Homeland Security: DHS's Progress and Challenges in Key Areas of Maritime, Aviation, and Cybersecurity
Published: 2009-12-02T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Securing the nation's transportation and information systems is a primary responsibility of the Department of Homeland Security (DHS). Within DHS, the Transportation Security Administration (TSA) is responsible for securing all transportation modes; U.S. Customs and Border Protection (CBP) is responsible for cargo container security; the U.S. Coast Guard is responsible for protecting the maritime environment; and the National Protection and Programs Directorate is responsible for the cybersecurity of critical infrastructure. This statement focuses on the progress and challenges DHS faces in key areas of maritime, aviation, and cybersecurity. It is based on GAO products issued from June 2004 through November 2009, as well as ongoing work on air cargo security. GAO reviewed relevant documents; interviewed cognizant agency officials; and observed operations at 12 airports, chosen by size and other factors. The results are not generalizable to all airports.
section_title: What GAO Found
paragraphs: DHS hasmade progress in enhancing security in the maritime sector, but key challenges remain. For example, as part of a statutory requirement to scan 100 percent of U.S.-bound container cargo by July 2012, CBP has implemented the Secure Freight Initiative at select foreign ports. However, CBP does not have a plan for fully implementing the 100 percent scanning requirement by July 2012 because it questions the feasibility, although it has not performed a feasibility analysis of the requirement. Rather, CBP has planned two new initiatives to further strengthen the security of container cargo, but these initiatives will not achieve 100 percent scanning. Further, TSA, the Coast Guard, and the maritime industry took a number of steps to enroll over 93 percent of the estimated 1.2 million users in the Transportation Worker Identification Credential (TWIC) program (designed to help control access to maritime vessels and facilities) by the April 15, 2009 compliance deadline, but they experienced challenges resulting in delays and in ensuring the successful execution of the TWIC pilot. While DHS and the Coast Guard have developed a strategy and programs to reduce the risks posed by small vessels, they face ongoing resource and technology challenges in tracking small vessels and preventing attacks by such vessels. In the aviation sector, TSA has made progress in meeting the statutory mandate to screen 100 percent of air cargo transported on passenger aircraft by August 2010 and in taking steps to strengthen airport security, but TSA continues to face challenges. TSA's efforts include developing a system to allow screening responsibilities to be shared across the domestic air cargo supply chain, among other steps. Despite these efforts, TSA and the industry face a number of challenges including the voluntary nature of the program, and ensuring that approved technologies are effective with air cargo. TSA also does not expect to meet the mandated 100 percent screening deadline as it applies to air cargo transported into the U.S., in part due to existing screening exemptions for this type of cargo and challenges in harmonizing security standards with other nations. GAO is reviewing these issues as part of its ongoing work and will issue a final report next year. In addition, TSA has taken a variety of actions to strengthen airport security by, among other things, implementing a worker screening program; however, TSA still faces challenges in this area. DHS has made progress in strengthening cybersecurity, such as addressing some lessons learned from a cyber attack exercise, but further actions are warranted. Since 2005, GAO has reported that DHS has not fully satisfied its key responsibilities for protecting the nation's computer-reliant critical infrastructures and has made related recommendations to DHS, such as bolstering cyber analysis and warning capabilities and strengthening its capabilities to recover from Internet disruptions. DHS has since developed and implemented certain capabilities to satisfy aspects of its responsibilities, but it has not fully implemented GAO's recommendations and, thus, more action is needed to address the risk to critical cybersecurity infrastructure.

section_title: Letter
paragraphs: I am pleased to submit this statement on the progress that the Department  of Homeland Security (DHS) has made and the challenges it faces in key  areas of maritime and aviation security, as well as in securing the nation  against computer-based, or cyber attacks. The economic well being of the  United States is dependent on the expeditious flow of people and goods  through the U.S. transportation system, which moves millions of  passengers and tons of freight each day. The extensiveness of the  transportation system, as well as the sheer volume of passengers and  freight moved, makes it both an attractive target and challenging to secure.  Ports, waterways, and vessels are part of an economic engine handling  more than $700 billion in merchandise annually, and an attack on this  system could have a widespread impact on global shipping, international  trade, and the global economy. Likewise, successful terrorist attacks and  plots against the commercial aviation system in the past 8 years highlight  the threats and vulnerabilities this system faces. Balancing security  concerns with the need to facilitate the free flow of people and commerce  remains an ongoing challenge for the public and private sectors alike.  Likewise, pervasive and sustained cyber attacks against the United States  and others continue to pose a potentially devastating impact to systems  and operations and the critical infrastructures that they support.
Within DHS, numerous component agencies have responsibility for  securing areas of transportation security and computer-reliant critical  infrastructures, such as communications and electricity. The  Transportation Security Administration (TSA) is the federal agency with  primary responsibility for securing all modes of transportation and has  developed and implemented a variety of programs and procedures to  secure commercial aviation and surface modes of transportation. U.S.  Customs and Border Protection (CBP) has a priority mission of keeping  terrorists and their weapons out of the U.S., is responsible for securing  and facilitating trade, and has primary responsibility for cargo container  security. The Coast Guard has responsibility for protecting the public, the  environment, and U.S. economic and security interests in any maritime  region in which those interests may be at risk, including America’s coasts,  ports, and inland waterways. The National Protection and Programs  Directorate is responsible for, among other things, assuring the security,  resiliency, and reliability of the nation’s computer-reliant critical  infrastructures—a practice known as cyber critical infrastructure  protection, or cyber CIP.
A number of laws have been enacted in recent years to strengthen  maritime and aviation security, as well as cybersecurity. In response to  provisions of the Aviation and Transportation Security Act (ATSA), TSA  established the Transportation Worker Identification Credential (TWIC)  program in December 2001. The Security and Accountability For Every  (SAFE) Port Act of 2006 directed the Secretary of Homeland Security to,  among other things, implement the TWIC pilot project in the maritime  sector. To increase the security of container cargo bound for the United  States, the SAFE Port Act further required CBP to establish a pilot  program to test the feasibility of scanning 100 percent of U.S.-bound  containers at foreign ports. Further, in August 2007 the Implementing  Recommendations of the 9/11 Commission Act (9/11 Act) was enacted and  provides, among other things, that by July 2012, a container loaded on a  vessel in a foreign port shall not enter the United States unless that  container is scanned before it is loaded onto the vessel. The Act further  requires that by August 2010, 100 percent of cargo—domestic and  inbound—transported on passenger aircraft be physically screened. To  address the threats posed by cyber attacks, President Bush issued a 2003  national strategy and related policy directives aimed at improving  cybersecurity nationwide, including both government systems and those  that support cyber critical infrastructures owned and operated by the  private sector.
My statement today focuses on the progress that DHS and its component  agencies have made to strengthen maritime, aviation, and cybersecurity,  and the challenges that remain. In particular, my statement addresses   (1) cargo container scanning, (2) efforts to enroll maritime workers in the  TWIC program, (3) small vessel security, (4) air cargo screening,   (5) airport perimeter and access control security, and (6) cybersecurity for  critical infrastructure.
My statement is based on related GAO reports and testimonies issued from  June 2004 through November 2009, as well as ongoing work that will be  completed in early 2010 assessing the progress that DHS and its  component agencies have made in addressing challenges related to air  cargo screening. To conduct this work, we reviewed relevant documents  related to the programs reviewed; interviewed cognizant DHS, TSA, Coast  Guard, and CBP officials; and observed operations at a non-probability  sample of 19 seaports—13 domestic and 6 foreign—and 12 airports,  chosen by size, program participation, and other factors. Although the  results of our site visits are not generalizable to all seaports, airports, or  officials, we gained a critical understanding of the progress and challenges  associated with implementing efforts to secure the transportation system  and improve cyber CIP. We have conducted our ongoing work—covering  the period October 2008 to date—as well as the prior audit work that  serves as the basis for this statement, in accordance with generally  accepted government auditing standards. Those standards require that we  plan and perform the audit to obtain sufficient, appropriate evidence to  provide a reasonable basis for our findings and conclusions based on our  audit objectives. We believe that the evidence obtained provides a  reasonable basis for our findings based on our audit objectives.
In summary, DHS has made progress in enhancing security in the maritime  sector, but key challenges remain. Among other things, CBP has begun  working with foreign ports to scan U.S.-bound container cargo; TSA, Coast  Guard, and the maritime industry enrolled over 93 percent of the estimated  1.2 million users in the TWIC program by the April 15, 2009 compliance   deadline; and DHS and the Coast Guard have developed a strategy and  programs to reduce the risks associated with small vessels. However, DHS  and its component agencies face a number of management, technological,  and resource challenges associated with these efforts. In our previous  work, we made recommendations to help address these challenges.  Specifically, in our October 2009 report on scanning of U.S.-bound cargo  containers, we made recommendations to DHS and CBP to complete a  feasibility analysis, cost estimates, and a cost-benefit analysis and provide  the results to Congress to help strengthen container security. In our  November 2009 report on TWIC, we made recommendations to TSA to,  among other things, expedite the development of contingency and disaster  recovery plans and system(s), and recommended to TSA and the Coast  Guard that they develop a detailed evaluation plan to help ensure that  needed information on biometrics readers will result from the pilot. DHS  generally concurred and discussed actions to implement  recommendations from both of these reports, but we believe that these  actions will not fully address the intent of all of the recommendations. In  the aviation sector, TSA has made progress in meeting the air cargo  screening mandate of the 9/11 Act—including developing a program to  share screening responsibilities across the supply chain, but the agency  continues to face challenges related to planning and technology, among  other things. In our September 2009 report on airport security, we made  recommendations to TSA to, among other things, develop a national  strategy to guide stakeholder efforts to strengthen airport perimeter and  access control security, to which DHS concurred. Finally, regarding cyber  CIP issues, DHS has developed and implemented certain capabilities to  satisfy aspects of its cybersecurity responsibilities, such as addressing  certain lessons learned from cyber attack exercises, but it has not fully  satisfied our recommendations to, among other things, bolster cyber  analysis and warning capabilities and strengthen its capabilities to recover  from Internet disruptions. As a result, DHS needs to take further action to  address these areas.
subsections: section_title: Background
subsections: section_title: Secure Freight Initiative (SFI)
paragraphs: In December 2006, in response to SAFE Port Act requirements, DHS, and  the Department of Energy (DOE) jointly announced the formation of the  Secure Freight Initiative (SFI) pilot program to test the feasibility of  scanning 100 percent of U.S.-bound container cargo at three foreign ports  (Puerto Cortes, Honduras; Qasim, Pakistan; and Southampton, United  Kingdom). According to CBP officials, while initiating the SFI program at  these ports satisfied the SAFE Port Act requirement, CBP also selected the  ports of Busan, South Korea; Hong Kong; Salalah, Oman; and Singapore to  more fully demonstrate the capability of the integrated scanning system at  larger, more complex ports. As of October 2009, SFI has been operational  at five of these initial seven seaports. According to CBP and DOE officials,  the SFI program builds upon existing container security measures by  enhancing the U.S. government’s ability to have containers scanned for  nuclear and radiological material overseas and, thus, better assess the risk  of weapons of mass destruction (WMD) in inbound cargo containers.
section_title: Transportation Worker Identification Credential (TWIC)
paragraphs: Managed by TSA and the U.S. Coast Guard, the TWIC program aims to  protect the nation’s maritime transportation facilities and vessels by  requiring maritime workers to complete background checks and obtain a  biometric identification card in order to gain unescorted access to the  secure areas of regulated facilities and vessels. A federal regulation in  January 2007 set a compliance deadline, subsequently extended to April  15, 2009, whereby each maritime worker was required to hold a TWIC in  order to obtain unescorted access to secure areas of regulated facilities  and vessels. In addition, TSA has initiated a pilot to test the use of TWIC  with related access control technologies.
section_title: Small Vessel Security
paragraphs: Concerns have grown about the security risks of small vessels and DHS  has identified the four gravest risk scenarios involving the use of such  vessels for terrorist attacks. Some of these risks have been shown to be  real through attacks conducted outside U.S. waters, but to date, no small  boat attacks have happened in the United States. These four scenarios  include the use of a small vessel as (1) a waterborne improvised explosive  device, (2) a means of smuggling weapons into the United States, (3) a  means of smuggling humans into the United States, and (4) a platform for  conducting a stand-off attack.
section_title: Air Cargo Security
paragraphs: Air cargo ranges in size from 1 pound to several tons, and can be shipped  in various forms, including unit load devices (ULD) that allow many  packages to be consolidated into one container or pallet, wooden crates,  or individually wrapped/boxed pieces, known as loose or bulk cargo.  Participants in the air cargo shipping process include shippers, such as  manufacturers; freight forwarders, who consolidate cargo from shippers  and take it to air carriers for transport; air cargo handling agents, who  process and load cargo onto aircraft on behalf of air carriers; and air  carriers that load and transport cargo. TSA’s responsibilities include,  among other things, establishing security requirements governing  domestic and foreign passenger air carriers that transport cargo, and  domestic freight forwarders.
section_title: Perimeter and Access Control Security
paragraphs: Airport perimeter and access control security is intended to prevent  unauthorized access into secured airport areas, either from outside the  airport complex or from within. Airport operators generally have direct  day-to-day responsibility for maintaining and improving perimeter and  access control security, as well as implementing measures to reduce  worker risk. However, TSA has primary responsibility for establishing and  implementing measures to improve security operations at U.S. commercial  airports—that is, TSA-regulated airports—including overseeing airport  operator efforts to maintain perimeter and access control security.  Airport workers may access sterile areas— areas of airports where  passengers wait after screening to board departing aircraft— through TSA  security checkpoints or through other access points that are secured by  the airport operator. The airport operator is also responsible, in  accordance with its security program, for securing access to secured  airport areas where passengers are not permitted. Airport methods used to  control access vary, but all access controls must meet minimum  performance standards in accordance with TSA requirements.
section_title: Cybersecurity
paragraphs: The federal government has developed a strategy to address cyber threats.  Specifically, President Bush issued the 2003 National Strategy to Secure  Cyberspace and related policy directives, such as Homeland Security  Presidential Directive 7, that specify key elements of how the nation is to  secure key computer-based systems, including both government systems  and those that support critical infrastructures owned and operated by the  private sector. The strategy and related policies also establish DHS as the  focal point for cyber critical infrastructure protection and assigns DHS  multiple leadership roles and responsibilities in this area, to include (1)  developing a comprehensive national plan for critical infrastructure  protection, including cybersecurity; (2) developing and enhancing national  cyber analysis and warning capabilities; (3) providing and coordinating  incident response and recovery planning, including conducting incident  response exercises; (4) identifying, assessing, and supporting efforts to  reduce cyber threats and vulnerabilities, including those associated with  infrastructure control systems; and (5) strengthening international  cyberspace security. More recently, in February 2009, President Obama  directed the National Security Council and Homeland Security Council to  conduct a comprehensive review to assess the United States’  cybersecurity-related policies and structures. The resulting May 2009  report made a number of recommendations to improve the nation’s  approach.
section_title: Maritime Security
subsections: section_title: CBP Has Made Some Progress in Working with Foreign Ports to Scan U.S.- Bound Containers, but Challenges Remain in Expanding the Program to Larger Ports and Meeting the Statutory Target Date
paragraphs: In October 2009, we reported that CBP has made some progress in  working with the initial SFI ports to scan U.S.-bound cargo containers; but  because of challenges to expanding scanning operations, especially to  larger ports, the feasibility of scanning 100 percent of U.S.-bound cargo  containers at over 600 foreign seaports remains largely unproven. CBP  and DOE have been successful in integrating images of scanned containers  onto a single computer screen that can be reviewed remotely from the  United States and have also been able to use these initial ports as a test  bed for new applications of existing technology, such as mobile radiation  scanners. However, the SFI ports’ level of participation, in some cases, has  been limited in terms of duration or scope. While 54 to 86 percent of the  U.S.-bound cargo containers, on average, were scanned at 3 comparatively  low volume ports that are responsible for less than 3 percent of container  shipments to the United States, CBP has not been able to achieve  sustained scanning rates above 5 percent at 2 comparatively larger ports— the type of ports that ship most containers to the United States. Scanning  operations at the initial SFI ports have encountered a number of  challenges, such as logistical problems with containers transferred from  rail or other vessels, and CBP officials are concerned that they and the  participating ports cannot overcome them.
CBP has developed two initiatives related to SFI for improving container  security; however, challenges remain as neither initiative will enable CBP  to fully achieve the 9/11 Act requirement to scan 100 percent of all U.S.- bound cargo by July 2012. The first initiative, the “strategic trade corridor  strategy,” involves scanning 100 percent of U.S.-bound containers at  selected foreign ports where CBP believes it will mitigate the greatest risk  of weapons of mass destruction (WMD) entering the United States. The  Secretary of Homeland Security approved this strategy and, according to  CBP, is in negotiations with foreign governments to expand SFI to ports in  those countries. The second initiative, known as “10+2”, requires  importers to provide 10 data elements and vessel carriers to provide 2 data  elements on containers and their cargo to CBP, which provides further  information to CBP, thus, improving its ability to identify containers that  may pose a risk of containing WMD for additional scrutiny—such as  scanning or physical inspection. Based on discussions with DHS and CBP  officials, it is unclear whether DHS intends for the strategic trade corridor  strategy and 10+2 to be implemented in lieu of the 100 percent scanning  requirement or whether it is the first phase of implementation. While these  initiatives may collectively improve container security, they will not  enable CBP to fully achieve the 9/11 Act requirement to scan 100 percent  of U.S.-bound containers by July 2012. According to CBP, it does not have  a plan for fully implementing the scanning requirement by this date  because it questions the feasibility; however, it has not performed a  feasibility analysis of expanding 100 percent scanning, as required by the  SAFE Port Act. To address this, in October 2009, we recommended that  CBP conduct a feasibility analysis of implementing 100 percent scanning  and provide the results, as well as alternatives to Congress, in order to  determine the best path forward to strengthen container security. CBP  concurred with our recommendation. Further, senior DHS and CBP  officials acknowledge that most, if not all foreign ports, will not be able to  meet the July 2012 target date for scanning all U.S.-bound cargo. As a  result, DHS has recently decided to grant a blanket extension to all foreign  ports, thus extending the target date for compliance with this requirement  by 2 years, to July 2014.
section_title: TSA and the Coast Guard Took Steps to Enroll Transportation Workers into the TWIC Program by the Mandated Deadline, but Challenges in Program Scheduling and Evaluation May Hinder the TWIC Reader Pilot’s Usefulness
paragraphs: In November 2009 we reported that, based on lessons learned from its  early experiences with enrollment and activation, TSA and its contractor  took steps to prepare for a surge in TWIC enrollments and activations as  local compliance dates approached. For example, according to TSA and  port facility representatives, TSA and its contractor increased enrollment  center resources, such as increasing the number of enrollment and  activation stations to meet projected TWIC user demands. Likewise, the  Coast Guard employed strategies to help the maritime industry meet the  TWIC national compliance date while not disrupting the flow of  commerce. As a result of these efforts, TSA reported enrolling 1,121,461  workers in the TWIC program, or over 93 percent of the estimated 1.2  million users, by the April 15, 2009 deadline.
Although most workers received their TWICs, TSA data show that some  workers experienced delays in receiving TWICs. Among the reasons for  the delays was that a power failure occurred in October 2008 at the  government facility that processes TWIC data that caused a hardware  component failure in the TWIC enrollment and activation system for  which no replacement component was on hand. In our November 2009  report on TWIC, we made recommendations to TSA to expedite the  development of contingency and disaster recovery plans and system(s).  DHS stated it is taking steps to address this recommendation and future  potential TWIC system failures by developing a system to support disaster  recovery by 2012. While DHS’s efforts are a positive step, until they are  complete, TWIC systems remain vulnerable to similar disasters.
In response to our 2006 recommendation and a SAFE Port Act  requirement, TSA initiated a pilot in August 2008 known as the TWIC  reader pilot, to test TWIC-related access control technologies. The pilot  is expected to test the viability of selected biometric card readers for use  in reading TWICs within the maritime environment and test the technica l  aspects of connecting TWIC readers to access control systems. The results  of the pilot are expected to inform the development of the card reader rule  requiring TWIC readers for use in controlling access at MTSA regulated  vessels/facilities. Based on the August 2008 pilot initiation date, the card  reader rule is to be issued no later than 24 months from the initiation of  the pilot, or by August 2010.
Although TSA has made significant progress to incorporate best practices  into TWIC’s schedule for implementing the reader pilot program,  weaknesses continue to exist that limit TSA’s ability to use the schedule as  a management tool to guide the pilot and accurately identify the pilot’s  completion date. In response to limitations that we identified, the program  office developed a new TWIC pilot master schedule in March 2009, and  updated it in April 2009, and again in May 2009. The pilot schedule went  from not meeting any of the nine scheduling best practices in September  2008 to fully addressing one of the practices, addressing seven practices to  varying degrees, and not addressing one practice. While TSA has  improved its technical application of program scheduling practices on the  TWIC reader pilot program, as of May 2009, weaknesses remain that may  adversely impact its usefulness as a management tool. For example, the  schedule does not accurately reflect all key pilot activities or assign  resources to those activities. To address these weaknesses, in our  November 2009 report we recommended that TSA, in concert with pilot  participants, fully incorporate best practices for program scheduling in the  pilot. TSA concurred in part with our recommendation. In addition,  shortfalls in TWIC pilot planning have presented a challenge for TSA and  the Coast Guard in ensuring that the pilot is broadly representative of  deployment conditions. This is in part because an evaluation plan that  fully identifies the scope of the pilot and the methodology for collecting  and analyzing the information resulting from the pilot has not been  developed. Agency officials told us that no such evaluation plan was  developed because they believe that the existing pilot documentation  coupled with subject matter expertise would be sufficient to guide the  pilot. However, our review of the TWIC pilot highlights weaknesses that  could be rectified by the development and use of an evaluation plan. To  address this, in November 2009, we recommended that TSA and the Coast  Guard develop an evaluation plan to help ensure that needed information  on the use of biometrics readers will result from the pilot. DHS concurred  and discussed actions to implement the recommendation, but it is too  early to determine if the intended actions will fully address the intent of  the recommendation.
section_title: DHS and Coast Guard Have a Strategy and Programs in Place, but Identifying and Preventing Small Vessel Attacks Remains a Challenge
paragraphs: While DHS and the Coast Guard have developed a strategy and programs  to reduce the risks associated with small vessels, they face ongoing  challenges in tracking small vessels and preventing attacks by such  vessels. In April 2008, DHS issued its Small Vessel Security Strategy and  is now in the process of developing and reviewing a more detailed  implementation plan. After review by the Coast Guard and CBP, the draft  plan was forwarded to DHS on September 18, 2009 with a  recommendation for approval, but DHS has not yet issued a final decision.  As part of its effort to improve security in the maritime domain, the Coast  Guard is also implementing two major unclassified systems to track a  broad spectrum of vessels. While these systems use proven technologies,  they depend on the compliance of vessel operators to carry equipment  needed to interact with these systems and to make sure the systems are  turned on and functioning properly. These systems, however, generally  cannot track small vessels. The Coast Guard and other agencies have other  systems, though—which can include cameras and radars—that can track  small vessels within ports, but these systems are not installed at all ports,  and do not always work in bad weather or at night. In addition, the Coast  Guard and other agencies, such as the New Jersey State Police, have  several programs in place to address risks from small vessels, such as  outreach efforts to the boating community to share threat information.  However, the Coast Guard program faces resource limitations. For  example, the Coast Guard’s program to reach out to the boating  community for their help in detecting suspicious activity, America’s  Waterway Watch, lost the funding it received through a Department of  Defense readiness training program for military reservists in fiscal year  2008. Now it must depend on the activities of the Coast Guard Auxiliary, a  voluntary organization, for most of its outreach efforts. Even with systems  in place to track small vessels, there is widespread agreement among  maritime stakeholders that it is very difficult to detect threatening activity  by small vessels without prior knowledge of a planned attack.
section_title: Aviation Security
subsections: section_title: TSA Has Made Progress in Meeting the Air Cargo Screening Mandate, but Still Faces Participation, Technology, Oversight, and Inbound Cargo Challenges
paragraphs: As we previously reported in March 2009, TSA has taken several key steps  to meet the air cargo screening mandate of the 9/11 Act as it applies to  domestic cargo. TSA’s approach involves multiple air cargo industry  stakeholders sharing screening responsibilities across the air cargo supply  chain. According to TSA officials, this decentralized approach is expected  to minimize carrier delays, cargo backlogs, and potential increases in  cargo transit time, which would likely result if screening were conducted  primarily by air carriers at the airport. The specific steps that TSA has  taken to address domestic air cargo screening include the following:    Revised air carrier security programs: Effective October 1, 2008,  TSA established a requirement for 100 percent screening of nonexempt  cargo transported on narrow-body passenger aircraft. Effective  February 1, 2009, TSA also required air carriers to ensure the screening  of 50 percent of all nonexempt air cargo transported on all passenger  aircraft. Furthermore, effective February 2009, TSA revised or  eliminated most of its screening exemptions for domestic cargo.
Created the Certified Cargo Screening Program (CCSP): TSA  created a voluntary program to allow screening to take place earlier in  the shipping process and at various points in the air cargo supply  chain—including before the cargo is consolidated. In this program, air  cargo industry stakeholders—such as freight forwarders and  shippers—voluntarily apply to become certified cargo screening  facilities (CCSF). CCSFs in the program were required to begin  screening cargo as of February 1, 2009.
Issued an interim final rule: On September 16, 2009, TSA issued an  interim final rule, effective November 16, 2009, that among other  things, codifies the statutory air cargo screening requirements of the  9/11 Act and establishes requirements for entities participating in the  CCSP.
Established the Air Cargo Screening Technology Pilot: To  operationally test explosives trace detection (ETD) and X-ray  technology among CCSFs, TSA created the Air Cargo Screening  Technology Pilot in January 2008, and selected some of the largest  freight forwarders to use the technologies and report on their  experiences. This pilot is ongoing, with an anticipated end date of  August 2010, and the results have not yet been finalized.
Expanded its explosives detection canine program: To assist air  carriers in screening cargo, TSA has taken steps to expand the use of  TSA-certified explosives detection canine teams. TSA now has 120  allocated canine teams dedicated to air cargo screening at 20 major  airports.
While these steps are encouraging, TSA faces several challenges in  meeting the air cargo screening mandate. First, although industry  participation in the CCSP is vital to TSA’s approach to move screening  responsibilities across the supply chain, the voluntary nature of the  program may make it difficult to attract program participants needed to  screen the required levels of domestic cargo. Attracting certified cargo  screening facilities (CCSF) is important because much cargo is currently  delivered to air carriers in a consolidated form and the requirement to  screen individual pieces of cargo will necessitate screening earlier in the  air cargo supply chain. However, there are concerns about potential  program costs, including acquiring expensive technology, hiring additional  personnel, conducting additional training, and making facility  improvements.
Second, while TSA has taken steps to test technologies for screening and  securing air cargo, it has not yet completed assessments of the  technologies it plans to allow air carriers and program participants to use  in meeting the August 2010 screening mandate. According to TSA officials,  the agency has conducted laboratory assessments and plans to complete  operational testing of X-ray technologies by late 2009, and laboratory and  operational testing of explosives trace detection technology by August  2010. However, these technologies, which have not yet been fully tested  for effectiveness, are currently being used by industry participants to meet  air cargo screening requirements.
Third, TSA faces challenges overseeing compliance with the CCSP due to  the size of its current Transportation Security Inspector (TSI) workforce.  Under the CCSP, in addition to performing inspections of air carrier and  freight forwarders, TSIs are to also perform compliance inspections of  new regulated entities that voluntarily become CCSFs, as well as conduct  additional CCSF inspections of existing freight forwarders. TSA officials  have stated that there may not be enough TSIs to conduct compliance  inspections of all the potential CCSFs once the program is fully  implemented by August 2010. Until TSA completes its staffing study, TSA  may not be able to determine whether it has the necessary staffing  resources to ensure that entities involved in the CCSP are meeting TSA  requirements to screen and secure air cargo.
Finally, TSA has taken some steps to meet the screening mandate as it  applies to inbound cargo but does not expect to achieve 100 percent  screening of inbound cargo by the August 2010 deadline. TSA revised its  requirements to, in general, require carriers to screen 50 percent of  nonexempt inbound cargo. TSA also began harmonization of security  standards with other nations through bilateral and quadrilateral  discussions. In addition, TSA continues to work with CBP to leverage an  existing CBP system to identify and target high-risk air cargo. However,  TSA does not expect to meet the mandated 100 percent screening level by  August 2010. This is due, in part, to existing inbound screening  exemptions, which TSA has not reviewed or revised, and to challenges  TSA faces in harmonizing the agency’s air cargo security standards with  those of other nations. Moreover, TSA’s international inspection resources  are limited. We will continue to explore these issues as part of our ongoing  review of TSA’s air cargo security efforts, to be issued next year.
section_title: TSA Has Taken Actions to Strengthen Airport Security, but Faces Challenges in Assessing Risk, Evaluating Worker Screening Methods, Addressing Airport Technology Needs, and Developing a National Strategy for Airport Security
paragraphs: In our September 2009 report on airport security, we reported that TSA  has implemented a variety of programs and protective actions to  strengthen the security of commercial airports. For example, in March  2007, TSA implemented a random worker screening program—the  Aviation Direct Access Screening Program (ADASP)—nationwide to  enforce access procedures, such as ensuring that workers do not possess  unauthorized items when entering secured areas. In addition, TSA has  expanded requirements for background checks and the population of  individuals who are subject to these checks, and has established a  statutorily directed pilot program to assess airport security technology.  In 2004 TSA initiated the Airport Access Control Pilot Program to test,  assess, and provide information on new and emerging technologies,  including biometrics. TSA issued a final report on the pilots in December  2006.
As we reported in September 2009, while TSA has taken numerous steps to  enhance airport security, it continues to face challenges in several areas,  such as assessing risk, evaluating worker screening methods, addressing  airport technology needs, and developing a unified national strategy for  airport security. For example, while TSA has taken steps to assess risk  related to airport security, it has not conducted a comprehensive risk  assessment based on assessments of threats, vulnerabilities, and  consequences, as required by DHS’s National Infrastructure Protection  Plan . To address these issues, we recommended, among other things, that  TSA develop a comprehensive risk assessment of airport security and  milestones for its completion, and evaluate whether the current approach  to conducting vulnerability assessments appropriately assesses  vulnerabilities. DHS concurred with these recommendations.
Further, to respond to the threat posed by airport workers, the  Explanatory Statement accompanying the DHS Appropriations Act, 2008,  directed TSA to use $15 million of its appropriation to conduct a pilot  program at seven airports to help identify the potential costs and benefits  of 100 percent worker screening and other worker screening methods. In  July 2009 TSA issued a final report on the results and concluded that  random screening is a more cost-effective approach because it appears  “roughly” as effective in identifying contraband items at less cost than 100  percent worker screening. However, the report also identified limitations  in the design and evaluation of the program and in the estimation of costs.  Given the significance of these limitations, we reported in September 2009  that it is unclear whether random worker screening is more or less cost- effective than 100 percent worker screening. In addition, TSA did not  document key aspects of the pilot’s design, methodology, and evaluation,  such as a data analysis plan, limiting the usefulness of these efforts. To  address this, we recommended that TSA ensure that future airport security  pilot program evaluation efforts include a well-developed and well- documented evaluation plan, to which DHS concurred.
Moreover, although TSA has taken steps to develop biometric worker  credentialing, it is unclear to what extent TSA plans to address statutory  requirements regarding biometric technology, such as developing or  requiring biometric access controls at airports, establishing  comprehensive standards, and determining the best way to incorporate  these decisions into airports’ existing systems. To address this issue, we  have recommended that TSA develop milestones for meeting statutory  requirements for, among other things, performance standards for  biometric airport access control systems. DHS concurred with this  recommendation.
Finally, TSA’s efforts to enhance the security of the nation’s airports have  not been guided by a national strategy that identifies key elements, such as  goals, priorities, performance measures, and required resources. To better  ensure that airport stakeholders take a unified approach to airport  security, we recommended that TSA develop a national strategy that  incorporates key characteristics of effective security strategies, such as  measurable goals and priorities, to which DHS concurred.
section_title: Cybersecurity
subsections: section_title: DHS Has Made Progress in Strengthening Cybersecurity, but Further Actions are Warranted
paragraphs: Federal law and policy establish DHS as the focal point for efforts to  protect our nation’s computer-reliant critical infrastructures. Since 2005,  we have reported that DHS has not yet fully satisfied its key  responsibilities for protecting these critical infrastructures and have made  recommendations for DHS to address in key cyberscurity areas, to include  the five key areas shown in table 1.
DHS has since developed and implemented certain capabilities to satisfy  aspects of its responsibilities, but the department has not fully  implemented our recommendations and, thus, further action needs to be  taken to address these areas. For example, in July 2008, we reported that  DHS’s United States Computer Emergency Readiness Team did not fully  address 15 key attributes of cyber analysis and warning capabilities related  to four key areas. As a result, we recommended that the department  address shortfalls in order to fully establish a national cyber analysis and  warning capability. DHS agreed in large part with our recommendation.  Similarly, in September 2008, we reported that since conducting a major  cyber attack exercise, called Cyber Storm, DHS had demonstrated  progress in addressing eight lessons it had learned from these efforts, but  its actions to address the lessons had not been fully implemented.   Consequently, we recommended that DHS complete corrective activities  to strengthen coordination between public and private sector participants  in response to significant cyber incidents. DHS concurred with our  recommendation and has made progress in completing some identified  activities.
We also testified in March 2009 on needed improvements to the nation’s  cybersecurity strategy. In preparing for that testimony, we obtained the  views of experts (by means of panel discussions) on critical aspects of the  strategy, including areas for improvement.
The experts, who included former federal officials, academics, and private  sector executives, highlighted 12 key improvements that are, in their view,  essential to improving the strategy and our national cybersecurity posture.  The key strategy improvements identified by these experts are listed in  table 2.
These recommended improvements to the national strategy are in large  part consistent with our previous reports and extensive research in this  area. Until they are addressed, our nation’s most critical federal and  private sector cyber infrastructure remain at unnecessary risk to attack  from our adversaries.
Mr. Chairman, this concludes my statement for the record.
section_title: GAO Contacts and Staff Acknowledgements
paragraphs: For questions about this statement, please contact Cathleen A. Berrick at  202-512-8777, or berrickc@gao.gov. For further information regarding  maritime security issues, please contact Stephen L. Caldwell at 202-512- 9610, or caldwells@gao.gov. For further information regarding aviation  security issues, please contact Stephen M. Lord at 202-512-4379, or  lords@gao.gov. For further information regarding cybersecurity issues,  contact David A. Powner at 202-512-9286, or pownerd@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement.
section_title: Acknowledgments
paragraphs: In addition to the contacts named above, Christopher Conrad, Assistant  Director, managed this review. Jonathan Bachman, Dave Bruno, Lisa  Canini, Joseph Cruz, Michael Gilmore, Barbara Guffy, Lemuel Jackson,  Steve Morris, Robert Rivas, Yanina Golburt Samuels, and Rebecca  Kuhlmann Taylor made significant contributions to the work. Frances  Cook, Geoffrey Hamilton, Tom Lombardi, and Jan Montgomery provided  legal support. Linda Miller provided assistance in testimony preparation.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.