud. This is in part because of previously discussed weaknesses in 
TWIC program controls for positively identifying applicants, and the 
systems and procedures the TWIC program relies on not being designed to 
effectively monitor for such occurrences, in accordance with internal 
control standards. Though not an exhaustive list, through a review of 
Coast Guard reports and publicly available court records, we identified 
five court cases where the court documents indicate that illegal 
immigrants acquired, or in one of the cases sought to acquire, an 
authentic TWIC through fraudulent activity such as providing fraudulent 
identity information and, in at least one of the cases and potentially 
up to four, used the TWIC to access secure areas of MTSA-regulated 
facilities. Four of these cases were a result of, or involved, United 
States Immigration and Customs Enforcement efforts after individuals 
had acquired, or sought to acquire, a TWIC. As of September 2010, the 
program's background checking process identified 18 instances of 
potential fraud out of the approximately 1,676,000 TWIC enrollments. 
These instances all involved some type of fraud related to 
immigration.\57\ The 18 instances of potential fraud were identified 
because the 18 individuals asserted themselves to be non-U.S.- born 
applicants and, unlike processes in place for individuals asserting to 
be U.S.-born citizens, TSA's background checking process includes 
additional controls to validate such individuals' identities. For 
example, TSA requires that at least one of the documents provided by 
such individuals at enrollment show proof of their legal status and 
seeks to validate each non-U.S.-born applicant's identity with the U.S. 
Citizenship and Immigration Services.
---------------------------------------------------------------------------
    \57\ According to TSA, as of September 8, 2010, a total of 18 TWIC 
applicants were issued an Initial Determination of Threat Assessment 
for invalid immigration documents. Upon submission to the U.S. 
Citizenship and Immigration Services, the documentation was reported to 
be altered or counterfeit. Of these 18 instances, only 1 applicant 
submitted additional documentation following an Initial Determination 
of Threat Assessment to challenge TSA's determination. The single 
applicant was subsequently awarded a TWIC.
---------------------------------------------------------------------------
    Internal control standards highlight the need for capturing 
information needed to meet program objectives; ensuring that relevant, 
reliable, and timely information is available for management 
decisionmaking purposes; and providing reasonable assurance that 
compliance with applicable laws and regulations is being achieved.\58\ 
Conducting a control assessment of the TWIC program's processes to 
address existing weaknesses could enhance the TWIC program's ability to 
prevent and detect fraud and positively identify TWIC applicants. Such 
an assessment could better position DHS in strengthening the program to 
ensure it achieves its objectives in controlling access to MTSA-
regulated facilities and vessels.
---------------------------------------------------------------------------
    \58\ GAO/AIMD-00-21.3.1.
---------------------------------------------------------------------------
TWIC Program Controls Are Not Designed to Require Adjudicators to 
        Follow a 
        Process with Clear Criteria for Applying Discretionary 
        Authority When 
        Applicants Are Found to Have Extensive Criminal Convictions
    Being convicted of a felony does not automatically disqualify a 
person from being eligible to receive a TWIC; however, prior 
convictions for certain crimes are automatically disqualifying. Threat 
assessment processes for the TWIC program include conducting background 
checks to determine whether each TWIC applicant poses a security 
threat.\59\ Some of these offenses, such as espionage or treason, would 
permanently disqualify an individual from obtaining a TWIC. Other 
offenses, such as murder or the unlawful possession of an explosive 
device, while categorized as permanent disqualifiers, are also eligible 
for a waiver under TSA regulations and might not permanently disqualify 
an individual from obtaining a TWIC if TSA determines upon subsequent 
review that an applicant does not represent a security threat.\60\ 
Table 1 presents examples of disqualifying criminal offenses set out in 
statute and implementing regulations for consideration as part of the 
adjudication process.
---------------------------------------------------------------------------
    \59\ These checks, in general, can include checks for criminal 
history records, immigration status, terrorism databases and 
watchlists, and records indicating an adjudication of a lack of mental 
capacity, among other things. As defined in TSA implementing 
regulations, the term security threat means an individual whom TSA 
determines or suspects of posing a threat to national security; to 
transportation security; or of terrorism. 49 C.F.R.  1570.3.
    \60\ These permanent disqualifying offenses for which no waiver can 
be issued include espionage, sedition, treason, a Federal crime of 
terrorism, or conspiracy to commit any of these offenses.

------------------------------------------------------------------------

    Table 1.--Examples of Disqualifying Offenses for TWIC Eligibility
------------------------------------------------------------------------
       Permanent         Permanent disqualifying   Interim disqualifying
disqualifying offenses    offenses  that can be          offenses c
           a                     waived b
------------------------------------------------------------------------
Espionage               Murder                     Bribery
Sedition                Unlawful possession, use,  Smuggling
Treason                  sale, distribution,       Arson
A federal crime of       manufacture, purchase,    Extortion
terrorism                receipt, transfer,        Robbery
                         shipping, transporting,
                         import, export, storage
                         of, or dealing in an
                         explosive or explosive
                         device
                        A crime involving a
                         transportation security
                         incident
                        Making any threat
                         concerning the
                         deliverance, placement,
                         or detonation of an
                         explosive or other
                         lethal device in or
                         against a place of
                         public use, a state or
                         government facility, a
                         public transportation
                         system, or an
                         infrastructure facility
------------------------------------------------------------------------
Source: GAO analysis of regulations and TSA.
Notes: See appendix IV for a list of all disqualifying offenses.
a Permanent disqualifying offenses are offenses defined in 49 C.F.R.
  1572.103(a) for which no waiver can be granted under 49 C.F.R.
  1515.7(a)(i).
b Permanent disqualifying offenses that can be waived are offenses
  defined in 49 C.F.R. 1572.103(a) for which a waiver can be granted in
  accordance with 49 C.F.R. 1515.7(a)(i). Applicants with certain
  permanent criminal offenses and all interim disqualifying criminal
  offenses may request a waiver of their disqualification. TSA
  regulations provide that in determining whether to grant a waiver, TSA
  will consider: (1) the circumstances of the disqualifying act or
  offense; (2) restitution made by the applicant; (3) any Federal or
  state mitigation remedies; (4) court records or official medical
  release documents indicating that the applicant no longer lacks mental
  capacity; and (5) other factors that indicate the applicant does not
  pose a security threat warranting denial of a hazardous materials
  endorsement or TWIC.
c Interim disqualifying offenses are offenses defined in 49 C.F.R.
  1572.103(b) for which the applicant has either been: (1) convicted, or
  found not guilty by reason of insanity, within a 7-year period
  preceding the TWIC application, or (2) incarcerated for within a 5-
  year period preceding the TWIC application.

    TSA also has the authority to add to or modify the list of interim 
disqualifying crimes. Further, in determining whether an applicant 
poses a security threat, TSA officials stated that adjudicators have 
the discretion to consider the totality of an individual's criminal 
record, including criminal offenses not defined as a permanent or 
interim disqualifying criminal offenses, such as theft or larceny.\61\ 
More specifically, TSA's implementing regulations provide, in part, 
that with respect to threat assessments, TSA may determine that an 
applicant poses a security threat if the search conducted reveals 
extensive foreign or domestic criminal convictions, a conviction for a 
serious crime not listed as a permanent or interim disqualifying 
offense, or a period of foreign or domestic imprisonment that exceeds 
365 consecutive days. Thus, if a person was convicted of multiple 
crimes, even if each of the crimes were not in and of themselves 
disqualifying, the number and type of convictions could be 
disqualifying.
---------------------------------------------------------------------------
    \61\ The U.S. government's Adjudicative Desk Reference, used in 
adjudicating security clearances, states that multiple criminal 
offenses indicate intentional continuing behavior that raises serious 
questions about a person's trustworthiness and judgment.
---------------------------------------------------------------------------
    Although TSA has the discretion and authority to consider criminal 
offenses not defined as a disqualifying offense, such as larceny and 
theft, and periods of imprisonment, TSA has not developed a definition 
for what extensive foreign or domestic criminal convictions means, or 
developed guidance to ensure that adjudicators apply this authority 
consistently in assessing the totality of an individual's criminal 
record. For example, TSA has not developed guidance or benchmarks for 
adjudicators to consistently apply when reviewing TWIC applicants with 
extensive criminal convictions but no disqualifying offense. This is 
particularly important given TSA's reasoning for including this 
authority in TWICrelated regulation. Specifically, TSA noted that it 
understands that the flexibility this language provides must be used 
cautiously and on the basis of compelling information that can 
withstand judicial review. They further noted that the decision to 
determine whether an applicant poses a threat under this authority is 
largely a subjective judgment based on many facts and circumstances.
    While TSA does not track metrics on the number of TWICs provided to 
applicants with specific criminal offenses not defined as disqualifying 
offenses, as of September 8, 2010, the agency reported 460,786 cases 
where the applicant was approved, but had a criminal record based on 
the results from the FBI. This represents approximately 27 percent of 
individuals approved for a TWIC at the time. In each of these cases, 
the applicant had either a criminal offense not defined as a 
disqualifying offense or an interim disqualifying offense that was no 
longer a disqualification based on conviction date or the applicant's 
release date from incarceration. Consequently, based on TSA's 
background checking procedures, all of these cases would have been 
reviewed by an adjudicator for consideration as part of the second-
level background check because derogatory information had been 
identified. As such, each of these cases had to be examined and a 
judgment had to be made as to whether to deny an applicant a TWIC based 
on the totality of the offenses contained in each applicant's criminal 
report.
    While there were 460,786 cases where the applicant was approved, 
but had a criminal record, TSA reports to have taken steps to deny 1 
TWIC applicant under this authority. However, in the absence of 
guidance for the application of this authority, it is not clear how TSA 
applied this authority in approving the 460,786 applications and 
denying the 1. Internal control standards call for controls and other 
significant events to be clearly documented in directives, policies, or 
manuals to help ensure operations are carried out as intended.
    According to TSA officials, the agency has not implemented guidance 
for adjudicators to follow on how to apply this discretion in a 
consistent manner because they are confident that the adjudicators 
would, based on their own judgment, identify all applicants where the 
authority to deny a TWIC based on the totality of all offenses should 
be applied. However, in the absence of criteria, we were unable to 
analyze or compare how the approximately 30 adjudicators who are 
assigned to the TWIC program at any given time made determinations 
about TWIC applicants with extensive criminal histories. Given that 27 
percent of TWIC holders have been convicted of at least one 
nondisqualifying offense, defining what extensive criminal convictions 
means and developing guidance or criteria for how adjudicators should 
apply this discretionary authority could help provide TSA with 
reasonable assurance that applications are consistently adjudicated. 
Defining terms and developing guidance is consistent with internal 
control standards.
TWIC Program Controls Are Not Designed to Provide Reasonable Assurance 
        That TWIC Holders Have Maintained Their Eligibility Once Issued 
        TWICs
    DHS's defined mission needs for TWIC include identifying 
individuals who fail to maintain their eligibility requirements once 
issued a TWIC, and immediately revoking the individual's card 
privileges. Pursuant to TWICrelated regulations, an individual may be 
disqualified from holding a TWIC and be required to surrender the TWIC 
to TSA for failing to meet certain eligibility criteria related to, for 
example, terrorism, crime, and immigration status. However, weaknesses 
exist in the design of the TWIC program's internal controls for 
identifying individuals who fail to maintain their eligibility that 
make it difficult for TSA to provide reasonable assurance that TWIC 
holders continue to meet all eligibility requirements.
    Controls are not designed to determine whether TWIC holders have 
committed disqualifying crimes at the Federal or state level after 
being granted a TWIC. TSA conducts a name-based check of TWIC holders 
against Federal wants \62\ and warrants on an ongoing basis. According 
to FBI and TSA officials, policy and statutory provisions hamper the 
program from running the broader FBI fingerprint-based check using the 
fingerprints collected at enrollment on an ongoing basis. More 
specifically, because the TWIC background check is considered to be for 
a noncriminal justice purpose,\63\ to conduct an additional 
fingerprint-based check as part of an ongoing TWIC background check, 
TSA would have to collect a new set of fingerprints from the TWIC-
holder,\64\ if the prints are more than 1 year old, and submit those 
prints to the FBI each time they want to assess the TWIC-holder's 
criminal history. According to TSA officials, it would be cost 
prohibitive to run the fingerprint-based check on an ongoing basis, as 
TSA would have to pay the FBI $17.25 per check.
---------------------------------------------------------------------------
    \62\ Federal wants generally consist of information on wanted 
persons, or individuals, for whom Federal warrants are outstanding.
    \63\ Under the National Crime Prevention and Privacy Compact Act of 
1998 (Pub. L. No. 105- 251, 112 Stat. 1870, 1874 (1998) (codified as 
amended at 42 U.S.C.  14601-14616)), which established an 
infrastructure by which states and other specified parties can exchange 
criminal records for noncriminal justice purposes authorized under 
Federal or state law, the term noncriminal justice purposes means uses 
of criminal history records for purposes authorized by Federal or state 
law other than purposes relating to criminal justice activities, 
including employment suitability, licensing determinations, immigration 
and naturalization matters, and national security clearances.
    \64\ Under the 1998 Act, subject fingerprints or other approved 
forms of positive identification must be submitted with all requests 
for criminal history record checks for noncriminal justice purposes.
---------------------------------------------------------------------------
    Although existing policies may hamper TSA's ability to check FBI-
held fingerprint-based criminal history records for the TWIC program, 
TSA has not explored alternatives for addressing this weakness, such as 
informing facility and port operators of this weakness and identifying 
solutions for leveraging existing state criminal history information, 
where available. For instance, state maritime organizations may have 
other mechanisms at their disposal for helping to identify TWIC-holders 
who may no longer meet TWIC qualification requirements. Specifically, 
laws governing the maritime environment in New York and New Jersey 
provide for credentialing authorities being notified if licensed or 
registered longshoremen have been arrested. Further, other governing 
entities, such as the State of Florida and the Alabama State Port 
Authority, have access to state-based criminal records checks. While 
TSA may not have direct access to criminal history records, TSA could 
compensate for this control weakness, for example, by leveraging 
existing mechanisms available to maritime stakeholders across the 
country to better ensure that only qualified individuals retain TWICs.
    Controls are not designed to provide reasonable assurance that TWIC 
holders continue to meet immigration status eligibility requirements. 
If a TWIC holder's stated period of legal presence in the United States 
is about to expire or has expired, the TWIC program does not request or 
require proof from TWIC holders to show that they continue to maintain 
legal presence in the United States. Additionally, although they have 
the regulatory authority to do so, the program does not issue TWICs for 
a term less than 5 years to match the expiration of a visa. Instead, 
TSA relies on: (1) TWIC holders to self-report if they no longer have 
legal presence in the country, and (2) employers to report if a worker 
is no longer legally present in the country.\65\ As we have previously 
reported, government programs for granting benefits to individuals face 
challenges in confirming an individual's immigration status.\66\ TWIC 
program officials stated that the program uses a United States 
Citizenship and Immigration Services system during the background 
checking process prior to issuing a TWIC as a method for confirming the 
legal status of non-U.S. citizens.\67\ TSA has not, however, consistent 
with internal control standards, implemented alternative controls to 
compensate for this limitation and provide reasonable assurance that 
TWIC holders remain eligible. For instance, the TWIC program has not 
compensated for this limitation by: (1) using its authority to issue 
TWICs with shorter expiration dates to correspond with each 
individual's legal presence, or (2) updating the TWIC system to 
systematically suspend TWIC privileges for individuals who no longer 
meet immigration eligibility requirements until they can provide 
evidence of continued legal presence.\68\
---------------------------------------------------------------------------
    \65\ TWIC-related regulations provide, for example, that 
individuals disqualified from holding a TWIC for immigration status 
reasons must surrender the TWIC to TSA. In addition, the regulations 
provide that TWICs are deemed to have expired when the status of 
certain lawful nonimmigrants with a restricted authorization to work in 
the United States (e.g., H-1B1 Free Trade Agreement) expires, the 
employer terminates the employment relationship with such an applicant, 
or such applicant otherwise ceases working for the employer, regardless 
of the date on the face of the TWIC. Upon the expiration of such 
nonimmigrant status for an individual who has a restricted 
authorization to work in the United States, the employer and employee 
both have related responsibilities--the employee is required to 
surrender the TWIC to the employer, and the employer is required to 
retrieve the TWIC and provide it to TSA. According to TSA officials, 
the TWIC program could not provide a count of the total number of TWIC 
holders whose employers reported that the TWIC holders no longer have 
legal status, as they do not track this information.
    \66\ See, for example, GAO, EmploymentVerification: Federal 
Agencies Have Taken Steps to Improve E-Verify, but Significant 
Challenges Remain, GAO-11-146 (Washington, D.C.: Dec. 17, 2010), and 
Immigration Enforcement: Weaknesses Hinder Employment Verification and 
Worksite Enforcement Efforts, GAO-05-813 (Washington, D.C.: Aug. 31, 
2005).
    \67\ Details from this section were removed because the agency 
deemed them sensitive security information.
    \68\ The TWIC program accepts various documents, such as visas, 
Interim Employment Authorizations, and form I-94 Arrival and Departure 
Records, as evidence of legal presence in the United States.
---------------------------------------------------------------------------
    TWIC program officials stated that implementing these compensating 
measures would be too costly, but they have not conducted an assessment 
to identify the costs of implementing these controls, or determined if 
the benefits of mitigating related security risks would outweigh those 
costs, consistent with internal control standards. Not implementing 
such measures could result in a continued risk of individuals no longer 
meeting TWIC legal presence requirements continuing to hold a federally 
issued identity document and gaining unescorted access to secure areas 
of MTSAregulated facilities and vessels.\69\ Thus, implementing 
compensating measures, to the extent that the benefits outweigh the 
costs and meet the program's defined mission needs, could provide TSA, 
the Coast Guard, and MTSA-regulated stakeholders with reasonable 
assurance that each TWIC holder continues to meet TWIC-related 
eligibility requirements.
---------------------------------------------------------------------------
    \69\ TWIC is a federally issued identity document that can be used 
as proof of identity for nonmaritime activities, such as boarding 
airplanes at United States airports and certain Department of Defense 
facilities in accordance with Department of Defense policy, Directive-
Type Memorandum (DTM) 09-012, ``Interim Policy Guidance for DOD 
Physical Access Control,'' dated December 8, 2009.
---------------------------------------------------------------------------
Internal Control Weaknesses in TWIC Enrollment, Background Checking, 
        and Use Could Have Contributed to Breach of MTSA-Regulated 
        Ports
    As of January 7, 2011, the Coast Guard reports that it has 
identified 11 known attempts to circumvent TWIC requirements for 
gaining unescorted access to MTSA-regulated areas by presenting 
counterfeit TWICs. The Coast Guard further reports to have identified 4 
instances of individuals presenting another person's TWIC as their own 
in attempts to gain access. Further, our investigators conducted covert 
tests to assess the use of TWIC as a means for controlling access to 
secure areas of MTSA-regulated facilities. During covert tests of TWIC 
at several selected ports, our investigators were successful in 
accessing ports using counterfeit TWICs, authentic TWICs acquired 
through fraudulent means, and false business cases (i.e., reasons for 
requesting access).\70\ Our investigators did not gain unescorted 
access to a port where a secondary port specific identification was 
required in addition to the TWIC.
---------------------------------------------------------------------------
    \70\ Existing vulnerabilities with TWIC to date have included, for 
example, problems with deteriorating TWIC card security features. Cards 
fading and delaminating have been reported by stakeholders across the 
country from places such as New York, Virginia, Texas, and California, 
with a range of climate conditions. According to stakeholders, these 
problems make it difficult for security guards to distinguish an 
authentic TWIC that is faded from a fraudulent TWIC. TSA and the Coast 
Guard have also received reports of problems with the card's chip or 
antenna connection not working from locations where TWICs are being 
used with readers. The total number of damaged TWICs with a damaged 
chip or antenna is unknown because TWICs are not required to be used 
with readers.
---------------------------------------------------------------------------
    In response to our covert tests, TSA and Coast Guard officials 
stated that, while a TWIC card is required for gaining unescorted 
access to secure areas of a MTSA-regulated facility, the card alone is 
not sufficient. These officials stated that the cardholder is also 
required to present a business case, which security officials at 
facilities must consider as part of granting the individual access. In 
addition, according to DHS's Screening Coordination Office, a 
credential is only one layer of a multilayer process to increase 
security. Other layers of security might include onsite law 
enforcement, security personnel, cameras, locked doors and windows, 
alarm systems, gates, and turnstiles. Thus, a weakness in the 
implementation of TWIC will not guarantee access to the secure areas of 
a MTSA-regulated port or facility.
    However, as our covert tests demonstrated, having an authentic TWIC 
and a legitimate business case were not always required in practice. 
The investigators' possession of TWIC cards provided them with the 
appearance of legitimacy and facilitated their unescorted entry into 
secure areas of MTSA-regulated facilities and ports at multiple 
locations across the country. If individuals are able to acquire 
authentic TWICs fraudulently, verifying the authenticity of these cards 
with a biometric reader will not reduce the risk of undesired 
individuals gaining unescorted access to the secure areas of MTSA-
regulated facilities and vessels.
    Given existing internal control weaknesses, conducting a control 
assessment of the TWIC program's processes to address existing 
weaknesses could enhance the TWIC program's ability to prevent and 
detect fraud and positively identify TWIC applicants. Such an 
assessment could better position DHS in strengthening the program to 
ensure it achieves its objectives in controlling unescorted access to 
MTSA-regulated facilities and vessels. It could also help DHS identify 
and implement the minimum controls needed to: (1) positively identify 
individuals, (2) provide reasonable assurance that control weaknesses 
in one area of the program would not undermine the reliability of other 
program areas or impede the program from meeting mission needs, and (3) 
provide reasonable assurance that the threat assessments are based on 
complete and accurate information. Such actions would be consistent 
with internal control standards, which highlight the need for capturing 
information needed to meet program objectives; determining that 
relevant, reliable, and timely information is available for management 
decision-making purposes; and designing internal controls to provide 
reasonable assurance that compliance with applicable laws and 
regulations is being achieved, as part of implementing effective 
controls. Moreover, our prior work on internal controls has shown that 
management should design and implement internal controls based on the 
related costs and benefits and continually assess and evaluate its 
internal controls to assure that the controls being used are effective 
and updated when necessary.\71\
---------------------------------------------------------------------------
    \71\ GAO/AIMD-00-21.3.1.
---------------------------------------------------------------------------
TWIC's Effectiveness at Enhancing Security Has Not BeenAssessed, and 
        the Coast Guard Lacks the Ability to Assess Trends in TWIC 
        Compliance
    The TWIC program is intended to improve maritime security by using 
a federally sponsored credential to enhance access controls to secure 
areas at MTSA-regulated facilities and vessels, but DHS has not 
assessed the program's effectiveness at enhancing security. In 
addition, Coast Guard's approach for monitoring and enforcing TWIC 
compliance nationwide could be improved by enhancing its collection and 
assessment of related maritime security information. For example, the 
Coast Guard tracks TWIC program compliance, but the processes involved 
in the collection, cataloguing, and querying of information cannot be 
relied on to produce the management information needed to assess trends 
in compliance with the TWIC program or associated vulnerabilities.
TWIC Has Not Been Assessed to Measure Effectiveness at Enhancing 
        Security
    DHS asserted in its 2009 and 2010 budget submissions that the 
absence of the TWIC program would leave America's critical maritime 
port facilities vulnerable to terrorist activities.\72\ However, to 
date, DHS has not assessed the effectiveness of TWIC at enhancing 
security or reducing risk for MTSA-regulated facilities and vessels. 
Such assessments are consistent with DHS's National Infrastructure 
Protection Plan, which recognizes that metrics and other evaluation 
procedures should be used to measure progress and assess the 
effectiveness of programs designed to protect key assets.\73\ Further, 
DHS has not demonstrated that TWIC, as currently implemented and 
planned with readers, is more effective than prior approaches used to 
limit access to ports and facilities, such as using facility specific 
identity credentials with business cases. According to TSA and Coast 
Guard officials, because the program was mandated by Congress as part 
of MTSA, DHS did not conduct a risk assessment to identify and mitigate 
program risks prior to implementation. Further, according to these 
officials, neither the Coast Guard nor TSA analyzed the potential 
effectiveness of TWIC in reducing or mitigating security risk--either 
before or after implementation--because they were not required to do so 
by Congress. Rather, DHS assumed that the TWIC program's enrollment and 
background checking procedures were effective and would not allow 
unqualified individuals to acquire and retain authentic TWICs.
---------------------------------------------------------------------------
    \72\ See DHS, DHS Exhibit 300 Public Release BY10/TSA--
Transportation Worker Identification Credentialing (TWIC) (Washington, 
D.C.: Apr. 17, 2009) and DHS Exhibit 300 Public Release BY09/TSA--
Transportation Worker Identification Credentialing (TWIC) (Washington, 
D.C.: July 27, 2007).
    \73\ DHS, National Infrastructure Protection Plan: Partnering to 
Enhance Protection and Resiliency (Washington, D.C.: 2009). The NIPP, 
first issued in June 2006 by DHS, established a six-step risk 
management framework to establish national priorities, goals, and 
requirements for Critical Infrastructure and Key Resources (CIKR) 
protection so that Federal funding and resources are applied in the 
most effective manner to deter threats, reduce vulnerabilities, and 
minimize the consequences of attacks and other incidents. The NIPP 
states that comprehensive risk assessments are necessary for 
determining which assets or systems face the highest risk, for 
prioritizing risk mitigation efforts and the allocation of resources, 
and for effectively measuring how security programs reduce risks.
---------------------------------------------------------------------------
    The internal control weaknesses that we discuss earlier in the 
report, as well as the results of our covert tests of TWIC use, raise 
questions about the effectiveness of the TWIC program. According to the 
Coast Guard official responsible for conducting assessments of maritime 
risk, it may now be possible to assess TWIC effectiveness and the 
extent to which, or if, TWIC use could enhance security using current 
Maritime Security Risk Analysis Model (MSRAM) data. Since MSRAM's 
deployment in 2005, the Coast Guard has used its MSRAM to help inform 
decisions on how to best secure our nation's ports and how to best 
allocate limited resources to reduce terrorist risks in the maritime 
environment.\74\ Moreover, as we have previously reported, Congress 
also needs information on whether and in what respects a program is 
working well or poorly to support its oversight of agencies and their 
budgets, and agencies' stakeholders need performance information to 
accurately judge program effectiveness.\75\ Conducting an effectiveness 
assessment that evaluates whether use of TWIC in its present form and 
planned use with readers would enhance the posture of security beyond 
efforts already in place given costs and program risks could better 
position DHS and policymakers in determining the impact of TWIC on 
enhancing maritime security.
---------------------------------------------------------------------------
    \74\ The Coast Guard uses MSRAM to assess risk for various types of 
vessels and port infrastructure in accordance with the guidance on 
assessing risk from DHS's National Infrastructure Protection Plan 
(NIPP). The Coast Guard uses the analysis tool to help implement its 
strategy and concentrate maritime security activities when and where 
relative risk is believed to be the greatest. The model assesses the 
risk--threats, vulnerabilities, and consequences--of a terrorist attack 
based on different scenarios; that is, it combines potential targets 
with different means of attack, as recommended by the risk assessment 
aspect of the NIPP. Also in accordance with the NIPP, the model is 
designed to support decisionmaking for the Coast Guard. At the national 
level, the model's results are used, among other things, for 
identifying capabilities needed to combat future terrorist threats.
    \75\ GAO, Executive Guide: Effectively Implementing the Government 
Performance and Results Act, GAO/GGD-96-118 (Washington, D.C.: June 
1996).
---------------------------------------------------------------------------
    Further, pursuant to Executive Branch requirements, prior to 
issuing a new regulation, agencies are to conduct a regulatory 
analysis, which is to include an assessment of costs, benefits, and 
associated risks.\76\ Prior to issuing the regulation on implementing 
the use of TWIC as a flashpass, DHS conducted a regulatory analysis, 
which asserted that TWIC would increase security. The analysis included 
an evaluation of the costs and benefits related to implementing TWIC. 
However, DHS did not conduct a risk-informed cost-benefit analysis that 
considered existing security risks. For example, the analysis did not 
account for the costs and security risks associated with designing 
program controls to prevent an individual from acquiring an authentic 
TWIC using a fraudulent identity and limiting access to secure areas of 
MTSA-regulated facilities and vessels to those with a legitimate need, 
in accordance with stated mission needs. As a proposed regulation on 
the use of TWIC with biometric card readers is under development, DHS 
is to issue a new regulatory analysis. Conducting a regulatory analysis 
using the information from the internal control and effectiveness 
assessments as the basis for evaluating the costs, benefits, security 
risks, and needed corrective actions could better inform and enhance 
the reliability of the new regulatory analysis. Moreover, these actions 
could help DHS identify and assess the full costs and benefits of 
implementing the TWIC program in a manner that will meet stated mission 
needs and mitigate existing security risks, and help ensure that the 
TWIC program is more effective and cost-efficient than existing 
measures or alternatives at enhancing maritime security.
---------------------------------------------------------------------------
    \76\ Office of Management and Budget, Circular A-4, Regulatory 
Analysis (Revised Sept. 17, 2003) provides guidance to Federal agencies 
on the development of regulatory analysis as required by Executive 
Order 12866 of September 30, 1993, as amended by Executive Order 13258 
of February 26, 2002, and Executive Order 13422 of January 18, 2007, 
``Regulatory Planning and Review.'' According to Executive Order 12866, 
agencies should adhere to certain specified principles, such as: (1) 
with respect to setting regulatory priorities, each agency shall 
consider, to the extent reasonable, the degree and nature of the risks 
posed by various substances or activities within its jurisdiction, and 
(2) each agency shall base its decisions on the best reasonably 
obtainable scientific, technical, economic, and other information 
concerning the need for, and consequences of, the intended regulation. 
According to Circular A-4, a regulatory analysis should include the 
following three basic elements: (1) a statement of the need for the 
proposed action, (2) an examination of alternative approaches, and (3) 
an evaluation of the benefits and costs--quantitative and qualitative--
of the proposed action and the main alternatives identified by the 
action. The evaluation of benefits and costs is to be informed by a 
risk assessment.
---------------------------------------------------------------------------
Coast Guard's Approach for Monitoring and Enforcing TWIC Compliance 
        Could Be Improved by Enhancing Its Collection and Assessment of 
        Maritime Security 
        Information
    Internal control standards state that: (1) internal controls should 
be designed to ensure that ongoing monitoring occurs in the course of 
normal operations, and (2) information should be communicated in a form 
and within a time-frame that enables management to carry out its 
internal control responsibilities.\77\ Further, our prior work has 
stated that Congress also needs information on whether and in what 
respects a program is working well or poorly to support its oversight 
of agencies and their budgets, and agencies' stakeholders need 
performance information to accurately judge program effectiveness.\78\ 
The Coast Guard uses its Marine Information for Safety and Law 
Enforcement (MISLE) database to meet these needs by recording 
activities related to MTSA-regulated facility and vessel oversight, 
including observations of TWIC-related deficiencies.\79\ The purpose of 
MISLE is to provide the capability to collect, maintain, and retrieve 
information necessary for the administration, management, and 
documentation of Coast Guard activities. In February 2008, we reported 
that flaws in the data in MISLE limit the Coast Guard's ability to 
accurately portray and appropriately target oversight activities.\80\
---------------------------------------------------------------------------
    \77\ See GAO/AIMD-00-21.3.1.
    \78\ See GAO/GGD-96-118.
    \79\ MISLE began operating in December 2001 and is the Coast 
Guard's primary data system for documenting facility oversight and 
other activities.
    \80\ We recommended that, among other things, the Coast Guard 
assess MISLE compliance data, including the completeness of the data, 
data entry, consistency, and data field problems, and make any changes 
needed to more effectively use MISLE data. DHS concurred with this 
recommendation. The Coast Guard acknowledged the need for improvement 
in MISLE compliance data and has taken initial steps to reduce some of 
the database concerns identified in our previous work. However, as of 
January 2011, the recommendation has not been fully addressed. See GAO, 
Maritime Security: Coast Guard Inspections Identify and Correct 
Facility Deficiencies, but More Analysis Needed of Program's Staffing, 
Practices, and Data, GAO-08-12 (Washington, D.C.: Feb. 14, 2008).
---------------------------------------------------------------------------
    In accordance with Coast Guard policy, Coast Guard inspectors are 
required to verify TWIC cards during annual compliance exams and 
security spot checks, and may do so in the course of other Coast Guard 
duties. As part of each inspection, Coast Guard inspectors are, among 
other things, to: (1) ensure that the card is authentic by examining it 
to visually verify that it has not been tampered with; (2) verify 
identity by comparing the photograph on the card with the TWIC holder 
to ensure a match; (3) check the card's physical security features; and 
(4) ensure the TWIC is valid--a check of the card's expiration date. 
Additionally, Coast Guard inspectors are to assess the proficiency of 
facility and vessel security personnel in complying with TWIC 
requirements through various means including oral examination, actual 
observation, and record review. Coast Guard inspectors randomly select 
workers to check their TWICs during inspections. The number of TWIC 
cards checked is left to the discretion of the inspectors.
    As of December 17, 2010, according to Coast Guard data, 2,135 
facilities have undergone at least 2 MTSA inspections as part of annual 
compliance exams and spot checks. In reviewing the Coast Guard's 
records of TWICrelated enforcement actions, we found that, in addition 
to verifying the number of inspections conducted, the Coast Guard is 
generally positioned to verify that TWIC cards are being checked by 
Coast Guard inspectors and, of the card checks that are recorded, the 
number of cardholders who are compliant and noncompliant. For instance, 
the Coast Guard reported inspecting 129,464 TWIC holders' cards from 
May 2009 through January 6, 2011. The Coast Guard reported that 124,203 
of the TWIC holders, or 96 percent, were found to be compliant--
possessed a valid TWIC.\81\ However, according to Coast Guard 
officials, local Coast Guard inspectors may not always or consistently 
record all inspection attempts. Consequently, while Coast Guard 
officials told us that inspectors verify TWICs as part of all security 
inspections, the Coast Guard could not reliably provide the number of 
TWICs checked during each inspection.
---------------------------------------------------------------------------
    \81\ These numbers represent a combination of visual and electronic 
verifications because the TWIC verification window in MISLE is not 
currently designed to capture whether cards are verified visually or 
electronically. According to Coast Guard officials, with the recent 
deployment of handheld readers to Coast Guard units, the Coast Guard is 
in the process of enhancing MISLE to include the ability to distinguish 
between the number of visual inspections of cards and the number of 
verifications conducted using the handheld readers.
---------------------------------------------------------------------------
    Since the national compliance deadline in April 2009 requiring TWIC 
use at MTSA-regulated facilities and vessels, the Coast Guard has not 
identified major concerns with TWIC implementation nationally. However, 
while the Coast Guard uses MISLE to track program compliance, because 
of limitations in the MISLE system design, the processes involved in 
the collection, cataloguing, and querying of information cannot be 
relied upon to produce the management information needed to assess 
trends in compliance with the TWIC program or associated 
vulnerabilities. For instance, when inspectors document a TWIC card 
verification check, the system is set up to record the number of TWICs 
reviewed for different types of workers and whether the TWIC holders 
are compliant or noncompliant. However, other details on TWIC-related 
deficiencies, such as failure to ensure that all facility personnel 
with security duties are familiar with all relevant aspects of the TWIC 
program and how to carry them out, are not recorded in the system in a 
form that allows inspectors or other Coast Guard officials to easily 
and systematically identify that a deficiency was related to TWIC. For 
example, from January 2009 through December 2010, the Coast Guard 
reported issuing 145 enforcement actions as a result of annual 
compliance exams or security spot checks at the 2,135 facilities that 
have undergone the inspections.\82\ These included 57 letters of 
warning, 40 notices of violation, 32 civil penalties, and 16 operations 
controls (suspension or restriction of operations). However, it would 
be labor-intensive for the Coast Guard to identify how many of the 57 
letters of warning or 40 notices of violation were TWIC related, 
according to a Coast Guard official responsible for TWIC compliance, 
because there is not an existing query designed to extract this 
information from the system. Someone would have to manually review each 
of the 97 inspection reports in the database indicating either a letter 
of warning or a notice of violation to verify whether or not the 
deficiencies were TWIC related. As such, the MISLE system is not 
designed to readily provide information that could help management 
measure and assess the overall level of compliance with the TWIC 
program or existing vulnerabilities.
---------------------------------------------------------------------------
    \82\ According to the Coast Guard, 2,509 facilities are subject to 
MTSA and must actively implement TWIC provisions.
---------------------------------------------------------------------------
    According to a Coast Guard official responsible for TWIC 
compliance, Coast Guard headquarters staff has not conducted a trend 
analysis of the deficiencies found during reviews and inspections and 
there are no other analyses they planned to conduct regarding 
enforcement until after readers are required to be used. According to 
the Coast Guard, it can generally identify the number of TWICs checked 
and recorded in the MISLE system. However, it cannot perform trend 
analysis of the deficiencies as it would like to do, as it requires 
additional information. In the interim, as of January 7, 2011, the 
Coast Guard reported deploying 164 handheld biometric readers 
nationally to units responsible for conducting inspections.\83\ These 
handheld readers are intended to be the Coast Guard's primary means of 
TWIC verification. During inspections, Coast Guard inspectors use the 
card readers to electronically check TWICs in three ways: (1) 
verification--a biometric one-to-one match of the fingerprint; (2) 
authentication--electronically confirming that the certificates on the 
credential are authentic; and (3) validation--electronically check the 
card against the ``hotlist'' of invalid or revoked cards. The Coast 
Guard believes that the use of these readers during inspections will 
greatly improve the effectiveness of enforcement efforts and enhance 
record keeping through the use of the readers' logs.
---------------------------------------------------------------------------
    \83\ The Coast Guard estimated a need for 300 handheld biometric 
readers, based on an estimate of 5 readers for each of the Coast 
Guard's major field inspections units across the country.
---------------------------------------------------------------------------
    As a result of limitations in MISLE design and the collection and 
recording of inspection data, it will be difficult for the Coast Guard 
to identify trends nationwide in TWIC-related compliance, such as 
whether particular types of facilities or a particular region of the 
country have greater levels of noncompliance, on an ongoing basis. 
Coast Guard officials acknowledged these deficiencies and reported that 
they are in the process of making enhancements to the MISLE database 
and plan to distribute updated guidance on how to collect and input 
information into MISLE to the Captains of the Port. However, as of 
January 2011, the Coast Guard had not yet set a date for implementing 
these changes. Further, while this is a good first step, these 
enhancements do not address weaknesses related to the collection 
process and querying of MISLE information so as to facilitate the Coast 
Guard performing trend analysis of the deficiencies as part of its 
compliance reviews. By designing and implementing a cost-effective and 
practical method for collecting, cataloging, and querying TWIC-related 
compliance information, the Coast Guard could be better positioned to 
identify and assess TWIC-related compliance and enforcement trends, and 
to obtain management information needed to assess and understand 
existing vulnerabilities with the use of TWIC.
Conclusions
    As the TWIC program continues on the path to full implementation--
with potentially billions of dollars needed to install TWIC card 
readers in thousands of the Nation's ports, facilities, and vessels at 
stake--it is important that Congress, program officials, and maritime 
industry stakeholders fully understand the program's potential benefits 
and vulnerabilities, as well as the likely costs of addressing these 
potential vulnerabilities. Identified internal control weaknesses and 
vulnerabilities include weaknesses in controls related to preventing 
and detecting identity fraud, assessing the security threat that 
individuals with extensive criminal histories pose prior to issuing a 
TWIC, and ensuring that TWIC holders continue to meet program 
eligibility requirements. Thus, conducting an internal control 
assessment of the program by analyzing controls, identifying related 
weaknesses and risks, and determining cost-effective actions to correct 
or compensate for these weaknesses could better position DHS to provide 
reasonable assurance that control weaknesses do not impede the program 
from meeting mission needs.
    In addition, conducting an effectiveness assessment could help 
provide reasonable assurance that the use of TWIC enhances the posture 
of security beyond efforts already in place or identify the extent to 
which TWIC may possibly introduce security vulnerabilities because of 
the way it has been designed and implemented. This assessment, along 
with the internal controls assessment, could be used to enhance the 
regulatory analysis to be conducted as part of implementing a 
regulation on the use of TWIC with readers. More specifically, 
considering identified security risks and needed corrective actions as 
part of the regulatory analysis could provide insights on the full 
costs and benefits of implementing the TWIC program in a manner that 
will meet stated mission needs and mitigate existing security risks. 
This is important because, unlike prior access control approaches which 
allowed access to a specific facility, the TWIC potentially facilitates 
access to thousands of facilities once the Federal Government attests 
that the TWIC holder has been positively identified and is deemed not 
to be a security threat. Further, doing so as part of the regulatory 
analysis could better assure DHS, Congress, and maritime stakeholders 
that TWIC program security objectives will be met. Finally, by 
designing and implementing a cost-effective and practical method for 
collecting, cataloging, and querying TWIC-related compliance 
information, the Coast Guard could be better positioned to identify 
trends and to obtain management information needed to assess and 
understand existing vulnerabilities with the use of TWIC.
Recommendations for Executive Action
    To identify effective and cost-efficient methods for meeting TWIC 
program objectives, and assist in determining whether the benefits of 
continuing to implement and operate the TWIC program in its present 
form and planned use with readers surpass the costs, we recommend that 
the Secretary of Homeland Security take the following four actions:

   Perform an internal control assessment of the TWIC program 
        by: (1) analyzing existing controls, (2) identifying related 
        weaknesses and risks, and (3) determining cost-effective 
        actions needed to correct or compensate for those weaknesses so 
        that reasonable assurance of meeting TWIC program objectives 
        can be achieved. This assessment should consider weaknesses we 
        identified in this report among other things, and include:

     strengthening the TWIC program's controls for preventing 
            and detecting identity fraud, such as requiring certain 
            biographic information from applicants and confirming the 
            information to the extent needed to positively identify the 
            individual, or implementing alternative mechanisms to 
            positively identify individuals;

     defining the term extensive criminal history for use in 
            the adjudication process and ensuring that adjudicators 
            follow a clearly defined and consistently applied process, 
            with clear criteria, in considering the approval or denial 
            of a TWIC for individuals with extensive criminal 
            convictions not defined as permanent or interim 
            disqualifying offenses; and

     identifying mechanisms for detecting whether TWIC holders 
            continue to meet TWIC disqualifying criminal offense and 
            immigration-related eligibility requirements after TWIC 
            issuance to prevent unqualified individuals from retaining 
            and using authentic TWICs.

   Conduct an effectiveness assessment that includes addressing 
        internal control weaknesses and, at a minimum, evaluates 
        whether use of TWIC in its present form and planned use with 
        readers would enhance the posture of security beyond efforts 
        already in place given costs and program risks.

   Use the information from the internal control and 
        effectiveness assessments as the basis for evaluating the 
        costs, benefits, security risks, and corrective actions needed 
        to implement the TWIC program in a manner that will meet stated 
        mission needs and mitigate existing security risks as part of 
        conducting the regulatory analysis on implementing a new 
        regulation on the use of TWIC with biometric card readers.

   Direct the Commandant of the Coast Guard to design effective 
        methods for collecting, cataloguing, and querying TWIC-related 
        compliance issues to provide the Coast Guard with the 
        enforcement information needed to assess trends in compliance 
        with the TWIC program and identify associated vulnerabilities.
Agency Comments and Our Evaluation
    We provided a draft of the sensitive version of this report to the 
Secretary of Homeland Security for review and comment on March 18, 
2011. DHS provided written comments on behalf of the Department, the 
Transportation Security Administration, and the United States Coast 
Guard, which are reprinted in full in appendix IV. In commenting on our 
report, DHS stated that it concurred with our four recommendations and 
identified actions planned or under way to implement them.
    While DHS did not take issue with the results of our work, DHS did 
provide new details in its response that merit additional discussion. 
First, DHS noted that it is working to strengthen controls around 
applicant identity verification in TWIC, but that document fraud is a 
vulnerability to credential-issuance programs across the Federal 
Government, state and local governments, and the private sector. DHS 
further noted that a governmentwide infrastructure does not exist for 
information sharing across all entities that issue documents that other 
programs, such as TWIC, use to positively authenticate an individual's 
identity. We acknowledge that such a government-wide infrastructure 
does not exist, and, as discussed in our report, recognize that there 
are inherent weaknesses in relying on identity documents alone to 
confirm an individual's identity. However, positively identifying 
individuals--or confirming their identity--and determining their 
eligibility for a TWIC is a key stated program goal. Issuing TWICs to 
individuals without positively identifying them and subsequently 
assuring their eligibility could, counter to the program's intent, 
create a security vulnerability. While we recognize that additional 
costs could be imposed by requiring positive identification checks, 
taking actions to strengthen the existing identity authentication 
process, such as only accepting documents that TSA can and does confirm 
to be authentic with the issuing agency, and verifying an applicant's 
business need, could enhance TWIC program efforts to prevent and detect 
identity fraud and enhance maritime security.
    Second, DHS stated that it is working to continually verify TWIC-
holder eligibility after issuance but also noted the limitations in the 
current process. While TSA does receive some criminal history records 
information when it sends fingerprints to the FBI, the information is 
not provided recurrently, nor is the information necessarily complete. 
DHS stated that to provide the most robust recurrent vetting against 
criminal records, TSA would need access to additional state and Federal 
systems, and have additional authority to do so. As we reported, FBI 
and TWIC officials stated that because the TWIC background check is 
considered to be for a noncriminal justice purpose, policy and 
statutory provisions hamper the program from running the broader FBI 
fingerprint-based check using the fingerprints collected at enrollment 
on an ongoing basis. However, we continue to believe that TSA could 
compensate for this weakness by leveraging existing mechanisms 
available to maritime stakeholders. For example, other governing 
entities--such as the Alabama State Port Authority--that have an 
interest in ensuring the security of the maritime environment, might be 
willing to establish a mechanism for independently sharing relevant 
information when warranted. Absent efforts to leverage available 
information sources, TSA may not be successful in tempering existing 
limitations.
    Lastly, DHS sought clarification on the reporting of our 
investigators' success at breaching security at ports during covert 
testing. Specifically, in its comments, DHS noted that it believes that 
our report's focus on access to port areas rather than access to 
individual facilities can be misleading. DHS noted that we do not 
report on the number of facilities that our investigators attempted to 
gain access to within each port area. DHS stated that presenting the 
breaches in terms of the number of port areas breached rather than the 
number of facilities paints a more troublesome picture of the actual 
breaches that occurred. We understand DHS's concern but continue to 
believe that the results of our investigators' work, as reported, 
fairly and accurately represents the results and significance of the 
work conducted. The goal of the covert testing was to assess whether or 
not weaknesses exist at ports with varying characteristics across the 
nation, not to define the pervasiveness of existing weaknesses by type 
of facility, volume, or other characteristic. Given the numerous 
differences across facilities and the lack of publicly available 
information and related statistics for each of the approximately 2,509 
MTSA-regulated facilities, we identified covert testing at the port 
level to be the proper unit of analysis for our review and reporting 
purposes. Conducting a detailed assessment of the pervasiveness of 
existing weaknesses by type of facility, volume, or other 
characteristics as suggested by DHS would be a more appropriate tasking 
for the Coast Guard as part of its continuing effort to ensure 
compliance with TWIC-related regulations.
    In addition, with regard to covert testing, DHS further commented 
that the report does not distinguish among breaches in security using a 
counterfeit TWIC or an authentic TWIC card obtained with fraudulent 
documents. DHS noted that because there is no ``granularity'' with the 
report as to when a specific card was used, one can be left with the 
unsupported impression that individual facilities in all cases were 
failing to implement TWIC visual inspection requirements. For the above 
noted reason, we did not report on the results of covert testing at the 
facility level. However, our records show that use of counterfeit TWICs 
was successful for gaining access to more than one port where our 
investigators breached security. Our investigators further report that 
security officers never questioned the authenticity of TWICs presented 
for acquiring access. Our records show that operations at the locations 
our investigators breached included cargo, containers, and fuel, among 
others.
    In addition, TSA provided written technical comments, which we 
incorporated into the report, as appropriate.
    We are sending copies of this report to the Secretary of Homeland 
Security, the Assistant Secretary for the Transportation Security 
Administration, the Commandant of the United States Coast Guard, and 
appropriate congressional committees. In addition, this report is 
available at no charge on the GAO website at http://www.gao.gov.
    If you or your staff have any questions about this report, please 
contact me.

                                            Stephen M. Lord
                     Director, Homeland Security and Justice Issues
List of Requesters
    The Honorable John D. Rockefeller, IV
    Chairman
    Committee on Commerce, Science, and Transportation
    U.S. Senate

    The Honorable Susan M. Collins
    Ranking Member
    Committee on Homeland Security and Governmental Affairs
    U.S. Senate

    The Honorable John L. Mica
    Chairman
    Committee on Transportation and Infrastructure
    House of Representatives

    The Honorable Bennie G. Thompson
    Ranking Member
    Committee on Homeland Security
    House of Representatives

    The Honorable Frank R. Lautenberg
    Chairman
    Subcommittee on Surface Transportation and Merchant Marine 
Infrastructure, Safety, and Security
    Committee on Commerce, Science, and Transportation
    U.S. Senate

    The Honorable Olympia J. Snowe
    Ranking Member
    Subcommittee on Oceans, Atmosphere, Fisheries, and Coast Guard
    Committee on Commerce, Science, and Transportation
    U.S. Senate

    The Honorable Frank A. LoBiondo
    Chairman
    Subcommittee on Coast Guard and Maritime Transportation
    Committee on Transportation and Infrastructure
    House of Representatives

    The Honorable Mike Rogers
    Chairman
    Subcommittee on Transportation Security
    Committee on Homeland Security
    House of Representatives

    The Honorable Candice S. Miller
    Chairwoman
    Subcommittee on Border and Maritime Security
    Committee on Homeland Security
    House of Representatives
                                 ______
                                 
          Appendix I: Key Steps in the TWIC Enrollment Process
    Transportation workers are enrolled by providing biographic 
information, such as name, date of birth, and address, and proof of 
identity documents, and then photographed and fingerprinted at 1 of 
approximately 149 enrollment centers by trusted agents. A trusted agent 
is a member of the TWIC team who has been authorized by the Federal 
Government to enroll transportation workers in the TWIC program and 
issue TWIC cards. Trusted agents are subcontractor staff acquired by 
Lockheed Martin as part of its support contract with TSA for the TWIC 
program. Table 2 below summarizes key steps in the enrollment process.

------------------------------------------------------------------------

                Table 2.--TWIC Enrollment Process Summary
------------------------------------------------------------------------

------------------------------------------------------------------------
1.                                 The TWIC applicant fills out a TWIC
                                    Application and Disclosure Form and
                                    affirms that the information he or
                                    she is providing to TSA is truthful.
2.                                 The applicant is required to present
                                    documentation to establish his or
                                    her identity to the trusted agent at
                                    the enrollment center. The
                                    documentation required is dependant
                                    upon the applicant's legal presence
                                    in the United States or whether the
                                    applicant was born in the United
                                    States.
3.                                 The trusted agent (government
                                    contractor) captures the applicant's
                                    biographic information, such as name
                                    and date of birth, in the TWIC
                                    system. This can be done in various
                                    ways, such as by scanning
                                    fingerprints and certain identity
                                    documents or by manually typing
                                    information into the system.
4.                                 The trusted agent reviews the
                                    identity documents to establish and
                                    confirm the applicant's identity and
                                    to confirm the documents'
                                    authenticity by reviewing the
                                    physical security features on the
                                    documents.
5.                                 The trusted agent scans the identity
                                    documents to record a digital image
                                    of the applicant's identity
                                    information.
6.                                 The trusted agent uses a machine-
                                    readable document scanning device to
                                    assess the risk of certain documents
                                    being fraudulent. Not all documents
                                    can be assessed using this device.
7.                                 The applicant's 10 fingerprints
                                    (where available) are captured in
                                    the system. The presence of
                                    nonsuitable fingerprints or lack of
                                    a finger for biometric use is
                                    documented in the system by the
                                    trusted agent.
8.                                 The applicant's digital picture is
                                    taken.
9.                                 The enrollment record is completed,
                                    encrypted, and is forwarded by the
                                    trusted agent to undergo the TWIC
                                    program's background checking
                                    procedures.
------------------------------------------------------------------------
Source: GAO analysis of the TWIC program enrollment process and
  documentation.

                                 ______
                                 
                   Appendix II: TWIC Program Funding
    According to TSA and Federal Emergency Management Agency (FEMA) 
program officials, from Fiscal Year 2002 through 2010, the TWIC program 
had funding authority totaling $420 million. Through Fiscal Year 2009, 
$111.5 million in appropriated funds, including reprogramming and 
adjustments, had been provided to TWIC (see table 3 below). An 
additional $196.8 million in funding was authorized from Fiscal Years 
2008 through 2010 through the collection of TWIC enrollment fees by 
TSA, and $111.7 million had been made available to maritime facilities 
implementing TWIC from FEMA grant programs--the Port Security Grant 
Program and the Transit Security Grant Program--from Fiscal Years 2006 
through 2010. In addition, industry has spent between approximately 
$185.7 million and $234 million to purchase 1,765,110 TWICs as of 
January 6, 2011.\1\ The costs for implementing the TWIC program, as 
estimated by TSA for informing the regulation on requiring the use of 
TWIC as an identification credential, is from $694.3 million to $3.2 
billion over a 10-year period. This estimate includes the costs related 
to purchasing TWICs and visually inspecting them. However, this 
estimate does not include the costs related to implementing TWIC with 
biometric card readers or related access control systems.\2\
---------------------------------------------------------------------------
    \1\ Range based on a reduced fee of $105.25 per TWIC for workers 
with current, comparable background checks or a $132.50 fee per TWIC 
for those without.
    \2\ See Transportation Worker Identification Credential (TWIC) 
Implementation in the Maritime Sector; Final Rule, 72 Fed. Reg. 3492, 
3571 (2007).

----------------------------------------------------------------------------------------------------------------

                       Table 3.--TWIC Program Funding from Fiscal Years 2002 through 2010
                                               Dollars in millions
----------------------------------------------------------------------------------------------------------------
                                                                             Federal security
 Fiscal year   Appropriated     Reprogramming     Adjustments    TWIC fee      grant awards      Total funding
                                                               authority a  related to TWIC b      authority
----------------------------------------------------------------------------------------------------------------
2002                       0                  0             0            0                  0                  0
----------------------------------------------------------------------------------------------------------------
2003                    $5.0                  0           $20            0                  0              $25.0
----------------------------------------------------------------------------------------------------------------
2004                   $49.7                  0             0            0                  0              $49.7
----------------------------------------------------------------------------------------------------------------
2005                    $5.0                  0             0            0                  0               $5.0
----------------------------------------------------------------------------------------------------------------
2006                       0              $15.0             0            0              $24.3              $39.3
----------------------------------------------------------------------------------------------------------------
2007                       0               $4.0          $4.7            0            $31.5 c              $40.2
----------------------------------------------------------------------------------------------------------------
2008                    $8.1                  0             0        $42.5              $18.0              $68.6
----------------------------------------------------------------------------------------------------------------
2009                       0                  0             0       $109.3            $22.2 d             $131.5
----------------------------------------------------------------------------------------------------------------
2010                       0                  0             0        $45.0              $15.7              $60.7
----------------------------------------------------------------------------------------------------------------
Total                  $67.8              $19.0         $24.7       $196.8             $111.7               $420
----------------------------------------------------------------------------------------------------------------
Source: GAO analysis of TWIC program funding reported by TSA and FEMA.
a Figures in the TWIC fee authority column represent the dollar amount TSA is authorized to collect from TWIC
  enrollment fees and not the actual dollars collected. TSA reports to have collected $41.7 million for Fiscal
  Year 2008, $76.2 million for Fiscal Year 2009, and $30.6 million for Fiscal Year 2010.
b According to FEMA, many of these awards are issued as cooperative agreements and, as such, the scope and
  amounts may change as the project(s) proceed. Also, FEMA has not received projects from all grant recipients
  so the total number of projects may increase slightly over time.
c Federal security grant funding subtotal for Fiscal Year 2007 includes $19.2 million in Fiscal Year Port
  Security Grant Program funding, $10.8 million in supplemental funding, and $1.5 million in Transit Security
  Grant Program funding.
d Federal security grant funding subtotal for Fiscal Year 2009 includes $3.9 million in Fiscal Year Port
  Security Grant Program funding and an additional $18.3 million in American Recovery and Reinvestment Act of
  2009 (Pub. L. No. 111-5, 123 Stat. 115 (2009)) funding.

                                 ______
                                 
 Appendix III: List of Documents U.S.-Born Citizens or Nationals Must 
            Select from to Present When Applying for a TWIC
    TWIC applicants who are citizens of the United States (or its 
outlying possessions) and were born inside the United States (or its 
outlying possessions), must provide one document from list A or two 
documents from list B. If two documents from list B are presented, at 
least one of them must be a government-issued photo identification, 
such as a state-issued driver's license, military ID card, or state 
identification card.
List A

   Unexpired United States passport book or passport card

   Unexpired Merchant Mariner Document

   Unexpired Free and Secure Trade Card \1\
---------------------------------------------------------------------------
    \1\ The Free and Secure Trade (FAST) Card is to be issued to 
approved commercial drivers to facilitate the travel of low-risk 
screened shipments across the borders between the U.S.-Canadian border 
and to the U.S. from Mexico.

   Unexpired NEXUS Card \2\
---------------------------------------------------------------------------
    \2\ The NEXUS card can be used as an alternative to the passport 
for air, land, and sea travel into the United States for U.S. and 
Canadian citizens. The NEXUS program allows prescreened travelers 
expedited processing by United States and Canadian officials at 
dedicated processing lanes at designated northern border ports of 
entry, at NEXUS kiosks at Canadian Preclearance airports, and at marine 
reporting locations.

   Unexpired Secure Electronic Network for Travelers Rapid 
        Inspection Card
List B

   Unexpired driver's license issued by a state or outlying 
        possession of the United States

   Unexpired identification card issued by a state or outlying 
        possession of the United States. Must include a state or state 
        agency seal or logo (such as state port authority 
        identification or state university identification)

   Original or certified copy of birth certificate issued by a 
        state, county, municipal authority, or outlying possession of 
        the United States bearing an official seal

   Voter's registration card

   United States military identification card or United States 
        retired military identification

   United States military dependent's card

   Expired United States passport (within 12 months of 
        expiration)

   Native American tribal document (with photo)

   United States Social Security card

   United States military discharge papers (DD-214)

   Department of Transportation medical card

   United States civil marriage certificate

   Unexpired Merchant Mariner License bearing an official 
        raised seal, or a certified copy

   Unexpired Department of Homeland Security/Transportation 
        Security Administration Transportation Worker Identification 
        Credential Card

   Unexpired Merchant Mariner Credential
                                 ______
                                 
  Appendix IV: Criminal Offenses That May Disqualify Applicants from 
                            Acquiring a TWIC
    Listed below are criminal offenses that can prevent TWIC applicants 
from being issued a TWIC. Pursuant to TSA implementing regulations, 
permanent disqualifying offenses are offenses defined in 49 C.F.R. 
1572.103(a). Permanent disqualifying offenses that can be waived are 
those offenses defined in 49 C.F.R. 1572.103(a) for which a waiver can 
be granted in accordance with 49 C.F.R. 1515.7(a)(i). Interim 
disqualifying offenses are offenses defined in 49 C.F.R. 1572.103(b) 
for which the applicant has either been: (1) convicted, or found not 
guilty by reason of insanity, within a 7-year period preceding the TWIC 
application, or (2) incarcerated for within a 5-year period preceding 
the TWIC application. Applicants with certain permanent criminal 
offenses and all interim disqualifying criminal offenses may request a 
waiver of their disqualification. In general, TSA may issue such a 
waiver and grant a TWIC if TSA determines that an applicant does not 
pose a security threat based upon the security threat assessment.
    Permanent disqualifying criminal offenses for which no waiver may 
be granted.

        1. Espionage, or conspiracy to commit espionage.

        2. Sedition, or conspiracy to commit sedition.

        3. Treason, or conspiracy to commit treason.

        4. A Federal crime of terrorism as defined in 18 U.S.C. 
        2332b(g), or comparable state law, or conspiracy to commit such 
        crime.

    Permanent disqualifying criminal offenses for which a waiver may be 
granted.

        1. A crime involving a transportation security incident. A 
        transportation security incident is a security incident 
        resulting in a significant loss of life, environmental damage, 
        transportation system disruption, or economic disruption in a 
        particular area, as defined in 46 U.S.C.  70101. The term 
        economic disruption does not include a work stoppage or other 
        employee-related action not related to terrorism and resulting 
        from an employer-employee dispute.

        2. Improper transportation of a hazardous material under 49 
        U.S.C.  5124, or a state law that is comparable.

        3. Unlawful possession, use, sale, distribution, manufacture, 
        purchase, receipt, transfer, shipping, transporting, import, 
        export, storage of, or dealing in an explosive or explosive 
        device. An explosive or explosive device includes, but is not 
        limited to, an explosive or explosive material as defined in 18 
        U.S.C.  232(5), 841(c) through 841(f), and 844(j); and a 
        destructive device, as defined in 18 U.S.C.  921(a)(4) and 26 
        U.S.C.  5845(f).

        4. Murder.

        5. Making any threat, or maliciously conveying false 
        information knowing the same to be false, concerning the 
        deliverance, placement, or detonation of an explosive or other 
        lethal device in or against a place of public use, a state or 
        government facility, a public transportations system, or an 
        infrastructure facility.

        6. Violations of the Racketeer Influenced and Corrupt 
        Organizations Act, 18 U.S.C. 1961, et seq. , or a comparable 
        state law, where one of the predicate acts found by a jury or 
        admitted by the defendant, consists of one of the crimes listed 
        in paragraph 49 C.F.R.  1572.103(a).

        7. Attempt to commit the crimes in paragraphs listed under 49 
        C.F.R.  1572.103(a)(1) through (a)(4).

        8. Conspiracy or attempt to commit the crimes in 49 C.F.R.  
        1572.103(a)(5) through (a)(10).

    The interim disqualifying felonies.

        1. Unlawful possession, use, sale, manufacture, purchase, 
        distribution, receipt, transfer, shipping, transporting, 
        delivery, import, export of, or dealing in a firearm or other 
        weapon. A firearm or other weapon includes, but is not limited 
        to, firearms as defined in 18 U.S.C.  921(a)(3) or 26 U.S.C.  
        5845(a), or items contained on the United States Munitions 
        Import List at 27 CFR  447.21.

        2. Extortion.

        3. Dishonesty, fraud, or misrepresentation, including identity 
        fraud and money laundering where the money laundering is 
        related to a crime described in 49 C.F.R.  1572.103(a) or (b). 
        Welfare fraud and passing bad checks do not constitute 
        dishonesty, fraud, or misrepresentation for purposes of this 
        paragraph.

        4. Bribery.

        5. Smuggling.

        6. Immigration violations.

        7. Distribution of, possession with intent to distribute, or 
        importation of a controlled substance.

        8. Arson.

        9. Kidnapping or hostage taking.

        10. Rape or aggravated sexual abuse.

        11. Assault with intent to kill.

        12. Robbery.

        13. Fraudulent entry into a seaport as described in 18 U.S.C.  
        1036, or a comparable state law.

        14. Violations of the Racketeer Influenced and Corrupt 
        Organizations Act, 18 U.S.C.  1961, et seq., or a comparable 
        state law, other than the violations listed in paragraph 49 
        C.F.R.  1572.103(a)(10).

        15. Conspiracy or attempt to commit the interim disqualifying 
        felonies.
                                 ______
                                 
       Appendix V: Comparison of Authentic and Counterfeit TWICs
    Figure 1: Comparison of Authentic and Counterfeit TWICs
    Details from this section were removed because the agency deemed 
them to be sensitive security information.
                                 ______
                                 
     Appendix VI: Comments from the Department of Homeland Security
                       U.S. Department or Homeland Security
                                        Washington, DC, May 5, 2011
Mr. Stephen M. Lord,
Director, Homeland Security and Justice Issues,
U.S. Government Accountability Office,
Washington, DC.

Dear Mr. Lord:

Re: GAO-11-657, Draft Report, Transportation Worker Identification 
            Credential: Internal Control Weaknesses Need to be 
            Corrected to Help Achieve Security Objectives

    Thank you for the opportunity to review and comment on this draft 
report. The U.S. Department of Homeland Security (DHS) appreciates the 
U.S. Government Accountability Office's (GAO's) work in planning and 
conducting its review and issuing this report.
    Transportation Worker Identification Credential (TWIC) is a vital 
security program that is jointly administered by the U.S. Coast Guard 
(USCG) and the Transportation Security Administration (TSA). TSA is 
responsible for enrollment, vetting, and card production, with the 
support of the U.S. Citizenship and Immigration Services, while the 
USCG governs access control requirements and has primary responsibility 
for enforcement. As of March 2011, TSA has enrolled and vetted more 
than 1.8 million maritime workers. As a result of DHS's rigorous 
vetting process, 35,661 individuals were denied from receiving a TWIC. 
DHS agrees that more work is needed to strengthen existing security 
controls and has begun efforts to address many of the GAO's findings.
DHS Increasing Applicant Identity Verification Controls
    DHS is working to strengthen controls around applicant identity 
verification in TWIC, knowing that document fraud is a vulnerability to 
credential-issuance programs across Federal, state, and local 
governments, and the private sector. To establish identity and proof-
of-citizenship, TWIC leverages documents issued by multiple Federal, 
state, and local entities. However, a government-wide infrastructure 
does not exist for information sharing across all entities that issue 
the breeder documents that relying parties use to positively 
authenticate an identity. TWIC follows best practices to mitigate the 
risks from not having visibility or control of the physical 
characteristics or the issuance process for these documents. 
Specifically. TWIC uses document authentication readers and requires 
fraudulent document training of its Trusted Agents as safeguards 
against document fraud.
    TWIC will benefit from national efforts to strengthen identity 
documents. For example, DHS continues to work with the states to 
implement the requirements of the REAL ID Act for more secure driver's 
licenses, as well as the underlying issuance processes and procedures. 
Furthermore, efforts are underway in the Federal Government, state 
vital records agencies, and departments of motor vehicles to enhance 
security related to core breeder documents. such as birth certificates, 
which would assist in positive authentication.
    TSA is also actively engaged with the DHS's United States Visitor 
and Immigrant Status Indicator Technology (US-VISIT) program to include 
TWIC applicant data into the US-VISIT database, referred to as IDENT. 
Biometrics placed in IDENT are linked to specific biographic 
information, enabling a person's identity to be established and then 
verified by the U.S. Government.
    TWIC is also strengthening safeguards against cards being misused 
after issuance. An upcoming USCG rulemaking will include a requirement 
for electronic verification of the TWIC card through use of card 
readers. The use of electronic readers will provide the port or 
facility authority in charge of access control decisions with a higher 
level of assurance that the TWIC presented is authentic, valid (not 
revoked), and unexpired.
DHS Working to Continually Verify TWIC Holder Eligibility after 
        Issuance
    DHS strongly agrees on the value of recurrent vetting. DHS is 
making progress in the effort to reasonably assure that TWIC holders 
have maintained their eligibility once issued their TWICs. TSA conducts 
recurrent checks of TWIC holders against the Terrorist Screening 
Database and other databases. TSA has the authority to revoke TWICs 
based on the results of recurrent vetting, and use of card readers for 
electronic verification will strengthen the effectiveness of these 
processes.
    In order to provide the most robust recurrent vetting against 
criminal history records, TSA needs full access to Criminal History 
Records Information (CHRI), similar to that of a criminal justice 
agency or law enforcement officer; this information is available at the 
state level and accessed via the Interstate Identification Index 
managed by the U.S. Department of Justice, Federal Bureau of 
Investigation (FBI). Although TSA receives some CHRI when it sends 
fingerprints to the FBI for initial vetting, the FBI does not perform 
recurrent vetting of CHRI on behalf of TSA. The FBI has deemed that 
TSA's security threat assessments for TWIC are non-criminal justice 
activities. As a result, TSA is unable to request subsequent CHRI for 
recurrent vetting without a submission of new fingerprints from the 
individual. Additionally, TSA may not always receive all available 
information because of the FBI's designation as ``non-criminal 
justice'' purposes for TSA security threat assessments. States may not 
upload all available information into the FBI biometric system and may 
not respond to CHRI requests for ``non-criminal justice'' activities. 
DHS has and will continue to work with the FBI and states to try to 
expand access to the CHRI.
    While not a final solution to the challenge of recurrent criminal 
vetting, including TWIC data in IDENT would provide a framework to 
initiate more recurrent vetting on CURL, where available, for TWIC 
holders. In addition to supporting identity verification, biometric 
data from IDENT is used to conduct vetting against criminals and 
immigration violators. TSA and US-VISIT are working to include TWIC 
data in the IDENT database.
DHS Clarification on GAO Breaches of MTSA-Regulated Ports
    DHS would also like to address aspects of GAO's covert operation 
defined in the report that we believe warrant further clarification.
    DHS believes that the focus on access to port areas rather than 
access to individual facilities can be misleading. Specifically, the 
report states that GAO investigators successfully penetrated ports 
between August 2009 and February 2010. However, the report does not 
breakdown the number of facilities to which GAO attempted to gain 
access within each port area. Each port is unique in design and 
operation--ranging from some ports housing hundreds of individual 
facilities spread over a large geographic area to other ports 
containing only a few facilities in a small geographic area with one 
main access control point. While GAO stated that it did not require its 
covert investigators to record the individual attempts to access 
facilities, investigators indicated during discussions with USCG that 
they were successful in gaining unauthorized access at some individual 
facilities within the port areas. The presentation of breaches at port 
versus individual facilities paints a more troublesome picture of the 
actual breaches that occurred.
    Third, the report does not distinguish among fraud committed with 
counterfeit TWIC cards, authentic TWIC cards obtained with fraudulent 
documents, and access control decisions made by facility personnel. 
Each type of fraud has a different mitigation technique. The fact that 
a Facility Security Officer does not question what appears to be a 
valid card should not be intertwined with cases in which a counterfeit 
card was presented to gain access. Because there is no granularity 
within the report as to when a specific card was used, one can be left 
with the unsupported impression that individual facilities in all cases 
were failing to implement TWIC visual inspection requirements. Or, as 
written in this report, that ports failed to properly implement these 
requirements.
Recent Developments
    The GAO audit was beneficial in helping DHS identify immediate 
actions that could strengthen the effectiveness of the TWIC program.
    TSA has already taken steps to remedy some of the missing internal 
controls that GAO has identified. Starting in January 2011, the TWIC 
program initiated a 100-percent review of all fingerprint matches 
received in the system. These matches could highlight potential fraud 
in the TWIC enrollment process where one individual could be attempting 
to enroll under a different identity and possibly with fraudulent 
documents. During this process, the TWIC program has already referred 
numerous cases to our Law Enforcement Investigations Unit where 
investigations are under way.
    On February 14, 2011, USCG Headquarters published additional 
guidance to field units regarding the importance of TWIC inspections 
and verifications. The guidance directed Captains of the Port to place 
a higher priority on the review and validation of TWIC verification 
procedures during the required Maritime Transportation Security Act 
(MTSA) security inspections. Additionally, the guidance encouraged 
Captains of the Port and the Facility Security Officers to take 
advantage of training aids regarding the identification of fraudulent 
TWICs published on Homeport-the USCG's Internet site for maritime 
information.
    As previously mentioned, the USCG is currently developing an 
upcoming rulemaking that will include a requirement for card readers at 
ports and facilities. The TWIC program has completed a pilot that 
evaluated using card readers for electronic verification of the TWIC 
card. DHS believes that electronic verification of TWIC cards will 
significantly enhance protection against counterfeit, tampered, or 
expired TWIC cards being used to gain access to secure facilities.
    TSA is in the initial phases of a modernization effort for its 
vetting infrastructure. This effort is aimed at consolidating 
systematic processes related to conducting background checks with the 
goal of improving the overall security and consistency of our 
enrollment and vetting processes. As the modernization effort moves 
forward, the TWIC program will continue to be heavily involved to 
ensure that any internal control gaps or risks are addressed or further 
mitigated.
GAO Recommendations
    DHS takes the findings of this review very seriously. DHS strongly 
believes that TWIC has an overall effect of strengthening the security 
of our nation's ports. We also acknowledge and appreciate GAO's work to 
identify opportunities to enhance current program controls. We 
recognize that breaches did occur and that the Department and port 
facility owners and operators need to take steps to enhance security. 
DHS appreciates the opportunity to provide GAO with comments to its 
audit recommendations.
    ``To identify effective and cost efficient methods for meeting TWIC 
program objectives, and assist in determining whether the benefits of 
continuing to implement and operate the TWIC program in its present 
form and planned use with readers surpass the costs, we recommend that 
the Secretary of Homeland Security take the following four actions:

    Recommendation 1: Perform an internal control assessment of the 
TWIC program by: (1) analyzing existing controls, (2) identifying 
related weaknesses and risks, and (3) determining cost-effective 
actions needed to correct or compensate for those weaknesses so that 
reasonable assurance of meeting TWIG program objectives can be 
achieved. This assessment should consider weaknesses we identified in 
this report, among other things, and include:

   strengthening the TWIC program's controls for preventing and 
        detecting identity fraud, such as requiring certain biographic 
        information from applicants and confirming the information to 
        the extent needed to positively identify the individual, or 
        implementing alternative mechanisms to positively identify 
        individuals;

   defining the term extensive criminal history for use in the 
        adjudication process and ensuring that adjudicators follow a 
        clearly defined and consistently applied process, with clear 
        criteria, in considering the approval and denial of a TWIC for 
        individuals with extensive criminal convictions not defined as 
        a permanent or interim disqualifying offense, and;

   identifying mechanisms for detecting whether TWIC-holders 
        continue to meet TWIC disqualifying criminal offense and 
        immigration-related eligibility requirements after TWIC 
        issuance to prevent unqualified individuals from retaining and 
        using authentic TWICs.''

    Response: Concur. DHS agrees that an internal control assessment 
should and will be performed. Once the final GAO report is issued, DHS 
will initiate a comprehensive review of current internal controls with 
a specific focus on the controls highlighted in this report. In the 
interim, TSA and USCG are evaluating and implementing new internal 
controls as discussed in this letter.
    Recommendation 2: ``Conduct an effectiveness assessment that 
includes addressing internal control weaknesses and, at a minimum, 
evaluates whether use of TWIC in its present form and planned use with 
readers would enhance the posture of security beyond efforts already in 
place given costs and program risks.''
    Response: Concur. DHS agrees that the results of the internal 
control assessment should be used to further evaluate the effectiveness 
of the TWIC program.
    Recommendation 3: ``Use the information from the internal control 
and effectiveness assessments as the basis for the evaluating the 
costs, benefits, security risks, and corrective actions needed to 
implement the TWIC program in a manner that will meet stated mission 
needs and mitigate existing security risks as part of conducting the 
regulatory analysis on implementing a new regulation on the use of TWIC 
with biometric card readers.''
    Response: Concur. As the internal control assessments progress, any 
applicable data or risks will be communicated to USCG for consideration 
during their regulatory analysis.
    Recommendation 4: ``Direct the Commandant of the Coast Guard to 
design effective methods for collecting, cataloging, and querying TWIC-
related compliance issues to provide the Coast Guard with the 
enforcement information needed to assess trends in compliance with the 
TWIC program and identify associated vulnerabilities.''
    Response: Concur. USCG has already incorporated changes to its 
current version of Marine Information for Safety and Law Enforcement 
(MISLE) to enhance data collection since the TWIC compliance date of 
April 15, 2009. Incorporation of additional changes is planned in a 
future release of MISLE that will add to current capabilities to 
collect data and allow for more detailed trend analysis.
    Again, thank you for the opportunity to review and comment on this 
draft report. We look forward to working with you on future Homeland 
Security issues.
            Sincerely,
                                         Jim H. Crumpacker,
                     Director, Departmental GAO/OIG Liaison Office.
                                 ______
                                 
                  Appendix VII: GAO Contact and Staff
    Stephen M. Lord at (202) 512-4379 or at [email protected]
Staff Acknowledgments
    In addition to the contact named above, David Bruno (Assistant 
Director), Joseph P. Cruz, Scott Fletcher, Geoffrey Hamilton, Richard 
Hung, Lemuel Jackson, Linda Miller, Jessica Orr, and Julie E. Silvers 
made key contributions to this report.

    Senator Lautenberg. Thank you very much, Mr. Lord.
    It's astounding to hear your testimony and see the large 
percentage of those really not qualified to receive the card. 
And then you said, being convicted of a felony does not 
automatically disqualify a person from being eligible. And it 
goes on to detail what kind of offenses: espionage, treason, 
other offenses, such as murder or the unlawful possession of 
explosive device. It sounds like we're not attracting, always, 
the kinds of applicants that would qualify to get a card. And 
that's a tough outcome for something that ought to be done much 
differently.
    Through your covert testing, you said you were able to 
obtain fraudulent TWIC cards, and access secure facilities 
using these cards. Now, what kind of threats are these to our 
ports and our other secure facilities?
    Mr. Lord. Well, in our report today, we reference a 2008 
Coast Guard assessment, in which it states, very clearly, al 
Qaeda considers U.S. ports and facilities to be legitimate 
targets. Perhaps the Coast Guard witness could expound on that. 
But, that to us, that's why this issue is important.
    Senator Lautenberg. The fact of the matter is that there's 
a question that invites a view of the magnitude of the problems 
that are involved in having something that can be stabilized 
and relied upon. And I wonder what other kinds of approaches 
there might be in order to get this to be an easier program to 
manage--one that's more reliable. Anyone want to make a quick 
suggestion here on that regard?
    Mr. Pistole?
    Admiral Cook. Mr. Chairman, I would just go back a little 
bit in history. I happen to have been the Captain of Port for 
the Houston-Galveston area during 9/11. And at that time, when 
we tried to bring into account--actually, before the MTSA, but 
certainly recognizing that access control was very, very 
important--that we tried to find a document that could be 
universally recognized from facility to facility which, 
typically, would have their own card. Sometimes they would 
recognize driver's license. Sometimes they would recognize 
other Federal ID cards. That was a very important thing for us 
to address early on. So, as we move from that initial, you 
know, implementation, and realizing that we needed to have more 
secure ports in the future, looking forward to one card that 
could be universally recognized, that guards could be trained 
to recognize, security features could be built in. And I think 
that that has been viewed as a very good thing. The Coast Guard 
actually looks forward to the opportunity to maximize that card 
through the use of card readers, which will then provide an 
additional level of verification, authentication, and 
validation. But--so, I--from my point of view, I would say that 
the card has introduced a significant amount of security, and 
certainly with my past experience----
    Senator Lautenberg. Well, but there is--Admiral, there is a 
suggestion that, in some ways, we might have not gained on it, 
and exposed ourselves to more difficult problems in the future.
    So, Mr. Pistole, before we discuss TSA's effort to address 
port security, it was discovered that al Qaeda was planning an 
attack on a U.S. rail line. To date, TSA's efforts on rail 
security have been delayed and nearly nonexistent, compared to 
aviation security. In light of this information, what immediate 
steps are we taking to increase rail security measures?
    Mr. Pistole. Thank you, Mr. Chairman. Well, obviously, as 
soon as we got the word from the document exploitation from the 
bin Laden raid and the killing of bin Laden, we engaged, 
particularly, with our partners in the rail security, 
particularly Amtrak for the Northeast Corridor, but all 
passenger and freight rail, noting the context for this 
information, coming from February of last year, and talking 
about an attack on passenger rail for the 10th anniversary of 
9/11. So, it's still months away. But, we passed that 
information immediately and then worked with, particularly, 
Amtrak Police, and others, in terms of what they were doing, in 
terms of additional random, unpredictable patrols, both 
uniformed officers, canines, explosive trace detection--all 
those things that would serve as a deterrent, knowing that the 
three things the terrorists are looking for, in terms of 
deterrent, are additional police patrols, additional canines, 
or closed-circuit television cameras, as long as they're not 
suicide bombers, as we saw in London, on July 5 and 21 of 2005.
    So, that's what we have done. We're obviously very much 
interested in the Transportation Security Grant Program and the 
outcome of Congress's decision on that, in terms of where that 
will be--how much money we'll have to support both the training 
efforts and the additional efforts that I've mentioned, in 
terms of things such as infrastructure protection, whether it's 
the Port Authority, Trans-Hudson, the PATH tunnels that you're 
so familiar with, shoring up those vulnerabilities, and other 
issues. So, those are some of the things we've done since that 
announcement.
    Senator Lautenberg. Senator Boozman.
    Senator Boozman. Thank you, Mr. Chairman.
    Mr. Lord, how much money has been spent on the project?
    Mr. Lord. Since the inception of the program, it's 
approximately $420 million. And that includes $111 million in 
direct appropriations, $112 million in grants, including port 
security grants and transit security grants, and approximately 
$198 million raised in fees. Once you apply for a TWIC, you're 
to pay $132.50. So, that represents a significant share of the 
program proceeds.
    Senator Boozman. After looking, the ability to essentially 
very easily obtain a TWIC fraudulently, the fact that it looks 
like--am I reading it right?--of the 1,676,000, 460,000--over 
460,000 criminals, only one has been denied?
    Mr. Lord. Actually, we didn't have full visibility over 
that, but that's our understanding. Most--virtually all were 
approved, and the one was denied, as part of that adjudication 
process; once derogatory information is identified in the 
application process. That's our understanding, which we include 
in our report.
    Senator Boozman. Based on your investigation, would a 
normal driver's license from the states, now, that are required 
to do the--you know, much more background check than they used 
to, as far as who you are--would that be more secure identity 
than the TWIC card? Or, is it at least as secure?
    Mr. Lord. It's at least as secure, probably, in many cases, 
more secure. That's our point.
    Senator Boozman. We've spent all this money, and right 
now--up to now, what we have is less secure than a driver's 
license.
    Mr. Lord. Yes. And that was the purpose of our report, 
quite frankly. We identified some design flaws in the system--
some holes. We think they can be patched. And we also raised an 
issue of facility training. The security guards play a key role 
in the process, and they, perhaps, need to be provided some 
additional training. They'll need to be a little more rigorous 
in scrutinizing the credentials, which are currently being used 
as a flash pass only. The biometric reader, that's the next 
stage of the program.
    Senator Boozman. And I guess, Admiral Cook, I would take 
exception to your remark about the TWIC card making us--you 
know, that we've had improvement by having it. And you can 
comment on this, too, Mr. Lord, and you, Mr. Pistole. But, the 
fact that we have this card that means nothing, or very little, 
because Mr. Lord's group has demonstrated it's very easy to get 
around it--to me, it makes us less secure than ever, because 
when your guys check this card, they, in good faith, feel like 
they're dealing--you know, this system--they have no idea that 
the card wasn't valid--then it gives them a false sense that 
they really shouldn't have at this point. Is that true or 
false?
    Admiral Cook. Senator--and this is not to be argumentative 
in any way--the--I pretty--I'm starting, pre-9/11, in my mind. 
But, then one of the things that--as I said, we're looking 
forward to being able to move to the electronic reader. And 
what the Coast Guard has done to try to move ahead on that is, 
we deployed over 200 portable readers so that we can take 
advantage of that biometrics. It still does not account for 
someone that had a TWIC obtained based on fraudulent documents, 
because then the--biometric in the card.
    Senator Boozman. The point is, it's so easy to obtain these 
things fraudulently.
    Admiral Cook. Well, the--as the mariners and workers----
    Senator Boozman. And this is not your problem. You're just 
the guy that's checking. I don't----
    Admiral Cook. Right.
    Senator Boozman. But, again, I think it puts--you're all at 
a disadvantage.
    Mr. Lord, who initiated the GAO study?
    Mr. Lord. It was this committee and eight other 
Congressional committees.
    Senator Boozman. Did you find any evidence, as you were 
investigating, that anybody--the Coast Guard, TSA--were 
concerned about this prior to your investigating the--was 
this--did this seem something that was at the top of their 
radar, as far as concerns about safety and security in this 
area?
    Mr. Lord. Oh, I think, absolutely, it was on their agenda; 
it was on their radar. But just contextually, we have completed 
a large body of work on TWIC-related issues over the last 5 
years. We've worked very closely with TSA and the Coast Guard 
on this. We have a good, collaborative relationship, and they 
have taken steps to address some of the issues we identified in 
our report.
    Senator Boozman. Mr. Pistole, who in your agency--I find it 
remarkable--you know, if you talk to the truckers and people 
like that, you know checking records--and just employers, in 
general, you know, with drug screenings and--this doesn't have 
anything to do with drug screenings--but, just in general, 
checking people out, whether or not they're going to drive a 
schoolbus or whatever--it's remarkable that, of your people 
with a criminal record, there's such a low, low, low percentage 
of people that were flagged. Who in your agency--who's 
responsible for that? What entity within TSA is responsible for 
making that decision?
    Mr. Pistole. Well, of course, I'm responsible, overall, but 
the----
    Senator Boozman. No, but you don't check----
    Mr. Pistole. Yes.
    Senator Boozman.--these things off.
    Mr. Pistole. Right. But----
    Senator Boozman. Who does that?
    Mr. Pistole.--TTAC, which is our credentialing group, is 
responsible for that.
    And just, if I could, Senator----
    Senator Boozman. So, what is the name of that group?
    Mr. Pistole. TTAC. It's T-T-A-C, the credentialing group.
    And just for context, I think--so, I would say--I agree 
with a number of your comments--I would say we are more secure 
from the standpoint of, prior to any of these cards, somebody 
could use a driver's license, a union card, whatever it may be, 
that they just used to get access to the ports, with no----
    Senator Boozman. Mr. Lord has just testified that a 
driver's license is more secure than the card.
    Mr. Pistole. So, if I could just finish, there--without any 
background check, necessarily--and so, at least, we're doing 
background checks now. Obviously, there are statutory 
provisions for people with criminal histories. And just by the 
nature of the workforce, a number of dockworkers may have had 
some criminal history. So----
    Senator Boozman. Right.
    Thank you, Mr. Chairman.
    Senator Lautenberg. Thank you very much.
    Senator Begich?

                STATEMENT OF HON. MARK BEGICH, 
                    U.S. SENATOR FROM ALASKA

    Senator Begich. Thank you very much, Mr. Chairman.
    First, I want to thank you, Administrator Pistole, for one 
program called ``Enroll Your Own,'' which is very important in 
our rural parts of Alaska, as you know. In order to have people 
to get the TWIC card is very expensive, complex for--and the 
travel in some of our fishing communities. And so, first I want 
to say thank you for that. We do have some suggestions we want 
to share with you--we'll do it for the record--from our police 
departments, who you work with.
    Mr. Pistole. Good.
    Senator Begich. And I think they have some very positive 
suggestions that I would hope you would consider as you 
continue to roll this program out.
    Mr. Pistole. Sure.
    Senator Begich. And I just want to issue a cautionary note, 
on the discussion here on criminal records and so forth--you 
hinted to it--in some of these industries, not everyone's going 
to have a stellar background, but are working in jobs that pay 
sometimes very low wages, and a variety of other things. So, I 
know that's a careful balance that you have to have.
    My concern--and I don't know who wants to answer this. Let 
me, first, start with one example. And I may be a little off, 
here, but I'm using an example from my own--one of my own staff 
people, a loaner from one of the agencies, NOAA. Because he 
works on a ship and works on a dock, he goes through a whole 
process to get his card, his common access card--
fingerprinting, all the 9 yards. Then he has to get a TWIC 
card, go through the same process. That seems such a simple 
fix, that if you've got a Coast Guard person that's required to 
go through and get their card, or a NOAA person, or any of 
these Federal agencies or government agencies, like a police 
department or maritime enforcement office, depending on if 
you're a coastal area, that, once they've done that, they 
shouldn't have to repeat that. Is that an easy fix that you can 
do?
    Mr. Pistole. I will take that, Senator. It's not easy, 
unfortunately, but you've identified a key issue which is 
really overriding all these individual issues that we're 
talking about here today, and that's not only for the whole 
U.S. Government, in terms of having a universal access card, 
whatever that may be--of course every state has different 
standards. The National Institute of Standards Technology, of 
course, sets some standards that we abide by. But, that's the 
challenge that we deal with, that this goes--even in my last 
job, at the FBI, where there were all types of fraudulent 
documents because of differing standards by state and the 
federal government.
    Senator Begich. But, you'll probably never get to the 
unified card of any kind. So, we have to take that as a given, 
even though I know, from a law-enforcement--as someone who was 
a mayor that managed a police department, you know, they would 
love to have one card, one place, one location. But, that will 
never happen, because of states' rights, and many other things. 
But, it seems, even in the Federal agencies--I think if a NOAA 
person or a Coast Guard person or--pick the agency--that goes 
through this already, that they shouldn't have to go through it 
again.
    Mr. Pistole. So, there's----
    Senator Begich. First, let me ask, does that make sense, 
that logic?
    Mr. Pistole. Yes.
    Senator Begich. OK.
    Mr. Pistole. Absolutely.
    Senator Begich. So, why not figure out--I know what we'd 
like to do, it seems, in the federal government, as I've 
learned now, is always get the big pitch, try to do it all at 
once, and do everything, which is disastrous. Example A, $300 
million. You know, maybe we'll learn a little bit out of this. 
But, it seems like--why don't we just take one piece of the pie 
and try to deal with it and get it to work, rather than this 
holistic, which--you know, it sounds like another contractor 
making a lot of money on a system that doesn't work, that we'll 
probably never recoup anything from, and then they'll charge us 
more to do some more work.
    Mr. Pistole. So, I agree, completely.
    Senator Begich. It's the----
    Mr. Pistole. You would think, Senator----
    Senator Begich.--the federal M.O.
    Mr. Pistole. Right. So, we are working on some proposed 
rulemaking that would help in that regard. Obviously, industry 
has a lot of interest and input into that. And so, as we work 
through this, unfortunately I believe it's a longer-term rather 
than a short-term fix. But, I agree completely with your 
philosophical approach of trying to consolidate and make it 
more efficient and effective for those who need these access 
cards.
    Senator Begich. And then--but, I just give you a cautionary 
note. The standard thought is, ``Well, let's try to figure out 
all the Federal--just take the Coast Guard, get them cleared 
up. Get the NOAA, get them cleared up.'' In other words, 
piecemeal it out so, each one, you're just trying to 
incrementally do. Is that a realistic approach, rather than 
this--it just makes me very nervous that we're going to try to 
do all of it at once and then, maybe a year and a half or 2 
years from now, we'll have the same conversation, maybe with 
different people, maybe the same people, talking about more 
expense. Is that----
    Admiral I don't know who. Mr. Lord? Whoever.
    Mr. Lord. No, it makes perfect sense. I believe you're 
referring to consolidating the so-called security threat 
assessment process. Typically, when you go in for a credential 
now, they'll run a STA on you. To complete an STA, you may need 
another credential. They'll do it again. What they're doing is 
accessing the same--essentially, the same databases. So, they 
have an effort. They just started. They're trying to 
consolidate that. So, they, the Department of Homeland 
Security, wholeheartedly would agree with your position. And 
they're already taking steps to do that. Initial steps. But, 
that's the vision. You want to consolidate----
    Senator Begich. Right.
    Mr. Lord.--all that so-called background-checking process, 
and just have one person, one check----
    Senator Begich. Right.
    Mr. Lord.--rather than having one person, multiple checks. 
It's currently----
    Senator Begich. Doesn't make sense, that latter part.
    Mr. Lord.--inefficient, and it costs the consumer, the 
person applying for the card, more money.
    Senator Begich. Let me just end with one question. The 
people that initiated this process--I know it wasn't under some 
of you folks, because some of you are new, obviously--but, the 
people below you who deal with all this, are they the same 
people that initiated this process, or are they new people? And 
the reason I ask that, sometimes--you know, there's my 
question. Because, I just heard a little knock on--to the left.
    [Laughter.]
    Senator Begich. Yes or no?
    Mr. Pistole. Yes, mostly the same people.
    Senator Begich. That's a problem. I'll leave it at that.
    Senator Lautenberg. Thank you very much.
    Senator Wicker.

              STATEMENT OF HON. ROGER F. WICKER, 
                 U.S. SENATOR FROM MISSISSIPPI

    Senator Wicker. Thank you.
    Gentleman, the results of the GAO report, I must say, are 
absolutely breathtaking. TSA has failed to implement and 
evaluate the TWIC Program in a way that provides reasonable 
assurance that only qualified individuals have access. GAO 
investigators were able to access secure facilities at U.S. 
ports during covert tests in which they presented either 
counterfeit TWIC cards, authentic TWIC cards, or cards obtained 
through fraud. GAO found that controls to identify the use of 
potentially counterfeit identity documents were not used to 
inform the background- checking process. TSA does not have 
clear criteria for applying discretionary authority to 
applicants who have past criminal convictions. And controls are 
not designed to determine whether cardholders have committed 
disqualifying crimes at the federal and state level after being 
granted a TWIC.
    It seems to me that a decade of work has resulted in a 
system that would put Rube Goldberg to shame, and it almost 
argues for starting over from scratch and trying to design 
something that would work. I would mention again what Senator 
Boozman has pointed out, that of 460,000 TWIC applicants with a 
criminal record, TSA was able to deny access to one of those 
460,000-plus applicants. I mean, it is absolutely astounding. 
But, the requirement has succeeded in making things harder on 
the applicants. And I have a report here from a constituent 
group, regarding TWIC card applications and the two-trip 
requirement. And I'll quote from this business, ``The 
requirement that applicants make two trips to a TWIC enrollment 
center that may be hundreds of miles from their workplace or 
home represents a substantial burden on transportation workers 
across the country. A resident living in West Plains, Missouri, 
for example, must make, at minimum, two 350-mile round-trips to 
apply for and activate their card at the nearest enrollment 
center located in Memphis. Another worker in Meridian, 
Mississippi, must make, at minimum, two 267-mile round-trips to 
apply for and activate their card at the nearest enrollment 
center in Mobile.''
    So, for the honest worker who doesn't have a criminal 
background, he's got to make two trips. Mr. Lord, is there some 
way, in your judgment, that we could devise a system that does 
not require the two trips? I have confidence in the mail 
system. And it seems to me that receiving a card in the mail, 
then calling with secure information to verify that that card 
has been received, and then activated at that point, much like 
the credit cards are done, that something of that nature should 
be used to apply some common sense to the honest people that 
are being inconvenienced, to the tune of hundreds of miles.
    Mr. Lord. No, that's an excellent question, sir. We 
recently looked at that, whether you could simply mail a TWIC 
card to an applicant's place of residence. It sounds easy. But, 
like many things, once you start looking into it, it's a little 
more complicated. And what we found was, the current policy of 
the Department is to remain aligned with the so-called FIPS 201 
standard. This is a biometric security standard that pertains 
to all government credentials. As long as the policy is to 
remain aligned with that standard, it would preclude you from 
mailing it to an applicant's place of residence. Why? Because 
you have to do a biometric match, in person, to ensure 
security. That helps limit potential fraud. And it's a key 
security enhancement. We had discussions with the NIST 
officials who crafted the standard--TSA, DHS; they agreed with 
our assessment. So, as long as that's their policy, the current 
policy is to remain aligned with that standard. Obviously, they 
could change the policy and have to reengineer their business 
processes, but as long as that policy remains unchanged, they 
cannot mail the TWIC to a person's place of residence.
    To TSA's credit, they did add some flexibility to the 
program. In February 2009, they allowed the applicant to 
designate what enrollment center they'd like to pick it up. 
Sometimes people move. You apply for a TWIC in Seattle, say, 
and move to Memphis. You can now say, ``I'd like to pick up my 
card in Memphis,'' without having to drive all the way back to 
Seattle. So, there has been some effort to respond to the needs 
of applicants. But, I cannot criticize them for requiring the 
in-person biometric match. That's a key part of the process.
    Senator Wicker. Well, I would just simply suggest, as I 
yield back, that there are so many aspects of this program that 
are obviously going to have to be rethought, that we ought to 
put up the best minds in the country on some way to make this 
less burdensome on the honest folks that actually do comply.
    Thank you.
    Mr. Pistole. Mr. Chairman----
    Senator Lautenberg. Yes.
    Mr. Pistole. I'm sorry.
    Senator Lautenberg. I'm sorry. Yes.
    Mr. Pistole. If I may just respond on the one part to the 
Senator's question----
    Senator Lautenberg. Sure.
    Mr. Pistole.--just briefly.
    Senator on the one denial, the overall numbers--we've 
actually denied over 35,000 people, for various disqualifying 
criteria. The one you're referring to is one who is an 
individual who had several criminal convictions, none of which 
was individually disqualifying, but, taken in totality, was 
disqualifying. So, it has actually been over 35,000. So, that's 
the whole purpose of that. We've also had several people who, 
it turned out, are on the terrorist watch list, who've applied 
for TWIC card, that have also been denied. And I could go into 
more detail in a closed setting on that.
    Senator Lautenberg. Thank you.
    Senator Snowe.

              STATEMENT OF HON. OLYMPIA J. SNOWE, 
                    U.S. SENATOR FROM MAINE

    Senator Snowe. Thank you, Mr. Chairman.
    And just to follow up on the question on the enrollment 
centers which is obviously a problem in a state like Maine, 
where we only have two enrollment centers, one in Bangor and 
one in Portland. So, I'm going to explore with you the issue of 
distance. Do have you have any information regarding the impact 
it has on these workers to go long distances in order to secure 
the card and then have to go back and get it approved, and so 
on, and requiring two different trips for these identity cards? 
And so, do you have any information on that? Who's----
    Mr. Lord. Just to clarify, we audited the program, but we 
did speak to many applicants. And that was a persistent pain 
point, having to make two trips to get your credential. And I 
know there has been various discussions about how to mitigate 
that. They have portable enrollment centers. You can move 
certain enrollment centers around the country. But, again, I'm 
from GAO, not TSA. So, that's probably a better question for 
TSA.
    Senator Snowe. Mr. Pistole?
    Mr. Pistole. So, Senator, yes, it's clearly less than ideal 
for most persons who are not located close. I have a map of 
where the permanent enrollment centers are. And, of course, 
they're located where most of these workers that would need 
them. We've also done several dozen of the mobile centers. And 
if there's a need in Maine that you've identified that would 
need one of these mobile centers, I'd be glad to take a look at 
that to try to facilitate that. So, we're--and also, by 
allowing the applicants to pick up their card at a different 
location, as noted, because they do move around and are--work 
in different places, it is a challenge, in trying to comply 
with the NIST standards, in terms of the best security, while 
also providing for the best convenience. So, that's the dynamic 
we deal with.
    Senator Snowe. Well, there is obviously a gap between the 
enrolled and the activated. So, is it your surmisal that they 
travel from one place to another--activate at one--enroll in 
one area and activate it in another location?
    Mr. Pistole. Some of the applicants request that, because 
they're jobs have changed----
    Senator Snowe. Do they have to get prior approval for doing 
that?
    Mr. Pistole. You know, I don't know that. I'll have to 
check on that.
    Senator Snowe. Well, somehow, we're going to just have to 
make this simpler. I just think it's cumbersome and 
bureaucratic. I mean, only 167 centers nationwide. So, it 
just--there must be a better way. I mean, I think about the 
amount of money that has already been spent on this program. 
Frankly, I think--the Chairman and I are probably one of the 
few members that were here on the Committee post-9/11, working 
on this very issue, and this was one of the issues that was 
identified as a priority. And that was back in the aftermath of 
9/11. In 2002, we began this process. I think it was then 
former President Bush identified as, you know, having the 
identity of these workers established, and developing a system. 
And we will have spent $3.2 billion, and we've yet to clear all 
the hurdles to say that it's fully implemented and satisfied.
    And so, I think it's--it--presenting enormous difficulties 
and complexity and failing to uphold the major standard, which 
is to confirm the identity of a cardholder. I mean, ultimately, 
that is not something that's been achieved at this point, it 
seems to me. And so, now we're going to spend all this money on 
biometric reading and digital devices, which are going to cost, 
as I understand it, up to $8,000 apiece. Is that correct?
    Admiral Cook. That is correct, yes.
    Senator Snowe. It is. So--I mean, so there's another 
monumental cost. And next year, we're supposed to have--mandate 
the use of these cards. Are we going to be prepared for that?
    Mr. Pistole. So, that is one of our challenges. And that's 
exactly why I've asked, along with Coast Guard and the 
Department, to--asking GAO to look the cost-benefit analysis of 
this whole program, because we do have hundreds of millions 
invested in it, between us, the U.S. Government, taxpayers, and 
industry. The question is, what's our return on investment? Are 
we clearly safer? Yes, we are. But, at what cost? And so, 
that's why we've asked for GAO to follow up on this.
    Senator Snowe. Well, I guess it's a red flag for all of us 
in Congress. I mean, I think if it takes so long to get a 
program up and running, something must be truly wrong, and 
we've got to decide differently, because it has been the better 
part of the decade, obviously, and we still haven't completed 
it. And yet, it's going to cost a great deal. I mean, it has 
been practically, what, from 2002 to 2012, essentially, and 
we're still not that much further ahead, in terms of where we 
need to be, and all the other problems that have been exposed.
    In 2006, I introduced an amendment to the SAFE Port Acts 
that required a GAO report to review the various background 
checks among various agencies. Now, is there any way that we 
can sort of synchronize these background checks, you know, so 
that we can have one unified background check, in credentials, 
for workers, instead of, you know, multiplicity?
    Mr. Pistole. So, that's what----
    Senator Snowe. Admiral Cook, and Mr. Pistole?
    Admiral Cook. Well, Senator----
    Senator Snowe. Who's in charge on this one?
    Admiral Cook. I'll go ahead and----
    Senator Snowe. OK.
    Admiral Cook.--step up, Senator. But, I think the--you 
know, to answer your question, we're kind of at a pivotal time 
right now in the program, because the pilot reader program is 
being concluded. I don't know if you were in here when we 
mentioned it would--the Administrator mentioned that that data 
for the final report will be closed out at the end of this 
month. And then that report will come over to the Coast Guard, 
and that will be part of the background for our notice of 
proposed rulemaking to establish the readers.
    So, I think, you know, in terms of the GAO audit, the work 
that has already been put into the TWIC, we are on the verge of 
being able to exploit the fundamental biometric data that we 
all wanted to achieve. And I know that the industry, who has 
been--you know, used to having the TWIC cards just flash passed 
us for the last few years, is anxious to move to that phase. 
They understand there'll be some costs. They're anxious to 
participate and help us get it right. And I think that's what I 
can offer at this time.
    Senator Snowe. Well, is it going to be interoperable in any 
way? I mean, are you--talking about this, you know, electronic 
reader--is that all going to be interoperable with other 
systems within government, or is it going to be stove-pipe?
    Admiral Cook. The standards are--should be set, such that 
they were--have the ability to read several different kinds of 
cards. And that's the--that will be a plus, right there. The--
but, they'll be focused back to databases which relate to the 
TWIC, from what I understand right now. But, as I say, as a 
pivotal point, we can start integrating different aspects that 
the GAO has brought to our attention and that we already have 
some internal programs for.
    Senator Snowe. Well, is it--can we understand, then, that 
there's going to be harmonization of these security 
credentials, among agencies, or not? I guess that's the 
question.
    Mr. Pistole?
    Mr. Pistole. So, that's--Senator, that's one of the things, 
at least within the Department of Homeland Security, the 
Secretary is focused on, to ensure that, for example, just 
within TSA, we do vetting and credentialing for up to 15 
million people in 28 different categories. So, there's a lot of 
that just within what we're doing. And that's what the 
Secretary is focused on.
    Senator Snowe. Thank you.
    I ask unanimous consent to include my statement in the 
record, Mr. Chairman. Thank you.
    Senator Lautenberg. Without any objection, certainly.
    [The prepared statement of Senator Snowe follows:]

  Prepared Statement of Hon. Olympia J. Snowe, U.S. Senator from Maine
    Thank you, Mr. Chairman for holding this hearing. As an original 
requestor of the GAO report presented today, I have great concerns 
about the Transportation Worker Identification Credential, or TWIC 
card, and the security of our nation's ports. For nearly a decade we 
have been grappling with many port security questions, and I think the 
report we see today identifies a need for review of current security 
practices. When we joined several of our colleagues to request this 
critical review of the TWIC, I believe you and I shared the view that 
when it comes to maritime security, we can, and must do better to 
protect our country's 360 ports and maritime facilities.
    Biometric identification cards for transportation workers were one 
of the first security challenges addressed by Congress following 
September 11 in the Aviation and Transportation Security Act of 2001. 
In subsequent years, the mandate for identification for port workers 
was amended several times to define the ID we now call the TWIC. Since 
2007, more than 1.7 million truckers, merchant mariners, longshoreman, 
and port workers have been issued these cards. Even the students at the 
Maine Maritime Academy have these $132 Federal security credentials to 
access the secure port facility on campus.
    Secure ID cards like the TWIC are vital in insuring that access to 
critical port facilities is restricted to known-persons. In 2004, 
President Bush issued Homeland Security Presidential Directive Number 
12, which among other things, required the Federal Government to 
establish a standard for ``secure and reliable forms of 
identification'' that must: (1) reliably identify an employee's 
identity, (2) be resistant to tampering or counterfeiting, (3) be 
rapidly authenticated electronically, and (4) be issued by providers 
whose reliability has been established. Unfortunately, we can see from 
today's report that the TWIC credential has failed on all counts.
    The truth of the matter is, the implementation of the TWIC card has 
not increased the level of security at our ports as designed, and has 
become another example of bureaucracy at its worst. Not only do the 
cards fail to accurately establish that transportation workers are who 
they say they are, they fail to work as designed, require an unwieldy 
process to obtain, and add yet another redundant credential to the list 
of federal security cards.
    Today's report indicates that the TWIC card may fail the first 
fundamental challenge of a security credential- accurately confirming 
the identity of the cardholder. GAO investigators were able to obtain 
TWIC cards by misrepresenting themselves as natural born U.S. citizens 
and by presenting forged birth certificates and drivers licenses. We're 
told that the documents presented can even be noted in the system as 
forgeries, but that these red flags are not accessible by the final 
adjudicator! Even if the TWIC processing center indicates a probable 
forgery, there is no path for review of the original documents 
presented.
    Even worse, the production of a false card does not seem to be 
beyond the capability of a common criminal. Since the cards are often 
used as ``flash passes'' where card holders simply wave the card at a 
gate agent, the cards only need a passing resemblance to the true card. 
GAO inspectors were able to enter port facilities with false cards, 
unchallenged on a number of occasions! The lack of digital verification 
of TWIC cards is a critical failure in ensuring the effective use of 
the credential, and we must move forward quickly in deploying cost 
effective, equipment designed for a marine environment.
    The TWIC cards have also so far failed to be rapidly authenticated 
electronically--most are worn as another badge, or presented for visual 
inspection, often from a distance of several feet. And the deployment 
of mobile readers suitable for ports has been slow at best. The 
substantial Federal investment of more than $400 million in the past 8 
years, combined with the industry investment of approximately $200 
million was designed to enhance and protect our nations ports, but I 
question if the program has been administered to provide the greatest 
security benefit.
    In the next year, a mandate for the use of TWIC card readers will 
begin to roll out, and we must ensure that we invest wisely in 
technology that will add to our security, and not just our bottom line. 
I would like additional information from our witnesses on the costs 
associated with the technology requirements, and how to best utilize 
the readers to maximize their security impact.
    The GAO report which we receive today also highlights significant 
concerns with the process used to vet applicants and reliably confirm 
the identity of individuals granted these security credentials. From 
asking workers to self identify a need for access to ports, and their 
place of birth, to incomplete verification of identity documents, it is 
clear that the security process for reviewing TWIC applicants has 
significant loopholes. I look forward to hearing from Administrator 
Pistole how TSA plans to address the concerns noted in the report.
    Frustratingly, this is not only a security problem; the two 
separate visits needed to process TWIC credentials has a impact on 
trucking, shipping, and port workers and managers. Workers must first 
take the time to visit the enrollment center nearest them, which in 
some cases may be many miles away. At this time, Maine has only two 
TWIC enrollment centers of 167 nationwide. Students from the Maine 
Maritime Academy must travel the 50 miles from Castine, where the 
Academy is located, to Bangor, where the nearest TWIC processing center 
is located to begin the application, and back to the center again 
several weeks later to activate and pick up their TWIC card. While most 
of these locations are at, or near busy ports, with a highly mobile 
work force, this is a poorly thought out process that does not mirror 
the distribution of other Federal documents like passports which can be 
mailed to applicants.
    Port workers, truckers, and other maritime professionals find 
themselves forced to obtain this additional security, often in addition 
to several other Federal issue identifications or endorsements. The 
TWIC is often carried in addition to Merchant Mariner Licenses, 
Merchant Mariner Credentials, and Commercial Drivers Licenses with 
Hazardous Materials Endorsements. How many times must the Federal 
Government screen and provide access credentials to a single 
individual? Can the departments of the Federal Government not work 
together to grant a single document to port and maritime workers to 
access and secure their workplace?
    In 2006, I offered an amendment to the SAFE Ports Act, which 
required GAO to look into these Federal background checks for 
credentials like these. While GAO and DHS identified several 
credentials which can use the same background check information, I 
believe we must take additional steps to reduce duplication of effort 
and the unnecessary repetition of these background checks. We must 
implement common sense reform to ensure efficiency and maximize cost 
savings--credentialing operations should be streamlined by reducing the 
number of redundant offices and procedures.
    I look forward to the testimony of today's witnesses, and I will be 
looking for information on how we can improve the credentialing 
process, the use of the card, and how we can adapt the use of the 
document to ensure the security of our nation's ports.
    Thank you, Mr. Chairman.

    Senator Lautenberg. And thank you, Senator Snowe, for your 
diligence in matters of security for our country, and 
particularly because the state of Maine has so much water 
access and ports that mean a lot. We thank you for your 
efforts.
    The questions that have arisen here are obviously a small 
number of the questions that actually exist. And we kind of 
feel like we're looking at a Rubik's Cube here. You know, you 
don't know where to start and quite where to stop. And we're 
talking about somewhat safer, but I wonder if that can be--if 
that sentence can end--or, that expression can end with 
``somewhat safer,'' because I think there's also larger risk 
accompanying this because of the fraudulent nature of things.
    And I ask, Mr. Pistole, when we know that GAO investigators 
were able to fraudulently obtain TWIC cards, use them for 
access to secure facilities--and these cards can be used to 
access literally thousands of facilities nationwide--so, what's 
being done to prevent fraudulently obtained cards from being 
used to access the airports, military bases? I think Senator 
Snowe was going there, as well. And can we do something that 
says, ``OK, these cards are good for limited use, limited time 
periods--reenrollment is the question that you raised--
biometric--I don't know--things that are visually protected. 
When I hear of the number of ineligibles that wanted to sign up 
for a card, it tells me that there is something really amiss in 
the basic structure.
    And I ask you, any one of you, what--has there been an 
assessment of the program of any significance since its 
origination, some years ago?
    Mr. Lord. Sure. We've, again, done a large body of work on 
this. I'd like to think we contributed to some better 
understanding of what some of the program's successes and 
weaknesses are. And when I think about this holistically, we're 
trying to apply this program, on a very large scale, in a so-
called one-size-fits-all manner. I think that when you do 
something of this magnitude, it's really important to design it 
very carefully, number one, and, two, make sure your staff are 
well trained in implementing it. In our report, that's 
essentially what we found wrong, that we found some design 
imperfections; some of the information they collect at the 
front end isn't acted upon; and some of the security guards and 
trusted agents, which are delegated a large responsibility for 
making this thing successful, they had some lapses. Some of our 
covert investigators used fraudulent documents and the trusted 
agents should have flagged them. I can't really discuss any of 
the details, because it's sensitive security information. But, 
you know, we found some holes at the front end and at the back 
end, when the security guards are looking at these things and 
letting people on their facilities.
    Senator Lautenberg. I'd almost like to ask that you--on a 
scale of 1 to 10, how comfortable we are with the progress that 
we've made, and this is not intended to be accusatory; it's 
intended to understand better where the problems are. I mean, 
the problems--we keep on, I think, discovering new problems as 
we move along here. And is the design an impossible one to make 
sense from? Or, what--anybody--I--you want to volunteer a quick 
opinion, Mr. Pistole?
    Mr. Pistole. Sure, Chairman.
    Senator Lautenberg. Admiral Cook?
    Mr. Pistole. No, I think this hearing has identified a lot 
of the challenges in trying to deploy a biometric card to a 
civilian population in--on a large-scale basis. And I think, 
although some progress has been made, it is clearly not what 
anybody intended, especially those going back to post-9/11. So, 
I have my own concerns. And that's why I've asked for the GAO 
to do, basically, a--just a top-to-bottom review to assess what 
that return on investment is.
    The thing that I do have some comfort in is that we largely 
know about those who are working in ports now, and docks. The 
fact that they have access to a dock doesn't mean they have 
access to the ship or anything else. I mean, there are 
obviously multiple layers of security, here. What I'm concerned 
about is the ease of using a fraudulent document. We know 
there's, you know, tens of thousands, perhaps 35,000 places in 
the country you can get a birth certificate, hopefully 
legitimate, but perhaps not. And if that's a breeder document, 
that's a document you're using to establish your bona fides; 
that makes it very difficult. The social engineering, which Mr. 
Lord referred to, simply having one of his folks--undercover 
officers go in and, you know, say, ''I have an appointment 
here,`` even though the card doesn't work, or, ''I need to use 
the restroom.`` So, that gets to this--to the training of the 
guards. And so, there--it is a complex issue.
    In answer to your question about 1-to-10, I would put it at 
a 3 right now.
    Senator Lautenberg. Either one of you--I'm going to go to 
my colleagues for a second round of questions--in response to 
my question--it sounds like what we've got--we've got a new 
idea: we'll make prisons without bars, and maybe that will help 
control behavior. I don't think we're quite getting there.
    Admiral Cook, do you----
    Admiral Cook. Senator, I would say that I'm anxious to move 
to a phase where I believe we'll provide--we'll wring out some 
of the uncertainty when we go to more biometrics. And the 
reason I would say I'm anxious is, we have anecdotal evidence, 
because we have a strong network, through our area maritime 
security committees, where we're in constant contact with the 
facility security officers, the actual people paid, on the 
waterfront facilities, by their companies, to maintain 
security. And we have feedback that things like pilferage and 
other small crimes have been reduced. I don't have statistical 
evidence. I'm just saying it's all anecdotal. So, I would like 
to move past the anecdotes, past the feeling of the area 
maritime security.
    Senator Lautenberg. Well, we agree.
    Admiral Cook. And that--so, that's where I am.
    Senator Lautenberg. Past the anecdotes. But, I'd like to 
move past the difficulties and the experiences that we've had.
    Mr. Lord, before I call on Senator Ayotte, do you have 
anything you want to volunteer, here?
    Mr. Lord. Again, a key program goal--I always like to go 
back to the program goals--there are four key program goals. 
One of them was to positively identify individuals applying for 
a TWIC. It's difficult to positively identify someone. What 
they do now is negatively identify. And all that means is, they 
run your fingerprints past the FBI criminal records checks, and 
if there's not derogatory information that comes back on that 
or the other database checks, you're given a TWIC card. You 
could say you're Joe Blow, essentially have your fingerprints 
run, name checked; as long as no derogatory information comes 
back, you could be provided a card. And that's not positively 
identifying; that's a negative ID. So, it costs more, up front. 
It's more rigorous. They have to make a judgment whether there 
are additional steps they can take, up front, to positively 
identify someone, like you do with a driver's license; you have 
to show them your electric bill, show them some proof of 
documentation that you're a resident in the state with that 
name. There's more rigor, up front, involved. But, it makes for 
a better system.
    Senator Lautenberg. Senator Ayotte.
    Senator Ayotte. Thank you, Chairman.
    I wanted to ask, as I understand it--and whoever's most 
appropriate to answer this question--that part of the screening 
process would be to match it up against the terrorist watch 
list. And this, of course, makes sense, in terms of making sure 
that those individuals on the list don't receive cards. So, 
that is part of the screening process. Is that right?
    Mr. Pistole. That's correct, Senator.
    Senator Ayotte. And have you ever had a situation where a 
TWIC applicant has actually been on the list--a known or 
suspected terrorist?
    Mr. Pistole. Yes.
    Senator Ayotte. Can you give us a sense on how frequently 
that has occurred?
    Mr. Pistole. So--infrequently, fortunately. And the actual 
number is sensitive security information. But----
    Senator Ayotte. Right.
    Mr. Pistole.--it's a small number, out of the 1.8 million. 
But, yes, we do have--and I can give you the exact number--but, 
we do have a small number of people who are on the watch list 
who have applied and been denied.
    Senator Ayotte. And if that occurs, is the process denial?
    Mr. Pistole. So, it would probably be denial. But, there 
may be an instance, because of the reason the person's on the 
watch list; and so we have to go back to the FBI or the 
intelligence community to see why they're on the watch list. Is 
there something--because, there are all different levels of 
reasons, whether it's material support, fund raisers, as 
opposed to bomb throwers. So, there may be something in there 
that would be mitigating.
    Senator Ayotte. So, is there a procedure in place to 
coordinate with other agencies--for example, the FBI--in terms 
of how you deal with someone on the watch list that applies for 
the TWIC?
    Mr. Pistole. Yes. So, there is. But, in the process of 
preparing for this hearing, I've found something that we can 
improve that I don't want to go into in an open hearing. But, 
yes, there is a vulnerability there that we need to address, 
both between us and with the FBI.
    Senator Ayotte. Is that something that we could learn about 
in a more appropriate----
    Mr. Pistole. Yes, absolutely.
    Senator Ayotte.--classified setting?
    Mr. Pistole. Sure.
    Senator Ayotte. Because, I think it's very important. 
Because, obviously, one of the issues we wanted to address, 
post-9/11, was the coordination among agencies----
    Mr. Pistole. Right.
    Senator Ayotte.--and making sure that, if we have that 
situation, that, if we need to create a situation where further 
intelligence-gathering has to occur, we're all working from the 
same page. So, I would really appreciate that answer in a more 
appropriate setting.
    Mr. Pistole. Absolutely. I'd be glad to do it after this, 
if you have time. But, yes.
    Senator Ayotte. Great. Thank you. I appreciate that.
    I also just wanted to share the concerns, as I understand, 
that have already been raised by my colleagues, and I raised in 
my opening statement, about figuring out a way where the 
multiple trips by the transportation workers to the enrollment 
centers, particularly those that live in areas that aren't so 
close to some of those centers. Is there a better way to do it? 
Can we do it in a more efficient way? And I know that many of 
my colleagues asked you about that, so I won't repeat that. 
But, I would echo their concerns.
    Mr. Pistole. Noted.
    Senator Ayotte. And finally, to the extent you haven't 
answered this, but if you can help me with it--when you're in a 
position where DHS is doing multiple screening processes--and 
you mentioned it in your opening statement--so, one facility, 
for example, could be going through one type of process, and 
that same facility may have to get a screening from you in 
another process. What is it that you are doing to eliminate 
those redundancies that--you know, one of the concerns--it's 
not just a cost issue of how much the redundancies cost on both 
the applicant and the government cost, but also, when you've 
got the right hand and the left hand, you can end up in 
confusion. So, if you could address that, I'd appreciate it.
    Mr. Pistole. Sure, Senator. So, there are a couple aspects 
to this. One is what we're doing, in terms of trying to limit 
the number of security threat assessments, the STAs, that would 
be done for somebody who has any type of government-issued ID 
that gives them access to something. So, we--15 million people, 
that I've mentioned, in the private sector, that we do some 
type of background and credentialing for them--so, do they--if 
they have, for example, a TWIC card, a hazardous material 
endorsement card, if they're an aviation worker--have access, 
or something--any number of things--and, of course, different 
things for other components--can we use that STA, that security 
threat assessment, that would apply to all of those? So, that's 
something that we're working through, just to streamline, make 
more efficient.
    In terms of the enrollment, I know, between Coast Guard and 
TSA, we have consolidated some centers. So--and I would defer 
to the Coast Guard, in terms of the details of that--where a 
person would be able to go into a TWIC enrollment center and 
apply for something that would be a Coast Guard card. And so--
--
    Senator Ayotte. Can you help me, also, in thinking about 
this--is there one universal standard, or are there multiple 
standards that--and can we move, in appropriate settings, to 
one universal standard for, obviously, similarly situated 
settings for threat?
    Mr. Pistole. So, there's not----
    Senator Ayotte. That would seem simpler, from----
    Mr. Pistole. Right.
    Senator Ayotte.--a government perspective.
    Mr. Pistole. Yes. And that would be--and it would be good 
for industry in many respects. But, for example, the criteria 
and standards that would be used--that we use on a national 
level for TWIC cards is a different standard than individual--
450 airports, for the--what they call the SIDA, the S-I-D-A, 
access--so--which are issued locally by each airport--and so, 
there--there's not constituency there. And then--so, there are 
a number of issues that we could peel back on that that would 
be helpful, that we are moving to try to address. There are a 
number of challenges there.
    Senator Ayotte. Well, you know, I appreciate that this is 
challenging. And I hope that, to the extent we can, we do move 
to a universal screening process for those that are in the same 
category. I can recognize that there may be additional 
screening for those in different categories, depending on the 
amount of risk that could be incurred, based on the activity.
    Mr. Pistole. Exactly.
    Senator Ayotte. But, it seems to me that that would be a 
better way to rank it and rate it, based on risk of activity, 
with screening, so that we could use our resources more 
efficiently in a universal standard.
    Mr. Pistole. Agreed. Agreed.
    Senator Ayotte. So----
    Senator Lautenberg. The record will be open for further 
submissions.
    Senator Ayotte. Great.
    Thank you very much.
    Senator Lautenberg. I would ask a question, here, related 
to something Senator Ayotte was talking about, about trying to 
define risks regarding the individual who's applying for the 
card. But, I go further, and it's said, and I'm sure you're all 
aware, that New Jersey is home to the most at-risk area for a 
terrorist attack in the United States. The FBI said, the 
distance from the Newark Airport to the harbor is the most 
dangerous 2 miles in the country for a terrorist attack. There 
are 12 million people within a short radius of that area. So, 
shouldn't the TSA, Mr. Pistole--and either one of you, as 
well--prioritize these high-risk areas for TWIC funding and 
implementation, and move on these things in some kind of 
priority basis?
    Mr. Pistole. Chairman, I think it--yes, exactly. And the--
part of this fits in with what we are doing with what we're 
describing as a risk-based security initiative, and it applies 
as much to aviation as anything. But, that--this fits within 
that--that we expedite those in those high-risk areas, 
recognizing, similar to the Transportation Security Grant 
Program, that there are a lot of different opinions about how 
those funds should be allocated. There's also different 
priorities, depending on what outcome you're trying to achieve. 
So, clearly, those who have access to the most sensitive high-
risk areas should be expedited, and we'll take that back.
    Senator Lautenberg. Thank you.
    This hearing is to be adjourned. And we will keep the 
record open. And I ask that, within some degree of promptness, 
that responses be given in writing.
    And I thank you, Senator Ayotte, for being here and for 
your questions.
    Thank all of you.
    [Whereupon, at 4 p.m., the hearing was adjourned.]
                            A P P E N D I X

    Response to Written Questions Submitted by Hon. Bill Nelson to 
                          Hon. John S. Pistole
    Question 1. What specific efforts have been made to partner with 
the states to ensure that TSA is granted access to states' criminal 
records, and guarantee that important information is not being 
neglected from background checks?
    Answer. The Department of Homeland Security, including the 
Transportation Security Administration (TSA), recognizes that there is 
additional information at the state level not available currently via 
the criminal history records information provided from the Department 
of Justice, Federal Bureau of Investigation (FBI).
    TSA has worked with the states, FBI and the National Crime 
Prevention and Privacy Compact Council to convene working groups to 
identify possible solutions to receive data directly from other states 
and to identify a standard, automated, cost efficient and effective 
solution. TSA discovered multiple problems with obtaining information 
directly from the states:

        a. The states have varying data systems, legal and practical 
        constraints, and TSA would likely be required to develop and 
        build a unique solution for each state in order to request data 
        directly for each Security Threat Assessment (STA) case. To 
        minimize these problems, TSA has discussed with the states an 
        option of defining one common technical solution through which 
        states could send their data directly to TSA. TSA is pursuing 
        this effort as part of the Transportation Threat Assessment and 
        Credentialing (TTAC) Infrastructure Modernization (TIM) 
        program, which was established to standardize and consolidate 
        TSA's security threat assessment systems.

        b. Because many transportation workers have resided in and 
        continually travel across multiple states, requesting and 
        receiving state level data from only an applicant's state of 
        residence or enrollment may miss criminal history in other 
        states.

        c. Some states may require additional fees to request and 
        receive information directly, rather than using the FBI's 
        system. Most TSA STA programs are primarily funded via user 
        fees and this additional cost could dramatically increase the 
        fees charged to workers.

    For all these reasons, TSA has determined that using the 
established FBI Interstate Identification Index (III) system to request 
and receive data from all states would be the most effective and 
efficient solution. State level criminal history data may be accessed 
via the III system managed by the FBI. The extent of access to state 
level data is based on the purpose for the data request; however, a 
program must be deemed to have a criminal justice purpose in order to 
receive the full breadth of Criminal History Records Information (CHRI) 
available from all 50 states and the District of Columbia. Many states 
may not upload all available information into the FBI biometric system 
made available to TSA today, and many states do not provide their III 
records for ``non-criminal justice'' activities.
    The Department of Justice has deemed that TSA's security threat 
assessments for TWIC and other similar programs are non-criminal 
justice activities. As a result, TSA is effectively provided the same 
access as an employer, and does not receive all available information. 
Additionally, TSA is not authorized to request subsequent CHRI for the 
purpose of conducting recurrent criminal background checks without a 
submission of new fingerprints from the individual.
    To provide the most robust recurrent vetting against criminal 
history records, TSA needs full access to CHRI similar to the access 
granted to criminal justice agencies and law enforcement officers. TSA, 
in coordination with the Department of Homeland Security (DHS), has and 
will continue to work with the FBI, the National Crime Prevention and 
Privacy Compact Council, and states to expand access to the CHRI.

    Question 2. The TWIC program currently does not make an effort to 
ensure that its holders are legally permitted to work under our 
immigration laws. Our immigration system is largely administered by the 
same department in which TSA is contained, the Department of Homeland 
Security, and it's no secret that individuals are permitted to work for 
different lengths of time, and that visas expire. Why doesn't the TWIC 
program reflect the reality of our immigration laws?
    Answer. The design of the Transportation Worker Identification 
Credential (TWIC) vetting program seeks to ensure consistency with 
current immigration laws, including the need to accommodate visa 
holders who receive an extension to their stay.
    TWIC leverages the capabilities of the Department of Homeland 
Security (DHS) as related to immigration. TWIC applicants who are not 
U.S. citizens undergo an immigration check using the U.S. Citizenship 
and Immigration Services (USCIS) Systematic Alien Verification for 
Entitlements (SAVE) data base. This check reviews an applicant's 
immigration status using TWIC-eligible immigration categories, 
developed as part of the rulemaking effort, that include visa 
categories that relate to working in the maritime industry. If the 
immigration check reveals information demonstrating that the individual 
is not in a TWIC-eligible immigration category, the individual is 
determined to be ineligible. If the check indicates that the individual 
may be in the U.S. illegally or improperly, the individual is 
determined ineligible and the Transportation Security Administration 
(TSA) coordinates with immigration authorities to take appropriate 
action.
    Input from industry and stakeholders strongly suggested that 
linking the TWIC expiration date to a non-U.S. citizen's visa 
expiration date would be problematic. Industry feedback focused on 
minimizing the disruption to ports and the flow of commerce when a non-
U.S. citizen's visa date was extended, as frequently happens. 
Electronic security features on the current TWIC make it impossible to 
extend the expiration date to reflect the extension of the visa. 
Furthermore, the TWIC expiration date is printed on the card. If the 
TWIC expiration was tied to the original visa expiration, the TWIC 
holder would have to assume the cost and process to get a new TWIC each 
time the visa was extended, or each time the individual came to the 
U.S. to conduct business. The ports would incur the economic cost of 
the individual's inability to access secure areas.
    As an alternative, the determination was made that individual 
employers--at the local level--should track the visa information on 
their non-immigrant employees, as they are required to do by law 
already, independent of TWIC. Per the TWIC regulation, individual TWIC 
holders are responsible for returning their TWICs if they no longer 
meet eligibility requirements and employers are responsible for 
collecting an individual's TWIC upon the expiration of his/her work 
visa.
    TSA believes believe the current process strikes a reasonable 
balance between ensuring only those who are in lawful status to work in 
the U.S. have access to regulated facilities and the need to 
accommodate business needs when visa holders receive an extension to 
their stay. Changing the requirement for the TWIC expiration date would 
entail significant changes to the current system and processes, 
including close integration with other DHS components and the 
Department of State, as well as oblige the TWIC holder to incur 
additional costs to obtain new credentials correlated with the duration 
of the individual's visa.

    Question 3. The contractors running the TWIC program have only 
denied one application that came under their discretionary review 
authority. What sort of oversight is there for the 460,786 other 
applicants who were flagged by the first check, but ultimately granted 
TWICs? Is there any follow up to insure that the proper judgment was 
made about those individuals?
    Answer. The Transportation Worker Identification Credential (TWIC) 
program employs contractors for the TWIC enrollment and operations, and 
separate contractors to assist with the high volume of TWIC 
applications to review background check information. The Transportation 
Threat Assessment and Credentialing (TTAC) staff makes the vast 
majority of initial denial decisions and all final denial decisions. 
The majority of the 460,786 approvals listed were made by the 
contractor after review of the background check information. TTAC 
provides a four-phased training program to all new adjudicators, both 
contractors and Federal employees, during which time the trainees are 
constantly evaluated. In order for a trainee to obtain status as a 
self-approver, he/she must pass a test administered by the government. 
After a trainee has been approved to be a self-approver, the government 
maintains a quality assurance process, where 5 to 10 percent of each 
self-approver's decisions are randomly reviewed each day to identify 
potential errors.
    It is important to note that the statement from GAO concerning the 
adjudicator's denial of ``one application that came under their 
discretionary review authority'' relates to a sentence in the TWIC 
regulations (49 CFR 1572.107(b)) that permits the Transportation 
Security Administration (TSA) to disqualify an applicant for 
``extensive foreign or domestic criminal convictions; a conviction for 
a crime not listed in 1572.103; or a period of foreign or domestic 
imprisonment that exceeds 365 consecutive days.'' TSA created this 
provision to cover the unusual circumstance of an applicant who 
appeared to pose a distinct ``terrorism security risk'' called for by 
the statute (46 U.S.C. 70105), but did not have serious criminal 
convictions listed on the specific list of disqualifying offenses. TSA 
never intended this provision to cover petty or frequent violators of 
the criminal code who, while perhaps untrustworthy and deceitful, did 
not pose a ``terrorism security risk.'' TSA intended for the list of 
criminal disqualifiers and periods for disqualification that are set 
forth by statute and regulation to be the primary list we would use to 
evaluate an applicant as to criminal history. (In fact, as of March 
2011 TSA has denied TWICs to 35,661 out of 1.8 million applicants.
                                 ______
                                 
Response to Written Questions Submitted by Hon. Frank R. Lautenberg to 
                          Hon. John S. Pistole
    Question 1. It was discovered last week that Al Qaeda was planning 
an attack on a U.S. rail line. To date, TSA's efforts on rail security 
have been delayed, incomplete and nearly nonexistent compared to 
aviation security. In light of this new plot, what immediate steps are 
you taking to increase rail security measures?
    Answer.
Mass Transit and Passenger Railroad Security
    In response to the news that Al Qaeda was planning an attack on a 
U.S. rail line, the Transportation Security Administration (TSA) held 
teleconference calls with the Transit Policing and Security Peer 
Advisory Group (PAG) on Monday, May 2, 2011, and Friday, May 6, 2011. 
The PAG was established under the Sector Coordinating Council structure 
and serves as a vital component for the mass transit industry.
    On the May 2 call, TSA encouraged all public transportation 
agencies to ramp up visible deterrence measures, and promoted the value 
of conducting unscheduled Regional Alliances including Local, State, 
and Federal Effort (RAILSAFE) operations.
    During the May 6 call, the PAG members discussed increased rail 
security measures that their respective public transportation systems 
were implementing. Such measures include:

   Maintaining high levels of K9 units deployed, including 
        vapor-wake teams on Amtrak trains

   Special briefings of engineers/track employees to emphasize 
        reporting of suspicious activity along Right of Way

   Implementing special operations deployments

   Participating in Visible Intermodal Prevention and Response 
        (VIPR) Team missions in critical locations

   Deploying Anti-Terrorism Teams

   Sending out awareness notices urging vigilance to transit 
        police and employees

   Emphasizing the ``See Something, Say Something'' campaign

   Adding extra police patrols over the weekend

    In addition to the independent security actions taken above, the 
public transportation agencies across the United States conducted a 
RAILSAFE exercise on Tuesday, May 5, 2011, which was stood-up in less 
than 24 hours, and involved over 90 agencies across 29 states and the 
District of Columbia, incorporating over 1,000 officers.
    Going forward, TSA will continue Security Awareness messages and 
Operational Deterrence Programs, which include training, public 
awareness, K9 units, and VIPR Teams. The focus will shift from extended 
periods of time to shorter periods, such as months or weeks. TSA 
encourages continuing RAILSAFE operations on a random basis to prepare 
for various security threats.
Freight Rail
    For nearly a decade, the freight rail industry, with guidance and 
assistance from TSA, has taken steps to reduce vulnerabilities within 
the freight rail network, specifically, the vulnerability of 
potentially dangerous cargoes. The industry has sought to raise the 
baseline of security by emphasizing employee training and awareness, 
and by instituting fundamental changes to daily processes that 
emphasize deterrence and increase the likelihood of detection of 
potential acts of terrorism.
    Regarding the most recent intelligence that Al Qaeda had plans to 
attack trains or railroad infrastructure, the information garnered was 
non-specific and general in nature. As such, TSA immediately 
communicated with the freight railroad industry and advised them to 
continue a state of vigilance and awareness. The success of this 
increased vigilance was evidenced by the increase in reporting of 
suspicious incidents detected throughout the railroad industry.
    In summary, TSA will continue to work closely with the freight 
railroad industry to ensure appropriate processes are in place that 
will enable them to meet emerging threats and continue to improve the 
baseline of security in the industry.

    Question 2. The TWIC program has more than one point eight (1.8) 
million people enrolled across the country, from crane operators to 
Alaskan fishermen. All of these applicants have access to secure 
facilities throughout the United States with their TWIC cards. Plus, 
the current enrollment process doesn't even check to see if these 
applicants legitimately need access to secure facilities. Are you 
confident that the TWIC program is making our ports more secure?
    Answer. The Transportation Security Administration (TSA) is 
confident that the Transportation Worker Identification Credential 
(TWIC) program has made the United States' ports more secure. Although 
the 1.8 million workers who have been issued TWICs are eligible to be 
granted unescorted access to secure areas of regulated facilities and 
vessels, they are not entitled or allowed to enter secure areas of 
facilities and vessels without the permission of the owners or 
operators of those facilities.
    Prior to the implementation of TWIC, the identity document 
requirements for access to secure areas of ports and vessels were 
dependent on each facility's Facility Security Plan. Facilities often 
accepted a number of documents such as a driver's license, passport, 
state ID, port/facility specific security card, or a Z-card (now 
Merchant Mariner Credential). Without uniform credential issuance 
processes, most facilities were unable to positively authenticate the 
identity of an individual or determine the authenticity of the identity 
documents presented. There also were no universal methods for 
determining if a once-valid credential holder were no longer eligible 
for access privileges, or to effectively revoke an individual's access 
permissions or credentials. TWIC enhances maritime security by 
providing one standardized biometric credential, removing the need to 
have security personnel discern the authenticity of multiple identity 
documents. In addition, TWIC standardized the security threat 
assessment (STA) conducted on workers in these secure areas to include 
comprehensive terrorism, criminal history, and immigration checks.
    In advance of a rule requiring reader use, ports are now made more 
secure by readers installed and in use through the recently completed 
TWIC reader pilot; the voluntary installation and use of readers at 
many facilities; and the more than 200 portable readers used by Coast 
Guard personnel to check TWICs during routine facility inspections. The 
use of these readers confirms that a valid TWIC is present, that it has 
not expired, and that it has not been revoked. In the biometric mode, 
the worker's identity is confirmed. Port security will continue to be 
enhanced as more electronic readers are put into use at secure 
facilities and vessels around the country.

    Question 3. When the TWIC program expanded nationwide, most cards 
were issued within a short period of time--and most of those cards are 
set to expire in 2012. What is TSA doing to work with labor and 
industry to prepare for the expiration of the current credentials?
    Answer. The Transportation Worker Identification Credential (TWIC) 
enrollments began in October 2007 when enrollment centers were phased 
in nationwide. Over the eighteen month period from October 2007 until 
the national compliance date of April 15, 2009, 1.1 million people 
applied for a TWIC. The Security Threat Assessment and associated TWIC 
for each applicant must be renewed every 5 years, for the credential to 
remain valid. Therefore, the expiration dates for the initial 
population of TWIC holders is spread out from October 2012 to April 
2014 (5 years after the national compliance date). Preparations are 
being made in advance of the impending initial five-year renewal cycle. 
The Transportation Security Administration (TSA) is in the process of 
developing policies and procedures that will ensure a smooth renewal 
phase for the transportation workers who rely on this card to do their 
jobs. TSA's enrollment services contract provides for increased hours 
and days of operation, and additional equipment and personnel to meet 
fluctuating demands for service. These procedures both minimize the 
operational impact at TWIC enrollment centers, and ensure that 
individuals who have completed the redress process are not required to 
repeat the process when no new criminal information is found. This 
approach will help expedite adjudication during the expected surge in 
renewal enrollments. Throughout this process, TSA will continue to 
engage the stakeholder community in order to minimize the impact of the 
renewal cycle on affected workers.
                                 ______
                                 
     Response to Written Questions Submitted by Hon. Jim DeMint to 
                          Hon. John S. Pistole
    Question 1. From GAO's ``TWIC Security Review'' (GAO-11-657):
    ``While TSA does not track metrics on the number of TWICs provided 
to applicants with specific criminal offenses not defined as 
disqualifying offenses, as of September 8, 2010, the agency reported 
460,786 cases where the applicant was approved, but had a criminal 
record based on the results from the FBI. This represents approximately 
27 percent of individuals approved for a TWIC at the time. In each of 
these cases, the applicant had either a criminal offense not defined as 
a disqualifying offense or an interim disqualifying offense that was no 
longer a disqualification based on conviction date or the applicant's 
release date from incarceration. Consequently, based on TSA's 
background checking procedures, all of these cases would have been 
reviewed by an adjudicator for consideration as part of the second-
level background check because derogatory information had been 
identified. As such, each of these cases had to be examined and a 
judgment had to be made as to whether to deny an applicant a TWIC based 
on the totality of the offenses contained in each applicant's criminal 
report.
    While there were 460,786 cases where the applicant was approved, 
but had a criminal record, TSA reports to have taken steps to deny 1 
TWIC applicant under this authority.''
    Does the TSA track metrics on the number of TWICs provided to 
applicants with specific offenses defined as disqualifying offenses? If 
so, how many TWICs have been provided to such applicants? Is it 
accurate to conclude that an applicant with specific offenses defined 
as disqualifying offenses may only be provided a TWIC after receiving a 
waiver?
    Answer. As of March 2011, TSA has enrolled and vetted over 1.8 
million maritime workers. As a result of DHS's rigorous vetting 
process, 35,661 individuals were denied from receiving a TWIC. To 
clarify the quoted statement from the GAO report in the second 
paragraph of the question, that only 1 applicant has been denied a TWIC 
``under this authority'', the authority is the 49 CFR 1572.107(b) 
provision of the TWIC regulation. This provision permits the 
Transportation Security Administration (TSA) to disqualify an applicant 
for ``extensive foreign or domestic criminal convictions; a conviction 
for a crime not listed in 1572.103; or a period of foreign or domestic 
imprisonment that exceeds 365 consecutive days.'' TSA created this 
provision to cover the unusual circumstance of an applicant who 
appeared to pose a distinct ``terrorism security risk'' called for by 
the statute (46 U.S.C. 70105), but did not have serious criminal 
convictions listed on the specific list of disqualifying offenses. TSA 
never intended this provision to cover petty or frequent violators of 
the criminal code who, while perhaps untrustworthy and deceitful, did 
not pose a ``terrorism security risk.'' TSA intended for the list of 
criminal disqualifiers and periods for disqualification that are set 
forth by statute and regulation to be the primary list we would use to 
evaluate an applicant as to criminal history.
    TSA tracks metrics on the number of Transportation Worker 
Identification Credentials (TWICs) provided to applicants, with 
specific offenses defined as disqualifying, who apply for an appeal or 
waiver. TSA approved 44,444 appeal requests and 7,962 waiver requests 
as of June 5, 2011, that involve disqualifying criminal offenses.
    An applicant, with specific offenses defined as disqualifying may 
also be provided a TWIC after approval of his/her request for an appeal 
where the applicant is able to prove that the disqualifying offense is 
out of scope (conviction is greater than 7 years old and release from 
incarceration on that disqualifying offense is greater than 5 years 
old), the conviction was later reversed on appeal, the applicant is not 
the person who committed the offense, or other fact that shows that the 
disqualifying offense standards have not been met.

    Question 2. How many applicants with the following criminal 
offenses as part of their backgrounds have been issued TWICs through a 
waiver process?
    a. A crime involving a transportation security incident. A 
transportation security incident is a security incident resulting in a 
significant loss of life, environmental damage, transportation system 
disruption, or economic disruption in a particular area, as defined in 
46 U.S.C.  70101. The term economic disruption does not include a work 
stoppage or other employee-related action not related to terrorism and 
resulting from an employer-employee dispute.
    Answer. 4 waivers approved

    Question 2b. Improper transportation of a hazardous material under 
49 U.S.C. 5124, or a state law that is comparable.
    Answer. 22 waivers approved

    Question 2c. Unlawful possession, use, sale, distribution, 
manufacture, purchase, receipt, transfer, shipping, transporting, 
import, export, storage of, or dealing in an explosive or explosive 
device. An explosive or explosive device includes, but is not limited 
to, an explosive or explosive material as defined in 18 U.S.C.  
232(5), 841(c) through 841(f), and 844(j); and a destructive device, as 
defined in 18 U.S.C.  921(a)(4) and 26 U.S.C.  5845(f).
    Answer. All crimes involving explosives, explosives devices, and/ 
or other lethal devices are classified in the same manner. 89 waivers 
approved

    Question 2d. Murder.
    Answer. 564 waivers approved

    Question 2e. Making any threat, or maliciously conveying false 
information knowing the same to be false, concerning the deliverance, 
placement, or detonation of an explosive or other lethal device in or 
against a place of public use, a state or government facility, a public 
transportations system, or an infrastructure facility.
    Answer. All crimes involving explosives, explosives devices, and/ 
or other lethal devices are classified in the same manner. Question c. 
and e. are tracked as one metric with a total of 89 waivers approved 
for all explosive crimes.

    Question 2f. Violations of the Racketeer Influenced and Corrupt 
Organizations Act, 18 U.S.C.  1961, et seq., or a comparable state 
law, where one of the predicate acts found by a jury or admitted by the 
defendant, consists of one of the crimes listed in paragraph 49 C.F.R. 
 1572.103(a).
    Answer. All crimes involving Violations of the Racketeer Influenced 
and Corrupt Organizations Act are classified in the same manner. 26 
waivers approved

    Question 2g. Attempt to commit the crimes in paragraphs listed 
under 49 C.F.R.  1572.103(a)(1) through (a)(4).
    Answer. Attempts to commit the crimes in paragraphs listed under 49 
C.F.R.  1572.103(a)(1) through (a)(4) are not tracked separately.

    Question 2h. Conspiracy or attempt to commit the crimes in 49 
C.F.R.  1572.103(a)(5) through (a)(10).
    Answer. Conspiracy or attempt to commit the crimes in 49 C.F.R.  
1572.103(a)(5) through (a)(10) are not tracked separately.

    Question 2i. Unlawful possession, use, sale, manufacture, purchase, 
distribution, receipt, transfer, shipping, transporting, delivery, 
import, export of, or dealing in a firearm or other weapon. A firearm 
or other weapon includes, but is not limited to, firearms as defined in 
18 U.S.C.  921(a)(3) or 26 U.S.C.  5845(a), or items contained on the 
United States Munitions Import List at 27 C.F.R.  447.21.
    Answer. 942 waivers approved

    Question 2j. Extortion.
    Answer. 6 waivers approved

    Question 2k. Dishonesty, fraud, or misrepresentation, including 
identity fraud and money laundering where the money laundering is 
related to a crime described in 49 C.F.R.  1572.103(a) or (b). Welfare 
fraud and passing bad checks do not constitute dishonesty, fraud, or 
misrepresentation for purposes of this paragraph.
    Answer. 922 waivers approved

    Question 2l. Bribery.
    Answer. 12 waivers approved

    Question 2m. Smuggling.
    Answer. 9 waivers approved

    Question 2m. Immigration violations.
    Answer. 0

    Question 2o. Distribution of, possession with intent to distribute, 
or importation of a controlled substance.
    Answer. 2,968 waivers approved

    Question 2p. Arson.
    Answer. 61 waivers approved

    Question 2q. Kidnapping or hostage taking.
    Answer. 24 waivers approved

    Question 2r. Rape or aggravated sexual abuse.
    Answer. 281 waivers approved

    Question 2s. Assault with intent to kill.
    Answer. 4 waivers approved

    Question 2t. Robbery.
    Answer. 552 waivers approved

    Question 2u. Fraudulent entry into a seaport as described in 18 
U.S.C.  1036, or a comparable state law.
    Answer. 0 waivers approved

    Question 2v. Violations of the Racketeer Influenced and Corrupt 
Organizations Act, 18 U.S.C.  1961, et seq., or a comparable state 
law, other than the violations listed in paragraph 49 C.F.R.  
1572.103(a)(10).
    Answer. All crimes involving Violations of the Racketeer Influenced 
and Corrupt Organizations Act are classified in the same manner. 
Question f. and v. are tracked as one metric with a total of 26 waivers 
approved for all RICO crimes.

    Question 2w. Conspiracy or attempt to commit the interim 
disqualifying felonies.
    Answer. Conspiracy or attempt to commit interim disqualifying 
felonies are not tracked separately.

    Question 3. From GAO's ``TWIC Security Review'' (GAO-11-657):
    ``TSA regulations provide that in determining whether to grant a 
waiver, TSA will consider: (1) the circumstances of the disqualifying 
act or offense; (2) restitution made by the applicant; (3) any Federal 
or state mitigation remedies; (4) court records or official medical 
release documents indicating that the applicant no longer lacks mental 
capacity; and (5) other factors that indicate the applicant does not 
pose a security threat warranting denial of a hazardous materials 
endorsement or TWIC.''
    These criteria generally, and (5) in particular, seem to grant 
broad latitude to TSA to grant TWICs to convicted felons. Please detail 
for the committee the guidance you have provided to your staff 
regarding the granting of waivers for disqualified individuals.
    Answer. The waiver review regulation is designed to provide a 
framework, for subjective assessment of whether the Transportation 
Worker Identification Credential (TWIC) applicant has overcome the 
presumption that he/she poses a security risk, for reviewing the 
totality of the TWIC applicant's criminal background and circumstances. 
The Transportation Security Administration (TSA) has maintained 
extensive communication between TSA's Office of Chief Counsel (OCC) and 
Office of Transportation Threat Assessment and Credentialing (TTAC) to 
develop guidelines and training materials to accomplish waiver reviews 
and make waiver determinations. Each waiver request is assessed by 
obtaining and reviewing information from the applicant as well as 
pertinent law enforcement, legal, business, and community officials. 
Once sufficient material has been obtained and reviewed, a 
recommendation to grant or deny the waiver is made to the appropriate 
TTAC decisionmaking official, and the TTAC official makes the waiver 
decision.
    According to 46 U.S.C. 70105(c)(2), TSA must develop a waiver 
program and give ``consideration to the circumstances of any 
disqualifying act or offense, restitution made by the individual, 
Federal and State mitigation remedies, and other factors.''
    TSA proposed a list of disqualifying offenses and did not limit the 
crimes that are eligible for a waiver in its initial notice of proposed 
rulemaking, which was subject to broad public comment, and included 
consultation with the Department of Justice as part of the rulemaking 
process. Many comments asserted that criminal history generally does 
not give rise to the ``terrorism security risk,'' as called for by the 
statute, and the list of disqualifying offenses should be much shorter 
than TSA's proposed list. Many feared that too many workers would be 
disqualified, and commerce and small businesses would suffer 
significantly as a result. Thus, TSA balanced a variety of important 
legal and policy issues in arriving at the current policy.
                                 ______
                                 
  Response to Written Questions Submitted by Hon. Roger F. Wicker to 
                          Hon. John S. Pistole
    Question 1. What steps were taken to identify security 
vulnerabilities in the TWIC program before it was implemented?
    Answer. The Transportation Worker Identification Credential (TWIC) 
program followed the principle of establishing a chain-of-trust from 
the initial enrollment of an applicant to delivery of their TWIC. Best 
practices from other credentialing programs were reviewed and adopted 
as appropriate. Integrating document authenticating scanner technology 
to assist in identifying counterfeit documents, such as driver licenses 
and passports, and comparing a new applicant's fingerprints to those of 
previous applicants, to catch an attempt to enroll more than once, are 
two examples of adopting best practices from other programs.
    The secure card technology and issuance procedures for a TWIC are 
very similar to the standards developed for government workers and 
contractors, specified for the Personal Identity Verification (PIV) 
card. The physical security features on the card meet the highest 
levels of counterfeit resistance specified by the Government. The 
procedures for issuing the TWIC ensure that the card is only delivered 
to its rightful holder.

    Question 2. The information encoded in the TWIC cards includes 
sensitive information about the cardholders, including information that 
could be used to profile cardholders. What steps are taken to protect 
this information from being leaked to third parties?
    Answer. Protecting personal privacy is a key component of the 
Transportation Worker Identification Credential (TWIC) program's 
mission statement. TWIC includes limited personal information contained 
on the card. The TWIC contains only three elements of personal 
information: name, facial photograph, and fingerprint templates for two 
fingerprints. The cardholder's name is printed on the card and encoded 
on the Integrated Circuit Chip (ICC) so that it may be freely read by a 
card reader. The facial photograph is also printed on the card and 
encoded on the ICC. However, it is encoded on the ICC such that it is 
protected from being viewed by a card reader without a Personal 
Identification Number (PIN)--selected by, and known only to, the 
cardholder. The fingerprint templates are stored in two locations on 
the card to facilitate use by either a TWIC reader or a Personal 
Identity Verification card reader. In the first case, the algorithm is 
encrypted to prevent disclosure of the template if an attempt is made 
to ``skim'' (i.e., the practice of intercepting information from a 
smart card using a device without the knowledge of the card holder) the 
card using radio-frequency technology. To decrypt the algorithm, a 
cardholder must physically ``swipe'' or insert his/her card into a 
reader. Thus, an un-encrypted fingerprint template cannot be obtained 
without the cardholder's action. In the second case, the algorithm is 
available only after entering a PIN.
    Note: A fingerprint template is a compact digital representation of 
distinct characteristics derived from a fingerprint image. Fingerprint 
templates are used as the basis for comparison during biometric 
authentication.

    Question 3. After the Agency addresses the problems cited by the 
GAO report, how will it evaluate those remediation steps to determine 
that they close the gaps the GAO identified?
    Answer. The Transportation Security Administration (TSA) is 
currently working to initiate the recommended controls assessment of 
the Transportation Worker Identification Credential (TWIC) program. As 
part of this assessment, a method will be established for each control 
enhancement that defines how TSA will monitor the effectiveness of the 
change. While the evaluation technique will depend on the remediation 
method, TSA plans to continue unannounced system and operational audits 
regarding key security areas. In addition, reporting mechanisms will be 
created that will assist TSA in ensuring that any new security 
procedures are being followed.

    Question 4. Robust and effective cybersecurity and the protection 
of freight information systems are important elements in port security 
for the United States. Among other important goals of port security are 
the ability to reliably and economically detect weapons of mass 
destruction that may be hidden in containers and cargo. Additionally it 
is important to verify the trustworthiness of foreign shippers. The 
compromise of data and information systems that relate to these 
vulnerabilities would represent critical risks to national security. 
Has the cybersecurity of port security systems, and related freight 
information, been addressed?
    Answer. Yes. All U.S. Customs and Border Protection (CBP) systems, 
including port security systems, abide by the Federal Information 
Security Management Act (FISMA) of 2002. FISMA requires each Federal 
agency to develop, document, and implement an agency-wide program to 
provide information security for the information and information 
systems that support the operations and assets of the agency. CBP has 
developed a robust Certification and Accreditation program to align 
with the goals and objectives of FISMA. Additionally, the Security and 
Technology Policy Branch ensures that port security systems align with 
DHS Sensitive Systems Policy Directive 4300A and CBP Information 
Systems Security Policies and Procedures Handbook 1400-05D.
    The National Cyber Security Division (NCSD), within the National 
Protection and Program Directorate's Office of Cybersecurity and 
Communications, is working with its public and private sector partners 
to address industrial control systems security and general 
cybersecurity at port and shipping facilities. Its Control Systems 
Security Program (CSSP) provided resources to conduct high-level 
assessments in Boston, Houston, and Norfolk. The assessment reports are 
still in development. Using the Cyber Security Evaluation Tool, CSSP 
will be conducting evaluations at ports and terminals located at the 
top ten facilities, based on a ranking by the Department of 
Transportation's Bureau of Transportation Statistics, as well as Maersk 
Shipping. In 2009, CSSP conducted several evaluations of freight rail 
facilities, as well as a port facility in Saipan, Commonwealth of the 
Northern Mariana Islands.

    Question 5. What evaluations, assessments, and tests have been 
performed to determine whether other port security systems under the 
agency's purview, such as freight information systems, can be 
compromised as readily as the GAO was able to with the TWIC program?
    Answer. CBP employs a defense-in-depth approach to security. As a 
component of FISMA, a detailed and thorough Security Test and 
Evaluation (ST&E) of port security systems is conducted. Testing 
includes personal interviews, scans of workstations, websites and data 
bases, and a physical site assessment to find and mitigate potential 
vulnerabilities. Additionally, CBP site risk assessments are performed 
to evaluate the site's security posture. Risk assessments are performed 
continuously throughout the calendar year. Each port security system 
also has a dedicated Information Systems Security Officer (ISSO) who 
handles day-to-day security for the system. ISSO duties include daily/
weekly log file examination, review of the CBP Security Operations 
Center monthly enterprise vulnerability scans, and oversight of 
configuration management.
    NCSD's Critical Infrastructure Protection--Cyber Security (CIP-CS) 
program is in discussions with the Maritime Sector Specific Agency 
(U.S. Coast Guard) to scope a Maritime Sector-wide cybersecurity risk 
assessment. This assessment would focus on identifying and assessing 
risks to categories of cyber critical infrastructure that support 
Maritime Sector critical functions. CIP-CS is conducting this work in 
support of the critical infrastructure and key resources cross-sector 
community to identify cyber critical infrastructure and support sector-
wide approaches to cybersecurity risk management.
                                 ______
                                 
Response to Written Questions Submitted by Hon. Frank R. Lautenberg to 
                        Rear Admiral Kevin Cook
    Question 1. The Coast Guard uses a risk analysis model to inform 
decisions on how best to secure our nation's ports and allocate limited 
resources. Could the Coast Guard model be applied to TWIC to assess its 
effectiveness and to enhance security?
    Answer. The Coast Guard Maritime Security Risk Analysis Model 
(MSRAM) is a terrorism risk analysis tool and process used by Coast 
Guard analysts across the nation to perform detailed risk analysis for 
their areas of responsibility. The results of this process are used to 
support a variety of risk management decisions at the strategic, 
operational, and tactical levels.
    During the initial rollout of TWIC, MSRAM data was used as part of 
a risk analysis approach in developing TWIC reader requirements in the 
maritime sector, and MSRAM will continue to provide risk analysis 
support to TWIC. However, since MSRAM is a risk analysis tool and not 
designed or capable of being used as a measure of effectiveness, it is 
not an appropriate model to assess the effectiveness of TWIC.

    Question 2. It has been more than 9 years since the TWIC program 
was created, but ports still do not have readers for the cards. 
Instead, they rely on visual verification, which can be more 
susceptible to fraud. How much will it cost to install readers at ports 
across the country and who is expected to pay for it?
    Answer. The Department of Homeland Security managed the TWIC pilot 
through the joint participation of TSA and the Coast Guard. The Coast 
Guard plans on using data from the TWIC Pilot Program, along with other 
studies and reader vendor data, to estimate the costs to fully 
implement the final card reader phase of the TWIC program. The Coast 
Guard is working on publishing a Notice of Proposed Rulemaking in the 
Federal Register that will present estimates of the costs to install 
readers at affected port facilities and present the number and types of 
affected facilities that will need to install readers. The cost of 
readers, as well as any necessary installation, will be incurred by the 
affected facilities. The ports may apply for grants to fund 
installation.
    TWIC Projects are eligible for funding under the FEMA Port Security 
Grant Program (PSGP). TWIC related projects have been specifically 
funded since FY06 or earlier and identified as a PSGP priority since 
FY07. TWIC Readers and associated equipment have been specifically 
identified as the major component of over $88M of PSGP funded projects 
since FY06. Project size, scope, and costs vary greatly among ports, 
and TWIC projects may typically include readers, cameras, fencing, 
gates, lighting, and associated installation costs as part of the 
overall project.

    Question 3. According to the FBI, New Jersey is home to the most 
at-risk area for a terrorist Answer. attack in the U.S. This area has 
targets ranging from the port to airports to chlorine gas plants. An 
attack in this area could impact 12 million people who live nearby. 
Shouldn't TSA prioritize these high-risk areas for TWIC funding and 
implementation?
    Answer. It is essential that the prioritization for TWIC funding 
and reader implementation be consistent across the Nation. Those 
facilities and vessels that present the highest risk, or are in high-
risk areas, will be prioritized accordingly, as they were in the 
initial TWIC implementation.

    Question 4. GAO investigators were able to fraudulently obtain TWIC 
cards and then use them to access secure facilities. TWIC cards can be 
used to access literally thousands of facilities nationwide. What is 
being done to prevent fraudulently obtained cards from being used to 
access airports, military bases, and other secure facilities?
    Answer. Each port establishes the requirements for access to its 
secure facilities. Possession of a TWIC, while a necessary element for 
access, does not guarantee its holder the right of access absent 
meeting the business case that individual port authorities establish 
for entering their secure facilities. The Coast Guard works with the 
ports to ensure the enforcement of security practices for access to 
secure facilities.
    Another important enhancement will be the use of card readers to 
verify TWICs electronically and ensure that the cards have not been 
revoked. The Coast Guard is currently developing an upcoming rulemaking 
that will include requirements for TWIC readers at Maritime 
Transportation Security Act (MTSA) regulated facilities and vessels. 
Once the final card reader phase of the program is implemented for 
electronic verification of TWICs, it will significantly enhance 
protection against counterfeit, tampered, or expired TWICs being used 
to gain access to MTSA-regulated facilities and vessels.
    Finally, TSA is conducting a review of internal controls for TWIC 
enrollment to identify ways to enhance the program's ability to prevent 
people from obtaining a TWIC using fraudulent identity documents. 
Almost all credentialing programs at all levels of government and the 
private sector face this challenge. TSA follows best practices by 
requiring the use of document authentication technology as a safeguard 
against TWIC applicants using counterfeit or altered identity documents 
at enrollment. DHS will continue to seek out best practices and new 
technologies to ensure that TWIC takes every reasonable precaution 
against fraud.
                                 ______
                                 
             United States Government Accountability Office
                                       Washington, DC, July 6, 2011
Hon. Frank R. Lautenberg,
Hon. Bill Nelson,
Committee on Commerce, Science, and Transportation,
U.S. Senate.

Subject: Transportation Worker Identification Credential: Responses to 
            Posthearing Questions for the Record

    On May 10, 2011, I testified before the Committee on Commerce, 
Science, and Transportation on the Department of Homeland Security's 
(DHS) credentialing program known as the Transportation Worker 
Identification Credential (TWIC). This letter responds to the three 
questions for the record that you posed. The responses are based on 
work associated with previously issued GAO products.\1\ Your questions 
and my responses follow.
---------------------------------------------------------------------------
    \1\ See GAO, Transportation Worker Identification Credential: 
Internal Control Weaknesses Need to Be Corrected to Help Achieve 
Security Objectives, GAO-11-657 (Washington, D.C.: May 10, 2011); 
Transportation Worker Identification Credential: Internal Control 
Weaknesses Need to Be Corrected to Help Achieve Security Objectives, 
GAO-11-648T (Washington, D.C.: May 10, 2011); and Transportation Worker 
Identification Credential: Progress Made in Enrolling Workers and 
Activating Credentials but Evaluation Plan Needed to Help Inform the 
Implementation of Card Readers, GAO-10-43 (Washington, D.C.: Nov. 18, 
2009).
---------------------------------------------------------------------------
    Question 1. Through your covert testing, you were able to obtain 
fraudulent TWIC cards and access secure facilities using fraudulent and 
counterfeit cards. What potential security threats are our ports and 
other secure facilities exposed to because of the problems with the 
TWIC program?
    Answer. We reported in May 2011 that internal control weaknesses in 
TWIC enrollment, background checking, and use could have contributed to 
the breach of Maritime Transportation Security Act (MTSA)-regulated 
ports during covert tests conducted by our investigators.\2\ We had our 
investigators conduct covert testing at TWIC enrollment center(s) to 
identify whether individuals providing fraudulent information could 
acquire an authentic TWIC. Further, during covert tests of TWIC use at 
several selected ports, our investigators were successful in accessing 
ports using counterfeit TWICs, authentic TWICs acquired through 
fraudulent means, and false business cases (i.e., reasons for 
requesting access). Our records show that operations at the ports our 
investigators breached included cargo, containers, and fuel, among 
others.\3\ Our investigators reported that throughout the testing, 
security officers did not question the authenticity of TWICs presented 
for acquiring access.
---------------------------------------------------------------------------
    \2\ GAO-11-657.
    \3\ The details related to the means used by the investigators in 
the tests could not be described here because they were deemed 
sensitive security information by TSA.
---------------------------------------------------------------------------
    According to the Coast Guard's January 2008 National Maritime 
Terrorism Threat Assessment, al Qaeda leaders and supporters have 
identified western maritime assets as legitimate targets.\4\ Moreover, 
according to the Coast Guard assessment, al Qaeda-inspired operatives 
are most likely to use vehicle bombs to strike U.S. cargo vessels, 
tankers, and fixed coastal facilities such as ports. If an individual 
presents an authentic TWIC acquired through fraudulent means when 
requesting unescorted access to the secure areas of a MTSA-regulated 
facility or vessel, the cardholder is deemed not to be a security 
threat to the maritime environment because the cardholder is presumed 
to have met TWIC-related qualifications during a background check. In 
such cases, individuals who wish to do harm to the maritime 
transportation system could better position themselves to 
inappropriately gain unescorted access to secure areas of a MTSA-
regulated facility or vessel.\5\
---------------------------------------------------------------------------
    \4\ U.S. Coast Guard Intelligence Coordination Center, National 
Maritime Terrorism Threat Assessment (Washington, D.C.: Jan. 7, 2008).
    \5\ The TWIC program requires individuals to both hold a TWIC and 
be authorized to be in the secure area by the owner/operator to gain 
unescorted access to secure areas of MTSA-regulated facilities and 
vessels. A regulation on the use of TWICs with card readers is 
currently under development and expected to address how the access 
control technologies, such as biometric card readers, are to be used 
for confirming the identity of the TWIC holder against the biometric 
information on the TWIC.
---------------------------------------------------------------------------
    As we recently reported in May 2011, while one of the goals of the 
TWIC program was to improve security by reducing risks associated with 
fraudulent or altered credentials by using biometrics to positively 
match an individual to the credential, as our covert tests 
demonstrated, an authentic TWIC and a legitimate business case were not 
always required in practice.\6\ As detailed in our report, inspection 
of TWICs with biometric readers is not currently required. Rather, 
TWICs are primarily used as visual identity cards--known as a 
flashpass--where a card is to be visually inspected before a cardholder 
is allowed unescorted access to a secure area of a MTSAregulated port 
or facility. The investigators' possession of TWICs provided them with 
the appearance of legitimacy and facilitated their unescorted entry 
into secure areas of MTSA-regulated ports at multiple locations across 
the country. If individuals are able to acquire authentic TWICs 
fraudulently, verifying the authenticity of these cards with a 
biometric reader will not necessarily reduce the risk of undesired 
individuals gaining unescorted access to the secure areas of MTSA-
regulated facilities and vessels. Our report noted that, unlike prior 
access control approaches, which allowed access to a specific facility, 
the TWIC potentially facilitates access to thousands of facilities once 
the Federal Government attests that the TWIC holder has been positively 
identified and is deemed not to be a security threat.
---------------------------------------------------------------------------
    \6\ GAO-11-657.

    Question 2. According to the FBI, New Jersey is home to the most 
at-risk area for a terrorist attack in the U.S. This area has targets 
ranging from the port to airports to chlorine gas plants. An attack in 
this area could impact 12 million people who live nearby. Shouldn't TSA 
prioritize these high-risk areas for TWIC funding and implementation?
    Answer. Funding for the TWIC program is a shared responsibility 
between the Federal Government and the private sector. TSA's efforts to 
issue the TWIC are to be funded by enrollment fees collected from TWIC 
applicants.\7\ Additional resources, however, would be required if TWIC 
is to be implemented with biometric card readers. For instance, MTSA-
regulated facility operators could be required to expend resources on 
TWIC readers and infrastructure to support TWIC-related operations, 
such as installing fiber optic cables and investing in computing 
system(s) capable of managing and recording TWIC-related access control 
efforts. While funding for such efforts is anticipated to be the 
responsibility of facility operators, limited Federal funding is 
expected to be available through Federal grant programs, such as the 
Federal Emergency Management Agency's (FEMA) Port Security Grant 
Program and the Transit Security Grant Program.\8\ As we previously 
reported, issuance of such grants is, in part, based on available risk 
information.\9\
---------------------------------------------------------------------------
    \7\ TSA was authorized to fund the program's operations by 
collecting $196.8 million in enrollment fees from TWIC applicants from 
Fiscal Years 2008 through 2010.
    \8\ From Fiscal Years 2006 through 2010, $111.7 million had been 
made available to maritime facilities implementing TWIC from FEMA grant 
programs--the Port Security Grant Program and the Transit Security 
Grant Program.
    \9\ See GAO, Transit Security Grant Program: DHS Allocates Grants 
Based on Risk, but Its Risk Methodology, Management Controls, and Grant 
Oversight Can Be Strengthened, GAO-09-491 (Washington, D.C.: June 8, 
2009); and Risk Management: Further Refinements Needed to Assess Risks 
and Prioritize Protective Measures at Ports and Other Critical 
Infrastructure, GAO-06-91 (Washington, D.C.: Dec. 15, 2005).
---------------------------------------------------------------------------
    Funding and implementing TWIC in a risk-informed manner would be 
consistent with our prior work.\10\ The purported benefit of making 
risk-informed investments is that Federal funds are to be directed at 
those programs that are most effective at reducing risk given available 
resources. However, as we reported in May 2011, DHS had not assessed 
the effectiveness of TWIC at enhancing security or reducing risk for 
MTSAregulated facilities and vessels.\11\ Further, DHS had not 
demonstrated that TWIC, as currently implemented and planned with 
readers, is more effective than prior approaches used to limit access 
to ports and facilities, such as using facility-specific identity 
credentials with business cases. Moreover, our May 2011 report found 
that enrollment and background checking processes were not designed to 
provide reasonable assurance that only qualified individuals could 
acquire TWICs, or that once issued a TWIC, TWIC-holders had maintained 
their eligibility. These weaknesses, coupled with the results of our 
covert tests on TWIC use, raise questions about the effectiveness of 
the TWIC program. As such, we recommended that the Secretary of 
Homeland Security evaluate the costs, benefits, security risks, and 
corrective actions needed to implement the TWIC program in a manner 
that will mitigate existing security risks. Completing these steps will 
facilitate efforts to identify high-risk areas for TWIC funding and 
implementation.
---------------------------------------------------------------------------
    \10\ See GAO, Homeland Security: Applying Risk Management 
Principles to Guide Federal Investments, GAO-07-386T (Washington, D.C.: 
Feb. 7, 2007); and GAO-06-91.
    \11\ GAO-11-657.

    Question 3. We have four of the highest volume U.S. ports in 
Florida, which are involved in tens of billions of dollars in trade 
each year. Did your investigators turn anything up unique about the 
efforts made by the folks running the TWIC program in Florida?
    Answer. Prior to being amended, previous Florida state law required 
workers accessing the state's 12 active deepwater public ports to 
undergo a state criminal history records check, and Florida's ports 
required workers to obtain a local port identification card. In doing 
so, Florida had implemented background check and identification 
requirements that extended beyond those of the TWIC program. First, 
prior to being repealed on May 24, 2011, a Florida statutory provision 
required that all applicants undergo a State of Florida fingerprint-
based criminal history records check to identify certain specified 
state criminal offenses, such as theft and burglary, separately from 
those specifically required to be identified or considered by the 
criminal history records check conducted by the TWIC program. Second, 
Florida denied access to individuals who had obtained their TWIC 
through the TWIC-waiver process, whereby individuals with disqualifying 
offenses could be granted a TWIC. Third, Florida maintained a database 
that retained the fingerprints and eligibility status of all seaport 
workers accessing its ports, and provided ports with an ongoing 
notification of the workers' criminal histories. While Florida has 
repealed its background check requirements, various Florida ports still 
require that individuals attempting to gain access to a port or 
facility provide a port-specific identification card in addition to the 
TWIC to gain access to ports in Florida.
    As we reported in May 2011, our investigators were successful in 
accessing ports using counterfeit TWICs, authentic TWICs acquired 
through fraudulent means, and false business cases (i.e., reasons for 
requesting access) during covert tests of TWIC use at several selected 
ports.\12\ Information on the specific ports and locations that our 
investigators were unable to access during covert testing was deemed 
sensitive security information by TSA. However, our report states that 
our investigators did not gain unescorted access to a port where a 
secondary port specific identification was required in addition to the 
TWIC.
---------------------------------------------------------------------------
    \12\ GAO-11-657.
---------------------------------------------------------------------------
    If you have any questions about this letter or need additional 
information, please contact me at (202) 512-4379 or [email protected].

                                           Stephen M. Lord,
                    Director, Homeland Security and Justice Issues.

                                  

```