Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives
Published: 2011-05-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Within the Department of Homeland Security (DHS), the Transportation Security Administration (TSA) and the U.S. Coast Guard manage the Transportation Worker Identification Credential (TWIC) program, which requires maritime workers to complete background checks and obtain a biometric identification card to gain unescorted access to secure areas of regulated maritime facilities. As requested, GAO evaluated the extent to which (1) TWIC processes for enrollment, background checking, and use are designed to provide reasonable assurance that unescorted access to these facilities is limited to qualified individuals; and (2) the effectiveness of TWIC has been assessed. GAO reviewed program documentation, such as the concept of operations, and conducted site visits to four TWIC centers, conducted covert tests at several selected U.S. ports chosen for their size in terms of cargo volume, and interviewed agency officials. The results of these visits and tests are not generalizable but provide insights and perspective about the TWIC program. This is a public version of a sensitive report. Information DHS deemed sensitive has been redacted.
section_title: What GAO Found
paragraphs: Internal control weaknesses governing the enrollment, background checking, and use of TWIC potentially limit the program's ability to provide reasonable assurance that access to secure areas of Maritime Transportation Security Act (MTSA)-regulated facilities is restricted to qualified individuals. To meet the stated program purpose, TSA designed TWIC program processes to facilitate the issuance of TWICs to maritime workers. However, TSA did not assess the internal controls designed and in place to determine whether they provided reasonable assurance that the program could meet defined mission needs for limiting access to only qualified individuals. GAO found that internal controls in the enrollment and background checking processes are not designed to provide reasonable assurance that (1) only qualified individuals can acquire TWICs; (2) adjudicators follow a process with clear criteria for applying discretionary authority when applicants are found to have extensive criminal convictions; or (3) once issued a TWIC, TWIC-holders have maintained their eligibility. Further, internal control weaknesses in TWIC enrollment, background checking, and use could have contributed to the breach of MTSA-regulated facilities during covert tests conducted by GAO's investigators. During covert tests of TWIC use at several selected ports, GAO's investigators were successful in accessing ports using counterfeit TWICs, authentic TWICs acquired through fraudulent means, and false business cases (i.e., reasons for requesting access). Conducting a control assessment of the TWIC program's processes to address existing weaknesses could better position DHS to achieve its objectives in controlling unescorted access to the secure areas of MTSA-regulated facilities and vessels. DHS has not assessed the TWIC program's effectiveness at enhancing security or reducing risk for MTSA-regulated facilities and vessels. Further, DHS has not demonstrated that TWIC, as currently implemented and planned, is more effective than prior approaches used to limit access to ports and facilities, such as using facility specific identity credentials with business cases. Conducting an effectiveness assessment that further identifies and assesses TWIC program security risks and benefits could better position DHS and policymakers to determine the impact of TWIC on enhancing maritime security. Further, DHS did not conduct a risk-informed cost-benefit analysis that considered existing security risks, and it has not yet completed a regulatory analysis for the upcoming rule on using TWIC with card readers. Conducting a regulatory analysis using the information from the internal control and effectiveness assessments as the basis for evaluating the costs, benefits, security risks, and corrective actions needed to implement the TWIC program, could help DHS ensure that the TWIC program is more effective and cost-efficient than existing measures or alternatives at enhancing maritime security. Among other things, GAO recommends that DHS assess TWIC program internal controls to identify needed corrective actions, assess TWIC's effectiveness, and use the information to identify effective and cost-efficient methods for meeting program objectives. DHS concurred with all of the recommendations.

section_title: Letter
paragraphs: Securing transportation systems and facilities requires balancing security  to address potential threats while facilitating the flow of people and goods  that are critical to the United States economy and necessary for  supporting international commerce. As we have previously reported, these  systems and facilities are vulnerable and difficult to secure given their size,  easy accessibility, large number of potential targets, and proximity to  urban areas.
The Maritime Transportation Security Act of 2002 (MTSA) required the  Secretary of Homeland Security to prescribe regulations preventing  individuals from having unescorted access to secure areas of MTSA- regulated facilities and vessels unless they possess a biometric  transportation security card and are authorized to be in such an area.  MTSA further tasked the Secretary with the responsibility to issue  biometric transportation security cards to eligible individuals unless the  Secretary determines that an applicant poses a security risk warranting  denial of the card. The Transportation Worker Identification Credential  (TWIC) program is designed to implement these biometric maritime  security card requirements. The program requires maritime workers to  complete background checks to obtain a biometric identification card and  be authorized to be in the secure area by the owner/operator in order to  gain unescorted access to secure areas of MTSA-regulated facilities and  vessels. According to the Coast Guard, as of December 2010 and January  2011, there were 2,509 facilities and 12,908 vessels, respectively, which are  subject to MTSA regulations and must implement TWIC provisions.
Within the Department of Homeland Security (DHS), the Transportation  Security Administration (TSA) and the U.S. Coast Guard are responsible  for implementing and enforcing the TWIC program. TSA’s responsibilities  include enrolling TWIC applicants, conducting background checks to  assess the individual’s security threat, and issuing TWICs. The Coast  Guard is responsible for developing TWIC-related security regulations and  ensuring that MTSA-regulated maritime facilities and vessels are in  compliance with these regulations. In addition, DHS’s Screening  Coordination Office facilitates coordination among the various DHS  components involved in TWIC, such as TSA and the Coast Guard, as well  as the U.S. Citizenship and Immigration Services, which personalizes the  credentials, and the Federal Emergency Management Agency, which  administers grant funds in support of the TWIC program.
In January 2007, a federal regulation (known as the TWIC credential rule)  set a compliance deadline, subsequently extended to April 15, 2009,  whereby each maritime worker seeking unescorted access to secure areas  of MTSA-regulated facilities and vessels must possess a TWIC. In  September 2008, we reported that TSA, the Coast Guard, and maritime  industry stakeholders (e.g., operators of MTSA-regulated facilities and  vessels) had faced challenges in implementing the TWIC program,  including enrolling and issuing TWICs to a larger population than was  originally anticipated, ensuring that TWIC access control technologies  perform effectively in the harsh maritime environment, and balancing  security requirements with the flow of maritime commerce. In November  2009, we reported that progress had been made in enrolling workers and  activating TWICs, and recommended that TSA develop an evaluation plan  to guide pilot efforts and help inform the future implementation of TWIC  with electronic card readers. DHS generally concurred and discussed  actions to implement the recommendations, but these actions have not yet  fully addressed the intent of all of the recommendations. Currently, TWICs  are primarily used as visual identity cards—known as a flashpass—where  a card is to be visually inspected before a cardholder is allowed  unescorted access to a secure area of a MTSA-regulated port or facility.  As of January 6, 2011, TSA reported over 1.7 million enrollments and  1.6 million cards issued and activated.
In response to your request, we evaluated the extent to which TWIC  program controls provide reasonable assurance that unescorted access to  secure areas of MTSA-regulated facilities and vessels is limited to those  possessing a legitimately issued TWIC and who are authorized to be in  such an area. Specifically, this report addresses the following questions:  1.  To what extent are TWIC processes for enrollment, background  checking, and use designed to provide reasonable assurance that  unescorted access to secure areas of MTSA-regulated facilities and  vessels is limited to qualified individuals?  2.  To what extent has DHS assessed the effectiveness of TWIC, and does  the Coast Guard have effective systems in place to measure  compliance?
This report is a public version of a related sensitive report that we issued  to you in May 2011. DHS and TSA deemed some of the information in the  prior report as sensitive security information, which must be protected  from public disclosure. Therefore, this report omits sensitive information  about the TWIC program, including techniques used to enroll and conduct  a background check on individuals and assess an individual’s eligibility for  a TWIC, and the technologies that support TWIC security threat  assessment determinations and Coast Guard inspections. In addition, at  TSA’s request, we have redacted data on specific enrollment center(s) and  maritime ports where our investigators conducted covert testing. Although  the information provided in this report is more limited in scope, it  addresses the same questions and includes the same recommendations as  the sensitive report. Also, the overall methodology used for both reports is  the same.
To assess the extent to which TWIC program processes were designed to  provide reasonable assurance that unescorted access to secure areas of  MTSA-regulated facilities and vessels is limited to qualified individuals, we  reviewed applicable laws, regulations, and policies. We also reviewed  documentation provided by TSA on the TWIC program systems and  processes, such as the TWIC User Manual for Trusted Agents, Statement  of Objectives, and Concept of Operations. We further reviewed the  processes and data sources with TWIC program management from TSA  and Lockheed Martin (the contractor responsible for implementing the  program). We also met with (1) the Director of Vetting Operations at  TSA’s Colorado Springs Operations Center (CSOC), where background  checks for links to terrorism and continual vetting of TWIC holders is to  take place; (2) the Operations Manager for the Adjudication Center, where  secondary background checks are to be conducted for applicants with  identified criminal or immigration issues; and (3) the Director at DHS’s  Screening Coordination Office responsible for overseeing credentialing  programs across DHS. Additionally, we met with the Criminal Justice  Information Services Division at the Federal Bureau of Investigation (FBI)  to discuss criminal vetting processes and policies. We then evaluated the  processes against the TWIC program’s mission needs and Standards for  Internal Control in the Federal Government. As part of our assessment  of TWIC program controls, we also did the following.
We visited four TWIC enrollment and activation centers located in  areas with high population density and near ports participating in the  TWIC pilot to observe how TWIC enrollments are conducted. The  results are not generalizable to all enrollment and activation centers;  however, because all centers are to conduct the same operations  following the same guidance, the locations we visited provided us with  an overview of the TWIC enrollment and activation/issuance processes.
We had our investigators conduct covert testing at enrollment center(s)  operating at the time to identify whether individuals providing  fraudulent information could acquire an authentic TWIC. The  information we obtained from the covert testing at enrollment  center(s) is not generalizable across all TWIC enrollment centers.  However, because all enrollments are to be conducted following the  same established processes, we believe that the information from our  covert tests provided us with important perspective on TWIC program  enrollment and background checking processes, as well as potential  challenges in verifying an individual’s identity.
Further our investigators conducted covert testing at several selected  maritime ports with MTSA-regulated facilities and vessels to identify  security vulnerabilities and program control deficiencies. These locations  were selected based on their geographic location across the country (east  coast, gulf coast, and west coast) and port size in terms of cargo volume.  We also visited or met with officials at each of the seven original pilot sites  being used to test TWIC card readers, interviewed port security officials  at two additional ports responsible for implementing TWIC at their port,  and met with nine maritime or transportation industry associations to  obtain information on (1) the use of TWIC as a flashpass and with  biometric readers where they are in use, (2) experiences with TWIC card  performance, and (3) any suspected or reported cases of TWIC card fraud.  The information we obtained from the security officials at the 9 ports or  pilot participants we visited is not generalizable across the maritime  transportation industry as a whole, but collectively, the ports we visited  accounted for 56 percent of maritime container trade in the United States,  and the ports our investigators visited as part of our covert testing efforts  accounted for 54 percent of maritime container trade in the United States  in 2009. As such, we believe that the information from these interviews,  site visits, and covert tests provided us with important additional  perspective and context on the TWIC program, as well as information  about potential implementation challenges faced by MTSA-regulated  facilities/vessels, transportation workers, and mariners.
To assess the extent to which DHS has assessed the effectiveness of  TWIC, and determine whether the Coast Guard has effective systems in  place to measure compliance, we reviewed applicable laws, regulations,  and policies. We also met with TWIC program officials from TSA and the  Coast Guard, as well as Coast Guard officials responsible for assessing  maritime security risk, and reviewed related documents, to identify how  TWIC is to enhance maritime security. In addition, we met with Coast  Guard TWIC program officials, data management staff, and Coast Guard  officials stationed at four port areas across the United States with  enforcement responsibilities to assess the agency’s approach to enforcing  compliance with TWIC regulations and measuring program effectiveness.  As part of this effort, we reviewed the type and substance of management  information available to the Coast Guard for assessing compliance with  TWIC. In performing this work, we evaluated the Coast Guard’s practices  against TWIC program mission needs and Standards for Internal Control  in the Federal Government.
We conducted this performance audit from November 2009 through  March 2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with standards prescribed by the Council  of the Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
subsections: section_title: TWIC History and Purpose
paragraphs: In November 2001, the Aviation and Transportation Security Act (ATSA)  was enacted, requiring TSA to, among other things, work with airport  operators to strengthen access control points to secured areas and to  consider using biometric access control systems, or similar technologies,  to verify the identity of individuals who seek to enter a secure airport area.  In response to ATSA, TSA established the TWIC program in December  2001. In November 2002, MTSA was enacted and required the Secretary  of Homeland Security to issue a maritime worker identification card that  uses biometrics to control access to secure areas of maritime  transportation facilities and vessels. In addition, the Security and  Accountability For Every Port Act (SAFE Port Act) of 2006 amended  MTSA and directed the Secretary of Homeland Security to, among other  things, implement the TWIC pilot project to test TWIC use with biometric  card readers and inform a future regulation on the use of TWIC with  electronic readers.
In requiring the issuance of transportation security cards for entry into  secure areas of a facility or vessel as part of MTSA, Congress noted in the  “Findings” section of the legislation that ports in the United States are a  major location for federal crime such as cargo theft and smuggling, and  are susceptible to large-scale acts of terrorism. For example, according  to the Coast Guard’s January 2008 National Maritime Terrorism Threat  Assessment, al Qaeda leaders and supporters have identified western  maritime assets as legitimate targets. Moreover, according to the Coast  Guard assessment, al Qaeda-inspired operatives are most likely to use  vehicle bombs to strike U.S. cargo vessels, tankers, and fixed coastal  facilities such as ports. Studies have demonstrated that attacks on ports  could have serious consequences. For example, a study by the Center for  Risk and Economic Analysis of Terrorist Events on the impact of a dirty  bomb attack on the Ports of Los Angeles and Long Beach estimated that  the economic consequences from a shutdown of the harbors due to the  contamination could result in significant losses in the tens of billions of  dollars, including the decontamination costs and the indirect economic  impacts due to the port shutdown.
As defined by DHS, the purpose of the TWIC program is to design and field  a common credential for all transportation workers across the United  States who require unescorted access to secure areas at MTSA-regulated  maritime facilities and vessels. As such, the TWIC program, once  implemented, aims to meet the following stated mission needs:    Positively identify authorized individuals who require unescorted  access to secure areas of the nation’s transportation system.
Determine the eligibility of individuals to be authorized unescorted  access to secure areas of the transportation system by conducting a  security threat assessment.
Ensure that unauthorized individuals are not able to defeat or  otherwise compromise the access system in order to be granted  permissions that have been assigned to an authorized individual.  Identify individuals who fail to maintain their eligibility requirements  subsequent to being permitted unescorted access to secure areas of the  nation’s transportation system and immediately revoke the individual’s  permissions.
section_title: TWIC Program Processes for Ensuring TWIC-Holder Eligibility
paragraphs: TSA is responsible for enrolling TWIC applicants and conducting  background checks to ensure that only eligible individuals are granted  TWICs. In addition, pursuant to TWIC-related regulations, MTSA- regulated facility and vessel operators are responsible for reviewing each  individual’s TWIC as part of their decision to grant unescorted access to  secure areas of their facilities. The Coast Guard is responsible for  assessing and enforcing operator compliance with TWIC-related laws and  regulations. Described below are key components of each process for  ensuring TWIC-holder eligibility.
Enrollment: Transportation workers are enrolled by providing biographic  information, such as name, date of birth, and address, and proof of identity  documents, and then being photographed and fingerprinted at enrollment  centers by trusted agents. A trusted agent is a member of the TWIC team  who has been authorized by the federal government to enroll  transportation workers in the TWIC program and issue TWIC cards.  Appendix I summarizes key steps in the enrollment process.
Background checking: TSA conducts background checks on each  worker who applies for a TWIC to ensure that individuals who enroll do  not pose a security risk to the United States. A worker’s potential link to  terrorism, criminal history, immigration status, and mental capacity are  considered as part of the security threat assessment. Workers have the  opportunity to appeal negative results of the threat assessment or request  a waiver of certain specified criminal offenses, and immigration or mental  capacity standards. Specifically, the TWIC background checking process  includes two levels of review.
First-level review: Initial automated background checking.  The initial automated background checking process is conducted  to determine whether any derogatory information is associated  with the name and fingerprints submitted by an applicant during  the enrollment process. This check is conducted against the FBI’s  criminal history records. These records contain information from  federal and state and local sources in the FBI’s National Crime  Information Center (NCIC) database and the FBI’s Integrated  Automated Fingerprint Identification System (IAFIS)/Interstate  Identification Index (III), which maintain criminal records and  related fingerprint submissions. Rather than positively confirming  each individual’s identity using the submitted fingerprints, the  FBI’s criminal history records check is a negative identification  check, whereby the fingerprints are used to confirm that the  associated individual is not on the FBI criminal history list. If an  individual is identified as being on the FBI’s criminal history list,  relevant information is to be forwarded to TSA for adjudication.  The check is also conducted against federal terrorism information  from the Terrorist Screening Database, including the Selectee and  No-Fly Lists. To determine an applicant’s immigration/citizenship  status and eligibility, TSA also runs applicant information against  the Systematic Alien Verification for Entitlements (SAVE) system.  If the applicant is identified as a U.S.-born citizen with no related  derogatory information, the system can approve the issuance of a  TWIC with no further review of the applicant or human  intervention.
Second-level review: TSA’s Adjudication Center Review. A  second-level review is conducted as part of an individual’s  background check if (1) the applicant has self-identified  themselves to be a non-U.S. citizen or non-U.S.-born citizen or  national, or (2) the first-level review uncovers any derogatory  information. As such, not all TWIC applicants will be subjected to a  second-level review. The second-level review consists of staff at  TSA’s adjudication center reviewing the applicant’s enrollment  file.
Card use and compliance: Once a TWIC has been activated and issued,  the worker may present his or her TWIC to security officials when he or  she seeks unescorted access to a secure area. Currently, visual inspections  of TWICs are required for controlling access to secure areas of MTSA- regulated facilities and vessels. Approaches for inspecting TWICs using  biometric readers at individual facilities and vessels across the nation are  being considered as part of a pilot but are not yet required. Pursuant to  Coast Guard policy, Coast Guard inspectors are required to verify TWIC  cards during annual compliance exams, security spot checks, and in the  course of other Coast Guard duties as determined by the Captain of the  Port based on risk and resource availability. The Coast Guard’s primary  means of verification is shifting toward the use of biometric handheld  readers with the continued deployment of readers to each of its Sectors  and Marine Safety Units. As of December 21, 2010, the Coast Guard  reports to have deployed biometric handheld readers to all of its 35  Sectors and 16 Marine Safety Units.
section_title: TWIC Regulations and Cost
paragraphs: In August 2006, DHS officials decided, based on industry comment, to  implement TWIC through two separate regulations, or rules. The first rule,  issued in January 2007, directs the use of the TWIC as an identification  credential, or flashpass. The second rule, the card reader rule, is currently  under development and is expected to address how the access control  technologies, such as biometric card readers, are to be used for confirming  the identity of the TWIC holder against the biometric information on the  TWIC. On March 27, 2009, the Coast Guard issued an Advance Notice of  Proposed Rule Making for the card reader rule.
To inform the rulemaking process, TSA initiated a pilot in August 2008,  known as the TWIC reader pilot, to test TWIC-related access control  technologies. This pilot is intended to test the technology, business  processes, and operational impacts of deploying TWIC readers at secure  areas of the marine transportation system. As such, the pilot is expected to  test the feasibility and functionality of using TWICs with biometric card  readers within the maritime environment. After the pilot has concluded, a  report on the findings of the pilot is expected to inform the development  of the card reader rule. DHS currently estimates that a notice of proposed  rulemaking will be issued late in calendar year 2011 and that the final rule  will be promulgated no earlier than the end of calendar year 2012.
According to agency officials, from fiscal years 2002 through 2010, the  TWIC program had funding authority totaling $420 million. In issuing the  credential rule, DHS estimated that implementing the TWIC program could  cost the federal government and the private sector a combined total of  between $694.3 million and $3.2 billion over a 10-year period. However,  these figures did not include costs associated with implementing and  operating readers. Appendix II contains additional program funding  details.
section_title: Standards for Internal Control
paragraphs: Standards for Internal Control in the Federal Government underscores  the need for developing effective controls for meeting program objectives  and complying with applicable regulations. Effective internal controls  provide for an assessment of the risks the agency faces from both internal  and external sources. Once risks have been identified, they should be  analyzed for their possible effect. Management then has to decide upon the  internal control activities required to mitigate those risks and achieve the  objectives of efficient and effective operations. As part of this effort,  management should design and implement internal controls based on the  related cost and benefits.
In addition, internal control standards highlight the need for the following:    capturing information needed to meet program objectives;    designing controls to assure that ongoing monitoring occurs in the  course of normal operations;    determining that relevant, reliable, and timely information is available  for management decision-making purposes;    conducting reviews and testing of development and modification  activities before placing systems into operation;  recording and communicating information to management and others  within the entity who need it and in a form and within a time frame that  enables them to carry out their internal control and other  responsibilities; and    designing internal controls to provide reasonable assurance that  compliance with applicable laws and regulations is being achieved, and  provide appropriate supervisory review of activities to help provide  oversight of operations. This includes designing and implementing  appropriate supervisory review activities to help provide oversight and  analyzing data to compare trends in actual performance to expected  results to identify any areas that may require further inquiries or  corrective action.
Internal control also serves as the first line of defense in safeguarding  assets and preventing and detecting errors and fraud. An internal control  weakness is a condition within an internal control system worthy of  attention. A weakness, therefore, may represent a perceived, potential, or  real shortcoming, or an opportunity to strengthen internal controls to  provide a greater likelihood that the entity’s objectives will be achieved.
section_title: Internal Control Weaknesses in DHS’s Biometric Transportation ID Program Hinder Efforts to Ensure Security Objectives Are Fully Achieved
paragraphs: DHS has established a system of TWIC-related processes and controls.  However, internal control weaknesses governing the enrollment,  background checking, and use of TWIC potentially limit the program’s  ability to provide reasonable assurance that access to secure areas of  MTSA-regulated facilities is restricted to qualified individuals. Specifically,  internal controls in the enrollment and background checking processes  are not designed to provide reasonable assurance that (1) only qualified  individuals can acquire TWICs; (2) adjudicators follow a process with  clear criteria for applying discretionary authority when applicants are  found to have extensive criminal convictions; or (3) once issued a TWIC,  TWIC holders have maintained their eligibility. To meet the stated program  mission needs, TSA designed TWIC program processes to facilitate the  issuance of TWICs to maritime workers. However, TSA did not assess the  internal controls designed and in place to determine whether they  provided reasonable assurance that the program could meet defined  mission needs for limiting access to only qualified individuals. Further,  internal control weaknesses in TWIC enrollment, background checking,  and use could have contributed to the breach of selected MTSA-regulated  facilities during covert tests conducted by our investigators.
subsections: section_title: TWIC Program Controls Are Not Designed to Provide Reasonable Assurance That Only Qualified Applicants Can Acquire TWICs
paragraphs: DHS has established a system of TWIC-related processes and controls that  as of April 2011 has resulted in TWICs being denied to 1,158 applicants  based on a criminal offense, criminal immigration offense, or invalid  immigration status. However, the TWIC program’s internal controls for  positively identifying an applicant, arriving at a security threat  determination for that individual, and approving the issuance of a TWIC,  are not designed to provide reasonable assurance that only qualified  applicants can acquire TWICs. Assuring the identity and qualifications of  TWIC-holders are two of the primary benefits that the TWIC program is to  provide MTSA-regulated facility and vessel operators making access  control decisions. If an individual presents an authentic TWIC acquired  through fraudulent means when requesting access to the secure areas of a  MTSA-regulated facility or vessel, the cardholder is deemed not to be a  security threat to the maritime environment because the cardholder is  presumed to have met TWIC-related qualifications during a background  check. In such cases, these individuals could better position themselves to  inappropriately gain unescorted access to secure areas of a MTSA- regulated facility or vessel.
As confirmed by TWIC program officials, there are ways for an unqualified  individual to acquire an authentic TWIC. According to TWIC program  officials, to meet the stated program purpose, TSA’s focus in designing the  TWIC program was on facilitating the issuance of TWICs to maritime  workers. However, TSA did not assess internal controls prior to  implementing the program. Further, prior to fielding the program, TSA did  not conduct a risk assessment of the TWIC program to identify program  risks and the need for controls to mitigate existing risks and weaknesses,  as called for by internal control standards. Such an assessment could help  provide reasonable assurance that control weaknesses in one area of the  program do not undermine the reliability of other program areas or  impede the program from meeting mission needs. TWIC program officials  told us that control weaknesses were not addressed prior to initiating the  TWIC program because they had not previously identified them, or  because they would be too costly to address. However, officials did not  provide documentation to support their cost concerns and told us that  they did not complete an assessment that accounted for whether the  program could achieve defined mission needs without implementing  additional or compensating controls to mitigate existing risks, or the risks  associated with not correcting for existing internal control weaknesses.
Our investigators conducted covert tests at enrollment center(s) to help  test the rigor of the TWIC enrollment and background checking processes.  The investigators fully complied with the enrollment application process.  They were photographed and fingerprinted, and asserted themselves to be  U.S.-born citizens. The investigators were successful in obtaining  authentic TWIC cards despite going through the background-checking  process. Not having internal controls designed to provide reasonable  assurance that the applicant has (1) been positively identified, and (2) met  all TWIC eligibility requirements, including not posing a security threat to  MTSA-regulated facilities and vessels, could have contributed to the  investigators’ successes. Specifically, we identified internal control  weaknesses in the following three areas related to ensuring that only  qualified applicants are able to obtain a TWIC.
Controls to identify the use of potentially counterfeit identity  documents are not used to inform background checking processes.  As part of TWIC program enrollment, a trusted agent is to review identity  documents for authenticity and use an electronic authentication device to  assess the likelihood of the document being counterfeit. According to  TWIC program officials, the trusted agent’s review of TWIC applicant  identity documents and the assessment provided by the electronic  authentication device are the two steps intended to serve as the primary  controls for detecting whether an applicant is presenting counterfeit  identity documents. Additionally, the electronic device used to assess the  authenticity of identification credentials renders a score on the likelihood  of the document being authentic and produces an assessment report in  support of the score. Assessing whether the applicant’s credential is  authentic is one source of information for positively identifying an  applicant. Our investigators provided counterfeit or fraudulently acquired  documents, but they were not detected.
However, the TWIC program’s background checking processes are not  designed to routinely consider the results of controls in place for assessing  whether an applicant’s identity documents are authentic. For example,  assessments of document authenticity made by a trusted agent or the  electronic document authentication device as part of the enrollment  process are not considered as part of the first-level background check.  Moreover, TWIC program officials agree that this is a program weakness.  As of December 1, 2010, approximately 50 percent of TWICs were  approved after the first-level background check without undergoing  further review. As an initial step towards addressing this weakness, and  in response to our review, TWIC program officials told us that since April  17, 2010, the comments provided at enrollment by trusted agents have  been sent to the Screening Gateway—a TSA system for aggregating threat  assessment data. However, this change in procedure does not correct the  internal control weaknesses we identified. Attempts to authenticate  copies of documents are limited because it is not possible to capture all of  the security features when copies of the identity documents are recorded,  such as holograms or color-shifting ink. Using information on the  authenticity of identity documents captured during enrollment to inform  the background check could help TSA better assess the reliability and  authenticity of such documents provided at enrollment.
Controls related to the legal status of self-reported U.S.-born  citizens or nationals. The TWIC program does not require that  applicants claiming to be U.S.-born citizens or nationals provide identity  documents that demonstrate proof of citizenship, or lawful status in the  United States. See appendix III for the list of documents U.S.-born citizens  or nationals must select from and present when applying for a TWIC. For  example, an applicant could elect to provide one document, such a U.S.  passport, which, according to TSA officials, serves as proof of U.S.  citizenship or proof of nationality. However, an applicant could elect to  submit documents that do not provide proof of citizenship. As of  December 1, 2010, nearly 86 percent of approved TWIC enrollments were  by self-identified United States citizens or nationals asserting that they  were born in the United States or a United States territory.
Verifying a U.S.-born citizen’s identity and related lawful status can be  costly and is a challenge faced by U.S. government programs such as  passports. However, reaching an accurate determination of a TWIC  applicant’s potential security threat in meeting TWIC mission needs is  dependant on positively identifying the applicant. Given such potential  cost constraints, consistent with internal control standards, identifying  alternative mechanisms to positively identify individuals to the extent that  the benefits exceed the costs and TWIC program mission needs are met  could enhance TSA’s ability to positively identify individuals and reduce  the likelihood that criminals or terrorists could acquire a TWIC  fraudulently.
Controls are not in place to determine whether an applicant has a  need for a TWIC. Regulations governing the TWIC program security  threat assessments require applicants to disclose their job description and  location(s) where they will most likely require unescorted access, if  known, and the name, telephone number, and address of the applicant’s  current employer(s) if the applicant works for an employer that requires a  TWIC. However, TSA enrollment processes do not require that this  information be provided by applicants. For example, when applying for a  TWIC, applicants are to certify that they may need a TWIC as part of their  employment duties. However, the enrollment process does not request  information on the location where the applicant will most likely require  unescorted access, and enrollment processes include asking the applicant  if they would like to provide employment information, but informing the  applicant that employer information is not required.
While not a problem prior to implementing the TWIC program, according  to TSA officials, a primary reason for not requiring employer information  be captured by applicant processes is that many applicants do not have  employers, and that many employers will not accept employment  applications from workers who do not already have a TWIC. However,  TSA could not provide statistics on (1) how many individuals applying for  TWICs were unemployed at the time of their application; or (2) a reason  why the TWIC-related regulation does not prohibit employers from  denying employment to non-TWIC holders who did not previously have a  need for a TWIC. Further, according to TSA and Coast Guard officials,  industry was opposed to having employment information verified as part  of the application process, as industry representatives believed such  checks would be too invasive and time-consuming. TSA officials further  told us that confirming this information would be too costly.
We recognize that implementing mechanisms to capture this information  could be time-consuming and involve additional costs. However, collecting  information on present employers or operators of MTSA-regulated  facilities and vessels to be accessed by the applicant, to the extent that the  benefits exceed the costs and TWIC program mission needs are met, could  help ensure TWIC program mission needs are being met, and serve as a  barrier to individuals attempting to acquire an authentic TWIC through  fraudulent means. Therefore, if TSA determines that implementing such  mechanisms are, in fact, cost prohibitive, identifying and implementing  appropriate compensating controls could better position TSA to positively  identify the TWIC applicant. Not taking any action increases the risk that  individuals could gain unescorted access to secure areas of MTSA- regulated facilities and vessels.
As of September 2010, TSA’s background checking process had identified  no instances of nonimmigration-related document or identity fraud. This is  in part because of previously discussed weaknesses in TWIC program  controls for positively identifying applicants, and the systems and  procedures the TWIC program relies on not being designed to effectively  monitor for such occurrences, in accordance with internal control  standards. Though not an exhaustive list, through a review of Coast Guard  reports and publicly available court records, we identified five court cases  where the court documents indicate that illegal immigrants acquired, or in  one of the cases sought to acquire, an authentic TWIC through fraudulent  activity such as providing fraudulent identity information and, in at least  one of the cases and potentially up to four, used the TWIC to access  secure areas of MTSA-regulated facilities. Four of these cases were a  result of, or involved, United States Immigration and Customs  Enforcement efforts after individuals had acquired, or sought to acquire, a  TWIC. As of September 2010, the program’s background checking process  identified 18 instances of potential fraud out of the approximately  1,676,000 TWIC enrollments. These instances all involved some type of  fraud related to immigration. The 18 instances of potential fraud were  identified because the 18 individuals asserted themselves to be non-U.S.- born applicants and, unlike processes in place for individuals asserting to  be U.S.-born citizens, TSA’s background checking process includes  additional controls to validate such individuals’ identities. For example,  TSA requires that at least one of the documents provided by such  individuals at enrollment show proof of their legal status and seeks to  validate each non-U.S.-born applicant’s identity with the U.S. Citizenship  and Immigration Services.
Internal control standards highlight the need for capturing information  needed to meet program objectives; ensuring that relevant, reliable, and  timely information is available for management decision-making purposes;  and providing reasonable assurance that compliance with applicable laws  and regulations is being achieved. Conducting a control assessment of  the TWIC program’s processes to address existing weaknesses could  enhance the TWIC program’s ability to prevent and detect fraud and  positively identify TWIC applicants. Such an assessment could better  position DHS in strengthening the program to ensure it achieves its  objectives in controlling access to MTSA-regulated facilities and vessels.
section_title: TWIC Program Controls Are Not Designed to Require Adjudicators to Follow a Process with Clear Criteria for Applying Discretionary Authority When Applicants Are Found to Have Extensive Criminal Convictions
paragraphs: Being convicted of a felony does not automatically disqualify a person  from being eligible to receive a TWIC; however, prior convictions for  certain crimes are automatically disqualifying. Threat assessment  processes for the TWIC program include conducting background checks  to determine whether each TWIC applicant poses a security threat. Some  of these offenses, such as espionage or treason, would permanently  disqualify an individual from obtaining a TWIC. Other offenses, such as  murder or the unlawful possession of an explosive device, while  categorized as permanent disqualifiers, are also eligible for a waiver under  TSA regulations and might not permanently disqualify an individual from  obtaining a TWIC if TSA determines upon subsequent review that an  applicant does not represent a security threat. Table 1 presents examples  of disqualifying criminal offenses set out in statute and implementing  regulations for consideration as part of the adjudication process.
TSA also has the authority to add to or modify the list of interim  disqualifying crimes. Further, in determining whether an applicant poses a  security threat, TSA officials stated that adjudicators have the discretion  to consider the totality of an individual’s criminal record, including  criminal offenses not defined as a permanent or interim disqualifying  criminal offenses, such as theft or larceny. More specifically, TSA’s  implementing regulations provide, in part, that with respect to threat  assessments, TSA may determine that an applicant poses a security threat  if the search conducted reveals extensive foreign or domestic criminal  convictions, a conviction for a serious crime not listed as a permanent or  interim disqualifying offense, or a period of foreign or domestic  imprisonment that exceeds 365 consecutive days. Thus, if a person was  convicted of multiple crimes, even if each of the crimes were not in and of  themselves disqualifying, the number and type of convictions could be  disqualifying.
Although TSA has the discretion and authority to consider criminal  offenses not defined as a disqualifying offense, such as larceny and theft,  and periods of imprisonment, TSA has not developed a definition for what  extensive foreign or domestic criminal convictions means, or developed  guidance to ensure that adjudicators apply this authority consistently in  assessing the totality of an individual’s criminal record. For example, TSA  has not developed guidance or benchmarks for adjudicators to  consistently apply when reviewing TWIC applicants with extensive  criminal convictions but no disqualifying offense. This is particularly  important given TSA’s reasoning for including this authority in TWIC- related regulation. Specifically, TSA noted that it understands that the  flexibility this language provides must be used cautiously and on the basis  of compelling information that can withstand judicial review. They further  noted that the decision to determine whether an applicant poses a threat  under this authority is largely a subjective judgment based on many facts  and circumstances.
While TSA does not track metrics on the number of TWICs provided to  applicants with specific criminal offenses not defined as disqualifying  offenses, as of September 8, 2010, the agency reported 460,786 cases  where the applicant was approved, but had a criminal record based on the  results from the FBI. This represents approximately 27 percent of  individuals approved for a TWIC at the time. In each of these cases, the  applicant had either a criminal offense not defined as a disqualifying  offense or an interim disqualifying offense that was no longer a  disqualification based on conviction date or the applicant’s release date  from incarceration. Consequently, based on TSA’s background checking  procedures, all of these cases would have been reviewed by an adjudicator  for consideration as part of the second-level background check because  derogatory information had been identified. As such, each of these cases  had to be examined and a judgment had to be made as to whether to deny  an applicant a TWIC based on the totality of the offenses contained in each  applicant’s criminal report.
While there were 460,786 cases where the applicant was approved, but had  a criminal record, TSA reports to have taken steps to deny 1 TWIC  applicant under this authority. However, in the absence of guidance for the  application of this authority, it is not clear how TSA applied this authority  in approving the 460,786 applications and denying the 1. Internal control  standards call for controls and other significant events to be clearly  documented in directives, policies, or manuals to help ensure operations  are carried out as intended.
According to TSA officials, the agency has not implemented guidance for  adjudicators to follow on how to apply this discretion in a consistent  manner because they are confident that the adjudicators would, based on  their own judgment, identify all applicants where the authority to deny a  TWIC based on the totality of all offenses should be applied. However, in  the absence of criteria, we were unable to analyze or compare how the  approximately 30 adjudicators who are assigned to the TWIC program at  any given time made determinations about TWIC applicants with extensive  criminal histories. Given that 27 percent of TWIC holders have been  convicted of at least one nondisqualifying offense, defining what extensive  criminal convictions means and developing guidance or criteria for how  adjudicators should apply this discretionary authority could help provide  TSA with reasonable assurance that applications are consistently  adjudicated. Defining terms and developing guidance is consistent with  internal control standards.
section_title: TWIC Program Controls Are Not Designed to Provide Reasonable Assurance That TWIC Holders Have Maintained Their Eligibility Once Issued TWICs
paragraphs: DHS’s defined mission needs for TWIC include identifying individuals who  fail to maintain their eligibility requirements once issued a TWIC, and  immediately revoking the individual’s card privileges. Pursuant to TWIC- related regulations, an individual may be disqualified from holding a TWIC  and be required to surrender the TWIC to TSA for failing to meet certain  eligibility criteria related to, for example, terrorism, crime, and  immigration status. However, weaknesses exist in the design of the TWIC  program’s internal controls for identifying individuals who fail to maintain  their eligibility that make it difficult for TSA to provide reasonable  assurance that TWIC holders continue to meet all eligibility requirements.
Controls are not designed to determine whether TWIC holders  have committed disqualifying crimes at the federal or state level  after being granted a TWIC. TSA conducts a name-based check of  TWIC holders against federal wants and warrants on an ongoing basis.  According to FBI and TSA officials, policy and statutory provisions  hamper the program from running the broader FBI fingerprint-based  check using the fingerprints collected at enrollment on an ongoing basis.  More specifically, because the TWIC background check is considered to  be for a noncriminal justice purpose, to conduct an additional  fingerprint-based check as part of an ongoing TWIC background check,  TSA would have to collect a new set of fingerprints from the TWIC- holder, if the prints are more than 1 year old, and submit those prints to  the FBI each time they want to assess the TWIC-holder’s criminal history.  According to TSA officials, it would be cost prohibitive to run the  fingerprint-based check on an ongoing basis, as TSA would have to pay th FBI $17 .25 per check.
Although existing policies may hamper TSA’s ability to check FBI-held  fingerprint-based criminal history records for the TWIC program, TSA has  not explored alternatives for addressing this weakness, such as informing  facility and port operators of this weakness and identifying solutions for  leveraging existing state criminal history information, where available. For  instance, state maritime organizations may have other mechanisms at their  disposal for helping to identify TWIC-holders who may no longer meet  TWIC qualification requirements. Specifically, laws governing the maritime  environment in New York and New Jersey provide for credentialing  authorities being notified if licensed or registered longshoremen have been  arrested. Further, other governing entities, such as the State of Florida and  the Alabama State Port Authority, have access to state-based criminal  records checks. While TSA may not have direct access to criminal history  records, TSA could compensate for this control weakness, for example, by  leveraging existing mechanisms available to maritime stakeholders across  the country to better ensure that only qualified individuals retain TWICs.
Controls are not designed to provide reasonable assurance that  TWIC holders continue to meet immigration status eligibility  requirements. If a TWIC holder’s stated period of legal presence in the  United States is about to expire or has expired, the TWIC program does  not request or require proof from TWIC holders to show that they continue  to maintain legal presence in the United States. Additionally, although they  have the regulatory authority to do so, the program does not issue TWICs  for a term less than 5 years to match the expiration of a visa. Instead, TSA  relies on (1) TWIC holders to self-report if they no longer have legal  presence in the country, and (2) employers to report if a worker is no  longer legally present in the country. As we have previously reported,  government programs for granting benefits to individuals face challenges  in confirming an individual’s immigration status. TWIC program officials  stated that the program uses a United States Citizenship and Immigration  Services system during the background checking process prior to issuing a  TWIC as a method for confirming the legal status of non-U.S. citizens.  TSA has not, however, consistent with internal control standards,  implemented alternative controls to compensate for this limitation and  provide reasonable assurance that TWIC holders remain eligible. For  instance, the TWIC program has not compensated for this limitation by (1)  using its authority to issue TWICs with shorter expiration dates to  correspond with each individual’s legal presence, or (2) updating the TWIC  system to systematically suspend TWIC privileges for individuals who no  longer meet immigration eligibility requirements until they can provide  evidence of continued legal presence.
TWIC program officials stated that implementing these compensating  measures would be too costly, but they have not conducted an assessment  to identify the costs of implementing these controls, or determined if the  benefits of mitigating related security risks would outweigh those costs,  consistent with internal control standards. Not implementing such  measures could result in a continued risk of individuals no longer meeting  TWIC legal presence requirements continuing to hold a federally issued  identity document and gaining unescorted access to secure areas of MTSA- regulated facilities and vessels. Thus, implementing compensating  measures, to the extent that the benefits outweigh the costs and meet the  program’s defined mission needs, could provide TSA, the Coast Guard, and  MTSA-regulated stakeholders with reasonable assurance that each TWIC  holder continues to meet TWIC-related eligibility requirements.
section_title: Internal Control Weaknesses in TWIC Enrollment, Background Checking, and Use Could Have Contributed to Breach of MTSA-Regulated Ports
paragraphs: As of January 7, 2011, the Coast Guard reports that it has identified 11  known attempts to circumvent TWIC requirements for gaining unescorted  access to MTSA-regulated areas by presenting counterfeit TWICs. The  Coast Guard further reports to have identified 4 instances of individuals  presenting another person’s TWIC as their own in attempts to gain access.  Further, our investigators conducted covert tests to assess the use of  TWIC as a means for controlling access to secure areas of MTSA-regulated  facilities. During covert tests of TWIC at several selected ports, our  investigators were successful in accessing ports using counterfeit TWICs,  authentic TWICs acquired through fraudulent means, and false business  cases (i.e., reasons for requesting access). Our investigators did not gain  unescorted access to a port where a secondary port specific identification  was required in addition to the TWIC.
In response to our covert tests, TSA and Coast Guard officials stated that,  while a TWIC card is required for gaining unescorted access to secure  areas of a MTSA-regulated facility, the card alone is not sufficient. These  officials stated that the cardholder is also required to present a business  case, which security officials at facilities must consider as part of granting  the individual access. In addition, according to DHS’s Screening  Coordination Office, a credential is only one layer of a multilayer process  to increase security. Other layers of security might include onsite law  enforcement, security personnel, cameras, locked doors and windows,  alarm systems, gates, and turnstiles. Thus, a weakness in the  implementation of TWIC will not guarantee access to the secure areas of a  MTSA-regulated port or facility.
However, as our covert tests demonstrated, having an authentic TWIC and  a legitimate business case were not always required in practice. The  investigators’ possession of TWIC cards provided them with the  appearance of legitimacy and facilitated their unescorted entry into secure  areas of MTSA-regulated facilities and ports at multiple locations across  the country.  If individuals are able to acquire authentic TWICs  fraudulently, verifying the authenticity of these cards with a biometric  reader will not reduce the risk of undesired individuals gaining unescorted  access to the secure areas of MTSA-regulated facilities and vessels.
Given existing internal control weaknesses, conducting a control  assessment of the TWIC program’s processes to address existing  weaknesses could enhance the TWIC program’s ability to prevent and  detect fraud and positively identify TWIC applicants. Such an assessment  could better position DHS in strengthening the program to ensure it  achieves its objectives in controlling unescorted access to MTSA-regulated  facilities and vessels. It could also help DHS identify and implement the  minimum controls needed to (1) positively identify individuals, (2) provide  reasonable assurance that control weaknesses in one area of the program  would not undermine the reliability of other program areas or impede the  program from meeting mission needs, and (3) provide reasonable  assurance that the threat assessments are based on complete and accurate  information. Such actions would be consistent with internal control  standards, which highlight the need for capturing information needed to  meet program objectives; determining that relevant, reliable, and timely  information is available for management decision-making purposes; and  designing internal controls to provide reasonable assurance that  compliance with applicable laws and regulations is being achieved, as part  of implementing effective controls. Moreover, our prior work on internal  controls has shown that management should design and implement  internal controls based on the related costs and benefits and continually  assess and evaluate its internal controls to assure that the controls being  used are effective and updated when necessary.
section_title: TWIC’s Effectiveness at Enhancing Security Has Not Been Assessed, and the Coast Guard Lacks the Ability to Assess Trends in TWIC Compliance
paragraphs: The TWIC program is intended to improve maritime security by using a  federally sponsored credential to enhance access controls to secure areas  at MTSA-regulated facilities and vessels, but DHS has not assessed the  program’s effectiveness at enhancing security. In addition, Coast Guard’s  approach for monitoring and enforcing TWIC compliance nationwide  could be improved by enhancing its collection and assessment of related  maritime security information. For example, the Coast Guard tracks TWIC  program compliance, but the processes involved in the collection,  cataloguing, and querying of information cannot be relied on to produce  the management information needed to assess trends in compliance with  the TWIC program or associated vulnerabilities.
subsections: section_title: TWIC Has Not Been Assessed to Measure Effectiveness at Enhancing Security
paragraphs: DHS asserted in its 2009 and 2010 budget submissions that the absence of  the TWIC program would leave America’s critical maritime port facilities  vulnerable to terrorist activities. However, to date, DHS has not assessed  the effectiveness of TWIC at enhancing security or reducing risk for  MTSA-regulated facilities and vessels. Such assessments are consistent  with DHS’s National Infrastructure Protection Plan, which recognizes that  metrics and other evaluation procedures should be used to measure  progress and assess the effectiveness of programs designed to protect key  assets. Further, DHS has not demonstrated that TWIC, as currently  implemented and planned with readers, is more effective than prior  approaches used to limit access to ports and facilities, such as using  facility specific identity credentials with business cases. According to TSA  and Coast Guard officials, because the program was mandated by  Congress as part of MTSA, DHS did not conduct a risk assessment to  identify and mitigate program risks prior to implementation. Further,  according to these officials, neither the Coast Guard nor TSA analyzed the  potential effectiveness of TWIC in reducing or mitigating security risk— either before or after implementation—because they were not required to  do so by Congress. Rather, DHS assumed that the TWIC program’s  enrollment and background checking procedures were effective and  would not allow unqualified individuals to acquire and retain authentic  TWICs.
The internal control weaknesses that we discuss earlier in the report, as  well as the results of our covert tests of TWIC use, raise questions about  the effectiveness of the TWIC program. According to the Coast Guard  official responsible for conducting assessments of maritime risk, it may  now be possible to assess TWIC effectiveness and the extent to which, or  if, TWIC use could enhance security using current Maritime Security Risk  Analysis Model (MSRAM) data. Since MSRAM’s deployment in 2005, the  Coast Guard has used its MSRAM to help inform decisions on how to best  secure our nation’s ports and how to best allocate limited resources to  reduce terrorist risks in the maritime environment. Moreover, as we have  previously reported, Congress also needs information on whether and in  what respects a program is working well or poorly to support its oversight  of agencies and their budgets, and agencies’ stakeholders need  performance information to accurately judge program effectiveness.  Conducting an effectiveness assessment that evaluates whether use of  TWIC in its present form and planned use with readers would enhance the  posture of security beyond efforts already in place given costs and  program risks could better position DHS and policymakers in determining  the impact of TWIC on enhancing maritime security.
Further, pursuant to executive branch requirements, prior to issuing a new  regulation, agencies are to conduct a regulatory analysis, which is to  include an assessment of costs, benefits, and associated risks. Prior to  issuing the regulation on implementing the use of TWIC as a flashpass,  DHS conducted a regulatory analysis, which asserted that TWIC would  increase security. The analysis included an evaluation of the costs and  benefits related to implementing TWIC. However, DHS did not conduct a  risk-informed cost-benefit analysis that considered existing security risks.  For example, the analysis did not account for the costs and security risks  associated with designing program controls to prevent an individual from  acquiring an authentic TWIC using a fraudulent identity and limiting  access to secure areas of MTSA-regulated facilities and vessels to those  with a legitimate need, in accordance with stated mission needs. As a  proposed regulation on the use of TWIC with biometric card readers is  under development, DHS is to issue a new regulatory analysis. Conducting  a regulatory analysis using the information from the internal control and  effectiveness assessments as the basis for evaluating the costs, benefits,  security risks, and needed corrective actions could better inform and  enhance the reliability of the new regulatory analysis. Moreover, these  actions could help DHS identify and assess the full costs and benefits of  implementing the TWIC program in a manner that will meet stated mission  needs and mitigate existing security risks, and help ensure that the TWIC  program is more effective and cost-efficient than existing measures or  alternatives at enhancing maritime security.
section_title: Coast Guard’s Approach for Monitoring and Enforcing TWIC Compliance Could Be Improved by Enhancing Its Collection and Assessment of Maritime Security Information
paragraphs: Internal control standards state that (1) internal controls should be  designed to ensure that ongoing monitoring occurs in the course of normal  operations, and (2) information should be communicated in a form and  within a time frame that enables management to carry out its internal  control responsibilities. Further, our prior work has stated that Congress  also needs information on whether and in what respects a program is  working well or poorly to support its oversight of agencies and their  budgets, and agencies’ stakeholders need performance information to  accurately judge program effectiveness. The Coast Guard uses its Marine  Information for Safety and Law Enforcement (MISLE) database to meet  these needs by recording activities related to MTSA-regulated facility and  vessel oversight, including observations of TWIC-related deficiencies.  The purpose of MISLE is to provide the capability to collect, maintain, and  retrieve information necessary for the administration, management, and  documentation of Coast Guard activities. In February 2008, we reported  that flaws in the data in MISLE limit the Coast Guard’s ability to accurately  portray and appropriately target oversight activities.
In accordance with Coast Guard policy, Coast Guard inspectors are  required to verify TWIC cards during annual compliance exams and  security spot checks, and may do so in the course of other Coast Guard  duties. As part of each inspection, Coast Guard inspectors are, among  other things, to: (1) ensure that the card is authentic by examining it to  visually verify that it has not been tampered with; (2) verify identity by  comparing the photograph on the card with the TWIC holder to ensure a  match; (3) check the card’s physical security features; and (4) ensure the  TWIC is valid—a check of the card’s expiration date. Additionally, Coast  Guard inspectors are to assess the proficiency of facility and vessel  security personnel in complying with TWIC requirements through various  means including oral examination, actual observation, and record review.  Coast Guard inspectors randomly select workers to check their TWICs  during inspections. The number of TWIC cards checked is left to the  discretion of the inspectors.
As of December 17, 2010, according to Coast Guard data, 2,135 facilities  have undergone at least 2 MTSA inspections as part of annual compliance  exams and spot checks. In reviewing the Coast Guard’s records of TWIC- related enforcement actions, we found that, in addition to verifying the  number of inspections conducted, the Coast Guard is generally positioned  to verify that TWIC cards are being checked by Coast Guard inspectors  and, of the card checks that are recorded, the number of cardholders who  are compliant and noncompliant. For instance, the Coast Guard reported  inspecting 129,464 TWIC holders’ cards from May 2009 through January 6,  2011. The Coast Guard reported that 124,203 of the TWIC holders, or  96 percent, were found to be compliant—possessed a valid TWIC.  However, according to Coast Guard officials, local Coast Guard inspectors  may not always or consistently record all inspection attempts.  Consequently, while Coast Guard officials told us that inspectors verify  TWICs as part of all security inspections, the Coast Guard could not  reliably provide the number of TWICs checked during each inspection.
Since the national compliance deadline in April 2009 requiring TWIC use at  MTSA-regulated facilities and vessels, the Coast Guard has not identified  major concerns with TWIC implementation nationally. However, while the  Coast Guard uses MISLE to track program compliance, because of  limitations in the MISLE system design, the processes involved in the  collection, cataloguing, and querying of information cannot be relied upon  to produce the management information needed to assess trends in  compliance with the TWIC program or associated vulnerabilities. For  instance, when inspectors document a TWIC card verification check, the  system is set up to record the number of TWICs reviewed for different  types of workers and whether the TWIC holders are compliant or  noncompliant. However, other details on TWIC-related deficiencies, such  as failure to ensure that all facility personnel with security duties are  familiar with all relevant aspects of the TWIC program and how to carry  them out, are not recorded in the system in a form that allows inspectors  or other Coast Guard officials to easily and systematically identify that a  deficiency was related to TWIC. For example, from January 2009 through  December 2010, the Coast Guard reported issuing 145 enforcement actions  as a result of annual compliance exams or security spot checks at the  2,135 facilities that have undergone the inspections. These included 57  letters of warning, 40 notices of violation, 32 civil penalties, and 16  operations controls (suspension or restriction of operations). However, it  would be labor-intensive for the Coast Guard to identify how many of the  57 letters of warning or 40 notices of violation were TWIC related,  according to a Coast Guard official responsible for TWIC compliance,  because there is not an existing query designed to extract this information  from the system. Someone would have to manually review each of the 97  inspection reports in the database indicating either a letter of warning or a  notice of violation to verify whether or not the deficiencies were TWIC  related. As such, the MISLE system is not designed to readily provide  information that could help management measure and assess the overall  level of compliance with the TWIC program or existing vulnerabilities.
According to a Coast Guard official responsible for TWIC compliance,  Coast Guard headquarters staff has not conducted a trend analysis of the  deficiencies found during reviews and inspections and there are no other  analyses they planned to conduct regarding enforcement until after  readers are required to be used. According to the Coast Guard, it can  generally identify the number of TWICs checked and recorded in the  MISLE system. However, it cannot perform trend analysis of the  deficiencies as it would like to do, as it requires additional information. In  the interim, as of January 7, 2011, the Coast Guard reported deploying 164  handheld biometric readers nationally to units responsible for conducting  inspections. These handheld readers are intended to be the Coast Guard’s primary means of TWIC verification. During inspections, Coast Guard inspectors use the card readers to electronically check TWICs inthree ways: (1) verification—a biometric one-to-one match of the  fingerprint; (2) authentication—electronically confirming that the  certificates on the credential are authentic; and (3) validation— electronically check the card against the “hotlist” of invalid or revoked  cards. The Coast Guard believes that the use of these readers during  inspections will greatly improve the effectiveness of enforcement efforts  and enhance record keeping through the use of the readers’ logs.
As a result of limitations in MISLE design and the collection and recording  of inspection data, it will be difficult for the Coast Guard to identify trends  nationwide in TWIC-related compliance, such as whether particular types  of facilities or a particular region of the country have greater levels of  noncompliance, on an ongoing basis. Coast Guard officials acknowledged  these deficiencies and reported that they are in the process of making  enhancements to the MISLE database and plan to distribute updated  guidance on how to collect and input information into MISLE to the  Captains of the Port. However, as of January 2011, the Coast Guard had  not yet set a date for implementing these changes. Further, while this is a  good first step, these enhancements do not address weaknesses related to  the collection process and querying of MISLE information so as to  facilitate the Coast Guard performing trend analysis of the deficiencies as  part of its compliance reviews. By designing and implementing a cost- effective and practical method for collecting, cataloging, and querying  TWIC-related compliance information, the Coast Guard could be better  positioned to identify and assess TWIC-related compliance and  enforcement trends, and to obtain management information needed to  assess and understand existing vulnerabilities with the use of TWIC.
section_title: Conclusions
paragraphs: As the TWIC program continues on the path to full implementation—with  potentially billions of dollars needed to install TWIC card readers in  thousands of the nation’s ports, facilities, and vessels at stake—it is  important that Congress, program officials, and maritime industry  stakeholders fully understand the program’s potential benefits and  vulnerabilities, as well as the likely costs of addressing these potential  vulnerabilities. Identified internal control weaknesses and vulnerabilities  include weaknesses in controls related to preventing and detecting  identity fraud, assessing the security threat that individuals with extensive  criminal histories pose prior to issuing a TWIC, and ensuring that TWIC  holders continue to meet program eligibility requirements. Thus,  conducting an internal control assessment of the program by analyzing  controls, identifying related weaknesses and risks, and determining cost- effective actions to correct or compensate for these weaknesses could  better position DHS to provide reasonable assurance that control  weaknesses do not impede the program from meeting mission needs.
In addition, conducting an effectiveness assessment could help provide  reasonable assurance that the use of TWIC enhances the posture of  security beyond efforts already in place or identify the extent to which  TWIC may possibly introduce security vulnerabilities because of the way it  has been designed and implemented. This assessment, along with the  internal controls assessment, could be used to enhance the regulatory  analysis to be conducted as part of implementing a regulation on the use  of TWIC with readers. More specifically, considering identified security  risks and needed corrective actions as part of the regulatory analysis could  provide insights on the full costs and benefits of implementing the TWIC  program in a manner that will meet stated mission needs and mitigate  existing security risks. This is important because, unlike prior access  control approaches which allowed access to a specific facility, the TWIC  potentially facilitates access to thousands of facilities once the federal  government attests that the TWIC holder has been positively identified and  is deemed not to be a security threat. Further, doing so as part of the  regulatory analysis could better assure DHS, Congress, and maritime  stakeholders that TWIC program security objectives will be met. Finally,  by designing and implementing a cost-effective and practical method for  collecting, cataloging, and querying TWIC-related compliance information,  the Coast Guard could be better positioned to identify trends and to obtain  management information needed to assess and understand existing  vulnerabilities with the use of TWIC.
section_title: Recommendations for Executive Action
paragraphs: To identify effective and cost-efficient methods for meeting TWIC program  objectives, and assist in determining whether the benefits of continuing to  implement and operate the TWIC program in its present form and planned  use with readers surpass the costs, we recommend that the Secretary of  Homeland Security take the following four actions:    Perform an internal control assessment of the TWIC program by   (1) analyzing existing controls, (2) identifying related weaknesses and  risks, and (3) determining cost-effective actions needed to correct or  compensate for those weaknesses so that reasonable assurance of  meeting TWIC program objectives can be achieved. This assessment  should consider weaknesses we identified in this report among other  things, and include:    strengthening the TWIC program’s controls for preventing and  detecting identity fraud, such as requiring certain biographic  information from applicants and confirming the information to the  extent needed to positively identify the individual, or implementing  alternative mechanisms to positively identify individuals;    defining the term extensive criminal history for use in the  adjudication process and ensuring that adjudicators follow a clearly  defined and consistently applied process, with clear criteria, in  considering the approval or denial of a TWIC for individuals with  extensive criminal convictions not defined as permanent or interim  disqualifying offenses; and  identifying mechanisms for detecting whether TWIC holders  continue to meet TWIC disqualifying criminal offense and  immigration-related eligibility requirements after TWIC issuance to  prevent unqualified individuals from retaining and using authentic  TWICs.
Conduct an effectiveness assessment that includes addressing internal  control weaknesses and, at a minimum, evaluates whether use of TWIC  in its present form and planned use with readers would enhance the  posture of security beyond efforts already in place given costs and  program risks.
Use the information from the internal control and effectiveness  assessments as the basis for evaluating the costs, benefits, security  risks, and corrective actions needed to implement the TWIC program in  a manner that will meet stated mission needs and mitigate existing  security risks as part of conducting the regulatory analysis on  implementing a new regulation on the use of TWIC with biometric card  readers.
Direct the Commandant of the Coast Guard to design effective methods  for collecting, cataloguing, and querying TWIC-related compliance  issues to provide the Coast Guard with the enforcement information  needed to assess trends in compliance with the TWIC program and  identify associated vulnerabilities.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of the sensitive version of this report to the Secretary  of Homeland Security for review and comment on March 18, 2011.  DHS  provided written comments on behalf of the Department, the  Transportation Security Administration, and the United States Coast  Guard, which are reprinted in full in appendix IV.  In commenting on our  report, DHS stated that it concurred with our four recommendations and  identified actions planned or under way to implement them.
While DHS did not take issue with the results of our work, DHS did  provide new details in its response that merit additional discussion.  First,  DHS noted that it is working to strengthen controls around applicant  identity verification in TWIC, but that document fraud is a vulnerability to  credential-issuance programs across the federal government, state and  local governments, and the private sector. DHS further noted that a  governmentwide infrastructure does not exist for information sharing  across all entities that issue documents that other programs, such as  TWIC, use to positively authenticate an individual’s identity. We  acknowledge that such a government-wide infrastructure does not exist,  and, as discussed in our report, recognize that there are inherent  weaknesses in relying on identity documents alone to confirm an  individual’s identity. However, positively identifying individuals—or  confirming their identity—and determining their eligibility for a TWIC is a  key stated program goal. Issuing TWICs to individuals without positively  identifying them and subsequently assuring their eligibility could, counter  to the program’s intent, create a security vulnerability. While we recognize  that additional costs could be imposed by requiring positive identification  checks, taking actions to strengthen the existing identity authentication  process, such as only accepting documents that TSA can and does confirm  to be authentic with the issuing agency, and verifying an applicant’s  business need, could enhance TWIC program efforts to prevent and detect  identity fraud and enhance maritime security.
Second, DHS stated that it is working to continually verify TWIC-holder  eligibility after issuance but also noted the limitations in the current  process.  While TSA does receive some criminal history records  information when it sends fingerprints to the FBI, the information is not  provided recurrently, nor is the information necessarily complete. DHS  stated that to provide the most robust recurrent vetting against criminal  records, TSA would need access to additional state and federal systems,  and have additional authority to do so. As we reported, FBI and TWIC  officials stated that because the TWIC background check is considered to  be for a noncriminal justice purpose, policy and statutory provisions  hamper the program from running the broader FBI fingerprint-based  check using the fingerprints collected at enrollment on an ongoing basis.  However, we continue to believe that TSA could compensate for this  weakness by leveraging existing mechanisms available to maritime  stakeholders. For example, other governing entities—such as the Alabama  State Port Authority—that have an interest in ensuring the security of the  maritime environment, might be willing to establish a mechanism for  independently sharing relevant information when warranted. Absent  efforts to leverage available information sources, TSA may not be  successful in tempering existing limitations.
Lastly, DHS sought clarification on the reporting of our investigators’  success at breaching security at ports during covert testing. Specifically, in  its comments, DHS noted that it believes that our report’s focus on access  to port areas rather than access to individual facilities can be misleading.  DHS noted that we do not report on the number of facilities that our  investigators attempted to gain access to within each port area. DHS  stated that presenting the breaches in terms of the number of port areas  breached rather than the number of facilities paints a more troublesome  picture of the actual breaches that occurred.  We understand DHS’s  concern but continue to believe that the results of our investigators’ work,  as reported, fairly and accurately represents the results and significance of  the work conducted.  The goal of the covert testing was to assess whether  or not weaknesses exist at ports with varying characteristics across the  nation, not to define the pervasiveness of existing weaknesses by type of  facility, volume, or other characteristic. Given the numerous differences  across facilities and the lack of publicly available information and related  statistics for each of the approximately 2,509 MTSA-regulated facilities, we  identified covert testing at the port level to be the proper unit of analysis  for our review and reporting purposes. Conducting a detailed assessment  of the pervasiveness of existing weaknesses by type of facility, volume, or  other characteristics as suggested by DHS would be a more appropriate  tasking for the Coast Guard as part of its continuing effort to ensure  compliance with TWIC-related regulations.
In addition, with regard to covert testing, DHS further commented that the  report does not distinguish among breaches in security using a counterfeit  TWIC or an authentic TWIC card obtained with fraudulent documents.  DHS noted that because there is no “granularity” with the report as to  when a specific card was used, one can be left with the unsupported  impression that individual facilities in all cases were failing to implement  TWIC visual inspection requirements. For the above noted reason, we did  not report on the results of covert testing at the facility level. However, our  records show that use of counterfeit TWICs was successful for gaining  access to more than one port where our investigators breached security.  Our investigators further report that security officers never questioned the  authenticity of TWICs presented for acquiring access. Our records show  that operations at the locations our investigators breached included cargo,  containers, and fuel, among others.
In addition, TSA provided written technical comments, which we  incorporated into the report, as appropriate.
We are sending copies of this report to the Secretary of Homeland  Security, the Assistant Secretary for the Transportation Security  Administration, the Commandant of the United States Coast Guard, and  appropriate congressional committees. In addition, this report is available  at no charge on the GAO Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Key contributors to this report are listed in appendix VII.
section_title: Appendix I: Key Steps in the TWIC Enrollment Process
section_title: Appendix II: TWIC Program Funding
paragraphs: Range based on a reduced fee of $105.25 per TWIC for workers with current, comparable  background checks or a $132.50 fee per TWIC for those without.  010.  ral security grant funding subtotal for fiscal year 2007 includes $19.2 million in fiscal year Port  ecurity Grant Program funding, $10.8 million in supplemental funding, and $1.5 million in Transit  S Security Grant Program funding.
section_title: Appendix III: List of Documents U.S.-Born Citizens or Nationals Must Select from to Present When Applying for a TWIC
paragraphs: TWIC applicants who are  possessions) and were born inside the United States (or its outlying  possessions), must prov e one document from list A or two documents  from list B. If two documents from list B are presented, at least one of  them must be a government-iss issued driv r’s license, m ilitary citizens of the United States (or its outlying  ued photo  ID card, ntification, su  state identificat .
subsections: section_title: List
section_title: List B
section_title: Appendix IV: Criminal Offenses That May Disqualify Applicants from Acquiring a TWIC
paragraphs: Listed below are criminal offenses that can prevent TWIC applicants from being issued a TWIC. Pursuant to TSA implementing regulations,  permanent disqualifying offenses are offenses defined in 49 C.F.R.  1572.103(a). Permanent disqualifying offenses that can be waived are  those offenses defined in 49 C.F.R. 1572.103(a) for which a waiver can be  granted in accordance with 49 C.F.R. 1515.7(a)(i). Interim disqualifying  offenses are offenses defined in 49 C.F.R. 1572.103(b) for which the  applicant has either been (1) convicted, or found not guilty by reason of  insanity, within a 7-year period preceding the TWIC application, or (2)  incarcerated for within a 5-year period preceding the TWIC application.  Applicants with certain permanent criminal offenses and all interim  disqualifying criminal offenses may request a waiver of their  disqualification. In general, TSA may issue such a waiver and grant a TWIC  if TSA determines that an applicant does not pose a security threat based  upon the security threat assessment.
Permanent disqualifying criminal offenses for which no waiver may  be granted.  1.  Espionage, or conspiracy to commit espionage.  2.  Sedition, or conspiracy to commit sedition.  3.  Treason, or conspiracy to commit treason.  4.  A federal crime of terrorism as defined in 18 U.S.C. 2332b(g), or  comparable state law, or conspiracy to commit such crime.
Permanent disqualifying criminal offenses for which a waiver may  be granted.  1.  A crime involving a transportation security incident. A transportation  security incident is a security incident resulting in a significant loss of  life, environmental damage, transportation system disruption, or  economic disruption in a particular area, as defined in 46 U.S.C. §  70101. The term economic disruption does not include a work  stoppage or other employee-related action not related to terrorism and  resulting from an employer-employee dispute.  2.  Improper transportation of a hazardous material under 49 U.S.C. §  5124, or a state law that is comparable.  3.  Unlawful possession, use, sale, distribution, manufacture, purchase,  receipt, transfer, shipping, transporting, import, export, storage of, or  dealing in an explosive or explosive device. An explosive or explosive  device includes, but is not limited to, an explosive or explosive  material as defined in 18 U.S.C. §§ 232(5), 841(c) through 841(f), and  844(j); and a destructive device, as defined in 18 U.S.C. § 921(a)(4) and  26 U.S.C. § 5845(f).  4.  Murder.  5.  Making any threat, or maliciously conveying false information kno the same to be false, concerning the deliverance, placement, or  detonation of an explosive or other lethal device in or against a place  of public use, a state or government facility, a public transportations  system, or an infrastructure facility.  6.  Violations of the Racketeer Influenced and Corrupt Organizations A 18 U.S.C. § 1961, et seq. , or a comparable state law, where one of the predicate acts found by a jury or admitted by the defendant, consists one of the crimes listed in paragraph 49 C.F.R. § 1572.103 (a).  7.  Attempt to commit the crimes in paragraphs listed under 49 C.F.R. §  1572.103 (a)(1) through (a)(4).  8.  Conspiracy or attempt to commit the crimes in 49 C.F.R. § 1572.103  (a)(5) through (a)(10).
The interim disqualifying felonies.  1.  Unlawful possession, use, sale, manufacture, pu receipt, transfer, shipping, transporting, delivery dealing in a firearm or other weapon. A firea includes, but is not limited to, firearms as defined in 18 U.S.C. §  921(a)(3) or 26 U.S.C. § 5845(a), or items contained on the United States Munitions Import List at 27 CFR § 447.21. rchase, distribution,  , import, export of, or  .  Extortion.  2 3.  Dishonesty, fraud, or misrepresentation, including identity fraud and  money laundering where the money laundering is related to a crime  described bad checks do not constitute dishonesty, fraud, or misrepresentation  for purposes of this paragraph.   in 49 C.F.R. § 1572.103 (a) or (b). Welfare fraud and passing  4.  Bribery.  5.  Smuggling.  6.  Immigration violations.  7.  Distribution of, possession with intent to distribute, or importa controlled substance.  8.  Arson.  9.  Kidnapping or hostage taking.  10. Rape or aggravated sexual abuse.  11. Assault with intent to kill.  12. Robbery.  13. Fraudulent entry into a seaport as described in 18 U.S.C. § 1036, or a  comparable state law.  14. Violations of the Racketeer Influenced and Corrupt Organizations Act,  18 U.S.C. § 1961, et seq., or a comparable state law, other than the  violations listed in paragraph 49 C.F.R. § 1572.103 (a)(10).  15. Conspiracy or attempt to commit the interim disqualifying felonies.
section_title: Appendix V: Comparison of Authentic and Counterfeit TWICs
section_title: Appendix VI: Comments from the Department of Homeland Security
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
paragraphs: Appendix VII: GAO Contact and Staff  Acknowledgments Error! No text of specified style in document.
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, David Bruno (Assistant Director),  Joseph P. Cruz, Scott Fletcher, Geoffrey Hamilton, Richard Hung, Lemuel  Jackson, Linda Miller, Jessica Orr, and Julie E. Silvers made key  contributions to this report.