```

[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]

 
    THREAT, RISK, AND VULNERABILITY: THE FUTURE OF THE TWIC PROGRAM

=======================================================================

                                HEARING

                               before the

                         SUBCOMMITTEE ON BORDER
                         AND MARITIME SECURITY

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED THIRTEENTH CONGRESS

                             FIRST SESSION

                               __________

                             JUNE 18, 2013

                               __________

                           Serial No. 113-23

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC] [TIFF OMITTED] 

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                  U.S. GOVERNMENT PRINTING OFFICE
85-688                    WASHINGTON : 2013
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing 
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC 
area (202) 512-1800 Fax: (202) 512-2104  Mail: Stop IDCC, Washington, DC 
20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Paul C. Broun, Georgia               Yvette D. Clarke, New York
Candice S. Miller, Michigan, Vice    Brian Higgins, New York
    Chair                            Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Jeff Duncan, South Carolina          Ron Barber, Arizona
Tom Marino, Pennsylvania             Dondald M. Payne, Jr., New Jersey
Jason Chaffetz, Utah                 Beto O'Rourke, Texas
Steven M. Palazzo, Mississippi       Tulsi Gabbard, Hawaii
Lou Barletta, Pennsylvania           Filemon Vela, Texas
Chris Stewart, Utah                  Steven A. Horsford, Nevada
Richard Hudson, North Carolina       Eric Swalwell, California
Steve Daines, Montana
Susan W. Brooks, Indiana
Scott Perry, Pennsylvania
Mark Sanford, South Carolina
                       Greg Hill, Chief of Staff
          Michael Geffroy, Deputy Chief of Staff/Chief Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

              SUBCOMMITTEE ON BORDER AND MARITIME SECURITY

                Candice S. Miller, Michigan, Chairwoman
Jeff Duncan, South Carolina          Sheila Jackson Lee, Texas
Tom Marino, Pennsylvania             Loretta Sanchez, California
Steven M. Palazzo, Mississippi       Beto O'Rourke, Texas
Lou Barletta, Pennsylvania           Tulsi Gabbard, Hawaii
Chris Stewart, Utah                  Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (Ex             (Ex Officio)
    Officio)
              Paul L. Anstine, Subcommittee Staff Director
                   Deborah Jordan, Subcommittee Clerk
         Alison Northrop, Minority Subcommittee Staff Director

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Candice S. Miller, a Representative in Congress 
  From the State of Michigan, and Chairwoman, Subcommittee on 
  Border and Maritime Security:
  Oral Statement.................................................     1
  Prepared Statement.............................................     2
The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas, and Ranking Member, Subcommittee on 
  Border and Maritime Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     7

                               Witnesses

Rear Admiral Joseph A. Servidio, Assistant Commandant for 
  Prevention Policy, U.S. Coast Guard:
  Oral Statement.................................................     8
  Prepared Statement.............................................     9
Mr. Steve Sadler, Assistant Administrator, Transportation 
  Security Administration:
  Oral Statement.................................................    11
  Prepared Statement.............................................    12
Mr. Stephen M. Lord, Director, Forensic Audits and Investigative 
  Services, U.S. Government Accountability Office:
  Oral Statement.................................................    15
  Prepared Statement.............................................    16
Captain Marcus Woodring, USCG (Ret), Managing Director, Health, 
  Safety, Security, and Environmental, Port of Houston Authority:
  Oral Statement.................................................    21
  Prepared Statement.............................................    23

                             For the Record

The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas, and Ranking Member, Subcommittee on 
  Border and Maritime Security:
  Letter From the American Association of Port Authorities.......    40
  Statement of American Trucking Associations, Inc...............    41
The Honorable Tulsi Gabbard, a Representative in Congress From 
  the State of Hawaii:
  Statement of the International Longshore and Warehouse Union...    44

                                Appendix

Questions From Chairwoman Candice S. Miller for Joseph A. 
  Servidio.......................................................    49
Questions From Chairwoman Candice S. Miller for Stephen M. Lord..    51

    THREAT, RISK, AND VULNERABILITY: THE FUTURE OF THE TWIC PROGRAM

                              ----------                              

                         Tuesday, June 18, 2013

             U.S. House of Representatives,
      Subcommittee on Border and Maritime Security,
                            Committee on Homeland Security,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:09 a.m., in 
Room 311, Cannon House Office Building, Hon. Candice S. Miller 
[Chairwoman of the subcommittee] presiding.
    Present: Representatives Miller, Duncan, Palazzo, Barletta, 
Stewart, Jackson Lee, O'Rourke, and Gabbard.
    Mrs. Miller. Good morning. The Committee on Homeland 
Security, Subcommittee on Border and Maritime Security, will 
come to order.
    The subcommittee is meeting today to examine the future of 
the TWIC program, and our witnesses today are Rear Admiral 
Joseph Servidio from the U.S. Coast Guard, Steven Sadler, 
assistant administrator for the Office of Intelligence and 
Analysis, Transportation Security Administration, Stephen Lord 
with the Government Accountability Office, and Marcus Woodring, 
from the Port of Houston Authority. I will give them a more 
formal introduction in just a moment.
    After 9/11, Congress passed the Maritime Transportation 
Security Act, or MTSA--it is sort of the acronym--to address 
several security vulnerabilities within the Nation's maritime 
and transportation sectors to prevent acts of terrorism that 
might impact our Nation. Among the provisions of the bill was a 
requirement from the Department of Homeland Security to develop 
a secure biometric access credential for individuals who 
require unescorted access to secure areas of regulated maritime 
facilities and vessels.
    Ports by their very nature may be susceptible to acts of 
terrorism that could cause loss of life and severe economic 
disruption. The lack of access control at the Nation's ports 
was certainly a glaring security vulnerability that MTSA and 
subsequently the Transportation Worker Identification 
Credential--we commonly call TWIC--was intended to fix.
    However, more than 11 years later, the TWIC card designed 
to prevent terrorists from gaining access to sensitive parts of 
the Nation's ports is currently no more than an extensive flash 
pass that costs workers about $130, principally to run criminal 
and terrorism background checks on prospective applicants.
    Unfortunately, the biometric capabilities on the card are 
of little use because delays in the pilot program and 
rulemaking processes have taken longer than ever intended. 
Pilot programs as envisioned by the Congress should have been 
designed to assist the Coast Guard in understanding the impact 
of proposed regulations on port operations and transportation 
workers alike, instead have been less than useful in the 
rulemaking process. Certainly, all of us are looking forward to 
hearing from our witnesses today on the extent to which the 
pilot was used to inform the rulemaking process.
    Maritime security is not the provenance of the Federal 
Government alone. Private industry and other stakeholders have 
an important role to play, but the Government has introduced an 
unacceptable level of uncertainty when it comes to TWIC. For 
several years, Members of this committee have been calling on 
the Department to release the reader rules on--or effective 
assessment of the program. That strikes me as a very poor way 
to run this program.
    Last Congress, I introduced the SMART Port Act, which 
passed through this committee and in the House, which would 
have made a series of reforms to the TWIC program. Included in 
that bill was a provision which required TSA to change the 
requirement for TWIC applicants who currently must go to an 
enrollment center twice and instead would allow for only visit 
to an enrollment center by allowing cards to be sent through 
the mail, just as passports and credit cards are today.
    Through our efforts, that provision was attached to last 
year's Coast Guard authorization act and it was signed into law 
by the President. However, it does appear that TSA will not 
comply with the 270-day time line in the statute. Making two 
trips to an enrollment center seems to just be a very onerous 
burden on transportation workers.
    So I will be very interested to hear how TSA will implement 
this provision, consistent with Congressional intent within 
that time frame. Millions of dollars of previously allocated 
and future grant spending are predicated on the TWIC providing 
a tangible security benefit at the Nation's ports and maritime 
facilities. We have an obligation to get this done right, and 
the way this program has been run so far does not give us the 
confidence that we are on the right course.
    Today I hope that we will be able to examine the security 
purpose of the TWIC card, principally, as well as chart out the 
future of this program to ensure that we maximize security and 
minimize the burden on American workers.
    With that, I would yield to the gentlelady from Texas, my 
Ranking Member, Ms. Jackson Lee.
    [The statement of Chairwoman Miller follows:]
               Statement of Chairwoman Candice S. Miller
                             June 18, 2013
    After 9/11, Congress passed the Maritime Transportation Security 
Act--MTSA--to address several security vulnerabilities within the 
Nation's maritime and transportation sectors to prevent acts of 
terrorism that might impact the Nation's economy. Among the provisions 
of the bill, was a requirement for DHS to develop a secure biometric 
access credential for individuals who require unescorted access to 
secure areas of regulated maritime facilities and vessels.
    Ports, by their very nature, may be susceptible to acts of 
terrorism that could cause loss of life and severe economic disruption. 
The lack of access control at the Nation's ports was a glaring security 
vulnerability that MTSA, and subsequently the Transportation Worker 
Identification Credential (TWIC) was intended to fix.
    However, more than 11 years later, the TWIC card, designed to 
prevent terrorists from gaining access to sensitive parts of the 
Nation's ports, is currently no more than an expensive flash pass that 
costs workers $129.75--principally to run criminal and terrorism 
background checks on prospective applicants.
    Unfortunately, the biometric capabilities on the card are of little 
use because delays in the pilot program and rulemaking processes have 
taken longer than ever intended. Pilot programs, as envisioned by the 
Congress, should have been designed to assist the Coast Guard in 
understanding the impact of proposed regulations on port operations and 
transportation workers alike, instead have been less than useful in the 
rulemaking process.
    I am looking forward to hearing from our witnesses on the extent to 
which the pilot was used to inform the rulemaking process.
    Maritime security is not the provenance of the Federal Government 
alone. Private industry and other stakeholders have an important role 
to play, but the Government has introduced an unacceptable level of 
uncertainty when it comes to TWIC.
    For several years, Members of this committee have been calling on 
the Department to release the reader rule to provide some certainty to 
workers and industry. Finally, we have a notice of proposed rulemaking 
that only requires TWIC readers to be used at the riskiest 5 percent of 
all TWIC-regulated vessels and facilities, nearly 6 years after workers 
were first required to pay for and obtain a TWIC card.
    The proposed rule and findings of a recent GAO report, leads to 
some very simple questions about the threat, risk, and vulnerability at 
our Nation's ports, and how the TWIC program should be used to reduce 
the risk of a terrorist attack at the handful of facilities and vessels 
identified in the proposed rule.
    I support a smart, risk-based approach to security, because I am 
convinced that maritime security is maximized through the use of a 
risk-based methodology. However, we should continue to scrutinize 
troubled programs by examining the principal reason they exist--in this 
case, preventing terrorists from doing economic harm to the Nation by 
disrupting the supply chain.
    This hearing will hopefully answer the question of whether or not 
the TWIC program serves that purpose.
    At this point, I believe it is still an open question as to what 
degree this card enhances maritime security. To that end, I hope to 
hear answers to the following questions: How many terrorist plots have 
been stopped by this card? Does TWIC enhance security in a tangible 
way? Can we address the security challenges at our Nation's ports in a 
more cost-effective, and balanced way?
    Today, we will hear from the Government Accountability Office, 
which recently reported that, `` . . . DHS has not demonstrated how, if 
at all, TWIC will improve maritime security.'' An assessment of how 
TWIC improves maritime security should have been one of the very first 
things the Department did when it began to implement the program.
    It has been more than a decade since the legislation that required 
TWIC was first enacted, but it is troubling that we have never done a 
simple security or effectiveness assessment of the program. That 
strikes me as a poor way to run a program.
    Last Congress, I introduced the SMART Port Act which passed through 
this committee and in the House, and would have made a series of 
reforms to the TWIC program.
    Included in that bill was a provision, originally authored by Mr. 
Scalise, which required TSA to change the requirement for TWIC 
applicants who currently must go to an enrollment center twice, and 
instead would allow for only one visit to an enrollment center by 
allowing cards to be sent through the mail, just as passports and 
credit cards are today.
    Through our efforts, that provision was attached to last year's 
Coast Guard Authorization Act and was signed into law by the President. 
However, it appears that TSA will not comply with the 270-day time line 
in statute.
    Making two trips to an enrollment center is an onerous burden on 
transportation workers, and I will be very interested to hear how TSA 
will implement this provision, consistent with Congressional intent 
within that time frame.
    Millions of dollars of previously allocated and future grant 
spending are predicated on the TWIC providing a tangible security 
benefit at the Nation's ports and maritime facilities.
    We have an obligation to get this right, and the way this program 
has been run so far does not give me the confidence that we are on the 
right course.
    Today, I hope that we examine the security purpose of the TWIC 
card, as well as chart out the future of this program to ensure that we 
maximize security and minimize the burden on American workers.
    With that I will yield to the gentlelady from Texas.

    Ms. Jackson Lee. Thank you. Good morning.
    I want to thank you, Madam Chairwoman, for holding today's 
hearing on the Department of Homeland Security's Transportation 
Worker Identification Credential program, something that many 
of us who have served on this committee have been dealing with 
not only with our constituents, but with our individual 
constituents and our corporate constituents, such as the 
Houston Port Authority.
    We have tried to be responsive to individuals, constituents 
who simply need to get to work. To our dismay, there have been 
a number of challenges with this program, though I know that 
its intentions were well-intentioned. Challenges that I would 
like to offer for the record are the site locations for 
individuals, the hours that TWIC offices would be open, the 
difficulty of those who lived away from ports or places like 
Louisiana, where they had to secure them places away from their 
particular home base. So there have been a lot of issues that 
have arisen with TWIC, and as I indicated, the intentions were 
good to give this card of identification.
    As a Member of Congress representing the port of Houston, 
the formal Chairwoman and Ranking Member of the Subcommittee on 
Transportation Security, and now working with this committee 
and Madam Chairwoman, I have been focused on the TWIC program 
since its creation.
    Early on, I engaged ports, workers, and other stakeholders 
about the program and heard their concerns about how it was 
being deployed. Like many of my colleagues, my office has 
received significant amounts of TWIC casework primarily from 
workers having difficulty obtaining and renewing their TWIC 
cards.
    While some of the issues with the program have largely been 
addressed, over time, other concerns have taken their place. I 
am particularly troubled by the Government Accountability 
Office report released last month that found serious problems 
with the TWIC reader pilot, which was intended to serve as the 
basis for the TWIC reader rulemaking. GAO has found that the 
pilot results were incomplete, inaccurate, and unreliable for 
informing Congress and for developing a final reader rule. GAO 
concluded these issues, calling to question the TWIC program's 
premise and its effectiveness in enhancing security.
    These concerns, coupled with prior unaddressed issues 
related to security vulnerabilities with the program, prompted 
GAO to recommend that the Department not move forward until a 
security assessment of the program is completed. However, DHS, 
which was made aware of GAO's finding in December 2012, 
published a notice of proposed rulemaking for the TWIC readers 
in March of this year.
    The NPRM would require readers to be deployed to only the 
highest-risk facilities and vessels accessed by just 5 percent 
of TWIC holders. While nothing precludes DHS from expanding the 
reader requirement in the future, such a limited deployment of 
biometric readers is not what Congress envisioned when it 
mandated the TWIC program, and I would encourage DHS to regroup 
and reassess, take more advice and counsel from stakeholders, 
more importantly reassess the technology. Technology is good. 
But it can be even better, obviously, if we pause for a moment 
and try to develop the technology that will, in fact, work.
    I am not advocating for broader deployment of readers at 
present, but I am concerned that DHS would ask port workers to 
pay for a biometric card whose biometric capabilities 
apparently may never be utilized. More broadly, I am concerned 
that DHS appears to be moving forward with its long-delayed 
reader rule before addressing the fundamental concerns that the 
program GAO has identified in its reports.
    I was pleased to invite from the port Mr. Marcus Woodring, 
who we have engaged and over the years has given effective 
service in the United States Coast Guard and has dealt with the 
TWIC issue over and over again, to testify before the 
subcommittee today to offer his port's perspective on the 
issues facing the TWIC program. Besides being one of the 
Nation's major ports with a significant presence of 
petrochemical-related facilities and vessels, the port of 
Houston has been using TWIC readers voluntarily since 2008. Mr. 
Woodring currently serves as managing director for health, 
safety, security, and environment at the Port of Houston 
Authority, having recently served in the Coast Guard, 
cumulating with service as captain of the port for the Houston 
region.
    I am especially interested in hearing from him about the 
port of Houston's experience with TWIC readers and his views on 
how the TWIC program can be strengthened going forward. I am 
delighted that he is here along with all the other witnesses, 
who I welcome. I want to hear from our DHS witnesses about how 
they plan to address GAO's recommendation, ensure TWIC programs 
become the maritime security program Congress intended, that 
ports and facilities can use without undue disruption to their 
businesses, and that DHS can justify asking maritime workers to 
continue to pay for.
    Finally, I would note that I have previously supported one 
enrollment process, one fee, and one security threat assessment 
for transportation workers. Madam Chairwoman, I will tell you, 
with all the numbers of cards that I have heard workers having 
to have, it may be well time for us to try and do that.
    I would like to hear from witnesses today about how the on-
going issues of the TWIC program might affect this effort. 
Again, we are grateful for the witnesses, and I want to 
acknowledge Mr. O'Rourke and Ms. Gabbard present here today. 
Thank you very much, Madam Chairwoman.
    I yield back.
    [The statement of Ranking Member Jackson Lee follows:]
             Statement of Ranking Member Sheila Jackson Lee
                             June 18, 2013
    As a Member of Congress representing the port of Houston, the 
former Chairwoman and Ranking Member of the Subcommittee on 
Transportation Security, and current Ranking Member of the Subcommittee 
on Border and Maritime Security, I have been focused on the TWIC 
program since its creation.
    Early on, I engaged ports, workers, and other stakeholders about 
the program and heard their concerns about how it was being deployed.
    Like many of my colleagues, my office has received significant 
amounts of TWIC casework, primarily from workers having difficulty 
obtaining and renewing their TWICs.
    While some of the issues with the program have largely been 
addressed over time, other concerns have taken their place.
    I was particularly troubled by the Government Accountability Office 
(GAO) report released last month that found serious problems with the 
TWIC reader pilot, which was intended to serve as the basis for the 
TWIC reader rulemaking.
    GAO found that the pilot results were incomplete, inaccurate, and 
unreliable for informing Congress and for developing a final reader 
rule.
    GAO concluded these issues call into question the TWIC program's 
premise and its effectiveness in enhancing security.
    These concerns, coupled with prior, unaddressed issues related to 
security vulnerabilities with the program, prompted GAO to recommend 
that the Department not move forward until a security assessment of the 
program is completed.
    However, DHS, which was made aware of GAO's findings in December 
2012, published a Notice of Proposed Rulemaking (NPRM) for the TWIC 
readers in March of this year.
    The NPRM would require readers to be deployed to only to the 
highest-risk facilities and vessels, accessed by just 5% of TWIC 
holders.
    While nothing precludes DHS from expanding the reader requirement 
in the future, such a limited deployment of biometric readers is not 
what Congress envisioned when it mandated the TWIC program.
    I am not advocating for broader deployment of readers at present, 
but am concerned that DHS would ask port workers to pay for a biometric 
card whose biometric capabilities apparently may never be utilized.
    More broadly, I am concerned that DHS appears to be moving forward 
with its long-delayed reader rule before addressing the fundamental 
concerns with the program GAO has identified in its reports.
    I was pleased to invite a witness from the port of Houston, Mr. 
Marcus Woodring, to testify before the subcommittee today to offer his 
port's perspective on the issues facing the TWIC program.
    Besides being one of the Nation's major ports with a significant 
presence of petrochemical-related facilities and vessels, the port of 
Houston has been using TWIC readers voluntarily since 2008.
    Mr. Woodring currently serves Managing Director for Health, Safety, 
Security, and Environmental (HSSE) at the Port of Houston Authority, 
having recently served in the Coast Guard culminating with service as 
captain of the port for the Houston region.
    I am especially interested in hearing from him about the port of 
Houston's experience with TWIC readers and his views on how the TWIC 
program can be strengthened going forward.
    Similarly, I want to hear from our DHS witnesses about how they 
plan to address GAO's recommendations and ensure TWIC becomes the 
maritime security program Congress intended, that ports and facilities 
can use without undue disruption to their businesses, and that DHS can 
justify asking maritime workers to continue to pay for.
    Finally, I will note that I have previously supported one 
enrollment process, one fee, and one security threat assessment for 
transportation workers.
    I would like to hear from our witnesses today about how the on-
going issues with the TWIC program might affect this effort.

    Mrs. Miller. Let me formally introduce our witnesses this 
morning. Again, we welcome all of you gentlemen. We appreciate 
you taking the time to be here.
    First of all, Rear Admiral Joseph Servidio is the assistant 
commandant for prevention policy overseeing Coast Guard 
inspections and compliance, marine transportation systems, and 
commercial regulations and standards. He is responsible for 
navigation and boating safety, commercial vessels, ports and 
facilities, merchant mariner credentialing, and vessel 
documentation. We welcome you, Admiral.
    Mr. Steven Sadler is the assistant administrator for the 
Office of Intelligence and Analysis at the Transportation 
Security Administration. In this role, he is responsible for 
the alignment of intelligence functions with vetting 
operations. Before joining TSA, Mr. Sadler spent 25 years in 
the commercial maritime industry in a number of leadership 
roles. Welcome.
    Mr. Stephen Lord directs the GAO's numerous engagements on 
aviation and surface transportation security issues and 
regularly discusses these issues before Congress in various 
industry forums. He supervised recent reviews of TSA passenger 
rail security programs and the TWIC program.
    I am going to ask my Ranking Member to make the formal 
introduction of her constituent, who graciously joins us this 
morning.
    Ms. Jackson Lee. As I indicated, let me welcome all the 
witnesses, but I am particularly--and thank you, Madam 
Chairwoman, very much--particularly excited and pleased to be 
able to welcome Mr. Marcus Woodring, retired from the United 
States Coast Guard, as captain of the port of Houston-Galveston 
in 2011. We are delighted that he assumed his new and current 
position with the port of Houston in July of that year. He is 
responsible for safety, security, environmental stewardship, 
and emergency response at eight terminals along the Houston 
ship channel.
    Over the years, I have had the privilege of working with 
Captain Woodring, and I would tell you, Madam Chairwoman, that 
he is one of the most engaged public servants and a problem-
solver. I am delighted for him to bring that experience to this 
committee and this hearing that is so very important today. 
Welcome you and welcome you from Houston, Captain.
    Mrs. Miller. Thank you very much. Other Members are 
reminded that statements may be submitted for the record.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                             June 18, 2013
    This committee has a long history of TWIC oversight, going back 
almost to its inception. Since that time, DHS has made progress in 
standing up the program, vetting and enrolling approximately 2.5 
million maritime workers.
    Certainly, workers have done their part by applying for TWICs, 
submitting to background investigations, paying for their credentials, 
filing for waivers and appeals as necessary, and making multiple trips 
to ultimately receive their cards.
    Yet, the program has long been plagued by delays, security 
vulnerabilities, and other problems.
    These problems now have many questioning whether TWIC will ever be 
the transportation security program Congress envisioned when it enacted 
the Maritime Transportation Security Act of 2002 and the SAFE Port Act 
of 2006.
    Just last month, the Government Accountability Office issued its 
latest in a series of troubling reports related to TWIC--this time on 
the reader pilots.
    GAO concluded that the pilots were so severely flawed that they 
cannot be used to inform DHS' long-delayed rulemaking process for the 
TWIC readers.
    Despite being made aware of GAO's serious concerns about the 
reliability of the reader pilot data and the TWIC program as a whole, 
Coast Guard published its Notice of Proposed Rulemaking (NPRM) for the 
TWIC readers earlier this year.
    The NPRM divides ports and facilities into three risk groups, 
requiring only those in the highest-risk group--Group A--to install 
biometric readers for admittance to secure areas.
    Facilities in Groups B and C can continue to allow TWICs to be used 
as ``flash passes'' with only a visual inspection required to gain 
access.
    This means that only 5% of TWIC holders would be using their 
biometric credentials as Congress intended--with a biometric reader.
    The remainder of TWIC holders will continue to use their card as an 
expensive flash pass.
    Let me be clear--I am not advocating for deployment of readers at 
additional facilities or vessels at this time.
    Rather, I believe the limited deployment of readers proposed by the 
rule raises some hard questions that need to be answered.
    For example, what does it say about the security value of the TWIC, 
and the TWIC program itself, if DHS does not believe the program needs 
to be fully deployed at all regulated facilities?
    And how can we continue requiring workers to pay for a biometric 
credential when, in the vast majority of cases, the full capability of 
that card will not be used?
    To get answers to these and other vital questions, I strongly 
support GAO's recommendation for an assessment of the TWIC program 
prior to its continued deployment.
    My staff has done significant stakeholder outreach on the rule, and 
I plan to file comments based on this outreach and our oversight work 
outlining my thoughts and concerns.
    I look forward to a discussion today about what needs to be done to 
address the persistent problems facing the TWIC program.
    In particular, I hope to hear from GAO in detail about their 
recommendations for the path forward for the program.

    Mrs. Miller. Again, thank you all for coming. At this time, 
the Chairwoman recognizes Admiral Servidio.

    STATEMENT OF REAR ADMIRAL JOSEPH A. SERVIDIO, ASSISTANT 
       COMMANDANT FOR PREVENTION POLICY, U.S. COAST GUARD

    Admiral Servidio. Good morning, Madam Chairwoman, Ranking 
Member Jackson Lee, distinguished Members of the subcommittee. 
I am Rear Admiral Joe Servidio, the assistant commandant for 
prevention policy for the Coast Guard, and I am honored to have 
this opportunity to speak before you today about the Coast 
Guard's role in enforcing compliance with the Transportation 
Worker Identification Credential and update you on the status 
of the TWIC reader rule.
    The Coast Guard views TWIC as a key component of our 
layered security strategy. By providing a Nationally-recognized 
vetting standard and a common credential, TWIC promotes both 
security and economic efficiency. Issued under a uniform 
standard, TWIC allows facility and vessel operators, as well as 
law enforcement Nation-wide, to verify the identity of 
individuals using a single official document. TWIC enables 
transportation workers the flexibility to potentially move 
among facilities, vessels, and geographic regions during 
routine operations and in emergencies, maintaining security and 
facilitating resiliency.
    While TWIC provides a standard baseline to determine 
suitability to enter the secure area of a facility or vessel 
regulated under the Maritime Transportation Security Act, it is 
only half of a two-part process. In addition to possessing a 
valid TWIC, an individual must also be specifically granted 
access to a secure area by a vessel or facility security 
officer.
    To re-emphasize, the possession of a valid TWIC alone is 
not sufficient for the holder of a credential to access secure 
areas. This two-step process provides an additional layer of 
security to help protect vital maritime transportation 
infrastructure from unauthorized access or exploitation.
    In addition to facility and vessel operators' significant 
efforts, Coast Guard inspectors have validated about 280,000 
TWICs during planned and unplanned no-notice visits since 2009. 
The Coast Guard also reviews approximately 3,100 facility and 
11,000 vessel security plans each year.
    On 22 March 2013, the Coast Guard released the TWIC reader 
notice of proposed rulemaking, which outlines requirements for 
certain MTSA-regulated facilities and vessels to use electronic 
readers as part of their TWIC access control program. This NPRM 
is an important element of maritime security, as electronic 
readers allow for biometric confirmation of the TWIC holder's 
identity.
    As with our other security regs, the Coast Guard balanced 
the expected security benefits of the requirement with the 
expected costs to industry. Accordingly, the reader rule 
proposes the use of TWIC readers only at the vessels and 
facilities where a security incident could pose the greatest 
consequence and where biometric verification of a TWIC would 
reduce risk.
    Vessels and facilities not required to use electronic 
readers under this rule will still be required to conduct 
visual TWIC verifications. The GAO released a report 
questioning the security benefits of the TWIC and the way the 
Coast Guard used the results of the pilot program to inform the 
rule. We indicated to GAO that we were aware of the pilot 
program's limitations and used pilot data with discretion in 
developing the NPRM.
    Moreover, we are convinced that TWIC, including the use of 
biometric readers, is an important part of our maritime 
security system. The GAO report was released while the NPRM 
common period was open. Given the timing of the report's 
release, a request by Representative Thompson and to ensure 
that we captured comments informed by the report, we extended 
the comment period by 30 days to 20 June 2013.
    The Coast Guard hosted four public meetings around the 
country, providing other outlets for public feedback on the 
proposed regs. To date, we have received approximately 50 
comments on the NPRM.
    The Coast Guard's focus is to facilitate a secure and 
efficient maritime transportation system, and TWIC is an 
important tool in that effort. As part of our layered security 
strategy, we are committed to establishing and enforcing 
effective and efficient access control requirements through 
TWIC. Our reader NPRM solicits public comment, which we 
recognize as critical to port security success, and we will 
continue to work with the Department, TSA, industry groups, 
labor organizations, Congress, and other key stakeholders to 
find ways to improve service.
    We know that we have more work to do, and we will ensure 
that Congress is informed of our progress. Thank you for the 
opportunity to testify today, and I look forward to your 
questions.
    [The prepared statement of Admiral Servidio follows:]
           Prepared Statement of Rear Admiral Joseph Servidio
                             June 18, 2013
    Good morning Madam Chairwoman and distinguished Members of the 
subcommittee. Thank you for the opportunity to testify before this 
committee on the Coast Guard's role in enforcing compliance of the 
Transportation Worker Identification Credential (TWIC) program within 
the maritime transportation system.
    In previous testimonies, the Coast Guard has described our 
responsibility for ensuring industry compliance with TWIC regulations, 
the status of our deployment of handheld readers to field units, and 
our efforts to publish regulations for electronic TWIC readers in 
accordance with Congressional requirements as provided in the Security 
and Accountability For Every (SAFE) Port Act of 2006. This testimony 
will provide an update of our on-going efforts to enhance the safety 
and security of the Nation's ports through the effective implementation 
of the TWIC program and recent publication of the TWIC Reader 
Requirements Notice of Proposed Rulemaking (NPRM).
    The Coast Guard and the Transportation Security Administration 
(TSA) have formed a successful partnership in the joint management of 
the TWIC program and continue to work together to effectively build, 
manage, and improve it. TSA is responsible for TWIC enrollment, 
security threat assessment and adjudication, card production, 
technology, TWIC issuance, conduct of the TWIC appeal and waiver 
process as it pertains to credential issuance, and management of 
Government support systems. The Coast Guard is responsible for 
establishing and enforcing access control requirements at Maritime 
Transportation Security Act (MTSA) regulated vessels and facilities, 
which include the requirement for TWIC.
                             value of twic
    TWIC is one part of the layered approach to port security and 
establishes a minimum, uniform, vetting, and threat assessment for 
mariners and port workers across the country. It ensures that workers 
needing routine, unescorted access to secure areas of facilities and 
vessels are vetted against a specific list of terrorism associations 
and criminal convictions and it provides a standard baseline for 
determining an individual's suitability to enter the secure area of a 
MTSA-regulated vessel or facility. However, it is only the first half 
of a two-part process. First, vessel and facility security personnel 
must determine that an individual posseses a valid TWIC.
    Second, they must assess the individual's business case for 
entering a vessel or facility before granting the person unescorted 
access. The possession of a valid TWIC alone is not sufficient to gain 
the holder of that credential access to secure areas on vessels or 
facilities across the country. The TWIC provides a means by which a 
vessel or facility security officer can determine that an individual 
has been vetted to an established standard. It helps inform the 
security officer's decision to grant unescorted access to an 
individual. The facility owners/operators must maintain control of the 
access privileges to their respective facilities based on the valid 
TWIC and business case.
    The Nation-wide recognition of TWIC promotes security and 
standardization. A common credential enables facility and vessel 
operators as well as Federal, State, local, Tribal, and territorial law 
enforcement entities to verify the identity of individuals--a step that 
was not feasible prior to TWIC implementation with potentially 
thousands of different facility-specific credentials. TWIC also allows 
transportation workers to move among facilities, vessels, and 
geographic regions as needed for routine market demands and during 
emergencies, while still maintaining security.
    As required by the SAFE Port Act, the Coast Guard conducts at least 
two security inspections annually at MTSA-regulated facilities, with 
one inspection being unannounced. Vessels and facilities in all 42 
Coast Guard Captain of the Port Zones are in compliance with TWIC 
requirements, and have been since the April 15, 2009 implementation 
date. In addition to the security activities taken by vessel and 
facility security officers, the Coast Guard conducts regular 
inspections, spot checks, and TWIC verifications at approximately 3,100 
maritime facilities, 14,000 vessels, and 50 outer continental shelf 
facilities. Our enforcement program also includes the use of hand-held 
TWIC readers by Coast Guard personnel to conduct spot checks using the 
biometric capabilities of TWIC.
                          reader requirements
    On March 22, 2013, the Coast Guard issued the TWIC Reader 
Requirements Notice of Proposed Rulemaking which outlines requirements 
for certain MTSA-regulated facilities and vessels to use electronic 
readers in accordance with Congressional requirements as provided in 
the SAFE Port Act as part of their TWIC access control program. The 
Notice of Proposed Rulemaking maintain the visual verification 
requirement for remaining vessels and facilities. Per 33 CFR Parts 104, 
105, and 106, this visual inspection must include, at a minimum:
   A match of the photo on the TWIC to the individual 
        presenting it;
   Verification that the TWIC has not expired; and
   A visual check of the various security features present on 
        the card to determine whether the TWIC has been tampered with 
        or forged.
    This Notice of Proposed Rulemaking is an important element of the 
Coast Guard's maritime security mission. Electronic readers add an 
important additional layer of security by providing biometric 
confirmation of the TWIC holder's identity.
    As you are aware, the Government Accountability Office (GAO) 
recently released a report questioning the security benefits of TWIC, 
and the way in which the Coast Guard used results of the pilot program 
to inform the reader rule. As we indicated to GAO in our reply to their 
report, we were aware of the pilot program's limitations, and used it 
with discretion in developing the Notice of Proposed Rulemaking. 
Moreover, we are convinced that TWIC, including the use of biometric 
readers, can and should be a part of the Nation's maritime security 
system. In part, because the GAO report came out while the Notice of 
Proposed Rulemaking public comment period was open, we extended the 
open period by 30 days to June 20, 2013, to ensure that the public had 
sufficient opportunity to review and provide feedback on the proposed 
regulations.
                               conclusion
    TWIC is improving access control at vessels and maritime facilities 
across the country. Its standard, Nation-wide recognition secures and 
facilitates a resilient, mobile transportation workforce during routine 
and emergency situations. The Coast Guard's NPRM will further increase 
the security value of TWIC to the Nation by focusing on the highest-
risk vessels and facilities. We will continue to work with TSA, 
industry groups, labor organizations, and other stakeholders to find 
ways to reduce costs, and improve service. As part of that process, we 
will continue to monitor the costs and benefits of TWIC, as well as the 
external security environment. In all of these matters, our primary 
concern is to provide the American people with a secure and efficient 
marine transportation system. We know we have more work to do, and we 
will ensure Congress is informed of our progress.
    Thank you for the opportunity to testify today. I look forward to 
your questions.

    Mrs. Miller. Thank you very much, Admiral.
    The Chairwoman now recognizes Mr. Sadler for his testimony.

      STATEMENT OF STEVE SADLER, ASSISTANT ADMINISTRATOR, 
             TRANSPORTATION SECURITY ADMINISTRATION

    Mr. Sadler. Good morning, Chairman Miller, Ranking Member 
Jackson Lee, and distinguished Members of the subcommittee. 
Thank you for the opportunity to speak with you today about 
TSA's role in the TWIC program.
    TWIC provides a uniform biometric tamper-resistant 
credential that is issued following the successful completion 
of the security threat assessment. For those with a business 
need, the credential is required to gain unescorted access to 
secure areas at port facilities and vessels regulated under the 
Maritime Transportation Security Act.
    TSA is responsible for enrollment and security threat 
assessments, as well as system operations and maintenance. TSA 
conducts a comprehensive security threat assessment, and more 
than 2.3 million transportation workers hold active TWIC cards. 
These credentials represent a capability that didn't previously 
exist in the maritime environment.
    We have taken the following steps to improve the program 
and reduce burden on workers while maintaining the security 
objectives of the program. In August 2012, we announced the 
Extended Expiration Date TWIC initiative, a one-time effort 
that runs through December 2014. This initiative allows workers 
to extend their credential for 3 years at half the cost of a 5-
year credential and requires only one visit to an enrollment 
center.
    Last month, TSA processed over 58,000 requests for TWIC 
cards. Of these, almost 23,000 were for the 3-year credential. 
This means the travel burden on 39 percent of all current 
applicants can be cut in half. To reduce wait times for 
workers, we have added customer service representatives and 
refined contractual performance standards.
    We have developed a web-based process that allows workers 
to apply for an Extended Expiration Date TWIC or a replacement 
card, and we have a plan to increase mobile enrollment 
opportunities. We are in the process of transitioning our 
single enrollment and system maintenance contract to two 
separate contracts. This will give us better oversight 
capability and allow the contractors to focus on their core 
functions.
    As directed by Congress, we are reforming the program by 
implementing the one-visit initiative to enable all workers to 
apply for and obtain a credential with a single visit to an 
enrollment center. Beginning with a pilot program in Alaska 
next month, we will expand the initiative Nation-wide in 2014.
    With one visit, an applicant will provide identification 
and biometric information during a single visit to an 
enrollment center. If approved to receive the credential, TSA 
will mail the card directly to the applicants, saving the 
applicant time and travel cost. We are more than doubling the 
number of enrollment centers from 136 to approximately 300 
sites by leveraging existing assets that will allow 
transportation workers to apply for a TWIC or hazardous 
material endorsement at the same location.
    The SAFE Port Act directed DHS to conduct a reader pilot to 
test the viability of biometric card readers. Seventeen sites 
participated on a voluntary basis. These facilities started 
using readers in August 2008, and despite numerous challenges 
identified in our report to Congress submitted in February 
2012, the pilot generated considerable data that proved helpful 
in evaluating reader performance and assessing the impact of 
readers at maritime facilities.
    We concluded that the reader system functions properly when 
designed, installed, and operated in a manner consistent with 
the business requirements of the facility or vessel operation. 
When TWIC readers are deployed, it will determine whether a 
card is authentic, valid, and issued by TSA. They will also 
facilitate access control decisions made by port facilities and 
vessels. In the biometric mode, readers confirm through a 
fingerprint match that the person using the card is the 
rightful owner of the card.
    Prior to the TWIC program, there was no standard identity 
verification or background check policy for entrance to a port 
facility or vessel. Today, facility and vessel owners and 
operators can look for one identification document based on an 
extensive background check.
    The use of readers and biometric verification will enhance 
security at MTSA-regulated port facilities and vessels. Thank 
you for the opportunity to be here today. I look forward to 
taking your questions.
    [The prepared statement of Mr. Sadler follows:]
                   Prepared Statement of Steve Sadler
                             June 18, 2013
    Good morning Chairman Miller, Ranking Member Jackson Lee, and 
distinguished Members of the subcommittee. Thank you for the 
opportunity to testify today about the Transportation Security 
Administration's (TSA) role in the Transportation Worker Identification 
Credential (TWIC) program.
    To fulfill a security mission of such scale, the Department of 
Homeland Security (DHS) leverages the expertise of its components to 
evaluate the entities that comprise the maritime domain and design 
security measures to counter potential threats. TWIC provides a 
uniform, industry-wide, biometric, tamper-resistant credential that is 
issued following successful completion of a security threat assessment 
(STA). Following successful completion of the STA and payment of 
relevant fees, eligible maritime workers are provided a tamper-
resistant biometric credential that permits unescorted access to secure 
areas of port facilities and vessels regulated by the USCG under MTSA. 
These security benefits are most fully realized when the credential is 
used in conjunction with readers that can provide electronic 
verification.
    TSA and the United States Coast Guard (USCG) jointly administer the 
fee-based TWIC program, which was established under Section 102 of the 
Maritime Transportation Security Act (MTSA) of 2002. The Act required 
the Secretary (at the time the Secretary of the Department of 
Transportation) to issue biometric transportation security cards to 
prevent unauthorized individuals from entering an area of a vessel or 
facility designated as a secure area. Currently, TSA is responsible for 
enrollment, STAs, and systems operations and maintenance related to 
TWICs while the USCG is responsible for establishing and enforcing 
access control standards including requirements for TWIC readers at 
MTSA-regulated facilities and vessels.
    TSA began National deployment of the TWIC program on October 16, 
2007, with the enrollment of maritime workers at the Port of 
Wilmington, DE. Since that time, TSA has conducted comprehensive STAs 
and issued TWIC credentials to over 2.5 million workers while 
identifying and preventing approximately 50,000 TWIC applicants who did 
not meet the required security standards from receiving a TWIC.
         twic: meeting industry needs and security requirements
    The TWIC program represents an important maritime security measure 
by allowing facility and vessel security operators to verify that the 
holder has successfully passed the STA, through possession and visual 
inspection of the TWIC credential. Workers at the approximately 13,825 
vessels and 3,270 maritime facilities that the USCG regulates under 
MTSA have been required to present their TWIC for unescorted entry to 
secure areas of those facilities since mid-April 2009. Until TWIC 
readers are in place, security access personnel are required to 
visually inspect the TWIC prior to granting unescorted access to secure 
areas on-board regulated vessels and at facilities.
    TWIC reader systems are designed to determine whether a card is 
authentic, valid, and issued by TSA. The readers also check that the 
card has not expired and, by accessing the cancelled card list, can 
determine if the card has been revoked or reported lost or stolen. When 
used in the biometric mode, readers confirm through a fingerprint match 
that the person using the card is the rightful owner of the card. The 
TWIC card and reader system can perform these checks virtually anywhere 
with portable or fixed readers because connectivity to an external 
database is not required.
    A TWIC is valid for 5 years. The cost is $129.75, unless a worker 
has a comparable STA and uses it to establish TWIC eligibility, in 
which case the cost is $105.25. In late August 2012, DHS announced the 
Extended Expiration Date (EED) initiative under which eligible workers 
have been able to submit a request to extend the expiration date on 
their TWIC by 3 years and pay a $60 card replacement fee. The EED is a 
one-time initiative through December 31, 2014. The TWIC reader 
requirements have been proposed by USCG in a Notice of Proposed 
Rulemaking published on March 22, 2013. The NPRM proposals, if 
finalized as published, would require TWIC readers for certain high-
risk vessels and facilities. Use of readers at these sites would 
enhance security by verifying the validity of the TWIC card as well as 
the identity of the card owner.
    TSA is committed to partnerships with stakeholders, including the 
private sector, to carry out its mission. To meet the demands of the 
TWIC program, the TSA will provide MTSA-regulated facility owners and 
operators with a list of TWIC readers that meet current TWIC 
specifications as outlined in current guidance. TSA established the 
Qualified Technology List (QTL) process on November 1, 2012, with the 
announcement that three National Voluntary Laboratory Accreditation 
Program laboratories were accredited to accept readers for compliance 
testing.
  ``onevisit'' initiative and other plans to enhance customer service
    TSA will soon implement the ``OneVisit'' initiative to facilitate 
card issuance to eligible applicants and individuals needing a 
replacement TWIC. The initiative will enable individuals to apply for 
and obtain a TWIC with a single visit to an enrollment center and will 
begin with a pilot in Alaska this summer and expand Nation-wide in 2014 
after TSA carefully evaluates the pilot results. Under ``OneVisit,'' an 
applicant will visit an enrollment center to provide identification and 
biometric information. Upon successful completion of an STA, TSA will 
directly mail a card to the applicant. ``OneVisit'' will eliminate the 
need for the transportation worker to make a follow-up visit to an 
enrollment center to activate the card and select a Personal 
Identification Number (PIN). Eliminating this second visit saves the 
applicant time and travel costs, as well as easing crowding at 
enrollment centers.
    The Coast Guard and Maritime Transportation Act of 2012 mandates 
that, within 270 days from the date of enactment, DHS reform the 
process for TWIC enrollment, activation, issuance, and renewal to 
require no more than one in-person visit to a designated enrollment 
center, except in cases where extenuating circumstances exist requiring 
more than one visit. DHS made clear that, while a plan would be 
initiated within 270 days to reform the process, it would likely take 
additional time to fully implement the provision in a manner that 
preserved the security of the credential.
    In addition to ``OneVisit,'' TSA is committed to providing enhanced 
customer service in a variety of ways. TSA will expand the number of 
TWIC enrollment centers from 136 to approximately 300 sites by 
transitioning Hazardous Materials Endorsement (HME)/TWIC enrollments 
sites to Universal Enrollment Service Centers. This will permit 
individuals to apply for a TWIC or HME at the same location, and 
shorten travel distances for many applicants. TSA is also increasing 
its oversight of customer service at our enrollment centers and has 
added call center representatives to reduce call wait times.
                         the twic reader pilot
    In October 2006, pursuant to the SAFE Port Act, Congress mandated 
that DHS conduct a TWIC reader pilot to inform reader requirements 
prior to Nation-wide implementation and test the viability of selected 
biometric card readers while examining the technical aspects of 
connecting TWIC readers to access control systems. Seventeen sites 
participated in the reader pilot on a voluntary basis. These facilities 
used readers in conjunction with TWICs starting in August 2008. The 
pilot faced several constraints, including extreme differences in the 
nature of operations at participating sites. Additionally, the 
participating sites had to ensure that the use of the new readers and 
test protocols did not interfere with the security and daily operations 
of the facilities. Notwithstanding these challenges, the TWIC reader 
pilot generated considerable data that proved helpful in evaluating 
reader performance and assessing the impact of using readers at 
maritime facilities.
    Following analysis of the pilot results, TSA concluded that TWIC 
reader systems function properly when they are designed, installed, and 
operated in a manner consistent with the characteristics and business 
needs of the facility or vessel operation. TSA also found that reader 
systems can facilitate access decisions efficiently and effectively 
despite the operational and technological difficulties that affected 
performance at some pilot locations. While a recent Government 
Accountability Office (GAO) report evaluating the results of the TWIC 
reader pilot program concluded that that DHS should not use the 
analysis of the pilot program as basis for developing the final TWIC 
reader regulation, the pilot did produce valuable information 
concerning the environmental, operational, and fiscal impacts of the 
use of TWIC readers.
                               conclusion
    Prior to the TWIC program, there was no standard identity 
verification or background check policy for entrance to a port facility 
or vessel. This created opportunities for fraud as well as security 
risks. Today, facility and vessel owners and operators look for one 
standard identification document that confirms the holder's identity 
and verifies that he or she successfully completed an STA. The use of 
readers and biometric verification will enhance security at MTSA-
regulated port facilities and vessels.
    TSA and its partners have taken significant steps to add layers of 
security to protect our Nation's port facilities and vessels. These 
steps link together information sharing, security, and law enforcement 
from across TSA, USCG, DHS, and a multitude of partnerships. Each 
security layer builds upon and complements the others. TWIC is one of 
those layers. Thank you for the opportunity to discuss the TWIC 
program. I am available to answer any questions.

    Mrs. Miller. Thank you very much.
    The Chairwoman now recognizes Mr. Lord.

  STATEMENT OF STEPHEN M. LORD, DIRECTOR, FORENSIC AUDITS AND 
 INVESTIGATIVE SERVICES, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Lord. Good morning, Chairwoman Miller, Ranking Member 
Jackson Lee, and other distinguished Members of the committee. 
I am really pleased to be here today to discuss our recent work 
on the TWIC pilot. As context, I would like to note that GAO 
has conducted an extensive body of work on a TWIC program 
spanning several years, which I believe gives me some unique 
insights to come in on the program today.
    The overall message that I wanted to convey today--I think 
this is a very important message--is that the pilot results 
reported to Congress in February 2012 should not be used as a 
basis to inform the current rulemaking or to inform decision-
making. Why is that? As we noted in our May 2000 report, we 
identified a number of planning, data collection, and reporting 
challenges that we believe made the pilot results unreliable.
    I am a little surprised to see on the March 22 NPRM that 
the Coast Guard concluded that the cards function properly and 
enhance security, as we found this very difficult to 
extrapolate from the pilot results.
    In terms of planning, we think it is notable that DHS did 
take some important initial steps to address the pilot planning 
issues we identified in our 2009 report. At the same time, it 
did not develop an evaluation plan or performance standards as 
we recommended. In terms of data collection, we identified 
several limitations in the way data was collected during the 
pilot. For example, TSA and the independent test agent did not 
always record clear baseline data for comparing reader 
performance. They also did not collect complete data on card 
failures or the reasons an individual was denied access to a 
facility.
    Also, the operational impact of using TWICs, that was one 
of the key purposes of the pilot, with readers was not 
consistently documented across pilot sites. As a result of 
these challenges, this made it really difficult to determine 
whether the problems encountered at the pilot sites were due to 
the card itself, the card reader, or the way the users were 
using them or a combination of all three.
    In terms of the report to Congress, we found that some of 
the information in the report was not always supported by the 
pilot data. For example, assessments of entry times at ports--
this is really important piece of data--the throughput times 
were--seem to have been mixed up with the reader response time, 
which is calculated in a controlled laboratory setting.
    DHS's report also stated that the TWIC readers can enhance 
security, even though that type of data was not collected 
during the pilot, nor was it a purpose of the pilot. Thus, it 
is still unclear how TWICs--using TWICs with readers will 
improve security even though we recommended that the Department 
assess this in our May 2011 report.
    To be fair, DHS officials, TSA officials did note that 
several challenges affected their ability to collect reliable 
data. For example, TSA noted that pilot participation was 
voluntary and, in some cases, it was analogous to herding cats. 
It is difficult to ensure consistency.
    TSA and the Coast Guard also said the independent test 
agent did not always collect and record key data consistently. 
We spoke to the independent test agent. He identified some 
resource constraints. Basically, they didn't have the physical 
presence in all locations to really figure out why the cards 
weren't working. However, we believe these risks could have 
been mitigated through better pilot planning and 
implementation.
    In closing, given the many issues we identified, we believe 
Congress should consider repealing the requirement that the 
final regulations for the card readers be consistent with the 
findings of the pilot. Essentially, we think those two events 
should be de-linked.
    Instead, we still believe Congress should require DHS to 
complete a security assessment to clearly show how using TWICs 
with readers will actually improve security over and above the 
systems that are already in place. This is something we 
recommended in our May 2011 report, which is still an open 
recommendation. As part of this assessment, we believe they 
should consider alternative credentialing approaches, including 
consideration of a more decentralized approach. We think it is 
really important to look at other approaches for achieving the 
same goal.
    Madam Chairwoman, other Members of the committee, this 
concludes my prepared statement. I look forward to your 
questions. Thank you.
    [The prepared statement of Mr. Lord follows:]
                 Prepared Statement of Stephen M. Lord
                             June 18, 2013
  transportation worker identification credential.--card reader pilot 
     results are unreliable; security benefits should be reassessed
                              gao-13-695t
    Chairman Miller, Ranking Member Jackson Lee, and Members of the 
subcommittee: I am pleased to be here today to discuss our work 
examining the Department of Homeland Security's (DHS) Transportation 
Worker Identification Credential (TWIC) program. Ports, waterways, and 
vessels handle billions of dollars in cargo annually, and an attack on 
our Nation's maritime transportation system could have serious 
consequences. Maritime workers, including longshoremen, mechanics, 
truck drivers, and merchant mariners, access secure areas of the 
Nation's estimated 16,400 maritime-related transportation facilities 
and vessels, such as cargo container and cruise ship terminals, each 
day while performing their jobs.\1\
---------------------------------------------------------------------------
    \1\ For the purposes of this statement, the term ``maritime-related 
transportation facilities'' refers to seaports, inland ports, offshore 
facilities, and facilities located on the grounds of ports.
---------------------------------------------------------------------------
    The TWIC program is intended to provide a tamper-resistant 
biometric credential \2\ to maritime workers who require unescorted 
access to secure areas of facilities and vessels regulated under the 
Maritime Transportation Security Act of 2002 (MTSA).\3\ TWIC is to 
enhance the ability of MTSA-regulated facility and vessel owners and 
operators to control access to their facilities and verify workers' 
identities. Under current statute and regulation, maritime workers 
requiring unescorted access to secure areas of MTSA-regulated 
facilities or vessels are required to obtain a TWIC,\4\ and facility 
and vessel operators are required by regulation to visually inspect 
each worker's TWIC before granting unescorted access.\5\ Prior to being 
granted a TWIC, maritime workers are required to undergo a background 
check, known as a security threat assessment.
---------------------------------------------------------------------------
    \2\ A biometric access control system consists of technology that 
determines an individual's identity by detecting and matching unique 
physical or behavioral characteristics, such as fingerprint or voice 
patterns, as a means of verifying personal identity.
    \3\ Pub. L. No. 107-295, 116 Stat. 2064. According to Coast Guard 
regulations, a secure area is an area that has security measures in 
place for access control. 33 C.F.R.  101.105. For most maritime 
facilities, the secure area is generally any place inside the outermost 
access control point. For a vessel or outer continental shelf facility, 
such as offshore petroleum or gas production facilities, the secure 
area is generally the whole vessel or facility. A restricted area is a 
part of a secure area that needs more limited access and higher 
security. Under Coast Guard regulations, an owner/operator must 
designate certain specified types of areas as restricted. For example, 
storage areas for cargo are restricted areas under Coast Guard 
regulations. 33 C.F.R.  105.260(b)(7).
    \4\ 46 U.S.C.  70105(a); 33 C.F.R.  101.514.
    \5\ 33 C.F.R.  104.265(c), 105.255(c).
---------------------------------------------------------------------------
    Within DHS, the Transportation Security Administration (TSA) and 
the U.S. Coast Guard (USCG) jointly administer the TWIC program. USCG 
is leading efforts to develop a new TWIC regulation (rule) regarding 
the use of TWIC cards with readers (known as the TWIC card reader 
rule). The TWIC card reader rule is expected to define if and under 
what circumstances facility and vessel owners and operators are to use 
electronic card readers to verify that a TWIC card is valid. USCG 
published the TWIC card reader notice of proposed rulemaking (NPRM) on 
March 22, 2013, and has since extended the public comment period to 
June 20, 2013.\6\
---------------------------------------------------------------------------
    \6\ 78 Fed. Reg. 17,782 (Mar. 22, 2013); 78 Fed. Reg. 27,335 (May 
10, 2013).
---------------------------------------------------------------------------
    To help inform this rulemaking and to fulfill the Security and 
Accountability For Every Port Act of 2006 (SAFE Port Act) 
requirement,\7\ TSA conducted a TWIC reader pilot from August 2008 
through May 2011 to test a variety of biometric readers, as well as the 
credential authentication and validation process. The TWIC reader 
pilot, implemented with the voluntary participation of maritime port, 
facility, and vessel operators, was to test the technology, business 
processes, and operational impacts of deploying card readers at 
maritime facilities and vessels prior to issuing a final rule.\8\ Among 
other things, the SAFE Port Act required that DHS submit a report on 
the findings of the pilot program to Congress.\9\ DHS submitted its 
report to Congress on the findings of the TWIC reader pilot on February 
27, 2012.\10\ The Coast Guard Authorization Act of 2010 required that, 
among other things, GAO conduct an assessment of the report's findings 
and recommendations.\11\
---------------------------------------------------------------------------
    \7\ Pub. L. No 109-347,  104(a), 120 Stat. 1884, 1888 (codified at 
46 U.S.C.  70105(k)).
    \8\ The SAFE Port Act required the Secretary of Homeland Security 
to conduct a pilot program to test the business processes, technology, 
and operational impacts required to deploy transportation security card 
readers at secure areas of the maritime transportation system. 46 
U.S.C.  70105(k)(1)(A).
    \9\ 46 U.S.C.  70105(k)(4).
    \10\ Department of Homeland Security, Transportation Worker 
Identification Credential Reader Pilot Program: In accordance with 
Section 104 of the Security and Accountability For Every Port Act of 
2006, Pub. L. 109-347 (SAFE Port Act) Final Report. Feb. 17, 2012.
    \11\ Pub. L. No. 111-281,  802, 124 Stat. 2905, 2989.
---------------------------------------------------------------------------
    We have been reporting on TWIC progress and challenges since 
September 2003.\12\ Among other issues, we highlighted steps that TSA 
and USCG were taking to meet an expected surge in initial enrollment as 
well as various challenges experienced in the TWIC testing conducted by 
a contractor for TSA and USCG from August 2004 through June 2005. We 
also identified challenges related to ensuring that the TWIC technology 
works effectively in the harsh maritime environment.\13\ In November 
2009, we reported on the design and approach of a pilot initiated in 
August 2008 to test TWIC readers, and found that DHS did not have a 
sound evaluation methodology to ensure information collected through 
the TWIC reader pilot would be complete and accurate.\14\ Moreover, in 
May 2011, we reported that internal control weaknesses governing the 
enrollment, background checking, and use of TWIC potentially limit the 
program's ability to provide reasonable assurance that access to secure 
areas of MTSA-regulated facilities is restricted to qualified 
individuals.\15\
---------------------------------------------------------------------------
    \12\ GAO, Maritime Security: Progress Made in Implementing Maritime 
Transportation Security Act, but Concerns Remain, GAO-03-1155T 
(Washington, DC: Sept. 9, 2003).
    \13\ GAO, Transportation Security: DHS Should Address Key 
Challenges Before Implementing the Transportation Worker Identification 
Credential Program, GAO-06-982 (Washington, DC: Sept. 29, 2006). TWIC 
readers and related technologies operated outdoors in the harsh 
maritime environment can be affected by dirt, salt, wind, and rain.
    \14\ GAO, Transportation Worker Identification Credential: Progress 
Made in Enrolling Workers and Activating Credentials but Evaluation 
Plan Needed to Help Inform the Implementation of Card Readers, GAO-10-
43 (Washington, DC: Nov. 18, 2009).
    \15\ GAO, Transportation Worker Identification Credential: Internal 
Control Weaknesses Need to Be Corrected to Help Achieve Security 
Objectives, GAO-11-657 (Washington, DC: May 10, 2011).
---------------------------------------------------------------------------
    My statement today highlights the key findings of our May 8, 2013, 
report on the TWIC program, which addressed the extent to which the 
results from the TWIC reader pilot were sufficiently complete, 
accurate, and reliable for informing Congress and the TWIC card reader 
rule.\16\ For the report, among other things, we assessed the methods 
used to collect and analyze pilot data since the inception of the pilot 
in August 2008. We analyzed and compared the pilot data with the TWIC 
reader pilot report submitted to Congress to determine whether the 
findings in the report are based on sufficiently complete, accurate, 
and reliable data. Additionally, we interviewed officials at DHS, TSA, 
and USCG with responsibilities for overseeing the TWIC program, as well 
as pilot officials responsible for coordinating pilot efforts with TSA 
and the independent test agent (responsible for planning, evaluating, 
and reporting on all test events), about TWIC reader pilot testing 
approaches, results, and challenges. Our investigators also conducted 
limited covert testing of TWIC program internal controls for acquiring 
and using TWIC cards at four maritime ports to update our understanding 
of the effectiveness of TWIC at enhancing maritime security since we 
reported on these issues in May 2011. Our May 2013 report includes 
additional details on our scope and methodology. We conducted this work 
in accordance with generally accepted Government auditing standards, 
and conducted the related investigative work in accordance with 
standards prescribed by the Council of the Inspectors General on 
Integrity and Efficiency.
---------------------------------------------------------------------------
    \16\ GAO, Transportation Worker Identification Credential: Card 
Reader Pilot Results Are Unreliable; Security Benefits Need to Be 
Reassessed, GAO-13-198 (Washington, DC: May 8, 2013).
---------------------------------------------------------------------------
twic reader pilot results are not sufficiently complete, accurate, and 
     reliable for informing congress and the twic card reader rule
    Our review of the pilot test identified several challenges related 
to pilot planning, data collection, and reporting, which affected the 
completeness, accuracy, and reliability of the results.
Pilot Planning
    DHS did not correct planning shortfalls that we identified in our 
November 2009 report.\17\ We determined that these weaknesses presented 
a challenge in ensuring that the pilot would yield information needed 
to inform Congress and the card reader rule and recommended that DHS 
components implementing the pilot--TSA and USCG--develop an evaluation 
plan to guide the remainder of the pilot and identify how it would 
compensate for areas where the TWIC reader pilot would not provide the 
information needed. DHS agreed with the recommendations; however, while 
TSA developed a data analysis plan, TSA and USCG reported that they did 
not develop an evaluation plan with an evaluation methodology or 
performance standards, as we recommended. The data analysis plan was a 
positive step because it identified specific data elements to be 
captured from the pilot for comparison across pilot sites. If accurate 
data had been collected, adherence to the data analysis plan could have 
helped yield valid results. However, TSA and the independent test agent 
did not utilize the data analysis plan.\18\ According to officials from 
the independent test agent, they started to use the data analysis plan 
but stopped using the plan because they were experiencing difficulty in 
collecting the required data and TSA directed them to change the 
reporting approach. TSA officials stated that they directed the 
independent test agent to change its collection and reporting approach 
because of TSA's inability to require or control data collection to the 
extent required to execute the plan.
---------------------------------------------------------------------------
    \17\ GAO-10-43.
    \18\ To conduct the TWIC reader pilot, TSA contracted with the 
Navy's Space and Naval Warfare Systems Command (SPAWAR) to serve as the 
independent test agent to plan, analyze, evaluate, and report on all 
test events.
---------------------------------------------------------------------------
Data Collection
    We identified eight areas where TWIC reader pilot data collection, 
supporting documentation, and recording weaknesses affected the 
completeness, accuracy, and reliability of the pilot data.
    1. Installed TWIC readers and access control systems could not 
        collect required data on TWIC reader use, and TSA and the 
        independent test agent did not employ effective compensating 
        data collection measures.--The TWIC reader pilot test and 
        evaluation master plan recognizes that in some cases, readers 
        or related access control systems at pilot sites may not 
        collect the required test data, potentially requiring 
        additional resources, such as on-site personnel, to monitor and 
        log TWIC card reader use issues. Moreover, such instances were 
        to be addressed as part of the test planning. However, the 
        independent test agent reported challenges in sufficiently 
        documenting reader and system errors. For example, the 
        independent test agent reported that the logs from the TWIC 
        readers and related access control systems were not detailed 
        enough to determine the reason for errors, such as biometric 
        match failure, an expired TWIC card, or that the TWIC was 
        identified as being on the list of revoked credentials. The 
        independent test agent further reported that the inability to 
        determine the reason for errors limited its ability to 
        understand why readers were failing, and thus it was unable to 
        determine whether errors encountered were due to TWIC cards, 
        readers, or users, or some combination thereof.

    2. Reported transaction data did not match underlying 
        documentation.--A total of 34 pilot site reports were issued by 
        the independent test agent. According to TSA, the pilot site 
        reports were used as the basis for DHS's report to Congress. We 
        separately requested copies of the 34 pilot site reports from 
        both TSA and the independent test agent. In comparing the 
        reports provided, we found that 31 of the 34 pilot site reports 
        provided to us by TSA did not contain the same information as 
        those provided by the independent test agent. Differences for 
        27 of the 31 pilot site reports pertained to how pilot site 
        data were characterized, such as the baseline throughput time 
        used to compare against throughput times observed during two 
        phases of testing. However, at two pilot sites, Brownsville and 
        Staten Island Ferry, transaction data reported by the 
        independent test agent did not match the data included in TSA's 
        reports. Moreover, data in the pilot site reports did not 
        always match data collected by the independent test agent 
        during the pilot.

    3. Pilot documentation did not contain complete TWIC reader and 
        access control system characteristics.--Pilot documentation did 
        not always identify which TWIC readers or which interface 
        (e.g., contact or contact-less interface) the reader used to 
        communicate with the TWIC card during data collection.\19\ For 
        example, at one pilot site, two different readers were tested. 
        However, the pilot site report did not identify which data were 
        collected using which reader.
---------------------------------------------------------------------------
    \19\ As used in this statement, ``contact-less mode'' refers to the 
use of TWIC readers for reading TWIC cards without requiring that a 
TWIC card be inserted into or make physical contact with a TWIC reader.

    4. TSA and the independent test agent did not record clear baseline 
        data for comparing operational performance at access points 
        with TWIC readers.--Baseline data, which were to be collected 
        prior to piloting the use of TWIC with readers, were to be a 
        measure of throughput time, that is, the time required to 
        inspect a TWIC card and complete access-related processes prior 
        to granting entry. However, it is unclear from the 
        documentation whether acquired data were sufficient to reliably 
        identify throughput times at truck, other vehicle, and 
---------------------------------------------------------------------------
        pedestrian access points, which may vary.

    5. TSA and the independent test agent did not collect complete data 
        on malfunctioning TWIC cards.--TSA officials observed 
        malfunctioning TWIC cards during the pilot, largely because of 
        broken antennas. If a TWIC with a broken antenna was presented 
        for a contactless read, the reader would not identify that a 
        TWIC had been presented, as the broken antenna would not 
        communicate TWIC information to a contactless reader. In such 
        instances, the reader would not log that an access attempt had 
        been made and failed.

    6. Pilot participants did not document instances of denied 
        access.--Incomplete data resulted from challenges documenting 
        how to manage individuals with a denied TWIC across pilot 
        sites. Specifically, TSA and the independent test agent did not 
        require pilot participants to document when individuals were 
        granted access based on a visual inspection of the TWIC, or 
        deny the individual access as may be required under future 
        regulation. This is contrary to the TWIC reader pilot test and 
        evaluation master plan, which calls for documenting the number 
        of entrants ``rejected'' with the TWIC card reader system 
        operational as part of assessing the economic impact. Without 
        such documentation, the pilot sites were not completely 
        measuring the operational impact of using TWIC with readers.

    7. TSA and the independent test agent did not collect consistent 
        data on the operational impact of using TWIC cards with 
        readers.--TWIC reader pilot testing scenarios included having 
        each individual present his or her TWIC for verification; 
        however, it is unclear whether this actually occurred in 
        practice. For example, at one pilot site, officials noted that 
        during testing, approximately 1 in 10 individuals was required 
        to have his or her TWIC checked while entering the facility 
        because of concerns about causing a traffic backup. Despite 
        noted deviations in test protocols, the reports for these pilot 
        sites do not note that these deviations occurred. Noting 
        deviations in each pilot site report would have provided 
        important perspective by identifying the limitations of the 
        data collected at the pilot site and providing context when 
        comparing the pilot site data with data from other pilot sites.

    8. Pilot site records did not contain complete information about 
        installed TWIC readers' and access control systems' design.--
        TSA and the independent test agent tested the TWIC readers at 
        each pilot site to ensure they worked before individuals began 
        presenting their TWIC cards to the readers during the pilot. 
        However, the data gathered during the testing were incomplete. 
        For example, 10 of 15 sites tested readers for which no record 
        of system design characteristics were recorded. In addition, 
        pilot reader information was identified for 4 pilot sites but 
        did not identify the specific readers or associated software 
        tested.

    According to TSA, a variety of challenges prevented TSA and the 
independent test agent from collecting pilot data in a complete and 
consistent fashion. Among the challenges noted by TSA: (1) Pilot 
participation was voluntary, which allowed pilot sites to stop 
participation at any time or not adhere to established testing and data 
collection protocols; (2) the independent test agent did not correctly 
and completely collect and record pilot data; (3) systems in place 
during the pilot did not record all required data, including 
information on failed TWIC card reads and the reasons for the failure; 
and (4) prior to pilot testing, officials did not expect to confront 
problems with nonfunctioning TWIC cards. Additionally, TSA noted that 
it lacked the authority to compel pilot sites to collect data in a way 
that would have been in compliance with Federal standards. In addition 
to these challenges, the independent test agent identified the lack of 
a database to track and analyze all pilot data in a consistent manner 
as an additional challenge to data collection and reporting. The 
independent test agent, however, noted that all data collection plans 
and resulting data representation were ultimately approved by TSA and 
USCG.
Reporting
    As required by the SAFE Port Act and the Coast Guard Authorization 
Act of 2010, DHS's report to Congress on the TWIC reader pilot 
presented several findings with respect to technical and operational 
aspects of implementing TWIC technologies in the maritime environment. 
However, DHS's reported findings were not always supported by the pilot 
data, or were based on incomplete or unreliable data, thus limiting the 
report's usefulness in informing Congress about the results of the TWIC 
reader pilot. For example, reported entry times into facilities were 
not based on data collected at pilot sites as intended. Further, the 
report concluded that TWIC cards and readers provide a critical layer 
of port security, but data were not collected to support this 
conclusion.
    Because of the number of concerns that we identified with the TWIC 
pilot, in our March 13, 2013, draft report to DHS, we recommended that 
DHS not use the pilot data to inform the upcoming TWIC card reader 
rule. However, after receiving the draft that we sent to DHS for 
comment, on March 22, 2013, USCG published the TWIC card reader NPRM, 
which included results from the TWIC card reader pilot.\20\ We 
subsequently removed the recommendation from our final report, given 
that USCG had moved forward with issuing the NPRM and had incorporated 
the pilot results into the proposed rulemaking. In its official 
comments on our report, DHS asserted that some of the perceived data 
anomalies we cited were not significant to the conclusions TSA reached 
during the pilot and that the pilot report was only one of multiple 
sources of information available to USCG in drafting the TWIC reader 
NPRM. We recognize that USCG had multiple sources of information 
available to it when drafting the proposed rule; however, the pilot was 
used as an important basis for informing the development of the NPRM, 
and the issues and concerns that we identified remain valid.
---------------------------------------------------------------------------
    \20\ 78 Fed. Reg. 17,782 (Mar. 22, 2013).
---------------------------------------------------------------------------
    Given that the results of the pilot are unreliable for informing 
the TWIC card reader rule on the technology and operational impacts of 
using TWIC cards with readers, we recommended that Congress consider 
repealing the requirement that the Secretary of Homeland Security 
promulgate final regulations that require the deployment of card 
readers that are consistent with the findings of the pilot program,\21\ 
and that Congress should consider requiring that the Secretary of 
Homeland Security complete an assessment that evaluates the 
effectiveness of using TWIC with readers for enhancing port security. 
This would be consistent with the recommendation that we made in our 
May 2011 report. These results could then be used to promulgate a final 
regulation as appropriate. Given DHS's challenges in implementing TWIC 
over the past decade, at a minimum, the assessment should include a 
comprehensive comparison of alternative credentialing approaches, which 
might include a more decentralized approach, for achieving TWIC program 
goals.
---------------------------------------------------------------------------
    \21\ 46 U.S.C.  70105(k)(3).
---------------------------------------------------------------------------
    Chairman Miller, Ranking Member Jackson Lee, and Members of the 
subcommittee, this concludes my prepared statement. I would be happy to 
respond to any questions that you may have.

    Mrs. Miller. I thank the gentleman. The Chairwoman now 
recognizes Captain Woodring.

  STATEMENT OF CAPTAIN MARCUS WOODRING, USCG (RET), MANAGING 
DIRECTOR, HEALTH, SAFETY, SECURITY, AND ENVIRONMENTAL, PORT OF 
                       HOUSTON AUTHORITY

    Captain Woodring. Good morning, Chairman Miller, Ranking 
Member Jackson Lee, and distinguished Members of the 
subcommittee. We would like to thank Chairman Miller for 
holding this important hearing today. I must also recognize 
Ranking Member Jackson Lee for inviting the Port of Houston 
Authority as the industry witness. As you know, the port of 
Houston is in the Ranking Member's district, and we have 
benefited from both her leadership and advocacy on behalf of 
the port.
    The port of Houston is comprised of the Port Authority's 
eight public terminals, along with more than 150 private 
terminals. The port is consistently ranked first in the United 
States in foreign waterborne tonnage, first in imports, second 
in export tonnage, and second in total tonnage. The port of 
Houston is also home to the largest petrochemical complex in 
the Nation.
    Results of a recent economic impact study show that ship 
channel-related businesses at the port of Houston are 
responsible for more than 2.1 million jobs and annually 
generate $499 billion in economic activity, contributing over 
$52 billion in tax revenue Nationally.
    The Port of Houston Authority was not part of the TWIC 
reader pilot program but has been utilizing installed TWIC 
readers since 2008, so we speak from real-world experience. The 
Port of Houston Authority started very early, with the 
installation of access point hardware, which could utilize the 
features of the TWIC card. The initial infrastructure was 
purchased with close to $10 million in port security grant 
funding.
    The Port of Houston Authority currently has over 350 access 
points that can read the TWIC card, of which 73 are biometric. 
Not all access points used the biometric or coded access 
technology due to the tremendous flow of commerce through our 
gates. Our Bayport container terminal, for example, handles 
close to 19,000 vehicles a week. To facilitate commerce, we 
currently use the TWIC as a flash pass in our vehicle entrance 
lanes in conjunction with our visitor management system.
    Let me expand on that point for just one moment. Having a 
TWIC is just one part of the regulated access control. I have a 
TWIC, but that does not give me unfettered access to any 
restricted port in the country. I must also have a valid 
business reason to be there. Management of that validation is 
left to terminal operators.
    For repeat visitors, we issue a Port of Houston Authority 
ID card. For occasional visitors, we have designated certain 
trusted agents to enter names into our visitor management 
system. On any given day, we average over 3,000 names in that 
system, all that have a valid business reason for being on-
board our facilities and overall have more than 35,000 TWIC 
cards registered with our credentialing office. The key 
takeaway is the possession of a TWIC itself is just a piece of 
the overall security process.
    During my time as captain of the port for the U.S. Coast 
Guard, the TWIC was first being introduced and issued in 
Houston. It took me several months to obtain my initial TWIC 
card. I recently applied for the 3-year extension and witnessed 
some process improvements.
    I would also like to note that when I was with the U.S. 
Coast Guard, I had the pleasure of accompanying the Ranking 
Member Jackson Lee to the TWIC office in Houston to activate 
her card in August 2008. Ma'am, I would like to take this 
opportunity to remind you that your card expires in 60 days.
    [Laughter.]
    Captain Woodring. The benefits of the TWIC reader program 
are clear. Individuals have a Federally-issued tamper-proof 
credential that can be used Nation-wide. The program ensures 
that individuals have been screened against the terrorism 
database, something I cannot do. The threat of a transportation 
security incident is reduced at the macro level, but there are 
still gaps in the system.
    Most ports issue their own credentials in addition to the 
TWIC card. I personally carry a port of Houston ID and my TWIC 
card on a daily basis. Secondly, the background check is only 
conducted at a very high level for very serious crimes. As a 
facility owner and operator, we strive to prevent any crime on 
our docks and still conduct our own local background checks on 
our employees for lesser crimes, such as driving while 
intoxicated, theft, or assault. These lesser crimes are just as 
important to us.
    Finally, the TWIC background check is a snapshot in time. 
Unless self-reported, there does not appear to be a constant 
and on-going linkage between the TWIC issuance and local 
criminal databases. Currently, the background check of the TWIC 
program is only as good as the day it was conducted.
    I would like to leave the subcommittee with two thoughts 
today. The Port of Houston Authority has received over $60 
million in port security grant funding, and it continues to be 
vital to our security posture. We are in the process of making 
application for the 2013 port security grants, one of which 
will request handheld TWIC readers. It is critical to our 
National security that the port security grant program remain 
independent of other grant programs and that the erosion of the 
funding level ceases.
    Second, the initial intent of the Transportation Worker 
Identification Credential program was to credential all 
transportation workers in all transportation modes. It was 
envisioned as a Nation-wide solution to be used at airports, 
seaports, rail, pipeline, trucking, and other mass transit. 
Someday this program will theoretically expand to all those 
modes of transportation, and what comes out of hearings such as 
this will more broadly impact the future of the TWIC program.
    Thank you, and I look forward to your questions.
    [The prepared statement of Captain Woodring follows:]
             Prepared Statement of Captain Marcus Woodring
                             June 18, 2013
    Chairman Miller, Ranking Member Jackson Lee, and Members of the 
subcommittee, I am Marcus Woodring. I serve as the managing director 
for health, safety, security, and environmental (HSSE) at the Port of 
Houston Authority.
    We would like to thank Chairman Miller for holding this important 
and vital hearing today. I must also recognize Ranking Member Jackson 
Lee for inviting the Port of Houston Authority as the industry witness. 
As you may know, the port of Houston is in the Ranking Member's 
district and we have benefitted from her leadership and advocacy on 
behalf of the port.
    Security of our Nation's borders, both land and maritime, is a 
vexing problem with many different components and concerns. While I 
certainly do not have the solutions to all the challenges, I can tell 
you about our maritime port facilities, how we operate, and the impact 
of the TWIC program.
    First, let me begin by giving you a short background about myself. 
I earned an undergraduate degree at Brown University, and a Masters 
degree at Cornell University. I'm fairly new at the Port of Houston 
Authority, having been hired in 2011 after ``retiring'' from a 27-plus 
year career in the U.S. Coast Guard. My U.S. Coast Guard service 
culminated as the Captain of the Port for the Houston region.
    There is a saying that if you've seen one port, you've seen one 
port--every port in the country is organized differently. But let me 
tell you about ours. The port of Houston is comprised of the Port 
Authority's eight public terminals along with 150-plus private 
industrial terminals along the 25-mile long upper Houston Ship Channel.
    Each year, more than 229 million tons of cargo moves through the 
port of Houston, with more than 8,100 vessel calls and 200,000 barge 
transits, trading with over 200 countries around the globe. The port is 
consistently ranked first in the United States in foreign waterborne 
tonnage, first in U.S. imports, and second in U.S. export tonnage, and 
it is also ranked second in the United States in total tonnage.
    The port of Houston is the largest importer and exporter of 
petroleum and petroleum products in the United States, which is no 
surprise, as it is home to the largest petrochemical complex in the 
United States, and is the second-largest petrochemical complex in the 
world.
    As one of the world's busiest ports, the port of Houston is a large 
and vibrant component of the regional economy. Results of a recent 
economic impact study show that ship channel-related businesses at the 
port of Houston were responsible for more than 1 million jobs 
throughout Texas. This activity helped generate more than $178.5 
billion in State-wide economic impact and more than $4.5 billion in 
annual State and local tax revenues. For the United States, the port's 
impact is even greater, with 2.1 million jobs, $499 billion in economic 
activity and $52.1 billion in tax revenue.
    Considering this economic impact and the volume of cargo traveling 
the waterways of the port of Houston, there are potentially significant 
National implications should a Transportation Security Incident occur 
within our maritime domain. Now I will get more specific in answering 
the questions on today's agenda.
                    (1) current use of twic readers
    I have read the recent GAO report, but the Port of Houston 
Authority was not part of the TWIC Reader Pilot Program. Instead, we 
have been utilizing installed TWIC readers since 2008, so I will speak 
from that experience. In an attempt to meet the ``spirit of the 
regulations'', the Port of Houston Authority started very early with 
the installation of access point hardware which could utilize the 
features of the TWIC card. The initial phases of the TWIC reader 
installation project was funded close to $10 million dollars in Port 
Security Grant funding ($6.3 million in Round 5, $1.7 million in Round 
7, and $1.2 million in Round 8). The Port of Houston Authority 
currently has over 350 access points which can read the TWIC card, of 
which 73 are biometric.
    Not all access points use the biometric or coded access technology 
due to the tremendous flow of commerce through our gates. For example, 
the Bayport Container Terminal handles close to 19,000 vehicles a week. 
That equates to an average of almost two trucks per minute, around the 
clock, at just one of our three major terminals. To facilitate 
commerce, we currently use the TWIC as a ``flash pass'' in our vehicle 
entrance lanes, in conjunction with our Visitor Management System 
(VMS).
    Let me expand on that point for a moment, having a TWIC is just one 
part of regulated access control. I have a TWIC, but that does not give 
me unfettered access to any restricted port in the country. I must also 
have ``a valid business reason'' to access the restricted or secure 
area. Management of the validation of that ``business reason'' is left 
to terminal operators, and managed at the Port of Houston Authority by 
our Credentialing Office. For our repeat visitors, we issue a Port of 
Houston Authority ID card. For occasional visitors, we have designated 
certain ``trusted agents'' to enter names into our Visitor Management 
System. On any given day, we average over 3,000 names in our system 
that all have a ``valid business reason'' for being on-board our 
facilities, and overall have 35,000 TWIC cards registered with our 
Credentialing Office. The key ``take-away'' is that possession of a 
TWIC itself is just a piece of the overall security process.
                  (2) enrollment and issuance of twic
    In 2008, during my time as Captain of the Port for the U.S. Coast 
Guard, the TWIC was first being introduced and issued in Houston. I 
heard many stories about the issuance process and while not required by 
law to obtain a TWIC (my military ID and status as a member of the U.S. 
Coast Guard precluded the requirement), I chose to personally apply and 
pay for a card so that I could witness the process first-hand, desiring 
to validate the stories I was hearing. The initial call to schedule an 
appointment took over 3 hours on the phone. After several months, I was 
able to determine my card was ready for pick-up. I made an appointment 
for 0630 and was told my card could not be located. After revealing my 
position with the U.S. Coast Guard, another search quickly located my 
card. The activation was fairly easy.
    Knowing that my card was due to expire in early 2013, I recently 
applied for the 3-year extension option. Again, the phone call took 
over 2 hours. The turn-around time was much quicker, and I was notified 
within several weeks that my new card was ready for activation. My 
appointment time had five other people, and we all lined up in front of 
computers and activated our new cards in less than 30 minutes, a vast 
improvement in the processing.
          (3) security benefits or problems with twic program
    The benefits are clear, individuals have a Federally-issued, 
tamper-proof credential that can be used Nation-wide. The program 
ensures that individuals have been screened against a terrorism 
database (aka the Security Threat Assessment), which I cannot do. The 
threat of a Transportation Security Incident is reduced at the macro 
level. It also allows facilities to automate access by coding the TWIC 
to activate unmanned entrance points.
    But there are still gaps in the system.
   Most ports still issue their own credentials in addition to 
        requiring a TWIC; I personally carry a Port of Houston 
        Authority ID and my TWIC on a daily basis. The Port of Houston 
        Authority ID is required to prove that I have a ``valid 
        business reason'' for being on the docks.
   Second, the background check is only conducted at a very 
        high level, for serious crimes. As a facility owner and 
        operator, we strive to prevent any crime on our docks and still 
        conduct our own local background checks on our employees for 
        lesser crimes, such as driving while intoxicated, theft, or 
        assault. These ``lesser crimes'' are just as important to me in 
        keeping our facilities safe and secure.
   Finally, the TWIC background check is a ``snapshot'' in 
        time. Unless self-reported, there does not appear to be a 
        constant and on-going linkage between the TWIC issuance and 
        local criminal databases. Again, I have over 35,000 TWIC cards 
        registered in my access system, and the background check of the 
        TWIC program is only as good as the day it was conducted.
              (4) thoughts concerning the twic reader nprm
    The Port of Houston Authority has already submitted ``comments for 
the docket'' concerning the TWIC Reader NPRM. I will briefly summarize 
those comments as they are available for public viewing on the docket 
website and included as an attachment to my prepared testimony.
    As I mentioned earlier, the TWIC is just a piece of the overall 
security process. The TWIC Reader Rule emphasizes the need to ensure 
the TWIC is valid, thereby simply ensuring the ``Security Threat 
Assessment'' is valid. There is enormous cost involved to ensure this 
sense of security. The background check associated with the TWIC card 
isn't the risk point, the risk point is when the ``valid business 
reason to be in the secure area'' is accepted by the individual 
facilities, allowing access to the waterfront. That part of the process 
is more critical than obtaining the TWIC card itself, but unregulated 
and left to individual facility security officers.
    We also asked for clarification of several items:
   The process for reporting inoperable readers to the U.S. 
        Coast Guard, and associated waiver process, is problematic if 
        it stops the flow of commerce while awaiting permission.
   The definition of ``CDC in bulk'' is vital to which 
        determining which level of TWIC compliance a facility must 
        obtain, and we asked for the term to be better defined.
   Recordkeeping requirements at a cruise terminal also need 
        clarification as the Facility Security Plans are often 
        ``shared'' between the cruise line and facility owner.
   Finally, we requested that the ``recurring unescorted 
        access'' waiver be better defined to accommodate workers such 
        as porters, who may be required to enter and exit a cruise 
        terminal up to 30 times each, per day.
    I would like to leave the subcommittee with two thoughts today--the 
Port of Houston Authority alone has received over $60 million dollars 
in Port Security Grant funding to date, and it continues to be vital to 
our security posture. We are in the process of making our applications 
for the fiscal year 2013 Port Security Grants, one of which will 
request handheld TWIC readers for our remote access points and for use 
during heightened levels of MARSEC. It is critical to our National 
security for the Port Security Program to remain independent of other 
grant programs, and that the erosion of the funding level cease.
    Second, the initial intent of the Transportation Worker 
Identification Credential program was to credential all transportation 
workers in all transportation modes. It was envisioned as a Nation-wide 
solution to be used at airports, seaports, rail, pipeline, trucking, 
and other mass transit facilities. Someday, this program will 
theoretically expand to all those modes of transportation, and what 
comes out of hearings such as this will more broadly impact the future 
of the TWIC program.
    This concludes my prepared statement. I would be pleased to respond 
to any questions that you may have. Thank you.
     Attachment.--Port of Houston Authority's Comments for Docket 
                          re: TWIC Reader NPRM
    We appreciate the effort being put forth with the TWIC program to 
ensure each potential port worker has been screened with a background 
check. Unfortunately, the background check doesn't go deep enough to 
ensure we are protected from crime. The TWIC Reader Rule wrongly 
emphasizes the need to ensure the TWIC is valid, thereby simply 
ensuring the very broad background check is valid. There is enormous 
cost involved to ensure this small sense of security. The background 
check associated with the TWIC card isn't the risk point, the risk 
point is when the ``valid business reason to be in the secure area'' is 
accepted by the individual facilities, allowing access to the 
waterfront. That part of the process is more critical than the TWIC 
card itself, which is easy to obtain, yet totally unregulated and left 
to individual facility security officers. This TWIC Reader Rule does 
not address the true risk decision point.
    The process for reporting inoperable readers to the USCG, and the 
associated waiver process, needs to be clarified. Are facilities 
allowed to switch methods, so as to not impede commerce, and then 
notify the U.S. Coast Guard? Or must commerce stop until the U.S. Coast 
Guard is notified and permission received to deviate from the TWIC 
Reader Rule? We suggest that facilities take prudent actions required 
to maintain their level of security, and simply notify the U.S. Coast 
Guard of the deviation within a set time frame (say 30 minutes). To 
pause, and await permission, will impact the movement of cargo.
    The term ``CDC in bulk'' is used several times in the NPRM. 
According to 33CFR160.204, carried in bulk means ``a commodity that is 
loaded or carried on board a vessel without containers or labels and 
received and handled without mark or count''. We assume this is the 
same definition being used in the NPRM. As a large container facility, 
with several hundred CDC iso-tanks present in a fairly confined area at 
any given time, we would like to ensure that we are not handling ``CDC 
in bulk''. Request the definition being used in the NPRM be clarified 
in the final rule for vessel and facility grouping purposes.
    As a facility that does not ``handle CDC in bulk'', are we allowed 
to provide a layberth for a vessel that carries CDC in bulk, but that 
we have no capability of handling? If the ship is in Group A, does the 
facility have to match that Group? Conversely, can a Cruise Ship 
Terminal (a Group A facility) act as a Group B layberth for a bulk ship 
when not operating as a Cruise Terminal?
    The record-keeping requirement also requires clarification. As a 
Port Authority, we maintain the FSP for our cruise terminal. When a 
cruise ship is in port, the cruise line security operates under their 
own FSP. Who maintains the records? We assume the Port Authority would 
continue to maintain the records and provide them to the U.S. Coast 
Guard should they desire to inspect the cruise line security operation. 
Request clarification in the rule making.
    At a cruise terminal, porters are required to enter and exit the 
secure area up to 25 times a day each. With 35 porters (for example) 
working, that is hundreds of verifications in a single day. Please 
clarify the process for seeking relief from this apparently cumbersome 
process.
    With the TWIC Reader Rule coming to fruition, the QTL should be 
expanded to include not just the authorized TWIC readers but also any 
supporting software, particularly for record-keeping requirements.

    Mrs. Miller. Thank you very much, all of you. Excuse me.
    I think I am going to just start with you, Captain. I 
appreciate your testimony. I was taking a couple notes as you 
were talking, and what you just said at the end there, that 
someday this would be a much more comprehensive kind of a 
program that could be utilized intermodally for all the various 
types of transportation. Well, actually, that probably was the 
original vision, I think, of Congress with this program, but 
what has happened has become rather unrecognizable from what 
our original vision was, because--excuse me--you have got the 
airports that do their own thing now, really, and even on our 
highways and that, with hazardous material endorsements, the 
way that those are handled through the States as an add-on to a 
commercial driver license, et cetera.
    You also mentioned that in your observation that the TWIC 
card currently is sort of a flash pass. It is something that we 
say here, a very expensive flash pass, and whether or not it 
actually works. Just listening to your testimony about how you 
have your own ID cards in the port of Houston, and most ports 
do, have their own--sort of a layered approach, I suppose, at 
all of these individual ports of what they have.
    Let me just ask you. Do you think the TWIC is really a 
critical component of security at your port?
    Captain Woodring. The TWIC card gives me comfort that a 
background check or a threat assessment has been done against 
the terrorism database which I cannot do. That is at the macro 
level. As Admiral Servidio said, it is a piece of the process 
of the layers that come with it. We have two reasons for 
issuing our own Port of Houston Authority ID card. One is to 
validate that business reason for being on the docks, which 
speeds up commerce going through the gates. You don't have to 
check in the computer to see if they are on the list for today. 
I simply show them that, and it speeds commerce through. But 
that card also allows me to code that card with other things.
    The TWIC card can be coded in our credentialing office to 
beep at the gate and do those kinds of things. Our Port of 
Houston Authority ID card can also be coded up to do other 
things. So we have split purposes. The TWIC card will get you 
into the restricted area. The port of Houston ID card has a 
flash pass, will show you a valid business reason, but it will 
also beep on the doors in the executive building and get us in 
there.
    Mrs. Miller. I see. Admiral, really, the proposed 
rulemaking for the reader really only includes the highest-risk 
facilities. Without going into details of what those all are, 
it has been the one-digit numerals apparently of what the high-
risk facilities actually are.
    So you still have--who are required to have a TWIC card, so 
you still have 90-some percent of those who needed a TWIC card. 
I am just wondering, what is the rationale for requiring the 
entire universe of everyone to be having these TWIC cards if 
you are only--there is such a small percentage that you are 
really looking at.
    Admiral Servidio. Madam Chairwoman, we do see that the TWIC 
is an enabler for the future, in addition to allowing a 
migratory worker population to move between various facilities. 
As Captain Woodring said, the port of Houston is the port 
authority. When I was in St. Petersburg, there were about 80 
different facilities, and over half of those were not part of 
that port authority terminal. So technically, you could have a 
worker that would need to have 30 to 40 to 80 different 
identification credentials to get around the port environment. 
It is a very different environment than an airport environment.
    So having a single credential, I have seen how that has 
increased security in that the gate guards can look at one 
credential and try to figure out, what are the security 
measures on that card, and to verify it.
    Also, we see biometrically that this is the direction we 
need to go. The Coast Guard has approximately 300 biometric 
hand-held readers that we use every time we do an inspection, 
either a regular inspection or a no-notice inspection. We know 
that there are 75 to 100 facilities that have already used the 
TWIC as their one access credential to that port. Some of them 
could potentially biometrically validate those people when they 
come in during high-risk.
    We see--this is the direction that we need to have in the 
future, is a biometrically-enabled, risk-based methodology 
moving forward. At the present time, our cost-benefit analysis 
clearly identified for risk group A that the benefits far 
outweigh the costs, which are about $26 million, I think, 
annualized. We see in the future that there might be changes in 
cost, and we would expand that population.
    Mrs. Miller. Thank you, Admiral.
    Just one other question, Mr. Sadler. I mentioned in my 
opening statement that last year we passed a SMART Port Act, 
where we are trying to assist the customer group, I suppose, 
and obviously security is the marquee issue always, so that 
they didn't have to go to more than one place to access the 
TWIC card. We gave the--we said that we needed to have that 
done, gave the Department 270 days, actually, I think in 
statute, but you were just mentioning that at this point you 
hope to have a pilot program or you will have a pilot program 
in Alaska next month.
    I just mentioned that sort of like, what is the hold-up? I 
think you--the frustration that the Congress always has--
although I have to tell you the truth that sort of what is 
happening--what you just testified to--is indicative of this 
entire program, it seems, during a number of years. So why is 
there such a lag in what the Congress's intent was and the 
application of that?
    Mr. Sadler. Thank you, Chairwoman. We think that the One-
Visit is the right way to go, and we appreciate Congress's 
direction on the One-Visit program. To put it in some context, 
currently we are transitioning one system, which I will call 
the legacy system, which was used to enroll TWIC workers, to a 
new system, a more modernized system. That is going to allow us 
to roll an individual once and use that enrollment for multiple 
credentials.
    So, for instance, if you get a person who is enrolling for 
a TWIC card or an HME background check, we will be able to 
enroll that person once. We will be able to use that background 
check for both of those programs. So when we looked at the 270-
day time line, we determined that we would have to make 
significant changes, very costly changes to the legacy system 
that may or may not be able to be carried over to the 
modernized system. That was one of the first things that 
happened.
    Then doing that, you would have to modify a number of 
contracts, as well, on the legacy side, as well as the 
contracts on the system for modernization. So when we looked at 
the overall risks and did our rough order of magnitudes for 
cost estimates, we determined that in order to get this right, 
because we obviously are fully aware of the work the GAO has 
done with us--and we appreciate their work, as well--in order 
to get this right and make such a significant change in the 
program, because this is one of the most significant changes we 
have made, we are going from two enrollments to one enrollment, 
we determined that the best course of action would be to 
implement a pilot, get some lessons learned, particularly in an 
area like Alaska, which is similar to Hawaii. You have an upper 
peninsula of Michigan. You have a lot of challenges for people 
traveling.
    Let's do it in Alaska. Let's get some lessons learned. 
Let's start building those requirements into the new system and 
then take a--go to another location late this year or early 
calendar year of 2014, and then from there move into Nation-
wide enrollment--or, excuse me, deployment, once we get the new 
system in place next spring. That was our thought process for 
this, ma'am.
    Mrs. Miller. Thank you. I appreciate that. At this time, I 
will recognize the Ranking Member.
    Ms. Jackson Lee. Thank you very much, Madam Chairwoman, and 
I think the testimony of all the witnesses have been 
contributing. Hearings by Members are to be part of problem-
solving. So I would indicate to all the witnesses, and 
particularly to you, Admiral, that you are really working with 
the cards that you are dealt, and I appreciate you rising to 
the occasion to do the best that you can, but I am not 
comfortable that we are where we should be and that we are at 
our best.
    I do, Captain Woodring, thank you very much, and it is good 
to get a personal notice of expiration, and so I will look 
forward to doing it again timely. Thanks for giving me the 60-
day notice. It will be up to me now, after being told, to rush 
quickly to get it done.
    But I want to--you said one--a number of things that I 
think are important that I would like to pursue. First of all, 
the enormity, the largeness of the size of the Houston port is 
a very good prototype because of the numbers of vehicles, 
Bayport, 19,000 vehicles, and I didn't hear whether it is 
19,000 a week, a month. I didn't hear the number.
    Captain Woodring. Yes, ma'am, 19,000 vehicles per week at 
just the Bayport container terminal.
    Ms. Jackson Lee. I think--let me take a point of personal 
privilege to invite my colleagues and the Chair to join me for 
a site visit at the Houston port, Madam Chairwoman. I would 
love to host you there and the committee, as well. So that nod 
is on the record, and it was a nodding yes.
    [Laughter.]
    Mrs. Miller. I would be delighted to do that.
    Ms. Jackson Lee. It is on the record now. Captain is 
writing it down.
    But in any event, you said something about you having the 
ability to access the terrorist lists. Could you just expand on 
that, how important that is for you? Then could you expand on 
your renewal? You said the phone call was 2 hours. Frankly, I 
believe that is too long. Is there something we can do to 
expedite that?
    Captain Woodring. Yes, ma'am. First, on my renewal, when 
the cards first came out, I got my initial card. I was on the 
phone for about 3 hours, made the appointment, went to the TWIC 
center. They couldn't find my card initially, and I revealed 
who I was with the Coast Guard at the time, and they did 
another search in the back room and found it. So that was my--
--
    Ms. Jackson Lee. What center did you go to?
    Captain Woodring. I went to the one up by the Turning 
Basin, ma'am.
    Ms. Jackson Lee. Yes, thank you.
    Captain Woodring. You know the one. But that was 5 years 
ago. When I renewed this time for the 3-year extension, the 
phone call took me about an hour-and-a-half, and I understand 
they have now a web-based ability to do that, or at least I 
heard that in the testimony this morning. Then when I went, it 
was very easy. There were five of us at a long table, and they 
were able to activate all those cards simultaneously. So the 
process had greatly improved over time.
    Ms. Jackson Lee. But there was--and then, could you just 
expand quickly on the value of being able to access the 
terrorist list that the TWIC card provides?
    Captain Woodring. Yes, ma'am. I personally cannot run a--I 
can run a background check through our police department 
through different databases. I cannot access the terrorism 
database at the National level, and that is what the TWIC card 
brings to the table for me.
    Ms. Jackson Lee. So if we could--if we formulated something 
else that was more responsive, moved more quickly, but still 
gave access to the terrorist card, you could be open to that?
    Captain Woodring. I believe in the beginning there was some 
discussion of allowing law enforcement to somehow vet people 
against that list. I am not sure where that went, but we have 
the system we do today, and we appreciate the ability to have 
that.
    Ms. Jackson Lee. Yes, and I wouldn't offer the law 
enforcement. I would just say something more effective than 
where we are with the TWIC card. You would be open to it as 
long as we had--that whatever the new substitute would be would 
have access to that list?
    Captain Woodring. Absolutely, yes, ma'am.
    Ms. Jackson Lee. Let me go to Admiral and Mr. Sadler. I 
just want to have a pointed question. The GAO reported last 
month that not all TWIC reader cards underwent both the 
environmental and functional tests in a laboratory prior to use 
in the pilot. Instead, an initial evaluation was enhanced by 
TSA, and 30 TWIC card readers were approved for use by a pilot 
participant. However, none of the 30 readers underwent and 
passed all tests. Why were the readers deployed if they had not 
passed the proper test? What effect did this have on the pilot 
and the resulting data?
    I am going to ask two questions back-to-back, because I 
want to get Mr. Lord, and your report is quite thought-
provoking, if I might say. I do want to go back to your point 
about asking us to repeal a requirement, I guess, to rely upon 
the data and to go in another direction. If I am going to ask 
Mr. Sadler and then, Mr. Lord, would you follow with your 
recommendation, expand on that recommendation?
    But, gentlemen, could you both answer that? Mr. Admiral, do 
you want to go first, or Mr. Sadler?
    Mr. Sadler. I will go first, ma'am, because we were in 
charge of the pilot, and that was our responsibility. So as we 
started to move forward on the pilot, we did a number of tests 
on the readers that were available at the time. We did some 
initial tests in a lab. We did an environmental test. Then we 
did operational tests in the field prior to the implementation 
of the pilot program.
    So all the readers that were put into the field passed an 
operational test prior to starting the pilot program at that 
particular location. The situation we got into was, because of 
the time it was taking to send all the readers and the cost--
all the readers through these testings--or these different 
tests, we made a determination that we would do a test on a 
certain number of readers and then we would allow the other 
readers to be used in the marketplace. That is how we got to 
that decision, ma'am.
    Ms. Jackson Lee. That is how you got to some of the errors, 
because you tested some and didn't test others?
    Mr. Sadler. I am not sure that is the reason, ma'am, 
because all the readers worked. They were operationally tested 
in the locations prior to the start of the pilot program. There 
were a number of different reasons that you couldn't get a read 
on the card. There may have been reader issues; there may have 
been card issues. One of the challenges that we had is it is 
difficult to get error information from these readers because 
they are not designed to do that. They are designed to 
facilitate access control decisions.
    Ms. Jackson Lee. Admiral, do you quickly want to have a 
comment so I can hear from Mr. Lord? Thank you for your 
service.
    Admiral Servidio. Thank you, Ranking Member. I would like 
to point out that, again, when the pilot first started, the 
systems are more robust than what they were at that time. We 
are looking to have a QTL, a qualified technology list, that 
would show that these readers have been tested and that they 
work properly.
    Our NPRM is soliciting comments from industry specifically 
on whether this is a good rule or bad rule, and we have seen in 
the past that the comments we received will make a better rule 
than what we initially proposed. We intentionally have not 
included some of those high-throughput facilities, like 
container terminals or row-row terminals, because we feel that 
we will get better data initially from the cost-benefit 
analysis and how we are proposing the NPRM.
    Ms. Jackson Lee. Mr. Lord.
    Mr. Lord. Did you want me to respond to the recommendation 
to de-link those two events? Well, obviously, we found some 
limitations in the pilot, and TSA and the Coast Guard were 
directed to use the pilot to help develop the rule. Given the 
importance of the rule, we believe some of the limitations we 
noted we are suggesting, well, they should be relieved of that 
requirement.
    Ms. Jackson Lee. So what should they base the rule on?
    Mr. Lord. Well, as the agencies noted in the rule, they 
used other sources of information to inform the rulemaking. 
Obviously, that is not the only source of information, although 
we view it as a key source, but just to ensure the integrity of 
the process, if the data is no good, we don't believe people 
should be asked to use it.
    Ms. Jackson Lee. Thank you, Madam Chairwoman. I yield back.
    Mrs. Miller. At this time, the Chairwoman recognizes the 
gentleman from South Carolina, Mr. Duncan.
    Mr. Duncan. Thank you, Madam Chairwoman.
    First off, let me just say that, after 11 years, this 
program should be a lot further along than it is. I was reading 
some of the notes, and it said there are disqualifying factors 
that can be waived with proper authority, and they include 
transportation security crimes, improper transportation of 
hazardous material, unlawful handling of explosive devices, 
murder, any threat or purposely false information concerning an 
explosive device in a public or Government facility. That is 
abysmal, the fact that we are going to waive entry for folks 
that have committed those type of crimes. So that needs to be 
addressed, and that is not where I am going to go today, but I 
would throw that out there for future hearings and 
conversation.
    I was contacted by a constituent from South Carolina, and I 
would just like to read some of his e-mail to me, because he is 
a contractor providing some of the hand-held scanners, I think, 
that the admiral talked about. But he said just yesterday, he 
spent nearly half-an-hour on the phone with the vice president 
of SSA, one of the Nation's largest container terminal 
operators. During that conversation, he told me that TWIC was 
dead and suggested I look for another market. We have had a 
team of consultants that work for us in the Texas market, and 
they are hearing much the same thing from many of their 
contacts. This was on June 5.
    He said that the notice of proposed rulemaking is under the 
comment period, which will close the 20th of this month. The 
NPRM was very disappointing, as it only requires Class A 
facilities to electronically validated TWIC cards and 
biometrically identify the holder. All Class B and Class C 
facilities will be allowed to continue to use the TWIC as a 
flash pass.
    Even though this was never the intent, I have spent the 
last several months on ports and private terminal operators' 
location and can tell you that the word flash really is the 
appropriate term. The drivers never take their TWIC out of its 
plastic protective case, which is typically on a lanyard around 
their neck, and hold it up for a security guard to see.
    For the most part, the name is not even readable from the 
distance they are viewing it from, certainly not the expiration 
date. My understanding of the current role and the new NPRM is 
that it is the responsibility of the security staff to 
accomplish three things when allowing a visitor on the port 
facility. One is to get the authenticity of the TWIC. The 
second is to verify the expiration date. The third is to 
positively identify the holder by comparing the picture on the 
TWIC with the face of the individual presenting the TWIC.
    This process should take approximately 15 to 20 seconds if 
it is done correctly. We all experience similar things at TSA, 
as we see airline personnel and TSA personnel and other clear 
people go through TSA screening. However, this is never done. 
In addition, we spend the time and money to publish a CCL so 
that we make sure we are not allowing an individual on the 
ports that has caused their name and number to be placed on the 
list. However, no Class B or Class C port or private terminal 
facility has the ability to check against a certain list. I 
think we heard some of that earlier.
    Even if such a list were made available to them, it would 
disrupt the entire operation and to take the necessary time to 
check the list. No one seems to be able to publish a document 
that clearly states that TWIC is not dead, but moving forward.
    It is concerning to me that I am hearing from someone and 
from my State that is involved. This is real life. This was an 
e-mail. I didn't make this up. So this is the real-life example 
of where we are failing America in this process of making sure 
that our port facilities are safe.
    I agree with the admiral. I think we can have the hand-held 
scanners that you are using. I think that is a very verifiable 
way to identify and make sure that that cardholder is holding a 
valid TWIC, that it is that person that is holding it, it is 
not fraudulent, and it doesn't take that long to validate that.
    Now, I know there are costs involved. But I would be 
willing to bet that over the past 11 years, the money that has 
been spent developing this program that is so far behind 
schedule that we could have probably paid for those type items.
    So the question I have for the witnesses is: Do you believe 
that the TWIC program is dead? Or should it be continued? When 
do you believe we will see some clarity on that issue? I will 
just start and go down the list. Admiral?
    Admiral Servidio. Thank you, sir, and thank you for the 
question. I strongly feel that TWIC is not dead. We, the Coast 
Guard, see great value in having a single credential with the 
background and the biometrically enabled. I think what is 
important is not just to look at the past, but to look at the 
future, and we do need something in the environment we are 
going to be going in that will allow real-time biometric 
enabling to verify a person is who they are when they are going 
in there.
    Mr. Duncan. I agree with you. Thank you.
    I will go down the list. Is TWIC dead? Should it continue? 
When do you think we will see some clarity?
    Mr. Sadler. TWIC is not dead. It should continue. I think 
we will see some clarity when the Coast Guard finishes getting 
its comments for the NPRM and adjudicates those comments and 
comes out with a good reader rule, because that is the key to 
this. The TWIC card is one element in the process. The reader 
is the key to using that card.
    Mr. Duncan. Do you agree with me that it is being used as a 
flash pass now, Class B and Class C terminals?
    Mr. Sadler. Currently, in many terminals, it is being used 
as a flash pass. That is why the reader rule is so important to 
get the readers out there.
    Mr. Duncan. Let's go down the list. Is it dead? Or should 
it continue? Some clarity?
    Mr. Lord. Obviously, it is not dead. It is--I think we need 
to rethink the approach, perhaps focus on more higher--use at 
higher-risk facilities, more selective use. That would help 
address some of the issues we have identified in our past work, 
but, again, that is up for Congress.
    Mr. Duncan. You are a class A terminal in Houston?
    Captain Woodring. Right now, we are not classified, because 
the NPRM is what groups you or classifies you right now. We 
currently use the card as a flash pass.
    Mr. Duncan. Flash pass?
    Captain Woodring. In the new rule, we would be a Group B, 
which means we would not have to have the biometrics unless the 
MARSEC level changed, in which case we would have to 
biometrically check.
    Mr. Duncan. Thank you, gentlemen. My time is up. I will 
yield back.
    Mrs. Miller. The Chairwoman now recognizes the gentleman 
from Texas, Mr. O'Rourke.
    Mr. O'Rourke. Thank you, Madam Chairwoman.
    I wanted to start with a statement that I believe I heard 
Mr. Lord make, which is that you were unable to determine how 
using TWIC has improved security. I just want to make sure I 
heard you correctly.
    Mr. Lord. Yes, the assumption is--and I know the Coast 
Guard and TSA strongly believe that is the case--but we--in 
terms of an analytical perspective or analysis, we have yet to 
see anything comparing TWIC before and after. That is what we 
essentially were asked--calling for in our so-called 
effectiveness study back in 2011.
    So the presumption is it would enhance security, but don't 
forget, a lot of these facilities already have access control 
systems in place. They are already using local credentials, as 
the gentleman to my left just explained, so we would like to--I 
guess we are slightly skeptical and just need to see the 
analysis, and that is why we made that recommendation in 2011.
    Mr. O'Rourke. You know, I think it is important for us to 
move forward with objective, verifiable data. If we have 
spent--as I understand it--more than $500 million so far on 
this program that we know, it is objective, hard data, if we 
are going to be asked to spend anywhere from $700 million to 
more than $3 billion going forward in the future, I think we 
need to know how and to what degree this improves security.
    So because the GAO and Mr. Lord were not able to determine 
that from the information that you provided, Admiral or Mr. 
Sadler, do you have anything that you could add now at this 
hearing that would give us some comfort in moving forward with 
this program?
    Admiral Servidio. Yes, sir. The Coast Guard does an 
assessment every year--at minimum annually--through what we 
call the MSRAM, which is the Maritime Security Risk Assessment 
Model, and we take a look at the whole--all of the components 
of port security. Access control is part of it, and TWIC is 
just part of that access control. So doing an assessment on 
just a subcomponent of one of the components is quite difficult 
at this time. We do agree that we should be doing assessments, 
we should have better measures. We feel that when there is a 
reader rule out there, we can look at the effectiveness of 
having those biometrics and other types of things. We are 
looking internally in how we are using the hand-held readers 
and what the effectiveness of using those hand-held readers are 
to biometrically verify people.
    Mr. O'Rourke. But without any data, without you being able 
to give me hard numbers, how could I support authorizing 
another dime for this program? If we do authorize another dime, 
how do we decide whether it is $3 billion or $10 billion or $1 
trillion if you are not going to give us any reliable cost-
benefit analysis to this?
    We don't have unlimited money to spend on security, and we 
have some troubling lack of evidence as to whether or not this 
is improved security at all so far, and yet we are being asked 
to spend more and perhaps expand this to other modes of 
transportation and other frontiers in National security.
    I also heard Mr. Lord say that in the data that you made 
available, throughput times were mixed up with reader response 
times. That is of particular concern to me in El Paso, Texas, a 
big trade corridor, more than $90 billion in U.S.-Mexico trade 
moving through there. If we slow down already long wait times 
even further, with a system that doesn't work or with a system 
whose effect on throughput we cannot ascertain, that to me is 
troubling, as well.
    Do you have a response to the statement he made about 
throughput times?
    Admiral Servidio. Okay, sir, if I could answer the first 
part with regards to the assessment, I guess there are two 
different answers. I can give you hard numbers on how we have 
reduced risks in our ports using the MSRAM data each and every 
year as a result of the actions we have taken in implementing 
the Maritime Transportation Security Act and the international 
ship and port facility security code.
    We do have numbers saying that we have reduced 
vulnerabilities and we have reduced risks in our ports. 
Anecdotally, I have been the captain of the port at three 
different locations, sir, and I can tell you that we have come 
a long way in accepting any credential and what the guards 
would look at to where we are today in TWIC. Are we where we 
need to be? No, sir, but I think we are moving in that right 
direction.
    Mr. O'Rourke. Was it worth $500 million? Is it worth an 
additional $3.2 billion, what you have seen so far? If you 
can't give us the numbers here, can you tell us in your best 
judgment whether that is good value for the taxpayer?
    Admiral Servidio. I can you tell, sir, that our NPRM has an 
annualized cost of $26 million for the implementation of TWIC 
readers at Group A facilities. That is a good investment in 
money, sir. As we end up maturing the technology, I believe 
that we will be able to justify why we should roll this out to 
Group B facilities and potentially to other facilities, sir.
    Mr. Sadler. Yes, sir, I would like to add a couple of 
things. On the transaction times, that was our responsibility 
in the reader pilot. We made a determination as we were going 
through the pilot to use transaction times from the card 
itself, because we were having difficulty collecting the 
information on throughput times through these access points. 
That is one of the challenges that we faced.
    So if you think about throughput, whether it is a 
pedestrian coming up to a gate and presenting the card, or 
whether it is a truck coming up to a gate and presenting a 
card, it got to the point that if a truck comes up to the gate, 
for instance, and the individual has the card on a lanyard and 
has to back up or move closer to the reader, is that part of 
the throughput time that is affected by the TWIC?
    For us, that throughput time would be standard, no matter 
who was going through that gate. For us, we were concerned with 
the transaction time of the card. When the person actually put 
the card up to the reader, put the fingerprint down or finger 
down to check the fingerprint, and collect that transaction 
time, because that was going to determine, you know, how we 
affected the actual throughput of an individual or a vehicle.
    On the card itself--and as far as security is concerned--we 
believe that the card does improve security. Having gone 
through ports and facilities for over 20 years myself, I know 
that you can get through gates or used to be able to get 
through gates with multiple credentials. I never had to go 
through a gate with one common credential. I never had to go 
through a gate with a biometric credential.
    I don't think there was a background check at that time. We 
have got a standard background check. We have got an 
adjudication process. There are a lot of things that we have 
done with this card that were never done before in this 
maritime environment.
    Then last thing, if I could just finish, sir, on the cost 
estimate, the numbers you are referring to, the $3.2 billion, 
that is our life-cycle cost estimate for the program through a 
10-year estimate. We did that, if I remember correctly, in 
2007-2008. I would have to check that number.
    So to date, we have spent $394 million on the program--this 
is in the GAO report--approximately $100 million on 
appropriations, and $294 million in fees, because it is a fee-
funded program.
    Mr. O'Rourke. Madam Chairwoman, I know my time is up. I 
just want to say that I appreciate your belief that this makes 
us more secure. The concept is a good one. But we need facts if 
we are to make informed decisions going forward. Thank you.
    Mrs. Miller. Thank you.
    The Chairwoman now recognizes the gentleman from Utah, Mr. 
Stewart.
    Mr. Stewart. Thank you, Madam Chairwoman.
    To the witnesses, thank you all. Thanks for your service. 
Thanks for your expertise and being with us today. I know that 
you have a difficult task. The challenges confronting us as a 
Nation and as a people that you have been involved with over 
the last 10 or 12 years are in some cases enormous, and we 
appreciate that.
    I think one thing that--an observation, if I could--and I 
would like to keep my comments and then my specific questions 
to you very big picture--being kind of new to this, I was a 
military officer for 14 years. I understand some of the 
security concerns. I also understand a little bit about how 
Government bureaucracies work.
    I think one of the things--an observation that many of us 
would agree with, and that is that Government sometimes creates 
bad legislation when that legislation is created in a time of 
perceived crisis. When there is a great urgency like we 
experienced after 
9/11 and there was this cry to do something, and we did 
something, and some of that has been very effective and very 
important, but some of it has been less so, because it was 
perhaps not as thoughtful as we would have done had we not been 
under this--again, this sense of urgency, this sense of crisis.
    There were many who warned at the creation of the 
Department that it would become a big bureaucracy, that it 
would become unyielding and unresponsive to some of the needs 
of the people. I think that that is a fair observation. I 
think--I don't know anyone who would disagree with that, that 
like any Government agency, that there are some issues with the 
Department of Homeland Security that could be made better. I 
think, frankly, this is a pretty good example of that. What the 
Department has done is good, and there are many great success 
stories, but, again, I think that there is criticism there that 
we can take and probably try to apply.
    Again, I think the TWIC program is--as you have indicated, 
I think all of you--and as has been indicated in the 
questions--it has been troubled from the very beginning. Since 
its initiation in 2002, DHS has failed to meet every time 
requirement, essentially. We are, what, 5 years behind what our 
goal was and where we wanted to be?
    So, Mr. Sadler, maybe I will ask you, but then, Admiral, I 
would like to come to you, as well. Help me understand the big 
picture. If you can, answer this question not in a couple 
paragraphs, but answer it in a sentence or two sentences, if 
you will. What is the greatest challenge we have had? What is 
the one thing that we can--you know, that you would say this is 
the problem or this is the most important problem, and then how 
do we fix that one problem?
    Mr. Sadler.
    Mr. Sadler. Well, thank you, sir. This is important to 
understand, so I can put some context around it. We started 
with nothing in the beginning of the program. So what I mean by 
that is, there was no common credential. There was no common 
background check. There was no adjudication process. There was 
no appeals process or waiver process or administrative law 
judge review. There was no waiver process. There were no 
disqualifiers. I will try and keep my answer short, but this is 
very important. When we started this program, the program as it 
exists today did not exist then.
    Mr. Stewart. So then are you alluding that that is the 
great challenge, because we started from zero?
    Mr. Sadler. I think that is one of the challenges. That is 
a challenge, because we had to design all these things to get 
to this point. Another challenge is that we are taking this 
security and we are applying it across the maritime 
environment. I know Captain Woodring or Admiral Servidio would 
say, if you have seen one port, you have seen one port. There 
are different throughputs. There are trucks. There are 
vehicles. There are pedestrians. There are service workers. 
There are tremendous challenges in this program.
    Mr. Stewart. Okay.
    Mr. Sadler. So I think that is the answer. I think we had 
to design something that didn't exist. Although there were 
other cards and credentials and programs out there, it didn't 
exist in the maritime environment, and just the maritime 
environment itself is very challenging.
    Mr. Stewart. Okay, and I appreciate that, and I know you 
are not trying to evade the question or the answer, but when 
you say it is difficult and we had to start from zero, it has 
still been a long time, and we have still spent a lot of money. 
I am not sure any of us are satisfied with the result of where 
we are now.
    I was hoping that you would be able to say--and maybe you 
can't--I was hoping you would be able to say, this is the 
challenge we have. This is the one thing that if we did this or 
these two things, if we did this, this would be better, this 
would be--we would be able to make progress now. We wouldn't 
get this sense that we are just kind of spinning our wheels. 
Admiral, do you have any comments on this? Can you help me 
understand, you know, the one or two things that we could fix 
that would help this process?
    Admiral Servidio. Yes, sir. I believe the two issues are, 
we have one single credential now, one background credential, 
the TWIC card, and getting the socialization of that concept, 
getting the implementation of that has been a challenge. But we 
have done that.
    I think the greatest concern going forward is customer 
service, and I think we need to decouple customer service 
issues to trips and other types of issues, being on the phone 
for 3 hours or 2 hours, from the value in having a single 
credential with a common background and making it easier for 
our ports to implement.
    I really think we have made progress on going to the single 
credential. I think we still have work to do on the customer 
service, and we are working actively with TSA and the 
Department on addressing those concerns.
    Mr. Stewart. All right. Thank you. I am out of time, Madam 
Chairwoman.
    Mrs. Miller. I thank the gentleman very much.
    The Chairwoman now recognizes the gentlelady from Hawaii, 
Ms. Gabbard.
    Ms. Gabbard. Thank you, Madam Chairwoman.
    Thank you, gentlemen, for your time, your service, and your 
work here. Like my colleagues, of course, we are concerned 
about--at the bottom line, how are we addressing potential 
threats and alleviating threats that we see today, as well as 
going forward along our borders and at our maritime ports?
    As you can imagine in Hawaii, this is something that is 
particularly of interest to us, as we receive close to 95 
percent of all of our goods coming through our ports. I have a 
few questions regarding the actual TWIC card. I know you have 
said that this is just one component of the overall maritime 
security plan, but looking at the level of threat that we see 
coming through our containers, coming through the cargo that is 
coming in, I am curious about how many either specifically or a 
ballpark figure, maritime figures you have found using this 
National terrorism database--have found to be on that list?
    Mr. Sadler. Well, ma'am, if I could speak to you outside of 
public forum, I would be happy to give you those numbers, but I 
am just not comfortable discussing it in this forum.
    Ms. Gabbard. Have you seen that this is a prevalent issue?
    Mr. Sadler. It is an issue, but, frankly, I would like to 
discuss it outside of the open forum.
    Ms. Gabbard. The reason I ask is because I have had 
conversations with many of our maritime workers that I have 
seen in our States. I have visited our various harbors and 
ports and have seen, more often than not, frustration at a 
basic level of dysfunction. Not only--you have talked about the 
readers and the other issues that have been there, but with 
folks who have been working at our ports for 12, 15, even 20 
years, erroneously being flagged as they go through the 
screening process and then are put out of work for 1 month, 6 
months, 8 months, which creates a tremendous hardship on their 
families and our workers, and to have to undergo this screening 
not only on an annual basis, you are saying that there is a 3-
year plan now that people can apply for, but also the hardship, 
as we see in Hawaii, of having to travel to the mainland for 
this screening.
    How do you reduce these erroneous disqualifications that 
are occurring?
    Mr. Sadler. Well, we are required to adjudicate the 
backgrounds against certain disqualifying criminal issues. 
There are approximately 27 crimes that we look at. Some of them 
we look back for an unlimited period of time. Some are 5 years 
from conviction or 7 years from a release from incarceration. 
That is a statutory requirement.
    So one of the things that we do is, we have a robust 
appeals, waivers, and review process, and as soon as an 
individual is flagged for having some type of issue, we 
immediately get a letter out to that person once we have 
identified that person or that issue, and then we try and get 
them into this review process, so we can clear up whatever that 
issue is.
    One of the challenges that we have with that type of 
background check is, the States need to upload their 
information into the database that we use from the FBI, all 
right? At this point, we are getting State records from 
approximately 40 States. They may be more complete than the 
Federal database. They may not be. They may be more extensive. 
If we got the records from all the States, that would help us a 
lot.
    It--I am sorry. What were your other questions, ma'am? Oh, 
on the travel. So, for instance, on the travel, we are doing a 
couple of things. We are increasing our enrollment sites from 
136 to over 300, so if you have a TWIC enrollment site or a 
hazardous material enrollment site, you will be able to apply 
for both of those background checks at the same place, and you 
can get a discount on the background check if you choose to get 
both of them.
    We are also extending the One-Visit pilot program to 
Nation-wide in 2014, which will only require one visit for all 
individuals. Then currently, we have the extended expiration 
date TWIC, the 3-year card, that only requires one visit. So we 
are taking positive steps to try and reduce that burden, 
whether it is through an adjudication process or whether it is 
through the actual visits to an enrollment center.
    Ms. Gabbard. Admiral, maybe you could answer this question. 
How does this background check that our maritime workers are 
undergoing compare to a background check that a brand-new 
enlistee in the uniformed services undergoes? I am not talking 
about a secret clearance. I am just talking about walking in 
the door.
    Admiral Servidio. I am not sure exactly what background 
check we do when someone comes in, so I am going to have to get 
back to you on the record. I can tell you that the background 
check we do for TWIC is different than what we require for a 
merchant mariner, because of just the interaction with the 
public and other types of things. So we do tailor some of those 
background checks to what we are looking for with that part of 
the industry.
    Ms. Gabbard. The reason I ask is because I am wondering if 
in some ways you are saying we are starting from ground zero, 
there has been nothing like this put in place before, but when 
you look at our U.S. military, for example, I know some of the 
branches have different and higher levels of requirement, but 
at a baseline level, you have a criminal background check much 
like the States already provide at the local level.
    Without a secret clearance, that is kind of it. There are 
different requirements there that they are undergone, but you 
have an ID card with the biometric system that is accessible at 
military bases around the world, that it is rugged, it is 
supposed to be durable, and it seems like this is a system that 
has already been in place and it has worked, and I am not sure 
why we are investing in something that has now already been 
done.
    Mr. Sadler. Well, our credential--the TWIC card is accepted 
at DOD facilities. It is--the basic card is the same card as 
the CAC card, the DOD card. It is a card that we get from the 
GSA schedule. So it is tested to the same standards, and we 
believe it probably has about the same failure rate, because it 
has similar use.
    I think the main difference outside of the card itself is 
the fact that this is a commercial environment, it is all about 
high volume and throughput and speed. So that is where our 
challenge comes in, but the card itself is the same card stock 
that any Federal agency would buy off the GSA schedule.
    Ms. Gabbard. Thank you very much. Thank you, Madam 
Chairwoman.
    Mrs. Miller. I thank the gentlelady.
    I certainly thank all the witnesses. You can see by the 
level of frustration, some of the questions that we are asking, 
I am sure you all share that. We will see what happens here 
with this TWIC card, but it is a very important issue. We 
appreciate all of your attendance here today.
    Ms. Jackson Lee. Madam Chairwoman----
    Mrs. Miller. I would--yes, the Ranking Member?
    Ms. Jackson Lee. Yes, before we end, might I ask to put in 
the record three things? One, the letter from the American 
Association of Port Authorities on this very issue, I ask 
unanimous consent.
    Mrs. Miller. Without objection.
    [The information follows:]
        Letter From the American Association of Port Authorities
                                     June 13, 2013.
U.S. Department of Transportation,
Docket Management Facility (M-30), West Building Ground Floor, Room 
        W12-140, 1200 New Jersey Avenue, S.E., Washington, DC 20590.
RE: Comments of the American Association of Port Authorities on the 
NPRM, Transportation Worker Identification Credential (TWIC) Reader 
Requirements Docket: USCG-2007-28915.

    Dear Sir/Madam: Seaports deliver prosperity by serving as critical 
links for access to the global marketplace. Safe and secure seaport 
facilities are fundamental to both protecting our borders and moving 
goods. The American Association of Port Authorities (AAPA), on behalf 
of its U.S. members, welcomes this opportunity to comment on the Coast 
Guard's (USCG) Notice of Proposed Rulemaking (NPRM) related to the 
Transportation Worker Identification Credential (TWIC) Reader 
Requirements. Our U.S. members handle containers, auto and ro/ro cargo, 
cruise passengers, as well as many bulk and breakbulk cargos, all of 
which would be impacted by this rule.
    While the comments below address specific issues raised in the 
NPRM, AAPA is concerned about the findings in the recent Government 
Accountability Office (GAO) May 8, 2013 report, Transportation Worker 
Identification Credential: Card Reader Pilot Results Are Unreliable; 
Security Benefits Need to Be Reassessed GAO-13-198. GAO recommended 
that Congress halt DHS's efforts to promulgate a final regulation until 
the successful completion of a security assessment of the effectiveness 
of using TWIC readers. While we understand that there may be some 
disagreements over these findings, we do ask the Department to consider 
delaying the implementation date of the rule, and we stand ready to 
assist in further analysis of TWIC reader operational problems 
identified in the report.
    Below are specific recommendations related to the NPRM.
    In the final rule, USCG should be more specific in defining what 
are considered TIER A, B, and C facilities and utilize a risk-based 
approach to reader requirements that more clearly addresses the 
particular circumstances of each port area and the facilities that fall 
within the category requiring readers.
    As noted in AAPA's May 13, 2009, comments on the TWIC rule, we 
support the Maritime Transportation Security Act (MTSA) regulatory 
system that is performance- and risk-based. Unlike earlier TWIC 
proposals, the NPRM proposes a risk-based approach. While this is an 
improvement from the previous proposal, we do not believe the system as 
proposed should be adopted. We are concerned that the three categories 
for TWIC reader use are based upon the passenger capacity of vessels, 
bulk of hazardous material, and the facilities that they use, rather 
than taking an approach that is more specific to the individual 
circumstances of each facility. (It is unclear, for example, how 
Strategic Ports will be classified based on the criteria listed.)
    AAPA recommends that USCG expand the risk-based concept and include 
a more performance-based and flexible system as reflected in other MTSA 
regulations. Every port is different and in making evaluations about 
risk, USCG should aggregate risks to the port area first, followed by a 
second layer of risk at the facility level using a Maritime Security 
Risk Analysis Model (MSRAM), including an evaluation of what other 
facilities are in close proximity. This would result in a flexible, but 
risk-based system. Therefore, a facility's risk and associated reader 
requirements should be based on a variety of risk factors, not just 
what type of vessels call on it or the type of cargo that it handles.
    At certain facilities, TWIC should be checked by electronic reader 
at the beginning of a shift but then afterward and for the duration of 
the shift employees should be able to walk into and out of the secure 
area only having to flash their card or show some other identification 
to the guard. At cruise terminals, for example, porters walk into and 
out of the secure area 25-30 times during their shifts. Having to stop 
and use the reader every time that movement into the secure area is 
made could well create an unnecessary burden, delay work, impact vessel 
schedule, and result in unnecessary expenses. While it is true that, 
according to the NPRM, the Captain of the Port (COTP) has the power to 
suspend the reader requirement if it is unduly holding up cargo or 
passenger processing, this particular exception to the rule should be 
codified before the fact and not reliant upon an after-the-fact 
assessment. Differing assessments by individual COTP's could 
inequitably impact inter-port competitiveness.
    According to the NPRM, the Captain of the Port is authorized to 
suspend the reader requirement in the event that a reader malfunctions 
or some other event transpires that makes the reader requirement unduly 
onerous. AAPA recommends that in the event of a minor occurrence, such 
as a reader malfunction, the port should immediately be able to 
continue to process workers using an alternative means that has 
previously been identified in the approved Facility Security Plan. 
Rather than being required to contact USCG for approval to resort to 
the previously-approved alternate plan, the port should be able to 
resort to the plan and then log the occurrence for review by USCG after 
the fact. USCG will be able to monitor how frequently or infrequently 
the alternate plan is used and address irregularities without holding 
up the process at the time.
    The NPRM requires that ports submit an updated Facility Security 
Plan describing what procedures will be used to comply with the new 
reader requirement, once it goes into effect. AAPA recommends that 
ports be permitted to submit TWIC updates within the 5-year plan 
resubmission, rather than be required to submit immediate amendments to 
already-existing security plans.
            Sincerely yours,
                                             Kurt J. Nagle,
                                                 President and CEO.

    Ms. Jackson Lee. A letter from the American--excuse me, 
statement from the American Trucking Association on this issue.
    Mrs. Miller. Without objection.
    [The information follows:]
           Statement of American Trucking Associations, Inc.
                             June 18, 2013
                              introduction
    The American Trucking Associations (ATA), founded in 1933, is the 
Nation's preeminent organization representing the interests of the U.S. 
trucking industry. Directly and through its affiliated organizations, 
ATA encompasses over 37,000 companies and every type and class of motor 
carrier operation.
    The trucking industry is an integral component of our Nation's 
economy, transporting more than 80% of our Nation's freight bill and 
employing approximately 7 million workers in trucking-related jobs, 
including over 3 million commercial drivers. It is important to note 
that the trucking industry is comprised primarily of small businesses, 
with 97% of trucking companies operating 20 trucks or less, and 90% 
operating six trucks or less.\1\ More importantly, about 80 percent of 
all U.S. communities depend solely on trucks to deliver and supply 
their essential commodities.
---------------------------------------------------------------------------
    \1\ American Trucking Associations, American Trucking Trends 2011 
(March 2011).
---------------------------------------------------------------------------
                               background
    As ATA has testified on several occasions at Congressional 
hearings, including before the House Homeland Security Committee, both 
the private sector and Government agencies continue to struggle to find 
the right balance between improving security while facilitating 
commerce throughout our Nation's transportation sector. The motor 
carrier industry believes that security and commerce are not mutually 
exclusive goals throughout the transportation system and the 
increasingly sophisticated supply chains that move global trade. To 
truly enhance security without disrupting the flow of commerce, 
security regulations and programs must be implemented in a cost-
effective and coordinated manner. A key goal of such an effort must be 
that individual programs should be designed in a way that they can be 
leveraged to comply with a multiplicity of regulations and security 
requirements. The trucking industry believes that the Transportation 
Worker Identification Credential (TWIC) can be such a program if 
implemented and utilized in an appropriate manner.
    ATA has long supported the original concept of the TWIC: One 
application/enrollment process, one fee, one security threat assessment 
(STA), and a single credential that transportation workers may utilize 
to demonstrate compliance with multiple security requirements. However, 
commercial drivers today continue to face multiple security 
credentialing requirements. For example, in addition to the TWIC, 
drivers must undergo separate STAs for the Hazardous Materials 
Endorsement (HME), the Free and Secure Trade (FAST) program for border 
crossings, to name a few. The cost to drivers and companies of these 
separate STAs and credentialing programs is almost $300 in fees alone, 
not including the costs associated with drivers' lost wages and fuel 
costs while traveling to and from multiple enrollment centers, and the 
aggravation of providing fingerprints multiple times for each program 
that performs the same background check.
    Over 10 years ago, Admiral James Loy, then the second-most senior 
official at the Transportation Security Administration) TSA, summed up 
the concept and the purpose of the TWIC, stating:

``A fourth initiative also underway is development of a Transportation 
Worker Identification Credential or TWIC . . . The idea is to have 
these [transportation] employees undergo only one standard criminal 
background investigation . . . I've heard that there are some truck 
drivers currently carrying up to 23 ID cards around their necks. I 
wouldn't want to pay that chiropractor bill. Under the TWIC program 
drivers and other transportation workers will only have one card to 
deal with which would be acceptable across the United States.\2\
---------------------------------------------------------------------------
    \2\ Remarks of Admiral James M. Loy, Under Secretary of 
Transportation for Security, Transportation Security Administration, 
during Transportation Research Board 82nd Annual Meeting Chairman's 
Luncheon, January 15, 2003.

    Unfortunately, the TWIC program/concept has not lived up fully to 
its promise and has become another expensive, duplicative security 
credential that truck drivers must obtain to access maritime 
facilities. TWIC works, but the goal of universal acceptance of a 
single security credential has yet to be implemented by TSA. It is not 
too late to enhance TWIC's capabilities and acceptance across multiple 
programs to improve its benefits and reduce the need for multiple 
screenings through the same databases. In essence, implement the long-
established Department of Homeland Security principle of ``enroll once, 
use many.''
                   twic challenges and opportunities
    The TWIC program has had to confront strong criticism since it was 
first proposed in an NPRM in 2006 implementing statutory requirements 
mandated under the Maritime Transportation Security Act of 2002. Some 
of the key criticisms that the TWIC has encountered include:
   The excessively high cost of the TWIC: $132.50 (reduced to 
        $129.50 in 2012);
   The extended time the application process requires of 
        applicants, taking time off work twice: Once to apply and 
        provide the biometrics, a second visit to pick up the 
        credential;
   The failure to expand TWIC's utilization to satisfy other 
        Federal STA regulatory requirements, including sister programs 
        within TSA;
   The lack of TWIC enrollment facilities Nation-wide to 
        facilitate the enrollment of transportation workers who live 
        far from either coast;
   The failure to implement TWIC with its essential counterpart 
        reader rule, annulling the credential's technology benefits and 
        serving only as an expensive ``flash-pass''.
    ATA generally agrees with these criticisms of the TWIC program and 
we have expressed such concerns in past testimony before Congressional 
Committees as well as in comments to TSA, The United States Coast Guard 
(USCG), and the Department of Homeland Security (DHS). However, our 
greatest concern at this point is the multiplicity of background 
checks, and their associated costs and burdens, which drivers undergo 
to perform their everyday work responsibilities, from transporting 
hazardous materials and delivering at maritime facilities, to crossing 
our international land borders and transporting air cargo.
    As a matter of policy, ATA has long supported a system and process 
that provides for a Criminal History Records Check through National 
databases. But today's state of affairs in which commercial drivers 
undergo multiple STAs is untenable, excessively burdensome, and 
patently inefficient. Because of this, ATA has taken the position to 
support the TWIC as the potential single credential and STA that can 
demonstrate and provide compliance with multiple programs and 
regulations that require a STA through a single enrollment, a single 
fee, a single background check and a single credential.
    Although TSA has not provided for full recognition of one STA for 
compliance with another regulatory STA, for example allowing TWIC 
holders seeking an HME to show their TWIC as proof of already having an 
equivalent STA--a policy supported statutorily by Section 1556 of the 
9/11 Commission Act--other Federal agencies are accepting the TWIC for 
compliance with their credentialing requirements. For example, the 
Department of Defense (DoD) has an established policy allowing 
commercial drivers transporting freight in and out of appropriate 
military facilities to use a TWIC in lieu of obtaining a DoD issued 
Common Access Card (CAC). DoD acceptance of the TWIC for such purposes 
is recognition of the strength of the TWIC STA process and its 
compliance with Federal Personal Identity Verification (PIV) standards 
used by millions of Federal employees.
    In its latest report regarding the TWIC card reader pilot 
results,\3\ the U.S. Government Accountability Office (GAO) criticized 
TSA's planning shortfalls for implementing the TWIC reader pilot in a 
manner that did not yield usable information due to data-collection 
challenges. ATA is aware that TSA faced some technology challenges in 
collecting TWIC-reader functionality data, including that the first 
generation of TWIC cards had faulty antennas embedded in the cards 
which rendered them useless when utilized with contactless readers. 
However, ATA is also aware of certain facilities that have been using 
the TWIC readers successfully to verify the credential's status, 
identity, and improving throughput for truck operations. Perhaps 
additional focus should be given to facilities that have successfully 
implemented the TWIC readers and utilize such ``lessons-learned'' that 
can be applied to other facilities facing reader challenges.
---------------------------------------------------------------------------
    \3\ U.S. Government Accountability Office; Transportation Worker 
Identification Credential: Card Reader Pilot Results Are Unreliable; 
Security Benefits Need to be Reassessed; May 2013.
---------------------------------------------------------------------------
    GAO's concerns and suggestions should be given careful 
consideration by DHS in improving the development and implementation of 
TWIC-readers at regulated facilities. ATA also agrees that Congress 
should continue to carefully assess the overall implementation of the 
TWIC program. However, ATA is concerned with GAO's suggestion that 
Congress consider ``alternative credentialing approaches, which might 
include a more decentralized approach for achieving TWIC program 
goals.'' A decentralized approach could result in an environment in 
which each State or location performs STAs and issues separate 
credentials for truck drivers to access maritime facilities throughout 
the country. Such a scenario would result in an increasingly 
burdensome, inefficient, and ineffective system for transportation 
workers who work and operate at multiple MTSA-regulated facilities. The 
TWIC is a robust, Nation-wide and uniform STA that can be utilized at 
multiple locations when matched with the appropriate readers. TSA and 
USCG need to focus their efforts in ensuring the deployment of TWIC 
readers nationwide rather than creating a vast assortment of individual 
systems.
    With the appropriate leadership within TSA and with clear guidance 
from Congress, the TWIC has the potential to serve as a valuable tool 
to ensure that personnel working throughout our country's critical 
transportation infrastructure have been screened appropriately and 
continue to be vetted frequently through relevant databases. Moreover, 
when the credential is utilized with the appropriate readers it can 
ensure the validity of the card, match the TWIC to the cardholder and 
allow for improved throughput when entering secure areas requiring such 
systems.
                               conclusion
    Notwithstanding that the TWIC continues to face several challenges 
to gain broad support from various sectors within Government--as 
demonstrated by the latest GAO TWIC report--as well as private-sector 
entities, the TWIC's future utility is robust if implemented as 
originally intended by leveraging its applicability throughout other 
security programs. But appropriate efforts and policies must be 
implemented by DHS, TSA, USCG, and other Federal entities to coordinate 
the utility of such a PIV for compliance with multiple STA 
requirements. The 2.4 million transportation workers in possession of a 
TWIC, including over 400,000 commercial drivers, are already heavily 
invested in the program. It would be a disservice to these workers to 
consider doing away with the TWIC when they have spent resources and 
time to obtain the credential.
    ATA urges the Homeland Security Committee and its various relevant 
subcommittees to:
   Continue supporting the TWIC as a viable STA program used by 
        millions of personnel to access secure areas of maritime 
        facilities as well as various Federal facilities;
   Authorize and mandate the use of the TWIC for compliance 
        with equivalent STA programs;
   Analyze and require TSA to significantly reduce the high 
        cost of the TWIC and ensure ample geographic coverage of 
        enrollment centers;
   Not overlook the fact that the TWIC, as a stand-alone 
        credential, provides a solid STA component and a perpetual 
        vetting process that offers a high degree of security;
   Allow the USCG to move forward with the implementation of 
        the TWIC readers, after careful consideration of industry 
        comments and recommendations.
    The implementation of the TWIC readers is essential to leverage 
properly the technology embedded in the TWIC and to establish uniform, 
secure, and efficient access procedures at secure areas of MTSA-
regulated facilities. Even with the very high cost of the TWIC, at 
roughly $130.00, it is a more cost-efficient scenario rather than 
paying multiple fees and undergoing multiple enrollment and finger-
printing processes. The trucking industry asks that these costs be 
reasonable and part of an efficient, risk-based process. ATA supports 
an approach that is good for security--and good for commerce.
    ATA appreciates the opportunity to offer this written statement and 
we look forward to continue working with this subcommittee and the 
Homeland Security Committee to further improve the security of our 
transportation system, doing so in a coordinated and efficient manner.

    Ms. Jackson Lee. For the record, a question to the Coast 
Guard and TSA to provide us in writing whether you have the 
tools to assess and evaluate the effectiveness of using the 
TWIC with readers for enhancing port security. I think we need 
a--I need a focus one, two, three, four, in relation to the GAO 
report in 2011 and 2013.
    I thank the Chairwoman, and I think this has been a very 
helpful hearing from all of the witnesses and look forward to 
maybe providing some legislative fix. I yield back to the 
Chairwoman.
    Mrs. Miller. I thank the gentlelady. Any Members of the 
committee that might have some additional questions for the 
witnesses there, we will--pursuant to the committee rule, the 
hearing record will be open for 10 days for those.
    Ms. Gabbard. Excuse me, Madam Chairwoman. Just briefly 
request----
    Mrs. Miller. Gentlelady from Hawaii.
    Ms. Gabbard [continuing]. Unanimous consent to insert 
testimony we have here submitted for the record from the 
Longshore and Warehouse Union, representing port workers in 
Hawaii and the western region for the record.
    Mrs. Miller. Without objection.
    [The information follows:]
      Statement of the International Longshore and Warehouse Union
                             June 18, 2013
    The International Longshore and Warehouse Union (``ILWU'') 
represents port workers in California, Oregon, Washington, Alaska, and 
Hawaii, as well as warehouse, maritime, agriculture, and hotel and 
resort workers. The ILWU's membership includes the approximately 22,000 
longshore workers, marine clerks and foremen who load, unload, track, 
monitor and oversee the movement of cargo into and out of all of the 
major ports on the West Coast, Alaska, and Hawaii. We appreciate the 
opportunity to submit these comments on the TWIC Program.
    The ILWU and its members have been active participants in the 
development and roll-out of TWIC since its inception. The union's 
experience of the program and deep knowledge of the waterfront have 
shown that TWIC does not improve port security and unfairly burdens 
working people. The program is now at a crossroads. The program stands 
poised to expand through the mandatory installation of expensive TWIC 
readers at approximately 570 locations pursuant to proposed regulations 
currently under review by the Coast Guard.\1\ According to the GAO, the 
TWIC Program has cost more than $500 million and will cost between $690 
million and $3.2 billion more over the next 10 years, not counting the 
costs of installing and operating readers.\2\ In one of its multiple 
recent reports critical of the program, GAO concluded: ``11 years after 
initiation, the TWIC program continues to be beset with significant 
internal control weaknesses and technology issues, and . . . the 
security benefits of the program have yet to be demonstrated. The 
weaknesses we have identified suggest that the program as designed may 
not be able to fulfill the principal rationale for the program--
enhancing maritime security.''\3\ Before proceeding further, we urge 
this committee to re-think the wisdom of TWIC. We believe that careful 
consideration of the facts on the ground will reveal that TWIC does not 
make our Nation safer, hurts American workers, and is a poor use of 
limited Government dollars.
---------------------------------------------------------------------------
    \1\ Notice of Proposed Rulemaking on TWIC Readers, 78 Fed. Reg. 56 
(March 22, 2013) at 17782, et seq.
    \2\ ``Transportation Worker Identification Credential: Card Reader 
Pilot Results are Unreliable; Security Benefits Need to Be 
Reassessed'', GAO-13-198, Appendix III, p. 59-60 (May 2013).
    \3\ ``Transportation Worker Identification Credential: Card Reader 
Pilot Results are Unreliable; Security Benefits Need to Be 
Reassessed'', GAO-13-198, at p. 42 (May 2013); see also ``Security 
Benefits Need to Be Reassessed,'' GAO-13-198 (May 2013); 
``Transportation Worker Identification Credential: Internal Control 
Weaknesses Need to be Corrected to Help Achieve Security Objectives,'' 
GAO-11-657 (May 2011).
---------------------------------------------------------------------------
    First, the fundamental focus of the TWIC program is wrong. If 
preventing terrorism is the goal, then targeting American workers for 
screening, as opposed to targeting containers and cargo, is the wrong 
approach. On the modern container facilities through which most of our 
imports and exports travel, port workers like those whom we represent 
have no real access to the cargo or the documentation associated with 
the containers' contents. Thus, requiring that workers be screened does 
not help to prevent facilities from being used to transport items that 
could be used to commit an act of terrorism.
    Moreover, the majority of the facilities themselves (whether 
container terminals or bulk operations) are large, decentralized spaces 
with workers, cargo, and equipment typically spread out across many 
acres. These characteristics make the facilities poor targets for a 
terrorist hoping to have a significant impact on commerce or on the 
public. Thus, screening the facilities' workforces is not a meaningful 
way to prevent a terrorist attack.
    Second, the TWIC program unfairly targets working people and has 
caused substantial hardships for workers and their families with no 
added security benefit. In 2006, when TWIC was still in the planning 
stages, ILWU longshore workers and marine clerks went through a Coast 
Guard-mandated threat assessment screening to ensure that they did not 
pose a National security risk.\4\ The ILWU cooperated with the Coast 
Guard and TSA to complete this process. The ILWU is not aware of any 
members being found to pose a risk.
---------------------------------------------------------------------------
    \4\ 71 Fed. Reg. 82 (April 28, 2006) at 25067 (requiring the ILWU 
to provide the Coast Guard with identifying information, including 
Social Security Numbers and alien identification numbers for all 
longshoremen to permit TSA to ``analyze . . . whether or not an 
employee or longshoreman poses or is suspected of posing a security 
threat warranting denial of access to the port facility'' and stating 
that anyone meeting those criteria will be denied access).
---------------------------------------------------------------------------
    In 2008, when the Department of Homeland Security began to require 
TWICs to obtain unescorted access to longshore workplaces, the ILWU 
membership was screened again.\5\ ILWU members applied for TWICs, were 
fingerprinted, had their irises scanned, underwent criminal background 
checks, and paid $129.75 each out of their own pockets to obtain these 
technologically-advanced cards. Almost none of these expensive 
technologies were ever put to use.
---------------------------------------------------------------------------
    \5\ 72 Fed. Reg. 3492 (Jan. 25, 2007); 33 CFR  101.514, 
104.115(d).
---------------------------------------------------------------------------
    The Government databases relied upon in evaluating TWIC 
applications contain an abundance of incomplete and faulty 
information.\6\ Due to this fact and delays by TSA, some of our members 
languished for months, unable to work, and unable to support their 
families while they tried to obtain TWICs.\7\ The following are only a 
few examples:
---------------------------------------------------------------------------
    \6\ U.S. Attorney General, ``The Attorney General's Report on 
Criminal History Background Checks,'' at page 3 (June 2006) (concluding 
that FBI's database was ``missing final disposition information for 
approximately 50% of its records''); see also ``A Scorecard on the Post 
9/11 Port Worker Background Checks: Model Worker Protections Provide a 
Lifeline for People of Color, While Major TSA Delays Leave Thousands 
Jobless During the Recession,'' National Employment Law Project (July 
2009), available at http://www.nelp.org/page/SCLP/PortWor- 
kerBackgroundChecks.pdf?nocdn=1.
    \7\ The National Employment Law Project, which represented or 
assisted more than 450 workers seeking to obtain TWICs estimated that 
workers waited almost 4 months on average to obtain an initial decision 
from TSA on their TWIC applications and workers waited an average of 7 
months for their appeals or waiver requests to be reviewed. ``A 
Scorecard on the Post- 
9/11 Port Worker Background Checks: Model Worker Protections Provide a 
Lifeline for People of Color, While Major TSA Delays Leave Thousands 
Jobless During the Recession,'' National Employment Law Project (July 
2009), at p. at 5-6.
---------------------------------------------------------------------------
   William Ericson, a lonsghore worker from Seattle was 
        erroneously denied a TWIC based on incorrect or incomplete 
        information in the notoriously flawed FBI database. Despite 12 
        years of work history on the waterfront, Brother Ericson sat 
        unable to work for 6 months, exhausted his savings and came 
        close to having his home foreclosed upon before he was able to 
        finally convince TSA that the agency had made a mistake.
   Another member from Seattle, Steven Richards, was born 
        outside of the United States on a military base. Even though he 
        was a citizen and met all of the qualifications to obtain a 
        TWIC, TSA denied his application. He found himself stuck in the 
        bureaucratic snarl and unable to work for months while TSA 
        obtained the records that proved his citizenship and 
        eligibility.
   Another member in the San Francisco Bay Area was denied a 
        TWIC because he had previously been convicted of a marijuana-
        related offense even though the court had expunged his 
        conviction.\8\ He had been a hard-working longshore worker for 
        18 years and had no other convictions. He spent months waiting 
        for TSA to rule on his initial application and, then even 
        longer waiting for TSA to review his request for a waiver. In 
        the meantime, he was unable to work and his family struggled to 
        avoid losing their home.
---------------------------------------------------------------------------
    \8\ To protect the member's privacy, we do not include his name.
---------------------------------------------------------------------------
    These members and others like them posed no risk to the security of 
the United States.
    These members are not alone. The Department of Homeland Security 
reports that, as of May 21, 2013, it had issued initial TWIC 
disqualification letters to 120,224 people.\9\ TSA has two procedures 
whereby someone can challenge the denial of a TWIC--appeal and 
waiver.\10\ Appeal is available to an applicant who was wrongly denied 
a TWIC. In other words, the applicant met all of the statutory and 
regulatory criteria for obtaining a TWIC but TSA erroneously denied his 
or her application anyway.\11\ Waiver can be sought by an applicant who 
does not meet all of the statutory and regulatory criteria for 
obtaining a TWIC but who nonetheless ``does not pose a security 
threat.''\12\ As of May 21, 2013, DHS had received 54,271 appeals and 
had granted 52,299 (more than 96%). In addition, DHS had received 
14,593 waiver requests and granted 12,289 (more than 84%). While these 
numbers indicate the absolute necessity of having an appeal and waiver 
process available, they also indicate that TSA initially denied TWICs 
to more than 50,000 people erroneously and to more than 12,000 people 
who posed no security threat. Almost certainly, there are tens of 
thousands more workers who met the requirements to obtain a TWIC but 
did not or could not appeal their denial or seek a waiver. These people 
are being wrongly denied access to work for no good reason.
---------------------------------------------------------------------------
    \9\ http://www.tsa.gov/sites/default/files/publications/pdf/twic/
monthly_dashboard_cur- rent.pdf.
    \10\ 49 C.F.R.  1515.6-1515.7.
    \11\ Id.  1515.6(b).
    \12\ Id.  1515.7(b).
---------------------------------------------------------------------------
    Third, TWIC has shown itself to be of little to no value if the 
goal of the program is to limit facility and vessel access. As ILWU 
members like those discussed above struggled and were denied the 
ability to work for lack of a TWIC, the ILWU has watched as unknown 
truckers, rail crews, vessel crews, maintenance workers, and 
construction crews without TWICs routinely enter and work at marine 
terminal facilities. Sometimes these workers are ``escorted'' by people 
with TWICs. However, in many cases the ``escort'' is more theoretical 
than real and individuals without TWICs work on the facilities largely 
unmonitored. What is more, these workers have no lasting relationship 
with the facility owner or operator and therefore pose an arguably more 
serious security risk than ILWU members.
    In addition, while ILWU members' backgrounds have been scrutinized 
in the name of National security, the union has watched waterfront 
employers eliminate people and protocols that actually improve security 
and replace them with cost-cutting technologies that are no substitute. 
For example, many marine terminal operators used to require that seals 
on stuffed containers be visually checked to ensure that they had not 
been tampered with. They also previously required that empty containers 
be opened and checked. To cut costs and speed up the movement of cargo, 
many employers now use only a camera linked to a monitor at a remote 
location. But a camera cannot tug on the seals to make sure they are 
intact, or open empty containers.
    The ILWU has been advised by some facility owners and operators 
that, if TWIC readers become mandatory, the employers intend to use the 
readers to further cut costs by eliminating security guards. Facility 
security personnel know the regular workforce on the docks and, 
therefore, know who belongs and who does not. Again, technology is no 
substitute, particularly given the serious flaws with TWIC card 
technology and readers noted by the GAO.\13\
---------------------------------------------------------------------------
    \13\ GAO-13-198, ``Transportation Worker Identification Credential: 
Card Reader Pilot Results Are Unreliable; Security Benefits Need to Be 
Reassessed,'' (May 8, 2013) at 25 (``according to officials from two 
pilot sites, approximately 70 percent of the TWICs they encountered 
when testing TWICs against contactless readers had broken antennas or 
malfunctioned. Further, a separate 2011 report commissioned and led by 
USCG . . . identified one site where 49 percent of TWICs could not be 
read in contact-less (or proximity mode, and two other sites where 11 
percent and 13 percent of TWICs could not be read in contact-less mode. 
Because TWIC cards malfunctioned, they could not be detected by 
readers.'').
---------------------------------------------------------------------------
    For all of these reasons, TWIC is misguided. It does not improve 
port security and it unfairly targets working people. Public monies can 
and should be put to better use.
    The ILWU appreciates the opportunity to submit these comments and 
thanks the committee for its consideration.

    Ms. Gabbard. Thank you.
    Mrs. Miller. Again, thank you to the witnesses very much. 
The committee is now adjourned.
    [Whereupon, at 11:25 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

   Questions From Chairwoman Candice S. Miller for Joseph A. Servidio
    Question 1. A Coast Guard official started in an interview with a 
Fierce Homeland Security reporter ``there is not a real strong nexus 
between the results of the pilot program and what is in the reader 
regulation.'' However, the pilot was referenced several times in the 
NPRM. What data from the TSA pilot were used to inform the NPRM? Could 
this information have been provided through other means? How can the 
Coast Guard be certain the NRPM will not have negative impacts on 
business operations knowing that this system has not truly been tested? 
Had the TSA pilot been more complete or shown a strong feasibility in 
carrying out the biometric requirements of the TWIC program, would the 
rule have sought to regulate more than 5 percent of all MTSA-regulated 
vessels and facilities?
    Answer. The Coast Guard used the best available data to 
characterize economic impacts, which in some cases resulted in using 
sources other than the TWIC pilot. Specifically, the TWIC pilot was the 
main data source associated with the cost to install TWIC readers, as 
well as the number of readers required per access point, throughput 
times, and failure rates of readers. However, TWIC pilot data was 
supplemented with other available data sources to provide preliminary 
estimates of other costs and benefits. Other data sources included the 
Marine Information for Safety and Law Enforcement (MISLE) database for 
population figures, the Marine Security Risk Assessment Model (MSRAM) 
for risk hierarchy and consequence data, the General Services 
Administration (GSA) schedule for reader hardware and software costs, 
and other literature for basic background on TWIC reader deployment. 
Based on the judicious use of all data sources, the Coast Guard has 
confidence in the proposed regulation's limited impact on business 
operations as noted in the Regulatory Assessment.
    Decisions regarding application of TWIC reader requirements were 
not driven by any limitations of the TWIC pilot, but rather by 
comparing costs of the requirements versus benefits gained. In the case 
of vessels, given the inherent limits on manning for barges (and 
thereby the limited utility for using a reader to verify the identity 
of mariners accessing any secure spaces on a barge), barges were 
excluded from TWIC reader requirements, thus eliminating approximately 
51 percent of the MTSA population (includes vessels and facilities). 
Similarly, other vessels with lower risk (e.g., vessels not engaged in 
transport of hazardous cargoes) and/or with fewer than 14 TWIC-holding 
crewmembers were eliminated given relatively low utility for the cost. 
This eliminated another 32 percent of the MTSA population (for a total 
of about 83 percent of the MTSA population exempted in the current 
proposal). Similar logic was applied to facilities, with requirements 
imposed on those 20 percent of MTSA facilities that comprised 
approximately 80 percent of the risk exposure. By eliminating lower 
risk facilities, another 13 percent of the MTSA population was exempted 
from requirements for a total of about 95 percent of the MTSA 
population exempted from reader requirements.
    Question 2. Since 9/11, Congress has implemented legislation 
specifically addressing perceived vulnerabilities with containerized 
cargo entering the United States. However, no container facilities will 
fall within Risk Group A, and thus will not be impacted by the proposed 
reader regulations at this time. Does containerized cargo deserve to be 
in a higher-risk group, or are earlier concerns regarding the threat 
within containerized cargo overstated? If container facilities are a 
major vulnerability, why are they not widely impacted by the proposed 
card reader rule?
    Answer. In the development of the NPRM, the Coast Guard evaluated 
TWIC reader requirements alternatives to those proposed in the NPRM 
including an alternative that would have required the installation of 
TWIC readers at Risk Group A facilities and all container facilities.
    The Coast Guard considered this alternative because container 
facilities are perceived to pose a unique threat to the maritime sector 
due to the transfer risk associated with containers (i.e., there is a 
greater risk of a threat coming through a container facility and 
inflicting harm or damage elsewhere than with any other facility type). 
However, as discussed in the preamble of the NPRM, many of the high-
risk threat scenarios at container facilities would not be mitigated by 
TWIC readers. Although TWIC readers serve as an additional access 
control measure, they do not mitigate the threat associated with the 
contents of a container, and would not improve screening of cargoes for 
dangerous substances or devices.
    Additionally, the costs/impacts for TWIC readers at container 
facilities would not be justified by the amount of potential risk 
reduction at these facilities. This alternative would increase the 
burden on industry by increasing the affected population from 532 
facilities to 651 facilities. The discounted 10-year costs would go 
from $186.1 million to $624.9 million. The inclusion of container 
facilities would also potentially have adverse environmental impacts 
due to increased air emissions due to longer queuing times and 
congestion at facilities.
    Question 3. In recent years, many port facilities have designated 
Port Security Grant funds specifically to procure TWIC readers and 
other equipment associated with TWIC implementation. How many 
facilities not in Group A, have received funding for TWIC card readers 
and infrastructure? Is it your expectation that Group B and C 
facilities, which are not required to purchase card readers, will still 
go ahead with the investment? Did the Coast Guard take into 
consideration, while drafting the NPRM, whether or not risk Group B or 
C facilities have already obtained Port Security Grant funding to 
purchase card readers?
    Answer. In the development of the TWIC Reader NPRM, the Coast Guard 
specifically focused on risk, security, and economic impacts rather 
than taking into consideration whether or not facilities had 
voluntarily purchased electronic TWIC Readers (with or without PSG 
funding). The Coast Guard expects that each facility in Groups B and C 
will make a determination on whether to implement readers based on what 
best meets its specific business and security needs and assessments. 
Absent of regulatory requirement, there is no expectation for B and C 
facilities to implement readers.
    The PSG Program allocates funds towards maritime security risk 
mitigation projects based on risk. Eligible PSG applicants may request 
several different projects within an application of which a TWIC 
project may be one of the projects or part of a project.
    PSG Program financial data is maintained via methodology 
established by Congress for Federal grant funding. From fiscal year 
2007 through fiscal year 2012, a total of 401 TWIC implementation 
projects were approved by DHS, and a total of $144.7 million was 
awarded for TWIC projects. Funding awarded for TWIC projects 
represented 7.5% of the total PSG Program funding ($1.92 billion) 
awarded during the period.
    Question 4. The crewmembers operating the Saugatuck Chain Ferry, 
out of Saugatuck, Michigan are required to carry a TWIC card. Given the 
low threat nature of this vessel as it operates on a fixed chain system 
propelled by a hand crank does it make sense for crewmembers of this 
vessel to be required to carry a TWIC card? Has there been any 
consideration to waive the requirement for crewmembers to obtain a TWIC 
card for vessels like this?
    Answer. The Saugatuck Chain Ferry (also known as the M/V DIANE) is 
a Coast Guard inspected 46 CFR Subchapter `T' small passenger vessel 
that operates on the Kalamazoo River (a navigable waterway). In 
accordance with Coast Guard Policy Letter 11-15, since the Saugatuck 
Chain Ferry does not meet the applicability requirements of maritime 
security for vessels (33 CFR 104.105) and therefore is not required to 
maintain a Vessel Security Plan (VSP), a credentialed mariner operating 
the vessel is not required to retain a Transportation Worker 
Identification Credential (TWIC).
    However, individuals applying for their initial Merchant Mariner 
Credential (MMC) are required to apply for a TWIC in order to undergo a 
Security Threat Assessment (STA). Such persons would only need to pass 
the STA in order to obtain their MMC. There is no requirement for that 
individual to actually hold a valid TWIC unless they are working on a 
vessel required to hold a VSP. Additionally, the Coast Guard will not 
require a mariner who holds or has held a TWIC to renew it in order to 
renew their current credential.
    Because of the Saugatuck Chain Ferry's route and service, the 
operator of the vessel is required to possess a Coast Guard issued MMC. 
The Coast Guard does not have the authority to waive this statutory 
requirement. Therefore, any person applying for their initial MMC who 
would like to then use that MMC to operate the Saugatuck Chain Ferry 
would have to apply for a TWIC in order to undergo a STA, but would not 
be required to carry the TWIC.
    Questions From Chairwoman Candice S. Miller for Stephen M. Lord
    [Note.--The responses are based on work associated with our 
previously issued products.]\1\
---------------------------------------------------------------------------
    \1\ See GAO, Transportation Worker Identification Credential: Card 
Reader Pilot Results Are Unreliable; Security Benefits Need to Be 
Reassessed, GAO-13-198 (Washington, DC: May 8, 2013); Transportation 
Security: Actions Needed to Address Limitations in TSA's Transportation 
Worker Security Threat Assessments and Growing Workload, GAO-12-60 
(Washington, DC: Dec. 8, 2011); Transportation Worker Identification 
Credential: Internal Control Weaknesses Need to Be Corrected to Help 
Achieve Security Objectives, GAO-11-657 (Washington, DC: May 10, 2011); 
Transportation Worker Identification Credential: Internal Control 
Weaknesses Need to Be Corrected to Help Achieve Security Objectives, 
GAO-11-648T (Washington, DC: May 10, 2011); and Transportation Worker 
Identification Credential: Progress Made in Enrolling Workers and 
Activating Credentials but Evaluation Plan Needed to Help Inform the 
Implementation of Card Readers, GAO-10-43 (Washington, DC: Nov. 18, 
2009).
---------------------------------------------------------------------------
    Question 1. Although TWIC was originally intended to be the common 
credential for workers in all modes of transportation, it has been 
limited to strictly a maritime security access control credential. The 
Coast Guard has further limited its scope by developing a Notice of 
Proposed Rulemaking (NPRM) which applies to less than 5 percent of all 
MTSA-regulated vessels and facilities. Given that the reader 
requirement is not being applied to Group B and C facilities should 
TWIC be further reduced by limiting issuance and use to only the 
highest-risk maritime facilities?
    Answer. Given the current uncertainties surrounding the 
implementation of the TWIC program in the maritime environment, and the 
program weaknesses highlighted in our 2011 and 2013 reports, limiting 
the use of TWIC to maritime facilities where the Coast Guard can 
clearly demonstrate that use of TWIC will effectively mitigate the 
three terrorist scenarios illustrated in the March 2013 NPRM (i.e., a 
truck bomb, a person/passenger carrying an improvised explosive device 
(IED), or a terrorist assault team) would be consistent with our 
findings and recommendations.\2\ As highlighted in our May 2013 report, 
the TWIC pilot conducted to test the use of TWICs with biometric card 
readers and other supporting analyses did not provide DHS with complete 
and accurate information on the impact of TWIC on facility and vessel 
operations or the added security benefits that the TWIC may provide.\3\ 
For example, we found that the pilot test's results were unreliable, 
and that DHS has not assessed the effectiveness of TWIC at enhancing 
security or reducing risk at Maritime Transportation Security Act 
(MTSA)-regulated facilities and vessels. While the current NPRM is 
aimed at implementing the use of TWIC with readers at Group A/highest-
risk-vessels and facilities, the NPRM suggests allowing for the 
expanded use of TWIC with readers at lower-risk facilities in the 
future.
---------------------------------------------------------------------------
    \2\ GAO-11-657 and GAO-13-198.
    \3\ GAO-13-198.
---------------------------------------------------------------------------
    Question 2. DHS argues that the decentralized security credential 
similar to the airport's Secure Identification Display Area (SIDA) 
badge is not comparable to TWIC because airport workers generally work 
at only one airport and disagrees with the GAO assessment that 
``maintaining site-specific credentials enhances security.'' Why do you 
believe decentralized security ``enhances security?'' What examples of 
such a decentralized approach would you recommend DHS evaluate for use 
at port facilities?
    Answer. Based on findings from our prior work, a decentralized 
credentialing approach could help remediate internal control weaknesses 
identified in our May 2011 report, and may therefore enhance 
security.\4\ Among others, we reported that TWIC program controls are 
not in place to determine whether an applicant has a need for a TWIC, 
and that our investigators were successful in obtaining authentic TWIC 
cards despite going through the background-checking process. As 
implemented, a uniform TWIC credential is issued by TSA after it 
conducts a security threat assessment. Operator participation is not 
required as part of this centralized TWIC enrollment, security review, 
or issuance process. According to our review of the evidence, operator 
participation, as would be required under a decentralized credentialing 
approach using facility- or port-specific credentials, could help 
validate an individual's identity and need for a credential to access a 
specific facility or vessel prior to issuing the credential. Maritime 
vessel and facility operators have a paramount interest in securing 
their assets. Involving operators in the credentialing process gives 
them more control and insight into the risks posed by people seeking 
access to secure areas, and could better ensure operators and the 
Federal Government of the individual's identity, need for a credential, 
and need for access to specific vessels and facilities.
---------------------------------------------------------------------------
    \4\ See, for example, GAO-13-198; GAO-12-60; and GAO-11-657.
---------------------------------------------------------------------------
    As we reported in May 2011, the TWIC program's internal controls 
for positively identifying an applicant, arriving at a security threat 
determination for that individual, and approving the issuance of a 
TWIC, are not designed to provide reasonable assurance that only 
qualified applicants can acquire TWICs. If an individual presents an 
authentic TWIC acquired through fraudulent means when requesting access 
to the secure areas of a MTSA-regulated facility or vessel, the 
cardholder is deemed not to be a security threat to the maritime 
environment because the cardholder is presumed to have met TWIC-related 
qualifications during a background check. In such cases, these 
individuals could inappropriately gain unescorted access to secure 
areas of a MTSA-regulated facility or vessel, as our investigators did 
for our May 2011 report and again for our May 2013 report.
    Through our work on the TWIC program, we have not identified any 
industry-wide common credential--beyond TWIC--that is used as a 
security tool for controlling access to individual, and often 
privately-owned, entities. Moreover, the Federal Government, which 
provides access to its many departments and agencies, does not use a 
single identification credential for controlling access to its 
facilities and vessels. Under the Federal model, agencies apply a 
standard for conducting background checks and creating the credentials. 
For example, as we reported in May 2011, TWIC is unlike other 
Federally-sponsored access control credentials, such as the Department 
of Defense's Common Access Card--the agency-wide standard 
identification card--for which sponsorship by an employer is required. 
For these Federal credentialing programs, employer sponsorship begins 
with the premise that an individual is known to need certain access as 
part of his or her employment. Further, the employing agency is to 
conduct a background investigation on the individual and has access to 
other personal information, such as prior employers, places of 
residency, and education, which it may confirm as part of the 
employment process and use to establish the individual's identity. 
According to our analysis, use of a decentralized credentialing 
approach could enhance the TWIC program's identity verification, 
vetting, and issuance controls by leveraging the employer and 
operator's knowledge of the individual's background and need for an 
access credential prior to conducting the Federal security threat 
assessment required as part of the TWIC program. In addition, localized 
control over credential issuance could enhance security by making it 
easier for individuals to replace lost or nonfunctioning credentials on 
site, and forgo potential travel times and waiting periods currently 
experienced under the TWIC program.
    Similarly, the decentralized aviation model may enhance security to 
a greater extent than the TWIC because this model includes employer 
sponsorship, background vetting at the local level, a Federal security 
threat assessment, and card revocation at the local level. For example, 
based on our prior work, in order to receive a SIDA, a person seeking a 
credential is sponsored by a previously vetted and authorized 
individual within the airport. This process provides greater assurance 
that the person seeking the credential has a real need for the 
credential and that the person is the person he or she claims to be on 
the application. Further, since the credential is valid only within a 
given airport, the person holding the credential cannot use that 
credential to access other airports where he or she has no legitimate 
need to gain access. As demonstrated by our covert tests, having a TWIC 
provided the appearance of legitimacy for our testers and allowed them 
to access multiple facilities with a single card. Moreover, the SIDA 
vetting process allows local airport authorities to see the criminal 
background check information pulled by DHS from the Federal Bureau of 
Investigation (FBI). Airport authorities use this information to make 
the determination about whether to grant or deny a credential. This 
allows the totality of an individual's criminal background to be 
considered, not just disqualifying offenses. We found that the 
Transportation Security Administration (TSA) has the authority and 
discretion to do this for the TWIC program but has seldom done so as 
part of the adjudication process.\5\ Consequently, under the SIDA 
model, airport authorities have greater control and ability to watch 
over the vetting process. Similarly, when local credentials are granted 
by local authorities, they can be customized for the unique needs of 
the facilities and can be revoked by the facilities, thus providing the 
facilities with greater control. As we found during our December 2011 
work on local credentialing programs, when Florida repealed provisions 
of law requiring workers accessing the State's 12 active deepwater 
public ports to undergo a State criminal history records check, 
individuals with criminal backgrounds who were kept out of the ports 
were allowed to return to work because they possessed a TWIC.\6\
---------------------------------------------------------------------------
    \5\ GAO-11-657.
    \6\ GAO-12-60.
---------------------------------------------------------------------------
    Regarding TSA's assertion that the lack of a common credential 
across the industry could leave facilities open to a security breach 
with falsified credentials, DHS has not provided or discussed with us 
any studies or evidence showing that use of a centralized common access 
credential enhances security beyond use of port- or facility-specific 
credentials supplemented by a Federal security threat assessment. As we 
reported in May 2011, unlike prior access control approaches that 
allowed access to a specific facility, the TWIC potentially facilitates 
access to thousands of facilities once the Federal Government attests 
that the TWIC holder has been positively identified and is deemed not 
to be a security threat. Further, DHS argues that the aviation 
industry's SIDA badge is not comparable to TWIC because airport workers 
generally work at only one airport. However, during the course of our 
work, DHS did not provide us with analysis on the number of TWIC 
holders that are ``transient'' or for whom a local port-specific 
credential(s) could necessitate the need for multiple credentials. 
Further, DHS did not provide us with analysis demonstrating that the 
majority of people seeking access to maritime facilities require more 
access control credentials than individuals working in the airport 
environment, or showing the extent to which requiring multiple access 
control credentials negatively affects security. Use of a single 
credential to access thousands of maritime facilities Nation-wide may 
prove to be more convenient for certain individuals or segments of the 
transportation industry. However, the TWIC program's primary intention 
is to enhance security. Given the lack of validated analysis available 
to support DHS's position on the security merits of using a common 
credential such as TWIC instead of a local port- or facility-specific 
credential supplemented by a Federal security threat assessment, we 
continue to believe that our May 2011 recommendation to DHS that it 
conduct an effectiveness assessment of the TWIC program, has merit and 
should be implemented. We also continue to believe that our May 2013 
suggestion to Congress that it consider requiring that DHS complete 
such an assessment, including a comprehensive comparison of alternative 
credentialing approaches, which might include a more decentralized 
approach for achieving TWIC program goals, before implementing a final 
regulation requiring the use of TWIC cards with biometric readers, has 
merit and should be implemented.
    Question 3. Considering the numerous delays and tribulations with 
the TWIC program over the past 11 years would the Department be able to 
produce a better product if only one component was responsible for the 
entire program?
    Answer. It is unclear that making one component responsible for the 
entire TWIC program would enhance the program at this time. The Coast 
Guard has primary responsibility for ensuring the safety and security 
of maritime ports and has individuals stationed at the ports, among 
other things. However, TSA manages the resources for conducting 
required security threat assessments for TWIC and other transportation-
related credentials. Therefore, moving the security threat assessment 
function to the Coast Guard may create duplication, though we have not 
conducted work in this area.

                                 

```